ISO 14971 Estimating Probability of Occurrence of Harm

Posted by Kevin Randall In FDA QMS, ISO 14971, ISO QMS 0 comment

July 13, 2021

ISO 14971 Estimating Probability of Occurrence of Harm

Based on the aforesaid flexibility (see my earlier blog post) allowed by ISO 14971 (e.g., see the third paragraph of ISO/TR 24971 section 5.5.2) for how to estimate probability of occurrence of harm, one might employ a variety of probability expressions. For example, occurrence of harm per day, occurrence of harm per year, occurrence of harm per unit, occurrence of harm per use, occurrence of harm per patient, occurrence of harm per age group, occurrence of harm during the device lifetime, etc.

To help illustrate, here are some hypotheticals:

If a particular harm is estimated to happen once per day with a vital signs monitor model, then the probability would seem to be different (higher) than if that harm is estimated to happen only once per year.

If a particular harm is estimated to happen once per device (e.g., per use, per unit sold, etc.) for a single-use device, then the probability would seem to be different (higher) than if that harm is estimated to happen only 0.001 times per device (e.g., per use, per unit sold, etc.). For example, one occurrence in 100 units sold = 0.01 occurrences/unit sold, whereas one occurrence in 100,000 units sold is only 0.00001 occurrences/unit sold.

Or as another example, 100 occurrences over a ten-year lifetime = 10 occurrences / year, whereas 1 occurrence over a ten-year lifetime is only 0.1 occurrences per year.

Or as a qualitative example: Likely to happen several times during a ten-year device lifetime would be a higher probability than not likely to happen during a ten-year device lifetime (see Table 3 of ISO/TR 24971).

I have seen some who disagree with this logic by asserting that the probability rate doesn’t change based on sales or the size of the installed base, and that the number of devices doesn’t change the rate, and that the rate doesn’t change based on the lifetime of the device). However, I believe such a stance would be at odds with the principles of ISO 14971.

EU MDR Scope and Applicability of GSPR 10.4.1

Posted by Kevin Randall In CE Mark, EU MDR, Uncategorized 0 comment

July 12, 2021

EU MDR Scope and Applicability of GSPR 10.4.1

I think there is a good possibility that GSPR clause 10.4.1’s reference both to “invasive” and to “come into direct contact with the human body” may just be an ambiguous redundancy in describing invasive devices, as I have a hard time imagining an invasive device that doesn’t somehow directly contact the human body. In an explanation from BSI, they seem to have interpreted devices that phrase (“invasive and come into direct contact with the human body”) to simply mean invasive devices.

I’ve also noted that the second two sub-bullets of 10.4.1 are aimed at the indirect contact route (specifically, certain permutations of indirect contact), whereas the first sub-bullet is reserved for the direct contact route (based on its mention of “direct contact” with the human body). Indeed, the European EU MDR authors seem to distinguish between direct contact and indirect contact (as evidenced by the separate dedication to indirect contact in the second two sub-bullets). I would be surprised if the EU MDR authors were lumping indirectly-invasive or indirect-contacting devices into the first sub-bullet; this is because if they were, then it would seem there would be no need for the second two sub-bullets.

Because it seems that CMR and ED substances could reasonably be of concern regarding any device that directly contacts the human body, I’ve been recommending that non-invasive direct contacting device manufacturers go ahead and complete the chemical review just to be safe unless more definitive direction is available for a particular case.

I’m also sensitive to GSPR 23.4(s) which calls for IFU precautions where appropriate related to the presence of CMR and ED substances and the potential for device materials to cause sensitization or allergic reaction by the patient or user. Europe’s liberal stance on toxicants such as CMR and ED doesn’t seem to leave room for excluding users from considerations about the risks of CMR and ED substances. This would seem to further push the GSPR 10.4.1 interpretation toward including non-invasive direct contacting devices.

In any event, I recommend consulting the responsible notified body (if any is involved) to understand its particular interpretation.

ISO 14971 Probability of Occurrence of Harm

Posted by Kevin Randall In FDA QMS, ISO 14971, ISO QMS 0 comment

July 12, 2021

ISO 14971 Probability of Occurrence of Harm

When tackling the estimation of probability of occurrence of harm during medical device risk management, I think it is important to remember that there is no one-size-fits-all approach. Instead, each manufacturer’s approach needs to be derived and appropriate based on the nature and complexity of the subject device, as well as on the availability (or lack thereof) of supporting data.

The particular approach can either be quantitative or qualitative (see ISO 14971 and ISO/TR 24971). The probability can be estimated per use, per device, per hour of use, within a population, etc. (ISO/TR 24971). The particular comparator (i.e., per use, per device, per hour of use, within a population, etc.) needs to be chosen based on the nature of the device. For example, some devices’ intended use (e.g., reusable devices) will intrinsically make the “per hour of use” comparator more appropriate than per device. In contrast, single-use devices may very well be appropriate for a “per device” comparator. The “per device” comparator is where sales numbers may be utilized. As hinted at above, these are longstanding principles that have been part of the ISO 14971 risk management paradigm for many years.

When using a “per device sold” comparator, various factors (e.g., nature and complexity of the device; marketplace tenure, emergent risks or device problems, etc.) will determine whether it is appropriate to use sales per day, per week, per month, per year, cumulative all-time sales, or some other timeframe. It is up to the manufacturer. Just be sure that the chosen paradigm makes sense by giving meaningful insight toward the ultimate goal of properly managing the subject device’s risk profile with regard to public health.

Consideration of device lifetime when estimating probability of occurrence harm is also a longstanding best-practice in risk management. Indeed, seeds for this can be found more than two decades back in the year 2000 version of ISO 14971 and even in EN 1441 (1998) that was a gold standard before modern risk management really got traction via the ISO 14971 series. Moreover, the consideration of device lifetime as part of estimating probability of occurrence harm remains a modern best practice today in the latest versions (see ISO 14971:2019 and ISO/TR 24971:2020), for example where it’s stated that device lifetime is an important factor for estimating probability of occurrence of harm. Accordingly, it is wise to figure out what is meant by device “lifetime” in the context of risk management and for the estimation of probability of occurrence of harm.

On that note, my experience has been that there seems to be harmonized general agreement on the meaning of device “lifetime”. That said, I haven’t found many standardized, statutory, or legislative definitions for this. At the moment, I generally rely on, adapt, and/or expand existing explanations such as:

FDA’s 21 CFR Part 803.3: “…(f) Expected life of a device means the time that a device is expected to remain functional after it is placed into use. Certain implanted devices have specified “end of life” (EOL) dates. Other devices are not labeled as to their respective EOL, but are expected to remain operational through activities such as maintenance, repairs, or upgrades, for an estimated period of time…”
ISO/TR 24971:2020: “…What determines the lifetime of the medical device?…Factors that should be considered include battery depletion, deterioration of materials and failure of components due to ageing, wear, fatigue or repeated use. The availability of spare parts should be considered as well…” [emphasis added].
FDA’s 2016 3^rd Party Servicing Workshop: “…Information about reliability is needed to…understand the expected life of the device…” [emphasis added].
ISO TC/210: “…the rationale for the determination [of medical device lifetime] should be recorded and can involve consideration of the following…shelf life of the medical device…expiry date for medical devices or components which are subject to degradation over time…number of cycles or periods of use of the medical device, based on life testing of the medical device…anticipated material degradation…stability of packaging material…for implantable devices, the residual risk that results from the entire period of residence of the medical device inside the patient’s body…for sterile medical devices, the ability to maintain sterility… organization’s ability/willingness or contractual or regulatory obligation…” [emphasis added].

EU MDR CE Marking On Advertising Materials

Posted by Kevin Randall In CE Mark, EU MDR 0 comment

July 9, 2021

EU MDR CE Marking On Advertising Materials

Though many of us have undoubtedly observed the placement of a CE mark on promotional flyers, I suggest that such a practice is contrary to the basic product-inscription intentions established by the European authorities for use of the CE mark. Accordingly, I recommend against placing CE marks on advertising literature, websites, and other promotional pieces, except for “sales packaging” (i.e., artwork on physical boxes, pouches, etc.). I explain further below.

When reviewing the basic principles for CE marking in EU MDR Article 20 and Annex V, in the Blue Guide, in Europe’s “common framework” for marketing of products, in Regulation (EC) 765/2008, and the like, the intrinsic focus is oriented toward the subject device’s physical, chemical, configurational, functional, etc., attributes, and the ability of those attributes to support the affixing of the CE mark inscription. We know this to be true because key legislative concerns are visibility, indelibility, readability, dimensional, etc., with immediate provisions for alternative marking options regarding devices whose basic physical, chemical, configurational, functional “markability” (my own term) don’t permit the affixing of the CE mark to the device, where in such instances we can instead place the mark on the accompanying legislatively-driven documents (i.e., on the information supplied with device, i.e., on the EU MDR Annex 1 Section 23 information, i.e., on the label and instructions for use).

Another telling angle is the Blue Guide’s statement that “CE marking does not serve commercial purposes, i.e. it is not a marketing tool.” Accordingly, I suggest that the EU MDR Article 20(5) reference to, “promotional material which mentions that a device fulfils the requirements for CE marking” [my emphasis added] should be interpreted as just that [i.e., as a “mention of”, i.e., as a promotion of, the device’s conformity), rather than to the actual affixing of a CE mark to the promotional materials.

Health Canada Medical Device Importer Requirements for DTC Sales

Posted by Kevin Randall In Health Canada 0 comment

July 7, 2021

Health Canada Medical Device Importer Requirements for DTC Sales

When dealing with Health Canada’s medical device regulatory requirements (i.e., SOR/98-282 as amended from time to time, hereinafter the “CMDR”), there are four device classes: I, II, III, and IV. Therefore, when adapting a regulatory strategy from surrounding jurisdictions, be sure to consider the unique differences in Canada’s device classification scheme, such as with respect to the EU’s class IIa category, or such as with respect to the USA, which only has three risk classes.

The CMDR don’t demand that an importer be designated for each imported shipment or device. Rather, it has been my experience that a person automatically becomes an importer based on whether the person engages in activities that meet Health Canada’s definition for importer. Oddly enough, neither the CMDR nor its statutory counterpart (the Canadian Food and Drugs Act) define importer. But in guidance (see GUI-0016), ‘importer’ is defined as a person in Canada, other than the manufacturer of a medical device, who is responsible for the medical device being brought into Canada for sale.

In the case of internet sales directly to consumers for personal home use, Health Canada has expressed to me in prior correspondence that such a consumer is viewed to be the importer. However, for that type of importer, neither the importer MDEL requirements (nor any other CMDR importer requirements) apply because of CMDR subsection 2(b). For example, GUI-0016 states an MDEL exemption for “any person who imports a medical device for his/her own personal use”.

EU MDR Applicability for Changes to Pre-26 May 2021 Devices

Posted by Kevin Randall In CE Mark, EU MDR 0 comment

July 7, 2021

EU MDR Applicability for Changes to Pre-26 May 2021 Devices

Remember (see my post from yesterday) that EU MDR requirements (like EU MDR vigilance procedures, EU MDR corrective action reporting, etc.) generally doesn’t apply for changes involving device units that were legally placed on the market and put into service in the Union prior to 26 May 2021 unless a significant change is made that renders the devices to be “new” devices. In other words for example, if the change to such pre-26 May 2021 devices are part of a FSCA, then the FSCA requirements of the MDD apply, not the EU MDR.

Particular EU MDR requirements will only become applicable regarding changes to devices placed on the market, made available on the market, or put into service in the Union from 26 May 2021 [notwithstanding the provision of Article 120(5) of course] or regarding significant changes to pre-26 May 2021 units.

Therefore, be careful not to unnecessarily/improperly apply EU MDR requirements to devices legally placed on the market or put into service before 26 May 2021 [except regarding Article 120(5)].

EU MDR & MDD Redundant Certification

Posted by Kevin Randall In CE Mark, EU MDR 0 comment

July 6, 2021

EU MDR & MDD Redundant Certification

An MDD-certified device is generally eligible for participation in the EU MDR Article 120(2) and/or (3) 2024 transitional buffer.

An MDD-certified device is generally eligible for participation in the EU MDR Article 120(2) and/or (3) 2024 transitional buffer. In that case, the MDD DoC can remain in effect (pursuant to certain EU MDR limitations) until replaced and/or supplemented by an EU MDR certificate and DoC. But once EU MDR conformity is achieved, then I know of no legislative reason to thereafter redundantly maintain the MDD certificate, though I suppose there could be business reasons for such redundancy. For the latter, it would mean a) that the manufacturer is willing to pay the NB(s) for the additional/duplicative conformity assessment services; and b) if the same NB will be used for both certifications, then such NB i) has the bandwidth and willingness to support such redundancy; and ii) such dual certification doesn’t violate the impartiality clauses (such as those in 4.2.4 regarding self-interest and familiarity) of the ISO 17021 standard(s) governing the NB. Other than that, I can’t bring to mind other reasons that would prohibit such dual certification by a single NB. But be sure to consult the NB involved so as to determine its particular stance on the matter.

Regarding significant changes to an existing MDD-compliant install base, refer to my related blog posts here and here.

EU MDR Critical Component Changes to MDD-Installed Devices

Posted by Kevin Randall In CE Mark, EU MDR 0 comment

July 6, 2021

EU MDR Critical Component Changes to MDD-Installed Devices

If changing the supplier of a critical component that will be, or could be, subsequently used for component replacement in devices already installed (i.e., already put into service) in the Union prior to 26 May 2021 under an MDD Declaration of Conformity (DoC) and Notified Body (NB) certificate, then the most ideal regulatory scenario is to be able to conclude that such a change is not a “significant change”. If that argument can be sustained, then it eliminates much of the grappling required by the EU MDR. I explain further below where I lay out a basic framework of the regulatory strategy path I would follow:

First remember that NB notification about device changes is subject to the particulars of the agreed arrangement (i.e., the contract) in place with the NB. Traditional precedent under the MDD being maintained under the EU MDR is that, in case of doubt whether a change is significant, the regulatory strategy should be formulated in consultation with the NB.
Thoroughly explore whether the change in critical component supplier can be justified as not significant. NBOG precedent (see NBOG 2014-3) and modern reiteration by the MDCG (see MDCG 2020-3) for the EU MDR leave open the possibility that critical supplier and component changes could possibly be justified as being not significant. I would also add that changes involving devices on the lower end of the risk-class spectrum may have relatively greater liberty to be categorized as not significant. If the “not significant” argument can be sustained, then it’s profound because such a change and the already-installed devices wouldn’t exceed the “significant change” threshold of EU MDR Article 120(3), consequently allowing continued service under the authority of the MDD DoC and certificate. A cornerstone of this rationale is threefold: a) the devices were already put into service; b) “putting into service” seems by fundamental definition to be just a once-in-a-lifetime event for each device unit; and c) the EU MDR DoC and certification requirements only apply to devices placed on the market, made available on the market, or put into service from 26 May 2021 [notwithstanding the provision of Article 120(5) of course]. Indeed, my interpretation is that, as a general rule, devices put into service under the MDD will never become subject to the EU MDR [except for the conditions in the final sentence of Article 120(3), and except for any ultimate cutoff date (I know of none) for allowing such devices to remain in service] unless a significant change is made (effectively resulting in a “new” device and the need for its own respective conformity assessment and once-in-its-lifetime putting into service).
On the other hand, if the change in critical component supplier and subsequent replacement of components in previously installed units is definitively found to be significant, then by default, that would seem to effectively result in a “new” device, thus nullifying the eligibility for the EU MDR Article 120(2) and (3) transitional provisions. This means that such a change would not be allowed from 26 May 2021 without a corresponding valid EU MDR DoC and NB certificate for the changed version and unit. But the NB’s interpretation of this needs to be determined, particularly regarding the aforesaid “new” device notion, as different NBs could have varying interpretations of how they would approach this.

Health Canada CMDR Updates 2021

Posted by Kevin Randall In Canada, Health Canada, Post-Market Surveillance 0 comment

June 28, 2021

Health Canada CMDR Updates 2021

Here’s a quick recap of Health Canada’s changes to the Medical Devices Regulations (SOR/98-282) that started coming into force on 23 June 2021:

1. Effective 23 June 2021, Health Canada has additional authorities to require us to do certain analyses and make certain information available to them upon request regarding device risks/problems, etc. Generally, this won’t require any changes in our QMSs, but we can certainly add QMS coverage voluntarily to assure the organization is ready to cooperate in the event such Health Canada demands are made.
1. Effective 23 June 2021, Canada’s Mandatory Problem Reporting requirements change in three ways and we need to have our Mandatory Problem Reporting procedures revised accordingly:
1. Canadian “Mandatory Problem” reporting is now Canadian “Incident” reporting.
2. Foreign incident reporting is now limited to Class I devices; yet
3. Class II, III, and IV foreign incident reporting has been replaced with a new process called “Foreign Risk Notification”.
1. Effective 23 December 2021, Health Canada will require a certain type of post-market surveillance and a report called a “Summary Report” which may in certain circumstances require submission to Health Canada within 72 hours. An associated seven-year record keeping requirement is included. Corresponding procedures should be integrated into our QMS procedures for PMS. I found that Canada’s new PMS requirements can be met by leveraging certain PMS tasks already being done for the EU MDR, and then adding a few tweaks. I also recommend a designated “Summary Report” template be used for the Canadian Summary report, as the particular conclusions and analyses required for Canada are unique compared to the EU MDR’s PMSR and PSUR.
1. The aforesaid changes were brought about via a SOR/2020-262 which conveys the series of regulatory amendments for SOR/98-282 (as well as for the Food and Drug Regulations C.R.C., c. 870). The SOR/98-282 changes that took effect on 23 June 2021 are expected to be incorporated into the Justice Laws website version within a couple weeks. The SOR/98-282 changes that will take effect 23 December 2021 will likewise be integrated in due course thereafter. The title of SOR/98-282 (Medical Devices Regulations) will remain unchanged.
A good place to document consideration of applicable new or revised regulations is during management review. For example, consideration of such regulatory changes is required as a management review input under ISO 13485 clause 5.6.2(l); a similar approach can certainly be applied even if it is not an ISO 13485 QMS. It would be sufficient to record a high-level summary of such changes, and then a general implementation plan/timeline. This would also be a good place to state the aforesaid relationship between SOR/2020-262 and SOR/98-282.

EU MDD and MDR “AFAP”

Posted by Kevin Randall In EN ISO 14971, EU MDD, EU MDR, Risk Management, Uncategorized 0 comment

January 26, 2021

EU MDD and MDR “AFAP”

Check Your Existing Procedures:

To properly attend to what Europe’s outgoing Medical Devices Directive (MDD) and new Regulation 2017/745 (the EU MDR) require regarding the reduction of risk “as far as possible” (AFAP), it is first important to know what an organization’s corresponding acronym actually stands for. For example, if the existing Risk Management Procedure uses “ALAP” and means “As Low as Possible“, then it may be that the organization’s definition of ALAP could already be aligned with the EU MDR’s requirement for As Far As Possible (AFAP). But further detailed assessment of the existing procedure would be needed to flush this out.

On the other hand, if a Risk Management procedure is based on reducing/controlling risks to be As Low As Practicable (a.k.a., ALARP – As Low As Reasonably Practicable), then, in preparation for an EU MDR audit, it is most definitely the right approach, and certainly required, to revise the procedure so as to update and replace ALAP/ALARP to a proper interpretation of AFAP. This is because both the outgoing MDD and the new EU MDR demand that risks be reduced to AFAP. Indeed, AFAP is not a new concept to the European medical device regulatory arena.

Align Your Procedures:

Ultimately, it is necessary to be sure that the procedure aligns its definition and application of ALAP/AFAP with what will be expected by the Notified Body. This should start with realizing that the EU MDR’s approach to AFAP builds upon, but doesn’t clearly conflict with, that which was already established in the MDD. Specifically, the EU MDR adds that the reduction of risks AFAP means reduction of risks AFAP without adversely affecting the benefit-risk ratio. So, what does that mean, and how do we characterize it for the purposes of the Risk Management procedure and process? I introduce this below.

First, remember that the notion of achieving AFAP without regard for economic considerations was born from Annex Z Content Deviation #3 of EN ISO 14971:2012 (now withdrawn and superseded by the latest state of the art, EN ISO 14971:2019) which includes no such Content Deviation. Indeed, even before EN ISO 14971:2012 was withdrawn, the Notified Bodies recognized and voiced such recognition (based on longstanding MDD precedent) of the impracticality and inappropriateness of pursuing AFAP with total disregard for economic considerations. So, the Notified Bodies in fact continued to permit a reasonable amount of economic consideration to be made when pursuing AFAP. Accordingly, the EU MDR Risk Management procedure’s attendance to AFAP should not be singularly focused on an aversion to, or disregard for, the associated economic considerations. Such an approach would probably be viewed by the Notified Bodies as impossible, and perhaps even disingenuous.

Instead, the Risk Management procedure needs to assure that the organization and its risk management mechanism properly and precisely define, in practical (i.e., working, implementable) terms, the concept of the AFAP threshold and how the organization goes about reducing risks AFAP. The procedure needs to specify what particular thresholds and criteria will be used for determining whether a particular risk has or has not been reduced to the AFAP threshold. The Notified Bodies, based on longstanding precedent, have a pretty clear understanding of this concept as elaborated on in their October 2014 Consensus Paper for the Interpretation and Application of Annexes Z in EN ISO 14971:2012. As noted above, the EN 2012 version of the ISO 14971 standard has been superseded, yet the 2014 Consensus Paper still in my experience contains an accurate Notified Body interpretation of the AFAP concept to be used as the basis for the corresponding elements of the Risk Management procedure.

A quick final note: Risk management is not risk analysis (though risk management certainly includes risk analysis). Accordingly, in order to comply with EN ISO 14971 and the EU MDR, it is necessary to have a Risk “Management” procedure that properly defines and integrates risk “analysis”.

← Previous 1 … 9 10 11 … 13 Next →

Blog