How do you apply the principles of data integrity and security to your PQ data and records?

?? Ensuring data integrity and security is crucial in today's digital landscape. One key step? Clearly defining roles and responsibilities for all involved. From the PQ team to system owners and administrators, everyone plays a vital role. By outlining responsibilities in a PQ plan, we establish clarity, accountability, and prevent conflicts. Let's build a framework that safeguards our data and fosters trust. #DataIntegrity #Security #RolesResponsibilities

Data Integrity 1.Validation of Data Collection Methods: Ensure that the methods used for collecting PQ data are validated and capable of producing accurate and reliable results. 2.Audit Trails 3.Data Review and Approval 4.Change Control Procedures 5.Data Retention and Archiving Data Security: 1.Access Controls 2.Data Encryption 3.Regular Backups 4.Data Transfer Security: Secure methods should be used when transferring PQ data, such as using secure file transfer protocols (e.g., SFTP, HTTPS) and avoiding unsecured channels like email. 5.Security Training 6.Physical Security 7.Incident Response Plan: Have a documented incident response plan that outlines the steps to be taken in the event of a data breach or other security incidents.

In addition to this, 1) We should establish clear RACI and a data integrity plan (can be combined with PQ). 2) Identify the roles such as System Owner, Data Verifier (Testing), Quality Assurance, Validation team 3) Outline the Responsibilities for each role clearly, - System Owner/Business owner: Evaluate need for checks, approve plans, ensure reviews. - Data Verifier (Testing): Conduct checks, document results, forward documents for review. - Validation / Quality Assurance: Provide guidance on procedures, ensure proper documentation, archive completed forms.

Define roles and Responsibilities in Validation is a key for avoid confusion in validation and Data Integrity activities. Below the list of roles would be require in any validation of IT systems are: 1. Process Owner 2. System Owner 3. IT Administrator/Support team 4. CSV 5. Tester 6. Technical SME/ Functional SME 7. Quality Assurance 8. Change Advisory Board 9. IT- Compliance 10. Project Manager Also based on project management methodologies i.e Agile, Waterfall, Devops, roles and responsibilities may varies. Note: Please make sure all project team must be follow data integrity ALCOA++ principles in entire SDLC process. #addcomment #csv #gamp #annex11 #21cfr

Data lifecycle management is an approach to manage data throughout life cycle from data creation to data destruction. Specially in regulatory life sciences industry produce large amount of data from clinical research development to Supply chain data based on criticality divided into two type are GxP, Non- GxP. Data Management policies and procedure must be established to governance data in life sciences industry. Data Management policies prepared based on FDA regulatory guidelines, Data Integrity guidelines ALCOA++ Data Management life phase are : 1. Data Creation 2. Data Process 3. Data Storage 4. Data Archival 5. Data Destruction #addcomments #csv #data #management #lifecycle #dataintegrity #fda

ALCOA+ helps as guidance for data integrity as outlined by 21 CFR Part 11.. These principles ensure data is trustworthy from creation to destruction, Following these principles ensures data reliability and compliance throughout its lifecycle. - Creation: Data must be clear, timely, and accurate. - Processing: Data handling must maintain accuracy. - Use: Data must be reliable for analysis and reporting. - Retention and Retrieval: Data storage must be secure and accessible. - Destruction: Data must be securely removed at the end.

ALCOA+ is a set of principles used in Good Manufacturing Practice (GMP) within the pharmaceutical and healthcare industries to ensure data integrity and quality throughout the data lifecycle. ALCOA+ stands for: Attributable, Legible, Contemporaneous, Original, and Accurate. The "plus" (+) in ALCOA+ signifies additional considerations beyond the original ALCOA principles. These additional considerations often include: Complete, Consistent, Enduring and Available. Implementing ALCOA+ principles ensures that data generated and recorded in pharmaceutical manufacturing processes are of high quality, reliable, and compliant with regulatory requirements.

Validated software tools like Kneat can be used to make execution of validation efficient and effective. We need to ensure that software tool is validated and in compliance with regulatory guidelines like 21 CFR 11 before using it.

In my experience, data review and verification is part of the executed protocols. Evidence should be provided by tester to ensure data meets the pre approved acceptance criteria. Executed protocols should be approved by Validation, System Owner, and QA as a minimum.

- To protect data from unauthorized access and changes, we should have a structured process. This includes, a. defining how users get access, b. managing who can access what, c. removing access, when necessary, d. specifying user roles (including admin roles), e. and regularly reviewing access. - Shared read-only user accounts that do not allow the user to perform regulated functions and for viewing data only. - Technical or procedural controls over export and printing of tot be implemented to protect data and information. - Methods to detect unauthorized, altered, and/or deleted data or records to be implemented, such as audit trail review and periodic monitoring.

User access levels should be tested as part of OQ / UAT. OQ / UAT should contain positive and negative tests for user access levels and responsibilities. For example, supervisor can perform their duties as per URS but can't perform admin duties. This should be tested and documented with the evidence provided.

PQ / UAT tests should include user access levels, defined responsibilities, and multi factor authentication. Positive and negative tests to be performed to ensure user access level groups perform as expected. Multi factor authentication will help in the protection of data. Modification and deletion of audit trail to be tested as part of PQ to ensure that audit trails can’t be manipulated. A regular review of audit trails should be performed to ensure data integrity is maintained.

- Data lifecycle includes creation, use, storage, retrieval, and destruction. - ALCOA+ requirements must be followed throughout the lifecycle. - Data flow diagrams should be in place to illustrate data movement in systems and processes. - Procedures should clearly define responsibilities to personnel such as System Owner and Data Custodian. - Processes should prevent, detect, and mitigate data integrity risks, as issues can arise at any point in the lifecycle. - Backed up data must remain readable, and Master data should also undergo lifecycle management. We should ensure hybrid systems maintain original records.

- Data integrity risk assessments to be performed. - Data to be generated according to approved SOPs/WIs. - Access to data to be restricted to appropriate personnel, and a user access management process to be in place. - A review process to be in place as specified by regulations, and the frequency of review to be followed based on the assessment of risk. - Implementation a risk-based data verification process. - Migration of data from one system to another to be documented and maintain the integrity of the original source. - Audit trails to be maintained and reviewed - Data and document retention procedures to ensure the protection of original or true copies of data. - Automated or manual backup and/or archive processes, based on risk.

Along with ALCOA & ALCOA+, industries have started ALCOA++ based on recently updated guidance additionally. As per ALCOA++, data or document should be traceable as and when required. This is applicable to all types of records created by regulated pharmaceutical companies.

This whole question (and not just this part) can be answered by baking-in Data Integrity right from the start. As part of the Design Phase - and I use this term in the wider sense - we should ensure that DI is included in all discussions and expectations with vendors and user requirements. This is the best way by far to provide assurance that by the time we get to the OQ and PQ phases that the systems will (or should) already be compliant. Therefore the ALCOA+ principles should be included in the User Requirements. Have sections within your URS specifically for this purpose