4 Key Compliance Issues for Medical Device Companies

The goal for most creators of new medical devices is to be able to get them to market as quickly as possible, right? So, what commonly puts roadblocks in the way?

Yep, you’re probably aware that for good reason, the medical device industry is heavily regulated and you are required to follow fairly strict guidelines for quality management systems. There is commonly a lot of confusion over those regulations and often, important compliance issues are missed.

What are the common issues and what happens with these non-compliances? Let’s take a look:

First, The Consequences...

The FDA may come and audit you at any time; that should be a reasonable expectation. If you’re manufacturing Class II or III products, you can expect to see them every two years, perhaps more often if they found any issues.

The first possibility if they find anything non-compliant is that they issue you with a form 483. This is where you really should be sitting up and paying attention. The 483 form outlines and notifies management of any objectionable conditions found by FDA inspectors. In their own words:

Observations are made when in the investigator’s judgement, conditions or practices observed would indicate that any food, drug, device or cosmetic has been adulterated or is being prepared, packed, or held under conditions whereby it may become adulterated or rendered injurious to health.

What happens next? Well, that’s up to the FDA and tends to be taken on a case by case basis. At the very least, you have the 483 and you need to take action on it. You have 15 days to respond. We've previously written about how to respond here.

In some cases, if they feel the situation warrants it, they may go ahead with issuing a warning letter. Typically, companies have found that even the most simple warning letter can take up to 6 months to fix up.

Here’s an example we know of recently; one larger company needed to hire 200 external consultants to address problems outlined in a warning letter. To put a bit of math around that, they would usually be paying them at least $200 per hour and the consultants would work 40 hour weeks for six months.

Over that time, the company was also on the hook for paying the accommodation, meal and travel expenses of the consultants. Add all of that up, any costs of equipment to rectify the situation, plus the additional time and money on staffing spent before the product can be released and you have a very costly situation, possibly running into the millions of dollars.

The other part to this is potential damage to your company's reputation. FDA warning letters can be found in the public domain, with your company name on them and outline why you received the letter. Even when you do the work to correct the reasons for the letter, it is out there for anyone to see.

Beyond warning letters, the FDA as a government body has many options for punitive action under the law. We’ve seen companies face large fines and custodial sentences are also possible, although rare.

Key Compliance Issues

In 2016, the FDA handed out 934 483 observations to medical device companies, no small number! Every year, similar themes seem to crop up as to which areas are prone to non-compliance and 483 issues; here are some of the common areas:

1. CAPA (Corrective and Preventive Action)

We’ve recently looked at CAPA and it’s importance for medical device development. The regulations can be found at 21 CFR 820:100 and 100b (documentation). By far, one of the most commonly cited areas for 483 forms in 2016 was non-compliance with CAPA regulations, most often that “procedures for preventive and corrective action have not been (adequately) established.” Second to this for CAPA was that procedures were not adequately documented.

The best remedy for this is to establish a CAPA procedure early as part of an overall Quality Management System. In general, your QMS is not something that should be left until later in your development process - some companies think they’ll “worry about it later” and focus on designing a working prototype first, but you need that QMS in place so that you can properly document everything.

The other thing to remember here is that having a QMS is not optional - it’s an expectation according to the law. Get on it early to ensure that your company is abiding by regulations for QMS.

2. Complaint Procedures

Every medical device company is required to follow a robust procedure for complaints as outlined in 21 CFR 820.198. A lack of or inadequate complaint procedures as per this section of the legislation was the second most common compliance issue in 2016.

This won’t really come up while you’re still in the process of designing and building your device, but it’s certainly something to maintain awareness of so that you have a head start on getting it right once you’re ready to sell into the market. If your complaint-handling system is not up to standard, it can cause recalls and sometimes product seizure.

To avoid this you need:

• Clearly documented complaint procedures that are followed by your company.
• To be able to close out any complaints in a timely manner.
• To implement a strong management strategy to track and monitor complaints.

This is another one where we’d recommend keeping things tidy by using a centralized, electronic QMS. You must be able to point to exactly what a complaint was and how it was rectified, so keeping all records in one place is a big help.

3. Medical Device Reporting Procedures

You’ll notice there’s a bit of a theme here - reporting under various parts of the law is a huge issue. The third most common violation in 2016 was a lack of written medical device reporting (MDR) procedures as laid out under 21 CFR 803.17.

The most common deficiencies included:

• No written procedure or plans to implement a written procedure that would satisfy the requirements of section 803.17.
• Omitting important terms defined in 803.17, such as “cause or contributed,” “become aware,” “malfunction,” “MDR reportable event,” and “reasonably suggests.”
• Omitting key descriptions, such as when a certain procedure will be required to kick in.

This is another area that the FDA is quite big on enforcing, so it’s a good idea for manufacturers to review their written MDR procedures and ensure that they are meeting the code.

4. Nonconforming Product Procedures

You might wonder, what on earth is a non-conforming product? It sounds like something very serious as first glance, but in reality, the event of non-conforming products or materials is common in medical device manufacturing, and is expected as long as the appropriate controls are placed around them.

Here’s how the FDA describes nonconforming product under 21 CFR 820:90 (a):

Control of nonconforming product. Each manufacturer shall establish and maintain procedures to control product that does not conform to specified requirements. The procedures shall address the identification, documentation, evaluation, segregation, and disposition of nonconforming product. The evaluation of nonconformance shall include a determination of the need for an investigation and notification of the persons or organizations responsible for the nonconformance. The evaluation and any investigation shall be documented.

This was the fourth most common cause of 483 notifications in 2016. The main problem was that procedures for control of nonconforming product were not adequately in place. Quite simply, nonconforming products are meant to be identified and kept segregated from those which are conforming.

Note here: You really shouldn’t have large quantities of nonconforming product, if you do, you may need to halt production and get back to your CAPA procedures.

Prepare Your Company…

We’ve highlighted just four of the most commonly-occurring 483 notification reasons from 2016, but it’s important to know that there are more on the list to be prepared for. FDA publishes summary data on 483 notifications in order to help promote awareness, so stay on top of what’s happening and keep your company prepared.

Remember that if you do receive a form 483, this should be your wake-up call to take corrective action before the situation can escalate. Warning letters are not only in the public domain, but they take a lot of extra time and resources to take care of.

Know that an FDA audit should be expected and stick to a rule where you’ll be prepared if they enter your facility tomorrow.