How to Write and Implement Data Integrity Policy?
Implementation of Data Integrity Policy (DIP) is a compulsory need in today's regulatory environment. This policy helps the pharmaceutical companies to come out from the terrifying consequences of a breach of data integrity. The data integrity policy gives control to the company's management over the manufacturing activities and sets a compliance standard in the company. The regulatory agencies definitely appreciate the company that implements the data integrity policy because it's the first step in preventing the manufacture of adulterated drugs.
In this era of modern technology, reliability and accuracy of the data are the growth factors for any kind of business.
The data management and the level of controls to protect the data integrity determines the future of a pharmaceutical company.
Therefore, there should be a well-defined policy on data integrity, which must reflect the core value and commitment of the company.
The data integrity policy is an important one among all other policies and every company should possess it.
It has to be written very carefully because it reflects the commitment of the company for data protection and its maintenance.
Before writing the policy, you should be aware of what data your company produces. Even before that, you should have a thorough understanding of the importance of data.
Data management plays a vital role in the pharmaceutical business.
The Importance Of Data In Pharmaceutical Industry
Pharmaceutical industry, mainly deals with the health of the public. It manufactures medicinal drugs. Pharmaceutical drugs are chemicals which are identified and used for the treatment of diseases.
Our human body also produces certain chemicals. It regulates them very intelligently to preserve and sustain its existence in nature. We all know the chemical imbalance in our human body leads to many diseases. So we take the medicines to balance these chemicals. It means the shortage of chemicals in the human body is fulfilled by sending pharmaceutical drugs into it through various ways.
So it's clear that the only chemical that can cure your disease should be in the medicine. The additional chemicals in it naturally harm the body and create new diseases. These additional chemicals are called impurities.
Impurities will come along with the main ingredient due to the limitations of the manufacturing process or inefficient manufacturing process or carelessness during the manufacturing process.
Hence, it is essential to record each and every detail of drug manufacturing. Evidence should be in place to prove the compliance of pharmaceutical drug manufacturing with cGMP. Documentary evidence must be established to show a medicinal drug contains no impurities or the impurities are within the acceptable criteria.
The accumulation of all these details, at all steps of manufacturing, is called data. Data may exist either in paper or electronic form or in a hybrid (paper + electronic) state. This data is the main source for the evaluation of the drug manufacturing process. Regulatory agencies verify this data and judges whether the drugs are manufactured as per the regulations set forth in the law or not.
Hence, the sanctity and integrity of the data have absolute importance in the drug approval process. The completeness, consistency, and accuracy of the data will decide the fate of the pharmaceutical company.
The Role Of Data Management In Pharmaceutical industry
The data provides information about the work being executed.
Based on this information, the decision will be taken to move the things further.
So data management is a crucial part of the business environment.
Management of data includes multiple tasks.
The following things are the part of data management.
- Sources for the generation of data.
- Type of the data. Example: videos, photographs, text/numeric, microfilms, paper records, electronic records etc.
- Data structure. Example: structured data (database) and unstructured data (email, MS Office docs)
- Data storage media.
- Handling of Data.
- Ease of searching data.
- Data security measures.
- The lifecycle of data.
Perfect data management ensures the accuracy of the information. The more accurate the information, the sharper the decision.
Guiding Principles To Write And Implement The Data Integrity Policy
Writing a policy for the data integrity is not an easy task as you think. It requires a complete understanding of your business, current practices, existing policies and regulatory requirements.
You must take into account the capability of the organization to implement the policy. It demands a significant technical, human and monetary resources for its successful implementation.
First of all, management has to identify and declare a responsible person (Policy Owner) to prepare and implement the data integrity policy.
You must select only the expert as a policy owner.
Then follow the steps given below to write the policy.
- Define the scope of the data integrity policy.
- Collect all the necessary information.
- Form a team to discuss the policy include employees from all departments & work levels.
- Prepare a draft of data integrity policy.
- Take the legal opinion on the policy.
- Publish the data integrity policy.
- Prepare procedures to implement the things written in the policy.
- Train the employees on the policy and its relevant procedures.
- Review the data integrity policy periodically.
Let us go through some details of each step, for better understanding and effective writing of the policy.
Setting A Background To Write The Data Integrity Policy
1. Define the scope of the data integrity policy
Then prepare a blueprint of data sources in your company. It should include each and every department, which is linked to your commercial product.
Now list out the areas that fall under the policy's scope.
2. Collect all necessary information.
Collect the information from all departments. The given below table is an example.
Collect all the incidents related to data integrity. List out all the root causes and verify the effectiveness of the CAPAs. Document the Limitations and failures of CAPA if any.
List out all kinds of software and firmware which are in use in the company. In the same way, collect the details of paper documentation in all departments.
List out all the possible sources that can lead to the breach of data integrity. This list should include both technical and human elements.
3. Form a team to discuss the policy
Discuss the following things based on the above-collected information:
- The necessity of the policy
- The scope of the policy
- Existing issues of data integrity
- Solutions for the data integrity issues
- Guidelines to include in the data integrity policy
- Handling of policy violations
- Consequences for the violation of policy
Preparation Of A Draft For The Data Integrity Policy
Write the policy using a clear and active language. Statements should contain few words which do not lead to any confusion and complexity.
The clarification that provided to understand a statement should never alter the core meaning of the policy.
Prepare the policy in the following format. The aim of the examples stated here is only to provide an idea to you.
You have to write the policy considering your company's size, resources, existing policies and business.
An example format of the Data Integrity Policy (DIP):
1. Title
Title: Global Data Integrity Policy.
2. Purpose
Quality of the pharmaceutical products is built on the accuracy and completeness the data generated during the manufacturing process. Data integrity is a core part of the pharmaceutical quality system. Compliance requirements are equally applicable to both electronic data and paper records.
The purpose of Data Integrity Policy is:
- To set a global standard for the maintenance of both electronic data and paper records in the organization.
- To bring transparency in all manufacturing activities.
- To meet all government regulations and ensure compliance with cGMP.
3. Scope
All the departments and divisions at the corporate level and all the departments in the manufacturing plants should comply with this policy.
4. Responsibility
- Compliance officer is responsible to publish and implement the policy.
- Individual departments are responsible to prepare procedures in support of the policy.
- The Corporate Quality Assurance department is responsible for the monitoring of performance indicators.
- It is the responsibility of every employee to comply with the policy.
5. Policy
A. Software
- All software which is used in the business and manufacturing activities should contain an audit trail function to track the activity of the user. If this function is not available, establish the alternate tracking system.
- User must access the software through an individual login account.
- The expiry date of a password is 90 days.
- All software must be validated after the installation.
- The administrator for all software shall be from Information Technology (IT) department.
B. Electronic Data Backup
- Electronic data backup shall be done by Information Technology (IT) department.
- Use only validated data backup methods for the backup of all kinds of electronic data.
C. Employee Behaviour
- All employees in the organization must follow this policy and must comply at all times.
- Employees must report the violations immediately through the defined reporting system.
- Employees should not breach the data integrity, in any form, intentionally with wrong motives.
- An intentional approach for the breach of data integrity is subject to the disciplinary actions mentioned in the Section: Consequences for breach of the Data Integrity Policy.
6. Reporting of Data Integrity Policy Violations
- It is the responsibility of every individual, department and division to bring all violations of this policy, to the notice of senior management through the below-defined reporting system.
- Report the issues through email. Use the below e-mail ID for the reporting of issues.
Email ID: chiefcomlianceofficer@xyzpharma.com - The chief compliance officer immediately initiates the investigation on policy violations and informs the senior management.
7. Consequences for breach of Data Integrity Policy
A. Disciplinary Actions - Violation of policy due to insufficient training.
- Do not allow the employee to perform the tasks.
- Provide the employee effective training.
- Evaluate the employee's knowledge of the policy after the retraining.
- Allow the employee to perform the tasks after satisfactory completion of retraining.
B. Disciplinary Actions - Violation of policy due to negligence
- Give an informal warning in the form of advice for the first violation.
- Issue a formal warning letter for the second violation
- Suspend the employee for a month for the third violation.
- If the violation repeats more than three times consider it as an intentional violation and disciplinary action shall be initiated as per the section " Intentional violation of policy"
C. Disciplinary Actions - Intentional violation of data integrity policy
- Immediately suspend the employee for 6 months.
- File the complaint and investigate the root cause and estimate the impact of the violation on the product or patient.
- After the completion of the investigation, terminate the employee.
8. Definitions
Chief Compliance Officer: He is the person who is responsible to implement the policy across the organization and investigates all violations of the policy as per the laid rules in the company. He is responsible to report all violations to the senior management.
9. Related Documents
Data Integrity – An international regulatory perspective
MHRA-‘GXP’ Data Integrity Guidance and Definitions
Data Integrity and Compliance With Drug CGMP
21 CFR of United States
Human Resources Policy (Company's internal policy)
After the completion of draft preparation, send the copy to all team members and all department heads and their second line of management for the review of policy. Consolidate all the opinions and suggestions; evaluate them. Consider only those points which are not affecting the goal of the policy. Make a final draft and proceed for the legal opinion.
Take Legal Opinion On The Policy
You can protect yourself from many legal disputes by seeking a legal opinion before the enforcement of the policy.
Since the pharmaceutical companies are dealing with the people (staff and patients) and regulatory agencies, the policies will fall within the jurisdiction of the courts.
Hence, you should write the policy carefully by selecting appropriate words. You must give the definition of all critical words that used in the policy, to remove the doubts and eliminate uncertainty.
Finding the right reviewer to review the policy is a great challenging task. The reviewer must be an expert and should have adequate knowledge on both statutory requirements of the company and drug regulations.
Legal opinion is required because you have to take a particular course of actions against the persons who break the policy. In such cases, you should not crush the fundamental rights provided by the constitution.
Sometimes the lapses in your policy may harm the patients significantly. So, these matters are very delicate and to be handled carefully and legally.
The policy should not go beyond the law since the existence of the company itself is based on the law. The guidelines composed in the policy should be meaningful and practical.
The company must ensure the prepared policy is legal and fair. After the expert's review, tweak the document as per his suggestions and make ready the final copy.
Publishment Of Data Integrity Policy
The final draft of the policy, which was reviewed by the attorney, should go for the approval of senior management who is ultimately responsible for the business.
Senior management has to review the document thoroughly and once again look into the requirement of resources to implement the policy effectively. Why, because the implementation of some guidelines may need resources immediately. Hence, it's better to ensure the availability of all required resources before the approval of the policy.
Otherwise, it will lead to so many other issues which may drag the company into legal disputes. It is not fair to expect the employees to comply with the policy, without proper arrangements of the needed things.
After finishing the approval process, publish the signed document and release the copies of it to all the relevant people.
Preparation Of The Procedures For The Implementation Of The Policy
Once the official copy of the data integrity policy is published, get ready to prepare the procedures to implement the policy. There is a difference between policy and procedure.
A policy gives you overall guidelines to follow. It reflects the organization's culture and values. It explains the expected behaviour of the employees and the required standards of legal, regulatory or internal standards.
On the other hand, a procedure provides the mechanism to implement the policy guidelines. It directs the ways of implementation along with the instructions and methods.
Prepare the procedures department wise. This is because the type of data, software and firmware differs based on the nature of the work and scope of the software/firmware application. Procedures must include a detailed method, instructions, and logical steps. The procedure is all about what to do, when to do, how to do and who has to do.
Policy Statement
Backup of electronic data shall be done in all departments and data shall be retained up to the necessary the period.
Procedure
Electronic Data Backup Procedure for QC Department :
The electronic data is generated in the QC lab during the testing of all kinds of materials. Different types of software and firmware are used in the analytical testing process. The electronic data that generated from all the instruments of QC shall be backed up periodically. The activity shall be performed as directed below.
- Data backup shall be taken by the IT personnel as per the SOP: IT-SOP-QC 001 / Version:00
- Data backup shall be taken for every instrument as per the defined period in the SOP: IT-SOP-QC 001 / Version:00
- Data shall be backed up onto the media that defined in the SOP: IT-SOP-QC 001 / Version:00
- Electronic data shall be retained based on the product's requirements which are described in the SOP: QC-SOP 001 / Version:00 Title: Record Retention and Destruction.
- Backed up electronic data shall be destructed safely, after the completion of its retention period, as described in the SOP: QC-SOP 001 / Version:00 Title: Record Retention and Destruction.
The above example is just an outline of the procedure, for the understanding purpose and to give you an idea. You have to write the procedures as per your company's standard format.
It's necessary to develop procedures department wise for the implementation of the policy. Otherwise, the policy will remain only on the paper. Having a policy without the right mechanism of implementation is a quite dangerous situation and leads to severe non-compliance issues.
Train The Employees On The Policy And Its Relevant Procedures
Another crucial step in the policy implementation process is training to the employee on the policy.
Circulate the policy copies to each and every employee and ask them to read and understand. Then take a signature on the copy as a token of his agreement to the policy and file it.
Conduct the training programs on the policy and procedures by showing practical examples. Evaluate the effectiveness of training and document it.
Collect the queries raised during the training program and prepare a document called "Frequently Asked Questions and Answers".
Ensure the availability of copies of 'Data Integrity Policy' and 'Frequently Asked Questions and Answers' at the workplace of the employee.
Periodical Review Of The Data Integrity Policy
No policy is eternal. It is subject to change based on the current needs and the latest regulatory requirements. Similarly, data Integrity policy also may need a change. So it has to be reviewed from time to time to meet the latest requirements.
You have to monitor the policy continually for its performance. The length of the success to be measured periodically, to understand what is needed for the improvement of the policy. Define the performance indicators to measure the strength of the policy to reach the specified goal.
You can consider the number of incidents, technical errors, and manual mistakes (intentional and unintentional) as the performance indicators. Measure the performance periodically and record the data.
Figure out the critical problems which are affecting the aim of the policy. Evaluate the existing procedures, based on the listed out critical problems. Identify the gaps and strengthen the procedures by including some new steps or removing the unnecessary steps.
If the performance of the policy is not satisfactory, even after the implementation of effective procedures in support of it, it means that the time has come to reassess that policy.
Revise the policy as per the needs and regulatory requirements to reach the final goal.
Summary
The data integrity policy is an essential requirement for any pharmaceutical company. This policy holds the company's staff to the defined standard and enables the company to get over all control on the business.
Prepare the policy after a rigorous brainstorming based on the existing data of data integrity issues. Take a legal opinion on the policy before its implementation.
Explain the meaning of the key terms in the policy for a better understanding of employee. Develop procedures in each department for the successful implementation of the policy.
In the whole process, training of the employee on data integrity policy is the major task to execute cautiously. Clearly define and communicate the consequences for the breach of data integrity policy.
Monitor the performance of the policy using some performance indicators and do the needful changes based on the feedback. Review the policy periodically and revise it based on the current needs and requirements.
Data integrity policy increases the confidence of the regulatory agencies in the company's manufacturing activities.
SHARE this article with your friends, if you feel this is helpful. It may help them if they are in need. Each one help one.
Suggested Readings
Click on the topic to read article.
Author Profile
Ram Kumar Reddy
Ram Kumar Reddy is the founder of Pharma Times Now. Helping Pharmacy and Chemistry students, along with the pharma employees, in learning pharmaceutical science. He has 24 years of rich experience in the Pharmaceutical industry and well versed in quality systems. He worked with Dr.Reddys and Sai Life Sciences. He lives in Hyderabad, India.
excellent work. very helpfull.
ReplyDeleteNice Post!!
ReplyDeletePlease look here at Privacy Compliance Solutions
Great post. Thanks for one marvelous posting! I enjoyed reading it. The information was very useful.
ReplyDeleteThird Party Manufacturing
Third Party Manufacturers
one of the best blogs has been put by you! Thanks for sharing this information. Keep it up.Best company for Pharma Franchise Marketing
ReplyDeleteone of the great blogs has been put by you! Thanks for sharing this information. Keep it up.PCD Pharma Franchise in Karnataka
ReplyDeleteone of the great blogs has been put by you! Thanks for sharing this information. Keep it up.PCD pharma franchise in Hyderabad
ReplyDeletegreat blog! Thanks for sharing this . Keep it up.pcd pharma franchise in ahmedabad
ReplyDeleteawsome post! Thanks for sharing this information. Keep it up.Taxi Services from Chandigarh to Shimla
ReplyDeleteAwsome post! Thanks for sharing this information. Keep it up Best General Medicine PCD Pharma Franchise Business
ReplyDeleteIf you're looking for our Pharmaceutical Company in Chandigarh, I highly recommend exploring the opportunities offered by the top-notch franchise providers in the region. With comprehensive support, high-quality products, and transparent business practices, our Best Pharmaceutical Company in Chandigarh ensures long-term success and growth for your pharma business.
ReplyDelete