Passing an FDA Quality System Inspection

The Quality System Regulation (QSR) 21 CFR Part 820, aka FDA current Good Manufacturing Practices (cGMP) for Medical Devices, is what regulatory professionals should be referencing in their quality system procedures. Part 820 embodies all the major parts of the FDA quality system that are shared with ISO 13485:2016—“Medical devices—Quality management systems—Requirements for regulatory purposes.” In fact, according to the QSR’s preamble, Part 820 was originally crafted to align with ISO 9001:1994 and ISO 13485:1996.

The FDA has said that ISO 13485 covers about 90 percent or more of its QSR. How nice, but what about the other 10 percent? Many manufacturers are surprised when an FDA investigator asks questions about other “Parts” in the Federal Regulation that don’t align with ISO 13485, and yet are considered some of the most critical points of concern during an FDA inspection.

Where the FDA prides itself on being uniquely rigorous in comparison to ISO 13485 is with “vigilance” activities. Vigilance is the word that describes a company “being watchful.” Vigilance is about knowing what the enemy looks like, and in every case, it’s the enemy to public health. It’s important to demonstrate to the FDA that your quality system not only includes a process to identify the enemy, but that the company also demonstrates a willingness and proven record of acting swiftly to prevent public health concerns.

All of this starts with a robust system that sensibly captures and processes customer complaints. The FDA wants to see evidence that you know what kinds of complaints need to be reported under Part 803, and that when the company takes action in the field, it’s doing so following the regulations under Part 806. Although ISO 13485:2016’s section 8.2.2 has nearly aligned its definition of complaint handling to the QSR, Part 803 and Part 806 remain significant outliers.

Deciding when to record a customer communication as an FDA ‘Complaint’

To avoid confusion here, I’ll use a lower-case “complaint” to mean a generic grievance and an upper-case “Complaint” to refer to the FDA’s interpretation.

The definition of a Complaint is one of the most critical to understand correctly. Erring on the interpretation will either bury your regulatory department or potentially lead to a Form 483 Official Action Indicated (OAI) notice—or worse.

A proper interpretation isn’t easy. Here’s why: The definition generally describes “Any... communication that alleges deficiencies.” Some companies have gone so far as to treat routine repairs as Complaints. This isn’t what the FDA intended.

21 CFR Part 820.3 (b) Complaint means any written, electronic, or oral communication that alleges deficiencies related to the identity, quality, durability, reliability, safety, effectiveness, or performance of a device after it is released for distribution.

According to the FDA, any information about a product that is sent in for repair that hasn’t caused harm, or is not likely to cause harm, will be captured in repair records. This doesn’t mean that Complaints (using the FDA’s definition) won’t come from service technicians. But we must understand the context of the customer’s communication. When someone throws a fit that his or her medical device isn’t working, that isn’t a Complaint. If, however, the customer makes statements that products placed on the market by the company are deficient, the FDA will consider that a genuine Complaint.

A more precise way to think of it is like this: A Complaint alleges a deficiency against a model number (i.e., a group of devices), not the serial number (single device). It’s a case of a company’s entire product being faulty vs. a single device from that product line. The margin of differences can be foggy at times, and it’s best to err on the side of caution.

Whoever is designated to review and handle the complaint file should be readily accessible to personnel who can’t decide if they have a legitimate Complaint to report. Many companies use the term “Complaint Unit” to describe the designated person or group within the company that handles records of complaints. These have to be handled in accordance with 21 CFR 820.198. Often it works best to have the same people who are responsible for handling corrective and preventive actions under Part 820.100 to also handle the Complaint Unit, since investigations must be carried out in a similar way.

All complaints need to be evaluated to determine if they are “reportable” under Part 803. If a corrective or preventive action involves taking action in the field, Part 806 kicks in. So it’s really important that the team responsible for handling complaints is familiar with Parts 803 and 806.

21 CFR Part 820.198 (a) (3) Complaints are evaluated to determine whether the complaint represents an event which is required to be reported to FDA under part 803 of this chapter, Medical Device Reporting.

The Complaint Unit is the watchdog for all complaints. Most mature medical device companies know who these people are, because they bark if someone doesn’t forward an email or other communication relating to a complaint. They must evaluate complaints immediately to determine whether the regulatory authorities must be notified. Some countries require notification within 48 hours.

The Complaint Unit must be vigilant, always watching for “reportable adverse events.” They must quickly evaluate any bona fide complaint to see if there is a potentially serious injury, or worse. They must also quickly decide whether the company will have to remedy a serious public health threat by taking corrective actions toward products on the market.

Here we begin to direct our attention to Part 806—“Medical devices—Report of corrections and removals.” Parts 803 and 806 describe different amounts of information and mechanisms for reporting real or likely threats of serious injury and death. The differences are based on whether something must be done about the remaining products in the field. For example, if a device that cauterizes tissue causes a serious burn of a patient by accidental misuse, this may not require any action to be taken in the field. If, however, a device that is not intended to get hot burns someone because of a design or production problem, field action is likely necessary, and Part 806 comes into play.

Five-day vs. 30-day reporting

Before looking at Part 806 more closely, it’s important to note that Part 803 has a timeline for reporting serious injury or deaths. If “no action would likely be taken in the field to reduce the risk,” then that time period is 30 days. That relatively long period of time may sound strange, but realistically, some serious injuries and deaths are expected to occur around some life-supporting and life-saving devices. Sometimes those incidents have no real bearing on the device’s quality or safety; therefore, reports of death and serious injury where “no field action is necessary” must only be reported only within 30 days.

On the other hand, if an incident happens, and the company will be taking action on a product in the field to reduce the risk of serious injury or death, then the FDA wants to know much more quickly—within five days. Why the difference?

Special electronic reporting for frequent reports

Some companies make millions of pacemakers and other life-supporting devices. These companies can apply and receive permission from the FDA to supply Reportable Adverse Event data using electronic access, because they so frequently have to report deaths and serious injuries. More of these devices will be involved in a death where those devices are used to save or sustain a person in critical or fragile condition.

Such is the world of automated electronic defibrillators (AED). They were responsible for 2,800 Medical Device Reports between 2005 and 2010. Statistics indicate that a person’s chance of revival from a defibrillator will be reduced 10 percent for each passing minute. How many good AED’s are blamed for death? The FDA hates under-reporting errors, so manufacturers would rather err the other way, to assure the FDA that they are doing what is expected.

This is the real world of healthcare at the very highest risk level. However, most medical device manufacturers have few, if any, serious injuries or deaths to report. If you are an “infrequent flyer” of the Medical Device Reporting requirements, you can fly economy class and download the free Form 3500 from the FDA website. The forms must be submitted within five days only if a field action is needed to prevent a serious threat to public health. Reports of Corrections and Removals are handled under Part 806, but they also accelerate the timeline for medical device reporting under Section 803.

Part 806—‘Medical devices—Report of corrections and removals’

What happens when a medical device doesn’t work right, and you determine that you may have a faulty part or a software design flaw? Maybe a screw wasn’t torqued down hard enough during production. Maybe the operations manual is causing operator confusion, leading to the device not working as expected. Should you issue a recall? What is the risk if you don’t?

806.2 (k) Risk to health means (1) A reasonable probability that use of, or exposure to, the product will cause serious adverse health consequences or death; or (2) That use of, or exposure to, the product may cause temporary or medically reversible adverse health consequences, or an outcome where the probability of serious adverse health consequences is remote

Part 806 requires that any correction undertaken on a product in the field, no matter how minor, must be documented and kept on file for the FDA to review. The good news is; you have to send a report to the FDA only if the action relates to a “risk to health.” What is a risk to health?

I’ve seen the wry smile of more than one FDA investigator because this term appears to be a less serious incident than those that must be reported to the FDA under section 803. No country has a requirement to report minor injuries, but some countries do ask for a report to be completed on any kind of action taken in the field. So the FDA is mindful that minor issues are important to monitor, especially if a whole series of devices are likely to present them.

To whom do manufacturers report field corrections and removals?

Surprisingly, Part 806 isn’t quite clear about where to send reports. That’s because it’s indicated in 21 CFR Part 7—“Enforcement action.” As you might expect, the FDA takes “Recalls” very seriously, and it wants boots near your door quickly, if necessary. So Reports of Recalls or any Corrections and Removals related to a “risk to health” are sent to the local FDA district office. A list of them can be found here.

The FDA is very mindful of any actions taken on any series of product problems in the field. You don’t have to report anything if the correction is a minor quality problem, but under section 806.20—“Records of corrections and removals not required to be reported,” there is a list of records that you must keep ready for the FDA investigator during their next visit. That list is much longer under section 806.10, which is meant for those reporting action to correct a risk to health. Failure to explain why any required document is missing from the list can lead to a warning letter or worse. As always, work as closely with the district office as possible, and they will act more like your friend than foe.

It’s said that ISO 13485 covers 90 percent of the FDA Quality System Regulation, but it’s ironic that there are more words in Part 803 than all of Part 820. Even so, complaint handling, medical device reporting, and the part about corrections and removals must all be integrated into the quality management system. Start with a solid understanding of complaint handling under 21 CFR Part 820.198. Know what a Reportable Adverse Event is, and integrate the reporting time frames and forms into that process.

Although we would hope that a correction or removal from the field would never be necessary, be aware of Parts 806 and even 21 CFR Part 7. The FDA Quality System is a machine designed to protect the public health, but it only works when all its parts are integrated in a company’s procedures.

For more information on this topic, join me and Quality Digest editor in chief Dirk Dusharme for our webinar, “Understanding the FDA’s Inspection of Parts 820, 803, and 806 As They Relate to Handling Complaints,” happening Tuesday, May 24, 2016, at 2 p.m. Eastern, 11 a.m. Pacific. Click here to register.

About The Author