Inspections, Compliance, Enforcement, and Criminal Investigations
Electronic Data Systems 07-Feb-05
Department of Health and Human Services
Public Health Service
Baltimore District Office
VL #: 05200033
February 7, 2005
RETURN RECEIPT REQEUSTED
Fielding “Butch” Cochran, Vice President
Military Health Programs Account
Electronic Data Systems
13600 EDS Drive
Herndon, VA 20171
Dear Mr. Cochran:
During an inspection of your establishment located at 5113 Leesburg Pike, Skyline 4, Suite 300, Falls Church, VA on September 13 through October 5, 2004, United States Food and Drug Administration (FDA) investigators, [redacted] and [redacted] determined that your establishment manufactures the Defense Blood Standard System (DBSS) software, version 3.04. This product is a device as defined by Section 201(h) of the Federal Food, Drug, and Cosmetic Act (the FD&C Act).
The above stated inspection revealed that this device is adulterated within the meaning of Section 501 (h) of the FD&C Act, in that the methods used in, or the facilities or controls used for, the manufacture, packing, storage, or installation of the DBSS are not in conformance with Current Good manufacturing Practice (CGMP) requirements of the Quality System (QS) regulation for medical devices, as specified in Title 21, Code of Federal Regulations (CFR), Part 820.
Quality System Regulation
At the close of the inspection, your firm was issued a list of inspectional observations, Form FDA-483, which identified a number of significant QS regulation violations including, but not limited to, the following:
1. Your firm failed to ensure that the procedures for implementing corrective and preventive actions were complete, as required by 21 CFR 820.100(a), [FDA-483, Item 1]. Specifically,
a. Your firm’s complaint handling procedures do not address how to enter data into the [redacted] electronic system to provide accurate figures to management on the number of trouble tickets received for similar issues or the number of complaints that are actually closed and resolved versus closed but unresolved.
b. Terms and categories entered into the various fields of the [redacted] have not been defined in a procedure to assure that they are used consistently to accurately determine the status of all software requests. The [redacted] is the software application used for tracking software requests, software testing problems, and software corrections.
c. Procedure [redacted] does not address the appropriate documentation for problems for which no workaround is possible nor does it address how the documentation should be entered into the [redacted]. While workaround forms for at least [redacted] system incident reports state "no workaround: or "no workaround possible," [redacted] records note that workarounds exist for these problems.
2. The software used by your firm as part of the quality system has not been fully validated for its intended use according to an established protocol, as required by 21 CFR 820.70(i), [FDA-483, Item 2]. Specifically,
a. The [redacted] software application, used for complaint handling, has not been validated to assure that the queries initiated to track and trend complaints yield accurate results. For example, the actual status of trouble tickets cannot be determined since they are categorized [redacted] whether or not the underlying issue has been corrected or otherwise resolved.
b. Information generated from data in [redacted] cannot be relied upon as accurate. For example: (1) [redacted] system report records indicate that workarounds exist when in fact no workarounds exists. (2) At least [redacted] system reports corrected in DBSS Version [redacted] are linked to DBSS Version [redacted] in [redacted]. (3) Individual software requests that are closed when linked to an open master software request are not always shown on the master request record.
3. Your firm failed to address design input requirements that are incomplete, as required by 21 CFR 820.30(c) [FDA-483, Item 31. Specifically,
a. Functional requirements for the DBSS are in some cases very high level. For example, the requirements for Donor Reporting merely state that the application must enable the user to identify, from a list of persons, the donor on whom the report should be based, and to print an Autologous Unit Status Report, a Donor History Report, a Person Audit Trail Report, a Deferral Audit Trail Report, and an Individual Donor Orders Report for a specific donor. The requirements do not address the files to be accessed, the fields to be printed, or the format of the ave been written for problems with these reports. [redacted] have been written for problems with these reports. For example, [redacted] concerns the military personnel’s SSN appearing where the donor’s SSN should appear on the Donor Audit Trail Report.
b. Detailed design specifications for DBSS version 3.04 could not be located Design specifications for DBSS Version [redacted], which is [redacted] and DBSS Version [redacted] which is currently being tested, only address changes to the current 3.04 version.
4. Your firm’s acceptance criteria were not complete prior to the performance of verification activities, as required by 21 CFR 820.30(f) [FDA-483, Item 4]. Specifically,
a. Unit testing of the [redacted] functionality in the DBSS Version [redacted] was completed and accept as passing although the output of the [redacted] report was incorrect. Unit testing was documented as passing on September 2, 2004. System integration testing on September 3, 2004 found that the merge report generated after the merge is incorrect in that the person shown as deleted and the person shown as kept are reversed on the report.
b. [redacted] initiated b a user site in 1999, documented this particular problem with the report. The [redacted] as invalidated by the SRRB (System Request Review Board) on August 12, 2004, with the rationale, “works as intended.”
5. Your firm fails to maintain complete complaint files, as required by 21 CFR 820.198(a) [FDA-483, Item 51. Specifically, investigation files are not complete. Facsimiles received from users depicting the software problem and screen-prints of the Customer Support personnel's re-creation of the problem are not retained. For example, files for trouble ticket [redacted] and related [redacted] concerning the incorrect SSN on the Donor Audit TRail REport, did not contain hard copy documentation from the user or the Customer Support personnel's re-creation of the problem.
6. Your firm’s device master record does not include or refer to the location of all software specifications, as required by 21 CFR 820.181(a) [FDA-483, Item 6]. Specifically, the device master record for DBSS Version [redacted] does not reference at least [redacted] system requests that were included in that version.
FDA evaluated the corrective actions taken to correct the objectionable conditions noted during the previous February-March 2003 inspection at your establishment. While EDS has taken steps to correct the previously cited deficiencies, several deficiencies from the previous inspection are identical or similar to those observed during the current inspection at your establishment.
FDA has received your letter dated November 2, 2004, responding to the Form FDA-483, (Inspectional Observations), issued and discussed with you at the conclusion of the inspection. We would like to comment on the following statement in your letter, “We talked to [redacted] the FDA Inspection Team lead, and she agreed that EDS should not address corrective actions en u-r response to each observation because EDS will no longer be in a position to take such actions.” At the conclusion of the inspection, EDS management stated that EDS would not respond to the FDA-483 observations due to the loss of the DBSS sustainment contract. Investigator [redacted] responded that she understood. Investigator [redacted] did not agree that EDS should not respond to the FDA-483 observations, nor did she instruct EDS not to respond. This letter is not intended to be an all inclusive list of the deficiencies at your facility. It is your responsibility to assure adherence to all applicable FDA regulations and the FD&C Act. The specific violations noted in this. letter and on the Form FDA-483 issued at the conclusion of the inspection may be symptomatic of serious underlying problems with your firm’s manufacturing and quality assurance systems. Federal agencies are advised of the issuance of Warning Letters regarding medical devices so that they may take this information into consideration when awarding contracts.
You should take prompt action to correct these violations. Failure to promptly correct these violations may result in regulatory action being initiated by.FDA without further notice. These actions include, but are not limited to, seizure, injunction, and/or civil penalties.
Please notify this office in writing, within fifteen (15) working days of receipt of this letter, of the specific steps you have taken, or will take, to identify and correct the noted violations, including (1) the time frames within which the corrections will be completed, (2) any documentation indicating the corrections have been achieved, and (3) an explanation of each step being taken to identify and make corrections to any underlying systems problems necessary to ensure similar violations will not recur.
Your reply should be sent to the Food and Drug Administration, 6000 Metro Drive, Suite 101, Baltimore, Maryland 21215, to the attention of Ms. Vinetta Howard-King, Compliance Officer. Ms. Howard-King can be reached at (410) 779-5454, extension 413.