Thinking Cap goes above and beyond to deliver the LMS software and on-site support you need to craft your Title 21 CFR Part 11 strategy.
What is Title 21 CFR Part 11?
Title 21 CFR Part 11 is the section of the Code of Federal Regulations (CFR) that deals with Food and Drug Administration (FDA) guidelines on electronic records and electronic signatures in the United States. It defines the criteria under which electronic records and electronic signatures are considered trustworthy, reliable, and equivalent to paper records.
What does it mean?
Organizations like pharmaceutical, medical supply and healthcare providers that fall under the 21 CFR Part 11 guidelines need to take extra precautions when using an LMS to disseminate information. Part 11 requires that both procedural controls (e.g. notification, training, SOPs, administration), and administrative controls are put in place by the user, in addition to the technical controls that a vendor can offer.
What does Thinking Cap do to support Title 21 CFR Part 11?
The Thinking Cap team has the technology, software, and expertise to ensure you remain in compliance with Title 21 CFR Part 11. While no vendor can offer a system that is compliant out-of-the-box with this regulation, Thinking Cap can help you stay within the guidelines with no disruption to your regular functionality.
|Section||Requirement||Thinking Cap LMS Feature|
|11.10 (b)||The system shall generate accurate and complete copies of records in human readable and electronic form suitable for inspection, review and copying||Thinking Cap LMS presents standard and custom reports in both screen and downloadable form. Downloaded reports are available as PDF or in CSV.|
|11.10 (d)||The system shall limit system access to authorized individuals.||Access to all parts of the application is controlled by username and password. Each account has roles and permissions that limit the functions and data the account can access. Thinking Cap allows for additional security tailored for the Title 21 CFR Part 11 environment, including: unique passwords; encrypted passwords; enforced strong password selection, and; automated password expiry. Under these hardened parameters, users cannot request a lost password but can regenerate a password after either correctly answering personal questions or through offline authentication. This enhanced security also allows for: automatic account locking for multiple failed attempts, and; recording of IP addresses for all accesses.|
|11.10 (e)||The system shall employ secure, computer-generated date/time stamped audit trails to independently record operator entries and actions that create, modify, or delete electronic records, without obscuring previously recorded information.||Thinking Cap records everything to the log, including: a record of each action; when each action occurred, and; who the user who committed the action was. In the case of clients using PKI signatures for users, the log contains the personal signature of the user. You can export this log to CSV.|
|11.10 (f)||The system shall enforce required steps and events sequencing, as appropriate (e.g., key steps cannot be bypassed or similarly compromised).||Thinking Cap controls each procedure, including: adding a user; enrollments; and; creating a new course. Between course and competency map, access is controlled via domains enrollment and prerequisites. Within the course and competency map themselves, sequencing rules enforced by the LMS govern each step. A second layer of administrative log in can control access to sensitive course and learning paths to provide onsite verification of a user’s identity and increase the security of the user’s log in point.|
|11.10 (g)||The system shall ensure that only authorized individuals can use the system, electronically sign a record, access the operations or computer system input or output device, alter a record, or perform the operation at hand.||Every function of the LMS is defined as a permission. Roles are created as groupings of permissions and each user is given some combination of roles and individual permissions. Layered onto this is the segmenting of domains and sub domains that further limit a user’s access based on their domain membership and role in that domain.|
|11.10 (h) (1)||The system shall determine, as appropriate, the validity of the source of data input or operational instruction.||Thinking Cap will not accept connections, and therefore will not accept commands or data, from unauthenticated sources, or from authenticated sources where the IP address of a command does not match the originally authenticated access for a given session. In a hardened environment, the LMS will only communicate over HTPPS, which prevents a third party from modifying data being transmitted.|
|11.50 (a) (1), (2), (3)||The system shall ensure all signed electronic records contain the printed name of the signer, date/time signature was executed, and the meaning associated with the signature (e.g. approval, responsibility, authorship).||The meaning of the signature is the action performed and recorded in the log. Thinking Cap stores this information along with the full name and account username of the signatory.|
|11.50 (b)||The system shall ensure the three signature elements (described in the previous requirement) of a signed electronic record are a part of any human readable form of the electronic record (e.g. electronic display or printout).||The three signature items are included in all audit trail reports.|
|11.70 (a)||The system shall ensure electronic signatures are linked to their respective electronic records and that these electronic signatures cannot be excised, copied, or otherwise transferred to falsify an electronic record by ordinary means.||Electronic signatures are linked and this link is protected by username and password protection of the data store. A hash of the audit trail made at each point provides a detection system of tampering, even by an authenticated user.|
|11.100 (a)||The system shall ensure that each electronic signature is unique to one individual and shall not be reused by, or reassigned to, anyone else.||Uniqueness of username and password is enforced by the system. This uniqueness survives even the expiry of an account. Inactive accounts and their records are never removed from the system.|
|11.200 (a) (1)||The system shall employee at least two distinct identification components such as an identification code and a password.||Thinking Cap employs username and password protection, and enforces that the authenticated session maintains the continuity of IP address. Personal PKI-based digital signatures are also an optional addition.|
|11.200 (a) (1) (i)||The system requires the use of all electronic signature components for the first signing during a single continuous period of controlled system access.||All sessions begin with a digital signing. Additional signing may be required by more privileged / trusted users for access to defined materials where the in-person authentication of an individual is mandated as necessary i.e. tests and compliance learning.|
|11.200 (a) (1) (i)||The system shall allow all subsequent signing during the same continuous period of controlled system access to use at least one electronic signature component.||The system will continue to use the originating IP of each request after the first to maintain security of the session.|
|11.200 (a) (1) (i)||The system shall ensure users are timed out during periods of specified inactivity.||Time out in a 21 CFR Part 11 environment is enforced after 20 minutes of inactivity.|
|11.200 (a) (1) (ii)||The system shall require the use of all electronic signature components for the signings not executed during a single continuous period of controlled system access.||All signing must be executed during a continuous period of controlled system access.|
|11.200 (a) (3)||The system shall require all attempted uses of an individual’s electronic signature by anyone other than its genuine owner to require collaboration of two or more individuals.||Sharing electronic signatures is not permitted.|
|11.300 (a)||The system shall require that each combination of identification code and password is unique, such that no two individuals have the same combination of identification code and password.||The system will not allow duplication. Two hashes of both the username and password are kept for comparison purposes to maintain integrity without storing actual information unencrypted.|
|11.300 (b)||The system shall require that passwords be periodically revised.||In hardened mode for use in a Title 21 CFR Part 11 environment,the system requires password changes every 30 days. This duration can only be reduced when operating in this mode.|
|11.300 (d)||The system shall employ transaction safeguards preventing the unauthorized use of password and/or identification codes.||Thinking Cap uses intrusion detection to identify fraudulent transactions, including: multiple failed attempts at log in; log in from a large number of IP addresses, and; unusual activity in an account. The system will temporarily suspend accounts showing this activity and will required logged explanations of the activity by administrators, including actions taken.|
|11.300 (d)||The system shall detect and report unauthorized use of password and/or identification codes to specified units.||Administrators are alerted to all attempts to log in with: a valid username and invalid password, or; an invalid username and valid password.|