"Language on your firm's website indicates that the ... software provides CADe functionality, utilizing machine learning algorithms to automatically detect and mark abnormalities on medical images, including lung nodules, pneumothorax, and pleural effusion. Your firm's website states that the ... software is capable of functioning as a "Virtual Resident" because it automatically performs an initial review of radiologic images and generates a report listing and characterizing the abnormalities detected in the images, relieving the physician of the task of reviewing the images to identify abnormalities."
"These violations include, but are not limited to, the following:
1. Failure to perform validation of device software as required by 21 CFR 820.30(g). Specifically,
Your firm distributed at least xx Complete Systems consisting of .. laptops with non-validated Desktop research software... During the inspection, you stated that the software is pending verification and validation, and that customers sign an End User Licensing Agreement because the device is not cleared. You stated that the research software has Artificial Intelligence (AI) codes & capabilities."
For example: the Excel spreadsheets used to record complaint records and Corrective and Preventive Action (CAPA) activities have not been validated to ensure the records are adequately and accurately recorded. Changes made to the complaint and CAPA records are not retained with identification of the change, the date of the change or the identification of the individual making the change. Additionally, the spreadsheets allow records to be deleted without any records of the deletion, the rationale for the deletion, or the identification of the individual deleting such records.
Your firm lacked sufficient controls over your gas chromatography (GC) data acquisition systems used to test drug product before release of analytical data. Specifically, your GC (GC (b)(4) and GC (b)(4)) data acquisition systems did not have sufficient controls to prevent deletion or alteration of raw data files. During the inspection, our investigators observed that laboratory personnel performing drug analyses had administrative privileges to the (b)(4) operating software for the GC equipment.
You have also failed to validate electronic worksheets used by laboratory personnel for microbial challenge efficacy testing. Microbial worksheets reviewed were found to use unvalidated cell formulas resulting in erroneous data generation such as negative log reductions and percent reductions including (b)(4) percent and (b)(4) percent for Staphylococcus aureus and Pseudomonas aeruginosa species, respectively. These unvalidated calculations call into question the validity of the data generated from these spreadsheets.
Your ultraviolet-visible (UV-Vis) spectrophotometer computer system lacked appropriate controls to assure the integrity of electronic test data, such as an audit trail and defined user access levels. This UV-Vis system was used for release testing of drug product batches.
It is essential that your firm keeps track of all changes made to your electronic data. The use of audit trails for computerized analytical instrumentation helps to ensure all additions, deletions, or modifications of information in your electronic records are authorized. It also allows you to verify the quality and integrity of the electronic data your laboratory generates.
Your stand-alone gas chromatogram (GC) computer system lacked appropriate controls, such as an audit trail and individual log-in access. For example, investigators found numerous analysis reports, test methods, raw data calibration, and system directories in the GC computer's recycling bin. Additionally, your laboratory personnel used a shared password, located in an unsecured drawer, to access the GC software.
For example:
- You lacked unique passwords for laboratory instruments used to generate analytical data for finished API products.
- Your analytical systems lacked controls to prevent users from deleting electronic data.
- You lacked procedures governing the review of audit trails of both production and laboratory equipment by your QU.
Your firm did not have adequate system security and access control for the (b)(4) system. For example, unique user accounts and privilege levels were not assigned to individual users for (b)(4) software, and the Windows operating system.