1. 1 Crossing the Threshold ( FDA Regulatory Requirements for Medical Device Manufacturers) DESIGN CONTROLS FDA

2. 2 Medical Device Design Controls Introduction to the FDA Definitions Classes of devices Design control overview Risk assessment Verification and Validation testing Software Quality Assurance Labeling Post design transfer issues

3. 3 Regulations CBER CDRHCDER Biologics 21 CFR 600/601/610 Blood 21CFR 606 21CFR 1270, 1271 (tissue) 21 CFR 58 (GLP) 21CFR 11 (electronic records) Devices 21 CFR 56 (IRB’s) 21 CFR 58 (GLP) 21CFR 11 (Electronic records) 21 CFRR 800-1050 (devices) 21 CFR 807 (510(k)) 21 CFR 812 (IDE) 21 CFR 814 (PMA) 21 CFR 21 CFR 820 QSR (GMP) Drugs 21 CFR 56 (IRB’s) 21 CFR 58 (GLP) 21CFR 11 (Electronic records) 21 CFR 210, 211 (Drug GMP’s) 21 CFR 312 (IND) 21 CFR 314 (NDA)

4. 4 What is a Medical Device? Type of Product: An instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar related article… Intended use: …for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment or prevention of disease... or intended to affect the structure or any function of the body… Mode of action: … and which does not achieve any of its primary intended purposes through chemical action within or on the body or by being metabolized. FD&C Act, §201(h)

5. 5 Research Design and Development Manufacture and Service Obsolescence FDA review  Good Clinical Practice  Clinical Trial Controls  Good Laboratory Practice  Investigational Devices Exemptions (IDE’s)  Design Controls  Good Lab Practices  Document Controls  Electronic Records  510(k) Clearance  PMA  Document Controls  Quality Systems Requirements  Establishment Registration  Labeling Controls  Design controls Record Retention  Recalls  Complaints  Medical Device Reporting FDA Oversight in a Medical Device Life Cycle

6. 6 12 CFR 820.30 Requirements All Class II and Class III devices, and some Class I devices require design controls. Written procedures required. Procedures are controlled via document control. Information about the design must be readily available to FDA – Design History Files. Design controls can continue through the manufacturing and service phase.

7. 7 Intended use Product Class Class I-Simple, Low risk. General controls needed (registration, labeling, GMP) Class II- More complex, Medium risk. Need 510(k) approval (some exemptions) Class III- Complex, High risk. Generally life support, life sustaining, preventing impairment to human health or unreasonable risk to human life. Premarket Approval (PMA) needed prior to market.

8. 8 Examples

9. 9 Quality System A Medical Device Quality System is designed to assure that products are Safe and Effective for their Intended Use and Consistently meet the specifications as defined by results of clinical and/or detailed technical design and validation

10. 10 Design Control Elements 21CFR 820.30 Design Planning Design Input (Requirements) Design Output (Specifications) Design Reviews (Technical) Design Verification (Meets Specifications) Design Validation (Meets clinical needs) Design Transfer (Moves from Design to Manufacturing) Design Changes (Formal Process) Design History File (DHF)

11. 11 Stage-Gate Method Defines phases of project. Uses design reviews and approvals as gates between phases.

12. 12 Design Controls General Stage-Gate Process

13. 13 Design Planning Feasibility Studies Risk Assessments Project Plan Defines Interfaces with Others Stage-Gate Methodology Constantly Changing

14. 14 Design Input-Feasibility Where Customers Technical Papers Medical experts Service people What Intended Use Technical Requirements Safety Issues How Documented Approved Filed Formal Change Control System

15. 15 Risk Assessment

16. 16 Risk Assessment Feasibility Clinical Risk Summary Design Input Preliminary Design Preliminary Risk Assessment: Specification Trace Matrix: (links between) Specification Risk Analysis Fault Table Test Plan Mitigations: Final Risk Assessment: Risk Management Document, Approvals

17. 17 ISO 14971 Risk Assessment Example Example of a Hypothetical Risk Assessment for a Electronic System to Monitor Patient Core Body Temperatures

18. 18 Definitions Harm: Physical injury or damage to the health of people, or damage to property or the environment Hazard: Potential sources of harm Risk: Combination of the probability of Occurrence of Harm and the Severity of the harm Risk Analysis: Systematic use of available information to identify hazards and estimate the risk Residual Risk: Risk remaining after protective measures and mitigations are taken Severity: A measure of the possible consequences of the risk As Low As Reasonably Practicable (ALARP): The residual risk is reduced to a level which is as low as can be reasonable implemented without sacrificing patient safety or clinical utility. The risk/benefit ratio is determined to be acceptable in light of technical feasibility and economic feasibility of implementing additional controls.

19. 19 Classification of Residual Risk SeverityOccurrenceDetectionRisk QuadrantsCurrent ControlsCorrective Actions 1 –10 Scale 1- 10 Scale 1-3 Scale1- Risk, None to Little None required 2- Risk, Minimal to Moderate Recommended 3- Risk, Significant RequiredRequired if no existing controls. (ALARP) 4- Risk, SeriousRedesign *

20. 20 SEVERITY TABLE RatingEffectDescription of RatingExample 1None No effect. Device operates as intended. Negligible 2Very Minor Some customers notice defect. Device operates as intended. No effect on patient or clinician 3Minor Device operates as intended. Slight effect on patient, clinician or user. 4Very Low Patient comfort or convenience is slightly Reduced but with no patient, clinician or user injury. 5Low Comfort or convenience is severely Reduced but with no patient, clinician or user injury. 6Moderate Product is inoperable with no patient or user injury. 7High Possible transient (reversible) minor injury to patient or user. Marginal Needle stick 8Very High Transient minor injury to patient or user (possibility of further surgical procedures). 9Hazardous - Possibly can contribute to death, severe injury, permanent significant disability or severe occupational illness in patient or user. Critical Exposure to blood borne pathogens 10Hazardous – Irrevers ible Can cause irreversible patient or clinician harm. (including for example organ failure, limb loss or death) Catastrophic

21. 21 Occurrence RatingProbability of Failure Description of RatingFailure Rate DFMEAPFMEA 1ImprobableFailure is unlikely.Failure unlikely. No failures ever associated with almost identical processes. 1 in 1,500,000 (~ 0.000067%) 2RemoteRelatively few failures.Isolated failures associated with almost identical processes. 1 in 150,000 (~ 0.00067%) 3Isolated failures associated with similar processes. 1 in 15,000 (~ 0.0067%) 4OccasionalOccasional failures.Generally associated with processes similar to previous processes that have experienced occasional failures. 1 in 2000 (~ 0.05%) 5 1 in 400 (~ 0.25%) 6ProbableRepeated failures.Generally associated with processes similar to previous processes that have often failed. 1 in 80 (~1.25%) 7 1 in 20 (~ 5%) 8FrequentFailure is almost inevitable. 1 in 8 (~ 12.5%) 9 1 in 3 (~ 33 %) 10  1 in 2 (  50%)

22. 22 Detection RatingProbability of Detecti on Description of Rating DFMEAPFMEA 1Almost Certain Design Control will almost certainly detect a potential Cause of Failure or subsequent Failure Mode. Current Controls almost certain to detect failure mode or Cause. Very HighVery high chance Design Control will detect Cause of Failure or subsequent Failure Mode. Very high likelihood that Current Controls will detect failure mode or Cause. HighHigh chance Design Control will detect Cause of Failure or subsequent Failure Mode. High likelihood that Current Controls will detect failure mode or Cause. 2ModerateModerate chance Design Control will detect Cause of Failure or subsequent Failure Mode. Moderate likelihood that Current Controls will detect failure mode or Cause. 3LowLow chance Design Control will detect Cause of Failure or subsequent Failure Mode. Low likelihood that Current Controls will detect failure mode or Cause. RemoteRemote chance Design Control will detect Cause of Failure or subsequent Failure Mode. Remote likelihood that Current Controls will detect failure mode or Cause. Absolute Uncertai nty Design Control will not detect a potential Cause of Failure or subsequent Failure Mode. No known Controls available to detect Failure Mode or Cause.

23. 23 Quadrant Map Occur rence 10 9 Quad 4 8 7 Quad 3 6 5 Quad 2 4 3 2 Q uad 1 1 12345678910 Severity

24. 24 Risk Assessment Table Clinical Risk Assessment Cause ID #Potential Clinical Risk Possible effects Potential causes Initial State Controlling Action's)/ Design Mitigations Post Mitigation State. Spec Ref S Of effect O Of cause or failure Score S Of effect O Of cause or failure D Of cause or failure Score (Quad) CRA 01Patient Core Temperature exceeds physiological limits Severe Hyperthermia (Seizure, Death, Brain Damage) Probe has a intermittent or “noisy” signal due to EMI in area 9654Audible and Visual Check Probe alarm EMC testing to UL/IEC 60601-1-2 Requirements 92118 Q3 CDS-015 CRA 02Patient Core Temperature exceeds physiological limits Severe Hyperthermia (Seizure, Death, Brain Damage) Probe is loose or disconnected 9654Audible and Visual Check Probe alarm 92118 Q3 CDS-019 CRA 03Patient Core Temperature exceeds physiological limits Severe Hyperthermia (Seizure, Death, Brain Damage) Probe not in calibration window Wrong Temp Probe used 9763Factory calibration window set for 400 Series thermistor Software Check for probe range Audible and Visual Check Probe alarm 92118 Q3 CDS-002 CRA 04Patient Core Temperature exceeds physiological limits Severe Hyperthermia (Seizure, Death, Brain Damage) Infection, Drug reaction, disease state 9436Audible and Visual High Temp Alarm 92118 Q3 CDS-012 CRA 05Patient Core temperature exceeds physiological limits Severe Hyperthermia (Seizure, Death, Brain Damage) Patient not being appropriately monitored 9545Audible and Visual High Temp Alarm Labeling and Training 92118 Q3 CDS-015 CRA 06Patient Core temperature lower than physiological limits Patient enters Hypothermia Probe has a intermittent or “noisy” signal due to EMI in area 9436Audible and Visual Low Temp Alarm Design for EMI immunity 92118 Q3 CDS-016 CRA 07Patient Core temperature lower than physiological limits Patient enters Hypothermia Probe is loose or disconnected 9654Audible and Visual Low Temp Alarm Audible and Visual Check Probe alarm Design fro interlocking connector 92118 Q3 CDS-018

25. 25 Design Output Final design specifications Quantitative Documented Approved Final specifications are contained in the design history file. Final risk assessments completed. Clinical testing may be needed.

26. 26 Design Reviews Formal Process Required for Phase Approval Checklists Minutes Attendees- one not associated with items reviewed Areas covered Action items/open issues Open items closed for final release Formal design review prior to release for manufacture and distribution

27. 27 Design Verification and Validation Demonstrates that all the risks have been mitigated. Demonstrates that specifications have been met. Uses a trace matrix between risk assessment, specs and V&V plans. Clinical trials may be needed to demonstrate safety and/or effectiveness.

28. 28 Design Verification And Validation Verification - meets specification Validation - meets intended use Written procedure required. Testing must be documented, reviewed and approved. Software must be verified and validated. Manufacturing processes must be verified and validated.

29. 29 System Verification and Validation

30. 30 Software Quality-Design Controls SRS Software Verification Testing System Design Specs and System V&V Activities Unit level Risk and SRS trace Unit verification activities SDS

31. 31 Design Transfer Design moves from R&D to manufacturing Manufacturing and production specifications are documented Manufacturing risk assessment may be needed Manufacturing IQ, OQ, PQ IQ - Installation Qualification (Equipment) OQ - Operational Qualification( 1 st ones meet specs) PQ - Performance Qualification (Consistently repeatable)

32. 32 Design Changes All changes to the design after release must be formally controlled (Change Control). Re-validation may be needed Continues for the life of product. Documentation control system is necessary.

33. 33 Labeling 21 CFR 801 Section 201(k) defines "label" as a: "display of written, printed, or graphic matter upon the immediate container of any article..." The term "immediate container" does not include package liners. Any word, statement, or other information appearing on the immediate container must also appear "on the outside container or wrapper, if any there be, of the retain package of such article, or is easily legible through the outside container of wrapper." Section 201(m) defines "labeling" as: "all labels and other written, printed, or graphic matter (1) upon any article or any of its containers or wrappers, or (2) accompanying such article" at any time while a device is held for sale after shipment or delivery for shipment in interstate commerce.

34. 34 Rx Medical Device Labeling Intended Use Indications for Use Contraindications for Use Warnings, Cautions Description of the Device User Instructions Specifications Corrective Actions (Troubleshooting)

35. 35 Labeling Controls

36. 36 Labeling Verification Labeling must be verified prior to FDA review and product release. Users should also review labeling. Risk assessment “labeling” mitigations must appear as warnings or cautions.

37. 37 Design History File Record of the Development Process Plans Specifications V&V Test Results Design Reviews Changes to the Design

38. 38 Class Exercise-Design Controls Dr. Bright and Dr. Idea have found a novel way to produce a machine to determine if a heart attack patient has additional blockage in the coronary arteries that may be caused by the surgical bypass procedure (CABG). The machine non- invasively measures arterial flow by using Doppler sonar to determine if the arteries are blocked. It can be used in a patient’s home, by itself, on post heart attack patients who may be at risk for additional heart attacks. It transfers the data to a monitoring station at a EMS facility for 24/7 monitoring. They have formed a company (The Bright-Idea Company), built a prototype and tested it in the lab on sheep and pigs. It worked great. Now they want to begin marketing it for use on humans. 1. Is the machine a medical device? 2. What steps should Dr. Bright and Dr. Idea take before they can begin marketing the machine? 3. What documents do they need to have on file?

39. 39 Questions