Compliance Zen

Is Your Software a Medical Device – 3 Steps to Find Out

As the regulatory landscape for healthcare apps and Software as a Medical Device (SaMD) begins to firm up, there are three key steps that firms should take as they develop and commercialize smartphone apps and stand-alone software:

1. Review the current best-of-breed regulatory guidance

2. Create a yes/no decision tree to document your decision

3. Clarify the decision and communicate.

 

Step 1:  Review the Current Best-of-Breed Regulatory Guidance

There are four critical guidelines to review that software (and medical device) makers will want to read through:

• The US FDA has dedicated section on its website that summarizes FDA’s current thinking in how FDA regulates Software as a Medical Device.  If your software falls under FDA’s SaMD interpretation, you will need to comply with 21 CFR 11 Electronic Records; Electronic Signatures (e.g., Part 11), 21 CFR 820 Quality System Regulation, and 21 CFR 807 Medical Device Reporting (MDR).

• The EU released its guidance document in January 2012, Guidelines on the Qualification and Classification of Stand Alone Software Used in Healthcare within the Regulatory Framework of Medical Devices (PDF). These are the EU "regulations," but see the next two items below before you just rely upon this.

• Sweden’s Medical Products Agency has release a very good analysis of the EU’s medical app guideline (PDF) that is well worth skimming through all six pages.  On page 5 is a very nice, short summary of the requirements for the EU to view an app as a medical device.

• The UK’s MHRA released its own guidance and webpage early in 2014, Guidance on Medical Device Stand-Alone Software (including Apps), on how it will assess and regulate Software as a Medical Device, including smartphone apps. The guidance gives numerous, clear examples along with keyword functionality that the MHRA will look for which will cause MHRA to classify your software as a medical device. In addition, this guideline provides several situational clarifications for the EU’s guidance document based on recent cases.

 

Step 2:  Create a Yes/No Decision-Tree to Document Your Decision

Using information from the above guidance documents, draft a decision-tree diagram of a series of yes/no questions. This decision-tree has two immediate audiences:  the software engineers developing your software and the firm’s senior management. For both audiences, simplicity and straightforwardness is important as you should expect your initial assessment to be second-guessed.

Ideally the decision-tree will be used to help guide development and commercialization. For instance, firms may want to avoid a quick bit of functionality that will inadvertently tip an app from non-regulated into regulated territory. One yes/no question to ask might be:  “Will the app perform a calculation on the raw health data and only present the results of the calculation (rather than the raw data as well)?” In such a situation, the app is likely to be regulated as a medical device. Thus, this decision-tree can be very helpful to developers and project managers looking at different functionalities and the impact to the software; just because a set of coding may be easy might obscure that adding the code will cause the app to suddenly become regulated.

Likewise, senior management (including venture capitalists) must be comfortable with an app’s final functionality target(s) in order to decide its path of commercialization. Is the software unregulated and thus simply released, or will it require regulatory approval and/or costly compliance with 21 CFR 11, 21 CFR 807, and 21 CFR 820 in the US? This type of decision early in commercialization is critical to help executives avoid costly mistakes and potential risky product liability situations.

As an example of what a straightforward yes/no decision-tree might look like, review the EU’s example yes/no diagram on page 10 of the PDF version of its guidance.

Finally, note that by the end of 2015, the International Medical Device Regulators Forum (IMDRF) has stated its intent to release an internationally harmonized regulatory guideline, so keep an eye out for that on the IMDRF website (www.imdrf.org).

 

Step 3:  Clarify the Decision and Communicate

Document the decision-path taken to identify the regulatory status of the software. This record should be retained as part of the software development project documentation (or in the case of a Software as a Medical Device, its Design History File).

In addition, distribute a copy of this highlighted, documented decision path to the developers and any future support engineers. It’s important to communicate the need to stay within the agreed-upon functionality guidelines, not just in initial development but also in post-launch support, bug fixes, and product enhancements.

For new product enhancements and full version revisions (1.xx to 2.xx), consider reviewing and verifying the decision-tree diagram documentation; this will show a traceable path of informed decisions for each software revision.

 

For more on Software as a Medical Device, see several of my earlier blog posts:

- Poll:  Should FDA Regulate Medical Apps

- Majority of Mobile Health Apps Class II Devices for FDA

- Medical Apps, FDA and Patient Data Integrity

 

And if you need to educate your team on the regulations affecting Software as a Medical Device, how to cost-effectively comply, or help drafting the policies and procedures required, consider contacting me through the Cerulean Associates LLC website.

FDA Inspection Handling – 10 FAQs and Tips for 2014

FDA inspections are stressful and worrisome.  Failed FDA inspection costs include sales revenue loss, stock price decline, and public embarrassment from FDA warning letters and FDA-483 observations.

Every so often, it’s good to recalibrate by looking at frequently asked questions when it comes to FDA inspections.  I’ve gathered these questions, answers and tips over the past two years with clients, and with current and retired FDA officials.  When reading through these FDA inspection FAQs, use your own best judgment or that of an FDA expert you’ve hired to help you succeed.

 

1.  Does FDA look at and trend product liability litigation for food, drugs, medical devices, cosmetics, etc. in order to figure out which companies to inspect?

Yes.  The FDA is not blind to reality.  FDA’s charter is to protect public safety.  If people, through product liability litigation, are having to take matters into their own hands to go after companies for putting ineffective or unsafe products on the market, FDA could be seen as not performing its task.  So yes, FDA pays very close attention to product liability litigation.

- summarized from Lori Lawless, FDA, Office of Regulatory Affairs, and Larry Spears, retired FDA Deputy Director for Regulatory Affairs

 

2.  How does an FDA investigator prepare for an inspection?

Prior to an inspection, the investigator(s) will create an inspection plan that is largely based on the following information:

• Any previous establishment inspection reports (EIRs)
• Any previous FDA Form 483 observations, especially those that require follow-up
• Company responses (to FDA-483s) and commitments
• Firm’s website (including product literature, executive profiles, physical location profiles, recent press releases, etc.)
• Consumer complaints that have come in since the last inspection
• Adverse events that have come in since the last inspection
• Any recalls or other field activities that have occurred since the last inspection
• Any product submissions and applications, specifically to find critical components or ingredients or processes that were of concern to FDA reviewers
• Online research through the web.

Online web research can be further broken into three main areas:

• Online videos of your products in use (including if consumers have posted videos comparing/contrasting to other competing products, etc.)
• Social media sites (especially for complaints about your product)
• Searches for your company name or product name(s) along with key words (such as “review” or “fraud” or “FDA”).

- summarized from Rachel Harrington, FDA, Office of Regulatory Affairs and Tim Wells, retired FDA Team Leader for the QSIT Project

An effective, independent FDA compliance gap analysis can help you pinpoint areas to strengthen in your compliance efforts before the FDA investigator arrives.

 

3.  Is a follow-up inspection (a closeout inspection from a warning letter) still a “regular” inspection?

Yes.  FDA investigators treat a closeout or follow-up inspection as a normal inspection.  You can be cited for new or additional items.

- summarized from Lori Lawless, FDA, Office of Regulatory Affairs

 

4.  Do pre-approval inspections (PAI) rely upon QSIT, and if so, what level are they?

PAI inspections are Level 2 QSIT inspections by default.  FDA reviewers of a submission will identify areas of concern for the investigator to look at during the inspection (such as GCP data integrity controls).  PAI inspections may cover everything from nonclinical supporting GLP-compliance, through GCP compliance, to GMP compliance, and even delve into how the company will monitor and control the product once it is approved and on the market.

- summarized from Lori Lawless, FDA, Office of Regulatory Affairs, Erin McFiren, FDA, Office of Regulatory Affairs, and Tim Wells, retired FDA Team Leader for the QSIT Project

A level 2 QSIT inspection is a comprehensive inspection, covering all four major quality system subsystems - management controls, development, CAPA, and production and process controls – as well as reviewing the remaining three subsystems (facilities and equipment controls, materials and supplier controls, and records controls) throughout as these three subsystems cut across all four major subsystems.  Thus, 21 CFR 11 controls will be reviewed and inspected throughout the PAI, not just during review of the design and development (e.g., design control) subsystem.  Learn more about the details of Level 2 QSIT inspections at the FDA:  www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/ucm244267.htm

 

5.  Will FDA investigators ask for supplier audit reports?

FDASIA 2012 expressly granted FDA the power to require supplier audit reports during regular inspections (see Title VII of FDASIA).  That said, by internal policy, FDA discourages investigators from asking for the report in the hopes that this will encourage firms to be more candid and clear in supplier audits.  Unfortunately, as was painfully shown during the recent Heparin scandal, FDA’s hope has not panned out.  Far too many firms conduct “meet and greet” supplier audits with little meaningful impact.  Thus, increasingly FDA investigators are taking advantage of FDASIA’s new powers and requesting copies of supplier audit reports.

It should also be noted that FDA has always requested supplier audit reports under various conditions as identified in the FDA Compliance Policy Guide, section 130.300, FDA Access to Results of Quality Assurance Program Audits and Inspections (www.fda.gov/ICECI/ComplianceManuals/CompliancePolicyGuidanceManual/ucm073841.htm):

• During directed or “for cause” inspections of a sponsor or monitor of a clinical trial
• In inspections where access to such records is authorized by statute (such as FDASIA)
• When public safety is at risk
• In litigation (or in support thereof)
• When executing a search warrant
• When a firm’s internal audit program is insufficient or otherwise deemed ineffective by FDA.

This last point is often overlooked.  Technically, if the FDA investigator writes down a Form FDA-483 observation that a firm’s quality audit program is insufficient, the FDA investigator can then review the firm’s supplier audit reports.  (Note:  Personally, I’m not aware of any incidents where this has occurred, and so I encourage you to be cognizant that an effective quality system audit program is necessary to show FDA you are overseeing your suppliers appropriately.)  It is thus in a firm’s interest to ensure that it has a robust, FDA supplier audit program that can withstand both FDA investigator and product liability litigator scrutiny.

Finally, always remember that FDA counts any corrective actions from supplier audits as CAPA documentation and freely open to review by any FDA investigator.

- summarized from Lori Lawless, FDA, Office of Regulatory Affairs, and Rachel Harrington, FDA, Office of Regulatory Affairs

 

6.  How does computer validation play into regular inspections?

As of the end of 2013, FDA’s special enforcement of 21 CFR 11 (e.g., "Part 11") is still ongoing.

Part 11 will come up throughout an inspection as it is a regulation that cuts across all quality system subsystems. If records are used or kept in digital form, or if a computerized system is used to automate a regulated process (such as production, lab testing, etc.), then the FDA investigator will ask Part 11-relevant questions.

FDA looks to see if you are verifying the functions that you use of a software or a computerized system in your environment, especially those functions related to data integrity.  For instance, with a  spreadsheet macro, the FDA investigator will expect to see a simple verification of your use of the macro in your environment, documented with a validation protocol, document testing, and a summary report.  Do not validate Excel, just the use of the macro within your environment.  Questions that the FDA investigator might ask include:  How do you know the results of the macro are correct?  Are complete?  Did not drop off various data inputs?  and so forth.  These types of Part 11 validation are the ones to concentrate on.

- summarized from Lori Lawless, FDA, Office of Regulatory Affairs, and David Chesney, retired FDA District Director

 

7.  How does FDA handle a situation when – during photo taking during the inspection – confidential patient information and/or trade secret information is accidentally captured in the photograph?

FDA treats all photographs, videos, documents, notes, etc. as confidential.  All such items go through FOIA to redact such sensitive information before they are released.

- summarized from David Chesney, retired FDA District Director

Personally, I suggest you consider making sure to identify in your inspection notes what photographs the FDA investigator took; if possible, take a similar photograph.  Then, in your response to the inspection, make sure to identify the photograph and any specific confidential or trade secret information that may have inadvertently been captured by the FDA photograph.  This will help FDA to redact the appropriate information while providing you some degree of assurance that they understand and acknowledge the situation.

 

8.  Where is FDA on adapting or accepting remote or online/virtual inspections?  Is FDA ready for online/remote inspections like a number of other notified bodies?

FDASIA 2012 granted FDA the power to conduct remote and even online/virtual inspections.  However, FDA is currently not positioned to take advantage of this.  The agency is planning to start a pilot program wherein part of the inspection will be conducted remotely (e.g., remote document review) followed by a briefer onsite inspection portion.

Keep in mind that at its core, FDA is a regulatory enforcement agency.  As such, during inspections, it is technically collecting evidence.  For companies doing all the right things, it is in their interest to have FDA investigators physically visit and see firsthand how well the company is doing.  For firms with more … “soft” …. approaches to compliance, a remote or online/virtual inspection has less of a chance to uncover gaps.  FDA is well aware of this.  In order to address this, expect FDA over the next few years, to take a two-step approach to an inspection:  part one is a remote review of policies, SOPs, etc., (presumably through PDFs sent to the agency); this will then inform and shape part two, the onsite inspection.

- summarized from Lori Lawless, FDA, Office of Regulatory Affairs, and Rachel Harrington, FDA, Office of Regulatory Affairs

When I conduct FDA compliance gap and remediation analyses, I prefer this two-step approach because it provides a high degree of efficiency, effectiveness, and enhanced ROI for everyone involved.

 

9.  What are “management discussion items” and what are the implications to a firm?

Management discussion items are non-compliance observations not written onto the Form FDA-483.  Management discussion items are compliance deviations that the FDA investigator believes to be of lesser significance than the documented 483s.

However…

Management discussion items can still end up as warning letter citations because the FDA district office or FDA head office believes they are more serious than originally assumed. Thus, if you address management discussion items in your response to FDA, you may want to notify the district that you are working to resolve the items as well as the written 483 observations.

Keep in mind that to FDA, as long as an observation of non-compliance was documented in the FDA investigator’s notes, written on a Form FDA-483, or spoken about to a firm's management, FDA considers the observation “documented by FDA.”  FDA is, at its heart, an enforcement agency collecting evidence when it conducts an inspection.

Finally, be aware that management discussion items can be treated as repeat violations if found again in a follow-up or a second FDA inspection.

- summarized from Rachel Harrington, FDA, Office of Regulatory Affairs, Erin McFiren, FDA, Office of Regulatory Affairs, and David Chesney, retired FDA District Director

 

10.  How long after an inspection will we receive a copy of the EIR (Establish Inspection Report) and/or any warning letter?

Technically, up to 45 days after the inspection.  In reality, depending on the type, depth, and other FDA inspection conditions, it can be up to 3-6 months after the FDA investigator leaves.  Nonetheless, your FDA inspection response and remediation plan is still due to the agency within 15 business days after departure of the FDA investigator.

- summarized from Lori Lawless, FDA, Office of Regulatory Affairs, Tim Wells, retired FDA Team Leader for the QSIT Project, and Larry Spears, retired FDA Deputy Director for Regulatory Affairs

 

If you have any further questions, or need help complying cost-effectively with FDA regulations, please contact me through my consulting firm, Cerulean Associates LLC.

Poll: FDA Should Regulate Medical Apps

In a new poll, 68% of physicians, healthcare professionals, medical app developers, and members of the general public voted that the FDA should regulate medical apps.  You can see the results and a discussion of the poll online at The Profitable Practice blog.

For app developers, the key point to keep in mind is that FDA is only planning to regulate software apps that will “transform a mobile device into a medical device already regulated by the FDA” or that can be used “as an accessory to a medical device.”  This is in line with the common sense approach taken by a number of EU member states such as Sweden.

Back in a March posting Should FDA Regulate Medical Apps?, I noted that the vast majority of so-called “medical apps” or “health apps” are really geared for the general public and layman to provide basic medical or health information. Trying to regulate these 17,000+ apps would bring FDA to its knees even if all of its personnel were magically transformed into medical app expert reviewers. This point was taken up and agreed to by FDA’s Baku Patel, as I pointed out in a July posting, Majority of Mobile Health Apps Class II Devices for FDA.

Now, with the release of FDA’s final guidance on medical apps, FDA has stepped back from the precipice and taken the more common sense approach advocated by this blog, the EU, and by the many, many critics of FDA’s initial draft guidance on mobile health apps. FDA’s regulatory focus is on apps that – if they malfunction – have a direct risk of harming the patient.

With this approach, FDA will not inadvertently treat the Apple, or Google, or Amazon’s app stores as distributors or pharmacies. This was another minefield in the initial draft guidance that is now resolved.

That said, Apple has formally implemented a policy for new medical and health apps on its app store wherein developers need to provide specific medical citations and sources for any medical information contained in an app.  This is no different than how medical journal articles must cite sources.  Read more about Apple’s new policy on health app medical source requirements.

See the FDA press release on the new mobile medical app final guidance

Download the final FDA mobile medical app guidance

Read more about the poll conducted by medical software resource Software Advice

List of 21 types of health apps that FDA will not regulate.

Majority of Mobile Health Apps Class II Devices for FDA

A June interview with FDA’s Bakul Patel, author of FDA's draft guidance on mobile medical apps, revealed that the majority of mobile health apps FDA has reviewed to date are classified as Class II Medical Devices.  Of the 27,000 medical apps available today, FDA has reviewed less than .003%.  Classifying even ten percent of the 27,000 medical apps as Class II Medical Devices risks bringing FDA to its knees, dramatically increasing the number of inspections and enforcement actions FDA needs to take each year.

As more developers around the world jump into the fast paced medical app business, the problem will get worse.  Compounding this is the lifespan of the average mobile app:  14 months.  And during that time, the app will be significantly revised or completely rewritten 3-4 times.  In device terms, that’s a new model every 3-4 months. And yet FDA needs an average of 67 days to review a medical app.  So by the time FDA has finished its review and clearance, the version the agency reviewed may well be obsolete.

This is going to be problematic if the majority of mobile medical apps are classified as Class II Devices as suggested by FDA's draft guidance on mobile medical apps.

Class II Medical Devices are higher risk than Class I devices.  Example Class II devices today include powered wheelchairs and infusion pumps.  Class II devices require their maker to fully comply with FDA's Quality System Regulation (21 CFR § 820) and the Medical Device Reporting (21 CFR § 803) rules, from design control to supplier (including distributor) qualification to postmarket monitoring.  Assuming a firm takes a traditional approach to compliance with the QSR and MDR, their cost of doing business will increase an average 30%.

Many questions about QSR and MDR compliance for medical apps abound.  Is Apple a distributor of the medical mobile app?  What about Google’s Android store?  Or Amazon.com?  How should a maker of a mobile health app qualify Google or Amazon.com or Apple?  If a user posits a poor review and bug problems he/she had on the app store’s reviews section, what responsibility does the developer – or Apple or Google – have to consider that user review for postmarket reporting?  How strict will FDA be in inspecting and enforcing design controls when device models completely change every 3-4 months.  Far too few firms today get design control right with an 18 month development lifecycle.  What is the agency’s compliance expectation for a 90-day development lifecycle?  And for apps that include the ability for a healthcare provider to enter patient data and track treatment plans, for instance, who is responsible for ensuring the app is 21 CFR § 11 compliant such that any data within it has integrity, much less remains confidential and private?

FDA’s current draft guidance on mobile medical apps is woefully short of such practical specifics.  And yet it’s these specifics that will get even the most forthright medical app developer in trouble with FDA-483s and Warning Letters.  Warning Letters have been shown to reduce product sales by at least 8% the first year and for three years thereafter.  For many of these developers, a Warning Letter might be the kiss of death and bring a painful chill to the innovation marketplace.

FDA will need to tread carefully in its final guidance.  I am less concerned about apps that clearly turn a smartphone into a medical device or diagnostic tool (a perfect example is the recent “It Has Come to Our Attention Letter” to Biosense Technologies in California for its mobile medical app, uChek Urine Analyzer).  I am more concerned about missteps in two areas:

1.  Misinterpretations around technological capabilities vis-à-vis wellness versus treatment versus diagnosis.  Many mobile medical apps help healthcare providers and patients track conditions – from weight loss to insulin levels.  It seems to me that FDA’s draft guidance identification of apps doing calculations as Class II devices is extremely broad.  After all, if my weight loss app calculates my body mass index, doesn’t that technically meet the criteria defined by FDA:  “Apps that act as calculators or utilize algorithms to produce an index, score, scale, or other similar calculations.”  And what if my doctor decides to rely upon that to prescribe a weight loss drug or exercise regimen?  Or a clinician, in the midst of a clinical trial, decides that this is how he/she is going to verify and track dosing?

2.  Enforcement of the QSR and MDR requirements.  How will FDA enforce these regulations given the enormous numbers of medical apps and the comparative dearth of FDA investigators and reviewers?  Few app developers today use anything like design control for their rapid development and release cycle.  And many medical app developers are virtual companies.  What is the actual likelihood they will comply versus simply shutdown shop after 14 months (the lifespan of their app) only to re-open under another name?  Think about how the video game development industry operates.  Game studios open and close all the time.  Individual developers jump ship to form a new studio, release a game, and then shut down the studio, only to reform with a slightly different group of developers and reopen a new studio 30 days later.  I can easily foresee this happening in the mobile medical app space, particularly as more and more overseas developers join the fray.  FDA can clarify all it wants that app developers need to register as device makers and comply with the QSR and MDR, but enforcement needs to be realistic to work.  The ability of an app maker to open up, develop the app, sell it for 14 months, and then close up shop faster than FDA can realize the app even existed is going to make for a lot of frustration in FDA, in the marketplace, and among patients and providers.

While FDA continues its case-by-case enforcement and tries to craft guidance-based rules in which to understand and frame the fast-paced mobile health landscape, the market marches forward at double time.

Let’s hope mobile medical app makers are not surprised when FDA finalizes the rules of the game.

Poll - Should FDA Regulate Medical Apps

The ante has been upped in the mobile medical app regulation debate. Recently, a large group of patient and provider associations along with IT companies and payors petitioned the Obama administration not to rush into regulation, urging caution.

 

Three days later, a separate coalition comprised mainly of device manufacturers, app developers, and mobile companies petitioned the government to do exactly the opposite, asking the FDA to provide final guidance on app regulation immediately.

Though patient safety is important to both sides, big businesses on each side of the debate are also incentivized by other factors.  Melissa McCormack, managing editor of The Profitable Practice, a blog for healthcare providers, recently alerted me to a new report examining the motives of each coalition. Compiled and analyzed by Software Advice, a company that helps medical software buyers evaluate products, the report makes for some interesting...and possibly disturbing...reading.

The report publishers are also running a poll on the topic, and they’d like your opinion.

Take the poll and view the results here:  Should the FDA regulate mobile medical apps?

FDA Training Records - Three Risky Challenges

Companies train their personnel in all sorts of FDA-related activities, from quality system SOPs to core regulatory requirements to company policies. Training is a common requirement of nearly all FDA regulations, from Part 11 to 21 CFR 820.

• What about training should be documented?
• What should be retained and for how long?
• Should training records be tied to individual personnel files or can we simply record group training?
• How do I go about figuring out who should be trained on what?

These questions carry with them significant risks - for FDA compliance, for product liability litigation, and for personnel-related allegations. When I give FDA compliance training workshops, webinars and speeches, many questions about training and training records often boil down to these tricky issues. Below, I'll answer a few aspects:

 

What specifically does FDA require us to document about training?

In only one place does FDA spell out specific items to document, in 21 CFR 111.14(b)(2) Current Good Manufacturing Practices for Dietary Supplements. FDA states:  “You must make and keep the following records:  Documentation of training, including the date of the training, the type of training, and the person(s) trained.”

At minimum, I suggest that ALL firms, irrespective of industry, follow the minimum specifics listed in 21 CFR 111.14. All the other regulations provide a summary statement similar to the one in 21 CFR 820.25(b):  “Training shall be documented.”

Unfortunately, in part because of these ambiguous requirements, a bad habit of using group attendance sheets has arisen over the years. Such group attendance sheets are easy, they get passed around, people sign their name, and voila – regulatory requirements met…right?

No.

Group sign-in sheets have multiple inherent weaknesses that - as many firms have discovered -  undermine compliance. For instance:

•  When did the individual sign?  Did they walk into training 5 minutes before the session ended and sign the sheet?   Did they walk out of training as soon as they signed the sheet to “take a quick call” and never return?
•  Was it actually that individual?  How often does someone match the signatures against a signature log?
•  How does signing a group “I showed up” sheet prove “I understand the training and I agree to abide by the training” with any level of accountability?

The reality is that most group attendance sheets go into a file drawer and are never seen again. FDA investigators understand that group attendance sheets prove little. In fact, in 32% of product recalls, FDA traced the root cause to ineffective training (US Federal Register, Vol 78, Iss. 11, 16 January 2013).

The proposed 21 CFR 117 specifically ties training to individual personnel records, eliminating the ability to use group sign-in sheets to prove FDA compliance. Supervisors are to be trained differently than line workers. And supervisors will have a responsibility to “ensure” that employees understand their obligations. Group sign-in sheets will not accomplish this.

Group sign-in sheets carry further risks for a company in two increasingly common situations:

• Product liability litigation
• Personnel discrimination or wrongful termination allegations.

Multiple US laws and regulations tie retention of training records to individual personnel files and roles performed. A 2008 SCOTUS ruling (CBOCS West, Inc. v. Humphries) on the statute of limitations in Section 1981 of Title VII (42 USC 1981) determined that job-related training records – such as training on SOPs – are examples of proof that can be used to show a company discriminated (or conversely, used to prove that a company did not discriminate) for several years after an employee's departure. As a result, firms now keep job-related training records for the duration of an employee’s term with the company plus at least two years (e.g., "date of departure + 2 years").

So how does your Quality group track the employment durations of each individual with your company?  Or perhaps they are planning to keep every single group sign-in sheet for at least 30+ years?

These are just some of the reasons why group sign-in sheets for training now cause more risks and problems than they solve.

 

What record(s) should I retain to prove personnel were trained appropriately and understood the training?

With my clients that I help either in FDA quality system consulting or in FDA recordkeeping consulting, I recommend retaining two record types:

1. Training Matrix
2. Individual Certificate of Acknowledgement

 

About the Training Matrix

A Training Matrix can be as simple or as complex as you desire, from a basic Excel spreadsheet to an Oracle or SQL database of some sort. Using an Excel spreadsheet, the left-hand column should list all the organization’s personnel; the top row should list all the potential training that could be received (specific SOPs or policies, regulations, etc.). The grid is then filled in either with the date last trained or with a shaded cell to indicate “not necessary.” Feel free to come up with other designations for date scheduled, type of training (“in person” vs. computer-based vs. “read-and-review”), and so on.

The purpose of the Training Matrix is two-fold:

1. Tracking who needs to be trained on what versus who has already completed training; AND
2. Quickly and easily showing an outside auditor or regulatory investigator the current “state of training.”

From a retention standpoint, the Training Matrix is what’s termed a “living” document. It’s constantly updated.

That said, from a risk-mitigation standpoint, I suggest my clients take an annual snapshot of the Training Matrix and archive that annual snapshot for a period of years equal to their local state statute of limitations such as 3 years or 6 years. Such a snapshot of a "living document" is not required under any regulation, it’s simply a precaution to allow the firm to quickly and easily trace who had training on what and when without having to cull through individual personnel records. It's a reminder that the Training Matrix is designed to be practical and user-friendly throughout.

With any luck, the Training Matrix is as far as the FDA investigator will need to go. However, deeper dives into specifics of what a person was trained on within a particular training session as well as the how the supervisor ensured the training was effective look to Individual Certificates of Acknowledgement.

 

About Individual Certificates of Acknowledgement

In each individual personnel record is the Individual Certificate of Acknowledgement.

An example Certificate of Acknowledgement documents the following items:

•  Topic of training session
• Date of training session
• Key responsibilities/requirements covered in the session
• Individual’s acknowledgement that he/she understands his/her obligations
• Individual’s agreement to comply with the requirements/obligations
• Supervisor’s review and agreement to supervise the individual to the requirements/obligations.

Not only does this comply with both the intent of the regulatory requirements, it also has a critical added benefit:  since the 1950s, studies have shown that this type of written, individual acknowledgement consistently improves compliance by up to 89%.

This is why the individual Certificate of Acknowledgement (or “Commitment” or “Understanding” or whatever word you want) is so powerful:

• Improves compliance by 89%
• Complies with all current US laws, court interpretations and regulations associated with training records.

One tool to comply with multiple regulations and strengthen compliance at the same time:  that’s a lean compliance technique.

 

How do I begin to create role-based training assignments when there might be hundreds or thousands of SOPs and policies?

The key challenge is to avoid getting lost in the details. Training everyone on everything is nice in theory, but breaks down quickly in practice; the larger an organization, the more unwieldy and ineffective the training will become.

Traditionally, there are two choices in how to tackle role-based training:

• Work with your local HR/personnel department to idenfity overall training requirements for each functional group; OR
• Work with each functional leader (department heads, team leads, etc.) to do the same.

I advocate a more practical, flexible lean compliance approach:

Assemble a temporary, working group of representatives from each functional area and HR to carve out initial sets of "buckets." In essence, everyone in functional group X gets trained on SOPs 1 and 2; everyone in functional group Z gets trained on SOPs 2, 3, and 4; everyone in functional group A, gets trained on SOPs 4, 5, and 6; and so on.

That's the core initial population of the Training Matrix.

Then, I take that initial populated draft of the Training Matrix and go to each department head to review, tweak, answer questions, and verify. After the quick verification sessions with the department heads, the Training Matrix is now fully populated, the functional heads and their direct reports are happy, and so is HR. It's a win-win-win.

And I don't worry about "is the Training Matrix perfect?" because it is - as I noted above - a "living document" that will get modified as time goes on.

This can also help reduce the drag of training on productivity. The more time spent in training, the less revenue-generating work is completed. Thus, the goal of the business is to have the minimum amount of training necessary; in other words, to balance compliance with profitability.

 

FDA lean compliance provides a company defensibility with records while reducing overhead, strengthening compliance, and improving profitability.

To learn more, visit my firm's website at www.ceruleanllc.com or read previous client stories and testimonials.

3D Printing and Nanobots - FDA Challenges Ahead

Among many products, the US Food and Drug Administration (FDA) regulates medical devices such as stents and prosthetics. FDA regulations - and compliance - are predicated on an assumption that medical device production is an involved undertaking that requires expertise, monies, and physical manufacturing.

Yet, what would happen - is happening right now - if anyone can make a fully functional, complex medical device at home in about an hour?

3D Printing of Medical Devices

Late last year, two folks collaborating from opposite sides of the planet created an articulating prosthetic hand using only a cheap 3D printer.

Then, they went one step further – they uploaded the design specs on the internet so anyone can download, make and use this 3D printer prosthetic hand today.  (*Note - this news story has embedded videos to watch as well so you can see the fully articulate hand in action.) The device design is now in the public domain.

Most prosthetics are Class I devices today, requiring only an FDA quality system (21 CFR 820)  and compliance with the medical device reporting rules (21 CFR 803); a 510(k) is not required. Sounds straightforward when such devices are designed and made in traditional manufacturing firms. But using this public domain specification, anyone with access to the internet and a 3D printer can make this Class I device.

So…is every person who prints one of these now an FDA-regulated manufacturer?

FDA rules, regulations and statutes are predicated on an assumption that in order to start a business – in order to design and sell a product – there are significant fixed costs involved, investors may need to be sought, expensive expertise to obtained, and so on.

Now though, all one needs is a cheap 3D printer and an internet connection to download, make and use a fully articulate, Class I medical device prosthetic.

The times they are a changing.

Beyond just the FDA QSR and MDR rules, the new unique device identifier (UDI) regulation will be phased in over the next six year. 3D printed prosthetics – and other Class I devices – will need their own UDI as of 2019, if not sooner. How will this work if anyone can make their own fully functional, Class I device with a 3D printer? Keep in mind – this fully articulate, 3D printed prosthetic is just the first of future medical devices made onsite, at any site, in real-time with 3D printing.

In February 2012, a woman received an impantable replacement jaw made from a 3D printer. Presumably, any hospital could make such an implantable device on the fly, in real-time, fitted to each individual patient’s characteristics. Fabulous from a healthcare perspective but a real challenge in the context of regulations that date back to last century. Will this mean each hospital in the US has to seek its own UDI? Has to have its own quality system and device adverse event reporting programs?

FDA has an overwhelming workload now. Imagine in a few years when wide-spread 3D printing allows real-time, patient-side creation of almost any type of medical device, from prosthetics to implants, at any hospital, doctor's office or home.

Nanobots and the UDI Rule

It’s only going to get worse, though. A colleague of mine is working to commercialize injectable nanobots that scour arteries for plaque and other problems, and then, within 30 days, completely dissolve. Other firms are drawing up plans for similar nanobots to tackle digestive system issues and so on.

Thankfully for the agency, these nanobot based devices are almost a decade away. And the clinical trials will undoubtedly be highly scrutinized.

Here are just two questions injectable (or injestable) nanobots raise:

1. Are these devices or drugs or combination products?
2. How do you apply a UDI to something the eye cannot discern and that will disappear in 30 days?

Fundamentally, the challenge facing FDA – and facing all of us in compliance and quality – is that scientific and technologic progress is far outstripping FDA’s ability – much less any organization's ability – to understand its implications enough to be able to craft reasonable regulations and practical SOPs and policies. This is a challenge that will get far worse before it gets better.

When I give FDA compliance training and workshops to business execs and scientists, I make a point to note that regulation in the US today takes at least 8 years to go from blank sheet of paper to reality (note that the UDI rule was drafted long before Congress actually passed the authorizing FDAAA statute in 2007). The UDI rule took almost a decade to come to fruition in Congress and then be written so as to go into place this year...and with 3D printing (much less imminent nanobot devices), the UDI rule is already outdated before it formally takes effect.

How can FDA handle 3D printed devices, nano-technology medicines and other new advances?

FDA has little choice left but to regulate through guidance. Guidance documents can take less than a year to publish. And for those of us who provide expert regulatory intelligence and quality systems advice to clients, we’ve also noticed that FDA is increasingly reliant as well upon using Warning Letters to explain rules and requirements; see the recent push of late for FDA records management requirements in warning letters and this year's Ben Venue Laboratories consent decree.

Implications for Firms Today

Firms need to proactively manage the gathering and synthesizing of FDA regulatory intelligence, incorporating and applying it into their quality systems and product planning. Relying upon a regulation written before Y2K to tell you what to do in this era of social media, iPhones and 3D printing is akin to relying on a fax machine to quickly send a document. This is why FDA officials of late have cautioned against relying on former FDA officials whose last stint with the agency was twenty years ago; too much has changed since the 1990s.

Those firms large enough to dedicate a team of personnel to regulatory intelligence and its application will manage just fine over the 5-10 years, but what of firms that don’t have that kind of manpower and money? How will firms with more needs than personnel keep up with new FDA expectations and clarifications from guidance documents, warning letters, consent decrees, and even web-based FAQs?

Stay up with FDA guidance, warning letters and FAQs to avoid enforcement and new product delays.

Small to midsized firms should look to some type of outside service. Consider asking an industry expert with a good reputation to provide you regulatory intelligence services (if you need help determining how to get a good a consultant, follow the tips in this article). Ask the trusted compliance expert to provide ongoing review, analysis and suggestions stemming from “recent and newly published relevant FDA guidance documents, warning letters, consent decrees, and FAQs.” Be sure to scope out the service appropriately. Don’t ask for a weekly update if you only plan on incorporating suggestions on a quarterly basis. Most clients I deal with want advice on a monthly or quarterly basis. A good rule of thumb is to expect the expert to spend approximately 12-20 days a year providing you analysis and suggestions from relevant FDA items. Work this out for the consultant’s hourly rate or a fixed fee.

Another option, albeit much less tailored, is to subscribe to a regulatory intelligence newsletter or a quality systems newsletter such as Cerulean’s SmarterCompliance. Keep in mind that published newsletters have a large readership and so you may not find every issue to be of immediate impact. Make sure the newsletter offers a money-back guarantee of some sort so that if you cannot find anything of any value over a handful of issues, you can at least get some monies back.

FDA regulatory intelligence is only as good as its applicability. Talk with your quality system consultant or regulatory intelligence expert on how best to apply the ongoing advice in your organization; he or she should have some level of insight into what works best in day-to-day practice.

From the Pharma Contracting and Outsourcing Conference

This past week I was invited to speak at the Contract Pharma Contracting and Outsourcing Conference in New Jersey, where I spoke on how to sell compliance to senior management.

All too often we assume that compliance is an essential requirement when choosing a critical supplier. And the yet, when cost becomes the deciding factor, compliance becomes compromised or even forgotten for the sake of the bottom line.

Given that more people are hurt each year by toilets than receive FDA warning letters or FDA-483s, the threat of FDA enforcement is hardly a credible compliance encouragement. And so I opened day two of the conference by speaking on how lean FDA compliance can:

• save money
• enable greater revenue and profitability
• simplify compliance
• and generate easy metrics to both support those results and prove effective compliance to FDA.

I was followed by Addam Reynolds, a Consumer Safety Officer with FDA's New Jersey district office who spoke on recent FDA inspectional findings and trends. Mr. Reynolds summarized a number of trends in FDA-483s, comparing the previous year to this one. I've reproduced two of his summary tables below.

As we looked at the data, Mr. Reynolds made several explanatory comments of what was behind the numbers.

First, many of the new investigators now with FDA are well-versed in laboratory and manufacturing operations. A number of new hires have come from those laid off by the pharma industry - an irony not lost on attendees. With increased familiarity of modern-day manufacturing and laboratory settings comes increased scrutiny. Thus the increases in citations for noncompliance with 21 CFR 211.63 and 211.160(b)(4). Mr. Reynolds noted that "Firms are either not qualifying their equipment and instruments at all, or are not doing it right."

Second,the number of citations for 21 CFR 211.68(b), controls over computerized systems, is, in Mr. Reynolds insight to FDA thinking, "really about data integrity and data security." This continues FDA's special enforcement of Part 11 as a rule governing electronic data and records integrity; an enforcement approach that was officially announced in 2010. As Mr. Reynolds noted, most Part 11-relevent 483s happen because firms continue having systems "with little to no data integrity controls."

As I've written about extensively, been interviewed on, and consulted on, Part 11 is less about validating computers per se, and more about ensuring data integrity. To that point, validation is simply a means to an end. The most recent issue of my client newsletter, SmarterCompliance #68, explains in-depth how to use data mapping as a technique to simplify and streamline Part 11 compliance.

The rest of Contract Pharma's conference featured more excellent speakers on various contracting and supplier management issues, including site selection criteria, what to do when your CMO goes bankrupt, and more. If you've not attended this two-day conference before, I encourage you to do so next September. Attendees and speakers are focused on frank conversations about overcoming real-world challenges. I'll be there speaking. I'm thinking of doing something on parallels between choosing a puppy and choosing a supplier - lessons learned and puddles cleaned.

If you're looking for more lean compliance events, check my upcoming workshops and speaking events page on my website. In the near term, I'll be speaking:

• September 25 - webinar on overseeing and verifying Part 11 compliance of your records at critical suppliers
• October 3 - Part 11 enforcement today for OTC manufacturers
• October 11 - webinar on best practices for quality system management reviews (a new requirement under the new EU GMPs Chapter 1 going into effect in January)

I hope you'll join me at one of these events.

 

Medical Apps, FDA and Patient Data Integrity

Two recent articles - one in the Washington Post entitled Health-care Apps of Smartphones Pit FDA Against Tech Industry and one in the Wall Street Journal entitled There's a Medical App for That-Or Not - have raised the spectre of how smartphone medical apps imply an imminent trainwreck between today's rapid-pace innovation and last century's slower-going FDA regulation.

 

  vs? 

What's the real question?

As I note in Get to Market Now!, new innovations and technologies emerge on average every 6 months while new or revised regulations take 12-14 years. Today, there are over 13,000 medical apps available for you and me; another 5,000 are available just for physicians and healthcare providers. By the time you finish reading this post, another medical app will have been published.

From a business perspective, the thought of FDA dragging down innovation to the rate of regulation is frightening. And while there is also the need to protect the public - and physicians - from medical apps that are unreliable, faulty, and just plain poor, is new regulation the answer? Is treating a $1.99 app like an MRI the answer? Innovation wouldn't stop. The price would just go up. Instead of paying $1.99, you'd just pay $1,990 for the app.

So, assuming that's not our goal, then what's the answer? Well, maybe we should step back from racing to find an answer, and reframe the question. Afterall, there's no point in arguing over the answer if we're not all answering the same question.

I suggest the real question has little to do with speeding innovation, keeping the public safe, enabling informed healthcare consumers, or making healthcare professionals more efficient. Those are all wonderful points, but they are not the core question behind how to, or even whether, we should regulate a medical app.

The real question is simpler:  How do we - as a society - ensure that patients and healtcare providers can rely upon the health data used/maintained in a medical app?

Think about it. Would you want one of the regular updates to an app on your smartphone to corrupt all the previous data you had in it?

In today's video game market, data corruption is a painful reality becoming more and more common - patches and updates to games increasingly have to be withdrawn and redone because they accidentally corrupted and destroyed people's previous game data. It's too late for those consumers whose data files were destroyed.

"Well, sure," you say, "but those are game files. I mean, come on." And then think about it:  is that what you want for your smartphone health app?  You'd be hard-pressed to find a patient or a physician okay with running that risk for all their health data. Are you okay with all your health data and trends over the past year being wiped out while an update to your app is downloaded as you sit at Starbucks sipping that latte?

So this is the core question:  how do we ensure that data entered into a medical app stays trustworthy?

And if we reframe it in this way, then we can cast about for already existing regulations, controls and tools. And yes, we already have them.

 

Today's Medical App Controls

I see four significant controls available today. The first two are pure market-driven, the second two are more "guiding hand" industry best practice combined with existing regulation:

1. Consumer reviews.  Admittedly, there are some drawbacks to this as we don't know if the person writing the review is knowledgeable, and sites that rely on consumer reviews are usually fairly easy to game. So, consumer reviews are not a stand-alone control, only a piece of the control puzzle.

2. Product liability litigation.  Yes, it's coming if not already occurring. Face it, if you can find a lawyer able to beat a restaurant for serving too hot a cup of coffee, you can find a lawyer able to beat a medical app for allowing your medical data to become corrupt. Still, because it can take up to two years for such product liability litigation to emerge, this is not a preventative except in the long, long-term. Product liability litigation is only another piece of the control puzzle. If nothing else, right now, medical app makers will want to include some level of documented risk assessment to patient data as part of their development process, otherwise, expect to defend why you didn't when you sit before the court in 18 months.

3. Software quality control practices.  Great in theory, often poor in practice. The reality is that often companies cut quality control in order to rush products to market. When a medical app can be written and quality checked by the same person all in the span of a 14-hour day, software quality control is not a stand-alone data integrity control to rely upon. Nonetheless, I'd argue it is still a part of today's control puzzle. Everything from ISO to CMM should be on the table here, and it'd be nice if we could start to see some sort of reference by medical app makers to the software quality coding method used to make their app and its inevitable updates.

4. Part 11.  Yes, I said it. 21 CFR 11 Electronic Records; Electronic Signatures. Now, before you bring up the spectre of "validate everything" (and trust me, as a recovering "validate everything" addict, I've got a lot of personally painful, embarrasing stories), I'm discussing how Part 11 (and the EU's Annex 11) are interpreted and enforced today. Today, Part 11 is all about data integrity - ensuring that data that is trustworthy. And isn't that the core question we just defined above?

So if a medical app provider can show that his/her medical app maintains data with integrity (i.e., is Part 11 compliant), isn't that enough for the vast majority of the 18,000+ medical apps out there?

Coincidentally, Sweden's Medical Products Agency just released a guide to the EU's medical device directives that discusses controls, risks, and expectations for medical software - including medical apps. Download a PDF of Sweden's guide here. It's approach seems quite reasonable. Makers of medical apps are to conduct a risk assessment of their app that includes risk to the patient (see control #2 above), and be able to demonstrate that the app meets its intended performance goals (see controls #3 and #4 above). Finally, the guide notes that smartphones and tablets, etc., will never be considered (and regulated as) medical devices unless they are specifically converted to be a medical device.

If only we in the States could be so reasonable....