21 CFR Part 11: Records and Signatures

What is 21 CFR Part 11?

21 CFR Part 11 is the US Food and Drug Administration’s regulation on specified electronic records and electronic signatures. It sets criteria for their trustworthiness, reliability and use in place of certain paper records and handwritten signatures.

Which records are in scope?

Scope depends on the underlying predicate rules: the FDA requirements that require records to be kept or submitted. Part 11 can apply to records maintained electronically in place of required paper records and relevant electronic submissions. It does not apply to every document merely because a healthcare or life-sciences organization uses it.

The FDA’s scope-and-application guidance explains its interpretation and enforcement approach. That guidance does not erase the underlying predicate-rule duties, and a general electronic-signature law does not replace FDA-specific requirements.

What kinds of controls does it address?

The current regulation includes system and procedural requirements, with controls concerning:

• Records: appropriate system validation, accurate copies, protection and retrievability.
• Access and changes: authorized access, applicable operational checks and time-stamped audit trails.
• People and procedures: training, accountability and control of system documentation.
• Signatures: individual identity, signature controls, displayed signing information and linkage to the record.

Signature manifestations include the signer’s name, signing date and time, and the meaning of the signature, such as approval or responsibility. The required implementation must be assessed for the actual records and intended use; a visible mark or completion report alone does not establish compliance.

Closed versus open systems

A closed system is one where access is controlled by those responsible for the record content. An open system lacks that control and has additional requirements appropriate to its risks. “Closed” does not simply mean offline, and a cloud service is not automatically an open system.

How does Part 11 differ from other signing rules?

HIPAA concerns covered health-information responsibilities, while the ESIGN Act addresses electronic records and signatures in covered transactions. Neither substitutes for an applicable FDA requirement. The organization must establish scope, controls and retained evidence; a generic vendor badge is not an FDA determination that its whole process complies.