Medical Product Software Development and FDA Regulations Software Development Practices and FDA Compliance

Transcription

1 Medical Product Development and FDA Regulations IEEE Orange County Computer Society March 27, 2006 Carl R. Wyrwa

2 Medical Product Development and FDA Regulations Introduction Regulated FDA Overview Medical Device Definition Special Attention Regulation Of Basic Requirements Quality Model Safety Model Maintenance Corrective Action and Preventive Action (CAPA) Reference Material Conclusion 2

3 The Intent Of Regulating Medical Device Safety and Efficacy Patients Environment Operators Bystanders Service Personnel 3

4 Many Stakeholders Keeping A Total Solution In Mind Medical Practitioners Safety Patients Operators Bystanders Service People Environment Customer and Business Needs Quality Systems and Q&RA All Needs Met Reviewers Internal Auditors External Reviewers People Doing The Work 4

5 Many Stakeholders Keeping A Balanced Solution In Mind Medical Practitioners Safety Patients Operators Bystanders Service People Environment Customer and Business Needs Quality Systems and Q&RA All Needs Met Reviewers Internal Auditors External Reviewers People Doing The Work 5

7 Types of Regulated Medical Device that is actually a part of the medical device itself that is an accessory to a medical device that itself is a medical device 7

8 Types of Regulated Medical Device that is actually a part of the medical device itself that is an accessory to a medical device that itself is a medical device Non-Device that is part of: The production system The quality system Systems that are used to create and maintain records required by FDA regulations 8

10 FDA Overview FDA is a public health agency, charged with: protecting American consumers by enforcing the Federal Food, Drug, and Cosmetic Act and several related public health laws. It is FDA's job to see that: the food we eat is safe and wholesome, the cosmetics we use won't hurt us, the medicines and medical devices we use are safe and effective, and that radiation-emitting products, such as microwave ovens, won't do us harm One of our nation's oldest consumer protection agencies. Located in district and local offices in 157 cities across the country 10

11 Medical Devices 32,358 11

12 FDA Overview Administrative Enforcement Powers Unannounced and Announced Inspections Inspectional Observations Warning Letters Adverse Publicity FDA-Initiated Recalls and Monitoring Company-Initiated Recalls Delay, Suspension, or Withdrawal of Product Approvals Preclusion of Government contracts Detention and Refusal of Entry into U.S. Commerce of Imported Products Judicial Enforcement Powers Civil Enforcement Powers (Seizure) Criminal Enforcement Powers (Prosecution) 12

14 Medical Device Definition Medical devices range from Simple Devices Tongue depressors and bedpans Complex Devices Programmable pacemakers Laser surgical devices Medical Device Classification Class I, II, and III Class I devices include those with the lowest risk Class III devices includes those with the greatest risk. 14

15 Medical Device Definition "an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article, including a component part, or accessory which is: recognized in the official National Formulary, or the United States Pharmacopoeia, or any supplement to them, intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man or other animals, or intended to affect the structure or any function of the body of man or other animals, and which does not achieve any of it's primary intended purposes through chemical action within or on the body of man or other animals and which is not dependent upon being metabolized for the achievement of any of its primary intended purposes." 15

17 Design Control (a) General (1) Each manufacturer of any class III or class II device, and the class I devices listed in paragraph (a)(2) of this section, shall: establish and maintain procedures to control the design of the device in order to ensure that specified design requirements are met. (2) The following class I devices are subject to design controls: (i) Devices automated with computer software; and (ii) The devices listed.. Below: Catheter, Tracheobronchial Suction Glove, Surgeon s Restraint, Protective System, Applicator, Radionuclide, Manual Source, Radionuclide Teletherapy 17

18 Special Attention General Principles of Validation 3.3 Is Different From Hardware Because of its complexity, the development process for software should be even more tightly controlled than for hardware, in order to prevent problems that cannot be easily detected later in the development process.. software engineering needs an even greater level of managerial scrutiny and control than does hardware engineering. [1] 18

20 Regulation of Basic Regulatory Requirements 21 CFR 807 Establishment Registration 21 CFR 807 Medical Device Listing 21 CFR 807 Premarket Notification 510(k) 21 CFR 814 Premarket Approval PMA 21 CFR 820 Quality System Regulation 21 CFR 801 Labeling 21 CFR 803 Medical Device Reporting Quality System Regulation A - General Provisions B - Quality System Requirements C Design Controls D Document Controls E Purchasing Controls F Identification and Traceability G Production & Process Controls H Acceptance Activities I Nonconforming Product J Corrective & Preventive Action (CAPA) K Labeling & Packaging Control L Handling, Storage, Distribution & Installation M - Records N - Servicing O Statistical Techniques Design Controls (a) General (b) Design & Development Planning (c) Design Input (d) Design Output (e) Design Review (f) Design Verification (g) Design Validation (h) Design Transfer (i) Design Changes (j) Design History File20

21 Regulation of Basic Regulatory Requirements 21 CFR 807 Establishment Registration 21 CFR 807 Medical Device Listing 21 CFR 807 Premarket Notification 510(k) 21 CFR 814 Premarket Approval PMA 21 CFR 820 Quality System Regulation 21 CFR 801 Labeling 21 CFR 803 Medical Device Reporting Quality System Regulation A - General Provisions B - Quality System Requirements C Design Controls D Document Controls E Purchasing Controls F Identification and Traceability G Production & Process Controls H Acceptance Activities I Nonconforming Product J Corrective & Preventive Action (CAPA) K Labeling & Packaging Control L Handling, Storage, Distribution & Installation M - Records N - Servicing O Statistical Techniques Production & Process Controls (a) General (b) Production & Process Changes (c) Environmental Control (d) Personnel (e) Contamination Control (f) Buildings (g) Equipment (h) Manufacturing Material (i) Automated Processes 21

22 Regulation of Basic Regulatory Requirements 21 CFR 807 Establishment Registration 21 CFR 807 Medical Device Listing 21 CFR 807 Premarket Notification 510(k) 21 CFR 814 Premarket Approval PMA 21 CFR 820 Quality System Regulation 21 CFR 801 Labeling 21 CFR 803 Medical Device Reporting Quality System Regulation A - General Provisions B - Quality System Requirements C Design Controls D Document Controls E Purchasing Controls F Identification and Traceability G Production & Process Controls H Acceptance Activities I Nonconforming Product J Corrective & Preventive Action (CAPA) K Labeling & Packaging Control L Handling, Storage, Distribution & Installation M - Records N - Servicing O Statistical Techniques Quality System Requirements Corrective & Preventive Action 22

23 Regulation of Basic Regulatory Requirements 21 CFR 807 Establishment Registration 21 CFR 807 Medical Device Listing 21 CFR 807 Premarket Notification 510(k) 21 CFR 814 Premarket Approval PMA 21 CFR 820 Quality System Regulation 21 CFR 801 Labeling 21 CFR 803 Medical Device Reporting Quality System Regulation A - General Provisions B - Quality System Requirements C Design Controls D Document Controls E Purchasing Controls F Identification and Traceability G Production & Process Controls H Acceptance Activities I Nonconforming Product J Corrective & Preventive Action (CAPA) K Labeling & Packaging Control L Handling, Storage, Distribution & Installation M - Records N - Servicing O Statistical Techniques Quality System Requirements (a) General (b) Training Quality Audit 23

24 Basic Requirements Quality System Regulation A - General Provisions B - Quality System Requirements C Design Controls D Document Controls E Purchasing Controls F Identification and Traceability G Production & Process Controls H Acceptance Activities I Nonconforming Product J Corrective & Preventive Action (CAPA) K Labeling & Packaging Control L Handling, Storage, Distribution & Installation M - Records N - Servicing O Statistical Techniques Procedures Plans SW Life-Cycle Model SW Requirements Analysis SW Requirements Verification SW Architectural Design SW Architecture Verification SW Detailed Design SW Detailed Design Verification SW Coding SW Code Verification Unit Test Integration Test SW System Test Beta Testing SW Verification SW Validation COTS Components SW Risk/Hazard Analysis SW Human Factors (Use Errors) SW Change Control SW Configuration Management SW Problem Tracking & Resolution SW Traceability Non-Product Validation Corrective & Preventive Action (CAPA) Design Transfer Design History File 24 Training Quality Audits

26 Procedures and Plans Procedures Plans You must be able to demonstrate that you are Operating In A State Of Control Procedures + Plans Establish, in advance of activities, what you are going to do. Do what you say you are going to do. Be able to provide objective (documented) evidence. 26

27 Development SW Life-Cycle Model SW Requirements Analysis SW Requirements Verification SW Architectural Design SW Architecture Verification SW Detailed Design SW Detailed Design Verification SW Coding SW Code Verification 27

28 Testing Unit Test Integration Test SW System Test Beta Testing 28

29 Verification & Validation SW Verification Engineering Correctness Checks SW Validation Intended Use Confirmation 29

30 Supporting Processes COTS Components SW Risk/Hazard Analysis SW Human Factors (Use Errors) SW Change Control SW Configuration Management SW Problem Tracking & Resolution SW Traceability Non-Product Validation Corrective and Preventive Action (CAPA) 30

31 Release Design Transfer Design History File 31

32 Personnel Training Quality Audits 32

34 Quality and Safety The Reason WHY we need to have a comprehensive and effective Development Life Cycle 34

35 The Intent Of Regulating Medical Device Safety and Efficacy Patients Environment Operators Bystanders Service Personnel 35

36 Understanding Defects Defects Start Development Process Ship [2] 36

37 Understanding Defects Defects Defects Injected Start Development Process Ship [2] 37

38 Understanding Defects Defects Defects Injected } Defects Shipped Defects Detected And Corrected Start Development Process Ship [2] 38

39 A Journey To Fewer Defects Overall Quality Defects Inject Fewer Start Development Process Ship [2] 39

40 Quality Model Understanding Defect Injection Rates Requirements High-Level Design Detailed Design Coding Defect injection rates can be reduced by Performing these activities highly effectively and introducing Causal Analysis 40

41 Quality Model Understanding Defect Injection Rates Requirements High-Level Design Detailed Design Coding Defect injection rates will increase if You do not perform these activities well or you decide not to do the activity at all 41

42 Quality Model Understanding Defect Injection Rates Requirements High-Level Design Detailed Design Coding Defect Injection Rates are directly related to the completeness and the effectiveness of each of these activities 42

43 Quality Model Understanding Defect Injection Rates Cumulative Defects Defects Injected Sys Reqs SW Reqs HL Design Det Design Coding Unit Test Int Test SW Sys Test Sys Valid Beta Test Customer Defects per 1000 lines of code 43

44 A Journey To Fewer Defects Overall Quality Defects Inject Fewer Detect More Effectively Detect Earlier Start Development Process Ship [2] 44

45 Quality Model Increasing Effectiveness Requirements High-Level Design Detailed Design Coding Verification Verification Verification Verification Unit Test Integration Test System Test System Validation Beta Site Testing Customer 45

46 A Journey To Fewer Defects Overall Quality Defects Inject Fewer } Fewer Defects Detect More Effectively Zero? Detect Earlier Start Development Process Ship [2] 46

48 Safety Model Risk/Hazard Analysis & Use Error Analysis Risk/Hazard Analysis Use Error Analysis Requirements Verification Harm To: High-Level Design Patients Operators Verification Bystanders Service Personnel Environment Detailed Design Verification Coding Verification Unit Test Integration Test System Test System Validation Beta Site Testing Customer 48

49 Safety Model Risk/Hazard Analysis & Use Error Analysis Risk/Hazard Analysis Use Error Analysis Requirements Verification Induced By: High-Level Design Basic Functionality Defects Use Verification Errors Environment Interfaces Detailed Design Verification Coding Verification Unit Test Integration Test System Test System Validation Beta Site Testing Customer 49

50 Safety Model Risk/Hazard Analysis & Use Error Analysis Requirements High-Level Design Detailed Design Coding Verification Verification Verification Verification Unit Test Integration Test System Test System Validation Beta Site Testing Customer 50

51 Safety Model Risk/Hazard Analysis & Use Error Analysis Risk/Hazard Analysis Use Error Analysis Requirements High-Level Design Detailed Design Coding Verification Verification Verification Verification Unit Test Integration Test System Test System Validation Beta Site Testing Customer 51

52 Safety Model A Continuous Process Throughout the Life Cycle Risk/Hazard Analysis Use Error Analysis Requirements High-Level Design Detailed Design Coding Verification Verification Verification Verification Unit Test Integration Test System Test System Validation Beta Site Testing Customer 52

55 Safety Model Use Error Analysis User Error X User Error Use Error Blames The User For Doing Something Wrong Developer takes accountability for developing software that allowed the user to make an error And..the developer incorporates Use Error Analysis into the risk management process resulting in the implementation of built-in safeguards to protect against Use Error 55

56 Safety Model Use Error Analysis Use Error (Human Factors) Considerations Skill Level Variation Environmental Variation Compromising Factors Physical and Sensory Characteristics Perception Cognition Expectancies Mental Models Home Use 56

57 Safety Model Risk/Hazard Analysis & Use Error Analysis Potential Harm To Patients Potential Harm To Operators Potential Harm To Bystanders Potential Harm To Service Personnel Potential Harm To Environment Basic Functionality Defects Use Errors YES You are developing a function where the user will be asked to manually enter a patient s age Environment Interfaces You realize that if the age is entered incorrectly that an incorrect diagnosis might be made 57

58 Safety Model Risk/Hazard Analysis & Use Error Analysis Function Feature Patient Age Entry Potential Event Incorrect Age Entered (Use Error) Potential Hazard Incorrect Diagnosis Severity Major Control Mitigation Enter Date of Birth (cross check) Post Control Severity Acceptable V&V Test Procedure

59 Safety Model Risk/Hazard Analysis & Use Error Analysis 59

61 Recall Statistics Related Recalls Initial (21%) FDA Analysis 3140 Recalls ( ) Due To Changes (79%) -related recalls 242 recalls due to changes 192 (79%) Of those software related recalls, 192 (or 79%) were caused by software defects that were introduced when changes were made to the software after its initial production and distribution FDA Guidance (2002) General Principles of Validation 61

62 Maintenance Challenges Oversimplification of the task Customer and Patient expectations Increased requirements on system Changes Design additions and/or modifications State of the documentation Knowledge level Personnel changes components (COTS) Hardware components Interfaces Cybersecurity issues Maintenance Challenges 62

63 Creating A Balance Challenges Oversimplification of the task Customer and Patient expectations Increased requirements on system Changes Design additions and/or modifications State of the documentation Knowledge level Personnel changes components (COTS) Hardware components Interfaces Cybersecurity issues Processes Requirements management Anomaly management Technology transition management Risk management Training Change control development life cycle Technical reviews Validation planning Testing Configuration management Documentation updates 63

65 Corrective Action Preventive Action (CAPA) Problem Encountered Investigate Find Root Cause Correct The Problem Same Product Similar Problems? Investigate Find Root Cause Correct The Problem Other Products Similar Problems? Investigate Find Root Cause Correct The Problem Process Change Prevent Similar Problems From Occurring In The Future 65

67 Quality System Regulation The Regulation The Quality System Regulation 21 CFR 820 Medical Device Quality System Manual Do It By Design Guide To Inspections Of Quality Systems (QSIT) Design Control Guidance Medical Device Use Safety Human Factors Risk Mgmnt FDA General References Medical Device Quality System Manual Design Control Guidance Do It By Design Medical Device Use Safety (Human Factors/Use Errors) Guide To Inspections Of Quality Systems (QSIT) General Principles of Validation Pre-Market Submission Guidance Off-The-Shelf Guidance FDA Specific References General Principles of Validation Pre-market Submission Guidance Off-The-Shelf Guidance ANSI/AAMI SW68:2001 Processes ISO ISO Industry References ISO ANSI/AAMI SW68 ISO ISO ISO

68 General Principles of Validation Pre-Market Submission Guidance Off-The-Shelf Guidance FDA Specific References General Principles of Validation Pre-market Submission Guidance Off-The-Shelf Guidance ANSI/AAMI SW68:2001 Processes ISO Industry References ANSI/AAMI SW68 ISO

69 FDA -Specific Guidance Documents 69

70 FDA -Specific Guidance Documents 70

71 ANSI/AAMI SW68:2001 Medical Device - life cycle processes 71

72 AAMI TIR32:2004 Medical device software risk management 72

73 FDA Website Click On Medical Devices 73

74 FDA Website CDRH A-Z Index Click On CDRH A-Z Index 74

75 FDA Website Click On S For 75

76 FDA Website Scroll Down To 76

77 FDA Website 77

78 FDA Website 78

79 AAMI Website 79

80 Quality System Regulation Medical Device Quality System Manual Do It By Design Guide To Inspections Of Quality Systems (QSIT) Design Control Guidance Medical Device Use Safety Human Factors Risk Mgmnt Off-The-Shelf Guidance Pre-Market Submission Guidance General Principles of Validation ANSI/AAMI SW68:2001 Processes Procedures Plans SW Life-Cycle Model SW Requirements Analysis SW Requirements Verification SW Architectural Design SW Architecture Verification SW Detailed Design SW Detailed Design Verification SW Coding SW Code Verification Unit Test Integration Test SW System Test Beta Testing SW Verification SW Validation COTS Components SW Risk/Hazard Analysis SW Human Factors (Use Errors) SW Change Control SW Configuration Management SW Problem Tracking & Resolution SW Traceability Non-Product Validation Corrective & Preventive Action (CAPA) Design Transfer Design History File 80 Training Quality Audits

82 Quality Model Risk/Hazard Analysis Use Error Analysis CAPA Low Defect Injection Rates Requirements High-Level Design Detailed Design Coding Verification Verification Verification Verification Early and Highly Effective Defect Detection Steps Unit Test Integration Test System Test System Validation Beta Site Testing Customer 82

83 It s All About Making It Safe Your Families! - Your Loved Ones! - Your Friends! Each and Every One Of YOU! Patients Environment Operators Bystanders Service Personnel 83

84 Carl R. Wyrwa MedicalDevice.com UC Irvine Extension Program Medical Product Development Medical Device Engineering BME X401 -Controlled Medical Devices Engineering & Compliance 84

85 References [1] FDA (2002). General Principles of Validation; Final Guidance for Industry and FDA Staff. FDA website: [2] Pietrasanta, Alfred M. (1990). Defect Prevention. Quality Improvement Module 9: Engineering Institute, Carnegie Mellon University. 85