[Docket No. 92N-0251] Published in the Federal Register of July 21,1992 (57 FR 32185) ___________________________________________________ DEPARTMENT OF HEALTH AND HUMAN SERVICES Food and Drug Administration 21 CFR Chapter I [Docket No. 92N-0251] Electronic Identification/Signatures; Electronic Records; Request for Information and Comments AGENCY: Food and Drug Administration ACTION: Advance notice of proposed rulemaking. SUMMARY: The Food and Drug Administration (FDA) is announcing that it is considering whether the agency should propose regulations that would, under certain circumstances, accept electronic identification or electronic signatures in place of handwritten signatures where signatures are called for in Title 21 of the Code of Federal Regulations (CFR), and where the electronic form of the signature bearing record is allowable by the regulations. The decision on whether to propose such regulations will be based on the information and comments submitted in response to this advance notice of proposed rulemaking, the recommendations and findings of the agency's Task Force on Electronic Identification/Signatures, and the agency's experience with alternatives to conventional handwritten signatures. DATES: Submit written information and comments by October 19, 1992. ADDRESSES: Submit written information and comments to the Dockets Management Branch (HFA-305), Food and Drug Administration, room 1-23, 12420 Parklawn Drive, Rockville, MD 20857. This document, together with the February 24, 1992 report of the agency's Electronic Identification/Signature Working Group, discussed elsewhere in this notice, is available (without references) via Internet and Bitnet by sending an electronic mail message to DOC00001@FDACD.BITNET. The sole purpose of this address is to automatically distribute the notice and report, by return electronic mail. Therefore, no other correspondence should be sent to the address, and there is no need to include text in the body or subject of the request message. The full report (in hard copy) may be ordered from National Technical Information Service (NTIS), U.S. Department of Commerce, 5285 Port Royal Rd., Springfield, VA 22161. Orders must reference NTIS order number PB 92-183193 and include payment of $50.00 (for paper copy: order number PB 92-183193 (A19)) or $19.00 (for microfiche: order number PB 92-183193 (A04)) for each copy of the document. Payment may be made by check, money order, charge card (American Express, VISA, or Mastercard), or billing arrangements made with NTIS. Charge card orders must include the charge card account number and expiration date. For telephone orders or further information on placing an order, call NTIS at 703-487-4650. The report is available for public examination in the Dockets Management Branch (address above) between 9 a.m. and 4 p.m., Monday through Friday. FOR FURTHER INFORMATION CONTACT: Paul J. Motise, Center for Drug Evaluation and Research (HFD-323), Food and Drug Administration, 7520 Standish Place, Rockville, MD 20855, 301-295-8089. Electronic mail address via MCI Telecommunications Corp. [MCI Mail: Name: Paul J. Motise, EMS: FDA, MBX:MOTISE, MBX:A1, MBX:FDACD. [For help in addressing format contact the MCI mail customer support line (1-800-444-6245)). SUPPLEMENTARY INFORMATION: The agency is aware that automated systems are being used more extensively in the various industries it regulates. Use of such systems is also expanding within the agency itself. An emerging objective of the use of automation is the implementation of paperless electronic records. Signatures are a key aspect of many records and the transition from paper records containing traditional handwritten signatures to paperless electronic records raises a set of issues relating to FDA acceptance of alternatives to handwritten signatures. Electronic records can contain human endorsements using various technologies. An alternative to the handwritten signature in such electronic records is termed an electronic identification/signature, for purposes of this document. The agency has met with members of the pharmaceutical industry who sought advice on how they could implement paperless records systems within regulations for 21 CFR Part 210--Current Good Manufacturing Practice in Manufacturing, Processing, Packing, or Holding of Drugs; General and 21 CFR Part 211--Current Good Manufacturing Practice Regulations for Finished Pharmaceuticals, i.e., CGMPs. Upon examining how the agency might accommodate such records and attendant endorsements by electronic identification/signature, FDA found the issues to be complex, affecting regulations beyond the CGMP area. For example, a review of Title 21 of the CFR found references to signatures in 132 different sections; a listing of these sections is contained in the report identified below. These regulations typically address signatures in manufacturing production records, clinical investigation records, and formal submissions to the agency. Absent, however, is a codified definition of signature itself. The same preliminary examination took note of the agency's own paperless electronic records which may contain electronic identifications/signatures. To identify the issues and develop preliminary approaches on how FDA might accept signature alternatives in an agency-wide manner, the agency formed an FDA Task Force on Electronic Identification/Signatures. The task force created a subgroup, the Electronic Identification/Signature Working Group to address the issues in greater detail. A copy of the group's initial report dated February 24, 1992 has been placed on file and is on display at the Dockets Management Branch (address above), for public examination; copies may be obtained NTIS (address above). The report recommended publication of an advanced notice of proposed rulemaking to obtain wide public comment on the issues to determine whether the agency should promulgate regulations that would, under certain circumstances, accept electronic identification/signatures in place of handwritten signatures where signatures are required by various FDA regulations. The agency is considering the use of electronic identification/signatures within the general context of three categories of current and future paperless (electronic) records: (1) Records maintained by industry which are subject to FDA inspection (e.g., batch production records for drug products, low acid canned foods, or infant formulas); (2) records submitted to FDA for review and approval, usually as part of research or marketing applications (e.g. new drug applications and food additive petitions); and, (3) FDA's own records (e.g. sample collection reports), and notifications to industry (e.g., electronic mail). The agency requests that comments address the issues within these three categories of records, and how these records may or may not lend themselves to the use of electronic identification/signatures. The agency wishes to clarify, however, that at this time it does not seek to mandate the conversion of paper records to electronic form. Although this notice pertains to records which are currently allowed by the regulations to be in electronic form, the issues related to electronic identification/signatures are germane to electronic records, in general. Therefore, the agency welcomes comments that identify any record now required by FDA that may be amenable to being in electronic form. The agency is aware of a variety of signature alternative technologies and will consider their acceptance according to their performance characteristics and the level of security they provide. The level of performance and security would be commensurate with the regulatory significance of the electronic record. The agency is seeking comments on how this stratified acceptance might be accomplished. For example, FDA might establish definitions which incorporate technological and security distinctions for the terms signature, signatures recorded electronically, electronic signature, and electronic identification. In the agency's experience, a signature is generally the name of an individual, handwritten in script by that individual; the act of signing usually involves use of a writing or marking instrument and provides a unique and secure link to the individual. Where such a signature is captured on electronic media instead of on paper, the result might be termed "signatures recorded electronically". The agency is aware of various technologies that dispense with the act of signing, but still apparently furnish an intrinsic biometric or behavioral link to an individual such that someone else cannot make use of that person's signature alternative (e.g., retinal scan systems, voice prints, hand prints). The agency is considering the term "electronic signatures" for such systems. Another type of signature alternative appears to lack intrinsic biometric or behavioral links to the person being identified, but instead relies upon administrative controls to maintain the uniqueness and security of the identification method. Examples of such signature alternatives are systems which use (individually, or in combination) bar codes, passwords/identification codes and personal identification devices (badges/cards). The agency is considering the term "electronic identification" for such systems. The agency requests comments on how the above, or other classes of signature alternatives would fulfill three general purposes of the traditional handwritten signature: (1) To identify the actor and show his/her authority to act; (2) to document the action in a way that is legally binding and cannot be altered or repudiated; and, (3) to create a record that would be admissible evidence in court. To be acceptable to the agency, electronic identification/signatures need to be as legally acceptable as conventional, handwritten signatures. The agency would have to conform to any acceptance criteria established by the courts. FDA expects electronic identification/signatures to carry the same commitment, legal weight, and significance as conventional handwritten signatures. Falsification of signature alternatives must be considered fraudulent to the same extent as is falsification of handwritten signatures. The agency is seeking specific comments on each of the following issues which are addressed in greater detail in the above referenced working group report: 1. Regulatory Acceptance. Various FDA regulations are worded in ways that do not accept signature alternatives. For example, the CGMP regulations for human and veterinary drugs do not anticipate or allow electronic identification/signature substitutes for handwritten signatures; 21 CFR 211.186 explicitly requires full handwritten signatures. Various submissions to the agency regarding medical devices must contain signatures; 21 CFR 1005.25 requires signatures to be written "in ink". On the other hand, the agency has accepted encoded computerized endorsements where the low acid canned food regulations call for identification of individuals who perform certain actions. The agency believes it would be beneficial to take a uniform approach to accepting signature alternatives and is seeking comments on how such an approach may be codified and how various records required by the regulations might lend themselves to the use of electronic identification/signatures. 2. Enforcement Integrity. Acceptance of signature alternatives must not hamper the agency's enforcement efforts. For example, FDA investigators must be able to obtain copies of electronic records which would be admissible evidence in regulatory actions to demonstrate individual responsibility. The agency conducted a review of relevant statutes and cases and found no court cases which clearly recognize the validity of signature alternatives. At the same time, no cases were found that would impede acceptance of signature alternatives. FDA's examination also disclosed several sections of Title 18 of the United States Code that FDA could use to pursue cases of electronic records falsification. (Details of the review are contained in the working group report.) The agency is particularly interested in comments on this aspect of adopting electronic identification/signatures. 3. Security. The agency is concerned that electronic identification/signatures be secure from abuse and falsification. Although FDA recognizes that virtually any system can be corrupted and defeated by individuals who are intent on falsification, substitutes for handwritten signatures should nonetheless be at least as secure as conventional handwritten signatures. The agency requests comments on how electronic identification/signatures can be secured. This issue is critical because of the ease with which some electronic identification methods can be falsified without leaving an audit trail. The agency seeks comments on whether some types of signature alternatives may be too insecure to accept at all, and if the agency should establish a stratified system whereby the regulatory significance of a given record would determine the level of security that would be necessary for a signature alternative. 4. Validation. The agency recognizes the importance of validation as a means of attaining confidence in the reliability of signature alternative technologies. Based upon the agency's inspectional findings of inadequacies regarding computer systems validation in general, FDA is concerned that new technologies may be adopted before they are adequately validated. Therefore, the agency requests comments on key elements of validation of electronic identification/signature systems and on what type of guidance FDA should develop in this area. 5. Standards. The agency's acceptance of signature alternatives would be facilitated if FDA could apply appropriate signature standards developed by other organizations. The agency is aware that a Digital Signature Standard has been proposed by the National Institute of Standards and Technologies (NIST). A copy of the proposed NIST standard is included as an attachment to the working group report, on file at the Dockets Management Branch (address above). The agency seeks comments on the application of the proposed NIST standard to FDA matters, as well as comments on any other relevant standards. 6. Freedom of Information. The agency has very limited experience in handling freedom of information (FOI) requests that: (1) Are submitted in electronic form, (2) request that paper documents be supplied in electronic form, and (3) request that electronic documents be furnished in electronic form. However, FDA anticipates receiving such requests in the future as paperless systems are adopted. Comments are requested on the need to establish modified fees and procedures. The agency also welcomes comments on any related issues. In addition, the agency would like to hear from developers of electronic identification/signature systems. Presentations before the task force are welcome and may be arranged through the contact individual named above. However, this request is for information only and does not undertake any commitment to purchase any system. In the event that any future acquisition results from this activity, such acquisitions will be conducted in accordance with the requirements for competition as set forth in the Federal Acquisition Regulation (Title 48 of the CFR). The agency emphasizes that the purpose of such presentations is for FDA to obtain information on emerging technologies and not to endorse or disapprove particular systems. Interested persons may, on or before October 19, 1992, submit to the Dockets Management Branch (address above) written information and comments regarding this advanced notice of proposed rulemaking. Two copies of the information and comments should be submitted, except that individuals may submit one copy. The information and comments are to be identified with the docket number found in brackets in the heading of this document. The information and comments may be seen in the office above between 9 a.m. and 4 p.m., Monday through Friday. Dated: July 15, 1992 Michael R. Taylor, Deputy Commissioner for Policy. [FR Doc. 92-17144 Filed 7-20-92; 12:01 pm] BILLING CODE 4160-01-F