I.
Introduction: FlowJo and 21 CFR part 11 compliance
II.
Background
i.
Code of Federal Regulations
ii.
21 CFR part 11
III.
How to be 21 CFR compliant with FlowJo as currently configured
IV.
References
I. Introduction
This document
describes strategies for FlowJo software users to achieve 21 CFR Part 11
compliance while using the software as currently configured. FlowJo is software intended to be used for
the analysis of indexed data acquired by a flow cytometer or a similar piece of
equipment. The data analyzed with the
software is used by some clients in a clinical setting for research or
diagnostic purposes. In this context the
software must be used in a manner that conforms to the Code of Federal
Regulations (CFR), particularly Title 21, which details the Food and Drug
Administration’s (FDA) regulations. Anyone that produces food, drugs, blood, biologics or cosmetics is
required to follow the applicable subsections of these regulations to produce
products that are safe for the consumer. For example, pharmaceutical companies must follow Parts 58, 210 and 211,
the regulations for Good Manufacturing Processes (GMP) or Good Laboratory
Practices (GLP). Included in these
regulations is the requirement to document (or keep records of) company
compliance with these regulations. Part
11 of 21 CFR is the portion of this code that details how software can be used
to produce electronic documentation in place of paper documents. For our users convenience we have summarized
explanations of what the Code of Federal Regulations is, what CFR Part 11
Compliance means, and how FlowJo users can achieve compliance.
i. Code of Federal Regulations (CFR)
The Code
of Federal Regulations (CFR) is the set of rules published by the federal
government to regulate various businesses conducts. There are 50 sections, known as titles,
included in this tome which is reviewed yearly. Title 21 is the set of rules describing the Food, Drug and Cosmetics
Act, and the law enforcement body, the Food and Drug Administration (FDA) that
enforces this Act. CFR Title 21 has 1499
parts that deal with every aspect of discovering, preclinical cytotoxicity
testing, phase I, phase II, phase II manufacturing, inter-state commerce, etc.
food, drugs, biologics, blood, vaccines and cosmetics.
ii. 21 CFR Part 11
Part 11 of
the CFR Title 21 code regulates electronic records and electronic
signatures. It provides criteria for
acceptance by the FDA of electronic records, electronic signatures, and handwritten
signatures executed to electronic records as equivalent to paper records and
handwritten signatures on paper. To
summarize the rules, if one must maintain records for GMP/GLP, or must submit
records to the FDA and would like to do so electronically in place of on paper,
then the software used to create the electronic records must be Part 11
compliant. However, if one uses software
but creates paper documentation for GMP/GLP, then the software itself need not
be Part 11 compliant for the laboratory to do Part 11 compliant work.
The
complete text on the matter is reprinted here, obtained from the FDA Part 11
compliance recommendation document1. The FDA considers Part 11 to apply to:
§
Records
that are required to be maintained under predicate rule requirements and that
are maintained in electronic format in place of paper format. On the other hand, records (and any associated signatures)
that are not required to be retained under predicate rules, but that are
nonetheless maintained in electronic format, are not part 11 records. We
recommend that you determine based on the predicate rules, whether specific
records are part 11 records. We recommend that you document such decisions.
§
Records
that are required to be maintained under predicate rules, that are maintained
in electronic format in
addition to paper format, and that are relied on to perform
regulated activities. In some cases, actual business practices may dictate whether you
are using electronic records instead of paper records under § 11.2(a)
instead of the paper record. That is, the Agency may take your business
practices into account in determining whether part 11 applies. Accordingly, we recommend that, for each
record required to be maintained under predicate rules, you determine in advance
whether you plan to rely on the electronic record or paper record to perform
regulated activities. We recommend that you document this decision.
§
Records
submitted to FDA, under predicate rules in electronic format. However, a record
that is not itself submitted, but is used in generating a submission, is not a
part 11 record unless it is otherwise required to be maintained under a
predicate rule and it is maintained in electronic format.
§
Electronic
signatures that are intended to be the equivalent of handwritten signatures,
initials, and other general signings required by predicate rules. Part 11
signatures include electronic signatures that are used, for example, to
document the fact that certain events obscure previous entries.
This is a
general guideline; every CFR compliance scheme is unique based on the specific
research or manufacturing undertaken. The most common intersection of 21 CFR part 11 compliance and FlowJo use
are situations where FlowJo is being used to analyze clinical data or data used
in pharmaceutical manufacturing, and thus this is the general use case assumed
here. Using this case, the broad
regulations that must be met are four-fold. First, assure that all analysis has been performed by the appropriate
persons. Second, document all of the
analysis so that an audit trail is available and responsibility for all actions
is established. Third, establish a
record keeping system that protects the privacy of the patients. Finally,
establish company policies that mandate following compliance rules, appropriate
hiring practices, etc. To meet these
four general criteria and be 21 CFR part 11 compliant
a lab using FlowJo for cytometric analysis could:
1.
Apply
security measures to allow access to the FlowJo workspaces and FCS data to
approved users only. One possible
method of achieving this is to store all workspaces and data in a database that
requires a username and a password for access.
2.
Require
any user who accesses a workspace and modifies it to save the modified
workspace with an incremented version number to preserve an audit trail.
3.
Require
any user who accesses a workspace and modifies it to print up relevant layouts
and tables at the end of each session. The user must then sign and date the documents, and explain the
purpose of the work (such as review, approval, responsibility, or
authorship) associated with the signature.
4.
Store
the printed records as the primary audit trail. A system of crosschecking saved workspaces against printed record could
be established to demonstrate that the paper records are the primary
documentation. This relieves the
analysis software of the necessity of being Part 11 compliant because it
electronic records are not being used in lieu of paper records.
5.
Encode
any information that could be used to identify a patient within the FlowJo
workspace file.
6.
Establish
appropriate intra-company regulations for following these, or similar, step.
IV. References
1. Guidance for Industry: The FDA's recommendations for following the code
