Introduction to Quality Management Systems for Medical Devices

1. Introduction to Quality Management Systems for Medical Devices

2. Introduction to Quality Management Systems of for Medical Devices Sponsored by: Community College of Allegheny County

3. Purpose of the course This course is intended to review the quality management system (QMS) requirements for medical device manufacturers.

4. Expected Learning • Understand the concept and structure of a quality system • Differentiate between the medical device QMS and that of other industries • Identify the common elements and processes of a QMS and key requirements that apply to them • Locate information in the FDA Quality System Regulation (QSR) • Learn what written procedures are required

5. Triage of Knowledge

6. Course Agenda • Regulatory Requirements • Quality System Documents and Structure • System Requirements • Management Responsibility • Resources • Realization Processes • Measurement and Improvement • Required Procedures • Examination and Evaluation

7. What is a System? A regularly interacting or interdependent group of items forming a unified whole

8. What is a Quality System? • The quality management system consists of the organizational structure, responsibilities, procedures, specifications, processes, and resources that work together to comply with the company’s quality policy and meet the requirements of our customers and applicable regulatory requirements • Quality is the degree to which a set of inherent characteristics fulfils requirements

9. Medical Regulatory Requirements for QMS • US/FDA: Quality Management System per 21 CFR820, Quality System Regulation • Europe, Canada, and Other International: QMS per EN/ISO 13485:2003, Medical devices – Quality management systems – Requirements for regulatory purposes • Additional directives, regulations, standards, and guidance documents

10. Why Consider ISO 13485? • The requirements of ISO 13485 and the FDA QSR are very similar • You will need 13485 if you do international business • Even if you don’t, the model of 13485 is a good tool for visualizing and learning the system and for complying with FDA QSR

11. Is ISO 13485 = ISO 9001? • More emphasis in 13485 on: • Records meeting medical device requirements • Risk management • Work environment and cleanliness • Complaint handling and corrective action • Less on customer satisfaction and continual improvement

12. Documented System? We don’t use no stinking documents We don’t keep no stinking records

13. Requirements for a Documented Quality System • QSR • 820.20(e) Quality system procedures • 820.20 Document Controls • 820.180 to 198: Records • ISO 13485 • Clause 4, Quality Management System • 4.2.2 Quality manual • 4.2.3 Control of Documents • 4.2.4 Control of Records

14. Typical Quality System Document Pyramid Quality Manual Procedures Work Instructions Forms Quality Records

15. Role of a Quality Manual • Describes the QMS • Sets policy for the organization based on • External regulations • Company business practices and plans • Company culture • QM is required by 13485, not by FDA, but: “An outline of the structure of the documentation used in the quality system shall be established where appropriate”

16. Quality System Procedures • Implement policy through • Definition of processes • Assignment of responsibility and authority • Identification of review and approval mechanisms • Maintenance of records • Should be referred to in the quality manual or otherwise summarized • Quality manual can be a collection of the high level procedures

17. What is meant by “Establish and Maintain Procedures?” • Establish = design the process, write, validate • Maintain = respond to audits, revise for corrective action, changing conditions • Responsibility of Department Leader or Process Owner

18. What is meant by “Where appropriate?” • A requirement is appropriate if consistent results and the ability to take corrective action are not possible without it. • Requirements for procedures and documents can depend on: • Risk of the device • Size and complexity of the organization • Training and skills of those using them

19. Lower Tier Documents • Detailed procedures – below system level • Work Instructions (build, test, inspect, purchase) • Forms or templates for developing documents or keeping records • Should be defined by associated procedures • Records

20. ISO 13485 Model

21. QMS Requirements (4.0) • Describe the scope of the quality management system (QMS) • Organization and locations • Products • Compliance (Regulations and Standards) • Describe the document structure and types of documents • To help auditors, include trace from requirements to quality manual or procedures, • Requirements for documents and records

22. Document Control • Changes only with approval by same persons or functions as original • Record of changes • Communicate changes and documents • Use only latest revision • Define if it is paper or electronic version • Control over standards and other documents of external origin

23. Record Control • “Record” is a document that furnishes objective evidence of activities performed or results achieved • Quality record is one that relates to the quality management system

24. Why Quality records? • Provide objective evidence of the achievement of quality requirements • Verify effective operation of the QMS • Comply with regulatory requirements • Provide for traceability of devices and components • Provide information for corrective and preventative action and continuous improvement

25. Procedures Required • Identifying, collecting, indexing, accessing, filing, storing, maintaining, and disposition • Storage location and archiving • Storage media (may be electronic) • Retention times • Methods of disposition

26. ISO 13485:2003 Model 7.0 Realization Processes

27. Management Responsibility • Executive Responsibility • Direction to establish Quality Policy • Management Representative • Management Review • Quality Planning

28. Management Review • Hold regularly with appropriate executive attendance • Defined inputs including • Status of QMS • Audits, Complaints, Corrective and Preventive Action • Metrics of processes • Maintain records including: • Conclusion on suitability of QMS • Actions for improvement

29. Resources • Responsibility of Management • Human Resources • Infrastructure • Working Environment • Measurement Equipment • Information Systems

30. Human Resources • Sufficient personnel with appropriate background, education, and experience • Determine required competence • Job Descriptions or other documentation of expectations • Provide training to ensure competence • Ensure that the assigned tasks are performed in accordance with the quality system and associated policies, procedures, and work instructions • Include instruction on the importance of the associate’s activities and their contribution to the quality objectives

31. Training • Identify the training needs and plan the training • Identify of device defects or nonconforming conditions that may occur as a result of improper performance • Identify types of defects that may be encountered on validation, verification, inspection, or test activities, • Include training on any special processes, and any need to work under special environmental conditions • Conduct the training • Consider how to train on changes • Evaluate effectiveness of training • Records of all training

32. Infrastructure • Controlled conditions to ensure that devices meet their requirements and are shipped free of contamination • Buildings adequate, orderly, to prevent contamination and mix-up • Processing Equipment • Selected and designed to meet requirements • Cleaned, maintained, and adjusted

33. Working Environment • Control environmental conditions as necessary depending on product, including consideration of items sensitive to electrostatic discharge (ESD) • Cleaning where necessary to meet specifications and prevent device or equipment contamination • Limitations on eating, drinking, and smoking • Inform all associates who contact devices or components of requirements for health, cleanliness, personal practices, and attire as well as any adverse effects that the health of the associates could have on product quality • Include requirements for safety and health per OSHA and other regulations

34. Measurement Equipment • Anything used to provide evidence of conformity • Ensure that it is suitable for its intended use and to assure confidence in the measurements • Include selection, qualification, identification, preservation, calibration, and corrective action • Procedures for calibration -- 820.72(b) • Suppliers of calibration services qualified per Purchasing procedures

35. Information Systems • Systems that support the quality management system shall be developed, operated, and maintained under controlled conditions • Adequate equipment, environment, software, procedures, and personnel • Validate all systems and software • Requirements of 21 CFR 11 • Electronic records • Electronic signature • HIPPA or Sarbanes-Oxley (SOX) may also apply

36. Electronic Records • Closed systems with controlled system access • Device checks to determine the validity of data sources • Demonstrated accuracy, consistency, and the ability to discern invalid or altered records • Ability to generate accurate copies of records in both human readable and electronic form • System checks to enforce sequencing of steps and events • Audit trails with system-generated date and time stamps • Changes shall not obscure previous information • Policies to hold individuals accountable for their actions • Provision for back-up protection and accurate and ready retrieval of the electronic records, including audit trails

37. Electronic Signature Requirements apply if regulations or procedures specifically require a “signature” for the data element. • Implementation shall be validated • Assignment of unique signature to one individual, without reuse, along with verification of the identity of the individual • In the case of signatures based on biometrics, steps to ensure they can be used only by their owners • Otherwise, include two distinct components such as an identification code and a password. • Both components shall be used, with the exception that during a single, continuous period of controlled system access, after signing on with both components, subsequent signings shall be executed by at least one of the components.

38. ISO 13485 Model

39. Realization Processes • Plan, define, implement, and maintain processes to meet customer requirements • Consider quality objectives • Comply with the requirements of the quality management system, and any unique requirements of the products. • Use risk management methods • Changes to manufacturing or service processes shall include appropriate quality planning, with provision for any required quality controls, verification, or validation

40. Typical Realization Processes Design Regulatory and Clinical Supply Management Manufacturing Distribution Service Customer Processes

41. Customer Processes • Ensure effective communication with customers • Receipt and entry of orders and order status • Product information, pricing, inquiries, contracts, service-level agreements • Changes affecting the products and services • Recording customer complaints • Collection of customer feedback • Information and training for safe and effective use of the product

42. Design Control • Plan and control the design and development of all products and their labeling in order to assure the safety, clinical utility, effectiveness, and reliability of the device design and to ensure that specified design requirements are met

43. Design Control Sub-processes • Design and Development Planning • Design Input • Design Output • Design Review • Verification • Validation • Control of Changes • Design Transfer

44. Design Input • Ensure requirements are appropriate • Risk analysis • Address needs of user and patient • Deal with incomplete requirements • Document, review, approve, and sign

45. Design Review • Formal reviews at planned stages • Can define in procedure or quality plan • Represent all functions affected • At least one participant independent of that stage • Document results • Document resolution of issues

46. Design Verification • Confirm that design output = design input requirements 820.30 (f) • Design output = drawings and hardware or software implementation • Document results • Include trace of inputs to verification tests or other methods

47. Design Validation • Confirm that devices meet user needs • Use production units under actual or simulated use conditions • Include user validation, clinical studies, human factors, as appropriate • Show statistical confidence that results are achieved • Document results

48. Design Records • Design history file (DHF) is record of how you got there • Technical file (TF) for European market • Device Master Record (DMR) is result of the design; the “recipe” for the product

49. Device Master Record • A compilation of records that completely describe the device and the processes by which the device is produced, inspected, tested, labeled, stored, and distributed • See 820.181 for content • Must be approved per Document Control procedures

50. DHF/TF Contents • Design reviews including the design, the date, and individuals performing the review • Design verification including the design, date, methods, identification of how design outputs meet design inputs, and individuals performing the verification • Design validation including the design, date, methods, and individuals performing the validation • Evidence of clinical utility and acceptance, including the records of any clinical studies performed as part of the development of the device • Records of all risk management activities