21 CFR Part 11's Subpart B for Electronic Records has a section on 'Controls for Open Systems" stating that:

Persons who use open systems to create, modify, maintain, or transmit electronic records shall employ procedures and controls designed to ensure the authenticity, integrity, and, as appropriate, the confidentiality of electronic records from the point of their creation to the point of their receipt. Such procedures and controls shall include those identified in 11.10, as appropriate, and additional measures such as document encryption and use of appropriate digital signature standards to ensure, as necessary under the circumstances, record authenticity, integrity, and confidentiality.

I am trying to interpret the "... additional measures such as document encryption and use of appropriate digital signature standards to ensure, as necessary under the circumstances, record authenticity, integrity, and confidentiality." part.

Does it mean every signer in a document should sign with a digital signature? Or does sealing the completed document with a digital seal is good enough?

1 Answer 1


The document in question, as with most similar security standards, requires effective procedures and controls. That means you need to have a threat model and to consider how you will design a system that provides security, given the totality of the circumstances, and effectively ensures authenticity, integrity, and confidentiality, while allowing the users to perform the desired functionality. This is very similar to other standards, such as PCI-DSS in the payments industry.

What it does not require is a particular, specific set of cryptographic implementations or tooling, so there is no clear answer to your question that's generally applicable. You will probably use TLS for securing connections (because that's the golden standard and a reasonable and prudent choice), so you'll use digital signatures as part of that.

For signing documents, it may be in your threat model or use case that disparate parties need to sign documents without an Internet connection, in which case everyone might need to sign the document. Or you might find that you use a document signing service which provides secure logins for all the parties, keeps an appropriate log of signatures, and can sign the document once for all of the parties, linking the document to its secure log, in which case signing the completed document might be enough. Either of those could be an effective control using digital signatures, but which to use depends on the circumstances and needs of the system and its users.

You'd of course also want to consider what cryptographic methods are available. In some cases, CMS (X.509 document signing) implementations only offer SHA-1, which is clearly inadequate these days, so it may be difficult for all users to sign the document individually unless they have suitable software.

It may also be that we expect many healthcare professionals to lack the technical knowledge or tooling to perform independent signatures, and thus we need an approach that performs that effective control without requiring that technical knowledge from our users. Part of the design of the system must account for providing a functional product that meets the needs of the users while preserving the security invariants, since a product that is too hard to use will not achieve the goal of allowing healthcare providers to effectively create, modify, maintain, and transmit electronic records, or to disclose them to patients in conformance with the law and professional regulations and ethics.

So the answer is, as with many things in technology, it depends. Either of those approaches could work, depending on the circumstances and requirements.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .