transitioning from iso 9001:2008 to iso 13485:2003 going after medical device business asq las vegas...

TRANSITIONING FROM ISO 9001:2008 TO ISO 13485:2003—GOING AFTER MEDICAL DEVICE BUSINESS

ASQ Las Vegas section 705

December 16, 2009

Presented by Michelle M. Johnston, RAC

Advanced Quality System Solutions

The Medical Device Sector 2

$100B industry More “recession-proof” than other

sectors but hit in 2008/2009 Ageing US population (baby boomers) Growth in the following segments:

Cardiac Orthopedic (record level of private

equity) Neurotechnology (electronic devices

interact with the nervous system) 15k medical device companies >400k jobs

What the Heck is EN ISO 13485:2003?

3

Quality system standard intended for medical device industry

Format based on ISO 9001, process approach

Intended to promote harmonization in the global market

Regulators don’t recognize ISO 9001

What the Heck is EN ISO 13485:2003?

4

Emphasis on effectiveness of quality management system as opposed to improvement

More controls than ISO 9001

Higher the risk of the device=more controls

However, if you don’t manufacture the finished device, not all requirements are applicable

What the Heck is EN ISO 13485:2003?

5

It is the medical device manufacturer’s responsibility to define and implement the requirements.

As applicable, they will pass along the requirements to their suppliers, usually in the form of a purchase spec or Supplier Agreement

From A Manufacturer’s Perspective

6

Assurance that their suppliers have adequate controls in place

Selecting a supplier who is registered to ISO 13485 can mean reduced monitoring by the manufacturer

From a regulatory perspective, much greater scrutiny on how manufacturer’s evaluate and monitor their suppliers. High visibility recalls where problems originated at the supplier.

What are the Differences?7

Let’s examine some of the important differences between ISO 9001 and ISO 13485

What are the Differences?8

The biggest difference is the intent of the standard. In the regulatory world, customer satisfaction and continuous improvement are superseded by the safety and effectiveness of medical devices.

1.2 Application 9

Can only exclude section 7.3, Design and Development—however, other regulations may preclude this

Other requirements in section 7 may be non-applicable based on the nature of the medical device (sterilization, implants) or activities performed by the organization

Exclusions/non-applications to be justified

4.1 General Requirements10

The organization shall establish, document, implement and maintain a quality management system and maintain its effectiveness in accordance with the requirements of this International Standard.

4.2 Documentation Requirements

11

The quality management system documentation shall include:

Any other documentation requirements specified by national or regional regulations.

4.2 Documentation Requirements

12

There is a requirement or a particular type of document, commonly referred to as a Device Master Record.

The organization shall establish and maintain a file containing documents defining for each type / model of medical device product specifications and quality system requirements (process and quality assurance) for:

complete manufacturing, and installation and servicing, if appropriate

4.2 Documentation Requirements

13

The Quality Manual must outline the structure of the documentation used in the quality management system.

Typically 4-tier structure: Quality manual SOPs Work instructions Forms/records

4.2.4 Records14

The importance of records in the medical device industry cannot be overstated.

Universal rule: If it isn’t documented, it wasn’t done.

Documentation, documentation, documentation

Stringent rules regarding recording of information Blue or black ink only No crossouts, write overs

Most organizations have a Good Documentation Practices procedure and intensive training.

4.2.4 Records15

Retention requirements based on the lifetime of the device Retention equivalent to lifetime of device

or not less than 2 years from date of release for distribution

Other regulations have more stringent requirements

Most medical device manufacturers do not often destroy records

Records specific to the medical device industry Device History Record (traveler, work

order) Adverse event reports to regulatory

agencies

5—Management Responsibility

16

Management must maintain the effectiveness of the quality management system

Independence and authority of those who perform tasks affecting quality

Management rep promotes customer and regulatory requirements throughout the organization

Management review must include new or revised regulatory requirements

6—Resource Management17

Determine and provide resources to implement the QMS and maintain its effectiveness

And to meet customer and regulatory requirements

May need a documented procedure to satisfy other regulatory requirements

6.3 Infrastructure 18

Preventive Maintenance

Documented requirements for maintenance

Records maintained

6.4 Work Environment19

Can be very critical, dependent on the device

Controls must be established if the environment could adversely impact the medical device (concern for devices intended to be sterilized)

Cleanroom or environmentally controlled manufacturing Gowning Documented procedure for environmental

controls and monitoring No food and drink

6.4 Work Environment20

Controls for used (returned) product to prevent contamination

Personnel who work under special environmental conditions must be trained

6.4 Work Environment21

Can also include ESD controls Designated ESD work areas Wrist/ankle straps Daily testing or continuous monitoring Handling and storage of ESD sensitive

devices Records

7.1 Planning of Product Realization

22

Specific reference to ISO 14971—Medical Devices Risk Management

Medical device manufacturers would expect suppliers to have a documented pFMEA in place.

7.3 Design and Development

23

A documented procedure is required. More records are required Design inputs must include safety and

performance requirements Design inputs must be approved Records of design outputs are required Independent person required at design

review Clinical evaluation as part of design

validation

7.4 Purchasing

24

Documented procedure required FDA requirement: Where appropriate,

purchasing documents will include an agreement that the supplier will notify the manufacturer of any changes to the product or service so that the manufacturer may assess the impact of the change on the finished device

Unauthorized changes can have a significant impact and result in recalls by the manufacturer

Evaluation of suppliers is typically risk-based

7.5 Production and Service Provision

25

The availability of documented procedures, requirements, work instructions, and reference materials and reference measurement procedures as necessary

The implementation of defined operations for labelling and packaging

Record that shows manufacturing history including quantity. Record shall be reviewed and approved.

7.5 Production and Service Provision

26

Cleanliness of product and contamination control

A documented procedure is required Intended for devices sold sterile or Devices to be sterilized by the end user

Installation and servicing procedures and controls

Specific requirements for sterile and implantable devices

7.5 Production and Service Provision

27

Procedure for the validation of computer software

Records of these activities Procedure for ID and traceability—more

stringent controls or implantable devices Procedure to distinguished returned product

from conforming product Status of product—must be known at all times

throughout the product realization process Procedure for the preservation of product

conformity—handling, storage

7.5 Production and Service Provision

28

Procedure for devices with a limited shelf life or special storage conditions

Storage conditions will be controlled and recorded.

Procedure required for calibration activities

8.2 Monitoring and Measurement29

Specific requirements for customer complaints as opposed to customer satisfaction

Some types of complaints must be reported to regulatory agencies

8.2.4 Monitoring and Measurement of Product

30

Documented procedure for inspection activities

Specific requirements for active implantable and implantable devices

8.3 Control of Nonconforming Product

31

UAI disposition only if regulatory requirements continue to be met

Must record person who authorizes UAI Work instructions for rework activities Determine and document any adverse

impact of rework on the device

8.5.1 General (Improvement)32

Customer complaints Documented procedures for product

recalls Must record reason if a complaint is not

followed by CAPA Procedure for notification of complaints

to regulatory agencies

8.5.2 CAPA 33

Record the results of any investigation Determine the effectiveness of the

corrective action taken Same for preventive action

Industry Trade Shows34

MD&M shows—annually East coast West coast Midwest

Questions?35

Thanks for your time.

Michelle Johnston Advanced Quality System Solutionswww.adqvss.commjohnston@advqss.com858.722.4471