GLP Records Storage and Retrieval

GLP Records Storage and Retrieval Cindy Green BBS UNITED, ALEX HAYDEN/GETTY IMAGES GLP Topics addresses topics associated with good laboratory practice requirements. We intend this column to be a useful resource for daily work applications. Reader comments, questions, and suggestions are needed to help us fulfill our objective for this column. Please send your comments and suggestions to column coordinator Cindy Green at cindynwrs@seanet.com or to journal managing editor Susan Haigney at shaigney@advanstar.com. KEY POINTS The following key points are discussed: An essential part of a study performed under good laboratory practice is the study record The study record contains what was done, how it was done, when the work was performed, and who performed the work Good documentation and recordkeeping practices that are applied to all site records are vital Records must be stored in adequate facilities that permit rapid access and retrieval Electronic records are subject to the same general rules as hardcopy records and also have specific considerations Hardcopy and electronic records must be secure to assure integrity Record retention must be defined All activities and requirements associated with records must be governed by procedure. INTRODUCTION An essential part of a study performed under good laboratory practice (GLP) is the record created. The record must be sufficiently detailed and complete to allow the accurate reconstruction of the study. The record must include data from the study. Evidence that the required procedures were conducted at the appropriate time is required (1). The study validity may be compromised without complete and accurate records. The only way of demonstrating what actually went on at the time is to record what was done, how it was done, when the work was performed, and who performed the work, as follows: Autumn 2011 Volume 15 Number 4 65

What was done documents the evidence that the specific steps required in the protocol were actually performed and in the sequence required. The results or observations are recorded for key protocol steps. How it was done documents that the data were collected and recorded consistent with the methods described in the protocol. In the event there were deviations from the prescribed protocol, these deviations must be recorded. When the work was performed documents the date and time that specific steps were performed. Depending on the protocol, the exact timing may be extremely important; for example, pharmacokinetic studies where animals are used to study the absorption, distribution, metabolism, and excretion of drugs. Who performed the work documents the identity of the person(s) who conducted the study. The specific assignments must be documented when more than one individual performed the work. RECORDS AND ASSOCIATED CONSIDERATIONS Topics associated with GLP records comprise the following. All must be proceduralized. Recordkeeping Practices Recordkeeping practices include activities in the actual recording of data, as follows: All data must be clearly identified and traceable to the study and the individual responsible for its generation (2). If more than one person observes and records data, that fact should be recorded in the data (2). Entries must be recorded at the time they occur (2). Separate pieces of paper (i.e., scrap paper, sticky notes) must not be used. Observations, results, and conclusions must be stated clearly in a complete, concise, and organized manner that is understandable to a second individual. Entries must be legible and indelible. Pencil is not acceptable. Entries must be permanent and able to be scanned, copied, or otherwise reproduced (2). Erasures must not be made. When dating a page, the actual date the page was completed must be used. Do not pre-date or postdate entries. A single, diagonal line must be made through blank pages or incomplete parts of a page. Sign and date on the line. All printouts, photographs, charts, etc. must be securely attached. Crosshatch an area of the page to show placement of an attachment. Sign and date the attachment. A list of abbreviations with definitions must be provided. Records must be accurate. Correction fluids, tape, etc. must not be used. Records must be signed by the responsible individual and dated. Changes must be made in a manner that allows the original entry to be read (2). Changes must be signed and dated by the person making the change (2) The reason for the change must be indicated (2). Types of Records Types of records include but are not limited to the following: Study plans (3) Raw data (3, 4) Protocols (4) Final reports (3, 4) Samples of test items (3) Specimens (3, 4) Records of inspections performed by the quality assurance unit (3, 5, 6) Master schedules (3, 6) Personnel qualification, training, experience, and job descriptions (3, 6) Organizational charts (6) Floor plans and site plans (6) Equipment calibration and maintenance records (3, 5, 6) Validation records for computerized systems (3, 6) Historical versions of standard operating procedures (3, 6) Environmental monitoring records (3, 6) 66 Journal of GXP Compliance

Cindy Green Animal records Pest control records (5) Standard operating procedures (4) Documentation and quality control reports from subcontractors (4) Photographs (6) Microfilms, microfiches, and computer media (6) Dictated observations (6) Recorded data from automated instruments (6) Samples of test and reference items, if used for more than one study (6) Certificate of Analysis, if used for more than one study (6). Archive Facilities The facility used for the storage of records must be designed and maintained in a manner to protect the records from unauthorized access and deterioration or damage (3, 5). The construction of the facility must be able to withstand weather, such as torrential rain or flooding. The risk of fire and explosion must be considered during the design or selection of the location for record retention. This includes consideration for fire and smoke detection and sprinkler systems (6). The archive facility must have environmental controls that are carefully monitored, and procedures should describe the necessary steps to be taken when there are deviations from established conditions. Environmental controls include temperature, humidity, and ventilation. Paper documents should not be stored for long periods of time under high humidity. Storage areas used for specimens containing formaldehyde should not be used for the storage of paper records (4). The archive facility should be included in a pest control program to minimize the potential damage from insects and rodents. There should be back-up power to protect against power outages, especially to refrigerators and freezers where specimens may be stored (6). Care must be taken to store electronic media in a manner that protects the media from dust or magnetic interference (6). Procedures should be in place for disaster recovery (e.g., fire, flooding, theft, sabotage). These procedures should include recovery and restoration of lost or damaged records or specimens and re-establishment of security (6). When continuous monitoring systems are used to monitor environmental conditions, these systems must be validated and periodically evaluated to assure established conditions continue to be met (6). Study directors or pathologists can be responsible for storing and retaining specimens and raw data; however, the location of these archive facilities must be identified in the central archives and must provide adequate storage conditions and authorized access requirements (5). In the event the facility assigned for archiving goes out of business and there is no legal successor, the records should be transferred to the study sponsor (3, 5). Electronic Records 21 CFR Part 11 describes the requirements for electronic signatures and records. This section of the Code of Federal Regulations states there must be established procedures that describe how and where computer data and backup copies are stored and how records are indexed to allow access to data stored on electronic media. Electronic records and signatures must be equivalent to paper records and handwritten signatures (4). Laboratories must comply with Part 11 requirements when three criteria are met: When computers are used to create, modify, maintain, archive, retrieve, or transmit data When at any time electronic entries are made on a durable storage device When the laboratory intends to create records that are intended to be submitted to or required by the US Food and Drug Administration (4). With the use of electronic records, the requirement for maintaining an audit trail becomes important. If you are generating, retaining, importing, or exporting any electronic data, the audit trail begins from the instant the data hits the durable media (7). Electronic data must be stored in a manner to prevent deterioration and allow retrievability (2, 4). Storage of electronic data presents a real challenge when the technology is advancing so rapidly. The data stored must be able to be retrieved with the required Autumn 2011 Volume 15 Number 4 67

hardware. If discs are used, the firm must assure that the computers available still have either an internal or external drive capable of reading the disc. If a conversion is made to a new computer system, the conversion must be validated. Conversion processes should also include meta data such as chromatographic integration parameters and calibration tables (4). Electronic records may be moved from the production part of a computerized system to a discrete secure archive area on the same computer system or explicitly marked as an archive. These records must be locked to prevent alteration (6). Software and system suppliers must be carefully evaluated to assure that they have a good understanding of Part 11 requirements. This evaluation of the suppliers should be a joint effort between the user group, quality assurance unit, and the purchasing department. It is extremely important for both the supplier and the purchaser to understand the requirements for Part 11 compliance. For laboratory equipment, there should be a gap analysis performed to determine the level of noncompliance. The use of the equipment and the data it generates needs to be carefully evaluated to determine if Part 11 applies. For example, in the event the analyzer stores data to durable media, Part 11 applies. The raw data is the electronic data not the copy of the printed data. Comparison of the electronic copy versus the paper copy is part of the system validation requirements (7). Electronic systems can be either open or closed systems. In a closed system, access is controlled by persons responsible for the content of the electronic records on the system. In an open system, access is not controlled by persons responsible for the content. For closed systems, procedures must be established and maintained for validation of the system; ability to generate accurate and complete copies; protection of records; limitations on system access; use of secure, computer-generated time-stamped audit trails; operational system checks; use of authority checks; use of device (e.g., terminal) checks; qualification of personnel; written policies authorizing the designated individuals for electronic record/signature assignments; and use of appropriate controls for handling electronic data. Open systems are required to meet all of the same requirements; however, there are additional controls that must be in place to assure record authenticity, integrity, and confidentiality (8). For computerized laboratory equipment, which is in common use today, a chromatography system can be used as an excellent example. In chromatography, there are at least three different types of records: original or raw data (e.g., instrument identification, operator name, run time, run duration); processing parameters or meta data (e.g., integration parameters, self calibration tables); and final results (9). These data are all stored electronically and must be defined in established procedures. 21 CFR Part 11.10 describes the requirements for limited and authorized system access. Procedures must be established to limit access to electronic systems to authorized individuals. There must be authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand (10). Access to electronic systems must be password protected with access authorization documented. Selected individuals should be authorized to only the applicable levels required by their roles and responsibilities. Placement of Records and Materials into Archives Upon completion of a nonclinical study, the study director is responsible for ensuring that all study documentation, data, and related records are archived in a timely manner. An additional responsibility assigned to the study director is to assure that the documentation is complete and accurate prior to transfer to the archive. Once the documentation has been transferred to the archive, the test facility management is responsible for the archived documentation (6). For non-study specific records, such as those for shared equipment, facility maintenance, utilities, etc., the test facility management is responsible for periodically updating the records in the archives (6). In the event there is a requirement to transfer records from one location to another, the transfer must be approved and documented. Typically, this is documented using a transfer plan and includes assignment of responsibilities as well as a complete listing of all 68 Journal of GXP Compliance

Cindy Green items to be transferred. There should be a chain of custody established to assure that there is complete accountability of the records and materials involved. Record and Data Retrieval Records must be organized in a manner that will allow the ease of retrieval. Clear identity of each and every record is essential. There are many ways to organize the records to allow their retrieval such as color coding by type of record, filing by study number, and filing by type of record under the study number. It is FDA s intention that a firm should be able to regenerate original results from the original or raw data. It is therefore possible that meta data (e.g., processing parameters, interpretive software) will be required to obtain the exact result originally reported. For this to be done, it may require not only the electronic data but also the software (including software for the operating system) and hardware originally used to create the original data. Periodically, storage media should be checked to assure that the data are still retrievable. Conversion may be necessary to stay current with computerized systems (9). Access to Records Archive facilities may be one or more buildings, rooms, safes, or lockable cabinets or other locations that are able to provide an appropriate level of security. The area(s) designated as the archive facility must be physically secure to prevent unauthorized access to the records and specimens being retained (6). Only personnel authorized by study management should have access to the archives. Only authorized individuals should be able to enter the archives (3, 4). In the event a visitor requires access to the archives, an authorized individual should accompany the visitor. The visitor should not be left alone in the archives. A record of the visitor and the records reviewed should be documented (6). There must be established procedures for the adding or removing of records (2, 4, 6). Whenever records are removed from the archives, the removal should be documented with the title and document number, the name of the individual removing the record, the date and time of removal, and the reason for the removal. The removal of records should be monitored to assure a timely return of the record. The date, time, and responsible individual returning the record should be recorded. Record Retention In the event that a required record retention period has not been established, the final disposition of any study materials should be documented. The length of time that records and specimens must be retained varies from country to country and may be as long as 15 years. 21 CFR Part 11 does not specify a timeframe for the retention period for electronic records. In the predicate rules, it may be 10 years or more (9). Another useful guide is to store the records for as long as the test substance is in use. When records and materials are associated with safety studies, the records and materials may be stored for as long as regulatory authorities might request GLP audits of the respective studies (4, 6). Specimens should be retained for the period required by the regulations or for as long as their quality permits meaningful re-evaluation, whichever is shorter (4, 5). In cases where samples or specimens are discarded prior to the established retention period, the rationale for early discard must be documented (3). When specimens are processed or aliquoted for use in the analysis, only the original specimen requires retention. It is not necessary to retain the processed samples (5). When animals are used in acute studies and organs are subjected to necropsy, the organs are to be retained as study specimens (5). Procedures Procedures describing the record storage and retrieval must be established. The procedure must identify the individual responsible for the archives. The assigned individual must be adequately qualified and trained. The training must be documented. If delegation occurs, the designated individual must be qualified and appropriately trained. Autumn 2011 Volume 15 Number 4 69

Procedures should be established that describe requirements for the following: Access to archives Definition and description of the archive Indexing procedures, including electronic records Conditions under which records and materials should be stored Procedures for the receipt of records and materials to be archived Procedures for accessing, removal, and return of records and materials Responsibilities of the archivist and archiving staff Security of the archive facility and records and materials retained Climate control Retention period Disposal of archived records and materials Contract archiving services, if applicable Transfer to sponsors or third parties, if applicable Disaster recovery Training requirements for the archivist and archiving staff Frequency of archiving non-study specific records Periodic refreshing of electronic records (6). CONCLUSIONS Records are vital documents. Without adequate documentation, anything done (i.e., protocols, calibration, maintenance) is worthless. Records must include what was done, how it was done, when the work was performed, and who performed the work. Good documentation practices are fundamental to records. These are required for all types of records in the facility. Once generated, records must be properly stored in acceptable archive facilities that enable reliable and rapid retrieval. Electronic records have specific requirements. All records, hardcopy and electronic, must be secure. Record retention requirements must be defined. All of the above must be addressed by procedures. Records and associated considerations are critical areas of concern in GLP activities. REFERENCES 1. WHO, Handbook Good Laboratory Practice (GLP): Quality Practices for Regulated Non-clinical Research and Development; UNDP/ World Bank/WHO Special Programme for Research and Training in Tropical Diseases (TDR). 2. FDA, Good Laboratory Practice (Nonclinical Laboratories), Food and Drug Administration Compliance Program Guidance Manual, Program 7348.808, February 21, 2001. 3. OECD Series on Principles of Good Laboratory Practice and Compliance Monitoring, Number 1; ENV/MC/CHEM(98)17, 26 Jan 1998. 4. Ludwig Huber, A Primer: Good Laboratory Practice and Current Good Manufacturing Practice, Agilent Technologies, March 2000. 5. FDA, Guidance for Industry: Good Laboratory Practices Questions and Answers, US Department of Health and Human Services, Food and Drug Administration, Office of Regulatory Affairs, June 1981 (updated December 1999). 6. OECD Series on Principles of Good Laboratory Practice and Compliance Monitoring, Number 15; Advisory Document of the Working Group on Good Laboratory Practice, Establishment and Control of Archives that Operate in Compliance with the Principles of GLP, ENV/JM/MONO(2007)10, Jun 11, 2007. 7. Nick A. Dayton, A Practical Approach to Compliance for 21 CFR Part 11 Electronic Records /Electronic Signatures Final Rule, Journal of cgmp Compliance, Special Edition, Institute of Validation Technology, pages 4-9. 8. Robert W. Stotz, Electronic Records and Signatures: A FDA Perspective, Journal of cgmp Compliance, Special Edition, Institute of Validation Technology, pages 10-18. 9. Ludwig Huber and Wolfgang Winter, The Impact of Part 11 on Chromatography Data Systems, Journal of cgmp Compliance, Special Edition, Institute of Validation Technology, pages 101-110. 10. 21 CFR Part 11.10(d)(g). GXP ABOUT THE AUTHOR Cindy Green is president of NorthWest Regulatory Support, LLC. Cindy has worked with regulated industry for more than 37 years holding senior positions in regulatory, quality assurance, and quality control for several biotechnology and medical device companies. She may be reached by e-mail at cindynwrs@seanet.com. 70 Journal of GXP Compliance