QMSR: The Future of FDA's Quality Management System Regulation for Medical Devices

FDA has proposed a new rule to align its Quality System Regulation (QSR) with ISO 13485:2016, the international standard for medical device quality management systems. How will, what's being referred to as Quality Management System Regulation (QMSR), affect the medical device industry and regulatory bodies?

In this episode of the Global Medical Device Podcast Jon Speer and Etienne Nichols talk to Mike Drues of Vascular Sciences and George Zack of Two Harbors Consulting about the changes unfolding and the pros and cons of harmonization between QSR and ISO 13485:2016—a standard not governed by FDA.

LISTEN NOW:

Like this episode? Subscribe today on iTunes or Spotify.

Some highlights of this episode include:

• FDA is not expected to adopt ISO 13485 or any other standards across the board. Instead, it will take a piecemeal approach. Any future revisions to the 2016 version of the standard would need to be evaluated before becoming part of U.S. regulations.

• How often are periodic changes and updates made to QSR, ISO standards, and FDA guidances? Do changes even need to be made or are they a waste of time and money? Good regulation is agnostic of time and technology.

• Government bodies in different parts of the world want to protect their citizens. Will there ever be global harmonization for quality? Are the most important principles of quality a function of geography? No, quality is quality.

• The timeline to transition is one year, but companies and inspectors may need or want more time due to a limited number of resources and notified bodies.

• If a company does what it should do for the safety and efficacy of medical devices, it should really be a tiny or no leap at all to make changes. The only changes are in the paperwork and forms.

• Medical device professionals should know about ISO 13485. If they do not know about this standard, whether it is required or not, that could be a problem.

• For those adhering to ISO 13485, if there are new requirements that make sense from a biology and engineering perspective, that’s the way to do something.

Links:

ANSI/AAMI/ISO 13485:2016 Handbook

NIST's "ABC's of Conformity Assessment"

International Medical Device Regulators Forum (IMDRF)

ISO 13485:2016

21 CFR Part 820 - Quality System Regulation

FDA - Design Control Guidance for Medical Device Manufacturers

FDA - Case for Quality Program

FDA - Medical Device Single Audit Program (MDSAP)

European Union Medical Device Regulation and In Vitro Diagnostic Regulation (EU MDR and IVDR)

Mike Drues of Vascular Sciences on LinkedIn

George Zack of Two Harbors Consulting on LinkedIn

True Quality 2022

Greenlight Guru YouTube Channel

MedTech True Quality Stories Podcast

Greenlight Guru

Memorable quotes from this episode:

“They are not going to adopt ISO or any other standards across the board. They’ll take sort of a piecemeal approach, and I think that makes sense.” Mike Drues

“When was the last time that the design control guidance was updated since it was created in 1997? The answer is, never. That guidance has remained exactly the same.” Mike Drues

“Good regulation is timeless.” George Zack

“While it might not be a huge shift, I think it is a step in a direction of many steps toward some sort of global harmonization.” George Zack

Transcription

Announcer: Welcome to the Global Medical Device podcast, where today's brightest minds in the medical device industry go to get their most useful and actionable insider knowledge, direct from some of the world's leading medical device experts and companies.

Etienne Nichols: Hey, everyone. If you haven't heard, the FDA came out with a proposed rule to align the current QSR, quality system regulations, with ISO 13485. They're calling it the QMSR. And that's something that we're going to be talking about today. How is this going to impact companies? How are these different changes going to affect medical device companies? Discussing with us today is Mike Drues, President of Vascular Sciences, which is an education, training, and consulting company. Offers a broad range of services to medical devices, pharmaceutical, biotechnology companies. And also with us is George Zack, who is the Principal and Co- founder at Two Harbors Consulting. He's a leader in the industry with 20 plus years experience in multiple aspects of process improvement, compliance, and regulation, quality management, implementation, software development, methodologies, project, and release management. If you haven't seen his LinkedIn, he releases a lot of good things about the industry that you can learn from easily on the go. Check that out. Without any further introduction, we'll go straight to the episode. And enjoy listening. Hey, everyone. Welcome back to the Global Medical Device podcast. My name is Etienne Nichols. I'm the co- host of the podcast. With me today as Jon Speer. Also, we have today with us George Zack and Mike Drues, a few of the leading minds within the medical device community. And today, we're going to be discussing the FDA's proposal to align the quality system regulations, more commonly known as maybe the QSR, with ISO 13485:2016. So if you're interested in submitting comments on that rule, you have until May 24th, 2022. I'll put the link in the show notes. But yeah, we're going to be discussing that today. A few different things that happened, that proposed rule on the CFR part 820, just for some background, part 820 and part 4 came out on February 23rd, and a followup meeting with industry experts occurred on March 2nd. As of today's recording, that was yesterday. So if we reference some of the conversation throughout this conversation that happened yesterday, that's what we're referring to. So just a little bit of background there. But yeah, I'm excited to be here with you all. Do you guys want to say a little bit about maybe your background? And we can start with George.

George Zack: Hello. My name's George Zack. I've been a long time listener to this podcast. I must say I'm very honored and humbled to be on with two of the giants that I've had in my ears for so many years. My favorite regulatory podcast that's out there. Looking forward to this conversation with all of you.

Etienne Nichols: Mike, you probably don't need any introduction, but here's your chance.

Mike Drues: Well, George, thank you for your kind words. Happy to share the stage. Be careful. You're going to give me a bigger head than what I already have.

George Zack: I'm softening you up.

Mike Drues: Most of the audience knows me already, but I'm looking forward to having this discussion, if you will, about a very important and a very timely topic of what's new and exciting in quality management systems.

Etienne Nichols: So one of the things the FDA proposed was incorporating 13485 by reference. So curious what you all think about the pros and cons of referencing 13485 by a standard not governed by the FDA. Just immediate thoughts that you guys all have.

George Zack: Well, this is something that we've heard about obviously for four years, right? We've heard the agency talking about going to this standard for a while. And so I think some of the fundamental questions as to what that means are still out there. I don't think that was resolved necessarily by the proposed rule. As we know, you just don't go and Google ISO 13485 and get the standard. That is just something that you're going to have to purchase. That's an interesting wrinkle probably as a part of this, as to you have to go out and get something that's licensed from an IP perspective. As the standard changes, which it doesn't seem like it's going to change in the near term, but is the agency still going to just point to that latest rev of it? Or are they going to say," We are sticking with the 2016 version," and then they're going to move along with how the standard changes in a more careful fashion? So I think those are still open ended questions that I don't have a good handle as to how we're going to treat that going forward. What do you think, Mike?

Mike Drues: Well, I think I would just reiterate what FDA has been saying for probably the last 20 years, at least with regard to standards overall. And that is the FDA has said publicly many times, and I agree with them on this, that they are not going to adopt ISO or any other standards across the board. They'll take a piecemeal approach. And I think that makes sense. Every single week, almost every day as a professional biomedical engineer, I read regulation. I read standards that make absolutely no sense, and yet people follow them anyway. So I don't like that we're going to just accept everything point blank without any thought. And referencing the meeting that Etienne mentioned a moment ago, one of the things that FDA announced in that meeting that I happen to agree with is they said that any revisions to the standard in the future, specifically 13485, which everybody knows is an incredibly broad standard and can be interpreted, let's say in many, many different ways, but any future revisions to that standard would need to be evaluated before making their way into US regulation. So I agree with that. I think to me that makes sense, not just as a regulatory or a quality professional, but also as a professional biomedical engineer. Jon, what do you think about that?

Jon Speer: Well, as George mentioned, I think the first time we started hearing hints about this FDA moving towards broader adoption of 13485, it happened a few years ago. And probably for obvious reasons, the FDA was pretty silent on that over the past couple years, I think in large part probably because of the pandemic. It was pulling their resources in other directions. And when the announcement came out," Oh, there's this new document," and that sort of thing, it's like," Oh, this is going to be interesting." I think in my career, this word harmonization has been uttered often. In fact, there used to be an entity known as the Global Harmonization Task Force. It now still exists. It's IMDRF now. But I think it's interesting that we want this from a practitioner point of view. I think I'll leave that as an open- ended question. But it gets way more complicated than that, because we have different government agencies in various parts of the world that are obviously trying to make sure that the laws and the regulations that are in place in those different countries are there to protect their citizens. And so can we ever get to a point where there's true harmonization? And if we did, will we be better off? These are some open- ended questions that I'm contemplating in my own mind. So...

Mike Drues: I was going to say, if I may add, Jon, I'm glad you mentioned global harmonization, because that's one of the things I was hoping to bring up today. In the past, global harmonization has always been in the context of the regulatory system.

Jon Speer: Right.

Mike Drues: In other words, why does it make sense to have to jump through different regulatory hoops, just simply as a function of where on the earth you happen to be standing at the time? Why can't we have one global regulatory framework that everybody jumps through? And if you meet those requirements, then you can sell your device anywhere in the world. What we're talking about today is the quality equivalent of global harmonization for the regulatory system. And the other thing that I thought that I would mention quickly, in referencing FDA's meeting yesterday, they also mentioned that most of the sub- parts of the quality system regulation that are proposed are, to use their phrase, substantially similar to what is already there. And so as a regulatory consultant, I take the pun purposely. Is this new quality system framework, is it substantially equivalent to what we already have? If so, then it would be like a 510( k). If it's significantly different, are we talking about de novo? So I'm purposely trying to use some regulatory puns here to interject into this quality discussion. What do you think?

George Zack: Is this a 510( k) change or a 510( k) that the agency's submitting, Mike, or is it a de novo?

Mike Drues: Indeed. That is exactly the question that I'm asking, George.

Jon Speer: But it's interesting to me. I remember when 13485 was last revised back in 2016. Greenlight was just started maybe a couple years prior to that. So this one's interesting because that change, that industry standard change, it put the industry in a lot of flux. Boy, it escapes me for the moment. But the previous version of ISO 13485, I think it was 2003 or something like that. And fact check me unless one of you all know. But it hadn't changed in a long, long, long time, at least the words in the standard. To me, the latest, greatest version of 13485, there was nothing dramatically new in that standard. And Mike, you and I have talked about the more things change, the more they stay the same. I think what that standard, what was different about it is the interpretation of the application of the specific requirements had evolved over the decade or so prior to the previous version. So the 2016 was just a catch up. It was just to make sure that this is reflecting latest, greatest thinking. And the last comment I'll say, at least for the moment, before I hear your all reaction, is the 2016 version, to me, the difference is between QSR and 13485 in a huge, huge way. It used to be QSR and 13485, they were 80 or so percent the same or very, very similar. But with the 2016, I think maybe up that up to closer to 90, 95% similar. So to me, they're already there. And so I was like," Why make this movement?"

Mike Drues: Well, Jon, it's interesting. And George, I would love to hear your thoughts on this as well. You mentioned the periodic changes, the updates to 13485, plus to the QSR in general. But Jon, when was the last time that the design control guidance-

Jon Speer: True.

Mike Drues: ...was updated since it was created in 1997?

Jon Speer: True.

Mike Drues: The answer is never. That guidance has remained exactly the same since it was originally created in 1997. I would argue that good regulation, whether we're talking about regulation in the regulatory sense or here in the quality sense, good regulation is totally agnostic of time. And it's also totally agnostic of technology. What do you guys think of that? Is that naive, or did I just fall off the turnip truck yesterday? Do we need to keep making changes? And regrettably, a lot of these changes are being made, maybe you guys might disagree, because people are not doing things that they should be doing.

Jon Speer: Yeah.

Mike Drues: And let's be honest, people and companies are doing things, stupid things, boneheaded things, things that should not be done. That's why I think we have a lot of this new regulation going into effect. I think there's a lot of parallels here to the new regulation going into the effect for medical devices in the EU. The whole reason why all of that regulation is going into effect is because of, regrettably, some of the high profile problems that we've had with medical devices in the past in the EU and the other places. So my question to you guys is, six months from now, a year from now, five years from now, 10 years from now, if these changes don't lead to safer and more effective medical devices, isn't this a colossal waste of time and money?

George Zack: Okay. I'll take a crack at this. So one, yes, I agree. Good regulation is timeless. I've heard you two speak, Jon and Mike, about the timeless nature of 820. 30, the design control part of the regulation. And not trying to speak on your behalf, but I think that, obviously since that was written, we've seen in the last 20 something years that that's been around the onset of software as a medical device. And it truly, in 1997, when we were all using Windows 95, the capabilities that are out there is from a inaudible perspective, what they are now, what do they... Forefathers did not think of those sorts of things when writing that part of the regulation. But even though many of my friends in software would say," Oh, the regulation's outdated," I disagree with them. I think 820. 30, hey, you have inputs, you have outputs, you have verification, validation, you plan, you have reviews. Consider risk. Maybe there should have been more about risk and 820.30 than what there is. And we actually see they're trying to bolster that with this proposed rule. But it's still timeless. Now, adjacent, just to give you a different case, I think most of us would look at part 11 and say," Hmm, that's kind of outlived its usefulness, I think, in terms of how it's written." Now, there's a lot of great principles in it. But in terms of how it's being applied by many organizations, that's a regulation that perhaps is not as timeless. So I agree with what you said, Jon. It's like I've been waiting. I don't know. I felt like a kid waiting for the next Star Wars movie to come out. I've been waiting for this proposed rule to come out for so long. I was like-

Jon Speer: Yeah.

George Zack: "Okay, great. Darth Vader is Luke's father. What are we going to get with this proposed thing?" And I was expecting this big rewrite of 820. And then frankly, I've heard it described more as a gap bridging measure, where they're saying," We're adopting this thing. And here's the places where we want to go a bit further in terms of our definitions, or we're going to make this particular thing clear." I think on whole, you can make the case," Well, is that a big colossal waste of time?" I think, while it doesn't get us to global harmonization, I think it's a necessary step. And I don't think it's as huge. And I may be wrong. I've yet to talk to a lot of people in industry as to their perceptions of this. But I don't think it's for the sites that are not doing boneheaded things or the manufacturers that are not doing boneheaded things. If you're already compliant, and maybe you're just distributing in the US and you don't have a 13485 certificate because you don't need one, I don't think it's a huge lift to shift to some of these considerations. Your thoughts.

Jon Speer: Well, first of all, apologies to those out there that didn't know that Darth Vader is Luke's father. George gave us all a big spoiler there. Yeah. I guess one of the curiosities that I wonder is how many companies are just a hundred percent focused on the US market and, 13485 be damned, haven't even gone down that path? I don't know. Hard to say. But nonetheless, the gaps do seem mostly trivial between those. Of course, there is a different motion and a different activity that one has to go through. You can't just self declare," Oh, well, we're 13485 compliant." Of course, you have to have an outside auditing organization come in and that sort of thing. But to me, that's the potential benefit from an FDA perspective or a benefit, not the. Now, there's resources that are routinely doing this. Okay. Yeah. Devil's advocate. I know there's FDA inspectors that routinely go to companies and come in and look at their practices and their policies and procedures and the documentation and the records and that sort of thing. But that's not always the case. At least if every company had to go through this ISO path, well, maybe it's a question. Does that help improve consistency with practices?

Mike Drues: Well, Jon, you probably know more about quality than anybody else I know. Answer this question. Are the most important principles of quality, are they a function of geography?

Jon Speer: No.

Mike Drues: In other words, to me, quality is quality, whether you're in the United States or in the EU or Canada or Japan or anywhere else in the world. So does it make sense for a company to have a separate quality management system for one region of the earth and another separate quality management system for another and so on? And then, George, you made an interesting inference a moment ago. And correct me if I'm wrong, but I think you implied that if a company was compliant, if they were doing what they were supposed to be doing, that they wouldn't be doing what I called earlier boneheaded things. And I would never make that assumption, companies who are 100% compliant and are still doing, from a biomedical engineering perspective, boneheaded things. So what do you guys think?

George Zack: That's completely fair. And people have heard me make this analogy multiple times, and I've heard you guys say," Being compliant is the equivalent of being the C student." I'll quote a former guest on this, a guy named Mike Drues. I've heard him said that, right? So, but the analogy I make, when my son, when he was 16, he's in his 20s now, when he got his driver's license, he demonstrated that he was a compliant driver. Now, in his head, he also thought he was a quality driver. Certainly, any of us that looked back as to what kind of drivers we were in our teen years would probably say we were not a quality driver, but we could be compliant. In fact, we know the whole case for quality. We've heard Jeff Shuren say, the director of CDRH, have said," Hey, we're seeing organizations that are compliant that are having quality issues. And we see organizations that are not compliant delivering high quality products." And the case for quality is really trying to get their arms around what's going on there. My point there was really not necessarily that, hey, if you're compliant with 820, that you're going to get quality products. What I'm suggesting is, if you have a quality management system that's already been geared to be compliant with 820, I don't see it as a huge lift to move to what's being proposed with the harmonization to 13485. And I think actually, I don't know either, Jon, how many companies are just living only in the 820 world. I think probably most are also thinking of global distribution. So they're thinking of those other markets, and 13485 has definitely been on their radar because of that. Or they've been under a rock if they haven't been thinking about this over the last four years. So I think some of the pushback of," Oh my gosh, this is a huge change in our quality system," I haven't quite seen something in there where I'm like," Okay, that's going to be rocket surgery," to call it that. But I don't see it as a big shift. And so that brings back to your point, Mike. So why? Why do we do it? And again, I think, while it may not be a huge shift, I think it is a step in a direction of many steps towards some sort of global harmonization. But that might take more time than any of the four of us are going to be around.

Mike Drues: Well, we've been talking. Sorry. Go ahead.

Jon Speer: No, I was just going to say, Etienne, I should have warned you, or maybe I did, that once you hit record and introduced this group of characters, that we were going to be off to the races on this. So I know you had some thoughts and ideas jotted down. So-

Etienne Nichols: Yeah. Yeah

Jon Speer: Hit us with something from your perspective. What are you thinking?

Etienne Nichols: Well, one of the questions that was in my mind was the time to transition. That was one of the things in the proposal, one year. So yesterday's meeting with the FDA, AdvaMed actually recommended two years. And there are different reasons why they might want to do that. To Mike's point, maybe there's some boneheaded companies who need to get their head straight before they transition. Another possibility is what about the inspectors themselves? Do they need time to transition their mindset? What are you all's thoughts on the time to transition? Should it be one year? Should it be more? Any thoughts there?

Mike Drues: George, why don't you go first?

George Zack: Well, yeah. A little pre- secret here is you might expect there was an email exchange between this panel discussing this. And I basically said," Maybe there's a reason really for it to be two years." But simply, it seems very arbitrary right now. Hey, it's a one- year transition, and then industry coming back and saying," We need two years." I just," Why?" What's so much harder about that? Right?

Jon Speer: But I'll jump in. Sorry to cut you off. Well, sorry, not sorry. But I think part of the challenge is, with the... Mike mentioned the EU MDR happening. We're in the middle of that. Part of the challenge was resources, right? The group of notified bodies that existed a few years ago, it's not the same group of notified bodies that aligned with EU MDR. And I think we saw a little bit of this when 13485:2016 came to light, is getting in line, so to speak, to get that certification. That could be a lengthy process. So whether it was one year, two year, I'm not sure either of those periods of time is enough to be able to make that full transition, just because of the limited number of resources that are authorized and accredited to perform the activities. Maybe that's part of the reason why. I don't know.

George Zack: Let me just see if I can clarify this. And I may be wrong, but my understanding is that, in this new QSMR world, you're not required to have a 13485 certificate.

Jon Speer: Right. But how does one make that transition without some sort of proof or evidence?

George Zack: So you're suggesting that, to show that your quality system is 820 and 13485 compliant, you want to have that certificate to provide. No. But I think your quality system could still stand on its own in the new QSMR world under 820, and you don't necessarily have the 13485 certificate. I do think many of these folks will still, because they're applying in international markets, either they have one or they're going to get one. Your point of if there was a... The statement is," We need more time because, oh, by the way, there's this little thing going on in Europe called EU MDR and IVDR for a lot of these companies as well." If they're saying," Look, that's the weather we have to deal with right now. And because of that, from a resource perspective, we need more time," that may be an acceptable argument to consider as to one year over two. But that is not something that I'm seeing in the proposed rule that's driving that time difference, and is so much as just overall conditions that industry's facing. That's a fair point.

Jon Speer: Yeah. No. But I see your point of view, too, as, okay, for all intents and purposes, the leap from QSR to QMSR should be a small leap, a little lift, not a big lift for me as a company, especially under the assumption that I've been following and compliant to the QSR as it has been written since the late'90s. So this should not be a revolutionary thing that I have to implement. It's evolutionary, right? And that's your point.

George Zack: Yeah, I think so. Mike?

Mike Drues: I would agree with what you just said, Jon, wholeheartedly. I would say it this way. If a company is doing what they should be doing, and what I mean by that is not from a regulatory or a quality regulation perspective, but from an engineering and a biology perspective, which is infinitely more important in my opinion than what the regulation end says, but if a company is doing what they should be doing, it should really be, to use your phrase, Jon, a very small leap, a tiny leap, maybe even no leap at all. Yeah, there are going to be changes in forms and paperwork, maybe in some processes, and so on. But in terms of substance, there should be really no change. And this, quite frankly, is the concern that I have with this QMSR. It's exactly the same concern that I've had for the last several years for the EU MDR. And that is when I look at this, and I'm intimately familiar with the changes going on in the EU for the MDRs for devices as well as for IVDs, when I look at the changes as a former R& D engineer, there is very little or nothing that I would do differently in terms of developing a device, testing a device, and so on. The only changes are in the paperwork. And-

Jon Speer: Right. There's a lot more words, right?

Mike Drues: There's a lot more words. Yeah. A lot more words. But one of the things that I've learned over this 30 years that I've been playing this game, there's hundreds, maybe thousands of variables that are going to ultimately impact the safety and the efficacy of a medical device, whether it's a physical device, piece of software, or IVD. I don't care what it is. But one thing that I will guarantee will never be on that list is the form that we put that information on. And that's what I'm afraid of. There's so much emphasis in companies, as well as in regulatory agencies, not on the information itself, but the form that's being used. That, to me, is a bit of a problem. I don't know if you guys agree or disagree, but that's the way I see it. Oh, and one other thing in terms of time, because George, you have some sort of opinions on this. Look, this is appropriate, right? So no matter what, it's a negotiation. So FDA knows in advance that whatever number they put out there first, industry is going to ask for more.

George Zack: Right.

Mike Drues: So, and the industry knows that whatever FDA proposes, they're going to want to extend. It's like when you buy a house or sell a house. The buyer wants to get the most amount of money and the seller wants to pay the least amount of money. So one year, whatever, I think that's a reasonable timeframe. I agree with you. I don't know why it should take any company longer than... And I hate to say it, from a pure human psychology perspective, let's not underestimate the importance of procrastination. Procrastination. As it is, we're doing this recording in early March. Our taxes are going to be due here in the United States in maybe less than six weeks from now. How many of us start working on taxes on January 1st? Most of us, probably not. We wait to maybe April 1st or April 10th, or maybe even April 14th before we have to submit them. So let's not underestimate the procrastination. I know, and Jon, you and I have talked about this before, there are companies out there that purposely don't start working on this until they absolutely have to. So regardless if they're going to have one year or two years or five years to implement, there are companies out there that are going to figure out," Okay, how long can we possibly delay this before we start to implement it?"

George Zack: One moment, though, Etienne actually had baked into his question, I think, the impact not just on the industry side. I think the longer pole in this tent is going to be the impact to the agency.

Jon Speer: Yeah.

George Zack: Right?

Jon Speer: That was going to be my question to you. Keep going. Yeah. I like this.

George Zack: Yeah. So I think if I'm the quality director of an organization, let's say that is doing the right things and it has a compliant quality system, but also has the right quality culture and is appropriately tuned to those engineering principles that you're talking about, Mike, they have the craftsmanship that they're thinking about," Let's do what's right in just good engineering practice, above and beyond what's expected from the regulation." Agree. This is small. We're talking about. 35,.45 in the regulation. Oh, guess what? My device history record, that's gone now. But it's just replaced with a different form, to your point, Mike. There's bigger shifts because the agency has been living with 820 as it is for over two decades. They have this inspection technique, QSIT, that's going to have to change. We haven't seen what that is going to look like yet. And maybe it stays for the most part the same, but I think we should expect to see some plumbing changes there. They're going to have to become familiar with 13485. Now, industry, I think just by the nature of business requirements," Hey, we want to distribute into Europe. We have to go get this 13485 certificate." Your quality director and maybe your engineers, they have an understanding of it. I am not thinking that most in the FDA, and I may be wrong, maybe they've been reading it late at night to get this familiarity, but they haven't had to. So I think that's going to be a much bigger shift for the agency than it is going to be for industry.

Mike Drues: George, I would go back to your metaphor earlier. You mentioned your son getting his driver's license. When somebody gets their driver's license, does that mean that they're a good driver? If somebody gets a certification, a 13485 certification, whatever it is, does that mean that they're doing what they should be doing?

Etienne Nichols: Well, one of the questions in my minds, Mike, you mentioned global regulations. So to couple that with Jon's comment about US only companies, so if, like you said, anywhere you stand on the planet, quality is quality, I would imagine those who are part 820 only companies are likely going to be smaller companies. And this is me pure speculation. Have they had the voice in the ISO standards? Do they need to start recognizing how standards are built and participating in that? And if so, how? Or do you have any comments or thoughts on that at all?

Jon Speer: Well, I'll jump in. Probably a true statement that the voices who get heard the most on standards are probably the biggest of the big medical device companies. That's probably a pretty universal statement. And at the same time, the data to corroborate this is hard to come by. But it's pretty widely accepted that about 80 plus percent of medical device companies are 50 or fewer employees. Some may say it's a couple hundred. But nonetheless, let's just say a hundred- ish employees or less. That represents the overwhelming majority of medical device companies. It's difficult. It's not impossible. It is difficult to be involved with standards committees. Those who do, that's oftentimes their full- time job. And I think smaller size companies may not be afforded the luxury of being able to hire a person whose sole responsibility is to be involved in guidances and regulations and standards creation. And I've worked at small companies for a good part of my career. There's nothing that's restrictive or so prescriptive within QSR or 13485 that prevents me from doing what I need to do to make sure my medical devices are safe and effective. So I don't think it's a big issue. But your point is valid. The big boys and girls oftentimes make the decisions for the rest of us in the classroom. So...

Mike Drues: Well, if I could add another thing that was mentioned in the FDA meeting referenced earlier just happened yesterday. And this is a direct quote from FDA. They said that," The requirements of ISO 13485 are about 90 to 95% similar to those in the quality system regulation." And then here's one other quote that I would find interesting. The FDA inspections, which we talked about that a moment ago," will not result in certificates of conformance to ISO 13485. Manufacturers who have ISO 13485 certificates are not exempt from FDA inspections." So that's a direct quote from the agency as of yesterday. So basically, what FDA is saying, and you guys feel free to bat this around further, if a company gets a certification for perhaps whatever reasons that might be required outside the US, that's not going to carry any weight here in the United States.

George Zack: I think what Jon was suggesting is, while that is objectively true, I think maybe, Jon, what you were suggesting is if the FDA inspector shows up for their cup of coffee, knocking on their door, and as they walk through your lobby, they see a 13485 certificate hanging, maybe they get a little bit more confidence in that organization.

Jon Speer: Yeah.

George Zack: But again, I think we're all in agreement there's not... And here, you have the FDA saying," Hey, look, we're not issuing those certificates. That's not our job. And you're not off the hook if you have one." So yeah, I think we get to the same place. You don't necessarily need a 13485 certificate, because the agency is now driving this into the QSMR. Oh, quick side note. I had a conversation recently with somebody from the agency. And I called 820 the QSR, and I got my hand slapped, because they told me the QSR is the quality system record, right, from 184 and that my referring to the 820 as the QSR was incorrect. So I, of course, told them," I've heard it called the QSR for a bunch of years," but including mostly on this podcast. But anyway, going to the QSMR, you will not need a 13485 certificate. But maybe getting one helps you gain some efficiencies in how you're applying that into your quality system as it stands today.

Mike Drues: And by the way, George, you really have to be a regulatory geek or a quality geek to point out those differences that you were just getting into.

George Zack: I'm in the right audience then.

Mike Drues: But more importantly, do you think there's a little bit of irony, perhaps even hypocrisy here, that on one hand, FDA is saying that at least for now we're not recognizing ISO 13485 certifications, and yet they do recognize MDSAP? How do you connect the dots-

George Zack: I know. Right?

Mike Drues: ...between those two things? I personally have problems with the whole philosophical concept of universal inspections like that. I know industry as well as the regulatory agencies, they like them because they're convenient, they're cheaper, they're less time, and so on. But is that really the kind of system, comes right back to what we started talking about earlier, about global harmonization?

George Zack: Right.

Mike Drues: Global harmonization of what? The regulatory system, the quality system, the inspection system. Before you know it, we're going to have everything the same for everything. End of discussion.

George Zack: Well, so I think that, yes, it would be very easy to have... We could probably have a weekly podcast just on inconsistencies between various regulations within the agency, or I think I even heard you recently speaking on this podcast about commonalities and differences, say, between 820 and 210 and 211, right? When you get into combination products and where that's going. I think that's pretty common that, I wouldn't go so far to say the left hand doesn't necessarily always know what the right hand's doing, but absolutely. Is that inconsistent that they recognize it with an MDSAP audit, but they're not necessarily going to do that here? My sense is that may fall out at some point in the future. And that's always going to be a balancing act on this global harmonization thing, right? I don't think we're ever going to get to one global regulatory/ quality pathway. Every country is still going to say," For our country, you need to do this." So until geopolitically, we all move to one big country, planet, then we should truly expect that we're going to see those differences.

Mike Drues: Well, we still don't have a global currency. We do not have a global electrical system. We don't have even consistency for what side of the road that we drive on. We've had a debate over global harmonization for the regulatory system for at least the last 20 years, and it still hasn't happened. I found it interesting that some people think that it might be more likely to have global harmonization for quality. Perhaps so. But why is quality different than any of these other things?

George Zack: Yeah. But I think there's still steps taken in that direction, essentially in the first dozen pages of the proposed rule, 52 pages. But for those of you that have not looked at it, you probably can trim 30 pages out of that reading, because there's a lot of preamble- like stuff. Why do we get to make these sorts of rules? What's the economics that's associated with it? Things that are perhaps less relevant to the actual change in the rule itself. And I think one of the things they're talking about here is that they think that they're doing this in response to what industry has asked for, because industry has said," Look, we have to deal with 13485. We have to deal with 820. We have to deal with other regulations. Can you help us out here, since most of us are playing at least with these two regulation/ standards?" And I think it's a step in the right direction that way. I'm not going to expect that's going to turn into a true global harmonization standard in my lifetime.

Etienne Nichols: There seem to be two different approaches, the two different types of companies. I'm sure there's more. In fact, the panel yesterday talked about more. But you have companies that are 13485 certified, so that will make life a little bit easier for them marketing in the US. But then you also have those companies like we mentioned earlier, that maybe they're only living under part 820, and now I'm going to have to start calling part 184 for the QSR. So those things that they're working under, what are the pros and cons for that subset of companies? We talk about the pros. Maybe they have lowered barrier to entry to exportation, for example. If they hadn't thought about exportation in the past, maybe that's an option now. I don't know. But what are some of the pros and cons that you all think about that subset?

Mike Drues: I'm sorry. So pros and cons of exactly what? I missed the question.

Etienne Nichols: No, no, no. That's fine. I ramble sometimes. Jon's working with me on that. Domestic only. So now they're going to be looking at 13485 maybe for the first time and they're probably thinking," Why do I have to do this?" We talk about some pros. Are there any cons in your mind? Are we looking at a 13485 plus system?

Mike Drues: Well, if I understand your question, and I appreciate the clarification, if there's a company that's doing business, say, here, only in the United States and nowhere else, and this is the first time that they're looking at 13485, then I would argue that's indicative of a much, much bigger problem than anything that we're talking about here. To me, that just goes to people call themselves medical device professionals. What does the word professional really mean? To me, that's not a term that should be used loosely. If somebody needed surgery, we would expect the surgeon to know how to do the surgery, the different methods to do the surgery, the advantages and disadvantages, what happens if this happened, what happens if that happens. That's what being a professional is about. So if somebody doesn't know about this particular standard, whether it's required or not, that I think is a problem.

Etienne Nichols: That makes a lot of sense. Okay. So maybe look at it from the other direction. What about the people who are adhering to 13485? Are these extras," extra part 820 requirements?" What are your thoughts on that? Are those a positive or a negative?

Mike Drues: I would look at it as a sanity check. It's very simple. If there are new requirements that are now being imposed, the company, and this is exactly the advice that I would give to my customers if they asked me that question, ask yourself, based on your device, your technology, and so on, from a biology engineering perspective, do these requirements make sense? In other words, could it be that maybe you're not doing something that in retrospect you should be doing? If that's the case, then that's the effective, that's the proper way of using the regulation, as a sanity check to make sure that we're not missing something, to make sure that we're not forgetting something, to make sure that we're not making a boneheaded mistake. That's what I would say in that case. Go ahead, Jon.

Jon Speer: From my perspective, and this is an opinion, it always seemed to me, having been subjected to throughout my career numerous FDA inspections and ISO audits, they're very, very different events and they feel very different on the receiving end. It's like, have you ever been driving? I guess we're on this driving analogies a metaphor a little bit. And all of a sudden, a police car shows up right behind you, and you change, or at least I change. But I wasn't doing anything wrong, I don't think, to begin with. But all of a sudden, my hands are 10 and two and I'm like," Is everybody buckled?," all these sorts of things. To me, that's what it feels like to go through an FDA inspection, is it's like," Oh, it feels different." And ISO, it's like," Oh yeah. Cool. We're buddies. You'll take my cup of coffee when I offer it to you. You'll eat lunch with us," and that sort of thing, versus," I can't give them a cup of coffee because it might be construed as a bribe or an inducement in some way, shape, or form." I think those things just feel very different. I think that's the biggest thing, at least from my own experience.

George Zack: Well, I think we're circling around a theme here, which is I've looked at this proposed rule as simply just a compliance regulation shift. And as we have said, I don't think it's a big gap in shifting to the QSMR from, I'll say it, the QSR, the existing QSR. But I don't think it's changed my expectations. And I don't think it's a meter mover seriously to say," Okay. All of a sudden, by doing this, everybody is going to be a high performing medical device professional." That should already be really what you're trying to strive for, regardless if you're talking about 820 or 13485 or any of the other regulations or standards for whatever countries, markets that you're manufacturing are distributing into. So I think that's the backdrop for now. That's the backdrop for when 13485 is harmonized with 820. Regulations are going to change, right? The last big one before this was probably the introduction of 830, right? UDI. So, hey, you now have to move on that from a ball field perspective. Or MDR, that's the one that's going on right now. You have to move. The compliance and the quality ought to go hand in hand. But as we have said by a variety of analogies here, they are different activities, right? And so yes, with the FDA, as a law enforcing body, whenever they show up at your door, I think there's going to be some tension, because, hey, this is a possibility they can put chains on that door if they wanted to stop you from doing your distribution. As long as there's that, there's going to be some of that tension. And we'll still have people, when the inspector asks," Do you know what time it is?," you simply say," Yes" in response and you don't tell them the time. That is not a mindset that drives greater quality outcomes. But hopefully, compliance can help support it. And there's cases where you're going to say," This form or this particular thing in any regulation, it's in my way. It doesn't help." And Mike, you have been a strong advocate here of saying," Don't be victim to the regulations. Make them work for you." Obviously, you have to be compliant, but it does not necessarily lessen your accountability to be doing the right things, especially in this market of medical devices.

Mike Drues: I agree with you, George, and thank you for those kind words. And I think, Etienne, we're going to have to wrap this up soon, but I would just add one last thing. Jon, I love when you took George's driving metaphor and extended one step further about admitting that you'd probably drive a little different when there's a police car behind you. We talked earlier about inspections. And I know, Jon, you and I have talked a little bit about this before, but what the heck is the benefit of having a pre- announced inspection? In other words, somebody calling you and say," Oh, by the way, we're going to come in three weeks and have an inspection." I don't want to know what's happening in the company when they're on their best behavior, when the floors have been cleaned and everything else. I want to know what's going on in the company every single day, on a normal day at random. So I know that's a little bit a tangent to what we're talking about here, but what's the advantage of even having all of these inspections, whether it's MDSAP or something else, if they're so contrived, if they're so sanitized? I was told a story recently where somebody was in a manufacturing environment and they happened to be inaudible the floors and repainting them. And when they asked why, it's because they said that they're having an inspection next week. It's like," Well, why are you cleaning the floors now, just because you know that there's an inspector coming next week?" Anyway, Etienne, you take over from here before I say something that's going to...

Etienne Nichols: No. I think-

Mike Drues: ...dig myself into a deeper hole than I already am.

Etienne Nichols: No, I think that was great. Both you and George's comments, I really appreciate those. I hate to correct Jon on the podcast. I think it's nine and three now. They changed the regulation. But that happens.

Jon Speer: Well, it's not 10 and two?

George Zack: It's the air bags, the airbag piece now is-

Jon Speer: Oh.

George Zack: I think, what, your hands don't hit you in the face or something like that when the airbags deploy or something like that.

Etienne Nichols: It's another episode.

Mike Drues: The underlining assumption there is that you have any hand out the wheel whatsoever.

George Zack: That's why they were following you, Jon, is your hands are at 10 and two. They're like," This guy, he's throwing cans out the window. What's going on?"

Etienne Nichols: It's really good. I appreciate all the comments. And if people want to learn more, we'll put some links in the show notes so that you can follow George, follow Mike, and learn some more. You've been listening to the Global Medical Device podcast. If you're interested in expanding your quality and not just being compliant, but going above and beyond, go over to www.greenlight.guru. We're the only medical device success platform that is designed by medical device professionals for medical device professionals. So if you're interested, go over to www.greenlight.guru, and we will see you all next time. Thanks.

ABOUT THE GLOBAL MEDICAL DEVICE PODCAST:

The Global Medical Device Podcast powered by Greenlight Guru is where today's brightest minds in the medical device industry go to get their most useful and actionable insider knowledge, direct from some of the world's leading medical device experts and companies.

Like this episode? Subscribe today on iTunes or Spotify.