Quality System Regulations

1. Quality System Regulations

2. Objectives for this section You will learn: Some of the key points for the Quality System regulation The difference between regulations, directives, guidance documents and international standards, and Where to find more information

3. Quality System Regulation The Quality System Regulation has many different names, but it is all 21 CFR 820. QSR’s QSRegs Good Manufacturing Practices GMP’s cGMP’s

4. Quality System Regulation 21CFR820 is specific to devices. Includes requirements for manufacturers to define, document, implement and maintainan appropriate Quality System based on the scope of their operations. Provides a framework for a Quality Management System, from the design of a new device through servicing of marketed devices. Regulation has been in effect since 1997. There is no substitute for reading the regulations!

5. Quality System Regulation Applicability of the QS Regulation The QS regulation applies to finished device manufacturers who commercially distribute medical devices intended for human use.  A finished device is defined in 21 CFR 820.3(l) as any device or accessory to any device that is suitable for use or capable of functioning, whether or not it is packaged, labeled, or sterilized. Certain components such as blood tubing and diagnostic x-ray components are considered by FDA to be finished devices because they are accessories to finished devices. A manufacturer of accessories is subject to the QS regulation.

6. Quality System Regulation GMP Exemptions FDA has determined that certain types of medical devices are exempt from GMP requirements.  These devices are exempted by FDA classification regulations published in the Federal Register and codified in 21 CFR 862 to 892.  Exemption from the GMP requirements does not exempt manufacturers of finished devices from keeping complaint files (21 CFR 820.198) or from general requirements concerning records (21 CFR 820.180).

7. Quality System Regulation Governs the methods used in, and the facilities and controls used for: Design, manufacture, packaging, labeling, storage, installation, and servicing of all finished devices. Intended to ensure that finished devices will be safe, effective and in compliance with FD&C Act. Does NOT apply to manufacturers of components or parts of finished devices. DOESapply to contract manufacturers of medical devices. If you use contract manufacturers, make sure they are (and remain) registered with the FDA!

8. Sections of 21 CFR 820 Subpart A – General Provisions 820.1 Scope 820.3 Definitions 820.5 Quality system Subpart B – Quality System Requirements 820.20 Management responsibility 820.22 Quality audit 820.25 Personnel Subpart C – Design Controls 820.30 Design controls

9. Sections of 21 CFR 820 Subpart D – Document Controls 820.40 Document controls Subpart E – Purchasing Controls 820.50 Purchasing controls Subpart F – Identification and Traceability 820.60 Identification 820.65 Traceability

10. Sections of 21 CFR 820 Subpart G – Production and Process Controls 820.70 Production and process controls 820.72 Inspection, measuring & test equip. 820.75 Process validation Subpart H – Acceptance Activities 820.80 Receiving, in-process, & finished test 820.86 Acceptance status

11. Sections of 21 CFR 820 SubpartI – Nonconforming Product 820.90 Nonconformingproduct Subpart J – Corrective and Preventive Action 820.100Corrective and preventive action Subpart K – Labeling and Packaging Control 820.120 Device labeling 820.130 Device packaging

12. Sections of 21 CFR 820 Subpart L – Handling, Storage, Dist. & Installation 820.140 Handling 820.150 Storage 820.160 Distribution 820.170 Installation Subpart M – Records 820.180 General requirements 820.181 Device master record 820.184 Device history record 820.186 Quality system record 820.198 Complaint files

13. Sections of 21 CFR 820 Very few sub-parts don’tapply to pre-marketrequirements… Today we will cover: General information Design Controls Device Master Record Device History Record Process Controls

14. Standards Not law. “Voluntary”, but may be required for market entry. Usually worldwide Compliance with ISO requirements is assessed by ISO Registrars or Notified Bodies (NB). Terminology Regulations Laws Usually country-specific. Compliance is assessed by local governmental authorities. Directives Laws European Union Compliance is assessed by compliance with ISO requirements by Notified Bodies (NB). Guidances Not law Are usually “expected”

15. But it is not that simple… It isn’t just the black and white letter of the law. Remember that “c” in cGMPs? It stands for “current”. Regulations take a long time to change. The “c” allows FDA to enforce items which may not be specifically mentioned in the regulations. As the manufacturer, you are expected to keep up to date with FDA’s current thinking and expectations. Guidance documents, recognized standards, etc. play a big role.

16. ISO 13485 Quality Management Systems for Medical Devices An adaptation of ISO 9001 Needed to sell into most countries outside of the US. Applies to all products, regardless of FDA classification. Look for contract manufacturers to have (and keep) this certification!

17. ISO 13485 Non-complaint customer feedback Customer satisfaction Continuous improvement Quality Manual Etc. You are “certified” to the ISO 13485 standard. So Where Do They Meet? Common core requirements QS Regs Manufacturing materials Device Master Record Quality System Record Etc. You are “registered” with the FDA, and “compliant” with the regulations.

18. Quality System Regulations Back to the

19. Quality System Regulation Authority “…The failure to comply with any applicable provision… renders a device adulterated under section 501(h) of the act. Such a device, as well as any person responsible for the failure to comply, is subject to regulatory action.” Violation of the QS Regulations is a felony. Ignorance of the law is not accepted as an excuse. If you are selling medical devices, it is your responsibility to know the laws and abide by them.

20. Quality System Regulation Key definitions: Establishmeans to: Define, Document (in writing or electronically), and Implement Standard Warning Letter text: “Failure to establish &maintain procedures to ….” Quality System includes: Organizational Structure and Responsibilities Processes and Procedures Resources for implementing the system

21. Quality System Regulation Manufacturer needs to comply only with the applicable requirements. Danger zone! When a requirement is qualified by “where appropriate”, it is deemed by the FDA to be “appropriate” unless the manufacturer can document justification otherwise. (And the justification must pass the “laugh test”.) Yes, exemptions do exist Can get you in trouble; be very certain which ones apply to your device Many FDA Class 1 devices are exempt from some of the GMPs ………………………………………...........but not all of the GMPs. FDA does not requires use of design controls for most Class 1 devices …………………………………………………...........but ISO 13485 does.

22. Design Controls FDA requires design controls for all: All Class II and Class III devices Class I devices that contain software, and “Listed” devices Note that ISO 13485 requires for all devices, regardless of FDA class.

23. Design Controls Design Controls are not “one and done”. Meant to be iterative process and livingdocuments Design History File (DHF) Establish and maintain a design history file Contain or reference the records necessary to demonstrate that the design was developed in accordance with the approved design plan, and with the QS Regs Objective evidence a.k.a. “proof” of what was done

24. Design Controls Design Planning Establish and maintain plans for activities Define responsibilities Describe interfaces between groups / activities Review, approve, and update as design evolves Design Inputs Establish and maintain procedures Ensure design requirements are appropriate and address the intended use of the device, including the needs of the user and patient Mechanism for addressing incomplete, ambiguous or conflicting requirements Requirements are documented, reviewed, and approved Approval includes signature and date

25. Design Controls Design Outputs Establish and maintain procedures for defining and documenting output in terms that allow an adequate evaluation of conformance to design input requirements. Procedure contains (or refers to) acceptance criteria Procedure ensures that outputs essential for the proper functioning of the device are identified Design outputs are documented, reviewed and approved before release Approval includes signature and date.

26. Design Controls Design Verification Establish and maintain procedures Confirm that the design outputs meet the design input requirements. Results of verification are documented in the design history file, including: Identification of the design Methods Date Individuals performing verification Clarification Design verification – verify that outputs meet inputs (bench-top) Design validation – verify that design meets user needs and the intended use (actual or simulated conditions of use)

27. Design Controls Design Validation Establish and maintain procedures Performed “under defined operating conditions on initial production units, lots, or batches, or their equivalents”. Ensures that devices conform to the defined user needs and intended uses Includes testing of production units under actual or simulated use conditions Includes software validation, where appropriate Includes risk analysis, where appropriate Results of review are documented in the design history file, including: Identification of the design Methods Date Individuals performing review

28. Design Controls Design Transfer “Each manufacturer shall establish and maintain procedures to ensure that the device design is correctly translated to production specifications.” Identify and define production processes, procedures, and controls. Device is consistently manufacturable to established specifications. Design Changes Establish and maintain procedures for the identification, documentation, validation (or where appropriate, the verification), review, and approval of design changes before their implementation. Design changes must be controlled throughout product lifecycle (pre- and post-transfer)

29. Quality System Regulation Clarification DHF = design history file DHR = device history record (batch record) DMR = device master record (master instructions)

30. Device History Record “Batch records” Regulations state that each manufacturer shall “Establish and maintain procedures to ensure that device history records are for each batch, lot, or unit are maintained to demonstrate that the device is manufactured in accordance with the DMR and the requirements of this part.” DHR includes or refers to the location of the following information: dates of manufacture, quantity manufactured, quantity released for distribution, acceptance records which demonstrate the device is manufactured in accordance with the DMR, primary identification label and labeling used for each production unit and any device identification(s) and control number(s) used

31. Device Master Record Establish and maintain a DMR for each type of device which includes: Device specifications Production process specifications QA procedures and specifications Packaging and labeling specifications Installation, maintenance, and servicing procedures and methods Think of this as your disaster recovery. Should be everything you would need to start production at a new location. Doesn’t have to be a physical binder… many companies use a Bill of Material format for this. Notice that the DMR is device – specific.

32. Quality System Record Quality System Record (QSR) Include in the QSR, or refer to the location of, procedures and documentation of activities required by this part that are not specific to a particular type of device Includes your general quality procedures. Again, does not have to be a physical binder. Can be (for example) a table of contents.

33. Process Controls The difference between process validation versus verification. Verification Verification means confirmation by examination and provision of objective evidence that specified requirements have been fulfilled. “Checking each piece against the specs” Process Validation Process validation means establishing by objective evidence that a process consistently produces a result or product meeting its predetermined specifications. “Proving that the process always produces good product when run within given parameters”.

34. Process Controls “Each manufacturer shall develop, conduct, control, and monitor production processes to ensure that a device conforms to its specification.” “Where deviations from specifications could occur as a result of the manufacturing process, the manufacturer shall establish and maintain process control procedures that describe any process controls necessary to ensure conformance to specifications.” Establish and maintain process controls such as: Documented instructions, SOPs, and methods Monitoring and control of process parameters, component characteristics, and device characteristics Approval of processes and process equipment Defined criteria for workmanship Ensuring equipment is operating properly Controlling environment, personnel, and substances that could cause nonconformities in the product Establish procedures for changes to a specification, method, process, or procedure, including verification and/or validation And so on….

35. Process Controls Those processes that have results that cannot be verified should be validated. Such as: Sterilization Clean room ambient conditions Aseptic processing Sterile package sealing Lyophilization Heat treating Plating Plastic injection molding

36. Verification 100% verification/inspection sounds like a great idea But the theory is often better than the reality.

37. Quality System Regulation In summary, the Quality System regulation: is intended to ensure that finished devices will be safe and effective is just one of several regulations that apply to finished device manufacturers

38. Quality System Regulation But how do I convince others?

39. Quality System Regulation Preamble is well worth reading Explains FDA’s thinking Provides support

40. Quality System Regulation “If you think compliance is expensive – try non-compliance.” - Former U.S. Deputy Attorney General Paul McNulty

41. Case Study

42. Case Study Acme is proceeding with the development of their spinal pedicle fixation rod, which will be a permanent implant. You are the regulatory specialist assigned to the design team. Unfortunately, the project is behind schedule. However, the designers have had a very busy week, and things are getting back on track to meet the timelines. The designers have had ten devices made at a local machine shop. These are prototypes for the actual devices, which will be made in-house. However, the in-house equipment was busy, so a local vendor was used. The designers thoroughly inspected each device prior to using it, and recorded all of their data. From that data, they created a list of design inputs, as well as the design outputs. The designers have gotten access to several cadavers and implanted five of the devices. The devices look great, and the “patients” have no complaints. From this single experiment, they also wrote up a design validation protocol/report, and acceptance criteria. To save time, they wrote the protocol as they did the experiment. The acceptance criteria were drafted from the results they saw as they ran the tests. All that is left now is to document a design review, and we can go to production, right? From the perspective of the QS Regs, what issues do you see with the design process here?

43. Resources

44. Selected Relevant Sources Quality System Regulations / “GMP” Found in Code of Federal Regulations 21CFR820 (devices only) http://www.gpo.gov/fdsys/granule/CFR-2011-title21-vol8/CFR-2011-title21-vol8-part820/content-detail.html Preamble to QS Regs Found in Federal Register 61 FR 52654, published Oct. 7, 1996 http://www.gpo.gov/fdsys/pkg/FR-1996-10-07/pdf/96-25720.pdf

45. Selected Relevant Sources FD&C Act for Drugs and Devices Found in US code 21 U.S.C. 301 http://www.fda.gov/RegulatoryInformation/Legislation/FederalFoodDrugandCosmeticActFDCAct/FDCActChapterVDrugsandDevices/default.htm Guidance Documents FDA Guidance can be found at http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/default.htm “Device Advice” section of FDA website http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/default.htm

46. Selected References Quality System Compendium; GMP Requirements and Industry Practice www.aami.org Reference comparing QS Regs to ISO 13485, and a discussion of how industry typically implements the elements. Book or CD (which is searchable by keyword). Companion to the AAMI training course.

47. Selected FDA Regulations Covering PreMarket Requirements 21 CFR 7 Enforcement Policy 21 CFR 11 Electronic Records; Electronic Signatures 21 CFR 801 Labeling 21 CFR 807 Establishment Registration and Device Listing for Manufacturers and Initial Importers of Medical Devices 21 CFR 809 In Vitro Diagnostics for Human Use 21 CFR 812 Investigational Device Exemptions 21 CFR 814 Premarket Approval of Medical Devices

48. Selected FDA Regulations Covering PreMarket Requirements 21 CFR 820 Quality System Regulation If you read nothing else, read this one! 21 CFR 821 Medical Device Tracking Requirements 21 CFR 830 Unique Device Identification Systems 21 CFR 860 Medical Device Classification Procedures 21 CFR 1270 Human Tissue Intended for Transplantation 21 CFR 1271 Human Cells, Tissues, and Cellular and Tissue-Based Products