21 C.F.R. § 203.60 – Request and receipt forms, reports, and records.

(a) Use of electronic records, electronic signatures, and handwritten signatures executed to electronic records.
1. (1) Provided the requirements of part 11 of this chapter are met, electronic records, electronic signatures, and handwritten signatures executed to electronic records may be used as an alternative to paper records and handwritten signatures executed on paper to meet any of the record and signature requirements of PDMA, PDA, or this part.
2. (2) Combinations of paper records and electronic records, electronic records and handwritten signatures executed on paper, or paper records and electronic signatures or handwritten signatures executed to electronic records, may be used to meet any of the record and signature requirements of PDMA, PDA, or this part, provided that:
  1. (i) The requirements of part 11 of this chapter are met for the electronic records, electronic signatures, or handwritten signatures executed to electronic records; and
  2. (ii) A reasonably secure link between the paper-based and electronic components exists such that the combined records and signatures are trustworthy and reliable, and to ensure that the signer cannot readily repudiate the signed records as not genuine.
3. (3) For the purposes of this paragraph (a), the phrase “record and signature requirements of PDMA, PDA, or this part” includes drug sample request and receipt forms, reports, records, and other documents, and their associated signatures required by PDMA, PDA, and this part.
(b) Maintenance of request and receipt forms, reports, records, and other documents created on paper. Request and receipt forms, reports, records, and other documents created on paper may be maintained on paper or by photographic imaging (i.e., photocopies or microfiche), provided that the security and authentication requirements described in paragraph (c) of this section are followed. Where a required document is created on paper and electronically scanned into a computer, the resulting record is an electronic record that must meet the requirements of part 11 of this chapter.
(c) Security and authentication requirements for request and receipt forms, reports, records, and other documents created on paper. A request or receipt form, report, record, or other document, and any signature appearing thereon, that is created on paper and that is maintained by photographic imaging, or transmitted electronically (i.e., by facsimile) shall be maintained or transmitted in a form that provides reasonable assurance of being:
1. (1) Resistant to tampering, revision, modification, fraud, unauthorized use, or alteration;
2. (2) Preserved in accessible and retrievable fashion; and
3. (3) Available to permit copying for purposes of review, analysis, verification, authentication, and reproduction by the person who executed the form or created the record, by the manufacturer or distributor, and by authorized personnel of FDA and other regulatory and law enforcement agencies.
(d) Retention of request and receipt forms, reports, lists, records, and other documents. Any person required to create or maintain reports, lists, or other records under PDMA, PDA, or this part, including records relating to the distribution of drug samples, shall retain them for at least 3 years after the date of their creation.
(e) Availability of request and receipt forms, reports, lists, and records. Any person required to create or maintain request and receipt forms, reports, lists, or other records under PDMA, PDA, or this part shall make them available, upon request, in a form that permits copying or other means of duplication, to FDA or other Federal, State, or local regulatory and law enforcement officials for review and reproduction. The records shall be made available within 2 business days of a request.