How to move HACCP records from paper to digital

Which rule applies to your plant

Before choosing how to go digital, identify which rule your records fall under:

• Preventive Controls for Human Food (21 CFR 117): most FDA-regulated plants.
• Low-acid canned foods (21 CFR 113) and acidified foods (21 CFR 114).
• Juice HACCP (21 CFR 120).
• Seafood HACCP (21 CFR 123).
• Meat and poultry HACCP (9 CFR 417): plants under USDA Food Safety and Inspection Service (FSIS) inspection.

21 CFR 117: electronic records and Part 11

Section 117.305 says records may be originals, true copies (such as photocopies, pictures, scanned copies or microfilm) or electronic records. They must also:

• Contain the actual values and observations from monitoring and, where applicable, verification.
• Be accurate, indelible and legible.
• Be created at the time the activity is performed.
• Be as detailed as needed to show how the work was done.
• Include the plant name (and location if needed), the date and, where appropriate, the time, the signature or initials of the person who performed the activity and, where appropriate, the product and lot code.

The Part 11 exemption

Under 117.305(g), records created to meet Part 117 that are electronic records as defined in Part 11 are exempt from Part 11. But if those same records are also required by another law or regulation, they remain subject to Part 11.

Part 11 covers electronic records that are created, modified, maintained, archived, retrieved or transmitted under FDA records requirements (21 CFR 11.1(b)). Its exemptions (11.1(f) through (p)) include Part 117, along with Parts 112, 121 and 507 and certain sections and subparts of Part 1, but not Parts 113, 114, 120 or 123.

Part 11 is the FDA's rule on electronic records and electronic signatures. For closed systems it requires, among other things, system validation, access limited to authorized individuals, authority checks and a secure, computer-generated, time-stamped audit trail that records who creates, modifies or deletes a record without obscuring what was there before (21 CFR 11.10).

Even if your Part 117 records are exempt, the requirement that they be indelible and created at the time of the activity still stands. In practice, that means a change should not erase the original value without a trace.

Low-acid canned foods, acidified foods, juice, seafood, and meat and poultry

Low-acid canned foods: 21 CFR 113.100(h) says records may be kept electronically if they comply with Part 11. They are kept at the plant for at least 1 year from the date of manufacture and for 2 more years at the plant or another reasonably accessible location (113.100(g)).

Acidified foods: 21 CFR 114.100 does not mention electronic records. Copies of the records it requires are kept for 3 years from the date of manufacture, at the plant or another reasonably accessible location.

Juice HACCP: 21 CFR 120.12(g) accepts computerized records if they are kept in compliance with Part 11. Records are kept at least 1 year for perishable or refrigerated juice, and 2 years or the shelf life, whichever is longer, for frozen, preserved or shelf-stable products. Monitoring records may be moved offsite after 6 months if they can be retrieved within 24 hours.

Seafood HACCP: 21 CFR 123.9(f) accepts records kept on computers if appropriate controls are in place to ensure the integrity of the electronic data and signatures; section 123.9 does not mention Part 11. Records are kept at least 1 year for refrigerated products and 2 years for frozen, preserved or shelf-stable products, and information is entered at the time it is observed.

Meat and poultry HACCP (USDA FSIS): 9 CFR 417.5(d) accepts records kept on computers with appropriate controls for the integrity of the data and signatures. Each entry is made when the event occurs, with the date and time, signed or initialed by the person making it, and production records are reviewed before the product is shipped. Monitoring records are kept at least 1 year (slaughter and refrigerated products) or 2 years (frozen, preserved or shelf-stable), and may be moved offsite after 6 months if they are provided within 24 hours when FSIS requests them.

How long to keep records and where (21 CFR 117)

Part 117 records are kept for at least 2 years. They may be stored offsite if they can be retrieved within 24 hours of a request, except the food safety plan, which must stay onsite. An electronic record counts as onsite if it can be accessed from the plant (21 CFR 117.315). All of them must be promptly available for official review and copying (21 CFR 117.320).

If you are SQF certified, the code also requires records to be legible, accessible, retrievable and stored securely against unauthorized access, loss or damage, for at least the product's shelf life or whatever the customer or the law requires.

Steps for the transition

These steps follow from the requirements above; adjust them to the rule that applies to you:

• Inventory all your paper forms: monitoring, corrective actions, verification, calibration, sanitation, receiving, training.
• For each form, confirm the digital version captures all the data your rule requires (plant, date, time, who did it, product and lot).
• Decide how the person making an entry is identified: each user with their own account, not a shared password.
• Define what happens when someone corrects a value: the original value must stay visible.
• If you produce juice or low-acid canned foods, confirm the system complies with Part 11 before you drop paper.
• Run paper and digital in parallel for a short period and compare.
• Decide what to do with the paper records you already have: keep them for as long as your rule requires, on paper or as scanned true copies.
• Test that you can find and produce any record in under 24 hours.
• Update your procedures and train staff on the new way of recording.