0303ss05

SUPPORTING STATEMENT FOR

Electronic Records; Electronic Signatures

21 CFR Part 11

OMB Number 0910-0303

Docket Number 05N-0045

Expires 07/31/08

1. JUSTIFICATION

1. Circumstances Making the Collection of Information Necessary

The Food and Drug Administration (FDA) is requesting an extension of the information collection requirements contained in 21 CFR Part 11, OMB No. 0910-0303, Electronic Records; Electronic Signatures (ESIG).

Part 11 establishes conditions for the elective use of electronic records and signatures. These conditions include certain procedures and controls to ensure the authenticity, integrity, and when appropriate, the confidentiality of electronic records and to ensure the signer cannot readily repudiate the signed record as not genuine.

Specifically, the recordkeeping provisions in part 11 (sections 11.10, 11.30, 11.50, and 11.300) require standard operating procedures (SOPs) to ensure appropriate use of, and precautions for, system electronic records and signatures. While some of the procedures and controls may be built into a system, others require SOPs and one specially requires the establishment of, and adherence to, written policies that hold individuals accountable and responsible for actions initiated under their electronic signatures in order to prevent record and signature falsification. Many of the procedures and controls are not standard in regulated industry and routinely used in order to protect electronic records and documents (i.e., personnel information, internal communications and discussions, and confidential and trade secret information).

The requirements for this information collection are as follows:

21 CFR 11.10 Recordkeeping Specifies procedures and controls for

persons, who use closed systems to

create, modify, maintain, or transmit electronic records. Some or all of these procedures and controls will need to be incorporated in SOPs.

21 CFR 11.30 Recordkeeping Specifies procedures and controls for

persons who use open systems to create, modify, maintain or transmit electronic records. Some or all of these procedures and controls will need to be incorporated in SOPs.

21 CFR 11.50 Recordkeeping Specifies procedures and controls for

persons who use electronic signatures. Some or all of these procedures and controls will need to be incorporated in SOPs.

21 CFR 11.300 Recordkeeping Specifies controls to ensure the

security and integrity of electronic

signatures based upon use of

identification codes in combination

with passwords. Some or all of these

controls will need to be incorporated

in SOPs.

2. Purpose and Use of the Information

This recordkeeping is intended to permit the widest possible use of electronic technology compatible with FDA's responsibility to promote and protect public health. The procedures and controls defined in SOPs are intended for use by the organizations that develop them. The purpose of the SOPs is to ensure that organizations adopt procedures for appropriate and secure use of electronic systems. Because widespread use of electronic technology is relatively recent, the significance of official , legally binding electronic records may not be fully appreciated by everyone.

3. Use of Information Technology

The purpose of the ESIG regulation is to permit widespread use of information technology by the regulated industry for all FDA reporting and recordkeeping requirements.

4. Effort to Identify Duplication

The ESIG regulation permits FDA-mandated records and signatures to be created and maintained electronically. This permits widespread use of a technology not contemplated when most reporting and recordkeeping requirements were issued. To create the required SOPs, many organizations will be able to simply describe procedures and controls already adopted internally to protect the authenticity, integrity, and confidentiality of electronic data, records, and signatures.

5. Impact on Small Business

This regulation has a positive impact on nearly all organization subject to the rule, including small business. For example, within the medical device industry alone, 93% of the firms are small business (i.e., have fewer than 500 employees). It is estimated also that approximately 500 pharmaceutical firms are small business. Of the approximately 3,000 registered blood and plasma establishments that are neither government owned nor part of the Red Cross, most are nonprofit establishments that are not nationally dominant and this may be small entities.

Although the capability for making electronic submissions to FDA will be phased in over time, firms can benefit immediately using ESIG for records they are required to keep, but not submit to FDA. Such records include, but are not limited to pharmaceutical and medical device batch production records, complaint records, and food processing records.

Because it will increase the market demand for certain types of software (e.g., document management, signature, and encryption software) and services (e.g., digital notaries and digital signature certification authorities), this rule benefits some small firms engaged in development and providing these products and services.

In addition, a small business coordinator within the agency works to ensure that small businesses have an adequate opportunity to express their concerns and to keep FDA management apprised of how regulatory decisions might impact the small business community.

6. Consequences of Collecting the Information Less Frequently

The prescribed frequency for the collection is based upon FDA's statutory responsibility to ensure the availability of uniformly high quality products to the nation. FDDA ensures compliance with many recordkeeping requirements by conducting establishment inspections, as authorized by section 704 (21 U.S.C. 374) of the Federal Food, Drug, and Cosmetic Act, to review and evaluate the adequacy of records. It is widely recognized that certain procedures and controls are necessary to protect the integrity of electronic records. As a result, FDA believes it is necessary to establish SOPs incorporating the procedures and controls provided in the rule. As noted, many organizations recognize the need to protect the integrity of their electronic systems and have adopted identical or similar procedures and controls.

7. Special Information Collection Circumstances

These recordkeeping requirements deviate from the specifications of 5 CFR 1320.6 in one respect. A person engaged in drug product manufacturing operations is required to retain records specifically associated with a drug product for at least 1 year after the expiration date or, in the case of certain OTC drug products dating, 3 years after distribution of the last lot of drug product (21 CFR 211.180). Depending on the approved dating period or shelf life of the drug product, it is possible that records would be retained for more than 3 years. Availability of these records provides an opportunity to follow up on complaints and adverse reports received during a drug's marketing period. Failure to have these records available for an investigation could prevent the resolution of undesirable and potentially life-threatening conditions. Audit trails are electronic records that must be kept, per §11.10(e), for at least as long as the related subject records.

8. Outside Consultation

In the Federal Register of February 7, 2005 (70 FR 6448), FDA published a request for continuation of this information collection and solicited public review and comment. No comments were received in response to the request.

9. Payment or Gift

No payment or gift will be provided to respondents.

10. Confidentiality Provisions

The agency frequently handles confidentiality information. Confidentiality is maintained over trade secret, proprietary, or confidential, commercial or financial information under 21 CFR 20.61 and investigatory records under 21 CFR 20.64. In addition, certain subparagraphs of 21 CFR 314.430 and 514.11 provide confidentiality of information contained in new drug applications (NDA's), abbreviated new drug applications (ANDAs), and new animal drug applications (NADAs). Many of the provisions of part 11 are designed to preserve confidentiality when using electronic systems. This goal is one of the stated purposes of the procedures and controls provided in the regulation.

11. Privacy

There are no recordkeeping requirements regarding sexual behavior and attitudes, religious beliefs, or any other matters, which are commonly considered private or sensitive in nature.

12. Burden Hours

Estimated Annual Recordkeeping Burden

21 CFR Section	No. of Recordkeepers	Annual Frequency Of Recordkeeping	Total Annual Records	Hours Per Recordkeepers	Total Hours
21 CFR 11.10	2,250	1	2,250	20	45,000
21 CFR 11.30	2,250	1	2,250	20	45,000
21 CFR 11.50	4,500	1	4,500	20	90,000
21 CFR 11.300	4,500	1	4,500	20	90,000
Total					270,000

There are no capital costs or operating and maintenance costs associated with this collection.

The burden created by this regulation is a one-time burden associated with the creation of standard operating procedures and validation. The agency anticipates the use of electronic media will reduce substantially the paperwork burden associated with maintaining FDA required records.

The respondents will be businesses and other for-profit organizations, state and local governments, Federal agencies and nonprofit institutions.

.

13 Estimates of Annualized Cost Burden to Respondents

The estimated annualized cost to respondents is $9, 204,975. The cost to respondents is estimated on the time required to compile information that already exists into SOPs and to compile a one-paragraph certification. This generally requires one professional specialty person at an adjusted pay rate of $39.66 per hour (270,000 hours x 3/4 hour x $39.66 = $8,031,150) and administrative support staff at an adjusted pay rate of $17.39 per hour (270,000 hours x 1/4 hour x $17.39 = $1, 173,975). Theses salary estimates include compensation but no overhead costs.

14. Annualized Cost to the Federal Government.

There are no costs to the Federal Government.

15. Explanation for Program Change or Adjustments

There has been no change to the burden.

15. Publication of Information Collection Results

FDA does not intend to publish the results of the information collection required by these regulations.

15. Display of OMB Approval Date

There are no forms associated with this collection of information.

15. Exceptions to Certification for Paperwork Reduction Act Submission

As stated in Item 7, there are instances where the respondents will be required to keep records longer than three years. There are no other exceptions to the "Certification for Paperwork Reduction Act Submissions" for this request.

6