Top Three Document Management Tips for Medical Device Companies

Avoid the headache (and citations) by establishing electronic document control

Published: Wednesday, July 8, 2015 - 12:00

In the medical device industry, one absolute—which shows no signs of abating—is the need to maintain documentation.

We’re talking documentation to demonstrate you have a compliant quality management system, that you design and develop products to meet design controls, and that you’re addressing risk management, to name a few.

Documents and records serve as proof that your medical device company uses compliant document management practices when designing, developing, and manufacturing health industry products.

And like it or not, how you manage your documentation can make or break you.

That’s why it’s essential to take the time to consider how your company will manage all of its documents and records, not just now, but long into the future.

Here are three key tips to consider when building a system for managing your documentation that will work for your organization.

Tip No. 1: Develop a document management strategy

Develop a document management strategy and do it early. To get started:

Map out all the types of documents and records that will be generated throughout medical device product realization.

Remember, as far as the FDA and other regulatory officials are concerned, if you didn’t document it, it didn’t happen. So pay particular attention to the kinds of documented evidence you’ll need to demonstrate that you’ve carried out the various quality management system activities according to planned arrangements.

During product development, you need to document, for instance, your design and risk management activities. Related records must be maintained or made accessible via a design history file.

As well, you’re likely working with a number of suppliers, so think about supplier evaluation records, qualification records, and an approved supplier list.

You are defining manufacturing processes, too, and establishing device master records, the “recipe” for your company’s devices.

And let’s face it: Once you go to market, you have a ton of production and post-production documentation and records to consider. They include, to name just a few more:
• Device history records—evidence of manufacturing builds
• Complaints and customer feedback
• Corrective actions
• Nonconformances
• Change orders

We’re just skimming the surface here. To be thorough, you need to spend time reviewing and listing the regulatory requirements to identify all the documents and records you need to generate and maintain.

Beyond locking in the types of documents and records you will be generating, there are a few other considerations to weigh when devising an appropriate document management strategy:
• Figure out who the owner of each document and record should be. Do this right away to avoid confusion. Otherwise you’re guaranteeing trouble down the road that can be quite difficult to disentangle. Make these decisions when your system and process are more flexible.
• Determine how long you need to keep all this documentation.
• Figure out where you will keep your documentation and in what form (see tip No. 2 below).
• Think three to five years into the future. This means your strategy should plan for scalability and flexibility.

Finally, as you develop your document management strategy, be sure to keep key stakeholders in the loop. Getting them on board early is essential.

Note: Even if your company already has established procedures, it’s a good idea to reevaluate your organization’s overall document management strategy.

Tip No. 2: Stop using paper

Did you know that more than 50 percent of medical device companies are still suffering with paper-based document management systems?

It’s 2015. Electronic document management systems have loads of advantages that even the youngest medical device startup can appreciate. They can be configured to automate most if not all of your company’s document control processes in accordance with the range of regulatory frameworks it’s obligated to abide by, whether 21 CFR Part 11, 21 CFR Part 820, Annex 11, ISO 13485 or the Health Insurance Portability and Accountability Act (HIPAA).

Why do so many medical device companies still struggle with document management tools?

Do you think general purpose tools like Dropbox and Google Drive can work to “meet” your document management needs?

Do you really enjoy keeping track of all that paper?
I suspect the simple answer comes down to perceived costs of an electronic document management system.

Admittedly, most document management systems aren’t exactly being given away. You will have to spend some money to implement document management software. But look at it this way: If your document controller earns, say, $60K a year, yet spends 20 percent of her time wrestling with nonconforming documents and unintuitive management software only to have the pile of CAPAs that emerge from the next surveillance audit be devoted to document and record management issues, well, it doesn’t take a genius to see that document management systems:
• Quickly pay for themselves (the math is easy to do, so do it.)
• Boost employee morale (“What? I don’t have to spend my afternoon chasing people for approval signatures? Yeah!”)
• Increase regulatory conformity (With less time spent fixing documents you have more time to spend addressing other areas of weakness when preparing for audits.)
• Free employees up to tackle the challenges that actually matter (Chasing missing records doesn’t meet this criteria.)
• Are the best way to address most document and record-oriented nonconformities (Not to mention training employees in effective document control)
• Increase security (Think audit trails, electronic signatures, access logs)

Of course there are always exceptions. Despite boasting all of the bells and whistles, the document management system you decide on may turn out to be a dud. So make sure that when you’re on the hunt for the right document management system, you bring along the right person with the right knowledge base to ask the right questions.

As you know, FDA’s 21 CFR Part 820 and ISO 13485 have very specific expectations when it comes to documents and records. So please make sure the solution you end up choosing is designed with this in mind.

Tip No. 3: Follow the document management procedures

Yes, this tip sounds so simple. Of course you’ll follow your own procedures for document and records management. Yet despite your best efforts, they will get derailed from time to time. So be a stickler! Make sure your medical device company follows established procedures. When the procedures call for a specific document or record, make sure there is actual, documented, objective evidence to prove that the procedure happened.

I can assure you that if you are ever inspected by the FDA or audited for ISO 13485 compliance, the auditor will definitely be seeking objective evidence.

One way to help you evaluate whether established procedures are being followed is through internal auditing. This ensures that those critical documents and records exist. It’s also a regulatory requirement.

Yes, regardless of how good your strategy is and how well-written your procedures are, there will be numerous issues identified once your quality system procedures are put into practice. When this happens, make adjustments. Adopt a mindset of continuous improvement.

And invest in a document management solution that will take the headache out of document control.

About The Authors

Alex Morris

Base in Toronto, Canada, Alex Morris, is a regulatory affairs and quality assurance consultant within the medical device industry. He designs, authors, implements and trains to 13485-compatible quality management systems. Regulatory and quality issues affecting software medical devices are his specialty. Morris is versed in ISO 13485, ISO 14971, ISO 9001, ISO 27001, ISO 27002, IEC 62304, IEC 62366-1, IEC 60601-13rd Ed., ISO 14001, HIPAA, CMDR, 21 CFR Part 820 and MDD93/42/EEC. Morris founded and leads Frontline Health Consulting that assists small to medium-sized medical device companies achieve their quality, regulatory, and information security goals.

Jon Speer

Jon Speer is the founder and vice president of quality assurance and regulatory affairs at Greenlight Guru, a software company that produces the only medical device quality management software solution. Device makers in more than 50 countries use Greenlight Guru to get safer products to market faster. Speer has served more than 20 years in the medical device industry and helped dozens of devices get to market. As a thought leader and speaker, he regularly contributes to numerous industry publications. He is also the host of Global Medical Device Podcast.