Transitioning from ISO 9001:2008 to ISO 13485:2003—Going After Medical Device Business ASQ Las Vegas section 705 December 16, 2009 Presented by Michelle M. Johnston, RAC Advanced Quality System Solutions

The Medical Device Sector $100B industry More “recession-proof” than other sectors but hit in 2008/2009 Ageing US population (baby boomers) Growth in the following segments: Cardiac Orthopedic (record level of private equity) Neurotechnology (electronic devices interact with the nervous system) 15k medical device companies >400k jobs

What the Heck is EN ISO 13485:2003? Quality system standard intended for medical device industry Format based on ISO 9001, process approach Intended to promote harmonization in the global market Regulators don’t recognize ISO 9001

What the Heck is EN ISO 13485:2003? Emphasis on effectiveness of quality management system as opposed to improvement More controls than ISO 9001 Higher the risk of the device=more controls However, if you don’t manufacture the finished device, not all requirements are applicable

What the Heck is EN ISO 13485:2003? It is the medical device manufacturer’s responsibility to define and implement the requirements. As applicable, they will pass along the requirements to their suppliers, usually in the form of a purchase spec or Supplier Agreement

From A Manufacturer’s Perspective Assurance that their suppliers have adequate controls in place Selecting a supplier who is registered to ISO 13485 can mean reduced monitoring by the manufacturer From a regulatory perspective, much greater scrutiny on how manufacturer’s evaluate and monitor their suppliers. High visibility recalls where problems originated at the supplier.

What are the Differences? Let’s examine some of the important differences between ISO 9001 and ISO 13485

What are the Differences? The biggest difference is the intent of the standard. In the regulatory world, customer satisfaction and continuous improvement are superseded by the safety and effectiveness of medical devices.

1.2 Application Can only exclude section 7.3, Design and Development—however, other regulations may preclude this Other requirements in section 7 may be non-applicable based on the nature of the medical device (sterilization, implants) or activities performed by the organization Exclusions/non-applications to be justified

4.1 General Requirements The organization shall establish, document, implement and maintain a quality management system and maintain its effectiveness in accordance with the requirements of this International Standard.

4.2 Documentation Requirements The quality management system documentation shall include: Any other documentation requirements specified by national or regional regulations.

4.2 Documentation Requirements There is a requirement or a particular type of document, commonly referred to as a Device Master Record. The organization shall establish and maintain a file containing documents defining for each type / model of medical device product specifications and quality system requirements (process and quality assurance) for: complete manufacturing, and installation and servicing, if appropriate

4.2 Documentation Requirements The Quality Manual must outline the structure of the documentation used in the quality management system. Typically 4-tier structure: Quality manual SOPs Work instructions Forms/records

4.2.4 Records The importance of records in the medical device industry cannot be overstated. Universal rule: If it isn’t documented, it wasn’t done. Documentation, documentation, documentation Stringent rules regarding recording of information Blue or black ink only No crossouts, write overs Most organizations have a Good Documentation Practices procedure and intensive training.

4.2.4 Records Retention requirements based on the lifetime of the device Retention equivalent to lifetime of device or not less than 2 years from date of release for distribution Other regulations have more stringent requirements Most medical device manufacturers do not often destroy records Records specific to the medical device industry Device History Record (traveler, work order) Adverse event reports to regulatory agencies

5—Management Responsibility Management must maintain the effectiveness of the quality management system Independence and authority of those who perform tasks affecting quality Management rep promotes customer and regulatory requirements throughout the organization Management review must include new or revised regulatory requirements

6—Resource Management Determine and provide resources to implement the QMS and maintain its effectiveness And to meet customer and regulatory requirements May need a documented procedure to satisfy other regulatory requirements

6.3 Infrastructure Preventive Maintenance Documented requirements for maintenance Records maintained

6.4 Work Environment Can be very critical, dependent on the device Controls must be established if the environment could adversely impact the medical device (concern for devices intended to be sterilized) Cleanroom or environmentally controlled manufacturing Gowning Documented procedure for environmental controls and monitoring No food and drink

6.4 Work Environment Controls for used (returned) product to prevent contamination Personnel who work under special environmental conditions must be trained

6.4 Work Environment Can also include ESD controls Designated ESD work areas Wrist/ankle straps Daily testing or continuous monitoring Handling and storage of ESD sensitive devices Records

7.1 Planning of Product Realization Specific reference to ISO 14971—Medical Devices Risk Management Medical device manufacturers would expect suppliers to have a documented pFMEA in place.

7.3 Design and Development A documented procedure is required. More records are required Design inputs must include safety and performance requirements Design inputs must be approved Records of design outputs are required Independent person required at design review Clinical evaluation as part of design validation

7.4 Purchasing Documented procedure required FDA requirement: Where appropriate, purchasing documents will include an agreement that the supplier will notify the manufacturer of any changes to the product or service so that the manufacturer may assess the impact of the change on the finished device Unauthorized changes can have a significant impact and result in recalls by the manufacturer Evaluation of suppliers is typically risk-based

7.5 Production and Service Provision The availability of documented procedures, requirements, work instructions, and reference materials and reference measurement procedures as necessary The implementation of defined operations for labelling and packaging Record that shows manufacturing history including quantity. Record shall be reviewed and approved.

7.5 Production and Service Provision Cleanliness of product and contamination control A documented procedure is required Intended for devices sold sterile or Devices to be sterilized by the end user Installation and servicing procedures and controls Specific requirements for sterile and implantable devices

7.5 Production and Service Provision Procedure for the validation of computer software Records of these activities Procedure for ID and traceability—more stringent controls or implantable devices Procedure to distinguished returned product from conforming product Status of product—must be known at all times throughout the product realization process Procedure for the preservation of product conformity— handling, storage

7.5 Production and Service Provision Procedure for devices with a limited shelf life or special storage conditions Storage conditions will be controlled and recorded. Procedure required for calibration activities

8.2 Monitoring and Measurement Specific requirements for customer complaints as opposed to customer satisfaction Some types of complaints must be reported to regulatory agencies

8.2.4 Monitoring and Measurement of Product Documented procedure for inspection activities Specific requirements for active implantable and implantable devices

8.3 Control of Nonconforming Product UAI disposition only if regulatory requirements continue to be met Must record person who authorizes UAI Work instructions for rework activities Determine and document any adverse impact of rework on the device

8.5.1 General (Improvement) Customer complaints Documented procedures for product recalls Must record reason if a complaint is not followed by CAPA Procedure for notification of complaints to regulatory agencies

8.5.2 CAPA Record the results of any investigation Determine the effectiveness of the corrective action taken Same for preventive action

Industry Trade Shows MD&M shows—annually East coast West coast Midwest

Questions? Thanks for your time. Michelle Johnston Advanced Quality System Solutions www.adqvss.com mjohnston@advqss.com 858.722.4471