Susan,
Not surprising that you are not getting the Part 11 awareness you need from this supplier and that regulated companies didn't hold them accountable to this part of the regulation.
My first piece of advice is to clear with your client on the need for Part 11 compliance before this application is used in the field. It sounds like you may have already done this.
Second, spend some time reading AAMI TIR36:2007 ("Validation of software for regulated processes"). This technical report goes into great length about the process and tools available for defining and validating these systems. The committee that wrote this report was co-chaired by John Murray of the FDA, who was their resident software standards expert until he retired just recently.
In particular, I would advise you to look at the validation toolbox in Annex A and the examples in Annex C.
Third, read FDA's General Principals of Software Validation. Although even more dated than TIR36 (2002), it is still in force, with the Agency. Pay particular attention to Section 6.
Fourth, get as much as you can from the supplier in terms of requirements and validation evidence. As much as possible try to get them to populate the lower 2/3 of the "V" in your validation lifecycle on both sides (requirements / design on the left and unit / integration testing on the right). The more of this you can get from them, the less you will have to generate on your own. If possible, focus on defining your intended use (TIR36, 4.3.1.4) then generating the validation against that intended use. Let the supplier provide the details below that. Anything you can't get form the supplier you will have to generate to fill in the gaps.
Good luck with this one, and please feel free to reach out if you have further questions or if I may be of assistance.
------------------------------
Eric Henry
King & Spalding
Washington DC
United States
------------------------------
Original Message:
Sent: 26-Feb-2019 16:18
From: Susan Bush
Subject: 21 CFR Part 11
Hello everyone,
This is my first time having to deal with 21 CFR Part 11. My client distributes and services (Class I & Class II) medical devices and they are looking into replacing their antiquated paper forms in the field with fillable forms on their mobile devices. They are considering utilizing a company that provides a software app that will allow my client's technicians to complete service forms on their mobile devices. This company is called Device Magic who has never heard of 21 CFR Part 11. Their website boasts all sorts of major companies as clients including a MAJOR pharmaceutical company - X. I asked them didn't they have to configure their product to 21 CFR Part 11 for X and they said no it never came up!
Needless to say I am extremely disappointed in this company and not sure how to proceed. My client has looked at other options but many out of their price range. Any advice would be greatly appreciated- thanks!
------------------------------
Susan Bush
CEO
Shamong NJ
United States
------------------------------