By Eric M. Stroud
GMPNetworks / Syvax Inc.
In most pharmaceutical companies, the Information Technology (IT) department often has a number of regulated customers: Manufacturing sites, laboratories, clinical operations, etc., each with its’ own section of predicate rules from the Food & Drug Administration (FDA) to follow, collectively called the “GXPs”, or “Good….Practices”. Manufacturing sites must be in compliance with the “GMPs” (21 CFR Parts 11, 210-211, 820 for medical devices); for laboratories, the “GLPs” (21 CFR Parts 11 and 58); and for Clinical Operations, the “GCPs” (21 CFR Parts 11, 50, 56, 312, 812).
While no predicate rule specifically spells out what the FDA expects for a data network, it is good practice to adopt the regulations from the GMPs, and apply them to the network. Think about who potentially would get audited the most in your organization: Manufacturing. A manufacturing division is a good example of an IT customer that would require documentation about the network, showing control, in order to show that its’ manufacturing sites, which use that network, are in compliance with the GMPs.
“The FDA ‘raised the bar’ on what they expected regarding control of data networks when it issued Pharmacia two warning letters…”
The data network used by the manufacturing, clinical, and laboratory operations must be qualified. Sounds extreme? Consider this: The FDA “raised the bar” on what they expected regarding control of data networks when it issued Pharmacia two warning letters during two inspections in 2000. Since then, larger pharmaceutical companies have implemented network quality programs, including Pfizer, Merck, and Schering-Plough.
The responsibility of a network quality program usually falls to the IT management or a quality role in the IT organization, and quality assurance. A complete network qualification package typically has the following components:
A policy on what will be controlled in the data network, specifying boundaries, responsibilities, and “core” procedures;
Standard Operating Procedures, particularly for those activities that are used to show compliance (change control, periodic review, monitoring, testing, training, document management, disaster recovery, etc.);
Documented Training on Standard Operating Procedures, which is checked in a periodic review;
A means of controlling documentation: A physical repository, an electronic document management system, or both, for maintaining diagrams, qualification documents, procedures, etc.
A methodology to specify, design, and test new devices or functionality; and,
An objective Quality Assurance role within the department, to manage the above items.
In Part 1 of this article, let’s discuss the use of the policy.
The policy document may originate from the IT organization. It’s most important purposes are to communicate the scope and responsibilities for maintaining control of the data network across the organization. The policy document is usually approved by a representative of each area of the IT organization, such as operations, architecture, deployment, and planning. The policy document should be implemented across the entire organization, and elaborates on the following.
What equipment will be under change control and qualification, such as layer-2 devices, wireless devices, MVX, video, etc.;
Where sites and regional/corporate groups divide their responsibility, such as at an “edge” layer-3 switch;
If there are documents which are shared by multiple sites, who will maintain those documents;
How will network documentation be approved and maintained; and,
The qualification approach for equipment.
Usually, the most difficult part about preparing an organization-wide policy is getting consensus. Many people maintain a data network, and often, the network may spread across the globe. Well-coordinated meetings with agendas, support from upper management, and a project team to ensure that the policy becomes practice are the essentials for success.
Getting a network control policy in place is often the hardest part of getting a new network quality program off the ground. Don’t despair! You have a lot of support and help out there! (hint!)
Eric is an FDA Validation expert for GMPNetworks/Syvax Inc. Eric has over ten years experience with FDA validation for the pharmaceutical industry and has been specializing in validating IT data networks.
www.gmpnetworks.com
Posts
