If you ask a pharmaceutical professional about the FDA’s requirements for medical devices, the answer you might get is a vague nod to the understanding that medical device regulations are “less restrictive” than pharmaceutical regulations. What are those requirements, really? If you are a pharmaceutical professional newly embarking on the adventure of medical devices, what are the essential regulations needed for compliance? This article will explore the key differences between the FDA regulations for pharmaceuticals and for medical devices.
By: Regina Fullin
Senior Compliance Expert at Compliance Team Inc.
The differences lie in three major areas: the FDA’s Quality System Regulation (QSR), Unique Device Identification (UDI), and Medical Device Reporting (MDR). (The FDA simply cannot resist the use of acronyms!) These regulations have similarities to the cGMPs, the Drug Supply Chain Security Act, and pharmacovigilance requirements for pharmaceutical products, with specific differences.
The Quality System Regulation covers manufacturing, processing, packing, and holding of medical devices. Some have mistakenly stated that these regulations are more lenient, when in actuality, they are less prescriptive, and perhaps, depending on your viewpoint or the type of device you make and market, the requirements could become more onerous to the organization.
The major differences in the QSR (in 21 CFR Part 820) from the GMPs (in 21 CFR 210/211) is the lack of detail to identify exactly what needs to be done to achieve compliance. This is because medical devices have a wide array of designs and intended uses, making it virtually impossible to prescribe exactly what constitutes Good Manufacturing Practice. To work around that obstacle, the FDA added verbiage to ensure that companies impose their own requirements to produce a system that is consistently able to produce devices that deliver on the intended use. If a requirement is inherently pointless due to the device design, the manufacturer must document the rationale for exemption from a rule. The one place in the QSR that most aptly illustrates this point is in 21 CFR 820, Subpart C, Design Controls.
The Quality System Regulation
Design Controls examine the intended use and design of a product BEFORE manufacturing, to ensure that the requirements for its manufacture are appropriate for the intended use. In a pharmaceutical product, the intended use and design is rather simple. The drug is formulated in a dosage form, and administered at the proper dosage topically or within the body, to address an underlying medical condition. For medical devices, the intended use may not be so straightforward, and require some explanation. For example, in a pharmaceutical drug manufacturing environment, certain levels of sanitation are necessary, since the drug, even if applied topically, could harm a patient if unsanitary. Sanitation may be less essential for certain medical devices. An X-ray machine makes no physical contact with the patient, for example, and the level of sanitation necessary would only be dictated if a key element of the system’s design necessitated cleanliness (such as cleanroom requirements for the manufacture of electronics – which may exclude microbial testing in lieu of stricter standards on airborne particulates.)
Design Controls then, are a way to determine what requirements are necessary for the medical device to perform in the manner it was designed to do. Design Control is a seven-phase process to show that the final design transferred to manufacturing is suitable for the product’s end-user. Those phases are: Design and Development Planning – How the establishment intends to do the work, the “rules” of the process; Design Input – A list of requirements for the device concept; Device Output – The resulting design and specifications after consideration of all the Design Input requirements; Design Review – Documented management review approving the design phase; Design Verification/Validation – Customer testing of the product to demonstrate that the design and specifications are indeed suitable for the device’s intended use; and Design Transfer – Documented official transfer of ownership of the product design to Production after successfully navigating all of the above steps. The last requirement, the Design History File, is the living document that is maintained to show all of the previous design phases, and the official record to document ongoing design changes (if necessary).
Design control is a tool to determine which requirements to implement to assure that manufacturing, processing, labeling, installation, servicing, packing and holding of in-process and final devices have the identity, quality, durability, reliability, safety effectiveness, and performance they purport to have. Note, that the word “purity” is excluded from this list, as this is a term that normally refers to a drug substance. If, during the Design Control process, however, it becomes clear that purity is essential to device effectiveness, production and process controls (and corresponding validations, etc.) would need to be implemented.
The Quality System Regulation is designed to avoid telling establishments how to manufacture a device, in lieu of specifying a system to ensure that requirements are appropriate for the device’s manufacture. Any requirements that would ordinarily be considered applicable, such as 21 CFR 820.200, Servicing, must be specifically excluded in the quality system documentation, with a clear, scientifically reasonable rationale as to its exclusion.
Inherent in the Quality System is a means to ensure that quality problems, once identified, will not recur. While many pharmaceutical establishments have implemented CAPA for this reason, CAPA is only specified as an FDA requirement for medical device companies. On the pharmaceutical side, all unexplained discrepancies must be thoroughly reviewed and investigated (21 CFR 211.192). The regulation for pharmaceuticals isn’t codified as the seven-step CAPA process outlined in 21 CFR Subpart J. The seven-part process describe the following specific steps: (1) Analyzing processes, (2) Investigating the root cause of nonconformities, (3) Identifying actions to correct the problem (4) Verify and/or validate the corrective action (5) Implementing the changes (6) Performing an Effectiveness Check, and (7) Performing management review CAPA oversight.
Medical Device Reporting
As stated earlier, Medical Device Reporting is most similar to pharmacovigilance for a pharmaceutical product. Both systems require that adverse events be reported to the FDA, and, most recently, both systems require these reports to be submitted electronically.
The main differences are in the way in which these items are evaluated and submitted. Submissions for adverse events are reported within 15 days of initial report receipt for a pharmaceutical report, while Medical Device reports for serious events are reported within 5 work days for an issue that may have public health impact, while a standard medical device report occurs within 30 calendar days that an establishment “becomes aware” of an event. The key difference between “receipt” or an adverse event report and “becoming aware” is that, for a medical device product, a more types of events are reportable – including events without actual adverse patient impact.
21 CFR 803 requires medical device reports for any malfunctioning device where the device or similar device marketed would be likely to cause or contribute to death or serious injury were that malfunction to recur. The definition for “likely,” in this case means that it has occurred once in the past, or has been risk assessed to a similar level as the actual occurrences. Most reportable events are received through product complaints for devices, and awareness of the malfunction that could cause death or serious injury if it were to recur may not exist at the initial receipt of a complaint. The reportable nature of the event may only become apparent to postmarket surveillance personnel after follow-up with the customer or investigation of the complaint that reveals a serious issue. Therefore, for a medical device organization, it is imperative that the awareness date be documented.
The use of one’s imagination to determine whether a complaint might cause or contribute to death or serious injury may sound astonishing, in comparison to the pharma regulations. Medical device organizations can avoid some inconveniences required in the pharmaceutical sector. Vigilance plans, literature reviews and postmarketing studies, are best practices that are optional for medical device manufacturers, but are mandatory in pharmaceutical organizations. In other words, medical device companies are not obligated to “look for” potentially adverse events. The FDA, instead, expects comprehensive complaint handling/complaint management and investigation system to assure that every complaint and adverse event received is reviewed and, if necessary, reported.
Other differences between medical device reporting and the pharmacovigilance process are times and formats for reporting. Periodic pharma summary reports are submitted quarterly while medical device summaries are submitted annually. Medical device reports are published in the MAUDE (Medical And User facility Device Experience) database. Pharmaceutical data for adverse events and medication errors are published in the FAERS (FDA Adverse Events Reporting System) database. At present, device is fully electronically-submitted. Though discouraged, pharmaceutical companies have the option to submit manually.
Unique Device Identification
Unique Device Identification is a relatively new FDA rule, whose analog in the Pharma world is the Drug Supply Chain Safety Act (DSCSA). The DSCSA is a comprehensive rule, to track and trace the location of a pharmaceutical product from point of origin to pharmacy, so this particular Act is early in its ten-year journey toward implementation. The Unique Device Identifier Final Rule is not as comprehensive. Both systems use AIDC technology (Automatic Identification and Data Capture – barcodes and/or RFIDs) on a label to identify products, but the UDI Final Rule was much easier to implement because the UDI rule lacks a track-and-trace requirement. As of now, all Class III and Class II medical devices should have a UDI label already, with future dates for the remainder of Class I devices (the lower-risk ones) that require UDIs.
Unique Device Identification is intended to integrate with the complaint handling and medical device reporting such that it facilitates a faster recall process. This is especially important where confusion over the device make, model, and manufacturer exist, such as for devices that are commodities where manufacturers market products that are virtually identical to competitors. Companies can use the additional information from the UDI to determine whether products are being diverted from the supply chain, counterfeited, or reused in an inappropriate manner, even though this outside the objective for the UDI Final Rule.
If you are transitioning from a compliance role in pharmaceuticals to a role within medical devices, studying the Quality System Regulation (21 CFR 820), the Medical Device Reporting rule (21 CFR 803) and the Unique Device Identification Final Rule (21 CFR 830) will help you on your compliance journey. Look into these regulations, and you will see similarities that you can borrow from the pharma world, to leverage for a medical device product. If you are in a pharma organization looking to take on the challenges of marketing a medical device or combination product, these rules will define just how much change your organization will need to undertake. Remember a remember to consider Compliance Team for your medical device transition plan because our regulatory compliance experts can help you to handle the transition.