This is my interpretation of:
• When Part 11 is required
• What Part 11 is asking for
• How PIs, IRBs, and their IT Support team can work together in meet Part 11 requirements
The goal of this piece is to provide my interpretation and analysis of Part 11 and how IRBs, PIs, and the IT support team can work together in applying it to HHS-regulated Human Subject Research (HSR). You can also just skip all this below and just view the power point presentation below:
Getting Your Platform Part 11 Compliant
Background Information
21 CFR Part 11 is not new to research. It actually became effective way back in 1997. However, with rapidly evolving technology and the sudden shift in research going virtual due to COVID-19, researchers are scrambling to move in person interventions and informed consent online. Prior to that, in 2019, HHS revised the Common Rule (45 CFR 46) in many ways- one of which was how signatures could be obtained. The “Revised Common Rule” now allowed researchers to, in some (not all cases) treat wet signatures the same as electronic signatures. Unfortunately, some of the Revised Common Rule changes were not carried over into similar regulations held by the FDA (21 CFR 56). That means that if a study is not FDA-regulated, researchers only need to focus on one set of regulations. That also means that if a HHS-regulated study is also FDA-regulated (often found in clinical trials), two different requirements for electronic signature (and electronic records) apply. Part 11 is the FDA’s Guidance on how to meet these requirements.
Part 11 Involves a Lot of Technical Stuff. Does the IRB Have to Get Involved?
(What Needs Done and Who Does What?)
Getting compliant requires the collaborative effort of the study team and Sponsor, IT support team, and the IRB. However, because the requirements largely involve technical documentation, validation, and testing, there is a lot of confusion as to who does what and how they go about doing it in order to get their platforms and software used in research compliant with Part 11. Some IRBs may believe that getting Part 11 compliant is a job entirely up to the IT office of the institution. Similarly, some IT support teams attempt to meet all the technical requirements, but assume the rest (processes and procedures) are up to the IRB and study team, leaving gaps in human subject protections. Sponsors may even push all the responsibilities on the study team. This makes for a frustrating, and oftentimes, overly complicated and time-consuming activity that prevents research from getting started in a timely manner.
The following table describes (my interpretation of) what must be addressed and documented in the research procedures when preparing the platform/software for Part 11 compliance, as well as who takes on what role to make that all happen:
| Documentation Item | Description | PI / Study Team/Sponsor | IRB | IT Support | |
| 1 | Validation | Documenting procedures for internal and external auditors to show how the system can be trusted (how it’s accurate, reliable, shows consistently performing as intended, and able to discern invalid or altered records) | (i) Follow IT guidance; (ii) document on IRB Application and study files how this will be done | Ensure description is on the IRB Application | Provide guidance to PI on how this can be done |
| 2 | Record Maintenance and Retention | Making sure all electronic records can be provided in language and format that humans (not just computers) understand | (i) Follow IT guidance; (ii) document in study files how this will be done | N/A | Provide guidance to PI on how this can be done |
| 3 | System Access | Ensuring only authorized individuals have access to the system | (i) Follow IT guidance; (ii) document on IRB Application and study files how this will be done | Ensure description is on the IRB Application | Provide guidance to PI on how this can be done |
| 4 | Record Retention (Storage and Maintenance) | Protecting documentation and making it readily available if needed for auditing or other reasons, as well as stored for the required duration | (i) Follow IT guidance; (ii) document on IRB Application and study files how this will be done | Ensure storage and maintenance duration and procedures are on IRB application | Provide guidance to PI on how this can be done |
| 5 | Study Personnel Roles and Accountability | Holding individuals accountable for their actions related to electronic records and signatures | Document in study files how this will be done | Review of study personnel qualifications and training, and description of study team roles is on IRB Application | N/A |
| 6 | Workflows | Making sure (via operational system checks) electronic workflows function correctly and as expected | (i) Follow IT guidance; (ii) document in study files how this will be done | N/A | Provide guidance to PI on how this can be done |
| 7 | Authority Checks | Limiting user access (at both system and record level) and verifying each user only performs their authorized function(s) | (i) Follow IT guidance; (ii) document on IRB Application and study files how this will be done | Review of (i) Protocol Application, (ii) study personnel qualifications and training, and (iii) description of study team roles is on IRB Application | Provide guidance to PI on how this can be done |
| 8 | Study Team Qualifications | Confirming study team qualifications and training are complete and relevant | (i) Follow IT guidance; (ii) document on IRB Application and study files how this will be done | Review of (i) study personnel qualifications and training, and (ii) description of study team roles is on IRB Application | N/A |
| 9 | Device Checks | Verifying the validity of source of data input and proper operational functions | (i) Follow IT guidance; (ii) document in study files how this will be done | N/A | Provide guidance to PI on how this can be done |
| 19 | Document Control | Control of documents for system operation and maintenance, including preservation of complete history of changes made to these documents | (i) Follow IT guidance; (ii) document in study files how this will be done | N/A | Provide guidance to PI on how this can be done |
Some hints, tips, and resources:
- For more information on getting various platforms compliant, I found this video really helpful.
- There is no such thing as an “out of the box” compliant software, so start talking to your Sponsor, IRB, and IT support team early in the research planning phase (don’t wait until the last minute or you may end up delaying the start of research).
- UCSF had a great guidance on getting compliant on their website.