Documentation and Computerized Systems Regulations

Below, we explain what compliance and documentation are involved in cold chain temperature monitoring solutions.

Title 21 CFR Part 11 and EU Annex 11

Embodied as part of the United States' Code of Federal Regulations (CFR), Title 21 details the US Food and Drug Administration (FDA) standards that govern electronic data. Importantly, these rules set the criteria for trustworthiness and reliability. They also define the legal equivalence of electronic records with paper documents and handwritten signatures.

To meet good practice or GxP guidelines and recommendations, hardware and software monitoring solutions that store electronic records with patient safety implications must comply with Title 21. Similarly, Annex 11 applies directives for GxP documentation within the EU.

Title 21 CFR Part 11 and Cold Chain Temperature Monitoring

Understanding and implementing the guidelines requires insight into the main risks in transporting ultra-cold or temperature-sensitive cargo. Whether accidentally or deliberately, electronic data is at risk of modification and deletion. By adhering to the rules, electronic records will be complete, intact, and maintained in the original context, all of which are necessary for compliance.

Complete Data

In ultra-cold and cryogenic transport containers, a communication bridge links each sensor to the company's central software. Ensuring the completeness of data is a significant challenge that requires mechanisms to prevent loss.

With the above aim in mind, when selecting temperature monitoring equipment, companies should opt for wireless sensors that automatically buffer readings internally in the event of disconnection. Crucially, there needs to be sufficient memory to retain these regular temperature measurements until the device reconnects and uploads the information correctly.

By design, cold chain databases should meet GxP regulations and mitigate the risks of:

• Forgetting to equip shipment pallets with sensors.

• Starting or stopping sensors incorrectly.

• Failing to upload the raw files from USB data loggers.

• Losing real-time connections to loggers.

Data Integrity

Usually, the risk of accidental or intentional modification of data is minimal. Nonetheless, the only way to ensure it stays intact is by encrypting it – from initial sensor measurement through the communication link to cloud storage.

Moreover, it should not be possible to delete or modify raw data. In some circumstances, however, adding certain additional information could be permissible (see below).

Context

Keeping project data in one single repository on central cloud infrastructure will preserve its original context and eliminate the risk of misinterpretation. Notably, warnings, alarms, and reports must include the unique sensor name, event number, and timestamp.

Various rules apply regarding access to measuring equipment. Apart from unique account names and strong passwords, each user must have a defined role and privilege level.

Device firmware or software should log user sessions. When conducting critical operations, such as acknowledging alarms, users might even have to enter their password again.

Furthermore, to avoid unauthorized access, time-out protection is advisable. In addition to automated events, systems should log manual interventions such as changing settings and generating reports.

Goods in Transit

Cold chain database audit trails tend to be more complex than static systems because they involve more events and participants. Fundamentally, auditing involves recording who has done what – and why.

Logs should include the product owner or the responsible Market Authorization Holder (MAH). Additionally, they must record user IDs when setting sensor configurations or viewing and commenting on temperature deviations.

Thus, in line with GxP documentation principles, a full cold chain audit trail might well include:

• Acceptance criteria.

• Configuration of shipments and data logger(s).

• Temperature measurements, status, and changes to settings.

• Warnings and alarms: who has the system informed and when?

• Comments, reassessments, and releases: who has commented on shipments, performed manual or automated re-assessments, and finally released products?

• Reports: sensor IDs, shipment information and user(s) IDs, whether warehouse senders, logistics service providers, quality assurance (QA) staff, or delivery recipients.

Documenting Logger and Database Qualification

Along with computerized systems, GxP regulations require organizations to qualify equipment used to produce, store, and transport temperature-sensitive pharmaceuticals. Such qualification constitutes documented proof that loggers and cold chain databases fulfill their intended purposes.

Pharma companies and MAHs that use computerized temperature logging systems in cold chains must carry out these qualification procedures individually for each specific process. Notably, documentation of cold chain monitoring is a popular audit target.

When determining how to document data logger and database qualification, simplicity is the key. To ease the burden, manufacturers or vendors of turnkey solutions can qualify system elements – hardware, software, and services – and provide detailed GxP documentation. This component validation includes:

• User Requirement Specification (URS) templates, which describe functionality.

• High level analyses, assessing risk probability, severity, and detectability, along with mitigation measures.

• Validation plans.

• Summaries of documents and versions.

• Operator qualification (OQ) templates.

Suppliers should offer clients guidance on GxP documentation during the initial qualification process(es) and, of course, be available for follow-up audit questions if necessary.

Documenting Temperature Excursions

It is essential to document every temperature excursion to verify the proper storage and transport of pharmaceutical products within specific temperature ranges. In addition, as suggested in GMP and GDP procedures, sensors and dashboards ought to display an alarm if temperature conditions deviate from the specified parameters.

Additionally, most systems can automate email or SMS notifications that include the:

• Location where the alarm went off – i.e., which building, container, or sensor.

• Time of the incident and its duration.

• Highest or lowest temperatures reached and whether the consignment returned to recommended temperature conditions.

As well as facilitating automatic exception reports, monitoring systems should have an option for users to add information.

Manual Information

Where appropriate or necessary, users ought to be able to add information manually. For instance, this type of detail could give the cause(s), affected product(s), and the likelihood – or severity – of damage. Other helpful information includes corrective action(s) and the possibility of a product recall.

Periodic Reporting

As well as reliable alarm mechanisms, periodic sensor reporting is vital to maintain confidence in a computerized system. Notably, monthly reports have to comply with ISO standards for long-term data archives.

Similarly, combined weekly reports for customers provide concise overviews for each project concerned. In contrast, daily reports are ideal for automated batch runs and quality control.

How is data archived?

Although not explicitly defined in GxP regulations, archiving involves moving non-active data to a separate storage device. It is essential to retain these archives for future access, perhaps for regulatory or compliance reasons. Archived information may be in a different form from process data.

Process Data: Also called fresh data, process data is instrumental in decision-making. Product detail and temperature measurements must be available electronically for at least two years for visualizations, reports, exports, and statistics such as MKT (mean kinetic temperature) calculations.

Archive Data: After two years, service providers can archive these files in secure storage. The electronic archives must remain available for at least ten years. Archive files should bear clear, self-explanatory names and be in a readable format such as PDF/A, which meets ISO 19005 standards.

Why are Dashboards Important?

In temperature control system installations, display dashboards provide concise overviews of temperature sensors, meaningfully grouped by location. Characteristically, screens display the current conditions, warning alarms, and each sensing device's technical status to facilitate monitoring.

Conclusion

You will have gained an appreciation of the regulation of computerized monitoring systems in cold container storage and pharmaceutical product supply chains from the above. While the rules for GxP documentation are detailed, the principles of good stewardship and careful storekeeping form their base.

ELPRO is a leader in GxP-compliant environmental monitoring solutions. For more than three decades, the world's leading pharma, biotech, life science, and healthcare companies have trusted their expertise in intelligent software and leading-edge hardware technology to monitor critical assets throughout the cold chains.

Above all, ELPRO supports clients in making medicine safe for patients. If you require advice or support with temperature monitoring GxP regulations, compliance, or efficiency within your supply chain, the team of experts will be glad to assist.