Using and Understanding vLog Software's File Security Features: Linking printed documents to electronic records

Overview

Veriteq validatable data loggers are part of a "hybrid" data collection system that combines both secure electronic records and signed paper documents. 21 CFR 11.70 allows for the use of hybrid systems by permitting handwritten signatures to be used in the authentication of records.

Challenge

An important requirement of 21 CFR 11.70 is that a non-refutable link be established between the handwritten signature on any printed report and any related electronic record(s) from which it was produced. This link is essential so that signers cannot repudiate records. As an example, it is important for the system to ensure that a user cannot claim that an electronic record was altered since the time of signing, or that the electronic record presented did not match the one previously signed.

While the record name, size, and the date and time the record was generated can form part of this link, the FDA does not consider those factors as sufficient to create a non-refutable connection.

Solution

In accordance with current good practice, the Veriteq system generates a unique checksum value, called a Logger File ID number, every time data is downloaded from a data logger. This number is then included and referenced in the following system files and documents:

• Logger File Creation Reports
• Logger Files
• Graph files that contain inserted logger file data
• Tabular listings and printouts

The method in which Logger File ID Numbers are generated ensures that it is virtually impossible (one chance in 4.3 billion) that any two logger files can have the same ID number. In addition, any alteration of the electronic record renders the file completely unusable. The combination of these two features provides the non-refutable connection between the original electronic record and the printed and signed reports.