Vigilance Reporting for Medical Devices in the EU. By Salma Michor, PhD, RAC

Transcription

1 Vigilance Reporting for Medical Devices in the EU By Salma Michor, PhD, RAC 24 September 2009

2 Manufacturers putting medical devices on the market in the European Union (EU) must have a vigilance system in place for collecting and evaluating reported incidents and taking corrective action if necessary to prevent the recurrence of such incidents. The main purpose of a medical device vigilance system is to improve protection of patients and other users health and safety by reducing the likelihood that a device incident will recur. 1 At a higher level, the vigilance system is an integral part of a postmarket surveillance (PMS) system. The medical device directives establish two principal mechanisms for providing feedback and information about marketed medical devices. 2 The first is PMS, which is the systematic review and analysis of postproduction information including clinical follow-ups, quality complaints, customer feedback, vigilance and new scientific information and literature. This information should be used to facilitate process and product improvements to meet customers expectations. The second mechanism is related to the vigilance system and includes the requirement to notify the appropriate Competent Authorities about any incidents occurring in their territory/country. This function must be performed by a person with the education and training needed to distinguish reportable from nonreportable incidents. Legal Basis The provisions for setting up vigilance and PMS systems are outlined in the following directives: Directive 93/42/EEC of 14 June 1993 concerning medical devices 3 (Article 10), as amended Directive 90/385/EEC of 20 June 1990 relating to active implantable medical devices 4 (Article 8), as amended Directive 98/79/EC of 27 October 1998 on in vitro diagnostic medical devices 5 (Article 11) Directive 2007/47 of 5 September 2007 amending Directives 93/42/EEC and 90/385/EEC and Directive 98/8/EC concerning the placing of biocidal products on the market subparagraph above leading to systematic recall of devices of the same type by the manufacturer 6 Table 1 shows the sections of the directives that refer to vigilance reporting. Incident reporting applies to Class I, IIa, IIb or III medical devices, active implantable devices and in vitro diagnostics. In addition, any incidents reported by medical practitioners or medical institutions to the Competent Authorities should be reported to the manufacturer or the authorized representative as well. Based upon an assessment by the Competent Authority together with the manufacturer or the authorized representative, Member States are obliged to inform both the European Commission and other Member States about the incidents and any corrective actions taken. Postmarket Surveillance The medical device directives collectively require medical device manufacturers to implement systematic procedures to review device experience in the postproduction phase. 7 It is important to distinguish between vigilance reporting and PMS. Annex II.3.1 of both the Medical Device Directive (MDD 93/42/EEC 8 ) and the Active Implantable Medical Device Directive (AIMDD 90/385/EEC 9 ) and Annex III.5 of the In Vitro Although the exact wording used in these directives is slightly different, they all address information on incidents occurring following the placement of devices on the market. Incident is defined as: any malfunction or deterioration in the characteristics and/or performance of a device, as well as any inadequacy in the labeling or the instructions for use that might lead to or might have led to the death of a patient or user or to a serious deterioration in his state of health any technical or medical reason in relation to the characteristics or performance of a device for the reasons referred to in the Regulatory Focus 25

3 Table 1. Provisions for Vigilance Reporting for Medical Devices 2 Mechanism AIMDD 90/385/EEC 4 MDD 93/42/EEC 3 IVDD 98/79/EC 5 Medical Devices Vigilance System Article 8 Annex II.3.1 Annex IV.3 Annex V.3.1 AIMDD = Active Implantable Medical Devices Directive MDD = Medical Devices Directive IVDD = In Vitro Device Directive Article 10 Annex II.3.1 Annex IV.3 Annex V.3.1 Annex VI.3.1 Annex VII.4 Article 11 Annex III.5 Annex IV.3.1 Annex VI.3 Annex VII.3.1 Diagnostic Device Directive (IVDD 98/79/EC 10 ) clearly state that when a manufacturer submits an application for assessment of its quality system with a Notified Body, the application must include a description of the PMS system. The purpose of the PMS system is to implement and maintain a systematic procedure to review experience gained from devices in the postproduction phase and apply any necessary corrective action. 11 Typical sources of information on device experience include: customer surveys user surveys adverse incidents (vigilance system) user reports user feedback customer complaints customer requirements, contract information and market needs patient follow-up after clinical trials or investigations service and evaluation reports scientific papers in peer-reviewed journals reports on similar products by competitors compliance-related communications from regulatory agencies changes to relevant standards and regulations 12 The PMS system is also part of the standard EN ISO 13485, 13 which indicates manufacturers should establish documented procedures for a feedback system to provide early warning of quality problems and input to the corrective and preventive action processes. These processes are, in turn, aimed at detecting and minimizing risk (ISO 14971: ). ISO 14971:2007 specifies a process for a manufacturer to identify the hazards associated with medical devices, including in vitro diagnostic (IVD) medical devices, to estimate and evaluate the hazards associated risks, to control these risks and to monitor the effectiveness of the controls. The requirements of ISO 14971:2007 are applicable to all stages of a medical device s lifecycle. Typically, manufacturers perform reasonably well-documented initial risk assessments. Compliance issues mostly occur due to inadequate follow-up measures; old files are rarely revisited and updated to account for new information and risk perspectives after product release. Vigilance Reporting Vigilance/incident reporting, part of the larger PMS system for medical device manufacturers, is the responsibility of manufacturers, national Competent Authorities and the users. Manufacturers or their authorized representatives must notify the relevant Competent Authority about incidents and file safety corrective actions when the reporting criteria are met. 15 In addition, manufacturers are responsible for investigating incidents and taking corrective action if necessary. National Competent Authorities must appoint vigilance contact points and monitor the incident investigations carried out by manufacturers. Competent Authorities must disseminate any information necessary to prevent further incidents and make all parties, including end users, aware that their cooperation is vital in providing the first link in the vigilance chain. 16 Users should report incidents to the manufacturer or national Competent Authority, depending upon national practice. The person responsible for vigilance reporting (manufacturer or authorized representative) must submit an initial incident report to the Competent Authority followed by a final report. The initial report of an incident should contain as much relevant detail as is immediately available, but should not be delayed for the sake of gathering additional information. The timelines for reporting incidents are given below; final reports should be submitted as soon as data related to the incident become available but, at the latest, within 30 days of the initial report submission. Not all incidents lead to corrective action; however, in case of doubt about the reportability of an incident, there should be a predisposition to report. 17 Requirements for an Incident to be Reportable An event has occurred. The list below provides some examples of typical incidents. malfunction or deterioration in device characteristics or performance Regulatory Focus 27

4 false positive or false negative test result falling outside the declared test performance unanticipated adverse reaction or side effect device degradation/destruction inaccuracy in labeling, instructions for use and/or promotional materials The manufacturer s device is suspected of being a contributory cause of the incident. For an incident to be reportable, there must be a clear link between the device and the incident. This may be especially difficult to determine when there are multiple devices and drugs involved in complex situations. In making a decision, manufacturers should take into account: the opinion, based upon available evidence, of healthcare professionals the results of the manufacturer s own preliminary assessment of the incident evidence of previous, similar incidents other evidence held by the manufacturer The event led, or might have led, to one of the following outcomes: death of a patient, user or other person serious deterioration in state of health of a patient, user or other person A serious deterioration in state of health can include: life-threatening illness permanent impairment of a body function or permanent damage to a body structure a condition necessitating medical or surgical intervention to prevent either of the above any indirect harm as a consequence of incorrect diagnostic or IVD test results when used within instructions for use fetal distress, fetal death or any congenital abnormality or birth defect 18 Conditions Where Reporting Under the Medical Device Vigilance System is Typically Not Required Reporting of incidents is not required under certain circumstances: deficiencies in devices found by the user prior to use event caused by patient conditions medical device service life or shelf life has been exceeded event that did not lead to death or serious deterioration in state of health because protection against a fault functioned correctly incident that did not lead to death or seri- ous deterioration in state of health and when, within a full risk assessment, the risk of death or serious deterioration has been quantified and found to be negligible 19 expected and foreseeable side effects When Must an Incident be Reported? Incidents should be reported according to the following timelines: 28 September 2009

5 serious public health threat: immediately (without any delay that could not be justified) but not later than two calendar days following the date of awareness of the event death or unanticipated serious deterioration in state of health: immediately (without any delay that could not be justified) but not later than 10 elapsed calendar days following the date of awareness of the event others: immediately (without any delay that could not be justified) but not later than 30 elapsed calendar days following the date of awareness of the event To Whom Should Manufacturers Report? Companies should report to the national Competent Authority in the country where the incident occurred. This means that a manufacturer based, for example, in the UK and selling a product on the German market must report an incident that happened in Germany to the German Competent Authorities, even though the company and its Notified Body are located in the UK. Due to the nature of the CE marking process, manufacturers of medical devices are not obliged to have a local entity in the EU country where the device is marketed. A single person responsible for vigilance reporting for the whole EU is acceptable. However, in practical terms, incidents should be reported in the country of occurrence and any dialogue with the national Competent Authorities may take place in the local language, making it important to have a local vigilance representative. Manufacturers must make sure their local distributors are aware of their reporting responsibilities and have a solid system to capture and report incidents locally. Postmarket Monitoring and Compliance The relevant national Competent Authorities are responsible for follow-up and monitoring of any investigation being carried out by the manufacturer, including these aspects: course (direction the investigation is taking) conduct (how the investigation is being carried out) progress (how quickly the investigation is being carried out) outcome (whether the results of device analysis are satisfactory) If more than one country is involved, Competent Authorities should choose a single Competent Authority to coordinate these activities. The coordinating Competent Authority is normally the one that is responsible for the manufacturer or the authorised representative. Notified Bodies do not play a key operational role in the medical device vigilance system, but are responsible for: assessing the vigilance procedures auditing implementation of the vigilance procedures, and the link with other systems, e.g., Corrective and Preventive Action (CAPA), Field Safety Corrective Action (FSCA) assessing the impact of vigilance issues on the certification granted acting as a liaison with the national Competent Authority, if required Assessment and Monitoring Systems Even though the Medical Devices Directives have been mandatory since the 1990s and stipulate that manufacturers have the legal obligation to report adverse events (incidents) according to European Competent Authorities, incident reporting is still at a level where underreporting is assumed to be widespread. This is partly due to the fact that some manufacturers are reluctant to report since they feel this may put them at a disadvantage or indicate negligence on their part. However, another contributing factor may be that the Competent Authorities are not directly involved in monitoring manufacturers vigilance systems, rather this is performed by the Notified Body. Incidents, however, are reported to the Competent Authorities. It is essential to consolidate assessment and monitoring systems to ensure that vigilance systems not only look good on paper but actually function. In many cases, companies make do with a single person in the EU for vigilance reporting. This should be thoroughly assessed during inspections since reporting incidents to the Competent Authority in the country where the incident occurred is usually where companies fail to meet their full reporting obligations, especially small companies with limited resources. Companies in a position to CE mark products and put them on the market should also be in a position to meet their vigilance obligations. Conclusion Vigilance reporting is a legal obligation of medical device manufacturers. In the EU, incidents must Regulatory Focus 29

6 be reported to the national Competent Authority in the country where the incident occurred. This may pose difficulties where reporting in the local language is foreseen or where in-person dialogue with the local authority is necessary. Notified Bodies play a key role in assessing the quality and effectiveness of a manufacturer s vigilance system. Many vigilance systems are not foolproof and leave room for improvement. Notified Bodies together with the Competent Authorities should improve their assessment and monitoring systems to capture critical system shortcomings and defects. Only with stricter monitoring and penalties will manufacturers be motivated to invest in and improve their vigilance and PMS systems. References 1. MEDDEV 2.12/1: Guidelines on a Medical Devices Vigilance System (rev 5) (April 2007) 2. Fundamentals of EU Regulatory Affairs, 4th edition, 2008, Regulatory Affairs Professionals Society, pp Council Directive 93/42/EEC of 14 June 1993 concerning medical devices 4. Council Directive 90/385/EEC of 20 June 1990 on the approximation of the laws of the Member States relating to active implantable medical devices 5. Directive 98/79/EC of the European Parliament and of the Council of 27 October 1998 on in vitro diagnostic medical devices 6. Ibid Ibid Ibid Ibid Ibid Ibid Ibid International Organization for Standardization. EN ISO 13485:2003 Medical devices Quality management systems Requirements for regulatory purposes. 14. International Organization for Standardization. ISO SO 14971:2007 Medical devices Application of risk management to medical devices 15. Ibid Ibid Ibid Ibid Ibid 1. Author Salma Michor, PhD, RAC, is CEO and principal consultant at Michor Consulting e.u., her recently established regulatory consulting business specializing in regulatory affairs and compliance, Quality Assurance, risk management and interim management. Previously, she worked in the medical device and pharmaceutical industries for companies including Croma Pharma, Wyeth and Chiesi. She is an independent expert for the European Commission and teaches regulatory affairs and clinical strategies at the postgraduate level. Michor is a member of the Board of Editors for Regulatory Focus and can be reached at michor_salma@hotmail.com. 30 September 2009