Title 21 CFR Part 11

Title 21 CFR Part 11

Thinking Cap goes above and beyond to deliver the LMS software and on-site support you need to craft your Title 21 CFR Part 11 strategy.

What is Title 21 CFR Part 11?

This section of the Code of Federal Regulations deals with Food and Drug Administration (FDA) guidelines on electronic records and electronic signatures in the US. It defines the criteria under which electronic records and electronic signatures are considered to be trustworthy, reliable and equivalent to paper records.

What does it mean?

Organizations like pharmaceutical, medical supply and healthcare providers that fall under the 21 CFR Part 11 guidelines need to take extra precautions when using an LMS to disseminate information. Part 11 requires that both procedural controls (e.g. notification, training, SOPs, administration), and administrative controls are put in place by the user, in addition to the technical controls that a vendor can offer.

What does Thinking Cap do?

While no vendor can offer a turnkey 21 CFR “Part 11-compliant system,” Thinking Cap has the technology, software and expertise to help your organization stay within these guidelines. See below for specific details.

Section Requirement Thinking Cap LMS Feature
11.10 (b) The system shall generate accurate and complete copies of records in human readable and electronic form suitable for inspection, review and copying Thinking Cap LMS presents standard and custom reports in both Screen and downloadable form. Downloaded reports are available as PDF or in CSV.
11.10 (d) The system shall limit system access to authorized individuals. All parts of the application are access controlled by username and password. Each account is given roles and permissions that limit the functions and data the account is able to access. Thinking Cap allows for additional security tailored for the 21 CFR Part 11 environment including, uniqueness of passwords, encrypted passwords, enforcement of strong password selection and automatic password expiry. Under these hardened parameters users cannot request a lost password but rather can regenerate a password after either correctly answering personal questions or offline authentication. This enhanced security will also allow for automatic account locking for multiple failed attempts and recording of IP address for all accesses.
11.10 (e) The system shall employ secure, computer-generated date/time stamped audit trails to independently record operator entries and actions that create, modify, or delete electronic records, without obscuring previously recorded information. Every action performed by the LMS is written to the log which records each action, when it occurred and who made the user was. In the case of clients’ using PKI Signatures for users the log contains the personal signature of the user. This log can be exported to CSV.
11.10 (f) The system shall enforce required steps and events sequencing, as appropriate (e.g., key steps cannot be bypassed or similarly compromised). The application controls each procedure from adding a user, to enrollments, to creation of a new Course. Between course and competency map access is controlled via Domain Enrollment and Prerequisites. Within the course and competency map themselves each step is governed by Sequencing rules enforced by the LMS. Sensitive Course and Learning Paths can have access controlled by a second layer of Administrative log in to provide onsite verification of a users identity and the security of that users log in point.
11.10 (g) The system shall ensure that only authorized individuals can use the system, electronically sign a record, access the operations or computer system input or output device, alter a record, or perform the operation at hand. Every function of the LMS is defined as a permission. Roles are created as groupings of permissions and each user is given some combination of roles and individual permissions. Layered onto this is the segmenting of Domains and SubDomains that further limit a user’s access based on their Domain membership and role in that Domain.
11.10 (h) (1) The system shall determine, as appropriate, the validity of the source of data input or operational instruction. The system will not accept connections and therefore commands or data from unauthenticated sources or authenticated sources where the IP address of a command doesn’t match the originally authenticated access for a given session. In a hardened environment LMS will only communicate over HTTPS thereby removing the possibility for a third party to modify data being transmitted.
11.50 (a) (1), (2), (3) The system shall ensure all signed electronic records contain the printed name of the signer, date/time signature was executed, and the meaning associated with the signature (e.g. approval, responsibility, authorship). The meaning of the signature is the action performed and recorded in the Log. Thinking Cap stores this information along with the Full Name and account Username of the signatory.
11.50 (b) The system shall ensure the three signature elements (described in the previous requirement) of a signed electronic record are a part of any human readable form of the electronic record (e.g. electronic display or printout). The three signature items are included in all audit trail reports.
11.70 (a) The system shall ensure electronic signatures are linked to their respective electronic records and that these electronic signatures cannot be excised, copied, or otherwise transferred to falsify an electronic record by ordinary means. Electronic Signature are linked and this link is protected by User Name and Password protection of the data store. A hash of the audit trail made at each point provides a detection system of tampering by even an authenticated user.
11.100 (a) The system shall ensure that each electronic signature is unique to one individual and shall not be reused by, or reassigned to, anyone else. Uniqueness of Username and Password is enforced by the system. This uniqueness survives even the expiry of an account. Inactive accounts and their records are never removed from the system.
11.200 (a) (1) The system shall employee at least two distinct identification components such as an identification code and a password. LMS employs username and password protect and enforces that the authenticated session maintains the continuity of IP address. Personal PKI based Digital Signatures are also an optional addition.
11.200 (a) (1) (i) The system require the use of all electronic signature components for the first signing during a single continuous period of controlled system access. All sessions begin with a digital signing. Additional signing may be required by more privileged / trusted users for access to defined materials where the in-person authentication of an individual is mandated as necessary i.e. tests and compliance learning.
11.200 (a) (1) (i) The system shall allow all subsequent signing during the same continuous period of controlled system access to use at least one electronic signature component. The system will continue to use the originating IP of each request after the first to maintain security of the session.
11.200 (a) (1) (i) The system shall ensure users are timed out during periods of specified inactivity. Time out in a 21 CFR Part 11 environment is enforce after 20 minutes of inactivity.
11.200 (a) (1) (ii) The system shall require the use of all electronic signature components for the signings not executed during a single continuous period of controlled system access. All Signing must be executed during a continues period of controlled system access.
11.200 (a) (3) The system shall require all attempted uses of an individual’s electronic signature by anyone other than its genuine owner to require collaboration of two or more individuals. No sharing of electronic signatures is permitted.
11.300 (a) The system shall require that each combination of identification code and password is unique, such that no two individuals have the same combination of identification code and password. The system will not allow duplication. Two hashes of both the username and password are kept for comparison purposes to maintain integrity without storing actual information unencrypted.
11.300 (b) The system shall require that passwords be periodically revised. In hardened mode for use in 21 CFR Part 11 environment,the system requires password changes every 30 days. This duration can only be reduced when operating in this mode.
11.300 (d) The system shall employ transaction safeguards preventing the unauthorized use of password and/or identification codes. LMS uses intrusion detection to identify fraudulent transactions. This includes multiple failed attempts at log in, log in from a large number of IP addresses and unusual activity in an account. The system will temporary suspend accounts and will require logged explanations of the activity by administrators including actions taken.
11.300 (d) The system shall detect and report unauthorized use of password and/or identification codes to specified units. All attempts to log in with a valid username and invalid password or a valid password and invalid username pair are highlighted in the log and alerted to administrators.

Ready to take the next step?

Book a demo