FDA

Is your system validated?

Is your system used to create, modify, maintain, store, archive, retrieve or transmit patient Protected Health Information (PHI) under Health Insurance Portability and Accountability Act (HIPAA)?

Does your system use Electronic Records?

Are Electronic Signatures used?

Are the records in electronic form created, modified, maintained, archived, retrieved, or distributed by a computer system?

Are the signatures executed in the system a computer data compilation of any symbol or series of symbols executed, adopted, or authorized by an individual to be the legally binding equivalent of the individual’s handwritten signature?

Are records protected against intentional or accidental modification or deletion?

Do you have a strategy defined or documented for the backup, restore and retention process? If so, has it been tested?

Does your system have access control?

Do you have policies and procedures to ensure both internal and external security?

Does your system maintain an audit trail that is readily available for an inspection?

Does the system ensure that only authorized individuals can use the system?

Does the system verify that an individual has the authority to electronically sign a record before allowing the individual to do so, or deny access to invalid users?

Do you have documentation to show that people who use the system have the education, training, and experience to perform their assigned tasks?

Do you have a Change Control procedure in place for System upgrades?

Are policies and processes established to certify that an electronic signature is the legally binding equivalent of the signer's handwritten signature?

Is your system used to electronically sign, electronically approve, or electronically archive data-containing regulatory submission documents for investigational or marketing applications to Health Authorities?

Does your system have any impact with respect to patient safety or Product Quality or Business Continuity?

Does your system directly affect the design, conduct, performance, auditing, recording, analyses, and report monitoring of adverse events in clinical studies of investigational products?

Is your system used for collecting, assessing, monitoring, and reporting adverse events for drug products?