Inspections, Compliance, Enforcement, and Criminal Investigations
SUBCHAPTER 5.6 - DEVICES
See IOM 2.2 for discussion of statutory authority.
The term "device" is defined in Sec. 201(h) of the FD&C Act [21 U.S.C. 321 (h)]. In-vitro diagnostics (21 CFR 809) are devices, as defined in 201(h) of the Act [21 U.S.C. 321 (h)], and may also be biological products subject to Section 351 of the PHS Act.
Inspections involving devices should be made only by those individuals qualified by training and experience in the device area. Electronic product radiation is defined in 21 CFR 1000. Because of the specific nature of inspections and investigations involving radiation, only personnel who have special training in this field should be assigned such work. However, others may participate for training purposes. Specific Compliance Program Guidance Manuals designate the type of individual and special training required for work in these areas.
CAUTION: Radiation-emitting devices and substances present a unique hazard and risk potential. Every effort should be taken to prevent any undue exposure or contamination. Monitoring devices must be used whenever radiation exposure is possible. Investigators should also be on the alert for, and avoid contact with, manufacturing materials and hazards associated with the manufacturing of many types of devices, which may present a threat to health, e.g., ethylene oxide, high voltage, pathogenic biomaterials, etc. See IOM 1.5 for additional safety information.
Each region and some districts have engineers and radiological health personnel available for technical assistance and consultation. Do not hesitate to make use of their services.
Engineers, quality assurance specialists, and expert investigators in ORA/ OO/OMPTO/Division of Medical Products and Tobacco Program Operations (DMPTPO),301-796-0358, are available for on-site consultation and assistance in problem areas. The division's subject matter experts are also available by telephone for consultation and to answer questions regarding regulation and program interpretation and QS/GMP application. Additionally, the CDRH Office of Compliance enforcement divisions (organized by device product) can be contacted as necessary.
WEAC has various personnel (biomedical, sterility, electronic, materials, mechanical, nuclear and plastics engineers) available for telephone consultation and on-site assistance at 781-756-9700.
Because of the limited funds available for samples and the relatively high cost of device samples, it is essential you consider, in consultation with your supervisor, the following factors before collecting a physical sample of a device:
- If follow-up to a QS/GMP deviation, will sampling demonstrate the deviation and/or a defective product? Documentary Samples may be more suitable for QS/GMP purposes.
- Likelihood of the analysis showing the device is unfit for its intended use.
- Samples costing over $250.00.
- Laboratory capability to analyze the sample. See IOM 220.127.116.11.6 for sample routing information.
If you are still uncertain, discuss with your supervisor and contact the CDRH Laboratory or WEAC 781-756-9700 for assistance.
Contact CDRH for assistance as follows:
In-vitro Diagnostic Devices - Office of Science and Technology (HFZ-113).
NOTE: Device samples do not require 702(b) portions. Include in the FDA 525 and with the C/R, if destined for different locations, a copy of the firm's finished device specifications, test methods and acceptance and/or rejection criteria.
General device inspections will be conducted under various Compliance Programs found in the Compliance Program Guidance Manual. The majority of these will be QS/GMP inspections, but often the reason for the inspection will vary. For example, inspections may be conducted to assist the pre-market clearance process (PMA or Class III 510(k)), to specifically address MDR concerns, or to assure in-depth coverage of an aspect of manufacturing (sterility). The following describes some of these inspections.
Bio-research monitoring (BIMO) assignments for medical devices will generally be issued by the Center for Devices and Radiological Health (CDRH) (see IOM 5.5.6).
Section 520(f) of the FD&C Act [21 U.S.C. 360j(f)] provides the Agency with authority to prescribe regulations requiring that the methods used in, and the facilities and controls used for, the manufacture, packing, storage, and installation of medical devices conform to good manufacturing practices. The medical device Quality System/Good Manufacturing Practices Regulation (QS/GMP)(21 CFR 820) became effective on June 1, 1997.
21 CFR 820 is established and promulgated under the authority of Sections 501, 502, 510, 513, 514, 515, 518, 519, 520, 522, 701, 704, 801 and 803 of the FD&C Act (21 U.S.C. 351, 352, 360, 360c, 360d, 360e, 360h, 360i, 360j, 360l, 371, 374, 381 and 383). Failure to comply with the provisions of 21 CFR 820 renders a device adulterated under Section 501(h) of the FD&C Act [21 U.S.C. 351(h)].
The regulations promulgated under 21 CFR 820 establish minimum requirements applicable to finished devices, as defined in 820.1(a). This regulation is not intended to apply to manufacturers of components or parts of finished devices, but instead recommended to them as a guide. In some special cases, components have been classified as finished devices (dental resins, alloys, etc.) and are subject to the QS/GMP. Manufacturers of human blood and blood components are not subject to this part, but are subject to 21 CFR 606.
The QS/GMP includes regulations regarding Purchasing Controls, 21 CFR 820.50, Receiving, In-process and Finished Device Acceptance, 21 CFR 820.80, and Traceability, 21 CFR 820.65, that require finished device manufacturers exercise more control over the components they use in their devices. The preamble of the QS/GMP states: "Since FDA is not regulating component suppliers, FDA believes that the explicit addition to the CGMP requirements of the purchasing controls...is necessary to provide the additional assurance that only acceptable components are used." And "...inspections and tests, and other verification tools, are also an important part of ensuring that components and finished devices conform to approved specifications." It further states, "...traceability of components must be maintained so potential and actual problem components can be traced back to the supplier."
The medical device QS/GMP is an umbrella GMP that specifies general objectives rather than methods. It is left to the manufacturer to develop the best methods to meet these objectives. You must use good judgment in determining compliance with the QS/GMP, keeping in mind that it is an umbrella GMP and all requirements may not apply or be necessary. The purpose of the QS/GMP is to assure conformance to specifications and to ensure that all requirements that will contribute to assuring the finished device meets specifications are implemented. You should not insist that a manufacturer meet non-applicable requirements. Refer to IOM Exhibit 5-13 for types of establishments that are required to comply with the QS/GMP.
Prior to the start of any medical device inspection, the factory jacket or establishment history of the establishment should be reviewed. You should review the previous inspectional findings and subsequent correspondence between the establishment and FDA; any MDR or consumer complaints where it was determined follow-up would occur at the next inspection; and any notifications of recalls since the last inspection.
The following on-line databases should be queried through the CDRH Information Retrieval System (CIRS):
- For Medical Device Reporting (MDR) data (MAUDE)
- Registration and Listing data, and 510(k)
- PMA summary data (OSCAR);
These databases are accessible to users with individual accounts. Accounts can be requested through the district or regional CIRS liaisons or from DMPTPO - Dolores Harper 301-796-5439.
MDR data most useful in preparing for an inspection includes specific MDRs for the manufacturer (i.e., query by establishment's short name) for the time frame since the last inspection, or MDRs for the generic devices manufactured by that establishment (i.e., query by product code) for some reasonable time frame. This data assists you in determining potential problem areas in the manufacture or design of the device, or lot or batch specific issues.
The establishment's reported registration and listing data should be verified during any GMP inspection to assure there have been no changes and the registration and listing data was accurately reported. Changes or inaccuracies should be immediately reported to the district medical device registration and listing monitor. See also Field Management Directive (FMD) 92.
510(k) and PMA data assists you in determining what devices the establishment is manufacturing and whether any new devices have been designed or changed since the last inspection. This data is useful in focusing the inspection on new or changed devices as well as devices that are higher risk devices, i.e., Class II or III versus Class I.
IOM 5.2 should be followed in regards to pre-announcement of medical device inspections.
The inspectional approach for identifying inadequate auditing of a quality assurance program is limited by the agency's policy, which prohibits access to audit results. The policy is stated in CPG section 130.300 (7151.02). Under the QS/GMP regulation (21 CFR 820.180 (c)) this prohibition extends to evaluations or audits of suppliers, 21 CFR 820.50(a), and Management Reviews conducted per 21 CFR 820.20. Evidence of inadequate auditing may be discovered without gaining access to the written audit reports. See the Guide to Inspections of Medical Device Manufacturers or Guide to Inspections of Quality Systems for inspectional guidance.
The preamble to the QS/GMP specifically states, "FDA will review the corrective and preventive action procedures and activities performed in conformance with those procedures without reviewing the internal audit reports. FDA wants to make it clear that corrective and preventive actions, to include the documentation of these activities, which result from internal audits and management reviews are not covered under the exemption at 820.180(c)." Therefore, these corrective and preventive actions and documentation are not excepted from inspectional scrutiny.
The QS/GMP regulation (21 CFR 820.180(c)) requires a manufacturer to certify in writing that audits and reaudits have been conducted whenever requested to do so by an investigator. Investigators through their supervisors should consult with CDRH (HFZ-306) prior to requesting such certification.
FDA has distinct authority under section 704(e) of the FD&C Act [21 U.S.C. 374 (e)] to inspect and copy records required under section 519 or 520(g) of the FD&C Act [21 U.S.C. 360i or 360j (g)]. Investigators should only collect copies of documents as necessary to support observations or to satisfy assignments. Manufacturers who have petitioned for and obtained exemption from the QS/GMP are not exempted from FDA authority to review and copy complaints and records associated with investigation of device failures and complaints.
You may advise manufacturers they may mark as confidential those records they deem proprietary to aid FDA in determining which information may be disclosed under Freedom of Information.
Records must be maintained for as long as necessary to facilitate evaluation of any report of adverse performance, but not less than two years from the date the device is released for distribution. Records required by the Radiation Control for Health and Safety Act must be maintained for five years. It is permissible to retain records in photocopy form, providing the copies are true and accurate reproductions.
Complaints are written or oral expressions of dissatisfaction with finished device identity, quality, durability, reliability, safety, effectiveness or performance. Routine requests for service would not normally be considered complaints. However, service requests should be reviewed to detect complaints, and as part of any trend analysis system, and to comply with 820.20(a)(3).
FDA has the authority to require a device firm to open its complaint files, and review and copy documents from the file.
Provisions in the FD&C Act pertaining to FDA review of records are:
- For restricted devices the FD&C Act in Section 704(a)(1)(B) [21 U.S.C. 374 (a)(1)(B)] extends inspection authority to records, files, papers, processes, controls and facilities bearing on restricted medical devices. See FD&C Act Sec. 704 [21 U.S.C. 374] for a full explanation and for a list of the items, e.g., financial data, which are exempt from disclosure to FDA.
- For all devices, including restricted devices, refer to Section 704(e) of the FD&C Act [21 U.S.C. 374 (e)], which provides for access to, copying and verification of certain records.
- Section 519 of the FD&C Act [21 U.S.C. 360i] requires manufacturers, importers, or distributors of devices intended for human use to maintain such records, and provide information as the Secretary may by Regulation reasonably require.
- Section 520(g) of the FD&C Act [21 U.S.C. 360j (g)] covers the establishment of exemptions for devices for investigational use and the records which must be maintained and open for inspection.
QS/GMP requirements for complaint files are found in 21 CFR 820.198. GMP requirements for complaint files first became effective on December 18, 1978. The Quality System Regulation, which went into effect on June 1, 1997, added to and modified the requirements for complaint handling. The regulation contains a provision that records maintained in compliance with the QS/GMP must be available for review and copying by FDA (21 CFR 820.180). Complaint files are QS/GMP required records; therefore, the manufacturer must make all complaints received on or after December 18, 1978 and the records of their investigation available for FDA review and copying. EIRs should contain enough information to allow cross-referencing between complaints and MDRs.
21 CFR Part 803 requires medical device manufacturers to report deaths, serious illnesses, and serious injuries to FDA for which a device has or may have caused or contributed, and manufacturers must also report certain device malfunctions. The MDR reportable events must be maintained in a separate portion of the complaint files or otherwise clearly identified. These complaints must be investigated to determine whether the device failed to meet specifications; whether the device was being used for treatment or diagnosis; and the relationship, if any, of the device to the reported incident or adverse event.
When a firm determines complaint handling will be conducted at a place other than the manufacturing site, copies of the record of investigation of complaints must be reasonably accessible at the actual manufacturing site.
Inspections of sterile device manufacturers are conducted per Compliance Program Guidance Manual 7382.845, as a production process under the Production and Process Control Subsystem. See the Guide to Inspections of Quality Systems for further guidance.
Specific labeling requirements for in vitro diagnostics (IVDs) are contained in 21 CFR 809.10.
Part 809.10(a) contains explicit labeling requirements for the individual IVD containers, and for the outer package labeling and/or kit labeling. Part 809.10(b) contains special labeling requirements for the product insert, which must be included with all IVD products. These two sections also contain the requirements for: lot numbers, allowing traceability to components (for reagents) or subassemblies (for IVD instruments); stability studies for all forms of the product; an expiration date, or other indication to assure the product meets appropriate standards; and, the requirements for establishing accuracy, precision, specificity and sensitivity (as applicable).
Part 809.10(c) lists the labeling statements required for IVDs which are being sold for investigational and research use. Determine whether the firm is limiting the sale of IVDs, labeled as such, to investigators or researchers. Document any questionable products, and submit to CDRH for review.
Warning and caution statements recommended for certain devices, along with certain restrictions for use, are described in 21 CFR 801. This same section also contains the general labeling regulations, which apply to all medical devices.
Inspections under the GWQAP are conducted upon request by Office of Enforcement and Import Operations (OEIO), Division of Compliance Systems (DCS). Each assignment is specific and may involve more than a single compliance program. Specific questions arising during or as a result of these inspections should be directed to OEIO/DCS.
Device manufacturers may employ the services of outside laboratories, sterilization facilities, or other manufacturers (i.e., injection molders, packagers, etc). The finished device manufacturer is responsible for assuring these contractors comply with the QS/GMP and that the product or service provided is adequate. These contractors are subject to FDA inspection and some are subject to the QS/GMP regulation. This “…includes but is not limited to those who perform the functions of contract sterilization, installation, relabeling, remanufacturing, repacking, or specification development, and initial distributors of foreign entities performing these functions,” per 21 CFR 820.3(o). Whether under contract or not if a firm manufactures a finished device by the definition found in 21 CFR 820.3(l) "Finished device" means any device or accessory to any device that is suitable for use or capable of functioning, whether or not it is packaged, labeled, or sterilized they are subject to QS/GMP. NOTE: if the product manufactured by the contractor also meets the definition of a component and a finished device, the contractor is subject to the QS/GMP regulation.
Determine how a manufacturer evaluates and selects potential contractors for their ability to meet the manufacturer's requirements, as required by 820.50, Purchasing Controls. Conducting audits can be an effective method for assessment. However, not all contractors allow audits. Audits may not be feasible in some instances. In other instances the activity the contractor is conducting may not have a significant impact on the device safety or function; therefore, expending the resources necessary to audit the contractor may not be warranted.
Evaluations may be accomplished by other means such as requesting that the potential contractor fill out a questionnaire about their quality system, asking other customers of the contractor about their experiences with the firm, or basing assessments on past performance. Evaluations must be documented. The extent to which a manufacturer has evaluated a contractor, as well as the results of the evaluation, should govern the degree of oversight exercised over products and services supplied by the contractor.
When inspecting one-person or very small manufacturers for compliance with the QS/GMP master record and written procedure requirements, the investigator should realize that detailed written assembly, process, and other instructional procedures required for larger firms may not be needed. In a small firm, division of work is at a minimum, with one person often assembling and testing the finished device. In many cases, blueprints or engineering drawings could be adequate procedures. The QS regulation requires that certain activities be defined, documented and implemented. The regulation does not require separate procedures for each requirement and often several requirements can be met with a single procedure. The complexity of the procedures should be proportional to the complexity of the manufacturer's quality system, the complexity of the organizational structure and the complexity/risk of the finished device being produced. In assessing the need for detailed or lengthy written procedures, the investigator should make judgments based on training and experience of the individuals doing the work and the complexity of the manufacturing process. However, this does not mean small manufacturers have any less responsibility for complying with the QS regulation or assuring safe and effective devices are produced.
Section 516 of the FD&C Act [21 U.S.C. 360f] provides a device for human use may be banned by regulation (21 CFR 895) if it presents substantial deception or an unreasonable and substantial risk of illness or injury. Investigators should become familiar with this regulation. When you determine, during an inspection or investigation, that banned devices are being distributed, the distribution, manufacture, etc., should be documented as for any other violative product.
See IOM 1.1. English language requirement. You should write your EIR following the guidance in IOM 5.10.4, 18.104.22.168, 22.214.171.124, 126.96.36.199. Section headings can be added to address the needs of other Compliance Program Guidance Manuals such as 7383.001 for pre-market and post-market PMA inspections. Include in your report the systems, processes, products, and product classification covered during the current inspection.