Question: We are a technology company with no experience in medical devices. Our company is developing a product which may be a medical device. How do we get started?
Answer: More companies are being introduced to medical devices. This is a business area that has grown and technology companies provide some fresh perspectives on better ways to help users. Like many industries, medical devices have their own set of regulations and expectations. Navigating them can be confusing.
For someone new to medical devices, here are some steps to take to get started.
- Obtain an expert opinion on whether your product is a medical device and its classification. A consultant is often enough for an early assessment. Assuming the product is a medical device, get started using the following steps.
- Review the appropriate regulations and resources based on your planned countries of sale. A couple major sites are listed below.
- FDA-Device Advice: Comprehensive Regulatory Assistance: This is a starting point for industry to learn the US regulations and what may be needed
- EU Medical Device Directives: This is the main EU site which lists the primary requirements for CE Marking (needed for sale in the EU).
- International Medical Device Regulators Forum: This is an international group that works to harmonize the standards among different countries.
- ISO 13485: While not a regulation, many countries, including the EU, use this as the quality system standard which satisfies the regulations.[i]
- Develop the necessary internal quality system expertise. Consultants can help you establish a system. However, at a minimum, you should have a senior level employee who is responsible for the quality system.[ii]
- Establish the quality system: Keep the system and process as simple as possible.
- Identify gaps between your current practices and the quality system expectations.
- Prioritize and resolve the gaps. Some of the gaps will be structural, such as hold management meetings, conduct internal audits, controlled document system, or record documentation and retention policies. Other gaps may be cultural, such as establishing product requirements before starting development or all outliers in formal data need to be investigated.
- Use terminology that is consistent with the regulations (for example, design inputs instead of product requirements).
- Integrate risk management per ISO 14971 which is focused on user risk, not project or business risks.
- Identify other standards that are important based on your product type.
- Start using the system immediately. It is much easier to capture the needed information moving forward than to retroactively find and document it.
- Remediate the product(s): Depending on where you are in the development of the product, the work needed to bring it into compliance will vary. Perform a gap analysis. At a minimum, you will need a design history file with the necessary elements. Use a note to the file to explain any documents which are being created retroactively and why that is ok.
While this may seem like a lot of work, the cost of not doing it is expensive. Below are two examples of what can happen when a company new to medical devices doesn’t plan for the regulations.
- 23andMe marketed their Personal Genome Service test directly to consumers without obtaining FDA approval. As a result, they received a Warning Letter in 2013. They halted sales of their test and began discussions with the FDA. Two (2) years later obtained clearance for some of the 23andMe recessive carrier gene tests through a 510(k). The lesson here is that 23andMe made a mistake, worked with the FDA, and eventually were able to resume selling the tests.
- Theranos developed a Class II blood testing device and had clearance for their Herpes Simplex Virus-1I test via 510(k). FDA inspections noted deficiencies in their product development process. In addition, employees repeated raised internal quality concerns related to both the product development and blood testing practices. A series of Wall Street Journal articles led to an investigation by the Centers for Medicare & Medicaid Services (CMS), who eventually revoked Theranos’ CLIA license and imposed sanctions. As a consequence, Walgreens Boots terminated its business relationship with Theranos, shutting down the blood sample collection sites. Theranos is also under SEC investigation for misleading investors. Its value has dropped from $9 billion to under $800 million. The lesson here is that ignoring the regulations and poor quality processes can cost a company its ability to sell its product and destroy value.
If you are new to medical devices, we initially recommend that you either hire an internal expert or a consultant to help you navigate important regulatory rules, including building the necessary infrastructure and resources to sell medical devices today and in the future. See our other medical device blogs.
[ii] The difference between regulatory and quality can be confusing for someone new to medical devices. Regulatory is generally concerned with how the company interacts with the regulatory agencies such as FDA, usually around submissions and database maintenance. Quality is concerned with how the company implements and maintains the regulations internally such as internal records and CAPA.