A Blueprint for Electronic Record Retention

Companies struggling to comply with the FDA’s myriad electronic recordkeeping regulations should take a deep breath and follow it up with a long, careful look at the FDA’s actual GxP and 21 CFR Part 11 rules. After a careful reading of the admittedly long and sometimes dry rules, it should become clear that the agency is quite clear in what it expects from companies when it comes to the kind of records they need to keep and how long they should hold onto them.“The regulations are specific about record retention,” notes Keith Benze, a consultant and compliance expert with SEC Associates and a co-author of The ‘New’ Part 11 and Drug Development: A Q&A Reference Guide (Barnett International, 2004). The FDA focuses on maintaining records for a certain period of time after an event. “For example, one year past the expiration of date of drug products,” Benze adds.

In other cases, that period is usually a year or two after the last distribution of the product or approval for the IND.  For example, Part 11’s section 820.140 states, "All records required by this part shall be retained for a period of time equivalent to the design and expected life of the device, but in no case less than two years from the date of release for commercial distribution by the manufacturer."

“The FDA provides a good road map for firms that are trying to determine what records they should retain and for how long,” points out Eric June, chief software architect at AssurX. “This will help companies avoid the common mistake of keeping everything forever because they are literally afraid to throw out anything.” He notes that companies can operate more efficiently, reduce their exposure to legal risks, speed their products to market and be more responsive to inspectors if they have the right software and a clear plan for prioritizing their records and setting up parameters that automatically keep what should be kept and remove the excess.

The good news is that electronic record retention tools and technologies give companies of all types and sizes unprecedented opportunities to improve their operational efficiencies, speed products to market, make regulators happy and send black ink straight to the bottom line. However, electronic record retention tools and technologies are arguably more advanced than some of the strategies and best practices employed by companies to achieve the aforementioned benefits. Worse, some companies commit the well-meaning mistake of trying to be safe by hanging onto every electronic record until their systems are so slowed and clogged that it’s hard to find the electronic records they need when necessary.

There are some key regulations affecting record retention for medical devices and drugs to help companies navigate the FDA’s rules and gain a better understanding of what’s expected of them. Although this article isn’t a substitute for a full and careful reading of these rules and regulations, it’s intended to help steer companies to some of the most important sections.

Medical Device GMP—Section 820.180 General requirements
Here the FDA states, "Records shall be maintained for all components, drug product containers, closures, and labeling for at least one year after the expiration date or, in the case of certain OTC drug products lacking expiration dates... three years after distribution of the last lot of the product incorporating the component or using the container, closure, or labeling."

Drug GMP—Section 211.180 General requirements
All records required by this part must be retained for a period of time equivalent to the design and expected life of the device, but in no case less than two years from the date of release for commercial distribution by the manufacturer. “Records shall be maintained for all components, drug product containers, closures, and labeling for at least one year after the expiration date or, in the case of certain OTC drug products lacking expiration dating because they meet [exemption criteria], three years after distribution of the last lot of drug product incorporating the component or using the container, closure, or labeling.”

Drug GLP—Section 58.195 Retention of records
For the reporting of nonclinical laboratory study results, the FDA is also clear about its record retention expectations. Although there are some exceptions, the FDA’s expectations broadly speaking are for you to maintain, “…documentation records, raw data and specimens pertaining to a nonclinical laboratory study and required to be made [by this rule] shall be retained in the archive[s] for whichever of the following periods is shortest”:

• A period of at least two years following the date on which an application for a research or marketing permit, in support of which the results of the nonclinical laboratory study were submitted, is approved by the FDA. This requirement doesn’t apply to studies supporting INDs or applications for IDEs, records of which should be governed by the provisions of section 2.
• A period of at least five years following the date on which the results of the nonclinical laboratory study are submitted to the FDA in support of an application for a research or marketing permit.
• In other situations (e.g. where the nonclinical laboratory study doesn’t result in the submission of the study in support of an application for a research or marketing permit), a period of at least two years following the date on which the study is completed, terminated, or discontinued.

Due to space restrictions, we cannot list all sections with minor exceptions. However, many are available from the FDA online here.

Drug GCP—Section 312.62 Investigator record keeping and record retention
Here the FDA directs companies to maintain records for at least two years after a marketing application is approved or for two years after an investigation is discontinued and the FDA is notified. “An investigator shall retain records required to be maintained under this part for a period of two years following the date a marketing application is approved for the drug for the indication for which it is being investigated; or, if no application is to be filed or if the application is not approved for such indication, until two years after the investigation is discontinued and the FDA is notified.”

Drug GCP—Section 312.57 Record keeping and record retention
A sponsor is expected to maintain adequate records showing the receipt, shipment or other disposition of the investigational drug for two years after a marketing application is approved or, if an application isn’t approved, until two years after shipment and delivery of the drug for investigational use is discontinued and the FDA is notified.

Drug GCP—Section 56.115 IRB records and reports
Here, the FDA expects records to be retained for at least three years after completion of the research. Records to be retained include copies of all research proposals reviewed, scientific evaluations, approved sample content documents, progress reports and minutes of IRB meetings sufficient in detail to show attendance and actions at the meetings.

Moving forward
Remember that what is presented here is taken straight from the FDA’s rules and regulations. Although space was limited in the listing of each exemption and special case, this article should be used as a guide to how you dive into and interpret the FDA rules and regulations in a way that makes the most sense for your particular situation. In its new approach to electronic record maintenance, the FDA has generally adopted a policy that allows companies great leeway in how they comply as long as they spell out a policy in advance that contains a common sense rationale for their approach. Simply by searching these rules on the FDA’s Web site, you can access complete copies of official documents.

Many companies have learned that the best way to approach record retention and compliance policies is to develop a well-reasoned program that balances the relative importance of an electronic record with the reality that saving everything all the time will actually make records more cumbersome and less secure.

We advise you to print out the full copy of each FDA rule and regulation referenced here, and look carefully for exemptions and special situations that may affect your compliance program.

About The Author