3 1 0 3 3 8 0 4 0 0 W W W. E N T RY P O I N T- I D C .

C O M

Intelligent data capture software

21 CFR Part 11 Checklist
FDA Compliance Tool
This tool is designed to help clinical researchers ensure that studies using computer systems to gather data electronically are in compli-
ance with federal regulations. The checklist applies to any study that uses a computer system to enter data, whether the data is entered
from a hardcopy, directly into the system, or automatically through a device (e.g., an ECG reading).
This document was compiled using the recommendations found in Guidance for Industry: Computerized Systems Used in Clinical
Investigations, by the Food and Drug Administration, May 2007.
Phoenix Software Internationals Entrypoint helps clients conduct compliant clinical research studies using electronic data capture without
the high cost and long implementation periods usually associated with EDC systems. With proper implementation and administration,
clinical investigators can achieve full compliance as inventoried in this document using features available in Entrypoint i4. Visit www.
entrypoint-idc.com to learn more.
d. Automatically record unauthorized login
Study Protocols attempts. q
1. Identify each step at which computer system will be e. Do not share individual account access with
used in written study protocol. q other users. q
2. Submit protocol with Investigational New Drug f. Do not log on to system to provide access to
(IND) and Investigational Device Exemption (IDE) another user. q
applications. q g. Electronically require users to change their
passwords at regular intervals. q
Standard Operating Procedures h. Automatically password protect computer
1. Have specific written operating procedures in systems when idle for short periods. q
place. q i. Automatically log users off computer systems
2. Make document available to personnel on site either when idle for long periods. q
in hardcopy or electronically. q 2. Audit Trail
3. Make document available for inspection by FDA. q a. Keep track of all creations, modifications, and
deletions electronically. q
Source document retention b. Maintain all entered data: Dont obscure
(for data entered directly into computer system) original data when changes are made. q
1. Treat electronic record as source document and
retain as required under part 312, 511.1(b). q c. Time stamp change automatically. q
2. When data is transmitted from one system to d. Configure computer system to require user to
another or entered directly into a remote central record reason for change. q
computer system, maintain copy in another location e. Automatically record identity of individual who
as defined below (check one). made change. q
f. Prevent users from being able to modify or
a. At clinical site. q delete audit trail. q
b. Another location (e.g., a data storage facility). q 3. Date and Time Controls
3. Produce copies contemporaneously with data entry. q a. Synchronize computer system to date and time
4. Preserve copies in appropriate format such as XML, provided by international standards setting
PDF or hardcopy. q source (e.g., http://www.time.gov/) q
Internal Security b. Limit users ability to change time. q
c. Document all date and time changes (except
1. Access Limitations daylight savings time). q
a. Password-protect individual accounts. q d. Include year, month, day, hour, and minute in
b. Configure computer system to require manual time stamp q
login and logout. q e. Include time zone in date and time stamp. q
c. Automatically limit number of failed login f. Explain any time zone references and naming
attempts. q conventions in study documentation. q
 4. System Controls
External Security a. Set up a full backup and recovery system
1. Restrict access to computer system and data via to protect against data loss if records are
external software applications by encrypting data maintained only in electronic form. q
as it is transferred and/or using a firewall. q b. Ensure that backup system maintains data
2. Maintain cumulative record that indicates names of integrity. q
authorized personnel, their titles, and a description
of their access privileges. q c. Store backup records at a secure offsite facility. q
3. Prevent, detect and mitigate effects of viruses and d. Maintain backup and recovery logs. q
other harmful software code. q 5. Change controls
a. Maintain data integrity when making changes
Other Features to the computer system, such as software
1. Direct Entry of Data upgrades, security and performance patches,
a. Use prompts, flags, and other help features to equipment repairs, etc. q
encourage consistent use of terminology. q b. Carefully evaluate effects of any changes
b. Use prompts for data out of the specified range. before and after making them. q
Specify valid vs. invalid ranges and alert user. q c. Validate changes that exceed previous
c. Do not set up system to enter default data if operational limits. q
field is bypassed. q d. Document all computer system changes. q
d. You may allow system to populate field with 6. Training
data duplicated from another field. However, a. Ensure that individuals who develop, maintain
analyze potential consequences very carefully and use computer system have sufficient
before doing so. q education, training, and experience to perform
2. Retrieving Data tasks. q
a. Design computer system to attribute data record b. Document computer education, training, and
to each individual subject. q experience of personnel. q
b. Be able to reconstruct source documentation for c. Provide training in the operation of the computer
FDA review. q system led by qualified individuals as needed. q
c. Be prepared to fully describe to FDA how data d. Conduct training sessions as needed on
were obtained and managed. q a continuing basis in case of changes in
3. Document what software and hardware is used. q personnel and the computer system. q

About Phoenix Software International

Phoenix Software International, Inc. is a major systems software development company providing advanced software solutions to enter-
prises around the world. Our diverse products support IBM and compatible mainframes, personal computers, and local and wide area
networks. Phoenix customers range from small entrepreneurial companies to major federal and state agencies to Fortune 500 leaders.

Phoenix develops Entrypoint, a software product designed for creating, deploying, and administering custom clinical trial applications.
The software was originally introduced in 1981 and was one of the first products available for electronic data capture. Entrypoint is the
software of choice for organizations that have been using EDC since the technology began.

Today, Entrypoint i4 consists of a web interface for data entry and administration plus three cross-platform desktop applications:
Application Studio, Desktop Workstation and Desktop System Manager. The product has a built-in database but can interact with
MySQL or Microsoft SQL Server.

Entrypoint i4 has special features for clinical trials including electronic CRF templates, powerful security options, a full audit trail,
comprehensive field checking, electronic patient reported outcome (ePRO), and more.

2016 Phoenix Software International.

Entrypoint, the P logo and Phoenix Software International are registered trademarks of
Phoenix Software International. All other trademarks are acknowledged and respected.