Overview of Medical Device Controls in the US By Nandini Murthy, MS, RAC 18
controls are a regulatory requirement for medical devices. In the US, compliance with the design controls section of 21 Code of Federal Regulations (CFR) Part 820.30 of the Quality System Regulation (QSR), 1 which applies to the design and development of new products, and changes to existing devices, is mandatory for both investigational and commercial medical devices. Because the regulation must apply to so many different types of devices, it does not prescribe in detail how a manufacturer must develop a specific device. Rather, the regulation is somewhat flexible; instead of specifics, it provides the framework that all manufacturers must follow by requiring that they develop and follow procedures and fill in the details that are appropriate to a given device. For example, the design control regulation requires documentation of device specifications. Different companies utilize terms such as Functional Requirement Specifications (FRS), Product Requirements Definition (PRD), etc., in their procedures. The Need for Control Requirements for Medical Devices Developing a new medical device from concept to market introduction is a complex process, particularly if the device and associated manufacturing processes use software, which presents the possibility of subtle errors. Devices typically have multiple components, some developed in-house, some procured from vendors. Then, the manufacturer assembles all these various parts into a finished medical device. Engineering teams developing such devices include members with specific functional expertise such as materials, software development and electronics, all of whom have to collaborate on designing the device. In addition to the complexity of the design process, device testing has to be adequate to meet regulatory requirements (US Food and Drug Administration (FDA), applicable international or domestic standards such as ISO, IEC and AAMI). This means regulatory strategy has to be developed early in design and development. Because devices are designed with intent, many can be tested exhaustively on the bench in simulated worst-case clinical conditions. Depending upon their technological risk and intended use, some devices may not need animal or clinical testing. Without thorough planning, communication and program control, it is difficult to develop a device that is error-free and or that includes all device features. Redesigning or retesting a device due to inadequate planning is a costly task and, in today s economic climate, funding such an effort could be a challenge. Controls provide a logical framework to approach device design and development, which are detailed in the article below. Figure 1 shows an overview of the design control process. History File A History File (DHF) should be initiated for each product developed. It contains and/ or references all of the documents and records noted below, necessary to establish compliance with the design control requirements. The following documents are typically maintained in the DHF and, are discussed in further detail below: design and development plans design inputs design review meeting minutes design outputs verification and validation test plans design verification protocols and results Most of these are living documents that evolve with device development, i.e., they undergo constant rethinking and modification as the project progresses. From Concept to and Development Plan At the outset of a new project, a product concept is outlined in a set of marketing requirements. The marketing requirements make a business case for proceeding with device development and outline the wish list for device features and functionality. It is a high-level description of the device, addressing the following basic questions: 2 What is the real need for the new device? Is there a market opportunity for the device? Where will the new device be used? In the hospital, the doctor s office, in consumers homes? Who will use the new device? Nurses, physicians, patients? How will the new device be used? Is it an accessory to another device? How long will the new device be used? Once the company decides to move forward with the project, a project plan is drawn up to guide and control the design and development of the device. Approval of the plan signifies the start of design controls implementation and a DHF is initiated at this time. The project plan (sometimes also called the design and development plan) is typically a project timeline or Gantt chart that is broad and complete, capturing tasks from conception through project completion, along with responsibilities and authority for the identified design and development activities. Risk management activities may be part of the plan. The project plan addresses team interfaces. For example, if contractors are responsible for developing software, developing manufacturing molds or conducting electrical safety testing, such activities are referenced and included in the plan. The interfaces also include interactions with Regulatory Focus 19
Figure 1. Control Overview & Development Planning Input Output Transfer Changes and Development Plan Develop Product Requirements, Specifications Implementation: Drawings, Mock Ups, Prototypes Tests (production units) Manufacturing Change Control System Safety Risk Analysis Part Specifications Reports Revalidation Testing Risk Assessment (FMEA) Clinical Trials Test Planning Unit Test & Verification Tests Significant Changes - Iterative Requirements & Risk Analysis Implementation Release manufacturing, research and development, marketing, quality assurance, regulatory or other internal functions. Some of these interfaces and responsibilities may be revised as the project advances. Most project plans identify a project manager who is tasked with coordinating this multi-functional input and ensuring compliance with design control requirements. Input input, the next step of the design and development process, involves translating user and marketing needs into a set of engineering requirements that can be tested, i.e., turning qualitative requirements into quantitative requirements. input also addresses requirements of regulations and standards, device packaging, shipping, installation and field service. This step focuses on what the design is intended to do while carefully avoiding specific solutions, especially at the start of the development phase. Besides engineering criteria, physician or nurse feedback may be obtained to capture routine clinical practice or procedures and experience with similar devices to better understand the clinical environment in which the device will be used and, if the technology is disruptive, to identify potential challenges to clinical implementation. A safety risk analysis related to intended use in the clinical environment may also be conducted. A design review is a formal, comprehensive, systematic, multi-function team evaluation and documentation of the design inputs or outputs to evaluate the adequacy of the design requirements, design capability and manufacturability, 20
and to identify problem areas. A design review may be used for design selection, for identification and resolution of problems and for design transfer to manufacturing. reviews are held at major decision points in product development as noted in the and Development Plan, and may be supplemented by routine team meetings. Output output is the translation of design input requirements into device specifications and production processes. It is important to realize that a design input requirement may have more than one design output. For example, a design input that states the device must alert a user via an audible alarm within one meter of the device may have specifications on both the decibel level and nature of the alarm (e.g., intermittent or continuous beep). outputs are documented and expressed in terms that can be verified and validated against the design input requirements. outputs evolve with the project. After preliminary design specifications are drafted, physical design of the device begins. Parts may be ordered and tested for acceptance before being approved as part of the design. Firms have to ensure that once parts are approved, purchasing control requirements of the QSR, such as supplier qualification and auditing, are complied with. Then prototypes of the device are assembled and preliminary testing is conducted to confirm design selection. If necessary, parts may be changed at this phase. All of this engineering work is documented. If there are significant challenges in meeting some design inputs, or revisions must be made to ensure proper functioning, the design input documents are updated using a formal document change procedure that captures the change history. In addition to document control, firms need to have supplier control and materials control procedures in place to support the design and development process. During this phase, a design risk assessment is conducted. Many methodologies are available. One is failure mode and effects analysis (FMEA). The FMEA methodology is a systematic process to identify potential material and component failures that might cause the device to fail, to identify and eliminate potential causes for these failures and to identify and reduce the failure s impacts. Verification and Test Plan A verification and validation (V&V) test plan is developed to ensure the device design meets all of the parameters in the design input phase. The design characteristics that mitigate risk as noted in the risk assessment are all tested in the V&V phase. There must be traceability from the V&V test plan back to the design input and design output/risk assessment. It is helpful to have a traceability matrix, which is a table where the direct, sequential relationship between the design input, design output/risk assessment and V&V test plan are noted. This traceability matrix is typically very detailed. Verification and validation testing must be prospectively planned and documented before actual testing commences and are typically captured in test protocols. Note that the actual V&V testing is also of the design output phase and more than one design review may be held during this phase. Verification verification testing confirms that the design output meets the design input requirements. verification involves reviewing, inspecting, testing and auditing the components, the final device, processes and documents to ensure they conform to design requirements. Testing can be performed on prototype devices. As product development proceeds, verification may be repeated as warranted when significant changes are made to the design. The verification effort takes into account the extremes of the design specifications (for example, the range of dimensional specifications of a coronary stent to 22
account for differences in human anatomy and the degree of arterial stenosis). When design verification testing shows that certain design requirements cannot be met, the requirements may be changed if marketing needs and the device s intended purpose are still fulfilled. A design review may be conducted to ensure that the updated design complies with the product requirements and raises no new questions of risk. validation follows successful design verification; it is intended to ensure that the products from initial production lots (or their equivalents), when used under actual or simulated conditions, function as intended. 3 The use of devices from production lots is meant to encompass expected variation in components, materials, manufacturing processes and the use environment. Methods of design validation include in vivo studies, historical database searches; literature searches; risk analysis, where appropriate; and review of labels, labeling, packaging and other historical product information. For certain products, a human clinical trial is required as part of the design validation activity to confirm that the product functions as intended in the user environment. The product tested is representative of the final, commercial product. Based on clinical trial feedback, design changes may be necessary. In general, if a product fails to meet the design input requirements during the design validation effort, it will be necessary to revise manufacturing processes (which may require re-validation) or the design (which may require reverification and reconstruction of design outputs). Transfer The purpose of design transfer is to ensure product designs are correctly transferred into manufacturing specifications. As the design output is being created, detailed part specifications, assembly instructions and quality control test instructions are being developed. They are all part of what is termed a Device Master Record (DMR), a set of documents that are used directly for production. Changes changes may be initiated because of factors such as customer feedback (suggestions for improvement, complaints), corrective or preventive actions, market changes and technological advances. changes are documented, tested, assessed for risk, reviewed and approved before implementation. The review of such changes includes the evaluation of the effect of the changes on products already in commercial or clinical use. The evaluation and documentation are to be in direct proportion to the nature and significance of the change, and may include risk analysis. The design changes are reviewed to determine whether prior design verification or validation results are impacted. If the design change is likely to affect the performance of the device under actual use conditions, new validation work, including clinical trials, may be necessary. Conclusion The design control regulations provide a comprehensive and systematic framework for device development. Regular design reviews are useful for periodically confirming that device development continues to meet clinical and market needs. Confirming that design outputs align with design inputs reduces the risk of omitting an important feature. The design control process is iterative. When new information comes up as the project progresses, the regulations require that prior documents be reviewed and revised as necessary. As noted earlier, redesigning the device after considerable time and effort has been expended is a costly exercise. control regulations are a regulatory requirement, but when used properly serve as good business practice. References 1. 21 CFR, Part 820, Quality System Regulation 2. Medical Device Quality Systems Manual: A Small Entity Compliance Guide 3. Control Guidance for Medical Device Manufacturers, 03/11/1997 Author Nandini Murthy, MS, RAC, is a regulatory consultant advising companies on regulatory strategy, regulatory planning, regulatory due diligence, FDA submissions, clinical study design and quality system development. Murthy has authored several PMA, modular PMA, HDE, IDE and 510(k) applications for cardiology, neurology, radiology, imaging, diagnostic device and IVD companies. She has also designed and executed clinical trials including the REMATCH, SPECTACL and BrainGate trials and has established quality systems to ISO 13485 and FDA Quality System requirements. Previously, Murthy served on the management team of several companies. Regulatory Focus 23