Integrating Software Into Hospital Quality Structures: What Practices Do Pharmaceutical Inspector Co-Operation Scheme (PIC/S) Guidelines Recommend?

Introduction

Many health care services are increasingly switching to software-based solutions to digitize paper-based work processes and documentation systems. Examples of such software include computerized provider order entry (CPOE) software and electronic medical records, which can integrate the generation, supplying, administration, and recording of medication orders in a hospital. All these software solutions concern elements of the medication management and use (MMU) process that have critical safety implications and as such, can be regulated and audited. However, software affecting the MMU process can also have functions that provide much greater detail on the supply of medication orders, such as the preparation and compounding of chemotherapy medications for intravenous use. Indeed, this is a process that occurs in a tightly controlled setting and with very high standards of staff training and quality systems.

Many organizations, including the Pharmaceutical Inspection Convention Co-operation Scheme (PIC/S), provide useful guidelines on implementing the switch from paper-based to software systems, which in turn ensure that existing workplace procedures are safe and fit for purpose. Pharmaceutical Inspection Convention Co-operation Scheme is an international organization that sets quality standards and guidelines for inspecting pharmaceutical facilities and assessing medicinal products to ensure their safety and quality, including in hospital settings. Such guidelines can provide the basis for hospitals to prepare their own policies while additionally allowing them to prepare for pharmaceutical inspections in countries where these occur. The timing and reason for inspections vary from country to country. In some European countries, it is the national drug agency that conducts a pre-planned pharmaceutical inspection every few years. This can apply to hospital pharmacies, both in line with national legislation on pharmacy inspections as well as international standards, such as PIC/S standards for health care establishments that act as manufacturers, for hospitals that have committed to PIC/S. Hospitals are considered to act as manufacturers when chemotherapy or extemporaneous preparations are compounded by a pharmacy. In the United States, the Food and Drug Administration (FDA) has no jurisdiction over pharmacies, even hospital pharmacies, unless they carry out compounding, and in that case, only if the medications compounded are sold to another establishment. Hospitals may also have their own internal audits, as a standard process for evaluating the quality of their own processes.

The PIC/S guideline, Good Practices For Computerized Systems In Regulated “GxP,” ¹ contains several important recommendations on developing and implementing software in a way that reduces associated risks, while being mindful of those elements that can be inspected by regulated entities. GxP refers to a collective term for various regulatory guidelines and standards in industries, such as pharmaceutics and health care. These guidelines ensure compliance with quality and safety standards, where “G” stands for “Good,” “P” stands for practice, and “x” represents different aspects of the pharmaceutical process, such as manufacturing (GMP—good manufacturing practice) and Clinical (GCP—Good Clinical Practice), depending on the industry. To develop best practices in the switchover from paper-based to software-based hospital solutions, there is an interplay between the users (i.e., the persons who ultimately use the software, in this case, physicians, nurses, pharmacists, pharmacy technicians, and administrators), the suppliers (i.e., the software developer who supplies the software) and the inspectors (i.e., the authority responsible for evaluating and ensuring compliance with standards or quality criteria). This interplay needs to be harnessed and optimized for the development of new practices, including implementation and use of hospital software.

This editorial will describe and focus on 2 key areas of the above PIC/S guidance on implementation of software-related quality in 2 areas, with focus on a global hospital setting: (1) the change management process and (2) validation and software security. These areas are key to the safe implementation of MMU-related software in a hospital, including the development of hospital practices policies.

What Is the Role of Pharmacists and Pharmacy Technicians in the Implementation of Software in a Hospital?

Pharmacists and pharmacy technicians can be and often are at the forefront of implementation of innovation, such as digitizing workflows in a hospital setting. This happens for several reasons. Pharmacists and pharmacy technicians are often key players in hospital quality teams, including quality assurance, quality control, and quality improvement. As such, these health care professionals (HCPs) have the practical and regulatory knowledge needed to develop hospital standards and ensure compliance. Such standards may be based on international standards, such as those outlined by Directive 2001/83/EC, ² Current Good Manufacturing Practice regulations (21 CFR Part 211), ³ the Quality System regulation (21 CFR Part 820), ⁴ and PIC/S guidance. Pharmacists and pharmacy technicians are usually conversant with these guidelines/regulations as well as other local/national ones. ⁵ In addition, these HCPs are often also lead contributors of patient safety teams, including medication safety in hospital. As persons with experience of improving medication safety and with familiarity of hospital MMU systems, pharmacists and pharmacy technicians can further contribute to the safe digitalization of medication-related software. Finally, pharmacists and pharmacy technicians are usually also involved in managerial roles as representatives of their professions in a hospital. It is for all these reasons that these HCPs, with their experience in quality and safety aspects of the MMU process in a hospital, both on the ground as well as on a managerial level, can and do provide a key contribution to digitizing MMU-related workflows in a hospital. This contribution is contingent on a hospital culture that recognizes how essential pharmacists and pharmacy technicians are to any change in the hospital’s MMU process as well as the maintenance of that change, to ensure it is fit for purpose and safe.

Change Management Process

Change in health care is inevitable because health care systems, whether in terms of clinical practices or infrastructure, are constantly evolving. Change management is therefore key in health care and much has been written on this topic. ⁶ The PIC/S guidelines mention several key elements of the change management process, including the preparation of user requirement specifications (URSs), having robust change control, error reporting procedures, and having an electronic audit trail. As these processes are also a key part of health care quality systems, they may be subject to inspection.

User Requirements Specifications

A URS is a detailed document that describes what end-users or stakeholders need and expect from a product or system, including its functions, performance, and constraints. User requirement specifications are crucial documents for the Design Qualification part of the validation of software development and should be comprehensive, realistic, definitive, and testable. The result of all the URS, taken together, should be a design that is fit for the intended purpose, whether this involves prescribing or administering a medication, or guiding the workflow of medication preparation. It should contain elements that allow the new process to be of equal or better quality than the current process. Pharmaceutical Inspection Convention Co-operation Scheme states that URS must be reviewed, authorized, and cataloged uniquely, with no conflicts between requirements. This requires very careful planning. All requirements, especially those related to regulatory compliance, should be verifiable through inspection, analysis and testing. Both users and suppliers should understand and agree on the URS, differentiating between mandatory and optional features. In short, this means that a hospital needs to be proactively engaged in the design of MMU-related software and to ensure that its requests lead to workflows and documentation that are either of equal or better quality than its current ones. Pharmacists and pharmacy technicians can provide value to this process by identifying the URSs that impact the MMU.

Change Control and Error Reporting Systems

While a project is still in the “design” phase, change management can be limited to record-keeping. However, once a project’s specifications are being developed and the way forward finalized, an official change control procedure is required. This is a much more complex process than just record keeping.

The main potentially auditable element here is the system control document, a document that outlines the procedures and rules for managing changes and reporting errors within a system or process. It provides guidelines for how changes are requested, evaluated, approved, and implemented while also detailing the process for reporting and rectifying errors or issues within the system. The formal change control procedure should include details and justification for proposed changes, assess their impact, and record change reviews and approvals. It should accommodate improvements or responses to errors, with documentation for emergency changes. Quality systems must ensure clear and documented changes and the procedure should align with deviation and error reporting. Software suppliers may have their own change control system but a hospital needs to ensure it has its own. Validated systems should require stakeholder review and authorization. The involvement of pharmacists and pharmacy technicians can ensure that key features of the software and any changes to it are in line with the hospital MMU process. Test scripts should be used to verify the acceptability of new features developed in response to change requests, especially before releasing the new software version. This change control process in a hospital can benefit greatly from being led by a team of health care professionals. ⁷

Data Changes —Audit Trail/Critical Data Entry

A software can improve the quality of health care documentation in a hospital setting compared to paper-based records. Digital medical records were found to have several advantages over paper records, including a better workflow, ⁸ better organizability and timelier retrievability, although both electronic and paper-based records have their drawbacks. Data changes in a software require an immutably linked audit trail to retain original data records and any subsequent alterations accurately. Such audit trails must comply with the hospital’s approved standard operating procedures for information security management. Clearly documented policies, standard operating procedures, validation reports, and training records are necessary for system controls. Audit trail records should be generated as basic features of the operating system. Time and user linked audit trail records should be available in a human-readable from as required by internal or external inspectors, to ensure accountability and traceability. Pharmacists and pharmacy technicians are typically aware of the need for accountability and traceability in the MMU, as they are often at the last step between the medication and the patient or the HCP who will administer it.

Validation and Security

Validation Strategies and Priorities

Pharmaceutical Inspection Co-operation Scheme guidance states that a system must be in place to assess and report quality and performance measures at all stages of software and system development, implementation, qualification, acceptance, operation, modification, requalification, maintenance, and retirement. The hospital’s software should be listed in an inventory, and the scope of validation for each system should be detailed in a consolidated validation program. The scope should include GxP compliance criteria, ranked based on product/process quality and data integrity risk. Results and justification for critical or non-critical classifications must be documented. Validation is important because it helps hospitals ensure that the software is robust, wherever it is being used. Pharmacists with experience in quality teams, such as Quality Insurance and Quality Improvement, are used to such processes involving careful documentation, validation and risk evaluation processes and can contribute immensely to the implementation of new MMU-related software in a hospital.

Retrospective Validation

Lack of prospective validation may be a serious deviation from GxP according to PIC/S guidance, but retrospective validation is justified for a non-GxP system newly classified as GxP. Retrospective validation involves inspectors checking for system descriptions and documented evidence of testing against specifications. Evaluating system history, including errors logs and changes made, can replace formal validation evidence. As above, pharmacists and pharmacy technicians with experience in quality systems would be an asset to this process.

System Security, Including Back-Ups and Contingency Modes

To ensure system security, hospitals must maintain procedures and records related to system access. Responsibilities for security management should be clearly defined, covering implementation, user and infrastructure access levels. Examination of procedures and records should meet basic requirements, including clearly defined access rights, secure password management, correct assignment of authority and responsibilities, periodic checks on identification codes and passwords measures to invalidate lost or compromised passwords, recording of breaches, and enforced access revocation after unsuccessful logon attempts. This is particularly important in health care settings, since data are very sensitive. Validated back-up procedures and data storage should guarantee data integrity. Written procedures for system recovery after breakdowns should include documentation and record requirements. Routine back-ups should be stored in safe locations, with separate hardware, and at a frequency based on risk analysis. GxP data, including audit trails, must be backed up, and regular testing of back-up and disaster recovery procedures should occur. Such back-ups need to take into account all possible failures, for example, local and regional/national internet/power failure. Physical security should be sufficient to prevent unauthorized access, damage, or data loss. Pharmacists and pharmacy technicians can contribute to many levels on this. At a managerial level, they need to decide which members of staff will have a specific kind of access rights to the MMU-related software and why. They may need to request access rights they did not previously have, such as the right to write notes on an electronic prescription or request the ability to validate a prescription. This can be done well only if good feedback is provided by pharmacists and pharmacy technicians who are part of the current MMU process. These HCPs can identify key security features of the current MMU process, which must be maintained as well as those that could be introduced to improve the MMU process. Good communication between pharmacists and pharmacy technicians at a managerial level as well as those on the ground is needed for optimal results.

Benefits and Challenges

The introduction of new software-based solutions in a hospital has both benefits and challenges in terms of quality systems. One of the greatest benefits introduced by electronic systems in terms of quality is that documentation and archiving should be easier, because this is built into the software itself. Pharmacists and pharmacy technicians would need to spend less time archiving and retrieving documents related to the MMU process. Another benefit is the requirement of logging into a user account to carry out an action, because this means that there is greater accountability. This is important since it by-passes the legibility and completeness problems of information in paper-based health care workflows. ⁹ Automated timestamping is another benefit of electronic systems that can increase compliance to quality systems. Another important benefit is that electronic systems can be designed to make compliance mandatory, for example, by preventing a user from moving forward in a process unless all the mandatory steps are completed. As a result, it is easier for pharmacists and pharmacy technicians in managerial positions to ensure that key steps in the MMU process are done.

There are, however, many challenges. It is challenging for existing quality systems to adapt from a paper-based to an electronic platform. Good quality systems can take years to develop and perfect and are the result not only of training and knowledge but also of experience. If called upon to contribute to the implementation of MMU-related software in a hospital, pharmacists and pharmacy technicians would need to familiarize themselves with the most relevant guidelines and laws in their geographical area. Another challenge is that, although pharmacists and pharmacy technicians have a key contribution to make in the safe implementation of MMU-related software in a hospital, this ultimately starts with their being represented within a hospital’s management by persons who know the potential of these HCPs. Such persons can act as advocates and empower pharmacists and pharmacy technicians to take an active role in defining and improving a hospital’s MMU process, including that concerning the introduction of new MMU-related software.

Conclusion

Implementation of an MMU-related software can be of benefit to hospitals, however, it brings about its share of challenges in terms of system validation. Pharmaceutical Inspection Co-operation Scheme provides guidance on which elements of software implementation and maintenance are particularly critical. This guidance is a good starting point for developing a hospital’s quality standards. Such guidance needs to be interpreted within the context of national legislation and guidelines and represents only the bare minimum of quality system requirements. Hospitals need to go beyond such minimum requirements in developing and operating software that are truly fit for purpose. Pharmacists and pharmacy technicians can provide key insights on optimizing and implementing a new electronic MMU process because of their knowledge and experience of hospital MMU processes at all levels.