MDR UPDATE

MDR update FHI1 November 2017

Erik Vollebregtwww.axonadvocaten.nl

Agenda• The new MDR: timeline, transition regime and bottlenecks• The new MDR: main challenges• Focus on software• Focus economic operators• Focus on Convenant Veilige Toepassing Medische Technologie• Outline of transition plan

Where are you with your gap assessment and transition?

Some questions to help you sleep better• Who has a copy of the MDR or IVDR?• Who has read it completely?• Who understands it (sort of / completely)?

• Whose company has done a gap assessment?

• Whose company has done an impact assessment based on the gap assessment?

• Whose company made a transition / implementation plan?

• Whose company has decided for each of its devices if it will remediate, retire or replace it for the EU market?

• Whose department was allocated sufficient resources to implement the transition plan?

• Whose company thinks it will complete transition in time?

The new MDR: main challenges

The new MDR: main challenges

• No grandfathering

• Every technical file for every product must be revisited

• Gap / impact assessment

• A lot of new things in the MDR means that your current regulatory assumptions will not be valid anymore (e.g. reclassification), the underlying documentation and data is no longer valid (e.g. new technical file / DoC format) and your certificates will need to be renewed under the MDR

• Transition plan + execute plan

Main challenge for most companies• Overcome inertia and start attacking this thing – it will be a lot of work• Not ready in time means no more placing product on the market - there is

no grandfathering

No grandfathering and no moving of implementation deadlines

• All devices on the market are phased into the new system by the end of transitional period

• This means that you have to do a new conformity assessment under the new rules for all devices currently on the market or remove the product from the market

• If you don’t have a new CE under MDR or IVDR, you cannot place new product on the market after transition period

• Do not count on the EU “having to move deadlines because it will be chaos”, as this would be unprecedented

New steps to market

So what is new?

• Definitions

• Many definitions are changed and have been added

• Document requirements

• Prescribed format for technical documentation, declarations of conformity, Post Market Clinical Follow Up Plan, Risk Management Plan

• New functions and changes to existing functions

• Person responsible for regulatory compliance• Authorised representative heavily regulated and product liable

So what is new?

• Regulation of MaaS (medical device as a service)

• New supply chain regime (more about that later)

• Labeling and UDI (more about that later)

• Clinical evaluation and clinical investigation (more about that immediately after this)

• Product liability rules changed

• Insurance requirements• Facilitation of claims by competent authority• AR jointly and severally liable with manufacturer

So what is new?

• PMS and vigilance requirements changed

• Must be fitted in life cycle concept and continuous update of clinical evaluation

• QMS requirements changed

• elements of QMS system in MDR

So what is new?

• New parts and components regime

• Obligation of validation for part manufacturer• Performance changing parts are devices in themselves

• Changes to the systems and kits regime

• MDD systems/kits can now feature IVDs and other stuff

• EUDAMED database

Clinical evaluation

• MDR = More Data Really

• Focus on clinical data and clinical evaluation as a continued cyclicalprocess

• Manufacturer will need to

• collect far more Post Market data and will do so in a more structuredmanner under PMCF

• report more PMS data in new formats• improve traceability and implement UDI• interface with new EU Eudamed database• PMS will need to be brought into a continuous evaluation and

improvement loop, linking to continuous reviews of risk management and to an annual update of a public summary of safety and performance, as well as clinical evaluation

Clinical evaluation

Eudamed be ready in time?

Post Market under MDR

The new MDR: timeline, transitionregime and bottlenecks

If I ask companies about their transition plan, they mostly answer:

You do not want to end up here –bankrupt or sold to a competitor

Transitional regime: Article 120

Transitional regime

Slide: Gert Bos at DIA Euromeeting 2017

Transitional regime

Slide: Gert Bos at DIA Euromeeting 2017

Bottlenecks‘soft transition’

• Be careful with ‘soft transition’

• Article 120 (3) restrictions

• No significant changes in design and intended purpose• MDR level controls and obligations• Notified body cannot be changed anymore

Transitional regime bottlenecks –not for class I• Transitional regime works only for existing certificates or certificates

obtained during transitional period

• Big problem for any device currently class I partially (M/S) or fully self-certified

• Notably software and substance based devices

• Every up-classified currently class I device must be MDR certified before DoA

• In other words: the group with the least experience with CE certification processes will need to get it right in the shortest timeframe and with notified bodies that are just starting to settle in their new MDR designation

Designation of notified bodies

• No MDR certificate without MDR notification

• Unknown currently: will all NBs be notified at the same time or in a particular order?

• Notified body capacity

• Will my notified body complete MDR certification before DoA?

• If not, what alternative will it offer?• Will it differ if it’s not my fault certification is not complete?

• Will I be able to predictably and reliably ’reserve’ conformity assessment capacity?

• Will I be able to jump ship to another notified body if things go wrong pending MDR certification?

Concurrent privacy by design requirements under GDPR• General Data Protection Regulation has already entered into force,

transitional period ending 25 May 2018

• Will apply to any device that processes personal data, both on hardware and software level – possible overlaps with MDR

• Relevant for everything clinical

• Requires privacy by

• Design• Default

• Requires cybersecurity measures

No grandfathering and no moving of implementation deadlines

• All devices on the market are phased into the new system by the end of transitional period

• This means that you have to do a new conformity assessment under the new rules for all devices currently on the market or remove the product from the market

• If you don’t have a new CE under MDR or IVDR, you cannot place new product on the market after transition period

• Do not count on the EU “having to move deadlines because it will be chaos”, as this would be unprecedented

#Brexit

• Is your notified body located in UK?

• After Brexit the NB may not be notified anymore if no mutual recognition deal is in place

• Is your business dependent on the UK market?

• Watch for a mutual recognition deal to shape up

• Current UK intention is “Norwegian deal” – in other words ‘sort of EEA member’

• Have your benefits from the internal market but none of other stuff

Transition planning

Focus on software

Software• MDR / IVDR

• New design / security requirements

• New classification rules• Transitional regime• GDPR

Classification MDR

• Under the new rule 11 all CDS and monitoring is class IIa or higher and class III becomes available for software

• Self-certification will be the exception rather than the rule

MDR and IVDR Design requirements• Apply to both software run on a device and software as device

• We don’t know yet if

• the same standards will be harmonized• new ones will be harmonized

EN IEC 62304

Design requirements

Active devices requirements (so ANY IoT enabled device):

Security design requirements (art. 32)Controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:

(a) the pseudonymisation and encryption of personal data(b) the ability to ensure the ongoing confidentiality, integrity, availability and

resilience of processing systems and services; (c) the ability to restore the availability and access to personal data in a

timely manner in the event of a physical or technical incident; (d) a process for regularly testing, assessing and evaluating the

effectiveness of technical and organisational measures for ensuring the security of the processing.

Take account of risks that are presented by processing, e.g. accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.

Overlap of risks and different approachesMDR / IVDR• Security by design aimed to safeguard safety and performance (Safety,

Reliability and Availability (SRA) for cyber physical systems)

GDPR• Security by design and default aimed at data integrity (Confidentiality–

Integrity–Availability (CIA) for corporate processes)

Map security risks under GDPR that are also (partially) safety and performance risks under MDR / IVDR

• Those risks are subject to AFAP reduction by means of design insofar as they concern the device (GSPR 2 and EN ISO 14971:2012 ZABC annexes)

Overlap of risks and different approaches - nice model

GDPR orientation

MDR / IVDR orientation

Marry the different approaches at an early stage• Design all security aspects into software, not only SRA but

also IUA• Integrate privacy by design and default in device design and

risk management

• PIA is part of design iteration cycle and risk management driven (re)design cycle

• Privacy by design / default assumes that software cannot bedeployed commercially when not GDPR compliant

• Make data protection part of software design life cycle(not only for the 1.0 version)

• Plug privacy into software QMS processes

Read the whole story

Digital Health Legal, April 2017, p. 4-9

Focus on economic operators

Supply chain controls: chapter II MDR

Manufacturer Importer Distributor

EndUserPost market surveillance and vigilance

Regulatory compliance of device

Verify compliance Verify compliance

Supplier

Unannounced NB inspections

Definitions regarding economic operators

Definitions regarding economic operators• Who is the importer in

case of a software update that is directly downloaded to the medical device?

• Depends:• Is there a

reseller/distributor in the EU?

• Placing on the market does not require a physical handover

• Manufacturer cannot be importer too (importer must be based in EU)

• Possible that there is no importer

Obligations economic operators

New stuff in chapter II compared to Decision 768/2008 re EOs• Includes some provisions that create ‘new’ EOs, new liability

• Cases in which obligations of manufacturers apply to importers, distributors or other persons (art. 14)

• Repacking / relabeling regime – medicinal products modelled but stricter than CJEU Servoprax judgment

• AR jointly and severally product liable (art. 11)• PRRC (art. 15)• Reprocessing (art. 17)• DOC to be updated continuously and translated in languages required

by the Member State(s) in which the device is made available (art. 19)• Cases where parts / components suppliers must validate part /

component or be manufacturer of device (art. 23)

Focus on Convenant

Focus on Convenant

• Convenant is aimed at procedures that a healthcare institution must have

• Convenant version 3 in the making – MDR compliant convenant

• MDR / IVDR defines health institution• Ties into a number of obligations and national policy options under MDR

/ IVDR, e.g.

• Information to patients about use of reprocessed single use devices and genetic testing

• Outsourced reprocessing

3. Invoeringsfase• 3.10: De zorginstelling heeft een procedure waarmee voorafgaand aan

de installatie en/of het initiële gebruik van een medisch hulpmiddel wordtzeker gesteld dat dit medische hulpmiddel op correcte wijze aansluit bijde bestaande infrastructuur van medische hulpmiddelen en IT-netwerken en bij overige infrastructuur.

• Annex I chapter 17:

• 17.4. Manufacturers shall set out minimum requirements concerning hardware, IT networks characteristics and IT security measures, including protection against unauthorised access, necessary to run the software as intended.

3. Invoeringsfase: UDI

• 3.5 / 3.6 procedure for identification and registration devices, procedure for management of those data

• Article 27 (1) (c) and (9) MDR / article 24 (1) (c) and (9) IVDR: UDI comprises among other things of storage of the UDI by economicoperators, health institutions and healthcare professionals, for:

• Class III implants (health institutions shall store and keeppreferably by electronic means the UDI of the devices which theyhave supplied or with which they have been supplied)

• Any other devices determined by Commission by implementingact or encouraged/determined by Member State

4. Gebruiksfase: Single use devices reprocessing• 4.2 De zorginstelling heeft een procedure voor het reinigen,

desinfecteren en/of steriliseren van medische hulpmiddelen in overeenstemming met de voor het medische hulpmiddel geldende specificaties.

• Health institution may qualify as ‘manufacturer’ under MDR and is product liable too for reprocessed device if it reprocesses single usedevices or outsources that activity (article 17)

• However subject to elective national exceptions• Subject to product liability regime in MDR (article 10)

• As regards single-use devices that are reprocessed and used within a health institution, Member States may decide not to apply all of the rulesrelating to manufacturers' obligations laid down in this Regulationprovided that they ensure that (article 17 (3))

4. Gebruiksfase: Single use devices reprocessing• Article 17 (4) Member States may choose to apply the requirements also

as regards single-use devices that are reprocessed by an externalreprocessor at the request of a health institution, provided that thereprocessed device in its entirety is returned to that health institution andthe external reprocessor complies with the same requirements as thehealth institution

Single use devices reprocessing

As regards single-use devices that are reprocessed and used within a health institution, Member States may decide not to apply all of the rulesrelating to manufacturers' obligations laid down in the MDR provided thatthey ensure that:

• safety and performance of the reprocessed device is equivalent to thatof the original device and the requirements for HPDs (article 5 (5))

• the reprocessing is performed in accordance with CS

• Also applies in case of single-use devices that are reprocessed by anexternal reprocessor at the request of a health institution, provided thatthe reprocessed device in its entirety is returned to that health institutionand the external reprocessor complies with the above requirements

• Unclear if it applies to health institutions reprocessing for eachother.

4. Gebruiksfase: Toepassing enonderhoud

4.2 De zorginstelling heeft een procedure voor het reinigen, desinfecterenen/of steriliseren van medische hulpmiddelen in overeenstemming met de voor het medische hulpmiddel geldende specificaties

Article 2 (1) – definition of medical device expanded:

• Placing these products on the market or putting them into service means that the health institution becomes a medical devices manufacturer

.

4. Gebruiksfase: Toepassing enonderhoud• 4.10, 4.11: internal, external competence of maintenance staff• 4.13, 4.18, 4.20: De zorginstelling heeft een procedure voor het plannen

en uitvoeren van preventief / correctief onderhoud, zowel uitgevoerddoor interne als door externe technici. De procedure stelt ook het gebruik van onderdelen zeker.

• Article 23 provides for replacement parts and components

• If no change performance or safety characteristics or its intended purpose: supplier must ensure that the item does not adversely affect the safety and performance of the device. Supporting evidence shall be kept available for the competent authorities of the Member States (article 23 (1) MDR)

• If item significantly changes the performance or safety characteristics or the intended purpose of the device: item = device for MDR purposes and requirements (article 23 (2) MDR)

• Potential fault based liability for hospitals that do not verify article 23 requirements compliance of suppliers / maintenance service providers

Information obligations for hospitals• Information about use of reprocessed single use device (article 17 (3)

MDR)• Supply of implant card (article 18 (2) MDR)

Transition planning and plan making

An overall plan could look like this

www.axonlawyers.com

THANKS FOR YOUR ATTENTIONErik VollebregtAxon LawyersPiet Heinkade 1831019 HC AmsterdamT +31 88 650 6500M +31 6 47 180 683

E erik.vollebregt@axonlawyers.com@meddevlegalB http://medicaldeviceslegal.com

READ MY BLOG:http://medicaldeviceslegal.com