If you’ve taken General Chemistry or Physics at any point, you are probably familiar with “systems” as referred to in thermodynamics. It is the study of energy and matter transfer that occurs in molecules or a collection or network of molecules. In Thermodynamics, an open system means both energy and matter can flow into and out of the system. For a closed system, matter cannot flow into and out of the system but heat energy can flow out of or into the system. There is a third called an isolated system which consists of a closed, often well-insulated container. For it, nothing can enter or leave the system.

Now, with that out of the way, let’s focus on what open and closed systems are within the pharmaceutical industry and begin the conversation to establish best practices for data integrity and data connectivity.

The terms “Open Systems” and “Closed Systems” stated in most business settings often make reference to operational data-housing processes and platforms (SOPs, equipment, etc.) used to manage the creation, storage, and transfer of data either into or out of the business or the “Systems” established by the business. These systems are also used to maintain records of past, present, and future data collection procedures performed by the business. The main focus for entities such as IT and Pharmaceutical groups; for instance, would be how these systems support and improve protocols related to security, confidentiality, data integrity AND data connectivity.

The focus in open systems is everything required in closed systems with the additional focus on authenticity, integrity, confidentiality, and irrefutability

For pharmaceutical companies – what does this look like?

Open system – “means an environment in which system access is not controlled by persons who are responsible for the content of electronic records that are on the system.” – FDA Sec. 11.30 Definitions; (9)

An open system is a system where data can reside for any given period of time on a system that is outside the control of the organization that owns the data. Think of it this way, “A new biotech company has a website commissioned by a web design company who manages all data; including GxP data, for the biotech company. Also, think about systems where user access is NOT controlled by the same individuals generating and responsible for its contents. This could be apparent in outsourcing situations where data is transferred to the requesting company by another entity.

Closed system – “means an environment in which system access is controlled by persons who are responsible for the content of electronic records that are on the system.” – FDA Sec. 11.10. Definitions; (4)

According to the 21 CFR Part 11.10, “companies who use closed systems to create, modify, maintain, or transmit electronic records shall employ procedures and controls designed to ensure the authenticity, integrity, and, when appropriate, the confidentiality of electronic records, and to ensure that the signer cannot readily repudiate the signed record as not genuine.”

So how does this break down into a more digestible format so you can begin implementing 21 CFR Part 11 in your workflows? Here are several questions you should ask yourself (to start) to ensure your procedures and controls in a closed system are compliant:

• Are your systems and equipment used in those systems validated to ensure reliability, accuracy, and consistency? Can you prove that? If so, how?
• Do you have and can you provide readied access to complete and accurate data?
• Are your records safe and uncompromised for the long-term?
• Who has access now and, in the case of data review or an audit, who will have access later?
• Are you already implementing or will-implement a transition from paper-based record keeping to electronic records?
• Will your systems and processes include required acknowledgement of events as needed?
• Are authority checks/sign-offs in place? What does your current process look like?
• Are qualified and capable individuals positioned to develop, maintain and operate present systems?
• What do accountability measures and practices look like?

For individuals or companies using open systems, take note that open systems are subject to the same guidelines as closed systems PLUS the requirement of ensuring record authenticity (through document encryption & digital signature), record integrity, confidentiality, and irrefutability. There are more steps required in an open system to proactively ensure data integrity and data connectivity are not compromised. Essentially, the more the system can be affected or risk being altered by external entities the more scrutiny the system will undergo during an audit.

In short, if you are looking to produce and manufacture life-saving medicines for people, make sure every part of your process lives up to “life-saving” standards by ensuring relevant and complete data are not compromised.

This will be the first in a series of blog posts on topics surrounding 21 CFR Part 11, data integrity, and data connectivity so stay tuned by subscribing. Thanks for reading!

Sources:

U.S. Food and Drug Administration (FDA). (n.d.). CFR – Code of Federal Regulations Title 21 – Sec. 11.10 Controls for closed systems. Retrieved March 18, 2023, from https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?CFRPart=11&showFR=1

U.S. Food and Drug Administration (FDA). (n.d.). Part 11, Electronic Records; Electronic Signatures – Scope and Application. U.S. Food and Drug Administration. Retrieved March 20, 2023, from https://www.fda.gov/regulatory-information/search-fda-guidance-documents/part-11-electronic-records-electronic-signatures-scope-and-application

U.S. Food and Drug Administration (FDA). (n.d.). CFR – Code of Federal Regulations Title 21 – Sec. 11.30 Controls for open systems. CFR – Code of Federal Regulations Title 21. Retrieved March 19, 2023, from https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?fr=11.30