The Dec. 31, 2018 deadline looms for medical device companies that sell their devices in Canada. On that day, any company that sells medical devices to Canada will either need to hold an MDSAP certificate or show proof that they are on track to be MDSAP certified, or they won’t be able to sell their products in Canada. This mandate could have consequences for Canadian citizens.

What is the Medical Device Single Audit Program?

Is MDSAP one certification accepted by all? No, however it is accepted by five countries: the United States, Canada, Brazil, Australia, and Japan. 

What medical device company that sells internationally wouldn’t want a yearly one-and-done audit that satisfies the regulatory requirements of those five countries? Within the medical device community, where audits are strict and often expensive, the ability to go through a single quality management system (QMS) audit and have those audit results accepted by five countries would theoretically save time and money compared to dealing with each country’s regulations individually. That was the intended goal behind the Medical Device Single Audit Program (MDSAP). However, as is the case with many plans, the unintended consequences may hurt not just the medical device companies it was supposed to help, but in the end may harm consumers.

Medical device companies selling into multiple countries currently seek ISO 13485 QMS certification. But because ISO 13485 is a generic QMS standard, for regulatory purposes within the medical device sector, some countries require some sort of additional regulatory audit to verify that a company’s QMS meets other requirements unique to their country. Thus, along with an ISO 13485 audit, a company would periodically undergo audits from other countries it sells to.

For companies that sell internationally, the entire process is unwieldy and involves dealing with auditors from multiple agencies and certification bodies, along with varying deadlines and requirements.

Not only is the process tedious for the medical device companies, it poses problems for regulatory agencies that have been unable to keep up with their own audit schedules. There are more than 30,000 medical device companies that sell products in the United States.  The FDA is completely unable to inspect them all on a regular basis. Therefore, the FDA conducts relatively few inspections of foreign establishments that sell in the United States. According to the last U.S. Government Accountability Office Report, officials estimate that the agency inspects foreign manufacturers of high-risk devices (such as pacemakers) every six years and foreign manufacturers of medium-risk devices (such as hearing aids) every 27 years. So, if you are a manufacturer of a low-risk device, your odds of being audited are pretty slim.

“Everything the FDA does is risk based,” says Alex Stenzler, president of 12th Man Technologies, an R&D firm specializing in pulmonary medicine, critical care, and infectious diseases. “How many people are affected and how severe the risk determines the FDA’s activities. There is no way for the FDA to visit every company every year or every three years to audit what they are doing. So what the FDA does is look at how big the company is, what kind of products they make, and how big the risk is. So they probably hardly ever audit adhesive-bandage manufacturers. But they audit people who make life-support equipment.”

Thus, in part to offload regulatory agencies from having to audit manufacturers of low-risk devices, in 2014 the International Medical Device Regulators Forum (IMDRF) began a pilot phase for a new program called the Medical Device Single Audit Program or MDSAP. The intent was to create a certification that would include both ISO 13485 and medical device QMS requirements specific to the five countries—United States, Canada, Australia, Brazil, and Japan—that agreed to participate in the program. One of its stated purposes was to provide “a way that medical device manufacturers can be audited once for compliance with ISO 13485 and to the various regulatory requirements of up to five different medical device markets”: In other words, one yearly audit that would do everything and be accepted by the five participating countries.

All this might seem like MDSAP would benefit everybody. After all, having a rigorous audit of medical device manufacturer’s QMS on a regular basis offloads some of the work on regulatory agencies, gives medical device companies one certificate accepted in five markets, increases the number of QMS audits being performed (more transparency), gives consumers confidence in products, and maybe even improves product safety. How could that be bad?

Unintended consequences

But the devil is in the details. The first thing to note is that, like ISO 13485, MDSAP requires a yearly audit. The difference is, this audit is not only for ISO 13485 but also for each participating country’s specific medical-device QMS requirements. To be clear—because there has been some confusion on this—the extra audit requirements are only for the participating countries you sell to. If you don’t sell to Brazil, you won’t be audited to Brazil’s requirement (see Health Canada’s MDSAP FAQ, Q6). In any case, your yearly ISO 13485 audit could grow into something much larger and more expensive. Estimates are anywhere from twice to three times the cost of an ISO 13485 audit.

For instance, 12th Man Technologies, which has products sold around the world, just received a quote from its certification body for $24,000 for an MDSAP audit. That is about twice the amount of what the eight-person company paid for an ISO 13485 audit, according to Stenzler.

Grant Ramaley, director of regulatory affairs for Aseptico Inc. and convener for the ISO 13485 Working Group at the International Accreditation Forum, encountered one company with nine employees that received a quote for an MDSAP audit that was $50,000. By comparison, says Ramaley, $50,000 is more than double the cost of a full ISO 13485 certification for a company with 10 times as many employees. The company complained that its entire margin for all sales in Canada would be consumed by the cost of MDSAP.

Of bigger concern to companies, especially those that sell inside the United States, is that a summary of the results of every MDSAP audit are reported back to the regulatory agencies of the MDSAP participating countries they sell to. Remember that following the initial audit by the FDA, many companies may not see an FDA inspector for years… or decades, which means they won’t come under scrutiny by the agency unless there is an adverse event with their product. With MDSAP, companies that were largely ignored by the FDA might find themselves in the agency’s cross hairs if there is any kind of negative finding in the MDSAP audit. MDSAP is a QMS audit not a product-safety audit, but many companies fear that a company that has had no product-safety issues could now face FDA scrutiny for something that had nothing to do with product safety.

Ramaley predicted that, for that reason alone, many smaller companies would not participate in MDSAP. Why take the chance of increased scrutiny?

All of this would be moot if MDSAP was simply an alternative to Canada’s current Canadian Medical Devices Conformity Assessment System (CMDCAS). If that was the case, a company could choose whether MDSAP was a benefit or not. In fact, for larger companies, MDSAP probably is a good program: large companies with many product lines face regulatory inspection much more frequently, and one certificate accepted by these participating countries would save them money. Also of benefit to large companies with frequent audits is the added bonus that an external audit has no legal consequences for a finding as opposed to, say, an FDA investigator finding a non-conformance, which triggers a set of legal actions and reporting requirements.

But here’s the problem. Of the five countries participating in MDSAP, Health Canada alone has mandated that MDSAP be a requirement for selling medical-device products in Canada. CMDCAS which was also mandatory, is replaced bv MDSAP. Because of the all-or-nothing nature of MDSAP you must use MDSAP for all participating countries you sell to or don’t use it all. The option of simply doing a required MDSAP for Canada and opt out of using it for the other countries isn’t an option. So a CMDCAS audit which only involved ISO 13485 plus Canadian requirements, has become an audit that must include all MDSAP participating countries that you sell into.

According to some, all of this means that small medical device manufacturers whose Canadian market is a small percentage of their overall sales, simply won’t sell in Canada. Ironically, this may include small medical device companies that are based in Canada. Transparency and the yearly costs of getting and maintaining an MDSAP certificate aren’t worth it. Those companies will continue doing what they currently do and simply drop the Canadian market. For the Canadian public this may mean that certain products won’t be available.

One concern that has been put to rest is whether a nonconformance on a non-Canadian requirement of MDSAP (a particular FDA requirement for instance) would keep your product out of Canada even though you had met all Canadian requirements. According to a Health Canada spokesperson, that may not be the case. “This would depend on the nature of the finding and of the requirement in the U.S. regulations that is not met,” she said. “If the requirement that is not met also happened to be a generic requirement of ISO 13485, this would be an issue for all jurisdictions and may have an impact on market authorizations in Canada. However, if the requirement of the U.S. regulations that are not met were specific to the U.S. and did not apply to Canada, this would not have an impact on market authorizations in this country.”

Health Canada is listening

It’s not as if Health Canada has turned a deaf ear to these concerns.

“Health Canada was made aware that the transition from CMDCAS to MDSAP may result in higher costs and lead to longer audits for smaller manufacturers in some cases” a Health Canada spokesperson told us. “To address this issue, the Department implemented mitigation measures to further support small businesses, including specific adjustments to the audit duration meant to help small businesses by reducing costs. The Department is aware that some companies may opt to withdraw from the Canadian market in part because of the cost increase associated with MDSAP.

“Health Canada is keeping an eye on the situation to detect any potential risks to the Canadian healthcare system and concurrently exploring options to alleviate the immediate impact on patients. Withdrawn products may still remain available to Canadian healthcare practitioners through the Special Access Programme under certain circumstances.”

The upshot is that rather than drop the mandatory requirement for MDSAP, and perhaps allow a choice between CMDCAS or MDSAP (which none of the four other countries have mandated), Health Canada has instead tried to decrease the burden on small companies by providing a longer timeline for compliance and by implementing a sliding scale for audit hours based on company size.

According to the latest MDSAP “Audit Time Determination Procedure” (MDSAP AU P0008.007) “The duration of audits may be adjusted based on the number of employees involved in the design and/or manufacturing of medical devices within the scope of the audit under certain circumstances.”

That adjustment table is shown below.

Figure 1: Adjustment to audit time

Besides cost, another issue is the timeline. Not surprisingly, the certification bodies (or auditing organizations as they are also called) have been swamped and have not been able to keep up with the MDSAP deadline. The result is that a lot of companies are either waiting for their certificates or for their audit, which will push them beyond the Dec. 31, 2018 deadline.

“There is a big backlog as we get closer to the deadline,” says Linda Chatwin, senior customer solutions consultant for the Health Sciences division of Emergo by UL. “Something is going to have to be looked at for a different approach… perhaps extend the deadline. [Auditing] resources are scary. Some companies that have a contract for auditing have been put off. … The big concern, is that right now you have MDSAP, the EU’s Medical Device Regulation transition, and the transition from the 2003 to the 2016 version of ISO 13485 and that is all hitting at the same time. It’s all a bit overwhelming for the small companies.”

To address this, Health Canada is offering some slack. You don’t have to have your certificate in hand by Dec. 31, 2018 if you can show that you “expect to undergo an MDSAP audit (initial or recertification) during the 2019 calendar.”

According to “Notice: Medical Device Single Audit Program (MDSAP) Transition Plan - Frequently Asked Questions” to do that “you must provide the following documents to Health Canada’s Medical Devices Bureau with a completed F202 form by December 31, 2018.
“1. An ISO 13485 certificate issued under Canadian Medical Devices Conformity Assessment System valid until at least December 31, 2018.
“2. An ISO 13485 certificate (non-Canadian Medical Devices Conformity Assessment System) issued by a Medical Device Single Audit Program Auditing Organisation (AO) valid from January 1, 2019 onward.
“3. Documented evidence that they have made firm arrangements to undergo a Medical Device Single Audit Program audit (initial or recertification) in 2019 (e.g. signed certification agreement, written confirmation from the Auditing Organisation on letterhead, or completed Medical Device Single Audit Program form.”

While admirable that Health Canada is trying to address concerns, whether either of these changes is enough to convince some of the smaller medical device companies to continue selling to the Canadian market remains to be seen. As of this date Health Canada reports that two-thirds (2,226 of the 3,300 or so) medical-device manufacturers that sell into Canada have signed up for MDSAP. That’s with only six weeks left.

Implications

According to numerous sources, including Health Canada, many small companies are choosing not to sell in Canada because of the MDSAP requirement. According to a Health Canada announcement “It is anticipated that some manufacturers, instead of conforming to the new MDSAP requirements, may be cancelling their medical device licenses and discontinuing the sale of their products as early as November 1, 2018. Healthcare professionals should discuss with their suppliers if they have any concerns regarding the ongoing availability of their current products.”

Barrie, Ontario-based Southmedic Inc., which manufactures and distributes medical devices to the global healthcare market, told The Globe and Mail that “about a half-dozen suppliers have said, as of last month, that they won’t be renewing their license to sell in Canada as a result of the program change.”

Emergo has also seen this among its clients: “We have heard from some companies who have determined either not to go into Canada, or to withdraw from the market,” says Chatwin. “Of course, these are smaller companies who cannot justify the increased resource and cost requirements for the amount of sales in Canada.”

This situation may change, of course, because of the cost and schedule allowances mentioned above and because Health Canada is scrambling to contact and convince these companies to reconsider.

Ironically, if Canada does lose smaller medical-device companies, it will have hurt rather than helped Canadian citizens. Small companies—no matter what industry—are often the most innovative and the most willing to work with small markets. A very large multinational medical device company, for instance, may see no value in developing specialized oxygen masks for emergency responders, while that may be a perfectly viable product for a small company. Multiply that by the hundreds of small medical device companies that might bypass Canada, and it becomes clear that Canada may miss out on a lot of innovation.

If some manufacturers disappear from the Canadian market it could also lead to medical device distributors and healthcare providers scrambling to replace old suppliers with new ones in order to meet patient needs. If that comes at increased cost, what benefit is that to suppliers or their customers? It could conceivably put some distributors out of business.

In the end, while MDSAP as a voluntary program has its merits, especially for larger companies, making it mandatory will only help regulatory agencies, auditing organizations, and consultants while providing little to no benefit to small companies or the public. A better route would be if Canada left MDSAP as a voluntary program and let companies decide which route was best for them.