On March 15, 2023, the U.S. Food and Drug Administration (“FDA”) issued updated draft guidance, Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations–Questions and Answers (“Draft Guidance”). The Draft Guidance revamps earlier recommendations from 2017 regarding the requirements of 21 CFR Part 11 (“Part 11”) and the use of electronic technologies in clinical investigations.[i] Part 11 sets forth regulatory standards under which FDA considers electronic systems, electronic records, and electronic signatures to be trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on paper. FDA is requesting public comment on the Draft Guidance.

What does the Draft Guidance cover?

The Draft Guidance provides recommendations to regulated entities[ii] conducting certain clinical investigations.[iii] Specifically, guidance is outlined regarding the use of the following as part of clinical investigations:

• Electronic records;

• Electronic systems owned or controlled by sponsors or other regulated entities;

• Information Technology Service Providers (“ITSPs”) and IT services;

• Digital Health Technologies (“DHTs”); and

• Electronic signatures.[iv]

How does the Draft Guidance differ from previous agency guidance?

The Draft Guidance differs from previous agency guidance in four key ways. First, it addresses advances in technology since 2017. Second, guidance is provided concerning regulated entities’ use of ITSPs in clinical investigations. Third, FDA revises previous recommendations regarding the risk-based approach for validation of electronic systems. Finally, the Draft Guidance has a significantly bolstered glossary.

Advances in Technology. The Draft Guidance includes recommendations for the use and applicability of the following in clinical investigations:

• Audit trails;

• Biometric and multi-factor authentication;

• DHTs and remote applications;

• Metadata, including automated date and time stamps; and

• Signatures drawn with a finger or electronic stylus on an electronic system.

Use of ITSPs. Further, the Draft Guidance recognizes the increasingly prevalent use of ITSPs as part of clinical investigations and recommends that regulated entities:

• Enter into service level agreements with ITSPs;

• Evaluate and select ITSPs based on their ability to provide data integrity and data security safeguards that are relevant to the service provided;

• Document quality and risk management procedures related to the ITSP; and

• Record ongoing oversight of the ITSP.

Risk-Based Approach for Validation. The Draft Guidance updates previous recommendations concerning the risk-based approach for validation of electronic systems. The Draft Guidance focuses more on customized electronic systems than in previous guidance and recommends that:

• Sponsors[v] review a vendor’s standard operating procedures ("SOPs"), system and software development life cycle model, validation documentation, and change control procedures; and

• User acceptance testing ("UAT") is performed to ensure the customized system fulfills the intended purpose.

Updated Glossary. The Draft Guidance contains a greatly expanded glossary, covering new and revised definitions of terms related to electronic technologies in clinical investigations, such as: audit trails, certified copies, DHTs, ITSPs, metadata, and service level agreements.

Public Comments

FDA is requesting public comments on the Draft Guidance on or before May 15, 2023. Comments can be submitted online to Docket Number FDA-2017-D-1105 and should include “Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations–Questions and Answers” in the comment.

Paul Clowes, law clerk in the Greenville office, contributed to the drafting of this post.

[i] The Draft Guidance revises the 2017 document, Use of Electronic Records and Electronic Signatures in Clinical Investigations Under 21 CFR Part 11 — Questions and Answers. The Draft Guidance expands upon recommendations in the 2003 guidance document, Part 11, Electronic Records; Electronic Signatures — Scope and Application. When finalized, the Draft Guidance will supersede the 2007 guidance document, Computerized Systems Used in Clinical Investigations.

[ii] Regulated entities include sponsors, clinical investigators, institutional review boards ("IRBs"), contract research organizations ("CROs"), and other entities who must comply with FDA regulations when conducting clinical trials.

[iii] Clinical investigations of medical products, foods, tobacco products, and new animal drugs are covered by the Draft Guidance.  

[iv] Definitions for each of these bulleted items can be found in the Draft Guidance glossary, at pages 25–26.

[v] In certain clinical investigations, a sponsor may elect to transfer responsibility for any or all of its obligations to a CRO. In such a situation, the requirements that apply to a sponsor would apply to the CRO to the extent the CRO accepted responsibility for the sponsor’s obligations. See footnote 2 in Draft Guidance.