Complying with ISO 14971: Transition from 2007 to 2009

presented by

John Beasley Owner & Sr. Consultant

MedTech Review

Topics

•  Understanding need for Risk Management •  Implementing ISO Standards •  Outline of ISO 14971 •  Key Changes under EN ISO 14971:2009 •  Final Comments

Understanding need for Risk Management

Advances  in  TECHNOLOGY  bring  increases  in  RISK  to  both  pa?ents  and  users  

Classic  example:    Radia?on  Treatment  for  cancer  

BENEFIT  to  pa?ent  outweighs    RISK  to  which  the  pa?ent  and  the  user  is  exposed  

Understanding need for Risk Management

Understanding need for Risk Management 25  MeV  Radiotherapy  Machine  X-­‐rays  &  Electrons    

200  rad  (e)  or  25000  rad(x)    

Error  on  selec?on,  SoUware  bug,  Beam  not  reset  

Pa?ent  received  25000  MeV  ,  “malfunc?on  54  displayed  “    

Technician  fired  2  more  ?mes  

4  Months  later  pa?ent  died  

“Captain  Kirk  forgot  to  put  his  phaser  on  stun”  

Implementing ISO Standards

Implementing ISO Standards

•  For the EU (and CE Marking) manufacturers have until 31 Mar 2010 to comply before cessation of the 2000 version

•  Some Notified Bodies are offering registration certificates to ISO 14971

•  EN ISO 14971:2009 identical to ISO 14971:2007 but includes annexes that show how it meets the essential requirements of AIMD, MDD and IVDD

had

Outline of ISO 14971

•  Risk Management Objectives •  Risk Management Process

– Risk Analysis – Risk Evaluation – Risk Control – Overall Residual Risk – Risk Management Report – Production & Post Production

•  Annexes

Risk Management Objectives •  Management Policies •  Documented Procedures •  Tasks

– Analysis – Evaluation – Risk control

Enable  medical   device  manufacturers   to   iden6fy  all   foreseeable  hazards  and  hazardous  situa6ons  relevant  to  a  par6cular  device  and  demonstrate  with  documented  evidence  that  related  risk  has  been  reduced  to  an  acceptable  level.  

Risk Management Process

•  Interactive with design, engineering, production, purchasing, sales, quality assurance and regulatory affairs

• Perpetual process, beginning with design & development and continuing through to the use of devices, where user feedback reveals actual performance

Interactive

•  ISO 13485:2003 Medical devices. Quality management systems. Requirements for regulatory purposes

–  Paragraph 7.1: Planning of Product Realization –  “The organization shall establish documented

requirements for Risk Management throughout product realization. Records arising from Risk Management shall be maintained”

–  (See ISO 14971 for guidance related to Risk Management)

Interactive

•  ISO 10993-1:2009 Biological evaluation of medical devices – Part 1: Evaluation and testing within a risk management process – Describes

•  general principles •  general categorization •  Evaluation •  identification of gaps •  identification of additional data sets •  the assessment of the biological safety

Interactive

•  BS EN 62366:2008 Medical devices. Application of usability engineering to medical devices – Specifies process to

•  Analyze •  Specify •  Design •  Verify •  Validate

It  can  be  used  to  iden6fy,  but  does  not  assess  or  

mi6gate,  risks  associated  with  abnormal  use.  

Perpetual

•  Clause 1 – Scope •  Clause 2 – Terms & Definitions •  Clause 3 – General Requirements for Risk Management •  Clause 4 – Risk Analysis •  Clause 5 – Risk Evaluation •  Clause 6 – Risk Control •  Clause 7 – Evaluation of overall residual risks

acceptability •  Clause 8 – Risk Management Report •  Clause 9 – Production & Post Production Information

Perpetual •  Annex A – Rationale for requirements •  Annex B – Overview of the risk management process for medical devices •  Annex C – Questions that can be used to identify medical device

characteristics that could impact on safety •  Annex D – Risk Concepts applied to medical devices •  Annex E – Examples of hazards, foreseeable sequences of events and

hazardous situations •  Annex F – Risk Management Plan •  Annex G – Information of Risk Management Techniques •  Annex H – Guidance on risk management for in-vitro diagnostic

medical devices •  Annex I – Guidance on risk analysis process for biological hazards •  Annex J – Information for safety and information about residual risk •  Annex ZA/ZB/ZC – Relationship between the standard and the

Essential Requirements of the MDD / AIMDD / IVD

Management Responsibilities

•  Top Management must show its commitment by: – Providing adequate resources – Assigning qualified personnel – Defining & documenting the policy for

determining risk acceptability – Conduct internal audits on risk management

activities

Risk Management Team

•  Qualification of Personnel: Personnel must have knowledge and experience – How the device works and its intended use – Knowledge of the technologies involved – How the device is manufactured and

constructed – Familiar in risk management techniques

Records  of  qualifica?ons  must  be  kept  as  part  of  the  Risk  Management  File!  

Risk Management Plan

•  Contents of a Risk Management Plan: – Scope of planned risk activities –  Identify & describe the medical device – Define responsibilities & authorities – Requirement for review of risk management

activities – Verification Activities – Define Risk Acceptance Criteria

Manufacturers  shall  establish  and  document  a  risk  management  plan  for  a  par5cular  device  

Risk Management Plan

•  So how detailed does it need to be? –  “commensurate with the level of risk

associated with the medical device” •  Annex F for guidance •  Forms part of the risk management file

Risk Analysis

•  Will people use the device correctly? •  Where in the production process might

variations impact the conformity of the device to its intended product specifications?

•  Risks are weighted to consider its probability of occurrence and the seriousness of its potential effects.

Iden6fying  foreseeable  hazardous  situa6ons  

Risk Analysis Records

•  Must include: – description and ID for device analyzed – who conducted the analysis – scope and date

•  Forms a part of the Risk Management File

Risk Analysis Methods Events  Causes  Hazardous  

Situa?ons  

Accident  /  Incident  /  Harm  

Primary  Cause  A  

Event  1  

Event  2  

Primary  Cause  B   Event  3  

PHA  -­‐  Preliminary  Hazard  Analysis  FTA  –  Fault  Tree  Analysis  

FMEA  -­‐  Failure  Mode  and  Effects  Analysis    Ishikawa  -­‐  Cause  and  Effect  (Fish  Bone  Diagram)    

HACCP  -­‐  Hazard  And  Cri?cal  Control  Point    HAZOP  -­‐  Hazard  And  Operability  Study  

Accident  /  Incident  /  Harm  

Man  Machine  

Material  Method  

Risk Evaluation

•  Estimated risks are compared to the risk acceptability criteria (Risk Management Plan)

•  Comparison determines appropriate level of risk reduction if necessary

•  For each hazard determine whether the estimated risk is so low, reduction is not required

Risk Control

•  Reducing risk through available control measures.

•  Must be consistent with the state-of-the art –  a measure that naturally shifts as science progresses

Inherent  Safety  by  Design  

(GHTF-­‐SG3/N15R8)  

Protec?ve  Measures  in  the  device  or  its  

manufacture  

Provide  Informa?on  for  safety,  such  as  warnings  in  IFU  etc.  

Overall Residual Risk

•  Risk / Benefit Analysis –  If you have any outstanding unacceptable

risks you need to establish if the benefits of the device / therapy outweigh the risks •  Reviews •  Clinical Evaluation

•  Essential Requirements: – 1, 2, 4, 6, 7, 8.6, 9.2, 9.3, 11.2, 11.3, 11.4,

11.5, 12.1,12.5, 12.6, 12.7, 12.8, 13.5

Risk Management Report

•  “Prior to release for commercial distribution the manufacturer shall carry out a review of the risk management process”: –  the RMP has been implemented –  the overall residual risk is acceptable –  appropriate methods are in place to gather

production & post production data •  Results of the review must be recorded in the

RM Report •  Person with appropriate authority shall

conduct the review

Production & Post Production

•  Must ensure that appropriate methods are in place to gather: – Production Data –  Inspection Data – Design Changes – Post Production Data

Production & Post Production

•  Production Experience – Non-conformance (rejects, re-work etc) – Scale up issues

•  Design Changes – Drawings, Materials, Methods, Packaging,

Sterilization, optimization studies •  Post Market Surveillance

– Active surveillance – Complaints

•  CAPA

Maintaining Risk Management File

•  Continue to monitor throughout entire lifecycle – Risks continue to remain acceptable – See if any new hazards or risks are identified -

especially CAPA – Verify or review assumptions & scoring values – Effect of State of the Art advances – Competitor products experience

Key Changes of EN ISO 14971:2009

•  Phase of the Life Cycle – 7.1 and 7.3.2 address the need to examine

different stages of the product, including manufacture, product release, in-use errors and disposal

Example – HDR Brachytherapy •     HDR  Ir  192  inserted  into  catheters  •     Wire  broke  in  one  of  catheters    •     Catheter  disposed  of  in  4  days  •     6  Days  in  storage  •     Detected  at  medical  waste  incinerator  

More  than  90  people  accidently  irradiated  

Key Changes of EN ISO 14971:2009

•  Type of Hazard – This version of the standard distinguishes

between hazard (potential source of harm) and hazardous situation (circumstances in which people, property, or the environment are exposed to one or more hazards).

– The risks must be estimated for both.

Key Changes of EN ISO 14971:2009

•  Confirmation of Standard Applicability – This standard is now applicable to all medical

devices, including In Vitro Diagnostic Devices (IVDs), for which a specific annex (H) was added about the identification of hazards. •  No direct risk - indirect risks

–  The extent to which the diagnosis relies on the analytical result (i.e., contribution to the medical decision)

Final Comments

•  FMEA, whether Design (DFMEA), Process (PFMEA) or Use (UFMEA) is a risk management technique mentioned by the standard but it does not alone address all the requirements of EN ISO 14971

•  Documentation is often missing to demonstrate compliance to EN ISO 14971

•  Start by performing a Gap Analysis

Thank You

John Beasley Owner & Sr. Consultant MedTech Review, LLC

www.medtechreview.com Email: john@medtechreview.com

SKYPE: medtechreview