Warning Letter: Lack of procedures and instructions (g6173d)

• Failure to have production and process controls for automated processes, as required by 21 CFR 820.70(i). when computers or automated data processing systems are used as part of production or the quality system. A manufacturer is required to validate computer software for its intended use according to an established protocol. For example, databases that are maintained for data analysis and other tracking and trending functions, including complaint and services access databases, have riot [sic] been validated for their intended use.
• Failure to establish and maintain instructions and procedures for performing and verifying that servicing meets the specified requirements, as required by 21 CFR 820.200(b). Each manufacturer must analyze service reports with appropriate: statistical methodology in accordance with Section 820. 100. For example, your quality group reviews narrative summaries of service reports every two weeks, but the data is not tracked and trended according to a statistical method.

View the original warning letter.

Warning Letter: No validation protocol (g6139d)

View the original warning letter.

Warning Letter: Lack of user level security (g5973d)

Appropriate controls are not exercised over computers or related systems to assure that changes in analytical methods or other control records are instituted only by authorized personnel [21 CFR § 211.68(b)]. Specifically:

a) Laboratory managers (QC and R&D) gained access to the [redacted] computer system through a common password. Analysts were not required to use individual passwords; they operated the system following the login by the laboratory managers.

b) Due to the common password and lack of varying security levels, any analyst or manager has access to, and can modify any HPLC analytical method or record. Furthermore, review of audit trails is not required.

View the original warning letter.

Warning Letter: Failure to maintain accurate, complete, and current records (ucm075362)

The deviations noted on the FDA-483, your written responses to those deviations, and issues from our subsequent review of the inspection report are discussed below.

• Failure to maintain accurate, complete, and current records relating to your participation in an investigation [21 CFR 812.140(a)].
  Responsibilities of clinical investigators include maintaining accurate, complete, and current records relating to the investigator’s participation in an investigation.

View the original warning letter.

Warning Letter: Failure to follow 21 CFR 11 compliance (g5276d)

Our review of the inspection results also noted that you use an electronic medical record (EMR) system to maintain medical and other clinical data for your patients, including study subjects . You told Mr.  [redacted] that data obtained during study visits are entered directly into the EMR, and no paper records are used. A follow-up letter from you to Mr. [redacted], dated January 31, 2005, detailed the name of the EMR system and the means by which study subject information is entered. Please note that Title 21, Code of Federal Regulations, Part 11, “Electronic Records; Electronic Signatures ” outlines specific requirements that must be met for any system that is being used to maintain required records. In addition to the information requested above, please submit the following:

• Documentation of the validation of your EMR system to ensure accuracy, reliability, and the ability to detect invalid or altered records;
• Documentation of the ability to generate accurate and complete copies of records suitable for inspection, review, and copying by the agency;
• Documentation of a secure, computer-generated, time-stamped audit trail that can independently record the date and time of operator entries and actions that create, modify, or delete electronic records, and to verify that record changes do not obscure previously recorded information.

View the original warning letter.

Warning Letter: Incomplete requirements (ucm075276)

Your firm failed to address design input requirements that are incomplete, as required by 21 CFR 820.30(c) [FDA-483, Item 31. Specifically,

• Functional requirements for the DBSS are in some cases very high level. For example, the requirements for Donor Reporting merely state that the application must enable the user to identify, from a list of persons, the donor on whom the report should be based, and to print an Autologous Unit Status Report, a Donor History Report, a Person Audit Trail Report, a Deferral Audit Trail Report, and an Individual Donor Orders Report for a specific donor. The requirements do not address the files to be accessed, the fields to be printed, or the format of the ave been written for problems with these reports. [redacted] have been written for problems with these reports. For example, [redacted] concerns the military personnel’s SSN appearing where the donor’s SSN should appear on the Donor Audit Trail Report.”

View the original warning letter.

Warning Letter: Failure to validate(g4689d)

View the original warning letter.

Warning Letter: Failure to Create Validation and CAPA Procedures (g4452d)

Failure to establish and maintain adequate procedures for implementing corrective and preventive action, as required by 21 CFR 820.100(a) and (b). For-example:

a. The procedure titled corrective Action Handling [redacted] was not approved and implemented to address corrective and preventive action and no established procedure was found to have been in place.

b. Microsoft 2000 Excel spreadsheet software used manufacturing has not been validated for the purpose of generating a worksheet for formulation of reagents. No documentation was found to establish or verify corrections made to the program.

A report dated November 11, 2002 on non-conforming material on [redacted] was filed and a possible cause for the [redacted] was given; however no documentation was provided to verify or validate the adequacy of the corrective and preventive actions.

Problems were recorded relating to the use of the new dosing/dispensing machine [redacted]; however no documentation/evidence was provided
to verify or validate the adequacy of the corrective and preventive actions.”

View the original warning letter.