Imaging VARs Profit When They Follow The Rules

Beautiful beaches, ocean breezes, delicious food, and a piña colada or two are probably what attract most visitors to Puerto Rico. However, dozens of large pharmaceutical manufacturers are lured to this tropical paradise by tax incentives and low labor costs. According to the Puerto Rico Industrial Development Co. (PRIDCO), during the fiscal year 2000, 25% of all pharmaceutical products manufactured in the United States were shipped from Puerto Rico, including 16 of the top 20 prescription drugs. Integrators like Altos Technologies, Corp. (Bayamon, Puerto Rico) know that where there's a pharmaceutical facility, there are stringent FDA (Food and Drug Administration) regulations to meet - and a need for document imaging and management to insure compliance.

From the end user's perspective, perhaps the most insidious of these regulations is FDA 21 CFR (Code of Federal Regulations) Part 11. Though Altos serves a number of vertical markets and offers products ranging from forms processing to mass storage, Joe Marcial, president, and Victor Medina, VP, focused a portion of their young company's resources on easing a headache for which no other VAR seemed to have the prescription. 21 CFR Part 11 sets the demanding standard pharmaceutical companies must meet when maintaining electronic records of everything from clinical data and studies to equipment maintenance and adverse events.

Altos' first step in tackling the challenge of 21 CFR Part 11 compliance was to hire a pharmaceutical software validation company to perform a gap analysis of its primary content management product. The assessment, which outlined what enhancements the product would have to undergo to meet the FDA specifications, cost Altos $3,000, but it was money well spent. When the integrator took the final report back to the software vendor, its development team made some modifications which, when combined with technologies such as digital signatures, offered a suitable solution.

Provide Airport-Style Security For Document Access
As in many industries, security is a major factor in compliance with FDA regulations to ensure results haven't been tampered with. To meet the standard, there are several layers of security that must be applied. There is the physical security of the building, as well as network access. Being able to sign onto the network doesn't automatically allow access to documents. 21 CFR Part 11 compliance requires document-level security. "Before you open any document, you have to prove that you are who you say you are," comments Marcial. "This often requires a combination of user name and password or a biometric signature." When a user tries to access a document, a window pops up requiring them to enter the reason they need the document. "You have to have the security profile for both the application and the document before you can view it," adds Marcial. "That profile determines whether you get to see only the most recent version of the document or all previous versions as well."

Version control and auditing are crucial aspects of 21 CFR Part 11 compliance, and providing those functions gives Altos an edge over potential competitors. Paradoxically, records must be both permanently unalterable and accurately reflect the current status of a project. As a result, every time a document is updated, both the original and the updated version must be maintained. Assuming a user has the correct profile, he or she must complete an electronic form explaining why the change was made and append a digital signature to it. That data is maintained in an audit log. "Many software products will provide an audit log as a single record or stream," says Marcial. "That requires a user to read through the entire document for a specific piece of information." Altos offers a searchable record that can call up a specific action so that, in the event of an inspection, answers can be provided quickly.

"Tying that audit log to the record and the version control is probably one of the most challenging aspects of 21 CFR compliance," says Marcial. "Very high-end software products can provide that, but they can be expensive. Even if you could find a developer who would be willing to create a solution, it can't be done with an SDK [software developer's kit]; it has to be directly in the code of the application itself." All of these documents must be permanently preserved on a storage device that ensures they cannot be altered.

For Pharmaceuticals, It's More Expensive Not To Buy
It might seem like the complexity of complying with 21 CFR Part 11 regulations could make customers view the cure for document overload as worse than the disease. However, on a hurricane-prone tropical island 35 miles wide and 100 miles long, maintaining climate-controlled, physically secure storage for paper documents isn't easy or cheap.

Physical document storage also reduces response time during unannounced FDA inspections in which requested paperwork must be produced as quickly as possible. The storage facilities are often unpleasant for the workers and difficult to organize. "When an FDA inspector walks in and starts demanding specific documents, plant operation comes to a halt that day because so many people must be sent in search of dead documents," notes Marcial. "One company on the island couldn't provide requested documentation and received a fine so huge it had to reduce its workforce, and eventually closed. The loss of even one document means a medication has to be pulled off the market until the lot is identified."

In order to make the sale, Altos must provide a solution that meets the needs of several decision-makers at the facility. Initially, Marcial suggests approaching the quality control director or document retention officer, often an engineer who is keenly aware of the regulatory requirements. "The quality control director is usually immediately sold, because keeping electronic records will help him sleep better at night," comments Marcial. "Then he'll bring in the IT director to analyze the solution and make sure it will fit the network environment." The final hurdle is often the general manager or controller who has to be sold on the cost justification of the solution, but maintaining government compliance is much more important than price. "If it's FDA-compliant, the company will usually go out of its way to see how it can be cost-justified," contends Marcial.

According to Marcial, the most frequent concerns among end users in this vertical are legal issues and permanence. Once he explains the evidentiary value of electronic documents, the tamper-resistant storage media, and backup software, most customer fears are allayed.

Old Paper Documents, New Revenue Opportunity
Of course, if a customer is convinced of the value of using electronic documents, he also sees the value of converting existing paper files to digital images. As a service bureau, Altos is well acquainted with operating high-volume scanning operations, but because of the security associated with these documents, pharmaceutical companies won't release their documents. As a result, Marcial and Medina often oversee the operations of a temporary "document factory" located on-site for anywhere from four months to a year. Altos brings in high-speed scanners such as Fujitsu's 4099, which scans 180 pages per minute. "It's not the easiest conversion," admits Marcial. The documents are often oddly shaped, such as testing equipment strips or calculator paper. The pharmaceutical company also requires Altos to provide workers with a higher level of security clearance, which means the integrator has to pay them more than the average scanner operator.

As long as the Puerto Rican government continues to make the island an attractive destination for an industry that exports more than $20 billion worth of products annually, Altos Technologies plans to chase away any clouds the FDA might create. Since Altos expects to make $5 million in its second year of business, it looks like there are plenty of sunny days ahead for the integrator, as well as for its customers.