Blog

So Many Adverse Event Reporting Terms in Various Jurisdictions

April 4, 2023

So Many Adverse Event Reporting Terms in Various Jurisdictions

 

I’ve seen companies try to combine multiple jurisdictions’ adverse event reporting requirements into a single universal set of criteria and terminology.  But that approach inevitably leads to under-reporting or over-reporting in certain jurisdictions.  Accordingly, my generally preferred approach is to keep the reporting thresholds and terminology for each jurisdiction separated from the others.  This is done by way of a separate SOP / WI for each jurisdiction.  A few examples are:

 

  • U.S. FDA: Here, FDA’s Medical Device Reporting (MDR) regulations expect that all “complaints” and “adverse events”, as officially defined by the FDA, be screened using FDA’s MDR reportability criteria, which lead to still other officially-defined FDA terms.  In fact, FDA is so strongly committed to ensuring we use their terms, that you can find FDA Warning Letters citing failure to include FDA’s specific terms in the firm’s MDR reporting SOP.  The FDA’s reporting criteria and regulations don’t use language like, “incident”, “serious incident”, “vigilance”, etc.  Moreover, FDA’s reporting thresholds contain unique attributes not directly reflected in those of other jurisdictions.

 

  • European MDR/IVDR: Here, the requirement is to report “serious incidents”.  The requirement is to screen any “incidents” to determine if they are “serious incidents”, and then if so, a serious incident report must be made.  The term “vigilance” reporting has strong roots in the European jurisdiction.  The terms “incident” and “serious incident”, along with related terms like “serious public health threat”, have officially-defined meanings for Europe’s Union; and those meanings don’t always align with the terms / concepts / reporting thresholds used by other jurisdictions. To make things even trickier for Europe, they also officially define and use the reportability terms “adverse event” and “serious adverse event”.  But when using those, it is only in regards to devices in clinical investigations.

 

  • Canada: Here, “incidents” that meet certain reporting criteria (see CMDR sections 59 -61 subparts) shall be reported.  While the CMDR don’t officially define “incident”, Health Canada does define this informally via guidance.  My experience with Health Canada inspections is that they will enforce the parameters of their guidance documents as if they were regulations; so be sure you incorporate those into your procedures.  On that note, your procedures might still refer to Canadian “Mandatory Problem Reporting”.  That Canadian terminology was recently retired and replaced with the term “incident reporting”.

 

  • UK and Australia: These have used terminology modeled after the retired EU MDD/IVDD approach which were precursors to the current EU MDR/IVDR requirements.

 

And so on.

 

Again, my strong recommendation is to forego trying to universalize these different terms.  Instead, we should have a dedicated reporting SOP/WI and decision tree form for each one. Hope this helps get you pointed in the right direction.

FDA PMA Stakeholder Logistics Strategy

April 4, 2023

FDA PMA Stakeholder Logistics Strategy

 

There is much to be addressed with this topic.  To help us get pointed in the right direction, here are some key principles:

 

  • In order to, as some informally say, be “registered in the U.S.”, Class III medical devices requiring Premarket Approval (PMA) require PMA approval followed by corresponding FDA Establishment Registration and Medical Device Listing by the Specification Developer and any finished device Contract Manufacturers. Such establishment registration and device listing will also apply to other associated stakeholders too, like the Initial Importer(s), Foreign Exporters, etc.  Therefore, a corresponding strategy needs to be customized for each business/operational/logistics scenario.

 

  • U.S. FDA premarket authorization [whether PMA or other types like Class I 510(k)-exempt, 510(k), de novo, etc.] is neither linked to, nor contingent on, EU MDR CE marking conformity (though such EU MDR conformity can indirectly help).  Accordingly, the subject device’s CE marking status is generally moot with respect to achieving official U.S. FDA premarket approval.

 

  • U.S. FDA PMAs are independent marketing authorizations neither linked to, nor contingent on, a different preexisting PMA approval unless the subsequent PMA approval is a supplemental PMA approval for the same legally marketed device being modified under the PMA Supplement process for that same device.  In other words, even if Applicant B’s proposed PMA device MD2 is “comparable” to a different legally marketed device marketed by a different firm Applicant A, then, as a general rule, Applicant B’s device MD2 will still require its own separate PMA approval.  Deviations from this general rule are, for example, if MD2 is sponsored by Applicant A and is just a supplementary modification of Applicant A’s own legally marketed MD1 via MD2 PMA Supplement.  Another route is if Applicant A has divested MD1 to Applicant B such that Applicant B becomes the sponsor/owner of MD1 and then sponsors a PMA supplement of MD1 to realize MD2.  But if MD2 and MD1 are in fact different devices (though comparable), then such alternatives aren’t available for the PMA approval of MD2.  For example, contrary to a section 510(k) notification, the PMA process is not based on showing substantial equivalence to a legally marketed predicate device.  Instead, the PMA process is for showing that the subject device is, in its own right, intrinsically safe and effective.  These are just some hypotheticals; there could be other organic variables/scenarios to consider in your particular case.

 

  • The FDA’s PMA requirements allow any applicant to carry out the PMA obligations for a subject device as long as that applicant will fulfill its respective obligations. That applicant could be either an overarching “umbrella company”, or it could be Applicant A or B, or a different party.  But the applicant, whoever it is, and as distinguished from the submission correspondent, will generally be viewed as the legal manufacturer unless established otherwise in the PMA.  Indeed, FDA says that the PMA applicant is usually the person who owns the rights, or otherwise has authorized access, to the data and other information to be submitted in support of FDA approval. This person may be an individual, partnership, corporation, association, scientific or academic establishment, government agency or organizational unit, or other legal entity. The applicant is often the inventor/developer and ultimately the manufacturer.  If your plan deviates from this, then be sure to clearly explain this in the PMA application.

 

  • Elaborating further, the PMA applicant is generally the party that FDA will consider to the be the Specification Developer (the “legal manufacturer” using your terminology) unless otherwise notified.  In practice, this means FDA will direct its reviewers’ attention to that Specification Developer.  In other words, the PMA acknowledgment letter, any requests for Additional Information, PMA holds, PAI correspondence and planning, responsibility for Design Control and other GMP compliance, PMA approval letter and ownership, PMA conditions of approval, etc., etc., will be directed and ascribed to that applicant.  So also will post-market quality and enforcement issues, like recalls, warning letters, etc.  Therefore, would it be beneficial to identify an intermediary business partner like a US agent or Distributor as “legal manufacturer”?  That depends on whether such entity is ready and qualified and willing to take on the initial and the perpetual ongoing weight of being the legally responsible manufacturer.

 

  • Can an intermediary party like a U.S. Agent or Distributor or Consultant submit a PMA on the sponsor’s behalf? Yes. But in so doing, it is recommended that it be made clear to the FDA that the such person is merely a submission correspondent, not the PMA applicant, specification developer, “legal manufacturer” etc., unless that burden (see preceding paragraph) is actually your business plan. Otherwise, FDA will view such party as the legal manufacturer, which can be contrary to FDA’s intent, such as for U.S. Agents.

 

  • Regardless of device class or exemption status, finished device contract manufacturing sites must still have their own FDA establishment registration and device listings with FDA.  The finished device contract manufacturer must still operate under a quality management system that is in compliance with 21 CFR Part 820.  And for a PMA device, the finished device contract manufacturer will still be inspected by FDA during the PMA PAI process, along with the specification developer site.

 

  • As a related aside, notification regarding change in sponsor of an IDE submission will depend on when such change was made, either before the termination of the clinical investigation, or after completion of the clinical investigation.  If made after, then corresponding explanation needs to be made in the corresponding section of the PMA application.

 

Hope this helps get you started in the right direction.

Can the EU MDR PMS Procedure and PMS Plan be the Same Thing? Part 2

April 4, 2023

Can the EU MDR PMS Procedure and PMS Plan be the Same Thing? Part 2

 

Carrying on from the first part of this topic from a couple days ago:  Indeed, it is wise to stick with longstanding principles and corresponding normative requirements for medical device QMS documentation.  And it’s essential to give very careful consideration to notified bodies’ enforcement practices, like those aforementioned.   EN ISO 13485’s (as amended) call for an outline of the structure of the QMS documentation is generally answered by the medical device QMS documentation pyramid (e.g., Tier 1 = policies; Tier 2 = procedures; Tier 3 = work instructions; Tier 4 = records). Moreover, there are specific and unique medical device QMS documentation control requirements that apply to procedures (e.g., PMS procedure and blank form for PMS Plan) as distinguished from records (e.g., the filled-out PMS Plan form for a particular product laying out that product’s specific PMS data types, gathering methods, analytical techniques, particular trigger criteria for improvement action, timelines, responsibilities, etc.).  Mixing and matching these is a recipe for nonconformity.

 

All this said, as a technical documentation auditor, I might not outright issue a nonconformity just because an organization reimagined a way to cobble together its Tier 2 PMS procedures and its Tier 4 PMS Plan records.  But there would likely be associated low-hanging bad fruit in the form of QMS documentation control nonconformities due to the fundamentally different controls required for procedures as distinguished from records.

 

EU MDR Article 22 Statement vs. Article 19 Declaration

April 3, 2023

EU MDR Article 22 Statement vs. Article 19 Declaration

 

Because an EU MDR Article 22 system or procedure pack Statement of Compatibility (SoC) has a different legislative purpose than the Article 19 Declarations of Conformity (DoC) for the components inside the system or procedure pack, then the SoC and DoC need to be prepared separately in order to avoid legislative mishaps.  For an example of an Article 22 SoC, my opinion is that Article 22(2) already contains a sufficient boilerplate.

Can the EU MDR PMS Procedure and PMS Plan be the Same Thing? Part 1

April 3, 2023

Can the EU MDR PMS Procedure and PMS Plan be the Same Thing? Part 1

 

The MDR/IVDR PMS procedures and blank templates for the PMS Plan should be Tier 2 generic quality management system (QMS) documents (i.e., procedures), while the actual PMS Plan should instead be a device-specific Tier 4 QMS document (i.e., a record).  This is in alignment with standard conventional QMS documentation practice.  Indeed, since PMS is a key component driven by the QMS requirements prescribed by EU MDR QMS Articles 10(9/10) / IVDR QMS Articles 10(8/9), then we should employ conventional QMS when approaching MDR/IVDR PMS.  For example, the notified body BSI says that, “…Please note that the [Post Market Surveillance] procedure is not the same as the Plan – the former refers to the manufacturer’s quality system requirements and is generic to all devices marketed by a manufacturer, whereas the latter is specific to the subject device, and can only be generated in light of data from the clinical evaluation and risk evaluation for that device…”

 

Regulatory Review of Marketing Literature and other DHF Elements

April 3, 2023

Regulatory Review of Marketing Literature and other DHF Elements

 

Virtually all aspects of design and development are officially regulated activities, especially labeling/advertising development.  Moreover, the quality management system demands that all personnel whose work can affect compliance shall be competent regarding their respective assignments.  But even if sales and marketing (or other functional group) believes they have the regulatory qualifications and experience to replace or exclude the actual regulatory contributor, it remains that the quality management system requirements for responsibility and authority don’t generally allow regulatory to be cut out.  This is because there is required to be independence between the compliance function and operating functions like sales & marketing, manufacturing, engineering, etc.  This is to avoid conflicts of interest, and to ensure proper checks and balances; not because regulatory says so, but because regulatory requirements demand such impartiality.

 

Excluding regulatory from the review of sales and marketing literature (i.e., medical device labeling) is a classic and proven recipe for misbranded (i.e., illegal) medical devices.  The regulations themselves don’t believe that medical device labeling can be consistently safe in the absence of regulatory controls.

 

There may be more flexibility regarding other DHF documents like verification and validation documents.  For example, I actually recommend and prefer that engineering become the organization’s experts regarding things like software life-cycle development, electrical safety, usability engineering, process validation, and so on.  Proper training and qualifications in those areas can enable more autonomy apart from regulatory.  Yet ultimately, regulatory should still be a contributor and signatory for those, as they are vital elements of successful premarket submissions.

 

I question the notion that having regulatory on the approval routing somehow adds significant burden to the approval process.  To those lobbying for exclusion of regulatory from the approval routing, I would be interested to know their basis for the questionable notion that regulatory review is adding significant delays.  If delays are happening because regulatory is discovering deficiencies in the documents, then the onus is on the other departments to become better qualified and proficient in those areas.  On the other hand, if delays are happening because the documents are logistically/administratively stalled in regulatory’s queue awaiting review, then regulatory needs to implement a policy whereby it always expedites these reviews and approvals, such that the documents are only in regulatory’s queue in fleeting fashion.

 

Ultimately, having a proper culture of quality and compliance is key.  Indeed for example, FDA reminds us that there could be a tendency to focus only on the time and effort required in developing and incorporating the controls into the design process. But we should keep in mind the intrinsic value of design controls too. It is a well established fact that the cost to correct design errors is lower when errors are detected early in the design and development process.  History has proven this out, where lack of proper regulatory/quality oversight has been proven to lead to increased recalls and compromised public health.

ChatGPT for Regulatory Documentation

March 30, 2023

ChatGPT for Regulatory Documentation

 

ChatGPT can only be as good as the source information which is publicly available in the electronic information ecosystem.  There’s a lot of polluted information in that ecosystem, and it hasn’t necessarily been properly vetted for integrity.  I did an informal mock audit of some ChatGPT-generated regulatory documents a few weeks back and I was able to find regulatory nonconformities.  ChatGPT might be a way to avoid starting with a blank slate. But it ultimately can’t compete with experienced, knowledgeable, sensitive, discerning people.

ISO 13485: Design & Development Obligations of Contract Manufacturers

March 29, 2023

ISO 13485: Design & Development Obligations of Contract Manufacturers

 

As a general rule, a contract manufacturer who doesn’t perform any design and development for the subject device is thereby not required to have design and development in the scope of that contract manufacturer’s ISO 13485 certificate.  So its certificate scope statement would be something like, “The contract manufacturing of ABC widget devices“, whereas the original manufacturer’s certificate scope would be something like, “The design and manufacture of…”.  As a general rule, the OEM, rather than the contract manufacturer, is ultimately accountable and responsible for design and development in this kind of scenario.

 

But if the contractor performs / leads any design and development operations, then that could trigger the need for design to be included in its QMS and certificate depending on the nature of those operations.  In such cases, different ISO registrars might have varying interpretations about how they want the certificate scope statement to read; accordingly, consulting the particular ISO registrar(s) involved is a good idea in my opinion regarding borderline scenarios.

EU MDR Transitional Extension Regulation (EU) 2023/607 and Expired MDD/AIMDD Certificates

March 27, 2023

EU MDR Transitional Extension Regulation (EU) 2023/607 and Previously-Expired MDD/AIMDD Certificates

 

Even if an MDD/AIMDD certificate from 25 May 2017 expired before Regulation (EU) 2023/607’s March 15 (20?), 2023 entry into force, and as long as it wasn’t “withdrawn” for cause (e.g., see EU MDR Annex IX.3.7), then placing on the market may continue provided that either a) the manufacturer and an EU MDR notified body had, prior to MDD/AIMDD certificate expiry, executed a written agreement (contract) formalizing (among other things) the parties’ mutual intentions for EU MDR conformity assessment later in due course, or b) the manufacturer has received an exception from the CA under either EU MDR Article 59(1) or Article 97(1). (On that note, I don’t believe Article 97 offers a way for the manufacturer to apply for the Article 97 exception; instead, Article 97 is a market surveillance-driven mechanism initiated/driven by notified bodies and competent authorities.  Accordingly, I’d say that Article 59(1) is the proper route if a manufacturer wishes to actually apply/lobby for an exception apart from an Article 97 for-cause scenario.)

 

Additional immediate conditions for continuing to place such expired-MDD/AIMDD certificate devices on the Union market are:

 

  • those devices continue to comply with Directive 90/385/EEC or Directive 93/42/EEC, as applicable,

 

  • there are no significant changes in the design and intended purpose,

 

  • the devices do not present an unacceptable risk to the health or safety of patients, users or other persons, or to other aspects of the protection of public health,

 

  • EU MDR requirements for post-market surveillance, market surveillance, vigilance, registration of economic operators and of devices shall apply in place of the corresponding requirements in Directives 90/385/EEC and 93/42/EEC, and

 

  • the notified body that issued the expired MDD/AIMDD certificate must continue to be responsible for the appropriate surveillance audits unless the manufacturer has agreed with an EU MDR notified body who will instead carry out such surveillance.

 

Finally, as of 26 May 2024, an additional condition will apply, namely that the manufacturer has put in place a quality management system in accordance with Article 10(9).

 

Additional requirements or exceptions to these provisions may apply regarding class III custom-made implantable devices and regarding deadlines for transition of surveillance auditing from the MDD/AIMDD notified body to an EU MDR notified body.

EU MDR: Who Must Hold the Annex XI Part A Certificate?

March 24, 2023

EU MDR: Who Must Hold the Annex XI Part A Certificate?

 

In addition to a production-focused quality management system certificate(s) (e.g., EU Quality Assurance Certificate or EU Product Verification Certificate), the EU MDR Annex XI Part A conformity assessment route requires the “manufacturer“, depending on device class, to also hold an:

 

  • EU Technical Documentation Assessment Certificate (Class IIa devices), or

  • EU Type-Examination Certificate (Class IIb and Class III devices).

 

Even if the “manufacturer” (the one named and identified as such on the device label) has outsourced the fabrication process to a contract manufacturing site, it still remains the obligation of the “manufacturer” to obtain and maintain the EU Technical Documentation Assessment Certificate (Class IIa devices) or EU Type-Examination Certificate (Class IIb and Class III devices).  Such a contract manufacturer is not required to hold its own EU Technical Documentation Assessment Certificate (Class IIa devices) or EU Type-Examination Certificate.