You need to remember that Part 11 is basis of rules that the FDA put in place to ensure that the documents that computers generate are of sufficient quality and context so that they are the equivalent of the signed document. In the context you stated, the user name/password do not qualify as a signature, it is just the record of who is generating the record.
Both comment made are quite valid. Yondon is probably eluding to the fact that perhaps you are using the typewriter (or hybrid) rule, which would remove (if documented as such) the requirement for e-sig. While the records are generated by the computer (which has been validated, I will assume), at the end of the day, the paper is the official record and is physically signed. He is also correctly asking if this particular document (you would need do this with all the documents (types) that the system generates, is intended to satisfy a predicate (or existing requirement) per the regulations. If not, Part 11 does not apply, since the document would not a regulatory requirement, but may be a business requirement.
Mikez is drawing you attention (once again on the typewriter rule) to that fact the a combination of procedural (SOP) and technical (validated output) can be leveraged, although final approval of the document is required.
Also bear in mind that if you allow regeneration of a record (such as in this case), you will need to address the rules over the record regeneration. Some systems have the “data” store and controlled, but an output, be it a physical record, a graphic or a file transmitted elsewhere, are generated by a query (I will use that term to cover all aspect of data collection, manipulation and presentation) as opposed to systems that actually embed the data into a permanent record, which does not required regeneration. Some of the factors to consider are server date (when you generate a record, the date is was generated is typically stamped on the record, so you need to address why the dates on records are different), if the report was a script type (which means, just a push of a button) versus an ad hoc report, where the factors to collect and present the data may be variable.
But you are allowed leeway for these activities.
I will also note, since you were referencing lab equipment, it is in your best interest to document the control and location of raw data. Lab equipment generates raw data at the equipment, then that raw data is transferred to an intermediate (LACE, A to D converter, integrator…) and finally to the computer system. You need to document that the appropriate controls are in place at each of these steps so that the data cannot be altered at any of the steps. Or if it can be, that there are procedural or other controls in place to identify and control these factors.
