GxP-validated information governance in Box 


Innovation is the lifeblood of organizations in life sciences including pharmaceutical, biotech, medical devices and contract research and manufacturing companies. A key driver to accelerating innovation is digital transformation which, given the extent of regulation in life sciences, is both an opportunity and a challenge. To address this challenge, Box launched Box GxP Validation last year to enable life sciences organizations to move to the cloud and standardize all content, regulated and non-regulated on a single, secure and validated platform. Moving from traditional on-premises and paper-based systems to Box enabled faster drug-to-market timelines, lowered risk and unlocked significant cost savings.

Going hand-in-hand with regulated content is its governance. From a validation standpoint, organizations need to be able to maintain and demonstrate end-to-end GxP compliance for their business processes, including any and all information governance policies in effect. With incremental updates over the past year, Box GxP Validation now offers complete native validation coverage for the entire set of Box Governance features. With this in place, life sciences organizations can leverage any of the Box Governance capabilities and digitize processes while enforcing corporate records management policies on GxP data used in areas such as clinical research, drug development etc. 

Let's take the example of a mission-critical business process in the life sciences - A pharma company (sponsor) collaborating with a Contract Research Organization (CRO) on clinical trials. While both the sponsor and CRO have records management policies related to information exchanged between the two, ad-hoc methods of collaboration (email, FTP, portals etc.) on fragmented content silos make enforcement of these policies a near-impossible task. With Box GxP Validation and Box Governance, organizations can easily enforce, maintain and demonstrate a constant state of compliance for both the content and the policies around that content. For instance:

  • Set-and-forget retention and disposition schedules can help easily enforce maintenance of records for project durations and archival post-trial
  • Secure trash policies can help prevent accidental removal of critical trial information.
  • Legal holds can ensure that content related to litigation such as patent infringement and consumer complaints can be searched, audited and held as needed

From a validation perspective, Box's innovative GxP validation methodology includes a set of accelerator validation documents based on GAMP5 standards and an automated testing tool for agile compliance maintenance and reporting. This enables organizations to accelerate initial validation, as well as reduce risk by easily qualifying and maintaining continued compliance of their Box instance. Where traditional validation would have taken several months, one of our Biotech customers validated their CRO collaboration use case in as little as 30 days and passed an impending FDA audit.  

As customers move their most sensitive and regulated content to Box, so do their mission-critical business processes and workflows. In addition to internal and external collaboration for drug and device development, these include:

  • Managing SAS datasets for clinical data management
  • Supporting the Suspected Unexpected Serious Adverse Reactions (SUSAR) process
  • Distribution of approved promotional materials to field teams
  • Compliance with 21 CFR Part 11 requirements by integrating Box with eSignature providers
  • Use of Box as a compliant content layer with life sciences ISV and SI partners

This is just the tip of the iceberg of life sciences use cases dealing with regulated and non-regulated content. Box is excited to enable moving your mission-critical business processes to the cloud, accelerating your digital transformation and powering how you innovate. Learn more about Box GxP Validation.