In the regulated environment of the life sciences industry (pharmaceutical and medical technology), computer systems that have an impact on product quality, patient safety or data integrity must be validated according to legal requirements and kept in a valid state throughout the entire system life cycle. This also applies to cloud-based systems, which are becoming increasingly common in the life science industry.
Cloud computing refers to the provision of IT infrastructure and IT services, such as storage capacity, computing power or application software as a service via the Internet, dynamically adapted to demand.
Chapter 7 of the EU-GMP guidelines also applies to the use of cloud services:
- Suitability of the provider must be checked by audits
- Service is to be contractually specified
- Quality is to be controlled by appropriate measures (monitoring)
A special feature here is that the entire supply chain must be considered, since many providers themselves purchase services as cloud services.
For more than 20 years we have been validating various computer systems for SMEs and international corporations (link to customer list), such as ERP systems (including Microsoft Dynamics), document management systems (DMS), laboratory information systems (LIMS), customer developments and spreadsheets (e.g. MS Excel-based applications).
Based on this experience, we have developed a cost-effective and scalable software validation method over the years. The DHC Best Practice Method is a framework consisting of a process model, work instructions (SOPs), templates, training material and tools. It covers the entire system lifecycle from initial implementation, through the operational phase to decommissioning and data archiving.
We have further adapted this method for cloud-based systems. In doing so, we take into account the special characteristics of these systems, such as the reduced user control over the system, management of the service provider or software supplier, protection of data in the system and software changes by the provider