Statement on Epic Compliance with 21 CFR Part 11

MUSC faculty and staff use electronic applications to maintain records that include human research activities, which are governed by FDA regulations. This statement provides the MUSC response to sponsor requests for certification of compliance with 21 C.F.R. Part 11 (“Part 11”) and provides information about MUSC’s use of Epic Electronic Health Record System (EHR) with Part 11 requirements. This is intended to be consistent with FDA guidance on the use of EHR data in clinical investigation.

Epic Electronic Health Record System is ONC Health IT certified. The FDA has stated that “use of such certified EHR technology is encouraged and, if used, would give FDA confidence during inspections that the EHR data is reliable and that the technical and software components of privacy and security protection requirement have been met.”

In addition, based on an internal analysis, there are no known issues that currently suggest that MUSC’s Epic Electronic Health Record System together with the Institution’s electronic authentication system, is not compliant with Part 11 requirements and neither the Institution’s institutional review board nor, to our knowledge, any individual MUSC researcher functioning as a sponsor and/or investigator has been cited for non-compliance with Part 11.

The FDA has not published certification criteria or a certification process for Part 11. Moreover, the FDA Guidance for Industry on Electronic Source Data in Clinical Investigations (September 2013) states, “The FDA does not intend to assess the compliance of EHRs with Part 11.” As a result of this guidance, Epic has no plans to certify their EHR to Part 11. Given the lack of specific detailed certification criteria, the FDA’s own industry guidance, and Epic’s position with respect to the FDA Guidance, MUSC is unable to provide any absolute representation or warranty of compliance to Part 11.

Sponsors or others seeking certification of compliance may be provided with a copy of this letter. MUSC researchers performing FDA-regulated studies may rely on this compliance statement or may print out and physically sign required documents and maintain these with other required research records. FDA has specified that it will exercise “enforcement discretion” where electronic records and signature are committed to physical writings and appropriately countersigned to assure security and non-repudiation.

Questions about this statement may be directed to:

Patrick Flume, MD
Associate Vice President for Clinical Research
96 Jonathan Lucas Street, Room 816-CSB
Charleston, SC 29425
Phone: 843-792-3167