The pharmaceutical and life sciences industries are uniquely impacted by records management. In an industry where one failure of processes can mean widespread impacts on public health, strict controls are necessary. Once a new drug is approved by the FDA, maintaining consistency in production is essential to protecting the public. The way for the FDA to do this effectively is to regularly audit the standards and processes of manufacturers. This means having efficient access to documentation and records with a high level of integrity.
Along with meeting the demands of the FDA on the part of the manufacturers, the pharmaceutical industry also deals with a huge volume of very sensitive personally identifiable information (PII). This too is, increasingly, tightly controlled as data breaches become more common and data privacy has been brought into the public eye.
To ensure that drugs are manufactured safely and that the privacy interests of the public are properly upheld, the pharmaceutical industry is regulated by a number of agencies and organizations, including the FDA. These regulations require good manufacturing practices (GMP) to be in place for drug manufacturers and proper records management for pharmacies and hospitals. So, what is documentation in the context of the pharmaceutical industry, and how is it affected by regulation and GMP requirements?
Every industry deals with documentation. Whether your business is a small retailer keeping basic records of inventory, or a global financial institution producing thousands of terabytes of data per day. The management of that documentation, in varying degrees, is essential to operating a successful business. However, for some sectors like the pharmaceutical industry, documentation and records management can mean the difference between drugs being approved and massive fines from regulators.
What Records do Pharmacies Keep?
As anyone who works in the pharmaceutical industry will tell you, there is no shortage of documentation involved in getting a drug from research and development to the prescription counter of your local pharmacist. Given the nature of the industry, much of it is relevant to regulatory compliance. However, there are specific types of documentation and records that are of particular importance. They are:
- Standard Operating Procedures
- Master Formula Records
- Master Packaging Records
- Batch Production Records
- Batch Packaging Records
- Patient Prescription Records
- Patient Personal Information
- Records of Document Integrity
While this is certainly not an exhaustive list, these are the document types that the pharmaceutical industry must give the most consideration to when preparing to meet compliance requirements. A failure to provide these records in full, with records of integrity, or a failure to meet an appropriate disposition and retention schedule, will result in severe penalties.
What is Good Manufacturing Practice (GMP)?
Good manufacturing practices are guidelines provided by regulators that dictate standards for manufacturers in the food, drug, cosmetics, and medical device manufacturing industries. In the USA, GMP guidelines are set out in the Food and Drug Administration’s Title 21 CFR regulation. Most other countries either use the WHO standard or the European Union’s EU-GMP.
The intention of GMP guidelines is to create a baseline for quality assurance and manufacturing consistency to ensure that consumer products are always of sufficient quality. These guidelines extend well beyond simple sanitation or manufacturing standards, however, and are constantly changing. In fact, they are more often referred to as cGMP, or “current good manufacturing practices.”
In the case of the FDA, GMP guidelines set out standard operating procedures and minimum levels of quality control for almost every aspect of the manufacturing process, including:
- Document and records management
- Staff training
- Personnel qualifications
- Sanitation of manufacturing environments
- Equipment verification
- Complaint handling
- Distribution of products
Compliance for manufacturers means ensuring that every area that is covered by GMP is at least within the guidelines. Thankfully, most of the guidelines are relatively open-ended, allowing space for manufacturers to decide how best to meet the standard in their facility. However, that does not mean that they can be taken lightly. Failure to meet standards in any area can result in significant fines, massive loss of stock value, and even jail time.
GMP Document Retention Guidelines for Pharmaceutical Companies
One of the most crucial components of GMP, particularly for pharmaceutical companies, is documentation and records management. So much so that there is even a saying in the industry when it comes to GMP: “If it isn’t written down, it didn’t happen.” While this is an over-simplification, it is a truth that is at the core of meeting compliance requirements.
FDA inspectors must rely on documentation, and evidence of the integrity of that documentation, in order to make their assessment of whether a manufacturer meets GMP standards. On-site inspections can only provide so much information. The bulk of an assessment will be based on the quality of standard operating procedure documentation, clear audit trails, and records of appropriate training and qualifications for personnel.
For this reason, the cGMP guidelines actually include standards for document and records management. For pharmaceutical manufacturers, implementing GMP doesn’t just mean meeting manufacturing, testing, and development. It also means setting up a robust system of document and records management with a retention schedule that ensures regulators have ample evidence to evaluate your practices over a given time period.
Record Retention Schedules for GMP
Record retention schedules are essential to good document and records management in any organization. At a minimum, they provide employees with a clear understanding of when it is okay to destroy a record to free up space. In more complex cases, they protect a business from being fined for lack of compliance or from being left without the necessary evidence to defend against litigation.
For pharmaceutical companies, record and document retention schedules are integral to meeting the FDA’s GMP standards. No matter how high the integrity of your document management system, if records are not being retained for the correct amounts of time, you will fall out of compliance and face hefty fines. Below are some examples of the retention schedules for records relating to finished pharmaceuticals, as outlined in Title 21 CFR Part 211:
- Any production, control, or distribution record that is specifically associated with a batch of a drug product shall be retained for at least 1 year after the expiration date of the batch.
- Records shall be maintained for all components, drug product containers, closures, and labeling for at least 1 year after the expiration date of the batch.
The regulation goes into great detail regarding the retention schedules for specific types of drugs, or drugs manufactured under specific conditions. Naturally, this can make managing your various records a hugely complex issue, particularly for larger drug manufacturers with a wide range of products.
Thankfully, most modern records and document management software that is equipped to handle the FDA GMP compliance requirements will handle this automatically. Documents and records will need to be classified appropriately and the system will automatically apply the correct retention schedule.
Records Retention and Management for Pharmacies
Naturally, when discussing compliance and records retention in the pharmaceutical industry, the focus tends to be on the manufacturers. However, dispensing pharmacies are subject to multiple sets of regulations from the FDA and DEA which both require different records to be retained for varying lengths of time. On top of that, they are also subject to HIPAA regulation with regard to the personal information of their customers and patients.
How Long do You Need to Keep Pharmaceutical Records?
There are many different retention schedules defined by each of the above agencies. However, there are some key retention schedules for each that we have outlined below.
FDA Drug Supply Chain Security Act (DSCSA)
- 3T (transaction information, transaction history, and transaction statement) records must be retained for a minimum of 6 years after the transaction date.
DEA Controlled Substances Act (CSA)
- Inventory records must be maintained for a minimum of 2 years and include your initial inventory, biennial inventory, and your newly controlled substance inventory.
The retention schedules for patient medical records and prescription records are not dictated at a federal level and therefore vary state-to-state. However, general best practice dictates that:
- Prescription records should be maintained for a minimum period of 2 years after the completion of treatment or 42 months, whichever is longer.
- Patient treatment records should be maintained for a minimum of ten years after the last date of service.
As with pharmaceutical manufacturers, dispensing pharmacies will benefit hugely from implementing a consistent and effective records management system. The best platforms should automate the various retention schedules required different regulations and make the issue of compliance an integrated part of day-to-day operations.
Document and record retention and management is a vital part of the foundation of the pharmaceutical industry. It is impossible to separate the implementation of GMP for manufacturers from the documentation of it. The only way for companies to prove to auditors that they are within guidelines is to have records of high integrity which are retained on a consistent schedule that meets compliance.
For pharmacies, accurate records are not only an essential piece of their daily operations. They are also necessary for proving their compliance with regulations from both the FDA and DEA. Failure to maintain the proper retention schedules for both manufacturers and pharmacies can result in significant fines and losses for businesses. Thankfully, companies from both sides of the supply chain can easily minimize risk streamline compliance by simply implementing effective records management software.