FDA Medical Device Enforcement and Quality System Update

1. FDA Medical Device Enforcement and Quality System Update Kimberly Trautman FDA’s Medical Device Quality Systems Expert Office of Compliance, CDRH

2. FDA Enforcement Update Remarks by: Margaret Hamburg, M.D.Commissioner of Food and Drugs "Effective Enforcement and Benefits to Public Health“ August 6, 2009 FDA must be vigilant, strategic, quick and visible

3. FDA Enforcement Update • Post Inspection deadlines – 15 day Warning Letter Response deadline • Decrease time between the inspection and issuance of a Warning Letter • Increase collaboration with regulatory partners such as local, state and international partners

4. FDA Enforcement Update • Prioritize enforcement follow-up • Act swiftly and aggressively to protect the public health • Warning Letter “Close Out” process

5. QS Regulation Cites by Subsystem

6. Warning Letter Cites by QS Subsystem - 2008 P&PC = 241 CAPA = 237 DESIGN = 155 MGMT = 130 DOC = 82 --------------------------------- Total = 845

7. Warning Letter Cites by QS Subsystem - 2008

8. Top Ten Warning Letter Cites - 2008 • 21 CFR 820.22 41 • 21 CFR 820.30(g) 28 • 21 CFR 820.198(a) 28 • 21 CFR 820.75(a) 27 • 21 CFR 820.100(a) 25 • 21 CFR 820.30(i) 21 • 21 CFR 820.184 21 • 21 CFR 820.30(a) 20 • 21 CFR 820.80(d) 19 • 21 CFR 820.198(c) 19

9. January – December 2008 FDA issued 98 Warning Letters to medical device firms for QS/GMP deficiencies 86/98 or 88% contained cites for CAPA system deficiencies Warning Letters with CAPA Subsystem Cites 2008

10. Warning Letters CAPA Subsystem Data

11. January – December 2008 FDA issued 98 Warning Letters to medical device firms for QS/GMP deficiencies 80/98 or 82% contained cites for P&PC subsystem deficiencies Warning Letters with P&PC Subsystem Cites 2008

12. January – December 2008 FDA issued 98 Warning Letters to medical device firms for QS/GMP deficiencies 54/98 or 55% contained cites for Design Control deficiencies Warning Letters with Design Control Cites 2008

13. Warning Letters Design Control Subsystem Data

14. Quality System Hot Topics • Supplier Controls • Corrective and Preventive Actions

15. What is unique about medical devices? • Medical Devices utilize a wide range of supplied products and services • Supplied products: • Finished medical devices or accessories in the case of kits or device systems • Electronic parts to include anything from individual resistors, capacitors, etc. to completed hybrid boards

16. What is unique about medical devices? • Supplied products: • Raw materials such as chemicals, polymers, metals, etc. • Software packages • Antibodies, antigens, etc. for in-vitro diagnostic products • Finished drugs or APIs in the case of combination products

17. What is unique about medical devices? • Supplied services: • Contract manufacturers • Contract laboratories • Contract sterilizers • Calibration test houses • Contract installers and service providers • Auditors • Consultants

18. What is unique about medical devices? • Further the supplied products and services cover the entire range from a risk perspective. • Same supplied product or service for one manufacturer may not have the same risks depending upon multiple factors.

19. What is unique about medical devices? • Same supplier for one product or service may have different risks for a different supplied product or service. • Be wary of utilization of supplier audits without understanding the scope of the previous supplier audit.

20. Quality System (QS) Regulation21 CFR 820.50 Purchasing Controls Each manufacturer shall establish and maintain procedures to ensure that all purchased or otherwise received product and services conform to specified requirements.

21. Quality System (QS) Regulation21 CFR 820.50(a) (a) Evaluation of suppliers, contractors, and consultants. Each manufacturer shall establish and maintain the requirements, including quality requirements, that must be met by suppliers, contractors, and consultants. Each manufacturer shall:

22. 21 CFR 820.50(a) Purchasing Controls (1) Evaluate and select potential suppliers, contractors, and consultants on the basis of their ability to meet specified requirements, including quality requirements. The evaluation shall be documented.

23. 21 CFR 820.50(a) Purchasing Controls (2) Define the type and extent of control to be exercised over the product, services, suppliers, contractors, and consultants, based on the evaluation results. (3) Establish and maintain records of acceptable suppliers, contractors, and consultants.

24. 21 CFR 820.50(b) Purchasing Data (b) Purchasing data. Each manufacturer shall establish and maintain data that clearly describe or reference the specified requirements, including quality requirements, for purchased or otherwise received product and services.

25. 21 CFR 820.50(b) Purchasing Data Purchasing documents shall include, where possible, an agreement that the suppliers, contractors, and consultants agree to notify the manufacturer of changes in the product or service so that manufacturers may determine whether the changes may affect the quality of a finished device. Purchasing data shall be approved in accordance with Sec. 820.40.

26. Preamble to the 1996 QS RegulationComment #99 Since FDA is not regulating component suppliers, FDA believes that the explicit addition to CGMP requirements of the purchasing controls of ISO 9001:1994 is necessary…

27. Preamble to the 1996 QS RegulationComment #99 To ensure purchased or otherwise received product or services conform to specifications, purchasing must be carried out under adequate controls, including the assessment and selection of suppliers, contractors, and consultants,

28. Preamble to the 1996 QS RegulationComment #99 the clear and unambiguous specification of requirements, and the performance of suitable acceptance activities. Each manufacturer must establish an appropriate mix of assessment and receiving acceptance to ensure products and services are acceptable for their intended uses. ..

29. Preamble to the 1996 QS RegulationComment #99 FDA generally believes that an appropriate mix of supplier and manufacturer quality controls are necessary. However, finished device manufacturers who conduct product quality control solely in-house must also assess the capability of suppliers to provide acceptable product. Where audits are not practical, this may be done through, among other means, reviewing historical data, monitoring and trending, and inspection and testing.

30. Preamble to the 1996 QS RegulationComment #99 Thus the degree of supplier control necessary to establish compliance may vary with the type and significance of the product or service purchased and the impact of that product or service on the quality of the finished device.

31. Preamble to the 1996 QS RegulationComment #100 Thus, a manufacturer must comply with these provisions when it receives product or services from its ``sister facility'' or some other corporate or financial affiliate. ``Otherwise received product'' would include ``customer supplied product'' as in ISO 9001:1994, section 4.7, but would not apply to ``returned product'' from the customer.

32. Preamble to the 1996 QS RegulationComment #102 …FDA believes that all suppliers of such services must be assessed and evaluated, just like a supplier of a product. As always, the degree of control necessary is related to the product or service purchased…

33. Preamble to the 1996 QS RegulationComment #103 …certification may play a role in evaluating suppliers, but cautions manufacturers against relying solely on certification by third parties as evidence that suppliers have the capability to provide quality products or services. FDA has found during inspections that some manufacturers who have been certified to the ISO standards have not had acceptable problem identification and corrective action programs.

34. Preamble to the 1996 QS RegulationComment #103 Therefore, the initial assessment or evaluation, depending on the type and potential effect on device quality of the product or service, should be a combination of assessment methods, to possibly include third party or product certification.

35. Preamble to the 1996 QS RegulationComment #103 However, third party certification should not be relied on exclusively in initially evaluating a supplier. If a device manufacturer has established confidence in the supplier's ability to provide acceptable products or services, certification with test data may be acceptable.

36. Preamble to the 1996 QS RegulationComment #106 The intent of Sec. 820.50 is to ensure that device manufacturers select only those suppliers, contractors, and consultants who have the capability to provide quality product and services. As with finished devices, quality cannot be inspected or tested into products or services.

37. Preamble to the 1996 QS RegulationComment #106 Rather, the quality of a product or service is established during the design of that product or service, and achieved through proper control of the manufacture of that product or the performance of that service…

38. Quality System (QS) Regulation21 CFR 820.30 Design Controls • 820.30(c) Design Input …ensure that the design requirements relating to a device are appropriate and address the intended use of the device, including the needs of the user and patient…

39. Quality System (QS) Regulation21 CFR 820.30 Design Controls • 820.30(d) Design Output …shall contain or make reference to acceptance criteria and shall ensure that those design outputs that are essential for the proper functioning of the device are identified…

40. Quality System (QS) Regulation21 CFR 820.30 Design Controls • 820.30(g) Design Validation Design validation shall ensure that devices conform to defined user needs and intended uses and shall include testing of production units under actual or simulated use conditions. Design validation shall include software validation and risk analysis...

41. Preamble to the 1996 QS RegulationComment #106 …Section 820.80 is specific to a device manufacturer's acceptance program. While finished device manufacturers are required to assess the capability of suppliers, contractors, and consultants to provide quality products and services, inspections and tests, and other verification tools, are also an important part of ensuring that components and finished devices conform to approved specifications.

42. Quality System (QS) Regulation21 CFR 820.80 Acceptance Activities • 820.80(a) General Each manufacturer shall establish and maintain procedures for acceptance activities. Acceptance activities include inspections, tests, or other verification activities….

43. Preamble to the 1996 QS RegulationComment #106 The extent of incoming acceptance activities can be based, in part, on the degree to which the supplier has demonstrated a capability to provide quality products or services. An appropriate product and services quality assurance program includes a combination of assessment techniques, including inspection and test.

44. Purchasing Controls and Acceptance Activities Commensurate to the Risk

45. Global Harmonization Task Force (GHTF) Guidance document • GHTF Study Group 3 Final Guidance: • Quality Management System – Medical Devices – Guidance on the Control of Products and Services Obtained from Suppliers • Posted Feb. 5, 2009 • http://www.ghtf.org/documents/sg3/sg3final-N17.pdf

46. Global Harmonization Task Force (GHTF) Study Group 3 Drafting a guidance document: Proposed Document for Comment estimated to be published in Dec 2009. “Quality Management System –Medical Devices – Guidance on corrective action and preventive action and related QMS processes”

47. Key Terms • Correction: repair, rework, or adjustment and relates to the disposition of an existing nonconformity. • Corrective Action: the action taken to eliminate the causes of an existing nonconformity, defect or other undesirable situation in order to prevent recurrence. • Preventative Action: action taken to eliminate the cause of a potentialnonconformity, defect, or other undesirable situation in order to prevent occurrence.

48. CAPA Summary

49. Providing Industry AssistanceCDRH Resources • CDRH Learn [New] • Modules include various premarket and post-market information • Available 24/7 • Certificate generated per topic upon passing post-tests • Suggest Future topics • http://www.fda.gov/cdrh/cdrhlearn/ • Device Advice • Self-service website • Searchable by topic • http://www.fda.gov/cdrh/devadvice/ • Division of Small Manufacturers, International, and Consumer Assistance (DSMICA) • Technical Assistance for the Medical Device Industry • 800-638-2041 or 240-276-3150 • DSMICA@cdrh.fda.gov

50. Providing Industry AssistanceCDRH Learn What is CDRH Learn? • New Online Training tool • Multi-Media Presentation • Available 24/7 • Certificate generated per topic upon passing post-tests • Suggest Future topics • Examples of Modules • Overview of Regulatory Requirements: Medical Devices • Quality System Regulation 21 CFR 820 Basic Introduction • Overview of the Premarket Notification Process – 510(k) • How to Get Your Electronic Product on the U.S. Market. • BIMO (under development) • Registration & Listing (under development) http://www.fda.gov/cdrh/cdrhlearn/