Top 3 Document Management Tips for Medical Device Companies

In the medical device industry, one absolute—which shows no signs of abating—is the need to maintain documentation. We’re talking documentation to demonstrate you have a compliant quality management system, documentation to demonstrate you design and develop products to meet design controls, and documentation to demonstrate you are addressing risk management, to name a few.

Documents and records serve as proof that your medical device company utilizes compliant document management practices when designing, developing, and manufacturing health industry products.

And like it or not, how you manage your documentation can make or break you.

That’s why it’s essential to take the time to consider how your company will manage all of its documents and records – not just now, but long into the future.

To help you out, we’re sharing 3 key tips to consider when looking to build a system for managing your documentation that works for you and your organization.

Tip #1: Develop a Document Management Strategy

Develop a document management strategy and do it early. To get started:

Map out all the types of documents and records that will be generated throughout medical device product realization.

Remember, as far as FDA and other regulatory officials are concerned, if you didn’t document it, it didn’t happen. So pay particular attention to what kinds of documented evidence you will need to demonstrate you’ve carried out the various QMS activities according to planned arrangements.

During product development, you need to document, for instance, your design and risk management activities. Related records need be maintained or made accessible via a Design History File (DHF).

As well, you’re likely working with a number of suppliers. Think supplier evaluation records, qualification records, and an Approved Supplier List.  

You are defining manufacturing processes, too, and establishing Device Master Records, the “recipe” for your company’s devices.

Let’s face it: once you go to market, you have a ton of production and post-production documentation and records to consider. They include, to name just a few more:

• Device History Records – evidence of manufacturing builds

• Complaints and Customer Feedback

• Corrective Actions

• Non-conformances

• Change Orders

We’re just skimming the surface here. Again, you need to spend some time reviewing and listing the regulatory requirements to identify all the documents and records you need to generate and maintain.

Beyond locking in the types of documents and records you will be generating, there are a few other considerations to weigh when devising an appropriate document management strategy:

• Figure out who the owner of each document and record should be. Do this right away to avoid confusion. Not having clear document owners leads without fail to trouble down the road that can be quite difficult to disentangle. Make these decisions when your system is flush with flexibility.  

• Determine how long you need to keep all this documentation.

• Figure out where you are going to keep your documentation and in what form (see Tip #2).

• Think 3 – 5 years into the future. This means your strategy should plan for scalability and flexibility.

Finally, as you develop your document management strategy, be sure to keep key stakeholders in the loop. Getting them on-board early on is essential.  

NOTE: Even if your company already has established procedures, it might be a good idea for you to re-evaluate the overall document management strategy.

Tip #2: Stop Using Paper-based Systems

Did you know that over 50% of medical device companies are still suffering with paper-based document management systems?

It is 2015.

Electronic document management systems have loads of advantages that even the youngest medical device startup can appreciate.

They can be configured to automate most if not all of your company’s document control processes in accordance with the range of regulatory frameworks it’s obligated to abide by, whether 21 CFR Part 11, 21 CFR Part 820, Annex 11, ISO 13485 or HIPAA.

Why do so many medical device companies still struggle with document management tools?

Do you think general purpose tools like Dropbox and Google Drive can work to “meet” your document management needs?

Do you really enjoy keeping track of all that paper?

I suspect the simple answer comes down to perceived costs of electronic document management system.

OK, I admit most document management systems aren’t exactly being given away. You will have to spend some money in order to implement document management software.

But look at it this way:

If your document controller earns, say, $60k a year, yet spends 20% of her time wrestling with nonconforming documents and unintuitive management software only to have the pile of CAPAs that emerge from the next surveillance audit be devoted to document and record management issues, well, it doesn’t take a genius to see that document management systems:

• Very quickly pay for themselves (the math is easy to do so do it.)

• Boost employee morale (“What? I don’t have to spend my afternoon chasing people for approval signatures??? YEAH!”)

• Increase regulatory conformity (not just on the documentation front. With less time spent fixing documents you have more time to spend addressing other areas of weakness when preparing for audits)

• Free employees up to use their minds for tackling the challenges that actually matter (chasing missing records doesn’t meet this criteria)

• Are the best way to address most document and record-oriented nonconformities (“A previous version went missing? Hmmm, maybe the quiz in our “Document Control Made Easy in 1.5 Billion steps” training module needs to be re-validated. Yeaaah no).

• Increase security (think audit trails, electronic signatures, access logs)

Of course there are always exceptions. Despite boasting all of the bells and whistles, the document management system you land on may turn out to be a dud.

So make sure that when you’re on the hunt for the right document management system, you bring along the right person with the right knowledge base to ask the right questions.

As you know, FDA’s 21 CFR Part 820 and ISO 13485 have some very specific expectations when it comes to documents and records. So please please PLEASE make sure the solution you end up choosing is designed with this in mind.

Tip #3: Follow the Document Management Procedures

Yes, this tip sounds so simple. Of course you’ll follow your own procedures for document and records management!

Yet despite your best efforts, they will get derailed from time to time.

So be a stickler! Make sure your medical device company follows established procedures. When the procedures call for a specific document or record, make sure there is actual documented objective evidence to prove that it happened.

I can assure you that if you are ever inspected by FDA or audited by ISO, the auditor will definitely be seeking objective evidence.

OK, document management is far from sexy. Yet, document management form the foundation of your med device company.

One way to help you evaluate whether established procedures are being followed is internal auditing. Internal auditing is a way to self-police and ensure that documents and records exist. It’s also a regulatory requirement.

Yes, regardless of how good your strategy is and how well-written your procedures are, there will be numerous issues identified once your quality system procedures are put into practice.

When this happens, make adjustments.

Adopt a mindset of continuous improvement.

And invest in a document management solution that will take the headache out of document control.

This co-authored article originally appeared as a guest post on Quality Digest and is being republished here with approval.

Co-author, Alex Morris

Based in Toronto, Canada, Alex Morris, MA, RAC, is a dedicated regulatory affairs and quality assurance consultant within the medical device industry. He designs, authors, implements and trains to 13485-compatible quality management systems. Regulatory and quality issues affecting software medical devices are his specialty. He is versed in several standards and regulatory frameworks. Alex has assisted multiple MedTech companies succeed at using regulatory and quality as tools for driving compliance and profit. He founded and leads Frontline Health Consulting, a boutique consulting firm laser-focused on assisting small to medium-sized medical device companies achieve their quality, regulatory and information security goals. Alex is an ISO 9001 IRCA-certificated Lead Auditor and holds a Regulatory Affairs Certification (RAC) from the Regulatory Affairs Professionals Society (RAPS).