FDA Archives

Mar 22 2023

Regulatory pathway analysis–a case study

510(k), FDA / By Robert Packard / 510(k), FDA, Medical Device, Regulatory Pathway

This article uses a case study example to explain how to determine the correct regulatory pathway for your medical device through the US FDA.

Regulatory Pathway 1 Regulatory pathway analysis a case study — **How do you select the right regulatory pathway for your device?**

Every consultant likes to answer this type of question with the answer, “It depends.” Well, of course, it depends. If there was only one answer, you could google that question, and you wouldn’t need to pay a regulatory consultant to answer the question. A more useful response is to start by asking five qualifying questions:

Does your product meet the definition of a device?
What is the intended purpose of your product?
How many people in the USA need your product annually?
Is there a similar product already on the market?
What are the risks associated with your product?

The first question is important because some products are not regulated as medical devices. If your product does not diagnose, treat, or monitor a medical condition, then your product may not be a device. For example, the product might be considered a general wellness product or clinical decision support software. In addition, some products have a systemic mode of action, and these products are typically categorized as a drug rather than a device–even if the product includes a needle and syringe.

The intended purpose of a product is the primary method used by the US FDA to determine how a product is regulated. This also determines which group within the FDA is responsible for reviewing a submission for your product. The US regulations use the term “intended use” of a device, but the decision is based upon the “indications for use” which are more specific. To understand the difference, we created a video explaining the difference.

Even regulatory consultants sometimes forget to ask how many people need your product annually, but population size determines the regulatory pathway. Any intended patient population less than 8,000 patients annually in the USA is eligible for a humanitarian device exemption with a special regulatory pathway and pricing constraints. If your product is intended for a population of <8,000 people annually, your device could qualify for a humanitarian device exemption, and the market is small enough that there may not be any similar products on the market.

If similar products are already on the US market, determining the regulatory pathway is much easier. We can look up the competitor product(s) in the FDA’s registration and listing database. In most cases, you must follow the same pathway your competitors took, and the FDA database will tell us your regulatory pathway.

If all of the products on the US market have different indications for use, or the technological characteristics of your product are different from other devices, then you need to categorize your product’s risks. For low-risk devices, general controls may be adequate. For medium-risk devices, special controls are required by the FDA. For the highest-risk devices, the FDA usually requires a clinical study, a panel review of your clinical data, and the FDA requires pre-market approval.

This article will use the example of bipolar forceps used with an electrosurgical generator as a case study.

Bipolar Forceps Regulatory pathway analysis a case study

What is the US FDA regulatory pathway for your device?

The generic term used for regulator authorization is “approval,” but the US FDA reserves this term for Class 3 devices with a Premarket Approval (PMA) submission. The reason for this is that only these submissions include a panel review of clinical data to support the safety and effectiveness of the device. Approval is limited to ~30 devices each year, and approximately 1,000 devices have been approved through the PMA process since 1976 when the US FDA first began regulating medical devices.

Most Class 2 devices are submitted to the FDA as Premarket Notifications or 510k submissions. This process is referred to as “510k clearance,” because clinical data is usually not required with this submission and there is no panel review of safety and effectiveness data. A 510k was originally planned as a rare pathway that would only be used by devices that are copies of other devices that are already sold on the market. However, the 510k pathway became the defacto regulatory pathway for 95+% of devices that are sold in the USA.

For moderate and high-risk devices that are intended for rare patient populations (i.e., <8,000 patients per year in the USA), the humanitarian device exemption process is the regulatory pathway.

Class 1 devices typically do not require a 510k submission, most of these devices are exempt from design controls, and some are exempt from quality system requirements. These devices still require listing on the FDA registration and listing database, but there is no review of the device by the FDA to ensure you have correctly classified and labeled Class 1 devices.

How do you find a predicate for your 510k submission?

As stated above, one of the most critical questions is, “Is there a similar product already on the market?” For our example of bipolar forceps, the answer is “yes.” There are approximately 169 bipolar forceps that have been 510k cleared by the FDA since 1976. If you are developing new bipolar forceps, you must prepare a 510k submission. The first step of this process is to verify that a 510k submission is the correct pathway and to find a suitable competitor product to use as a “predicate” device. A predicate device is a device that meets each of the following criteria:

it is legally marketing in the USA
it has indications for use that are equivalent to your device
the technological characteristics are equivalent to your device

There are two search strategies we use to verify the product classification of a new device and to find a suitable predicate device. The first strategy is to use the free, public databases provided by the FDA. Ideally, you instantly think of a direct competitor that sells bipolar forceps for electrosurgery in the USA (e.g., Conmed bipolar forceps). You can use the registration and listing database to find a suitable predicate in this situation. First, you type “Conmed” into the database search tool for the name of the company, and then you type “bipolar forceps” in the data search tool for the name of the device.

If you are unaware of any competitor products, you will need to search using the product classification database instead. Unfortunately, this approach will result in no results if you use the terms “bipolar” or “forceps.” Therefore, you will need to be more creative and use the word “electrosurgical,” which describes a larger product classification that includes both monopolar and bipolar surgical devices that have many sizes and shapes–including bipolar forceps. The correct product classification is seventh out of 31 search results.

The most significant disadvantage of the FDA databases is that you can only search each database separately. The search is also a boolean-type search rather than using natural language algorithms that we all take for granted. The second strategy is to use a licensed database (e.g., Basil Systems).

Searching these databases is more efficient, and the software will provide additional information that the FDA website does not offer, such as a predicate tree, review time, and models listed under each 510k number are provided below:

What does the predicate tree look like for the predicate device you selected?

I’m glad I don’t need to manually enter the 510k review time for 2,263 devices to create the above graph.

Wouldn’t having the model numbers for every device identified in the US FDA listing database be nice?

Another advantage of the Basil Systems software is that the database is lightning-fast, while the FDA is a free government database (i.e., not quite as fast).

How do you create a regulatory pathway strategy for medical devices?

The best strategy for obtaining 510k clearance is to select a predicate device with the same indications for use that you want and was recently cleared by the FDA. Therefore, you will need to review FDA Form 3881 for each of the potential predicate devices you find for your device. In the case of the bipolar forceps, there are 169 devices to choose from, but FDA Form 3881 is not available for 100% of those devices because the FDA database only displays FDA Form 3881 and the 510(k) Summary for devices cleared since 1996. Therefore, you should select a device cleared by the FDA in the past ten years unless there are no equivalent devices with a recent clearance.

In addition to identifying the correct product classification code for your device and selecting a predicate device, you will also need to develop a testing plan for the verification and validation of your device. For electrosurgical devices, there is an FDA special controls guidance that defines the testing requirements and the content required for a 510k submission. Once you develop a testing plan, you should confirm that the FDA agrees with your regulatory strategy and testing plan in a pre-submission meeting.

Which type of 510k submission is required for your device?

There are three types of 510k submissions:

Special 510k – 30-day review target timeline
Abbreviated 510k – 90-day review target timeline (requires summary reports and use of recognized consensus standards)
Traditional 510k – 90-day review target timeline

The special 510k pathway is intended for minor device modifications from the predicate device. However, this pathway is only eligible to your company if your company also submitted the predicate device. Originally it was only permitted to submit a Special 510k for modifications that require the review of one functional area. However, the FDA recently completed a pilot study evaluating if more than one functional area could be reviewed. The FDA determined that up to three functional areas could be reviewed. However, the FDA decides whether they can complete the review within 30 days or if you need to convert your Special 510k submission to a Traditional submission. Therefore, you should also discuss the submission type with the FDA in a pre-submission meeting if you are unsure whether the device modifications will allow the FDA to complete the review in 30 days.

In 2019 the FDA updated the guidance document for Abbreviated 510k submissions. However, this pathway requires that the manufacturer use recognized consensus standards for the testing, and the manufacturer must provide a summary document for each test report. The theory is that abbreviated reports require less time for the FDA to review than full test reports. However, if you do not provide sufficient information in the summary document, the FDA will place your submission on hold and request additional information. This happens for nearly 100% of abbreviated 510k submissions. Therefore, there is no clear benefit for manufacturers to take the time to write a summary for each report in the 510k submission. This also explains why less than 2% of submissions were abbreviated type in 2022.

The traditional type of 510k is the most common type of 510k submission used by manufacturers, and this is the type we recommend for all new device manufacturers.

Regulatory pathway analysis–a case study Read More »

Mar 15 2022

Medical Device Shortage Reporting

1 Comment / FDA, Health Canada / By Matthew Walker / FDA, Medical Device

The FDA and Health Canada both have executive-level orders requiring medical device shortage reporting or supply-chain disruptions.

In a previous article, we discussed supply-chain disruptions and mentioned that there might be medical device shortage reporting requirements if that disruption causes a market shortage of the manufactured device. Both the United States and Canada have reporting requirements for supply disruptions or the market’s ability to meet the demand of specific types of devices.

Both the U.S. FDA and Health Canada have executive-level orders that require reporting of shortages or disruptions to the supply of medical devices deemed necessary for the COVID-19 Health Emergency. There is some overlap, but each country is monitoring and experiencing shortages and disruptions of different devices.

Where did medical device shortage reporting responsibilities come from?

Check 21 CFR 820, ISO 13485:2016, and even peek at SOR 98-282 and see if you can find your obligations for reporting. Go ahead. I’ll wait… Not much in there, right? Adverse events, complaints, etc., but not market shortages.
Medical device shortage reporting is specific to health emergencies. The U.S. FDA and Health Canada happen to be two authorities having jurisdiction with reporting requirements for shortages concerning the COVID-19 Health Emergency. However, there may be others, so having your organization’s regulatory affairs manager verify the reporting requirements for the markets in which you are engaged might not be bad.

U.S. FDA 506J reporting-

U.S. FDA logo

In the United States, an Amendment to the U.S. Food, Drug, and Cosmetics Act requires regulatory reporting by medical device manufacturers to the U.S. FDA. It is sometimes called 506J reporting for the Section of the U.S. FD&C Act where it is located.

You will find the statutory requirements outlined within 21 USC 356J.

21 USC 356j screenshot from uscode.house .gov cropped title Medical Device Shortage Reporting — 21 USC 356J *Discontinuance or interruption in the production of medical devices*

For the full text read, 21 USC 356j: Discontinuance or interruption in the production of medical devices. (Interestingly enough, the website where this information is available is not an HTTPS site, so visit at your own discretion).

http://uscode.house.gov/browse.xhtml

What devices are subject to 506J reporting?

There are two types of devices that the FDA is monitoring. “Critical” devices and an FDA-published list of devices for which COVID-19 is causing a higher than expected demand.

The FDA has released a guidance document that contains criteria for what is considered to be a “Critical Device”. This includes devices such as those used during surgery, emergency medical care, and those intended to treat, diagnose, prevent, or mitigate COVID-19.

fda guidance criteria for 506j critical devices Medical Device Shortage Reporting — Screenshot of the Critical Device Criteria for 506J reporting

There is also a published list of concerned devices that the FDA is specifically monitoring. The FDA website lists these devices by product code, but include the following device types;

Clinical Chemistry Products
Dialysis-Related Products
General ICU/Hospital Products
Hematology Products
Infusion Pumps and Related Accessories
Microbiology Products
Needles and Syringes
Personal Protective Equipment (PPE)
Sterilization Products
Testing Supplies and Equipment
Ventilation-Related Products
Vital Sign Monitoring

fda 506j shortage list screenshot Medical Device Shortage Reporting — Screenshot of the FDA Shortage List

Understandably this process may not be intuitive, and for this, the FDA has released a guidance document that addresses;

Who must make the notification
When you should make a notification
What information needs to be included within your 506J notification
How to make a notification, and
Penalties for failure to make a notification

The referenced product codes may not be an all-inclusive list or entirely up to date. The best suggestion for full compliance is to go straight to the source of the regulation, in part because noncompliance can result in enforcement action from the FDA. If you think that your device might require notification to the FDA but isn’t in the reference table, you should contact the FDA for notification clarification. Below is the quote from the FDA website, and it includes the contact email for asking these specific questions to ‘the agency.’

“If a device type is not included in this table, but you believe it requires a notification under section 506J of the FD&C Act, or if you have questions regarding the device types in this table, you should contact FDA at CDRHManufacturerShortage@fda.hhs.gov and include “Question” in the subject line of the email.”

Link to the FDA Guidance Document for 506J Reporting- HERE

How to make a 506J report to the U.S. FDA?

The FDA accepts 506J reports in multiple ways. For example, you may use the 506J Reporting web form or submit a notification by email directly to (Include Email Here). In addition, Medical Device Academy has developed a Work Instruction and Form to determine if your company is experiencing a reportable discontinuance or meaningful disruption in manufacturing a medical device as well as compiling the report for submission.

There are a few methods of notification, a web form for individual notifications and spreadsheet options for multiple notifications at once, or emailing a report directly to the FDA reporting email included below;

CDRHManufacturerShortage@fda.hhs.gov

fda 506j webform screenshot Medical Device Shortage Reporting — Screenshot of the FDA 506J reporting Webforms from https://fdaprod.force.com/shortages

It is for this process that Medical Device Academy developed WI-010 506J Shortage Reporting to the U.S. FDA. This work instruction and associated form, FRM-053 506J Reporting Form are designed to walk you through the process of determining reportability and compiling the information necessary to either complete the webform or email the report directly to the shortage reporting email.

Medical Device Shortage Reporting to Health Canada

Health Canada logo

Rather than discontinuance and disruption of manufacture, Health Canada is monitoring for shortages of specific devices. Therefore, Health Canada wants Medical Device Shortage Reports regardless of the reason for the shortage. It also shows that this is not identical reporting of the same conditions to two different authorities. Health Canada will also accept reports from Importers because the frame of reference is Canada’s supply of medical devices concerning Canada’s needs.

As an Authority Having Jurisdiction, Health Canada also has reporting requirements for medical device shortage reporting of specific types of medical devices. Health Canada is also an independent authority that uses a different device classification system than the U.S. FDA.

The table below shows the device types by their classification level that HC requires supply chain disruption notifications for. This information is current as of September 5^th, 2021, and the link below will take you to the HC website page for the most up-to-date list.

https://www.canada.ca/en/health-canada/services/drugs-health-products/medical-devices/shortages/covid19-mandatory-reporting.html

Class I Medical Devices

Masks (surgical, procedure or medical masks) – Level 1, 2, 3 (ATSM)

N95 respirators for medical use

KN95 respirators for medical use

Face shields

Gowns (isolation or surgical gowns) – Level 2, 3 and 4

Gowns (chemotherapy gowns)

Class II Medical Devices

Ventilators (including bi-level positive airway pressure or BiPAP machines, and continuous positive airway pressure or CPAP machines)

Infrared thermometers

Digital thermometers

Oxygen Concentrators

Pulse Oximeters (single measurement)

Aspirators/suction pumps (portable and stationary)

Laryngoscopes

Endotracheal tubes

Manual resuscitation bags (individually or part of a kit)

Medical Gloves – Examination and Surgical (Nitrile, Vinyl)

Oxygen Delivery Devices

Class III Medical Devices

Ventilators (including bi-level positive airway pressure or BiPAP machines)

Pulse Oximeters (continuous monitoring)

Vital Signs Monitors

Dialyzers

Infusion Pumps

Anesthesia Delivery Devices

Class IV Medical Devices

Extracorporeal Membrane Oxygenation (ECMO) Devices

List of ‘Specified Devices’ that Health Canada is monitoring for shortage reporting

One of the things that Health Canada does an excellent job of is defining its expectations. In the Second Interim Order Respecting Drugs, Medical Devices and Foods for a Special Dietary Purpose in Relation to COVID-19, it is explained the Manufacturers or Importers should report to the Minister actual or expected shortages of the device, OR components, accessories, or parts. These notifications must be made within 5-days of becoming aware of the shortage or the anticipated shortage date. Update reports must be made within 2-days of becoming aware of new information regarding the shortage, and a closing report must be made within 2-days of the end of the shortage.

(This link is to the HC website for the 2^nd Interim Order referenced above)

https://www.canada.ca/en/health-canada/services/drugs-health-products/covid19-industry/drug-medical-device-food-shortages/interim-order-2021.html

How to make a shortage report to Health Canada?

These reports are submitted online through the Health Canada Website. They have an entire section dedicated to medical device shortages, and the reporting links can be found there (Link here). If you have any questions or are on the fence about notification, you can email Health Canada at MD.shortages-penurie.de.IM@canada.ca.

Inkedhc reporting shortages overview screenshot edited LI 1024x384 Medical Device Shortage Reporting — Health Canada Webforms for reporting a shortage and the end of a shortage

The webform for reporting a shortage is the same webform that is used for providing update reports to Health Canada as well. This is both for manufacturers of specified medical devices as well as importers.

Medical Device Shortage Reporting Read More »

Oct 20 2021

eSTAR draft guidance is here, and wicked eSubmitter is dead.

5 Comments / 510(k), eSTAR / By Robert Packard / 510(k), eSTAR, FDA

I hated the the FDA eSubmitter template which was discontinued May 30, 2021. Finally we have eSTAR draft guidance for the new eSTAR template.

History of 510k electronic submissions

The FDA has experimented with a multitude of pilot 510k submission programs over the years to streamline and improve the 510k submission content, formatting, and to facilitate a faster review process. The Turbo 510k program was one of the first successful pilot programs. In 2012 I wrote one of my first blogs about how to improve the 510k process. In September 2018, the FDA launched the “Quality in 510k Review Program Pilot” for certain devices using the eSubmitter electronic submission template. The goal of the this pilot program was to enable electronic submissions instead of requiring manufacturers to deliver USB flash drives to the FDA Document Control Center (DCC). I hated the eSubmitter template, and the FDA finally discontinued availability of the eSubmitter template on May 30, 2021. During the past 15 years, the FDA gradually streamlined the eCopy process too. Originally we had to submit one complete hardcopy, averaging 1,200 pages per submission, and one CD containing an electronic “eCopy.” Today, the current process involves a single USB flash drive and a 2-page printed cover letter, but today’s eCopy must still be shipped by mail or courier to the DCC.

eSTAR Pilot Program is Launched

During the 15-year evolution of the FDA eCopy, CDRH was trying to develop a reliable process for electronic submissions of a 510k. CBER, the biologics division of the FDA, has already eliminated the submission of eCopy submissions and now 100% of biologics submissions must be submitted through an electronic submissions gateway (ESG). In February 2020, CDRH launched a new and improved 510k template through the electronic Submission Template And Resource (eSTAR) Pilot Program. The eSTAR templates include benefits of the deceased eSubmitter template, but CDRH has incorporated additional benefits:

the templates use Adobe Acrobat Pro instead of a proprietary application requiring training;
support for images and messages with hyperlinks;
support for creation of Supplements and Amendments;
availability for use on mobile devices as a dynamic PDF;
ability to add comments to the PDF; and
the content and logic mirrors checklists used by CDRH reviewers.

Medical Device Academy’s experience with the eSTAR Templates

Every time the FDA has released a new template for electronic submissions we have obtained a copy and tried populating the template with content from one of our 510k submissions. Unfortunately, all of the templates have been slower to populate that the Word document templates that our company uses every day. On May 16 we conducted an internal training for our team on the eSTAR submission templates, and we published that training as a YouTube Video (see embedded video below). Then nine days later the FDA released updates to the eSTAR templates (version 0.7). The new eSTAR templates are available for non-IVD and IVD products (ver 0.7 updated May 27, 2021).

Sharon Morrow submitted our first eSTAR template to the FDA in August and we experienced no delays with the 510k submission during the initial uploading to the CDHR database, there was no RTA screening process, and CDRH did not identify any issues during their technical screening process. Shoron’s first eSTAR submission is now in interactive review, which is a better outcome than 95%+ of our 510k submissions. I have several other eSTAR submissions that are almost ready to submit as well. The other 510k consultants on our team are also working on their first eSTAR submissions.

Finally the CDRH releases an FDA eSTAR draft guidance

On September 29, 2021 the FDA released the new eSTAR draft Guidance for 510k submissions. This is a huge milestone because there have not been any draft guidance documents created for pilot programs. The draft indicates that the comment period will last 60 days (i.e. until November 28, 2021). However, the draft also states that the guidance will not be finalized until a date for requiring electronic submissions (i.e. submission via an ESG) is identified. The draft indicates that this will be no later than September 30, 2022. Once the guidance is finalized, there will be a transition period of at least one year where companies may submit via an ESG or by physical delivery to the FDA DCC.

Are there any new format or content requirements in the FDA eSTAR draft guidance?

There are no new format or content requirements in the eSTAR draft guidance, but the eSTAR template itself has several text boxes that must be filled in with summary information that is not specified in the guidance for format and content of a 510k. The information requested for the text boxes is a brief summary of non-confidential information contained in the attachments of the submission. Therefore, these boxes can information that would normally be in the overview summary documentst that are typically included at the beginning of each section of a 510k. If your overview documents do not already have this information, then you may have some additional work to do in order to complete the eSTAR templates. An example of one of these text boxes is provided below:

Another example of additional content required by the eSTAR templates is references to page numbers. Normally the FDA reviewer has to search the submission for information that is required in their regulatory review checklist. In the new templates the submitter is now asked to enter the page numbers of each attachment where specific information can be found. The following is an example of this type of request for a symbols glossary:

Are there any changes to the review timelines for a 510k in the eSTAR draft guidance?

The eSTAR draft guidance indicates that a technical screening will be completed in 15 calendar days instead of conducting a RTA screening. I believe that the technical screening is less challenging than the RTA screening, but the FDA has not released a draft of the technical screening criteria or a draft checklist. I would imagine that the intent was to streamline the process and reduce the workload of reviewers performing a technical screening, but we only have guesses regarding the substance of the technical review and so far our performance is 100% passing (i.e. 1 of 1). The next step in the 510k review process is a substantive review. Timelines for the substantive review are not even mentioned in the new draft guidance, but the FDA usually has the review clock details in Table 1 (MDUFA III performance goals) and Table 2 (MDUFA IV performance goals) of the FDA guidance specific to “Effect on FDA Review Clock and Goals.” In both tables, the goal is 60 calendar days, and our first eSTAR submission completed the substantive review in 60 days successfully. The 180-day deadline for responding to an additional information (AI) request has not changed in the eSTAR draft guidance, but our first submission is now interactive review. I believe this suggests that companies may have a higher likelihood of having an interactive review with their CDRH lead reviewer instead of being placed upon AI Hold, but we won’t have enough submissions reviewed by the FDA to be sure until the end of Q1 2022.

Register for our new webinar on the FDA eSTAR draft guidance

We hosted a live webinar on Thursday, October 21, 2021 @ Noon EDT. The webinar was approximatley 37 minutes in duration. In this webinar we shared the lessons learned from our initial work with the eSTAR template. Anyone that registers for our webinar will also receive a copy of our table of contents template that we updated for use with the eSTAR templates. Unlike a 510k eCopy, an eSTAR template does not require a table of contents but we still use a table of contents to communicate the status of the 510(k) project with our clients. Finally, we reviewed the eSTAR draft guidance in detail. If you would like to receive our new eSTAR table of content template and an invitation to our live webinar, please complete the registration form below.

About the Author

Robert Packard is a regulatory consultant with 25+ years of experience in the medical device, pharmaceutical, and biotechnology industries. He is a graduate of UConn in Chemical Engineering. Robert was a senior manager at several medical device companies—including the President/CEO of a laparoscopic imaging company. His Quality Management System expertise covers all aspects of developing, training, implementing, and maintaining ISO 13485 and ISO 14971 certification. From 2009-2012, he was a lead auditor and instructor for one of the largest Notified Bodies. Robert’s specialty is regulatory submissions for high-risk medical devices, such as implants and drug/device combination products for CE marking applications, Canadian medical device applications, and 510(k) submissions. The most favorite part of his job is training others. He can be reached via phone 802.258.1881 or email. You can also follow him on Google+, LinkedIn or Twitter.

eSTAR draft guidance is here, and wicked eSubmitter is dead. Read More »

Oct 3 2014

Software Design Validation – FDA Requirements

3 Comments / FDA / By Robert Packard / Design Validation, FDA, FDA QSIT inspection, FDA QSIT medical device inspection, medical device design validation, QSIT

What are the FDA software design validation requirements for software as a medical device (SaMD) and software in a medical device (SiMD).

If your product has software, then the investigator is instructed by the FDA QSIT Inspection Manual to consider reviewing software validation. Since inadequate software validation causes many quality problems with devices, you should be shocked if an investigator doesn’t review the software validation of a device containing software. Software-containing devices are also the only devices that manufacturers are required to submit a risk analysis for when submitting premarket notifications (i.e., 510k submissions).

Software Design Validation

Validation confirms that a device meets the user needs. Software validation is no different. Unfortunately, “software design validation” is also the term that we use to mean software design and development–which includes software verification activities and software validation activities. The software verification activities consist of unit testing, integration testing, and system testing. In software verification, we are verifying that each requirement of the software design specification (SDS) meets the requirements of the software requirements specification (SRS). In contrast, software validation involves simulated use or actual use testing of the software to confirm that it meets the user needs of the software. The “device” is the final complete software program in the operating environment in which it is intended to be used (i.e., operating system and hardware), and the “user needs” may be defined as system-level requirements in the SRS or as the intended purpose of the software in the software description.

To facilitate the validation of software, a traceability matrix is typically used to facilitate the construction of validation protocols. The traceability matrix will identify each requirement in the left-hand column of the matrix. The columns to the right of the requirements should include the following:

hazard identification
the potential severity of harm
P1 – the probability of occurrence
P2 – the probability of occurrence resulting in harm
risk controls
design outputs or references to the code modules that are responsible for each requirement
references to verification and validation testing for each risk control
estimation of residual risks
risk/benefit analysis of each risk and overall risk
traceability to information disclosed to users and patients or residual risks

Since the failure of each module can easily result in multiple failure modes, the above approach to documenting design requirements and risk analysis is generally more effective than using an FMEA. This approach also has the benefit of lending itself to assessing risk each time new complaints, service reports, and other post-market surveillance information is gathered.

The use of a traceability matrix also lends itself to the early stages of debugging software modules and unit validation. Each software design requirement will typically have a section of code (i.e., a software module) that is associated with it. That module will be validated initially as a standalone unit operation to verify that it performs the intended function. In addition to verifying the correct function, the software validation protocol should also verify that the embedded risk controls catch incorrect inputs to the module for that module. The correct error code should be generated, and applicable alarms should be triggered.

Finally, after each requirement has been verified, the entire software program must be validated as well. When changes are made, the module and program as a whole must be re-validated. Inspectors and auditors will specifically review changes made in recent versions to verify that revalidation of the entire program was performed–not just unit testing. You must also comply with IEC 62304, medical device software – software lifecycle processes. This is required for CE Marking as a harmonized standard and recognized by the US FDA. One of the implications of applying IEC 62304 is that you must consider the risk of using software of unknown pedigree or provenance (SOUP).

Software Risk Analysis

Each requirement of the software design validation requirements document will typically have a risk associated with it if the software fails to perform that requirement. These risks are quantified concerning the severity of harm and the probability of occurrence of harm. The likelihood of occurrence of harm has two factors: P1 and P2, as defined in Annex E of ISO 14971:2007 (see our updated risk management training).

P1 is the probability of occurrence, and for software, we have two factors. First, the situation must occur that will trigger a failure of the software. Second, does the software have a design risk control that prevents harm or provides a warning of the potential for harm? P2 is the probability that occurrence will result in harm; P2 has one factor. P2 is determined by evaluating the likelihood that failure will result in harm if the risk control is not 100% effective.

An investigator reviewing the risk assessment should verify that risk has been estimated for each software design requirement. There should be harm identified for each software design requirement, or the traceability matrix should indicate that no harm can result from failure to meet the software design requirement. Next, the risk assessment should indicate what the risk controls are for each requirement identified with the potential for harm. In accordance with ISO 14971, design risk controls should be implemented first to eliminate the possibility of harm. Wherever it is impossible to eliminate the possibility of harm, a protective measure (i.e., an alarm) should be used.

Each risk control must be verified for effectiveness as part of the software validation. Also, the residual risk for each potential harm is subject to a risk/benefit analysis in accordance with EN ISO 14971:2012, Annex ZA Deviation #4. The international version, ISO 14971:2007 (which is recognized by the US FDA and Health Canada), allows companies to limit a risk/benefit analysis to only unacceptable risks. Therefore, the European requirement (i.e., EN ISO 14971:2012) is more stringent. Companies that intend to CE Mark medical devices should comply with the EN version of the risk management standard instead of the international version for risk management.

Software Design Validation – FDA Requirements Read More »

Jun 4 2014

7 Steps to writing an FDA 483 response

4 Comments / FDA / By Robert Packard / FDA, FDA 483, FDA 483 inspection observation, FDA form 483, FDA inspection, Food and Drug Administration

Responding in 15 business days is one of 7 steps on how to write an FDA 483 response, but do you know what should be in your response?When an FDA investigator has an inspection observation, the investigator issues an FDA 483. “Form 483” is the FDA form number. If your company receives an FDA 483, it is critical to understand how to write your FDA 483 response in order to avoid a Warning Letter. In the words of a former FDA investigator, “Many, many times I have seen an [Official Action Indicated (OAI)] classified inspection that had been recommended for a Warning Letter by the compliance branch be set aside based upon the response of the firm.”

The best way for your company to write a FDA 483 response is to provide a brief cover letter and to use your CAPA process. Every 483 inspection observation needs to be addressed in the FDA 483 response as a separate CAPA. Make sure that your response includes the following seven steps below:

respond within 15 business days (earlier is better)
use your CAPA form and a cover letter–instead of a memo
document the investigation that was conducted with a concisely stated root cause
identify containment measures and corrections to address each specific observation by the FDA inspector
identify corrective actions planned and the date(s) you expect to complete implementation
Include documentation of containment, corrections and corrective actions that are completed at the time you submit the response
follow-up with a memo confirming that all the corrective actions are complete and include all related documentation–including training for any new procedures or any new corrective actions that warranted training

Your FDA 483 response is required in less than 15 business days

The FDA has always involuntarily required a medical device firm, or any firm under FDA jurisdiction that received an FDA 483, to provide a written FDA 483 response to the District Office within 15 business days. As of two years ago (http://www.gpo.gov/fdsys/pkg/FR-2009-08-11/pdf/E9-19107.pdf), it became mandatory that the Agency must receive a FDA 483 response within 15 business days, or an automatic Warning Letter is issued. You need to respond aggressively to FDA 483s with corrective actions, and submit your response early. The FDA has also modified the format of the response to require email responses.

Use your CAPA forms instead of a memo.

I have asked several former FDA investigators whether they would prefer to see firms submit responses in memo format, or by using their CAPA forms and a cover letter. Some told me that they prefer to see firms use their CAPA forms, while others don’t seem to have a preference. Nobody from the FDA has ever indicated a preference for a memo. I see no point in doubling your work and risking transcription errors. If you have an electronic system that does not have an easy-to-follow output format, go ahead and copy-and-paste the information from your electronic database to your memo. If the CAPA system output is easy to follow, just use a cover letter and copies of the forms.

Document the investigation and root cause

This is definitely my pet-peeve, but a one-sentence “root cause” is not enough for an FDA 483 response. Regardless of whether I am doing a mock-FDA inspection, an internal audit, or a supplier audit–I expect you to document how you determined the root cause (http://robertpackard.wpengine.com/five-tools-for-conducting-root-cause-analysis/). If it’s trivial and obvious, then it must have been something important, or I would not have written a nonconformity. Therefore, you should be looking beyond the immediate scope of the FDA 483 to ensure that a similar problem cannot occur elsewhere. In the language of the FDA, this is a preventive action, because you are preventing occurrence with another process or product. Most ISO certification auditors are purists, and they won’t accept this as a preventive action. You will have to show the purists something special–maybe from your data analysis.

Don’t forget containment and correction

For every 483 observation, including the subparts, you need to identify if immediate containment is necessary and how you can correct the problem. Whenever possible, you should attempt to implement the containment and corrections during your FDA inspection. It would be fantastic to give the FDA inspector a copy of the new CAPA you initiated during the audit. The new CAPA would identify containment and corrections that have been or will be implemented–including any nonconformity(s) you initiated to quarantine product. You may still get an FDA 483 inspection observation, but you are likely to convert a possible Official Action Indicated (OAI) into a Voluntary Action Indicated (VAI). You can also modify the CAPA wording later in your FDA 483 response to include a cross-reference to the FDA 483 and quote the exact wording the inspector uses.

Explain the corrective action plans and timelines

Clarity, brevity, and realistic plans are critical in this section of your response. I prefer a table that looks like the example shown below.

Show the FDA you have already taken action in your FDA 483 response

Whenever possible, you want to show the FDA that you are taking action without delay. If you revised the SOP for MDRs and scheduled a group training for July 15, then you should provide the FDA a copy of the revised procedure and a copy of the agenda for your planned training session. The only caution is to only commit to actions you are certain you will implement. You can always do more, but it will be much harder to explain why you did not implement an action you submitted in your FDA 483 response.

Follow-up with a second FDA 483 response before the FDA asks for it

The FDA’s compliance office will be looking for a response when an FDA 483 is issued, and they will review your response. The investigator will get a copy of the FDA 483 response, and the investigator will comment on the response. The compliance office and the investigator enter their comments into a CDRH database. Still, the comments are only general, as to whether the response is adequate or inadequate and will require additional review.

If you do not hear back from the FDA, do not assume that the compliance office or the investigator was satisfied. You should also follow-up several months later (earlier if possible) with a letter that includes evidence of the completed corrective actions, and your verification of effectiveness. If the verification is compelling and received in less than six months of the inspection, you may convince the compliance office to hold off a planned Warning Letter.

If you are interested in root cause analysis and improving your CAPA process, we have two related webinars:

7 Steps to writing an FDA 483 response Read More »

Sep 25 2013

8 success tips for the first 30 minutes of an FDA inspection

1 Comment / FDA / By Robert Packard / FDA, FDA inspection

The author presents an 8 item action plan and discussion for getting your FDA inspection off to a good start, beginning when the FDA enters your facility. When an FDA inspector arrives at the reception desk of your facility, the last thing that you want is a Keystone Kops scenario with people running around in a panic and keeping the inspector waiting. This is your first opportunity to make a professional impression, and you never want to give an inspector the impression that you have something to hide. What happens during the first 30 minutes of arrival is critical. While medical device inspections are often announced several days in advance, there is no obligation for the Agency to do so. Therefore, your team needs training and a plan. This training should involve more than just reading the Quality System Inspection Technique (QSIT) manual (http://bit.ly/QSITManual), and conducting a mock FDA inspection. Last year, Rob Packard wrote a blog about “10 FDA Inspection Strategies that Don’t Work” (http://bit.ly/QSITmistakes), but the following activities need to be executed in the first 30 minutes to ensure your next inspection starts smoothly.

The FDA Inspection: 8 Immediate Actions to Take

1. Receptionist-Personnel Contacts (Time Zero)

I once witnessed a receptionist sarcastically comment to an inspector that people must be thrilled when they walk in the door. That was not a great start to the inspection. Ensure that your receptionist and additional personnel who may sit at the desk are trained, understand what to do, and know-how to behave when an FDA inspector(s) arrives. This exercise should not cause panic. You need a simple work instruction located at the reception desk and a list of key staff members to contact immediately. The head of the Quality department, or Management Representative, is usually the first call.

2. Have Chain of Command in Place (Time = 1 minute)

DO NOT keep the inspector waiting in the lobby. Have a communication chain in place to ensure that other appropriate personnel is available in the event that the first point of contact cannot be reached. It is reasonable to ask the inspector to return at a later date ONLY if all individuals with the technical expertise to participate in the inspection are not on-site, or are out of the country. The agent will decide whether to honor this request, but the expectation is that there is always someone with whom they can work with. Never make this request to put off the inevitable.

3. Ask To See Inspector Credentials (Time = 2 minutes)

Ask to see the inspector’s credentials, and ensure that you give them more than a cursory glance. This is important to avoid allowing an imposter posing as an Agency employee from gaining access to your business. While a rare occurrence, it has been known to happen. Some investigators are officers of the Public Health Service and may be in uniform. However, even these officers are not required to wear a uniform for all visits. Note: Section 5.1.1.2 of the FDA Investigations Operations Manual (http://bit.ly/FDAIOM) instructs inspectors to provide their credentials to top management, but copying of official credentials is not allowed.

4. Escort Inspector to Inspection Room (Time = 5 minutes)

Make sure that you can have the inspector escorted to a suitable room with the respective hosts within five minutes of arrival. This will involve ensuring that it is clearly understood by all administrative staff and key management that any other meeting may need to be curtailed, or moved immediately to another location to provide an appropriate space for the inspection. Providing substandard accommodations, such as a very cold or warm room, is not a good strategy for shortening the inspection time, and is a ploy easily recognized by the Agency, though not appreciated. Note: Rob Packard taught an audio seminar earlier this year, where the use of inspection war rooms was covered in more detail—including a diagram with a proposed layout for the room (http://bit.ly/FDAInspectionSeminar).

5. Ready the FDA Inspection War Room (Time = 10 minutes)

Immediately after your inspection room is identified, you need to prepare your backroom or “war room.” This room should be located near the inspection room and set up at a moment’s notice with staff who can expertly execute their respective roles. You will need a mode of communication between the inspection and war rooms, runners to retrieve documents and records in the shortest time possible, as well as a technical individual to review these documents to ensure that they are appropriate and accurate before being provided to the inspector. This room should be ready within ten minutes of arrival.

6. Ensure You Have Emergency Supplies & Copies (Time = 15 minutes)

Your war room will need supplies. You should have a mobile cart equipped with inspection supplies ready and waiting at all times. Suggestions for the contents of your war room cart include a laptop, projector, staplers, staples, pens, blank folders, a label maker, and a stamp for “uncontrolled copies.” Your supplies need to make it to the war room within 15 minutes of arrival.

7. Ready the Frequently Requested Documents (Time = 25 minutes)

Don’t wait for the inspector to tell you which documents are invariably requested at the outset of any inspection. This includes, but is not limited to, the organizational chart, an index of all procedures, CAPA log, and your nonconformance logs for medical devices—all dating back to the last inspection. This doesn’t mean that you should offer these documents to the inspector. You want to prepare these before they are requested so that they can be provided quickly, but you should keep the copies in the war room until the inspector requests each document and record. Copies of these records and documents should be stamped and ready within 25 minutes of arrival.

8. Relax (Time = 30 minutes)

It sounds as though this process is a race against time. It is not. No one engaging with the inspector should be running in and out of the room, gasping for breath, or sweating profusely from the effort. Keeping the inspector waiting can be perceived as a stall tactic, perhaps arousing suspicion that you are creating records “on the fly” in the war room (definitely not a strategy that I recommend), or that you are having difficulty locating the requested documents, and are not in control of your Quality Management System (QMS). The most important aspect is to manage your QMS so that you are always ready for an inspection at a moment’s notice. If you prepare in advance, you shouldn’t need to do anything more than ask if the inspector would like coffee before the inspection begins.

Please Connect With Medical Device Academy on Social Media

8 success tips for the first 30 minutes of an FDA inspection Read More »

Sep 11 2012

How to request FDA Device Classification information – 513(g) Alternative

1 Comment / FDA / By Robert Packard / Device Classification, FDA

This blog provides a five-step process on how to request FDA device classification information. A screenshot of the FDA website for each step is included.

If your company is currently registering with the US FDA, you are probably reviewing the guidance document this month for the FY2013 user fees. On pages six and seven, there is a table of these fees, but you might have overlooked 513(g). Section 513(g) is a provision in the law that allows companies to request device classification information from the FDA.

For example, if your company was developing a new product, and you were having difficulty identifying the regulatory pathway, 513(g) is your friend. In my opinion, these fees are modest: $5,061 = Standard Fee, and $2,530 = Small Business Fee (updated for FY 2022). Most consultants will charge at least ten hours of consulting to identify the regulatory pathway for a company. I would charge quite a bit less because it takes me a lot less than ten hours. I still think the FDA’s pricing is a good deal because getting information directly from the source is always more valuable than an “expert.”

The US FDA has published a guidance document explaining the process for 513(g) requests. This guidance document was released on April 6, 2012 (updated in 2019). The guidance explains what information companies need to provide in order to submit a 513(g) request. The guidance also has a fantastic list of FDA resources on page five. These are the very same resources that the “experts” use—including yours truly.

Just as any good lawyer tries to avoid asking questions that they don’t already know the answer to, I recommend that you first try using these resources yourself. Once you think you know the answer, your request for classification information will be easier to organize.

Here’s how I would proceed to request FDA device classification information:

Step 1 – Are there similar devices on the market?

Identify another device similar to yours. If you can’t do this, you need serious help. You need a similar device that is already sold on the market to use as a predicate device. If you cannot identify a predicate, then you can’t use the 510(k) process—or you don’t know your competition. Either way, there are challenges to overcome. For example, if you are trying to launch a new topical adhesive made from cyanoacrylate—”Dermabond” might be the first predicate device that comes to mind.

Step 2 – Search the Registration Database for FDA Device Classification

Use the registration and listing database on the FDA website to find the company that manufacturers the device. The link for this is #4 on my helpful links page (updated). This link also will provide you with connections to the classification database—which you can use to find the classification for any device. However, the registration and listing database is less likely to lead you astray. When I type “Dermabond” into the field for the proprietary device name, I get a list of five different product listings.

Step 3 – Select one of the competitor links to identify the FDA Device Classification

Clicking on any one of these five will take you to a listing page for the corresponding company. On that page, you will find the three-letter product code that identifies the device classification and the applicable regulations for that device.

Step 4 – Your found the FDA Device Classification

Clicking on the three-letter product code (i.e., – “MPN” in our Dermabond example) takes you to the Product Classification page. This is where you will find that Dermabond, and other tissue adhesives, are Class II devices that require a 510(k) submission. Also, the Product Classification page identifies an applicable guidance document to follow for design verification and validation testing. This is also called the “Special Controls Document.”

Step 5 – TheTPLC Report lists all the recent 510(k) submissions

Click on the “TPLC Product Code Report” link. This link will provide you with a report of all the 510(k) ‘s recently granted to your competitors, problems customers have experienced with their products, and recalls for the past five years. This is extremely valuable information as a design input—as well as competitive information for your marketing team.

tplc total product life cycle report for mpn How to request FDA Device Classification information 513(g) Alternative — TPLC Report for Product Code “MPN” – Topical Adhesive

How to request FDA Device Classification information – 513(g) Alternative Read More »

Jun 2 2012

FDA Approval Process: “Triage” for 510(k)

1 Comment / 510(k) / By Robert Packard / 510(k), FDA, Food & Drug Administration, Triage Pilot Program

The Triage program for 510(k) submissions is reviewed. The goal of this FDA approval process program is to reduce review time from 90 to 30 days.

Thursday, Congress voted 96 to 1 for a bill to increase FDA user fees. The rationale is that the FDA needs more funding to be strong enough to properly regulate foods, drugs, and medical devices. One of the commitments linked with this new funding is to shorten the review of 510(k) submissions. To this end, OIVD has created a new program called “Triage.” The goal of this program is to accelerate the review of specific traditional 510(k) submissions to 30 days instead of 90 days.

In theory, this pilot program will help some companies get their 510(k) clearance letter faster, but simultaneously, the FDA will be able to concentrate resources on high-risk 510(k) submissions. This entire strategy seems to be the opposite of triage. Triage involves sorting sick patients into three categories:

1) Those who are likely to live, regardless of what care they receive

2) Those who are likely to die, regardless of what care they receive

3) Those for whom immediate care might make a positive difference in their outcome

If we apply the triage analogy to 510(k) submissions, we see three categories:

1) 510(k) submissions that are likely to be approved, regardless of how much time the FDA spends

2) 510(k) submissions that are likely to be rejected, regardless of how much time the FDA spends

3) 510(k) submissions whose approval or rejection is not apparent, but the FDA’s earlier involvement in the design and development process would substantially improve review time.

The FDA’s “triage” program is intended to demonstrate improvement in the time required to approve medical devices by sorting submissions into two groups: group #1 above and group # 2/3 from above. This will make the numbers look good, but the FDA should be spending even less time on #2 than it spends on the #1 category of submissions. The FDA should also get involved in group #3 submissions much earlier.

FDA Approval Process

The types of submissions that need more FDA reviewer time are devices that are higher in risk and where special controls guidance documents and or ISO Standards have not already been established for performance and safety testing criteria (i.e., – Category #3 above). In these cases, when a company tries to obtain some feedback from the FDA, they are asked to request a pre-IDE meeting. The company will not be necessarily performing a clinical trial, but this is the only vehicle the FDA has for justifying the time it spends providing feedback on proposed verification and validation testing plans. The FDA needs to develop a new model that is ideally suited for 510(k) products where guidance and Standards do not exist. This would also have the effect of reducing the number of “Not Substantially Equivalent” (NSE) letters the FDA issues.

If a company is developing a device that already has an applicable special controls document or ISO Standard, then the 510(k) pathway should be well-defined without the FDA’s help. Unfortunately, there is no easy mechanism for ensuring compliance with these external standards. This type of submission would benefit from software-controlled submissions and or pre-screening of submissions by third-party reviewers. The Turbo 510(k) software tool could lend itself to software-controlled submissions, but a proliferation of the Turbo 510(k) has been limited.

Submitting a 510(k)

If a company does not submit a 510(k) with all the required elements of a guidance document, the submission should not be processed. Implementation of validated software tools for each 3-letter product code would prevent incomplete submissions. At the very least, companies should be required to provide a rationale for any sections of submission that are not applicable.

One example of a possible software solution is currently used by third-party auditors at BSI. BSI uses a software tool that will not allow the auditor to generate a final report unless all the required elements have been completed. The FDA could use the existing screening checklist and convert this into a similar “SmartForm.” If the submission does not have all the required elements of the checklist, the submission form could not be generated from the software. This forces the task of pre-screening reviews back upon the submitter with the aid of a validated software tool.

The most significant shortfall of the Triage program is the target product types. IVD devices are quite different from other device types. Each IVD has unique chemistry, and there are a limited number of Guidance documents for IVDs, and IVD submissions represent only 10-20% of all submissions. Orthopedic, cardiovascular, general/plastic surgery and radiology devices each represent more than 10% of the submissions, and collectively they represent half of the submissions. These types of devices also have both special controls documents and ISO Standards defining the design inputs for design verification. Therefore, these four device types would be a better choice for a pilot program to expedite reviews.

FDA Approval Process: “Triage” for 510(k) Read More »