QP CERTIFIKACIJA SERIJE LIJEKA NA DALJINU – POSTAJE LI TO REDOVNI GMP PROCES

Pojam home office je tijekom zadnjih nekoliko godina postao nešto sasvim normalno i uobičajeno, a tome se sada pridružuje i GMP, točnije proces certifikacije i puštanja serije lijeka u promet. Naime, EMA (European Medicines Agency) je upravo objavila nove detalje oko QP certifikacije serije lijeka na daljinu (remote batch certification/confrmation) pri čemu su ključna tri elementa o kojima više detalja donosimo u nastavku. Također, bit će zanimljivo pratiti hoće li mogućnost certifikacije serije lijeka na daljinu u nekom obliku ući i u prvu sljedeću reviziju EU GMP Annex 16.

Je li i kada je dozvoljena QP certifikacija na daljinu?

Prema najnovijem službenom stavu EMA-e, certifikacija na daljinu je načelno moguća, ali mora biti prihvaćena i odobrena od strane nacionalnog nadležnog tijela. Za sada još nema konkretnih informacija o tome kako bi taj postupak odobrenja trebalo provesti. Uz to, nužno je ispuniti i niz operativnih, proceduralnih i tehničkih preduvjeta – više o tome u nastavku.

Koji su ključni preduvjeti za QP certifikaciju na daljinu?

U slučaju da je QP certifikacija na daljinu dozvoljena od strane nacionalnog nadležnog tijela, treba ispuniti niz preduvjeta; evo što donosi originalni tekst zahtjeva koji je objavila EMA:

It is a prerequisite that the QP certification/confirmation is carried out in full accordance with EU legislation and EU GMP guidelines.

QP certification / confirmation should take place within the EU/EEA (or Northern Ireland) in all cases. This should be demonstrated by technical means.

QPs are obliged to maintain their knowledge in relation to the products, manufacturing processes and pharmaceutical quality system. QPs also need to be satisfied that their ongoing reliance on the relevant pharmaceutical quality system is well founded. The QP must be able to demonstrate to the competent authority knowledge of the product and the manufacturing processes for which they are responsible. This should include time spent physically on-site as applicable.

Where remote QP certification / confirmation is employed on a routine basis, it must be described and controlled within the pharmaceutical quality system and relevant detailed site procedures should be in place. In Member States where use of contract QPs (i.e. a person who is not an employee of the manufacturer but conducting QP activities under the manufacturer’s authorisation) is permitted, the technical agreement between the MIA holder and the QP should also mention remote certification / confirmation, and specify the circumstances under which the QP must attend the site.

The QP should have access to all information (data and computer system applications) which are necessary according to Annex 16 to make a decision on batch certification / confirmation.

The MIA holder should provide the required facilities to enable QPs to carry out their functions remotely. This includes the equipment and support required to enable electronic batch certification / confirmation and completion of the batch certification register remotely. IT systems used for remote batch release should comply with requirements of EU GMP Annex 11.

All actions carried out by the QP electronically at the remote location should be contemporaneously available for inspection by the competent authorities at the authorised batch release site. It is the responsibility of the MIA holder to guarantee that a) only the QP has editing access to the batch certification function, b) that data being transferred are complete and unchanged and c) an electronic signature, reflecting requirements in annex 11, is in place. QPs must be able to demonstrate that they are fulfilling their wider duties in accordance with Annex 16.

Compliance with the above points should be verified e.g. as part of the self-inspection programme at the authorized batch release site.

Koje tehničke zahtjeve treba ispuniti kod QP certifikacije na daljinu?

Ovo je pitanje važno zbog toga što pristup na daljinu može značiti veći rizik za IT sigurnost i integritet podataka nego kada se softverske transakcije provode u sklopu kontroliranog okruženja unutar lokacije kompanije. U nastavku donosimo popis najvažnijih zahtjeva, ponovno u originalnom obliku:

Prior to transfer of any hardware off-site it should be identified and inventoried. It should be ensured that the hardware remains complete and up-to-date. The hard disk should be encrypted and any ports that are not required should be disabled.

For QPs who may be using a virtual private network, security parameters on the network operating system, database and application level should be configured appropriately to avoid unauthorised access.

Recognised industry standards should be used for authentication and authorisation (e.g. two-factor or multifactor authentication). There should be no use of shared authentication information, and automatic expiry of authentication information should be employed.

Data in transfer should be secured by strong transport encryption (e.g. TLS 1.2, https)

The MIA holder is responsible for putting organisational controls (e.g. assignment of individual privileges) and technical controls in place to ensure that only the QP is able to perform remote batch certification / confirmation.

Tekst o QP certifikaciji serije lijeka na daljinu za sada je dostupan na GMP-GDP Q&A dijelu web stranice EMA-e.

Neovisno o tome provodite li certifikaciju serije lijeka iz službenog ureda, iz dnevnog boravka ili s balkona, uvijek je važno da kao QP budete maksimalno učinkoviti. Evo kako biti učinkovitiji QP kroz 7 praktičnih koraka.