Which rules must we follow? Sorting out compliance laws, rulings and regulations.

For managers and engineers who are new to the medical device industry, regulated device engineering will seem like a strange new world. One no longer simply design, release and sell products; a pre-market submission and acceptance are required from a government agency. Circuits and software can no longer be designed from a blank page, inventing the look, feel, and performance limitations as one draws schematics or create source files--instead, one must work within design controls that are subject to audit from the same agency.

Confusion sets in when determining what rules must be followed. The industry is an alphabet soup of acronyms, abbreviations, and standards numbers. Quality and compliance professionals speak in this abbreviated language. There are standards on the same topics that disagree with each other. Consultants will be hired who will give conflicting advice. How can one make sense of the dozens of documents out there so one can get back to engineering a product?

This paper is an engineer's (or engineering manager's) abridged guide to the FDA, regulatory documents, and standards. It will explain the FDA's interest in one's device, the level of control it has over a company, and how to navigate the available regulations and documents. Please note this guide is abridged. There are many documents available from the FDA and standards groups that are not referenced here. This information is just the "tip of the iceberg," of which product designers should have at least a cursory knowledge.

Historical background of FDA

The FDA was originally formed and has subsequently evolved in reaction to a series of calamities. The Food and Drugs Act was passed in 1906 in response to poisonous food additives, ineffective patent medicines, and public outrage over unsanitary meat packing practices (described in Upton Sinclair's The Jungle). Not long afterwards, the Food Drug and Insecticide Administration was set up as an independent regulatory agency. Although medical device quackery was rampant, the FDA had no power to regulate medical devices until 1938, when the Food and Drugs Act was replaced with the Food Drug and Cosmetic Act.

The Food Drug and Cosmetic Act (FDCA) was also passed in a climate of outrage, when nearly 100 people died from ingesting an elixir prepared with diethylene glycol (a substance similar to antifreeze). The Agency's name was changed to the Food and Drug Administration and medical devices were added to its purview. Under the 1938 FDCA, the Agency only had the power of seizure "after the fact"; if a device was shown to be unsafe, mislabeled or adulterated. Unscrupulous manufacturers could continue to send faulty or dangerous devices to market, in spite of FDA intervention.

The number and complexity of medical devices increased in the 1950's and 1960'S. However, the FDA had little power to prosecute fraudulent devices. In some cases, the Agency had to go to court to have a device declared a "drug", in order to get the power to require proof of effectiveness (drugs have needed premarket approval since 1962, as a result of the thalidomide tragedy in Europe). In 1976, after thousands of women were injured by the Dalkon shield intrauterine device, the Medical Device Amendments (MDA) set in place a mechanism to require premarket approval of medical devices. Devices were assigned three classification levels according to the level of risk to the user. The manufacturer had to prove efficacy and safety if the device was assigned to a higher risk category. If the device was substantially equivalent to a device already around before 1976, the path to market was streamlined. The MDA also imposed the first Good Manufacturing Practices, as well as requirements for keeping records of medical devices. Most importantly, the FDA was given the power to recall devices, and to withhold premarket approval, when necessary.

In the 1970'S and 1980's computer components became widespread in safety critical medical devices. In the late 1980's, six cancer patients received massive X-ray overdoses during radiation therapy with Therac-25 linear accelerator machines because of software error. This tragedy led to the publishing of the FDA Quality System Regulation (QSR) in 1996. The 1990's also saw the passage of the Safe Medical Device Act in 1990, requiring closer tracking and post-marketing surveillance of medical devices. Most recently, in 1997, the Food and Drug Administration Modernization Act was passed, accelerating review and release of safe and effective devices. Some of the 1997 revisions, as well as the QSR issues will be discussed below.

The FDA's relationship with medical devices

It is important to understand that, despite the apparent complexity and number of Centers and Offices within the FDA, the mission of the agency is quite simple. As simply stated in the FDA Mission Statement, the mission of the FDA is to assure the safety and efficacy of the products within its purview. That mission of the agency extends down to each of the centers within the FDA, most notably (for device engineers) the Center for Devices and Radiological Health (CDRH). The mission also extends to each office within the center. FDA staff members who examine pre-market submissions are interested in assuring the safety and efficacy of devices before they get to market. Compliance auditors (inspectors) are interested in assuring the safety and efficacy of the design and quality systems used to create and maintain the devices.

The FDA is an agency of the Department of Health and Human Services of the Federal government. The organization chart of Figure 1 shows how the FDA is organized. Of the Offices within CDRH, three are of particular interest to device designers.

1. The Office of Device Evaluation (ODE) is the office to which new products are submitted for pre-market notification or approval.

2. The Office of Compliance has enforcement as one of its main responsibilities. The FDA audits (or investigations) of medical device manufacturers are prompted and coordinated by this office.

3. The Office of Science and Technology (OST) is where specialists are found within the FDA in specific areas of science and technology. These specialists are called upon by the FDA to assist in writing guidances for the industry and to assist ODE and the Office of Compliance on technically complex submission and audit situations.

The powers of the FDA over medical device manufacturers, granted by the Food, Drug and Cosmetic Act of 1938, can be summarized as pre-market approval powers and post-market audit powers. The pre-market approval powers are exercised by requiring medical device manufacturers to submit their devices to the FDA for review prior to release.

Submissions fall in one of three major categories:

1. Investigational Device Exemptions (IDE)--these submissions are for devices whose efficacy has not yet been proven. They are not for sale, and generally are to be used in the early phases of device research.

2. Pre-Market Approvals (PMA)--these submissions are for devices whose therapeutic or diagnostic value are new and unproven. The efficacy of the device must be proven to the examiner prior to market release. It usually involves clinical trials, and statistical treatment of trial results. Safety must also be addressed through testing or reference to design controls and quality systems that assure the safety of the device.

3. Pre-Market Notification (PMN)--addressed in Section 510(k) of the Food, Drug and Cosmetic Act, usually referred to as a 510(k) or 510k submission. These submissions are for devices whose safety and efficacy can be proven to be substantially equivalent to a predicate device that is already legally marketed in the US. The examiner only needs to be convinced that the new device is at least as effective as the predicate device. SaJety must also be addressed through testing or reference to design controls and quality systems that assure the safety of the device.

The post-market power of the FDA is exemplified by the audit. The Code of Federal Regulations (21 CFR 810) gives the FDA power to demand that a manufacturer recall or cease distribution of a device. The audit and the inspection are the tools that the agency uses to collect the information to support a demand for recall.

Manufacturers have a responsibility to maintain a quality system (QSRs). Implicit in this system is a responsibility for documentation of quality efforts appropriate to the type of device. The law requires a manufacturer to conduct internal audits at regular intervals, and to have a documented audit procedure.

Product designers and engineers need to understand that the FDA instructs its inspectors, during a quality audit, to choose any Class II or 111 device design project (as well as certain Class 1 devices) and to verify that Design Control Quality requirements under 21 CFR 820.30 have been met and have been documented. Furthermore, if software is part of the device, the inspector may look for documented evidence of its validation. For this reason, any project needs to be controlled and documented with the assumption that it may be subject to close scrutiny.

The regulatory maze

The FDA was created and given powers by Congress in the Food Drug and Cosmetics Act. The law can be found in Title 21 of the United States Code. The Regulations of the FDA are contained in the Code of Federal Regulations, Title 21 (referred to as 21 CFR). The regulations that are of particular interest to medical device manufacturers are in Parts 800-1299 of 21 CFR. There are also regulations in Parts II and 211 that relate to electronic records and signatures and to the preparations of finished drug products, respectively, which are beyond the scope of this article. Medical device design engineers should read closely 21 CFR Part 820, on Quality System Regulations (the QSRs), particularly Section 30 (820.30), which regulates Design Controls and, to a lesser extent, Section 70 (820.70), which regulates Production and Process Controls. Some of the requirements of 820.70 relate to quality systems and the validation of automated process software that can include design tools such as test software, compilers and code generators, which might be used by product designers.

All designers should be familiar with the QSRs. Part 820 that defines the QSRs is only 13 pages long; however, the entire Title 21 is over 700 pages long and is available online or in printed form from the US Government Printing Office. The FDA usually has a stock of the printed versions available for the asking at medical device trade shows.

Documents for the designer

The Design Controls (21 CFR 820.30) state that designers need to plan design activities, identify design inputs and outputs, verify and validate the design, plan for the transfer to manufacturing and the maintenance of the device design, and keep records of these activities. It sounds easy on the surface, but what exactly does it mean?

To help answer that question, the FDA has produced a large collection of publications. Figure 2 shows the relationship of the legislation to the regulations, guidances, and to industry standards. Of specific use to device designers are Guidances, which are methods proposed by the FDA for meeting the regulations. A manufacturer can propose any other method for meeting the regulatory intent, subject to acceptance by the FDA. The FDA also allows public web access to the inspection guides used by FDA auditors, including Quality System inspection guides.

Reduce paperwork by complying with standards

Recently, Section 514(c) was added to the Food, Drug and Cosmetic Act under FDA jurisdiction. This addition allows for proof that a device conforms to acceptable industry standards to replace detailed descriptive information or performance data, significantly reducing paperwork. Though not evident to a first time submitter, it is not the FDA's goal to create paperwork of no value. Instead, its aim is to provide reasonable assurance that design engineering and quality practices are being followed that are appropriate for the development of safe and effective devices.

To an FDA reviewer, conformity with a standard means a new device has been developed to be compliant with industry accepted performance specifications, and/or using processes generally accepted by the industry for successful development of medical devices. This recognition is sometimes referred to as the use of standards in substantial equivalence determination.

So, what standards should a designer use? If the FDA is unfamiliar with a standard, if there is a lack of specificity, or existence of device features not addressed in the standard, the FDA may reject substantial equivalence determination as sole 510(k) submission information. The best way to avoid this problem is to use the overall list of acceptable standards given by the FDA. Currently, over 500 standards are recognized, including: AAMI, ANSI, ASME, IEEE and ISO standards. Normally if an FDA-recognized standard is applicable to a device, the device is identified in the standard's Supplemental Information Sheet on the Center's Website that lists FDA-recognized standards.

A guide to documents for designers

The first task for a medical device manufacturer is registering its business with the FDA. A high level strategy for bringing a medical device to market is also critical. Small businesses are particularly challenged by the regulatory overhead, and need special consideration.

The potential device's classification will determine the design control rigor that will be required. The submission strategy will be determined by how novel the potential device is compared to similar devices already on the market. The manufacturer must decide if the device is exempt, or whether it must submit a 510k PMN or file a PMA. The design of the device can be affected by the submission strategy, especially if the manufacturer plans to make a substantial equivalence claim.

The medical device manufacturer must have a formal quality system in place. If the manufacturer is already familiar with the ISO 9000 quality standards, it may be relatively easy to map the ISO 9000 quality system the QSRs. The FDA also offers some advice to small businesses on how to comply with the QSRs.

If the device contains software, it receives increased scrutiny from the FDA. There are special considerations when applying the QSR design controls to software developed for a medical device, especially as it relates to the validation and verification (V&V) of the software. If off-the-shelf software is embedded in the device, it too, falls under the design controls of the QSRs.

FDA studies of device incidents and recalls have shown that a significant number of incidents are reported every year, because users of devices are confused or mislead by the user interface to the device. There are special guidances for the industry to suggest methodologies for developing user interfaces appropriate for the intended use of the device.

Special devices such as blood banks and imaging systems deserve special treatment, and as such have a special guidance to assist manufacturers of those devices. The CDRH website has numerous documents for ODE reviewers to guide them on their evaluations of specific device types.

In preparing device submissions, it can be useful for the manufacturer to understand how the FDA reviewers are trained to review submissions. Likewise, it is also useful, in preparing for an FDA audit, to understand how the FDA inspectors are trained to inspect manufacturers and to inspect quality systems.

Manufacturers who wish to comply with accepted industry standards can choose from a number of standards that deal with specific devices, and with development and quality processes. The AAMI and ANSI standards are generally accepted in the US market, ISO standards are internationally recognized. For standards specific to dealing with software, the IEEE has a large collection of standards that provide detail down to the document level.

Intertech, Norwood, MA, specializes in contract product development, verification and validation services, training, and consulting for medical device manufacturer.

Circle 144--Intertech Engineering Associates Inc, or connect directly to their website at www.rsleads.com/405df-144