Appropriate controls are not exercised over computers or related systems to assure that changes in analytical methods or other control records are instituted only by authorized personnel [21 CFR § 211.68(b)]. Specifically:
a) Laboratory managers (QC and R&D) gained access to the [redacted] computer system through a common password. Analysts were not required to use individual passwords; they operated the system following the login by the laboratory managers.
b) Due to the common password and lack of varying security levels, any analyst or manager has access to, and can modify any HPLC analytical method or record. Furthermore, review of audit trails is not required.
View the original warning letter.
Failure to indicate the reason for change in automated data entries [21 CFR 58.130(e)]. In several instances, entries in the [redacted] collection/notes and audit trails failed to provide the reason for changing raw data. For example, audit trail entries for study [redacted]demonstrate that observations of “normal” were removed without an explanation.
View the original warning letter.
The deviations noted on the FDA-483, your written responses to those deviations, and issues from our subsequent review of the inspection report are discussed below.
View the original warning letter.
Our review of the inspection results also noted that you use an electronic medical record (EMR) system to maintain medical and other clinical data for your patients, including study subjects . You told Mr. [redacted] that data obtained during study visits are entered directly into the EMR, and no paper records are used. A follow-up letter from you to Mr. [redacted], dated January 31, 2005, detailed the name of the EMR system and the means by which study subject information is entered. Please note that Title 21, Code of Federal Regulations, Part 11, “Electronic Records; Electronic Signatures ” outlines specific requirements that must be met for any system that is being used to maintain required records. In addition to the information requested above, please submit the following:
View the original warning letter.
Your firm failed to address design input requirements that are incomplete, as required by 21 CFR 820.30(c) [FDA-483, Item 31. Specifically,
View the original warning letter.
View the original warning letter.
Failure to establish and maintain adequate procedures for implementing corrective and preventive action, as required by 21 CFR 820.100(a) and (b). For-example:
a. The procedure titled corrective Action Handling [redacted] was not approved and implemented to address corrective and preventive action and no established procedure was found to have been in place.
b. Microsoft 2000 Excel spreadsheet software used manufacturing has not been validated for the purpose of generating a worksheet for formulation of reagents. No documentation was found to establish or verify corrections made to the program.
A report dated November 11, 2002 on non-conforming material on [redacted] was filed and a possible cause for the [redacted] was given; however no documentation was provided to verify or validate the adequacy of the corrective and preventive actions.
Problems were recorded relating to the use of the new dosing/dispensing machine [redacted]; however no documentation/evidence was provided
to verify or validate the adequacy of the corrective and preventive actions.”
View the original warning letter.
Your firm failed to maintain complete and accurate records from which unsuitable donors could be identified so that products from such individuals would not be distributed [21 CFR 606.160(e)] and records to identify the person performing the work so to provide a complete history of the work performed [21 CFR 606.160(a)(1)]. Specifically, when the investigators requested a search of some of the various donor permanent deferral codes in your [redacted] database, 72 donors had various permanent deferral codes entered into the “Comment” field but these donors did not have a permanent deferral status entered into the “Deferral Code” field of the [redacted] database. The “Comment” field is not referenced for identification of deferred donors. Out of 72 donors, 10 were verified to meet the criteria for permanent deferral.
View the original warning letter.
Failure to validate computer software for its intended use according to an established protocol, as required by 21 CFR 820-70(i). For example:
View the original warning letter.
In addition to the above listed violations, our Investigator noted that the laboratory is using an electronic record system for processing and storage of data from the atomic absorption and HPLC instruments that is not set up to control the security and data integrity in that the system is not password controlled, there is no systematic back-up provision, and there is no audit trail of the system capabilities. The system does not appear to be designed and controlled in compliance with the requirements of 21 CFR, Part 11, Electronic Records.
View the original warning letter.