Medical Devices; Current Good Manufacturing Practice (CGMP) Final Rule; Quality System Regulation
[Federal Register: October 7, 1996 (Volume 61, Number 195)] [Rules and Regulations] [Page 52601-52662] From the Federal Register Online via GPO Access [wais.access.gpo.gov] [Page 52601] ____________________________________________________________________ Part VII Department of Health and Human Services ____________________________________________________________________ Food and Drug Administration ____________________________________________________________________ 21 CFR Parts 808, 812, and 820 Medical Devices; Current Good Manufacturing Practice (CGMP); Final Rule [Page 52602] DEPARTMENT OF HEALTH AND HUMAN SERVICES Food and Drug Administration 21 CFR Parts 808, 812, and 820 [Docket No. 90N-0172] RIN 0910-AA09 Medical Devices; Current Good Manufacturing Practice (CGMP) Final Rule; Quality System Regulation AGENCY: Food and Drug Administration, HHS. ACTION: Final rule. ----------------------------------------------------------------------- SUMMARY: The Food and Drug Administration (FDA) is revising the current good manufacturing practice (CGMP) requirements for medical devices and incorporating them into a quality system regulation. The quality system regulation includes requirements related to the methods used in, and the facilities and controls used for, designing, manufacturing, packaging, labeling, storing, installing, and servicing of medical devices intended for human use. This action is necessary to add preproduction design controls and to achieve consistency with quality system requirements worldwide. This regulation sets forth the framework for device manufacturers to follow and gives them greater flexibility in achieving quality requirements. DATES: The regulation is effective June 1, 1997. For more information on compliance with 21 CFR 820.30 see section IV. of this document. Written comments on the information collection requirements should be submitted by December 6, 1996. ADDRESSES: Submit written comments on the information collection requirements to the Dockets Management Branch (HFA-305), Food and Drug Administration, 12420 Parklawn Dr., rm. 1-23, Rockville, MD 20857. All comments should be identified with the docket number found in brackets in the heading of this document. FOR FURTHER INFORMATION CONTACT: Kimberly A. Trautman, Center for Devices and Radiological Health (HFZ-341), Food and Drug Administration, 2098 Gaither Rd., Rockville, MD 20850, 301-594-4648. SUPPLEMENTARY INFORMATION: I. Background Manufacturers establish and follow quality systems to help ensure that their products consistently meet applicable requirements and specifications. The quality systems for FDA-regulated products (food, drugs, biologics, and devices) are known as CGMP's. CGMP requirements for devices in part 820 (21 CFR part 820) were first authorized by section 520(f) of the Federal Food, Drug, and Cosmetic Act (the act) (21 U.S.C. 360j(f)), which was among the authorities added to the act by the Medical Device Amendments of 1976 (Pub. L. 94-295). Under section 520(f) of the act, FDA issued a final rule in the Federal Register of July 21, 1978 (43 FR 31 508), prescribing CGMP requirements for the methods used in, and the facilities and controls used for the manufacture, packing, storage, and installation of medical devices. This regulation became effective on December 18, 1978, and is codified under part 820. Except for editorial changes to update organizational references in the regulation and revisions to the list of critical devices that was included in the preamble to the final regulation, the device CGMP requirements have not been revised since 1978. This final rule is the result of an extensive effort begun in 1990 to revise this regulation. The Safe Medical Devices Act of 1990 (the SMDA) (Pub. L. 101-629), enacted on November 28, 1990, amended section 520(f) of the act, providing FDA with the authority to add preproduction design controls to the CGMP regulation. This change in law was based on findings that a significant proportion of device recalls were attributed to faulty design of product. Specifically, in January 1990, FDA published the results of an evaluation of device recalls that occurred from October 1983 through September 1989, in a report entitled ``Device Recalls: A Study of Quality Problems'' (Ref. 1). (See 55 FR 21108, May 22, 1990, where FDA announced the availability of the report.) FDA found that approximately 44 percent of the quality problems that led to voluntary recall actions during this 6-year period were attributed to errors or deficiencies that were designed into particular devices and may have been prevented by adequate design controls. These design-related defects involved both noncritical devices (e.g., patient chair lifts, in vitro diagnostics, and administration sets) and critical devices (e.g., pacemakers and ventilators). Also in 1990, the Department of Health and Human Services' Inspector General conducted a study entitled ``FDA Medical Device Regulation From Premarket Review to Recall'' (Ref. 2), which reached similar conclusions. With respect to software used to operate medical devices, the data were even more striking. A subsequent study of software-related recalls for the period of fiscal year (FY) 1983 through FY 1991 indicated that over 90 percent of all software- related device failures were due to design-related errors, generally, the failure to validate software prior to routine production (Ref. 3). The SMDA also added new section 803 to the act (21 U.S.C. 383) which, among other things, encourages FDA to work with foreign countries toward mutual recognition of CGMP requirements. FDA undertook the revision of the CGMP regulation to add the design controls authorized by the SMDA to the CGMP regulation, as well as because the agency believed that it would be beneficial to the public and the medical device industry for the CGMP regulation to be consistent, to the extent possible, with the requirements for quality systems contained in applicable international standards, primarily, the International Organization for Standards (ISO) 9001:1994 ``Quality Systems--Model for Quality Assurance in Design, Development, Production, Installation, and Servicing'' (Ref. 4), and the ISO committee draft (CD) revision of ISO/CD 13485 ``Quality Systems-- Medical Devices--Supplementary Requirements to ISO 9001'' (Ref. 5). This action is being taken under those provisions of the SMDA and in response to the following: (1) Notices that appeared in the Federal Register of April 25, 1990 (55 FR 17502), and in the Federal Register of April 17, 1991 (56 FR 15626), that announced meetings of the agency's Device Good Manufacturing Practice Advisory Committee (GMP Advisory Committee), at which the need for revisions to the CGMP regulation was explored; (2) an advance notice of proposed rulemaking (ANPRM) that appeared in the Federal Register of June 15, 1990 (55 FR 24544), that announced the agency's intent to revise the CGMP regulation; (3) a notice of availability of a document that appeared in the Federal Register of November 30, 1990 (55 FR 49644), entitled ``Medical Devices; Current Good Manufacturing Practices (CGMP) Regulations Document; Suggested Changes; Availability'' (Ref. 6) and comments solicited from the public about the document; (4) a proposed rule in the Federal Register of November 23, 1993 (58 FR 61952), (Ref. 7) and comments solicited from the public about the proposal; (5) a notice of availability that appeared in the Federal Register of July 24, 1995 (60 FR 37856), announcing the availability of the ``Working Draft of the Current Good Manufacturing Practice (CGMP) Final Rule'' (hereinafter referred to as the Working Draft) (Ref. 8) and comments [Page 52603] solicited from the public about the Working Draft; (6) testimony at an August 23, 1995, open public meeting announced in the Federal Register (60 FR 37856); (7) and testimony and advisory committee recommendations from the September 13 and 14, 1995, meeting of the GMP Advisory Committee announced in the Federal Register of August 24, 1995 (60 FR 44036). Thus, FDA's decision to revise the CGMP regulation is based on changes in the law made by the SMDA, the agency's discussions with others including its GMP Advisory Committee, responses to the Federal Register notices on this matter, FDA's analysis of recall data, its experience with the regulatory application of the original CGMP regulation, and its assessment of international quality standards. The agency's final rule embraces the same ``umbrella'' approach to the CGMP regulation that is the underpinning of the original CGMP regulation. Because this regulation must apply to so many different types of devices, the regulation does not prescribe in detail how a manufacturer must produce a specific device. Rather, the regulation provides the framework that all manufacturers must follow by requiring that manufacturers develop and follow procedures and fill in the details that are appropriate to a given device according to the current state-of-the-art manufacturing for that specific device. FDA has made changes to the proposed regulation and the Working Draft, as the final rule evidences, to provide manufacturers with even greater flexibility in achieving the quality requirements. The Supreme Court recently addressed the preemptive effect, under section 521 of the act (21 U.S.C. 360k), of the original CGMP regulation and other FDA requirements for medical devices on State tort actions. In Medtronic, Inc. v. Lohr, 116 S. Ct. 2240 (1996), the Supreme Court gave substantial deference to the agency's interpretation of section 521 of the act found at Sec. 808.1 (21 CFR 808.1). The Court noted that CGMP requirements are general rather than ``specific requirements applicable to a particular device,'' and that State common law remedies are similarly general, and do not establish a ``substantive requirement for a specific device.'' (Lohr at 2257; see also Sec. 808.1(d) and (d)(6)(ii).) Moreover, the Court drew a distinction between remedies and requirements, noting that while common law tort actions may provide remedies different from those available under the act, no preemption occurs unless the substantive requirements of the State law are ``different from, or in addition to,'' those imposed by the act. (See Lohr at 2255.) Under the Supreme Court's analysis in Lohr, the requirements imposed by the original CGMP regulation would rarely have preemptive effect. FDA believes that the reasoning of Medtronic v. Lohr applies equally to the new quality system regulation, which, as does the original CGMP regulation, prescribes requirements that apply to medical devices in general, rather than to any particular medical device. Therefore, FDA has concurrently amended part 808 (21 CFR part 808) to make clear the new quality system regulation does not preempt State tort and common law remedies. II. Decision to Make a Working Draft Available for Comment In the Federal Register of November 23, 1993, the agency issued the proposed revisions to the CGMP regulation, entitled ``Medical Devices; Current Good Manufacturing Practice (CGMP) Regulations; Proposed Revisions; Request for Comments,'' and public comment was solicited. After the proposal issued, FDA met with the Global Harmonization Task Force (the GHTF) Study Group in early March 1994, in Brussels, to compare the provisions of the proposal with the provisions of ISO 9001:1994 and European National Standard (EN) 46001 ``Quality Systems-- Medical Devices--Particular Requirements for the Application of EN 29001'' (Ref. 9). ISO 9001:1994 and EN 46001:1994 are written as voluntary standards, but when used to fulfill the requirements of the European Medical Device Directives, or other national regulations, these standards are mandatory requirements similar to the CGMP requirements. The GHTF includes: Representatives of the Canadian Ministry of Health and Welfare, the Japanese Ministry of Health and Welfare, FDA, and industry members from the European Union (EU), Australia, Canada, Japan, and the United States. The participants at the GHTF meeting favorably regarded FDA's effort toward harmonization with international standards. The GHTF submitted comments, however, noting where FDA could more closely harmonize to achieve consistency with quality system requirements worldwide. Since the proposal published, FDA has also attended numerous industry and professional association seminars and workshops, including ISO Technical Committee (TC) 210 ``Quality Management and Corresponding General Aspects for Medical Devices'' meetings, where the proposed revisions were discussed. The original period for comment on the proposal closed on February 22, 1994, and was extended until April 4, 1994. Because of the heavy volume of comments and the desire to increase public participation in the development of the quality system regulation, FDA decided to publish the notice of availability in the Federal Register to allow comment on the Working Draft before issuing a final regulation. The Working Draft represented the agency's views at the time on how it would respond to the many comments received, and on how the agency believed a final rule should be framed. FDA solicited public comment on the Working Draft until October 23, 1995, to determine if the agency had adequately addressed the many comments received and whether the agency had framed a final rule that achieved the public health goals to be gained from implementation of quality systems in the most efficient manner. III. Open Public Meeting and GMP Advisory Committee Meeting FDA held an open public meeting on the quality system regulation on August 23, 1995. The public meeting consisted of prepared presentations followed by an open discussion period. Both the agency and the participants found the meeting to be very productive in focusing attention on the few main areas of concern in the Working Draft. The main issues were: The application of the regulation to component manufacturers; the application of the regulation to third party servicers and refurbishers; and the implementation timeframe of the final rule. A transcript of the proceedings of the public meeting, as well as data and information submitted to FDA during the public meeting, are available from the Dockets Management Branch (HFA-305), Food and Drug Administration, 12420 Parklawn Dr., rm. 1-23, Rockville, MD 20857, between 9 a.m. and 4 p.m., Monday through Friday. There also was a meeting of the GMP Advisory Committee on the Working Draft on September 13 and 14, 1995. A notice of the meeting was published in the Federal Register of August 24, 1995. FDA made a brief presentation to the committee on the changes from the 1993 proposal to the 1995 Working Draft and discussed some changes that FDA was recommending as a result of the August 1995 meeting. Two consultants also made presentations to the committee, one a representative from ISO TC 176 (the TC that authored the ISO 9000 series) and the other a representative from the European Committee for Standardization (CEN). The remainder of the meeting consisted of prepared [Page 52604] presentations from the public and the committee's discussion on the main issues. The overwhelming majority of the committee members believed that the Working Draft met the public health needs, gave manufacturers sufficient flexibility to comply with the regulation, and met the agency's goal of harmonizing the quality system requirements with those of other countries. The GMP Advisory Committee strongly supported FDA's recommendation, in response to the August 1995 public meeting, to not include component manufacturers under this final rule. However, the GMP Advisory Committee was clearly divided on several issues related to the proposed regulation of third party servicers and refurbishers. A transcript of the proceedings of the GMP Advisory Committee meeting, as well as data and information submitted to FDA during the meeting, are available from the Dockets Management Branch (address above). After considering the written comments and the views expressed at meetings with the GHTF, at the August 1995 public meeting, and at the September 1995 GMP Advisory Committee meeting, FDA is publishing this final rule. A summary of changes from the July 1995 Working Draft to the final rule is contained at the end of this preamble. IV. Implementation of the Final Rule FDA has decided, in response to the many comments and concerns expressed about the need for more time to implement design controls, to implement the final rule in two stages. Under stage one, on June 1, 1997, approximately 1 year after this rule is published in the Federal Register, all elements of the final rule become effective. However, with respect to the design control requirements in Sec. 820.30, as long as manufacturers are taking reasonable steps to come into compliance, FDA will implement a special 1-year transition program, with a midcourse review, during which official agency action will not be initiated, including FDA Form 483 observations, warning letters, or enforcement cases, based on failure to comply with Sec. 820.30. Under stage two, beginning June 1, 1998, FDA will treat noncompliance with design control requirements in Sec. 820.30 the same as noncompliance with other provisions of the CGMP regulation. To prepare for stage one of this implementation plan, FDA intends to develop, by April of 1997, a strategy for inspecting the design control requirements. Both industry and FDA field investigators will then be trained on this inspectional strategy for design controls during April and May 1997. Starting June 1, 1997, manufacturers will be inspected for compliance with all the new quality system requirements, including design controls, in the manner described in the inspectional strategy. However, as part of the transition program, from June 1, 1997, for a period of 1 year, although FDA will inspect firms for compliance with the design control requirements, the field will issue any observations to the manufacturer on a separate design control inspectional strategy report, not on FDA Form 483. The design control inspectional strategy report will be made a part of the manufacturer's establishment inspection report (EIR), but the observations relating to Sec. 820.30 will not be included in any warning letters or regulatory actions during this initial 1-year period. FDA notes that it can, at any time, take action against unsafe or adulterated medical devices under different regulatory or statutory authorities. FDA wants to emphasize that manufacturers are required to take reasonable steps to come into compliance with the design control requirements during the June 1, 1997, to June 1, 1998, period. FDA also emphasizes that this transition period relates only to the design control requirements of Sec. 820.30, and that beginning June 1, 1997, the agency will issue observations on FDA Form 483's, issue warning letters, and take any necessary regulatory action for violations of all other provisions of the CGMP final rule. The time period from June 1, 1997, to June 1, 1998, is intended to allow both the industry and FDA field investigators time to become familiar with the design control requirements and the enforcement aspects of this new area. Finally, as described elsewhere in this preamble, FDA intends to conduct a midcourse review of the new design control requirements during the transition year (June 1997 to June 1998). Specifically, the results of the first several months of design control inspections will be reviewed by early 1998. FDA will review all of the completed design control inspectional strategy reports that were given to manufacturers from between June 1, 1997, through December 1, 1997. The completed strategy reports will be reviewed with particular attention paid to clarity of information obtained, the appropriateness of the information collected with respect to the design control requirements, the appropriateness of the questions on the inspectional strategy, the manner in which the investigators are writing out their observations, and any requirements that seem to be giving manufacturers a problem or where there might be misunderstandings as to what the regulation requires. FDA will then hold an open public meeting in early 1998 to discuss with industry these findings and to further explore any concerns industry might be having in implementing the new design control requirements. As a result of the midcourse review and open public meeting, FDA might hold additional workshops, meetings, and/or training sessions. Any midcourse adjustments to the inspectional strategy will be instituted and made public by the spring of 1998. Also during this midcourse review, FDA will evaluate the information gathered at that point and determine if the design control requirements as written in this final rule are appropriate to obtain the goals expressed in this preamble. FDA will consider minor or even major changes, based on experience to date. Any necessary adjustments or proposed revisions will be published in the Federal Register and comments will be solicited as necessary during the spring of 1998. This implementation strategy is responsive to requests by industry for FDA to harmonize the quality system regulation's implementation with the mandatory date for implementation of the EU's Medical Device Directive, which is June 1998. However, if during the midcourse review of stage one it is determined that the industry and/or FDA needs more time to fully implement the design control requirements, FDA will publish an extension of the regulatory implementation date for design control requirements prior to June 1, 1998. V. Response to Comments and Rationale for Changes Approximately 280 separate individuals or groups commented on the proposal published in the Federal Register of November 23, 1993, and approximately 175 separate individuals or groups commented on the Working Draft that was announced in a notice of availability published in the Federal Register on July 24, 1995. FDA made many changes in response to the comments. Most of the changes were made in response to specific comments, in response to comments for clarity, understanding, and readability, or to further harmonize FDA requirements with international standards, as many comments requested. Numerous comments stated that industry was very pleased with FDA's [Page 52605] Working Draft and the effort that was made to harmonize with ISO, as well as to engage industry in commenting on the Working Draft through the open public meeting and the GMP Advisory Committee meeting that were held in August and September 1995, respectively. FDA's responses to the comments received on the proposal and the Working Draft, as well as explanations for the changes made, follow. A. General Provisions (Subpart A) i. Scope (Sec. 820.1) 1. The title of the regulation, as reflected in this section, has been changed from the ``Current Good Manufacturing Practices (CGMP)'' regulation to the ``Quality System'' regulation. This revision follows the suggestion underlying many comments on specific provisions that FDA generally harmonize the CGMP requirements and terminology with international standards. ISO 9001:1994, ISO/CD 13485, and EN 46001 employ this terminology to describe the CGMP requirements. In addition, this title accurately describes the sum of the requirements, which now include the CGMP requirements for design, purchasing, and servicing controls. CGMP requirements now cover a full quality system. FDA notes that the principles embodied in this quality system regulation have been accepted worldwide as a means of ensuring that acceptable products are produced. While the regulation has been harmonized with the medical device requirements in Europe, Australia, and Japan, as well as the requirements proposed by Canada, it is anticipated that other countries will adopt similar requirements in the near future. FDA, however, did not adopt ISO 9001:1994 verbatim for two reasons. First, there were complications in dealing with the issue of copyrights and, second, FDA along with health agencies of other governments does not believe that for medical devices ISO 9001:1994 alone is sufficient to adequately protect the public health. Therefore, FDA has worked closely with the GHTF and TC 210 to develop a regulation which is consistent with both ISO 9001:1994 and ISO/CD 13485. FDA made several suggestions to TC 210 on the drafts of the ISO/CD 13485 document in order to minimize differences and move closer to harmonization. In some cases, FDA has explicitly stated requirements that many experts believe are inherent in ISO 9001:1994. Through the many years of experience enforcing and evaluating compliance with the original CGMP regulation, FDA has found that it is necessary to clearly spell out its expectations. This difference in approach does not represent any fundamentally different requirements that would hinder global harmonization. In fact, numerous comments expressed their approval and satisfaction with FDA's effort to harmonize the quality system requirements with those of ISO 9001:1994 and ISO/CD 13485. 2. One comment suggested that the term ``purchasing'' in the scope be deleted because it could be interpreted to mean the purchase of finished medical devices by health care institutions and medical professionals, instead of the purchase of components and manufacturing materials as intended. FDA agrees and has deleted the term ``purchasing'' throughout the regulation when used in this context. 3. Several comments suggested that Sec. 820.1(a)(1) should not state that the regulation establishes the ``minimum'' requirements because it implies that compliance with the stated requirements may be insufficient. They asked that FDA delete the word ``minimum,'' to avoid having auditors search for additional requirements. FDA does not believe that the provision would have required that manufacturers meet additional requirements not mandated by the regulation but has modified the section to clarify its intent by stating that the regulation establishes the ``basic'' requirements for manufacturing devices. The quality system regulation provides a framework of basic requirements for each manufacturer to use in establishing a quality system appropriate to the devices designed and manufactured and the manufacturing processes employed. Manufacturers must adopt current and effective methods and procedures for each device they design and manufacture to comply with and implement the basic requirements. The regulation provides the flexibility necessary to allow manufacturers to adopt advances in technology, as well as new manufacturing and quality system procedures, as they become available. During inspections, FDA will assess whether a manufacturer has established procedures and followed requirements that are appropriate to a given device under the current state-of-the-art manufacturing for that specific device. FDA investigators receive extensive training to ensure uniform interpretation and application of the regulation to the medical device industry. Thus, the agency does not believe that FDA investigators will cite deviations from requirements not contained in this part. However, as noted above, FDA has altered the language of the scope to make clear that additional, unstated requirements do not exist. 4. A few comments suggested eliminating the distinction between critical and noncritical devices, thus eliminating the need for distinct requirements for critical devices. Other comments disagreed, asserting that eliminating the distinction would increase the cost of production of low-risk devices without improving their safety and effectiveness. FDA agrees in part with the comments that suggest eliminating the distinction between critical and noncritical devices and has eliminated the term ``critical device'' from the scope, definitions, and regulation in Secs. 820.65 Critical devices, traceability and 820.165 Critical devices, labeling. However, FDA has retained the concept of distinguishing between devices for the traceability requirements in Sec. 820.65. As addressed in the discussion under that section, FDA believes that it is imperative that manufacturers be able to trace, by control number, any device, or where appropriate component of a device, that is intended for surgical implant into the body or to support or sustain life whose failure to perform when properly used in accordance with instructions for use provided in the labeling can be reasonably expected to result in a significant injury to the user. The deletion of the terminology will bring the regulation in closer harmony with ISO 9001:1994 and the quality system standards or requirements of other countries. Finally, FDA notes that eliminating the term ``critical device'' and the list of critical devices does not result in the imposition of new requirements. In fact the new regulation is less prescriptive and gives the manufacturer the flexibility to determine the controls that are necessary commensurate with risk. The burden is on the manufacturer, however, to describe the types and degree of controls and how those controls were decided upon. Such determinations are made in accordance with standard operating procedures (SOP's) established by the manufacturer. 5. In response to numerous comments, FDA has added the sentence ``If a person engages in only some operations subject to the requirements in this part, and not in others, that person need only comply with those requirements applicable to the operations in which he or she is engaged.'' This sentence was added to clarify the scope of the regulation and [Page 52606] the responsibility of those who fall under this regulation. The wording is the same as that used in the drug CGMP. 6. Several comments recommended that the short list of class I devices subject to design control requirements be deleted from the regulation and be placed in the preamble, to allow additions or deletions without requiring a change to the entire regulation. Others commented that the list of class I devices should be entirely eliminated to harmonize with Europe and Japan. FDA disagrees that the list of devices subject to design control requirements should be deleted from the regulation. FDA has experienced problems or has concerns with the class I devices listed and has determined that design controls are needed for the listed devices. Further, placing the list in the regulation establishes the requirements related to those devices, and is convenient for use by persons who are not familiar with, or who do not have access to, the preamble. Further, FDA notes that individual sections of a regulation may be revised independent of the remainder of the regulation. 7. Numerous written comments and persons who testified at the August and September 1995 meetings stated that application of the regulation to component manufacturers would increase product cost, with questionable value added to device safety and effectiveness, and that many component suppliers would refuse to supply components or services to the medical device industry. This would be especially likely to occur, it was suggested, where medical device manufacturers account for a small fraction of the supplier's sales. FDA believes that because of the complexity of many components used in medical devices, their adequacy cannot always be assured through inspection and testing at the finished device manufacturer. This is especially true of software and software-related components, such as microprocessors and microcircuits. Quality must be designed and built into components through the application of proper quality systems. However, FDA notes that the quality system regulation now explicitly requires that the finished device manufacturer assess the capability of suppliers, contractors, and consultants to provide quality products pursuant to Sec. 820.50 Purchasing controls. These requirements supplement the acceptance requirements under Sec. 820.80. Manufacturers must comply with both sections for any incoming component or subassembly or service, regardless of the finished device manufacturer's financial or business affiliation with the person providing such products or services. FDA believes that these purchasing controls are sufficient to provide the needed assurance that suppliers, contractors, and consultants have adequate controls to produce acceptable components. Therefore, balancing the many concerns of the medical device industry and the agency's public health and safety concerns, FDA has decided to remove the provision making the CGMP regulation applicable to component manufacturers and return to the language in the original CGMP regulation. This approach was unanimously endorsed by the members of the GMP Advisory Committee at the September 1995 meeting. FDA will continue to focus its inspections on finished device manufacturers and expects that such manufacturers will properly ensure that the components they purchase are safe and effective. Finished device manufacturers who fail to comply with Secs. 820.50 and 820.80 will be subject to enforcement action. FDA notes that the legal authority exists to cover component manufacturers under the CGMP regulation should the need arise. 8. One comment stated that proposed Sec. 820.1(a)(2) should be revised to include the District of Columbia and the Commonwealth of Puerto Rico, as in the original CGMP regulation. FDA agrees with the comment. These localities were inadvertently omitted and have been added to the regulation. 9. FDA added Sec. 820.1(a)(3) on how to interpret the phrase ``where appropriate'' in the regulation, as recommended by the GMP Advisory Committee. This section is consistent with the statement in ISO/CD 13485. 10. Some comments on proposed Sec. 820.1(c) recommended that the section be deleted as it already appears in the act. Others stated that the provision implies that FDA will subject devices or persons to legal action, regardless of the level of noncompliance. Still others suggested that only intentional violations of the regulation should give rise to regulatory action. FDA disagrees with these comments. The consequences of the failure to comply, and the legal authority under which regulatory action may be taken, are included in the regulation so that the public may be fully apprised of the possible consequences of noncompliance and understand the importance of compliance. FDA notes that the agency exercises discretion when deciding whether to pursue a regulatory action and does not take enforcement action for every violation it encounters. Further, FDA generally provides manufacturers with warning prior to initiating regulatory action and encourages voluntary compliance. The agency also notes, however, that violations of this regulation need not be intentional to place the public at serious risk or for FDA to take regulatory action for such violations. In response to the concerns regarding the tone of the section, however, the title has been changed. FDA has also deleted the specific provisions referenced in the proposed section with which the failure to comply would render the devices adulterated. The term ``part'' includes all of the regulation's requirements. 11. A few comments on proposed Sec. 820.1(c)(2), now Sec. 820.1(d), requested that the agency clarify what is meant by requiring that foreign manufacturers ``schedule'' an inspection. A few comments stated that FDA was adding new requirements for foreign manufacturers in this section. Others stated that the proposed language would prohibit global harmonization because it would limit third party audits in place of FDA inspections. FDA has moved the provision related to foreign manufacturers into a separate section and has modified the language. The language in the regulation reflects the language in section 801(a) of the act (21 U.S.C. 381(a)). FDA disagrees that it is adding new requirements for foreign manufacturers in Sec. 820.1(d) because the section recites the current requirement and standard used, and is consistent with current agency policy. The agency believes that it is imperative that foreign facilities be inspected for compliance with this regulation and that they be held to the same high standards to which U.S. manufacturers are held. Otherwise, the U.S. public will not be sufficiently protected from potentially dangerous devices, and the U.S. medical device industry will be at a competitive disadvantage. FDA intends to continue scheduling inspections of foreign manufacturers in advance to assure their availability and avoid conflicts with holidays and shut down periods. However, the language pertaining to the ``scheduling'' of such inspections has been deleted to allow flexibility in scheduling methods. FDA disagrees that, as written, the language would prohibit inspections by third parties. FDA may use third party inspections, as it uses other compliance information, in setting its priorities and utilizing its resources related to foreign inspections. In this regard, FDA looks forward to entering into agreements with foreign countries related to CGMP [Page 52607] inspections that would provide FDA with reliable inspectional information. 12. Two comments stated that the section on ``Exemptions or variances,'' now Sec. 820.1(e), should require that FDA provide a decision on petitions within 60 days of receipt and state that the agency will take no enforcement action with respect to the subject of the petition until a decision is rendered. The comments said that the petition process is long, arduous, and not practical. FDA disagrees with the comments. Currently, FDA is required by section 520(f)(2)(B) of the act to respond within 60 days of receipt of the petition, unless the petition is referred to an advisory committee. When the 1978 CGMP regulation was published, there was a prediction that FDA would be overwhelmed with petitions for exemption and variance from the regulation. Over the past 18 years, since the CGMP regulation first became effective, FDA has only received approximately 75 petitions. It is FDA's opinion that few petitions have been received because of the flexible nature of the CGMP regulation. FDA has attempted to write the current regulation with at least the same degree of flexibility, if not more, to allow manufacturers to design a quality system that is appropriate for their devices and operations and that is not overly burdensome. Guidelines for the submission of petitions for exemption or variance are available from the Division of Small Manufacturers Assistance (the DSMA). The petition guidelines state that FDA will not process a petition for exemption or variance while an FDA inspection of a manufacturer is ongoing. Until FDA has approved a petition for an exemption or variance, a manufacturer should not deviate from the requirements of this regulation. FDA must first have the opportunity to ensure that the manufacturer has established that an exemption or variance is warranted, to carry out its obligation of ensuring that devices are safe and effective. 13. Several comments stated that the proposed requirements are not necessary for all manufacturers, particularly small manufacturers with few employees and low-risk devices. Other comments stated that the documentation requirements are excessive. FDA generally disagrees with these comments. The regulation provides the ``basic'' requirements for the design and manufacture of medical devices. And, as noted in the previous response, the requirements are written in general terms to allow manufacturers to establish procedures appropriate for their devices and operations. Also, as discussed above, a manufacturer need only comply with those requirements applicable to the operations in which he or she is engaged. However, because the regulation requirements are basic, they will apply in total to most manufacturers subject to the regulation. The extent of the documentation necessary to meet the regulation requirements may vary with the complexity of the design and manufacturing operations, the size of the firm, the importance of a process, and the risk associated with the failure of the device, among other factors. Small manufacturers may design acceptable quality systems that require a minimum of documentation and, where possible, may automate documentation. In many situations, documentation may be kept at a minimum by combining many of the recordkeeping requirements of the regulation, for example, the production SOP's, handling, and storage procedures. When manufacturers believe that the requirements are not necessary for their operations, they may petition for an exemption or variance from all or part of the regulation pursuant to section 520(f)(2) of the act. In addition, FDA has added a variance provision in Sec. 820.1(e)(2) under which the agency can initiate a variance when it is in the best interest of the public health. Under this provision, for instance, the agency may initiate and grant a variance to manufacturers of devices during times of product shortages, where the devices are needed by the public and may not otherwise be made available, if such manufacturers can adequately assure that the resulting devices are safe and effective. The agency envisions this provision as a bridge, providing a manufacturer with the time necessary to fulfill the requirements in the regulation while providing important and needed devices to the public. Thus, the variance would only be granted for a short period of time, and only while the devices remained necessary and in short supply. Under this provision, FDA will require a manufacturer to submit a plan detailing the action it is taking to assure the safety and effectiveness of the devices it manufactures and to meet the requirements of the regulation. This agency initiated variance provision is in accordance with section 520(f) of the act which permits, but does not require, FDA to promulgate regulations governing the good manufacturing practices for devices and section 701(a) of the act (21 U.S.C. 371(a)), which permits FDA to promulgate regulations for the efficient enforcement of the act. Because the statute does not mandate that the agency establish any requirements for device CGMP's, the agency has the authority to determine that the manufacturers of certain devices need not follow every requirement of the regulation. Further, the agency initiated variance provision is in keeping with the intent of Congress that FDA prevent hazardous devices from reaching the marketplace, H. Rept. 853, 94th Cong., 2d sess. 25-26 (1976), and the general intent of the act that the agency undertake to protect the public health. The agency will only initiate such a variance where the devices are needed and may not otherwise be made available, and the manufacturer can assure the agency that its procedures are likely to be adequate and that it is actively pursuing full compliance. The variances will only be in effect for a limited time. Section 820.1(e) has been modified to include the above addition, to reflect the title change of the regulation, and to provide the most current address for the DSMA. ii. Definitions (Sec. 820.3) 14. Several comments were received regarding the definition of "complaint.'' Comments generally believed that the definition was unclear and could be interpreted to include routine service requests, communications from customers unrelated to the quality, safety, or effectiveness of the device, and internal communications. FDA agrees with the comments in part and has modified the definition to make clear that a communication would be considered a "complaint'' only if the communication alleged some deficiency related to the identity, quality, durability, reliability, safety, effectiveness, or performance of the device after it is released for distribution. The definition is now very similar to the definition used in ISO/CD 13485. The regulation addresses service requests and in-house indications of dissatisfaction under Sec. 820.100 Corrective and preventive action. This section requires manufacturers to establish procedures to identify quality problems and process the information received to detect and correct quality problems. Information generated in-house relating to quality problems should be documented and processed as part of this corrective and preventive action program. With respect to service requests, Sec. 820.200 Servicing states that a service report that represents an event which [Page 52608] must be reported to the FDA under part 803 or 804 (21 CFR part 803 or 804) shall automatically be considered a complaint. All other service reports must be analyzed for trends or systemic problems and when found, these trends or systemic problems must be investigated according to the provisions of Sec. 820.100 Corrective and preventive action. 15. One comment suggested that the agency delete the phrase ``used during device manufacturing'' in the definition of ``component'' because it was confusing and may cause problems with certain aspects of distributor operations. FDA agrees and has deleted the words ``used during device manufacturing'' from the definition because it was not intended to differentiate between distributors and manufacturers. Further, FDA deleted the term ``packaging'' to clarify that every piece of packaging is not necessarily a component. Only the materials that are part of the "finished, packaged, and labeled device'' are considered to be components. 16. Several comments stated that the term ``complete history'' in the definition of ``control number'' should be clarified or deleted because it is unclear what a complete production history is, and the term could be construed to require full traceability for all component lots of any product containing a control number. FDA agrees in part with the comments. The control number is the means by which the history of the device, from purchase of components and materials through distribution, may be traced, where traceability is required. The definition does not require that a manufacturer be able to trace the device whenever control numbers are used. In fact, the definition itself does not establish any requirements. The agency notes, however, that the manufacturer's traceability procedures should ensure that a complete history of the device, including environmental conditions which could cause the device to fail to conform to its specified requirements, can be traced and should facilitate investigation of quality problems and corrective action. FDA notes, however, that the level of detail required for this history is dependent on the nature of the device, its intended use, and its complexity. Therefore, FDA has removed the term ``complete'' in the definition for clarity and flexibility. FDA has also amended the definition for added flexibility, to state that symbols may be used and has included the term ``unit'' for any device that is not manufactured as a lot or batch. 17. The definition of ``critical device'' has been deleted for the reasons discussed above. 18. Several comments stated that the term ``design history record'' should be changed because the acronym for the term is the same as that for device history record (the DHR). Other comments said the ``design history record'' should not need to contain documentation of a ``complete'' design history. One comment stated that the definition should allow reference to records containing the design history of the device. A few comments stated that the term should be deleted altogether because it is redundant with the definition of device master record (the DMR). FDA agrees in part with these comments and has changed the term ``design history record'' to ``design history file.'' In addition, FDA has amended the provisions to require that the file describe the design history, as it may not be necessary to maintain a record of every step in the design phase, although the ``entire history'' should be apparent from the document. Section 820.30(j) further delineates what should be in the design history file (the DHF), specifically records sufficient to verify that the design was developed in accordance with the design and development plan and other applicable design requirements of the regulation. FDA does not agree that the definitions of the DHF and the DMR are redundant. The DHF for each type of device should include, for example, the design and development plan, design review results, design verification results, and design validation results, as well as any other data necessary to establish compliance with the design requirements. The DMR should contain all of the procedures related to each type of device as required by this part and the most current manufacturing specifications of the device, once the design specifications have been transferred into production. 19. One comment on ``design input'' stated it was confused by the term "requirements'' and wanted to know whose requirements are encompassed in this definition. The term "requirement'' is meant in the broadest sense, to encompass any internally or externally imposed requirements such as safety, customer-related, and regulatory requirements. All of these requirements must be considered as design inputs. How these requirements are handled and dealt with is up to the manufacturer. 20. Two comments stated that the definition of "design output'' should be revised because it is not necessary, and would be burdensome, to keep records of and review the "results of a design effort at each design phase and at the end.'' Other comments suggested that the design output definition should be restricted to physical characteristics of the device. FDA agrees in part, but has not deleted the phrase ``results of a design effort at each design phase and at the end'' from the definition. The intent was not to dictate when design phases would occur. Such phases will be defined in the design and development plan. For example, a manufacturer may only have a few design phases for a new type of syringe. Thus, design output would be the results of those few efforts. The results of each design phase constitute the total design output. The definition has been amended, however, to clarify that the finished design output is the basis for the DMR. FDA disagrees with the comments that suggest that the design output should be restricted to physical characteristics of the device. Design output is more than just the device specifications. Design output includes, among other things, the specifications for the manufacturing process, the quality assurance testing, and the device labeling and packaging. It is important to note that the design effort should not only control the design aspects of the device during the original development phase, but also all subsequent design and development activities including any redesign or design changes after the original design is transferred to production. 21. A few comments on the definition of ``design review'' stated that proposing solutions to problems is not part of the design review activity. Two other comments expressed concern that the definition would require that each design review be ``comprehensive.'' In response to the comments on the proper role of design review, FDA agrees that the design review participants are typically not responsible for establishing solutions, although they may do so in many small operations. The definition has been amended, but FDA wants to make clear that although the design review participants need not propose solutions, they should ensure that solutions to any identified problems are adequate and implemented appropriately. Regarding the scope of design review, each design review need not be ``comprehensive'' for the entire design process but must be ``comprehensive'' for the design phase being reviewed. However, at the end of the design process when the design is transferred [Page 52609] to production, all aspects of the design process should have been reviewed. A few other changes were made to harmonize with the definition in ISO 8402:1994 ``Quality--Vocabulary.'' 22. Comments on the definition of ``device master record'' pointed out that the definition is not consistent with the requirements of Sec. 820.181 Device master record. Other comments stated that the definition should allow reference to records. One comment stated that ``all'' procedures related to a specific finished device need not be included in the DMR, such as the procedures for the design and development, since they may be in the DHF. FDA agrees in part with the comments that found the DMR definition and requirements to be inconsistent and has amended the definition to be consistent with the requirements set forth in Sec. 820.181. FDA does not believe, however, that it is necessary to modify the definition to include the referencing of records because the DMR requirements in Sec. 820.181 state that the DMR ``shall include or refer to the location of'' the required information. FDA agrees that the term ``all'' is not necessary and has deleted it in order to give manufacturers the necessary flexibility. 23. The definition for the term ``end-of-life'' was added to the Working Draft because this term was used in the definitions for ``refurbisher'' and ``servicing'' to help distinguish the activities of refurbishing from those of servicing. FDA determined that such a distinction was necessary, due to comments and ongoing confusion regarding the difference between the two functions, and the different requirements applicable to the functions. Many written comments and persons who testified at the August and September 1995 meetings stated that the term was confusing, unnecessary, and introduced many new legal and liability issues. FDA agrees with these comments and has deleted the term throughout the regulation. FDA has also deleted definitions for ``refurbisher'' and ``servicing'' for the reasons discussed below. 24. The few comments received on the definition of ``establish'' indicated a concern that the regulation requires too much documentation and is more onerous than ISO 9001 requirements. FDA disagrees with the comments. The term ``establish'' is only used where documentation is necessary. FDA also notes that the quality system regulation is premised on the theory that adequate written procedures, which are implemented appropriately, will likely ensure the safety and effectiveness of the device. ISO 9001:1994 relies on the same premise. The 1994 version of ISO 9001 broadly requires the manufacturer to ``establish, document, and maintain a quality system,'' which includes documenting procedures to meet the requirements. The definition has been amended, however, in response to general comments received, to clarify that a ``document'' may be in writing or on electronic media, to allow flexibility for any type of recorded media. 25. FDA received comments questioning the inclusion of a device that is intended to be sterile, but that is not yet sterile, in the definition of ``finished device.'' A few comments stated that ``capable of functioning'' is ambiguous, and ``suitable for use'' is not necessary. Another comment requested that the term ``accessory'' be defined. FDA disagrees with the comments, but has amended the definition for clarification. Since the 1978 CGMP regulation was promulgated, FDA has been repeatedly asked whether devices intended to be sold as sterile are considered subject to the CGMP requirements, even though they have not yet been sterilized. The agency had intended the new definition to make explicit the application of the regulation to the manufacture of sterile devices that have yet to be sterilized. Although FDA believes it should be obvious that such devices are subject to CGMP requirements, some manufacturers have taken the position that the regulation does not apply because the device is not ``finished'' or ``suitable for use'' until it has been sterilized. To better clarify its intent, FDA has amended the definition to add that all devices that are capable of functioning, including those devices that could be used even though they are not yet in their final form, are ``finished devices.'' For example, devices that have been manufactured or assembled, and need only to be sterilized, polished, inspected and tested, or packaged or labeled by a purchaser/ manufacturer are clearly not components, but are now in a condition in which they could be used, therefore meeting the definition of ``finished device.'' The distinction between ``components'' and ``finished devices'' was not intended to permit manufacturers to manufacture devices without complying with CGMP requirements by claiming that other functions, such as sterilization, incoming inspection (where sold for subsequent minor polishing, sterilization, or packaging), or insertion of software, will take place. The public would not be adequately protected in such cases if a manufacturer could claim that a device was not a ``finished'' device subject to the CGMP regulation because it was not in its ``final'' form. The phrase ``for commercial distribution'' was deleted from the proposed definition of ``finished device'' because it is not necessary for a device to be in commercial distribution to be considered a finished device. Further, FDA notes that the term ``accessory'' is described in Sec. 807.20(a)(5) (21 CFR 807.20(a)(5)). 26. Two comments on the definition of ``lot or batch'' requested that the definition be clarified: One to reflect that single units may be produced for distribution, the other to indicate that what constitutes a lot or a batch may vary depending on the context. In response to the comments, FDA has modified the definition to make clear that a lot or batch may, depending on circumstances, be comprised of one finished device. Whether for inspection or for distribution, a lot or batch is determined by the factors set forth in the definition; of course, a manufacturer may determine the size of the lot or batch, as appropriate. 27. Several comments received on the definition of ``executive management'' objected that the definition is inconsistent with ISO 9001. Others thought that FDA should better define the level of management the term was intended to describe. FDA agrees with both concerns and has modified the definition by deleting the second half, which appeared to bring executive authority and responsibility too far down the organization chart. The term was intended to apply only to management that has the authority to bring about change in the quality system and the management of the quality system. Although such management would clearly have authority over, for example, distribution, those who may have delegated management authority over distribution would not necessarily have authority over the quality system and quality policy. Accordingly, the definition has been modified to include only those who have the authority and responsibility to establish and make changes to the quality policy and quality system. It is the responsibility of top management to establish and communicate the quality policy. In addition, the term ``executive management'' has been changed to ``management with executive responsibility,'' to harmonize with ISO 9001:1994. 28. Several comments in response to the proposed definition of [Page 52610] ``manufacturer'' stated that refurbishers and servicers should be added to the definition of a ``manufacturer.'' Other comments recommended adding the term ``remanufacturer.'' Other comments requested deletion of contract sterilizers, installers, specification developers, repackagers, relabelers, and initial distributors from the definition. One comment stated that the phrase ``processes a finished device'' should be explained in the definition of manufacturer. FDA's Compliance Policy Guide (CPG) 7124.28 contains the agency's policy regarding the provisions of the act and regulations with which persons who recondition or rebuild used devices are expected to comply. This CPG is in the process of being revised in light of FDA's experience in this area. FDA is not including the terms ``servicer'' or ``refurbisher,'' as they relate to entities outside the control of the original equipment manufacturer, in this final regulation, even though it believes that persons who perform such functions meet the definition of manufacturer. Because of a number of competitive and other issues, including sharply divided views by members of the GMP Advisory Committee at the September 1995 meeting, FDA has elected to address application of the CGMP requirements to persons who perform servicing and refurbishing functions outside the control of the original manufacturer in a separate rulemaking later this year, with another opportunity for public comment. FDA agrees that the term ``remanufacturing'' should be added to the definition of ``manufacturer'' and has separately defined the term. A remanufacturer is defined as ``any person who processes, conditions, renovates, repackages, restores, or does any other act to a finished device that significantly changes the finished device's performance or safety specifications, or intended use.'' However, FDA disagrees that contract sterilizers, installers, specification developers, repackagers, relabelers, and initial distributors should be deleted from the definition, primarily because all such persons may have a significant effect on the safety and effectiveness of a device and on the public health. All persons who perform these functions meet the definition of manufacturer, and therefore should be inspected to ensure that they are complying with the applicable provisions. For example, a specification developer initiates the design requirements for a device that is manufactured by a second party for subsequent commercial distribution. Such a developer is subject to design controls. Further, those that perform the functions of contract sterilization, installation, relabeling, remanufacturing, and repacking have routinely been considered to be manufacturers under the original CGMP definition, and the agency has treated them as such by inspecting them to ensure that they comply with the appropriate portions of the original CGMP. By explicitly including them in the definition of ``manufacturer'' the agency has simply codified its longstanding policy and interpretation of the original regulation. The phrase ``processes a finished device'' applies to a finished device after distribution. Again, this phrase has been part of the CGMP regulation definition of ``manufacturer'' for 18 years. 29. A number of comments on the definition of ``manufacturing material,'' and on other parts of the proposal containing requirements for ``manufacturing material,'' stated that while the control of manufacturing material is important, it need not be as extensive as required throughout the regulation. Other comments stated that the meaning of the phrase ``or other byproducts of the manufacturing process'' is unclear, and should be deleted. One comment suggested that the definition be modified to separate the definition from the examples. FDA agrees that, depending on the manufacturing material and the device, the degree of control that is needed will vary. FDA believes that manufacturing materials must be assessed, found acceptable for use, and controlled. Therefore, the regulation requires manufacturers to assess, assure acceptability of, and control manufacturing materials to the degree necessary to meet the specified requirements. The agency notes that international standards such as ISO 8402:1994 include manufacturing material in their definition of ``product,'' to which all requirements apply, and notes that FDA has added the same definition in Sec. 820.3(r) in its effort toward harmonization. FDA amended the definition of manufacturing material to read ``a concomitant constituent, or a byproduct constituent produced during the manufacturing process'' to help clarify this definition. These terms refer to those materials or substances that naturally occur as a part of the material or during the manufacturing process which are intended to be removed or reduced in the finished device. For example, some components, such as natural rubber latex, contain allergenic proteins that must be reduced or removed from the finished devices. The definition has been modified to include ``concomitant constituents'' to clarify the meaning. In addition to clarifying the definition, FDA has deleted the specific examples. Therefore, FDA notes that cleaning agents, mold release agents, lubricating oils, latex proteins, and sterilant residues are just some examples of manufacturing materials. 30. The comments received on the definition for ``nonconforming'' conveyed a general sense that the definition was confusing, with various comments suggesting that different parts of the definition should be deleted and one suggesting that the definition be deleted altogether. In response to these comments, the definition of ``nonconforming'' has been deleted. However, the definition from ISO 8402:1994 for ``nonconformity'' was added to ensure that the requirements in the regulation, especially those in Secs. 820.90 Nonconforming product and 820.100 Corrective and preventive action are understood. FDA emphasizes that a ``nonconformity'' may not always rise to the level of a product defect or failure, but a product defect or failure will typically constitute a nonconformity. 31. Several comments requested various revisions to the definition of ``production'' to make it more clear, and one thought that it was a common term and should be deleted. In response, FDA has deleted the definition for ``production'' because it should be commonly understood. As noted in response to comments on the definition of manufacturing material, FDA has added a definition of ``product'' to conform to the definition in ISO 8402:1994 and to avoid the necessity of repeating the individual terms throughout the regulation. Whenever a requirement is not applicable to all types of product, the regulation specifically states the product(s) to which the requirement is applicable. It should be noted that the regulation has acceptance requirements for incoming ``product'' and other requirements for ``product,'' which by definition includes manufacturing materials. Manufacturing materials should be controlled in a manner that is commensurate with their risk as discussed above. However, for manufacturing materials that are ``concomitant constituents,'' FDA realizes that incoming acceptance, identification, etc., may not be feasible. The important control measure for ``concomitant constituents'' is the [Page 52611] reduction or removal requirement found in Sec. 820.70(h). 32. A few comments stated that the definition of ``quality'' should be changed to be identical to ISO 8402. Others stated that the terminology adopted from ISO 8402, ``that bear on,'' is too broad and could cover every potential and imaginable factor. Still others wanted to add the phrase, ``as defined by the manufacturer'' to the end of the sentence. FDA disagrees with the comments and believes that the definition is closely harmonized to that in ISO 8402:1994. FDA believes that the definition appropriately defines quality in the context of a medical device and believes that the phrase from ISO 8402:1994, ``stated and implied needs,'' has the same meaning as the phrase ``fitness-for-use, including safety and performance'' in the context of the Quality System regulation. Further, ``quality'' is not just ``defined by the manufacturer'' but is also defined by customer need and expectation. 33. Many comments received on the ``quality audit'' definition suggested that the definition should not state that it is an examination of the ``entire'' quality system because that would require that every audit include the ``entire'' quality system. Other comments on ``quality audit'' stated that it is unclear what is meant by the last sentence of the proposed definition, namely, that `` `[q]uality audit' is different from * * * other quality system activities required by or under this part.'' FDA agrees that while the quality audit is an audit of the ``entire'' quality system, audits may be conducted in phases, with some areas requiring more frequent audits than other areas, and that each audit need not review the whole system. The frequency of internal quality audits should be commensurate with, among other things, the importance of the activity, the difficulty of the activity to perform, and the problems found. To avoid any misunderstanding, the word ``entire'' before quality system has been deleted. FDA emphasizes that if conducted properly, internal quality audits can prevent major problems from developing and provide a foundation for the management review required by Sec. 820.20(c), ``Management review.'' In response to the confusion about the last sentence of the proposed definition, FDA has deleted the last sentence. The purpose of the sentence was to clarify that the internal audit requirement is different from, and in addition to, the requirements for establishing quality assurance procedures and recording results. On occasion, manufacturers have attempted to prevent FDA investigators from reviewing such quality assurance procedures and results (for example, trend analysis results) by stating that they are part of the internal quality audit report and not subject to review during a CGMP inspection. FDA disagrees with this position. To clarify which records are exempt from routine FDA inspection, FDA has added Sec. 820.180(c). 34. One comment said that the word ``executive'' should be deleted from the definition of ``quality policy'' because quality policy should be supported by all personnel, not just those in executive management. A few comments stated that ``formally expressed'' should be deleted because it is incompatible with the requirements in Sec. 820.20(a) and (c) which require that the quality policy be ``established.'' Other comments stated that the ``quality'' before ``intentions'' was tautological. FDA agrees that all company personnel must follow the quality policy. However, the definition is intended to make clear that the quality policy must be established by top management. Therefore it has been retained. The term ``executive management'' has been modified to ``management with executive responsibility'' to be consistent with the revised ISO 9001:1994. FDA agrees with the remaining comments and has changed ``formally expressed'' to ``established'' for consistency and has deleted the ``quality'' before ``intentions.'' 35. A few comments suggested using the definition of ``quality systems'' from ISO 8402 and 9001. Other comments on the definition of ``quality system'' said that the term ``quality management'' should be defined. FDA agrees in part with the comments. The term ``specifications'' has been deleted to harmonize the definition with ISO 8402:1994. FDA does not agree that the term ``quality management'' must be defined. A definition can be found in ISO 8402:1994 that is consistent with FDA's use of the term. 36. Many comments on the definition of ``record'' were received. Some thought the term was too broad, giving FDA access to all documents and exceeding FDA's inspection authority. Others thought that the definition of ``record'' would tremendously increase the recordkeeping burden. Several comments recommended that FDA adopt the ISO definition. The definition of ``record'' was deleted because it seemed to add more confusion than clarity. The definition was intended to clarify that ``records'' may include more than the traditional hardcopy procedures and SOP's, for example, plans, notes, forms, data, etc. FDA was trying to clarify that ``records'' could be written, electronic, optical, etc., as long as they could be stored and controlled. FDA could not adopt the ISO 8402:1994 definition because of how the term ``record'' is used in the act, which is broader than the ISO definition. Therefore, FDA will allow the act and case law to continue to define the term. 37. The definition in the Working Draft of ``refurbisher'' was deleted and will be addressed in the separate rulemaking described above. 38. FDA added the definition of ``remanufacturer'' to codify FDA's longstanding policy and interpretation of the original CGMP. The language is consistent with the 510(k) provisions and the premarket approval amendment/supplement requirements, because FDA has always considered remanufacturers in fact to be manufacturers of a new device. 39. Several comments on the definition of ``reprocessing'' requested clarification of the difference between that term and ``refurbishing.'' Several other comments on the definition of ``reprocessing'' stated that FDA should clarify that ``reprocessing'' is an activity performed before a device is distributed. Others commented that the term ``rework'' should be used instead of the term ``reprocessing,'' to be consistent with ISO terminology. FDA agrees with the comments and has changed the term to ``rework,'' adopted the ISO 8402:1994 definition, and added that ``rework'' is performed according to specified DMR requirements before the device is released for distribution. 40. A few comments stated that including the term ``maintenance'' in the proposed definition of ``servicing'' implies that preventative maintenance would be subject to the regulation. Other comments said that it may not be desirable to return old devices or devices that have received field modifications to the original specifications. Therefore, the comments suggested deleting the last part of the definition that states that ``servicing'' is returning a device to its specifications. FDA has deleted the definition of ``servicing'' and has not added a definition of ``servicer'' because this will be covered in the separate rulemaking discussed above. FDA notes, however, that servicing performed by manufacturers and remanufacturers is subject to the requirements in Sec. 820.200 Servicing. These requirements are a codification of longstanding interpretations of the original CGMP, [Page 52612] Sec. 820.20(a)(3), and current agency policy. 41. Several comments were received on the proposed definition of ``special process.'' Many asked for clarification or adoption of the ISO definition. Some stated that it is impossible to completely verify processes in every instance. FDA has deleted the definition because the term ``special process'' is no longer used in ISO 9001:1994, except in a note. FDA has, however, modified the requirements of the regulation to reflect that, in many cases, testing and inspecting alone may be insufficient to prove the adequacy of a process. One of the principles on which the quality systems regulation is based is that all processes require some degree of qualification, verification, or validation, and manufacturers should not rely solely on inspection and testing to ensure processes are adequate for their intended uses. 42. Several comments on the definition of ``specification'' suggested that the term should not apply to quality system requirements. One comment suggested that the phrase ``other activity'' be deleted because it is too broad. Another comment noted that the definition in ISO 9001 pertains to requirements, not only documents. In response, FDA has amended the definition to make clear that it applies to the requirements for a product, process, service, or other activity. The reference to the quality system has been deleted. FDA disagrees that the definition is too broad and has not deleted the term ``other activity'' because a specification can be developed for anything the manufacturer chooses. FDA notes, however, that ISO 9001:1994 does not contain a definition for ``specification'' but uses the definition found in ISO 8402:1994. 43. Numerous comments were received on the definitions of ``validation'' and ``verification.'' Almost all stated that the two definitions overlapped and that there was a need to rewrite the definitions to prevent confusion. Many suggested that the ISO definitions be adopted. Others stated that there was a need to distinguish between design validation and process validation. FDA agrees with the comments and has rewritten the two definitions to better reflect the agency's intent. FDA has adopted the ISO 8402:1994 definition of validation. ``Validation'' is a step beyond verification to ensure the user needs and intended uses can be fulfilled on a consistent basis. FDA has further distinguished ``process validation'' from ``design validation'' to help clarify these two types of ``validation.'' The ``process validation'' definition follows from FDA's ``Guidelines on General Principles of Process Validation'' (Ref. 10). The definition for ``design validation'' is consistent with the requirements contained in Sec. 820.30 Design controls. The ISO 8402:1994 definition of ``verification'' has been adopted. ``Verification'' is confirmation by examination and provision of objective evidence that specified requirements for a particular device or activity at hand have been met. iii. Quality System (Sec. 820.5) 44. Several comments suggested that the requirement should be more general, in that the requirement that devices be safe and effective is covered elsewhere in the regulation. The comments recommended that the quality system requirements be harmonized with international standards and focus on requiring that a system be established that is appropriate to the specific device and that meets the requirements of the regulation. FDA agrees in part with the comments and has modified the language as generally suggested by several comments to require that the quality system be ``appropriate for the specific medical device(s) designed or manufactured, and [] meet[] the requirements of this part.'' This is essentially the requirement of the original CGMP regulation with the added reference to design control. The requirements that effective quality system instructions and procedures be established and effectively maintained are retained; however, they were moved to Sec. 820.20(b)(3)(i). As previously noted, the quality system regulation is premised on the theory that the development, implementation, and maintenance of procedures designed to carry out the requirements will assure the safety and effectiveness of devices. Thus, the broad requirements in Sec. 820.5 are in a sense the foundation on which the remaining quality system requirements are built. B. Quality System Requirements (Subpart B) i. Management Responsibility (Sec. 820.20) 45. Several comments on Sec. 820.20(a), ``Quality policy,'' related to the use of the term ``executive management.'' A few comments stated that quality system development and implementation are the responsibility of the chief executive officer, but how he or she chooses to discharge the responsibility should be left to the discretion of the manufacturer. Other comments stated that the requirement that executive management ensure that the quality policy is understood is impossible and should be deleted or rewritten. FDA agrees in part with the comments. In response to the comments, FDA has deleted the term ``executive management'' and replaced it with ``management with executive responsibility,'' which is consistent with ISO 9001:1994. Management with executive responsibility is that level of management that has the authority to establish and make changes to the company quality policy. The establishment of quality objectives, the translation of such objectives into actual methods and procedures, and the implementation of the quality system may be delegated. The regulation does not prohibit the delegation. However, it is the responsibility of the highest level of management to establish the quality policy and to ensure that it is followed. (See United States v. Dotterweich, 320 U.S. 277 (1943), and United States v. Park, 421 U.S. 658 (1975).) For this reason, FDA disagrees that the requirement that management ensure that the quality policy is understood should be deleted. It is without question management's responsibility to undertake appropriate actions to ensure that employees understand management's policies and objectives. Understanding is a learning process achieved through training and reinforcement. Management reinforces understanding of policies and objectives by demonstrating a commitment to the quality system visibly and actively on a continuous basis. Such commitment can be demonstrated by providing adequate resources and training to support quality system development and implementation. In the interest of harmonization, the regulation has been amended to be very similar to ISO 9001:1994. 46. A few comments stated that the words ``adequate'' and ``sufficient'' should be deleted from Sec. 820.20(b) ``Organization,'' as they are subjective and too difficult to define. One comment thought that the general requirements in the paragraphs are addressed by Sec. 820.25 Personnel. Another comment stated that ``designed'' should be added prior to ``produced'' for consistency with the scope. FDA agrees that the requirement for ``sufficient personnel'' is covered in Secs. 820.20(b)(2), ``Resources,'' and 820.25 Personnel, both of which require manufacturers to employ sufficient personnel with the training and [Page 52613] experience necessary to carry out their assigned activities properly. The phrase is, therefore, deleted. However, FDA has retained the requirement for establishing an ``adequate organizational structure'' to ensure compliance with the regulation, because such an organizational structure is fundamental to a manufacturer's ability to produce safe and effective devices. The organizational structure should ensure that the technical, administrative, and human factors functions affecting the quality of the device will be controlled, whether these functions involve hardware, software, processed materials, or services. All such control should be oriented towards the reduction, elimination, or ideally, prevention of quality nonconformities. Further, the agency does not believe that the term is ambiguous. The organizational structure established will be determined in part by the type of device produced, the manufacturer's organizational goals, and the expectations and needs of customers. What may be an ``adequate'' organizational structure for manufacturing a relatively simple device may not be ``adequate'' for the production of a more complex device, such as a defibrillator. FDA has also added ``designed'' prior to ``produced'' to be consistent with the scope of the regulation. 47. A number of comments on proposed Sec. 820.20 (b)(1)(i) through (b)(1)(v), ``Responsibility and authority,'' objected to the section, stating that it was too detailed and confusing and that the wording was redundant with other sections of the proposal. FDA agrees generally with the comments in that the proposed paragraphs set forth examples of situations in which independence and authority are important. Therefore, the examples provided in Sec. 820.20 (b)(1)(i) through (b)(1)(v) are deleted. However, FDA has retained the broad requirement that the necessary independence and authority be provided as appropriate to every function affecting quality. FDA emphasizes that it is crucial to the success of the quality system for the manufacturer to ensure that responsibility, authority, and organizational freedom (or independence) is provided to those who initiate action to prevent nonconformities, identify and document quality problems, initiate, recommend, provide, and verify solutions to quality problems, and direct or control further processing, delivery, or installation of nonconforming product. Organizational freedom or independence does not necessarily require a stand-alone group, but responsibility, authority, and independence should be sufficient to attain the assigned quality objectives with the desired efficiency. 48. Several comments on proposed Sec. 820.20(b)(2), ``Verification resources and personnel,'' stated that requiring ``adequately'' trained personnel was subjective and that the section was not consistent with ISO 9001. FDA agrees that the section is not consistent with ISO 9001, and has adopted the language used in ISO 9001:1994, section 4.1.2.2, ``Resources,'' and has renamed the section ``Resources.'' The provision is now a broad requirement that the manufacturer provide adequate resources for the quality system and is not restricted to the verification function. FDA acknowledges that Sec. 820.25(a), ``General,'' requires that sufficiently trained personnel be employed. However, Sec. 820.20(b)(2), ``Resources,'' emphasizes that all resource needs must be provided for, including monetary, supplies, etc., as well as personnel resources. In contrast, Sec. 820.25(a) specifically addresses education, background, training, and experience requirements for personnel. 49. Comments on Sec. 820.20(b)(3), ``Management representative,'' stated that the management representative should not be limited to ``executive'' management. A few comments stated that the appointment should be documented. In addition, a few comments from proposed Sec. 820.5 stated that the terms ``effective'' and ``effectively'' should be defined. The agency agrees that the responsibility need not be assigned to ``executive'' management and has modified the requirement to allow management with executive responsibility to appoint a member of management. When a member of management is appointed to this function, potential conflicts of interest should be examined to ensure that the effectiveness of the quality system is not compromised. In addition, in response to many comments, the requirement was amended to make clear that the appointment of this person must be documented, moving the requirement up from Sec. 820.20(b)(3)(ii). The amended language is consistent with ISO 9001:1994. Further, FDA has amended this section to change ``executive management'' to ``management with executive responsibility'' for consistency with the definition. The terms ``effective'' and ``effectively'' are no longer used in Sec. 820.5 but ``effectively'' is found in Sec. 820.20(b)(3)(i). FDA does not believe that these terms require a definition. Instructions and procedures must be defined, documented, implemented, and maintained in such a way that the requirements of this part are met. If they are, they will be ``effective.'' 50. A few comments stated that the improvement of the quality system is not a requirement under the act and the reference to such improvement in Sec. 820.20(b)(3)(ii) should, therefore, be deleted. FDA agrees in part with the comments and has deleted the requirement that the person appointed under this section provide information for improving the quality system. The provision implied that the manufacturer must go beyond the requirements of the regulation. FDA notes, however, that information collected in complying with Secs. 820.20(b)(3)(ii) and 820.100 Corrective and preventive action, should be used not only for detecting deficiencies and for subsequent correction of the deficiencies but also to improve the device and quality system. 51. Many comments stated that the report required by Sec. 820.20(c), ``Management review,'' should not be subject to FDA review, due to the same liability and self-incrimination concerns related to the internal audit. FDA agrees in part with the comments. The proposed regulation did not state FDA's intentions with respect to inspectional review of the results of the required management review. After careful consideration of the comments, FDA agrees that it will not request to inspect and copy the reports of reviews required by Sec. 820.20(c) when conducting routine inspections to determine compliance with this part. FDA believes that refraining from routinely reviewing these reports may help ensure that the audits are complete and candid and of maximum use to the manufacturer. However, FDA believes that it is important that the dates and results of quality system reviews be documented, and FDA may require that management with executive responsibility certify in writing that the manufacturer has complied with the requirements of Sec. 820.20(c). FDA will also review the written procedures required by Sec. 820.20(c), as well as all other records required under Sec. 820.20. 52. A few comments stated that the management review should not be dictated by established review procedures because management level employees should be fully capable of reviewing documents without a written procedure. As noted above, FDA has retained the requirement for establishing procedures to conduct the required management review in Sec. 820.20(c). FDA believes that [Page 52614] a manufacturer can establish procedures flexible enough for management to vary the way in which a review is conducted, as appropriate. Procedures should require that the review be conducted at appropriate intervals and should be designed to ensure that all parts of the quality system are adequately reviewed. A manufacturer may, of course, develop procedures that permit review of different areas at different times, so long as such reviews are sufficient to carry out the objectives of this section. If there are known problems, for example, a ``sufficient frequency'' may be fairly frequent. Further, because FDA will not be reviewing the results of such reviews, FDA must be assured that this function will occur in a consistent manner. 53. A few comments stated that Sec. 820.20(c) should be deleted because it duplicates the quality audit required by Sec. 820.22. FDA disagrees that Sec. 820.20(c) duplicates the requirements in Sec. 820.22. The purpose of the management reviews required by Sec. 820.20(c) is to determine if the manufacturer's quality policy and quality objectives are being met, and to ensure the continued suitability and effectiveness of the quality system. An evaluation of the findings of internal and supplier audits should be included in the Sec. 820.20(c) evaluation. The management review may include a review of the following: (1) The organizational structure, including the adequacy of staffing and resources; (2) the quality of the finished device in relation to the quality objectives; (3) combined information based on purchaser feedback, internal feedback (such as results of internal audits), process performance, product (including servicing) performance, among other things; and (4) internal audit results and corrective and preventive actions taken. Management reviews should include considerations for updating the quality system in relation to changes brought about by new technologies, quality concepts, market strategies, and other social or environmental conditions. Management should also review periodically the appropriateness of the review frequency, based on the findings of previous reviews. The quality system review process in Sec. 820.20(c), and the reasons for the review, should be understood by the organization. The requirements under Sec. 820.22 Quality audit are for an internal audit and review of the quality system to verify compliance with the quality system regulation. The review and evaluations under Sec. 820.22 are very focused. During the internal quality audit, the manufacturer should review all procedures to ensure adequacy and compliance with the regulation, and determine whether the procedures are being effectively implemented at all times. In contrast, as noted above, the management review under Sec. 820.20(c) is a broader review of the organization as a whole to ensure that the quality policy is implemented and the quality objectives are met. The reviews of the quality policy and objectives (Sec. 820.20(c)) should be carried out by top management, and the review of supporting activities (Sec. 820.22) should be carried out by management with executive responsibility for quality and other appropriate members of management, utilizing competent personnel as decided on by the management. 54. Some comments suggested that the requirements in Sec. 820.186(a) and (d) be moved to Sec. 820.20 for clarity and to better align with the structure of ISO 9001:1994 and ISO/CD 13485. FDA agrees and has moved the specific requirements from Sec. 820.186 and rewritten them into new Sec. 820.20 (d) and (e) for clarity, better organization, and closer harmonization. Therefore, Sec. 820.20(d) is consistent with ISO 9001:1994, section 4.2.3, ``Quality planning,'' and Sec. 820.20(e) is consistent with ISO 9001:1994, sections 4.2.1, ``General,'' and 4.2.2, ``Quality-system procedures.'' Section 820.20(e) discusses ``[a]n outline of the structure of the documentation used in the quality system.'' FDA believes that outlining the structure of the documentation is beneficial and, at times, may be critical to the effective operation of the quality system. FDA recognizes, however, that it may not be necessary to create an outline in all cases. For example, it may not be necessary for smaller manufacturers and manufacturers of less complicated devices. Thus, the outline is only required where appropriate. ii. Quality Audit (Sec. 820.22) 55. A few comments suggested that FDA delete the requirement that persons conducting the audit be ``appropriately trained'' from the second sentence of proposed Sec. 820.22(a), because it is subjective and not consistent with ISO 9001. FDA has deleted the requirement from Sec. 820.22(a) because Sec. 820.25 Personnel requires that such individuals be appropriately trained. Further, FDA has attempted to better harmonize with ISO 9001:1994, which does not explicitly state personnel qualifications in each provision. Similarly, in response to general comments suggesting better harmonization, FDA has added the requirement that the audit ``determine the effectiveness of the quality system'' as required by ISO 9001:1994. This requirement underscores that the quality audit must not only determine whether the manufacturer's requirements are being carried out, but whether the requirements themselves are adequate. 56. Some comments stated that requiring ``individuals who do not have direct responsibility for the matters being audited'' to conduct the audits is impractical and burdensome, particularly for small manufacturers. FDA disagrees with the comments. Both small and large manufacturers have been subject to the identical requirement since 1978 and FDA knows of no hardship, on small or large manufacturers, as a result. Small manufacturers must generally establish independence, even if it means hiring outside auditors, because the failure to have an independent auditor could result in an ineffective audit. Manufacturers must realize that conducting effective quality audits is crucial. Without the feedback provided by the quality audit and other information sources, such as complaints and service records, manufacturers operate in an open loop system with no assurance that the process used to design and produce devices is operating in a state of control. ISO 9001:1994 has the same requirement for independence from the activity being audited. 57. Several comments claimed that the last sentence in proposed Sec. 820.22(a), which required that followup corrective action be documented in the audit report, made no sense. The comments said that corrective action would be the subject of a followup report. It was the agency's intent that the provision require that where corrective action was necessary, it would be taken and documented in a reaudit report. The provision has been rewritten to make that clear. New Sec. 824.22 also clarifies that a reaudit is not always required, but where it is indicated, it must be conducted. The report should verify that corrective action was implemented and effective. Because FDA does not review these reports, the date on which the audit and reaudit were performed must be documented and will be subject to FDA review. The revised reaudit provision is consistent with ISO 9001:1994. 58. Many comments were received on proposed Sec. 820.22(b) regarding the reports exempt from FDA review. Most of the comments objected to FDA reviewing evaluations of suppliers. FDA has decided not to review such [Page 52615] evaluations at this time and will revisit this decision after the agency gains sufficient experience with the new requirement to determine its effectiveness. A thorough response to the comments is found with the agency's response to other comments received on Sec. 820.50 Purchasing controls. FDA has moved the section regarding which reports the agency will refrain from reviewing from Sec. 820.22(b) to new Sec. 820.180(c), ``Exemptions,'' under the related records requirements. FDA believes this organization is easier to follow. iii. Personnel (Sec. 820.25) 59. A few comments stated that the requirement in Sec. 820.25 Personnel for the manufacturer to employ ``sufficient'' personnel should be deleted, because whether there are ``sufficient'' personnel is a subjective determination, and it is unnecessary to require it since the manufacturer will know how best to staff the organization. A few other comments stated that the provision should not base the personnel requirements on ensuring that the requirements of the regulation are ``correctly'' performed, because no manufacturer can ensure that all activities are performed correctly. Another comment stated that the term ``employ'' should be changed because personnel may include qualified temporaries, contractors, and others who may not typically be considered ``employees.'' FDA disagrees with the suggestions that the terms ``sufficient'' and ``correctly'' be deleted. Whether ``sufficient'' personnel are employed will be determined by the requirements of the quality system, which must be designed to ensure that the requirements of the regulation are properly implemented. In making staffing decisions, a manufacturer must ensure that persons assigned to particular functions are properly equipped and possess the necessary education, background, training, and experience to perform their functions correctly. However, FDA changed ``ensure'' to ``assure'' to address the concerns that people do make mistakes and management cannot guarantee that work is correctly performed all of the time. Further, FDA agrees that the manufacturer must determine for itself what constitutes ``sufficient'' personnel with proper qualification in the first instance. However, if the manufacturer does not employ sufficient personnel, or personnel with the necessary qualifications to carry out their functions, the manufacturer will be in violation of the regulation. FDA has often found that the failure to comply with this requirement leads to other significant regulatory violations. FDA agrees with the comment that the term ``employ'' should be deleted so that the requirement covers all personnel who work at a firm. 60. In Sec. 820.25(b), ``Training,'' FDA deleted the requirement that employees be trained ``by qualified individuals,'' because Sec. 820.25(a) requires this. Several comments stated that FDA should add the requirement that the training procedure include the identification of training needs, to be consistent with the requirements in ISO 9001:1994 and ISO/CD 13485. Other comments stated that personnel need not be trained to the extent that they can quote chapter and verse of the regulation as long as they can adequately perform their assigned responsibilities. Several comments suggested deleting the requirements in the last two sentences in favor of a broad, general requirement that personnel be trained. A few comments stated that the last two sentences should be retained because they are crucial and sound requirements but that validation activities should be included with verification activities. FDA amended the requirement so that the training procedure includes the identification of training needs. FDA deleted the requirement on understanding the CGMP requirements applicable to job functions to avoid the perception that personnel would need to know ``chapter and verse of the regulation.'' FDA notes, however, that a training program to ensure personnel adequately perform their assigned responsibilities should include information about the CGMP requirements and how particular job functions relate to the overall quality system. FDA further believes that it is imperative that training cover the consequences of improper performance so that personnel will be apprised of defects that they should look for, as well as be aware of the effect their actions can have on the safety and effectiveness of the device. In addition, FDA disagrees with comments that suggested that only ``personnel affecting quality'' should be required to be adequately trained. In order for the full quality system to function as intended, all personnel should be properly trained. Each function in the manufacture of a medical device must be viewed as integral to all other functions. FDA has reorganized the last two sentences, however, to place the requirements under Sec. 820.25(b), ``Training,'' and has added validation activities as suggested by the comments. 61. Many comments objected to the proposed requirements of Sec. 820.25(c), ``Consultants,'' stating that requiring a manufacturer to chose consultants that have sufficient qualifications and to keep records subject to FDA review of all consultants used, along with copies of their resumes and lists of previous jobs, would unreasonably interfere with the manufacturer's business activities and restrict the right of a manufacturer to hire consultants on any basis it chooses. Other comments said that a manufacturer's employment of a consultant has the same potential impact on the safety and effectiveness of medical devices as employment of any other contractor for services, and that consultants should, therefore, be covered by Sec. 820.50 Purchasing controls. FDA agrees in part with these comments. Although employing a consultant is a business decision, when a manufacturer hires consultants who do not have appropriate credentials, and manufacturing decisions are made based on erroneous or ill-conceived advice, the public suffers. Of course, the manufacturer is still ultimately responsible for following the CGMP requirements and will bear the consequences of a failure to comply. FDA notes that the use of unqualified consultants has led to regulatory action for the failure to comply with the CGMP regulation in the past. Thus, because of the significant impact a consultant can have on the safety and effectiveness of a device, FDA believes that some degree of control is required in the regulation. The requirements are revised somewhat in response to comments, however, to reflect that it is not FDA's goal to dictate whom a manufacturer may use as a consultant, but instead to require that a manufacturer determine what it needs to adequately carry out the requirements of the regulation and to assess whether the consultant can adequately meet those needs. The requirements related to consultants have been added in Sec. 820.50 Purchasing controls because a consultant is a supplier of a service. C. Design Controls (Subpart C) Since early 1984, FDA has identified lack of design controls as one of the major causes of device recalls. The intrinsic quality of devices, including their safety and effectiveness, is established during the design phase. Thus, FDA believes that unless appropriate design controls are observed during preproduction stages of development, a finished device may be neither safe nor effective for its intended use. The SMDA provided FDA with the [Page 52616] authority to add preproduction design controls to the device CGMP regulation. Based on its experience with administering the original CGMP regulation, which did not include preproduction design controls, the agency was concerned that the original regulation provided less than an adequate level of assurance that devices would be safe and effective. Therefore, FDA has added general requirements for design controls to the device CGMP regulation for all class III and II devices and certain class I devices. FDA is not subjecting the majority of class I devices to design controls because FDA does not believe that such controls are necessary to ensure that such devices are safe and effective and otherwise in compliance with the act. However, all devices, including class I devices exempt from design controls, must be properly transferred to production in order to comply with Sec. 820.181, as well as other applicable requirements. For most class I devices, FDA believes that the production and other controls in the new quality system regulation and other general controls of the act will be sufficient, as they have been in the past, to ensure safety and effectiveness. 62. Many comments were submitted in response to the addition of design control requirements in general, many questioning how these new requirements would be implemented and enforced. For instance, several comments stated that the design control requirements do not reflect how medical devices are actually developed, because the concept of a design rarely originates with the manufacturer, who may not become involved until relatively late in the design evolution. Others expressed concern that FDA investigators will second-guess design issues in which they are not educated or trained, and stated that investigators should not debate whether medical device designs are ``safe and effective.'' FDA agrees in part with the comments. The design control requirements are not intended to apply to the development of concepts and feasibility studies. However, once it is decided that a design will be developed, a plan must be established to determine the adequacy of the design requirements and to ensure that the design that will eventually be released to production meets the approved requirements. Those who design medical devices must be aware of the design control requirements in the regulation and comply with them. Unsafe and ineffective devices are often the result of informal development that does not ensure the proper establishment and assessment of design requirements which are necessary to develop a medical device that is safe and effective for the intended use of the device and that meets the needs of the user. However, FDA investigators will not inspect a device under the design control requirements to determine whether the design is appropriate or ``safe and effective.'' Section 520(f)(1)(a) of the act precludes FDA from evaluating the ``safety or effectiveness of a device'' through preproduction design control procedures. FDA investigators will evaluate the process, the methods, and the procedures that a manufacturer has established to implement the requirements for design controls. If, based on any information gained during an inspection, an investigator believes that distributed devices are unsafe or ineffective, the investigator has an obligation to report the observations to the Center for Devices and Radiological Health (CDRH). 63. Several comments expressed concern that the application of design controls would severely restrict the creativity and innovation of the design process and suggested that design controls should not apply too early in the design development process. FDA disagrees with the comments. It is not the intent of FDA to interfere with creativity and innovation, and it is not the intent of FDA to apply the design control requirements to the research phase. Instead, the regulation requires the establishment of procedures to ensure that whatever design is ultimately transferred to production is, in fact, a design that will translate into a device that properly performs according to its intended use and user needs. To assist FDA in applying the regulation, manufacturers should document the flow of the design process so that it is clear to the FDA investigator where research is ending and development of the design is beginning. 64. A few comments stated that design controls should not be retroactive and that ongoing design development should be exempted. FDA agrees in part with the comments. FDA did not intend the design requirements to be retroactive, and Sec. 820.30 Design controls will not require the manufacturer to apply such requirements to already distributed devices. When the regulation becomes effective on June 1, 1997, it will apply to designs that are in the design and development phase, and manufacturers will be expected to have the design and development plan established. The manufacturer should identify what stage a design is in for each device and will be expected to comply with the established design and development plan and the applicable paragraphs of Sec. 820.30 from that point forward to completion. If a manufacturer had a design in the development stage before June 1, 1997, and cannot comply with any particular paragraph of Sec. 820.30, the manufacturer must provide a detailed justification as to why such compliance is not possible. However, designs will not have to be recycled through previous phases that have been completed. Manufacturers will be expected to comply in full by June 1, 1998. As stated earlier, FDA wants to emphasize that it expects manufacturers to be in a reasonable state of compliance with the design control requirements from June 1, 1997, to June 1, 1998, because extra time was given to the industry for implementing design controls before the final regulation became effective. When changes are made to new or existing designs, the design controls of Sec. 820.30 must be followed to ensure that the changes are appropriate and that the device will continue to perform as intended. FDA notes that the original CGMP regulation contained requirements for specification controls and controls for specification or design changes under Sec. 820.100(a). 65. One comment asked how the proposed design controls would apply to investigational device exemption (IDE) devices, since devices under approved IDE's have been exempt from the CGMP regulation. Some comments suggested that any changes to the IDE regulation should be done in a separate rulemaking. Other comments stated that any change to the IDE regulation should be worded so that all of Sec. 820.30 applies since the IDE process is supplying information in support of the design validation requirements but that all design requirements need not be completed prior to the start of the IDE because the clinical evaluation process often brings valuable information to the design project which may need to be incorporated into the design before design transfer. The IDE regulation was published in 1976 and last updated in 1978, and has been in effect since that time. Devices being evaluated under IDE's were exempted from the original CGMP regulation because it was believed that it was not reasonable to expect sponsors of clinical investigations to ensure compliance with CGMP's for devices that may never be approved for commercial distribution. However, sponsors of IDE studies were required to ensure that investigational devices were manufactured under a state of control. [Page 52617] With respect to the new regulation, FDA believes that it is reasonable to expect manufacturers who design medical devices to develop the designs in conformance with design control requirements and that adhering to such requirements is necessary to adequately protect the public from potentially harmful devices. The design control requirements are basic controls needed to ensure that the device being designed will perform as intended when produced for commercial distribution. Clinical evaluation is an important aspect of the design verification and validation process during the design and development of the device. Because some of the device design occurs during the IDE stage, it is logical that manufacturers who intend to commercially produce the device follow design control procedures. Were a manufacturer to wait until all the IDE studies were complete, it would be too late to take advantage of the design control process, and the manufacturer would not be able to fulfill the requirements of the quality system regulation for that device. Therefore, FDA has concurrently amended the IDE regulation, 812.1 Scope to state: (a) * * * An IDE approved under Sec. 812.30 or considered approved under Sec. 812.2(b) exempts a device from the requirements of the following sections of the Federal Food, Drug, and Cosmetic Act (the act) and regulations issued thereunder: * * * good manufacturing practice requirements under section 520(f) except for the requirements found in Sec. 820.30, if applicable (unless the sponsor states an intention to comply with these requirements under Sec. 812.20(b)(3) or Sec. 812.140(b)(4)(v)) and color additive requirements under section 721. (Emphasis added.) FDA does not expect any new information in IDE applications as a result of this amendment, nor will FDA inspect design controls during bioresearch monitoring inspections. FDA is simply making a conforming amendment to the IDE regulation to make clear that design controls must be followed when design functions are undertaken by manufacturers, including design activity which occurs under an approved IDE. FDA will evaluate the adequacy of manufacturers' compliance with design control requirements in routine CGMP inspections, including preapproval inspections for premarket approval applications (PMA's). 66. Many written comments and oral comments at the August and September 1995 meetings recommended that, because design controls are a major addition to the regulation, the effective date for design controls should be delayed until 18 months after publication of the final rule. FDA has addressed these comments by extending the effective date of the regulation until June 1, 1997, and by the inspectional strategy described earlier. 67. A couple of comments suggested that FDA lacked the authority to establish the design control requirements. FDA disagrees with the comments. The act and its legislative history make clear that FDA has the authority to impose those controls necessary to ensure that devices are safe and effective. The SMDA gave FDA explicit authority to promulgate design controls, including a process to assess the performance of a device (see section 520(f)(1)(A) of the act). The legislative history of the SMDA supports a ``comprehensive device design validation regulation.'' H. Rept. 808, 101st Cong., 2d sess. 23 (emphasis added). Congress stated that the amendment to the statute was necessary because almost half of all device recalls over a 5-year period were ``related to a problem with product design.'' Id. There is a thorough discussion on the evolution of and need for the design controls in the preamble to the November 23, 1993 (58 FR 61952), proposal. 68. A few comments objected to FDA requiring design controls for any class I devices in Sec. 820.30(a). FDA believes that, for the class I devices listed, design controls are necessary and has retained the requirements. Those relatively few devices, while class I, require close control of the design process to ensure that the devices perform as intended, given the serious consequences that could occur if their designs were flawed and the devices were to fail to meet their intended uses. In fact, some of the devices included on the list have experienced failures due to design related problems that have resulted in health hazards, injuries, or death. Further, verification, or even validation, cannot provide the assurance of proper design for some devices, especially those containing extensive software. Thus, all automated devices must be developed under the design control requirements. 69. Several comments stated that FDA has underestimated the complexity of a design project in requiring that the plans identify ``persons responsible for each activity'' in proposed Sec. 820.30(b). One comment stated that ``define responsibility for implementation'' and ``activities shall be assigned'' were basically redundant requirements. A few other comments stated that ISO 9001:1994 does not call for the design plans to be ``approved'' and that this requirement should be deleted because it would be burdensome. FDA agrees in part with the comments and has revised Sec. 820.30(b) to require the plan to describe or reference design activities and define responsibility for implementing the activities, rather than requiring that the plan identify each person responsible for carrying out each activity. In making this change, FDA notes that Sec. 820.20(b)(1) requires manufacturers to establish the appropriate responsibility for activities affecting quality, and emphasizes that the assignment of specific responsibility is important to the success of the design control program and to achieving compliance with the regulation. Also, the design and development activities should be assigned to qualified personnel equipped with adequate resources as required under Sec. 820.20(b)(2). The requirements under Sec. 820.30(b) were rewritten to be very similar to the requirements in ISO 9001:1994, sections 4.4.2 and 4.4.3. FDA does not agree that the design plan should not be ``approved.'' ISO 9001:1994, section 4.4.2 requires that the plan be ``updated,'' and section 4.4.3 requires that the plan be ``regularly reviewed.'' Therefore, the approval is consistent with ISO 9001:1994 and would not be unduly burdensome since the FDA does not dictate how or by whom the plan must be approved. The regulation gives the manufacturer the necessary flexibility to have the same person(s) who is responsible for the review also be responsible for the approval of the plan if appropriate. 70. A few comments stated that the proposed requirement to describe ``any interaction between or among different organizational and technical groups'' in Sec. 820.30(b) for the design and development plan should be deleted because it is overly broad, unnecessary, and burdensome. One comment said that the communication expected between these groups should be clarified. In response, FDA has amended the requirement as suggested by one comment so that the plan shall identify and describe the interfaces with different groups or activities that provide, or result in, input to the design process. Many organization functions, both inside and outside the design group, may contribute to the design process. For example, interfaces with marketing, purchasing, regulatory affairs, manufacturing, service groups, or information systems may be necessary during the design [Page 52618] development phase. To function effectively, the design plan must establish the roles of these groups in the design process and describe the information that should be received and transmitted. 71. One comment stated that the requirement in Sec. 820.30(b) that manufacturers establish a design plan completely ignores the creative and dynamic process of designing by requiring a plan to have complete design and testing criteria established, with specifications, before the design process is started. FDA disagrees with the comment. Section 820.30(b) does not require manufacturers to complete design and testing criteria before the design process begins. This section has been revised to state that ``plans shall be reviewed, updated, and approved as design and development evolves,'' indicating that changes to the design plan are expected. A design plan typically includes at least proposed quality practices, assessment methodology, recordkeeping and documentation requirements, and resources, as well as a sequence of events related to a particular design or design category. These may be modified and refined as the design evolves. However, the design process can become a lengthy and costly process if the design activity is not properly defined and planned. The more specifically the activities are defined up front, the less need there will be for changes as the design evolves. 72. One comment stated that the language contained in proposed Sec. 820.30(c) should more closely match that of ISO 9001. Many other comments stated that the provision should not require the input requirements to ``completely'' address the intended use of the device because inputs could never ``completely'' address the intended use. Several comments stated that the requirement of ISO 9001 that ``incomplete, ambiguous or conflicting requirements shall be resolved with those responsible for imposing these requirements'' should be added to Sec. 820.30(c), ``Design input,'' because it is important that the regulation identify the method of resolving conflicting information. FDA agrees with the harmonization comment and has revised the language to incorporate the requirement of section 4.4.4, ``Design input,'' of ISO 9001:1994. FDA does not believe that it is necessary to have identical language to harmonize quality system requirements. ISO 9001:1994, section 4.4.1, ``General,'' requires that the manufacturer ``establish and maintain documented procedures to control and verify the design of the product in order to ensure that the specified requirements are met.'' FDA's regulation, under Sec. 820.30(a), imposes the same requirements. Regarding the comments that input requirements cannot completely address the intended use of the device, FDA recognizes that the provision could be interpreted to impose a burden that may not always be possible to meet and has deleted the word ``completely.'' FDA did not intend the provision to suggest that a manufacturer must foresee every possible event. FDA emphasizes, however, that the section requires the manufacturer to ensure that the design input requirements are appropriate so the device will perform to meet its intended use and the needs of the user. In doing this, the manufacturer must define the performance characteristics, safety and reliability requirements, environmental requirements and limitations, physical characteristics, applicable standards and regulatory requirements, and labeling and packaging requirements, among other things, and refine the design requirements as verification and validation results are established. For example, when designing a device, the manufacturer should conduct appropriate human factors studies, analyses, and tests from the early stages of the design process until that point in development at which the interfaces with the medical professional and the patient are fixed. The human interface includes both the hardware and software characteristics that affect device use, and good design is crucial to logical, straightforward, and safe device operation. The human factors methods used (for instance, task/function analyses, user studies, prototype tests, mock-up reviews, etc.) should ensure that the characteristics of the user population and operating environment are considered. In addition, the compatibility of system components should be assessed. Finally, labeling (e.g., instructions for use) should be tested for usability. FDA agrees with the comments, in that it is important that incomplete, ambiguous, or conflicting requirements be resolved with those responsible for imposing these requirements. Therefore, FDA has added the requirement that the procedures shall include a mechanism for addressing incomplete, ambiguous, or conflicting requirements. FDA notes that this must be done to ``ensure that the design requirements are appropriate and address the intended use of the device,'' as required under Sec. 820.30(c). 73. A few other comments stated that ISO 9001:1994 does not call for the design input to be ``approved'' and therefore, this requirement should be deleted because it would be burdensome. FDA does not agree that the ``approval'' of design input requirements should be deleted, nor that the requirement is inconsistent with ISO. ISO 9001:1994, section 4.4.4, ``Design Input,'' requires that the design input requirements be ``reviewed by the supplier for adequacy.'' Therefore, the approval would not add any additional burden because FDA does not dictate how or by whom the design input requirements must be approved, thus giving the manufacturer the necessary flexibility to have the same person(s) who is responsible for the ``review for adequacy'' also be responsible for the approval, if appropriate. Further, it is important that the design input be assessed as early as possible in the development process, making this an ideal time in the device's design development to have a design review to ``approve'' the design input. 74. A few comments stated that the proposed requirement under Sec. 820.30(c) that ``design input shall be reviewed and approved by a designated qualified individual'' should be deleted as it implies that one person must be designated to review and approve a design, and that there may not be one person who is qualified to assess all of the design input requirements. Addressing the same point, several comments suggested that the provision be revised to allow for more than one person to review and approve the design. One comment said that the FDA's requirement appears to be at odds with the team approach. FDA agrees with the concern expressed by the comments and has modified the requirement to allow more than one individual to review and approve the design input. FDA endorses the team approach and believes that designs should be reviewed and evaluated by all disciplines necessary to ensure the design input requirements are appropriate. 75. Two comments stated that proposed Sec. 820.30(c) should be reworded to focus on systems for assuring adequate design input, not on the input itself. One additional comment on this section said that the design input requirements should include not only the device's intended use and needs of the user, but the environmental limits of where it will be used. FDA agrees that procedures for ensuring appropriate design controls are of the utmost importance and has modified the section to clarify that the [Page 52619] manufacturer must establish and maintain procedures to ensure that the design requirements are properly addressed. FDA made this change to the other paragraphs as well, but notes that Sec. 820.30(a), ``General,'' requires the manufacturer to establish and maintain procedures to control the design of the device in order to ensure that specified design requirements are met. The sections that follow set forth some of the requirements for which procedures must be established. It should be emphasized that the input itself must also be appropriate; the requirement is for the procedures to be defined, documented, and implemented. Thus, if the input requirements related to a device fail to address the intended use of the device, for example, the manufacturer has failed to comply with the provision. FDA also agrees with the additional comment but believes that identifying and establishing the environmental limits for safe and effective device operation is inherent in the requirements for ensuring that a device is appropriate for its intended use. Some factors that must be considered when establishing inputs include, where applicable, a determination of energy (e.g., electrical, heat, and electromagnetic fields), biological effects (e.g., toxicity and biocompatibility) and environmental effects (e.g., electromagnetic interference and electrostatic discharge). 76. Several comments stated that proposed Sec. 820.30(f), ``Design output,'' should be rewritten or deleted because many of the requirements were already stated in proposed Secs. 820.30(d), ``Design verification,'' and 820.30(e), ``Design review,'' and, if retained, should be reordered similar to ISO 9001. FDA agrees in part with the comments and has rewritten the requirements of design output to be consistent with ISO 9001:1994, section 4.4.5, ``Design output,'' and reordered the sections to be consistent with ISO 9001:1994. FDA retained the provision, however, because it does not agree that the section is redundant with the sections on design verification, design validation, or design review. Design output are the design specifications which should meet design input requirements, as confirmed during design verification and validation and ensured during design review. The output includes the device, its labeling and packaging, associated specifications and drawings, and production and quality assurance specifications and procedures. These documents are the basis for the DMR. The total finished design output consists of the device, its labeling and packaging, and the DMR. 77. One comment stated that the sentence ``Design output procedures shall ensure that design output meets the design input requirements'' is redundant with the requirement under design verification. Another comment asked what is meant by ``release.'' FDA agrees with the first comment and has deleted that sentence in Sec. 820.30(d) but notes that the design output must be documented and expressed in terms that can be verified against the design input requirements. Design output can be ``released'' or transferred to the next design phase at various stages in the design process, as defined in the design and development plan. The design output is reviewed and approved before release or transfer to the next design phase or production. The design output requirements are intended to apply to all such stages of the design process. 78. One small manufacturer commented that the problems that Sec. 820.30(e), ``Design review,'' is meant to reveal involve coordination, cooperation, or communication difficulties among the members of an organization and that these difficulties do not exist in a small company. Therefore, the comment stated that the design review requirements should not apply to small manufacturers. The purpose of conducting design reviews during the design phase is to ensure that the design satisfies the design input requirements for the intended use of the device and the needs of the user. Design review includes the review of design verification data to determine whether the design outputs meet functional and operational requirements, the design is compatible with components and other accessories, the safety requirements are achieved, the reliability and maintenance requirements are met, the labeling and other regulatory requirements are met, and the manufacturing, installation, and servicing requirements are compatible with the design specifications. Design reviews should be conducted at major decision points during the design phase. For a large manufacturer, design review provides an opportunity for all those who may have an impact on the quality of the device to provide input, including manufacturing, quality assurance, purchasing, sales, and servicing divisions. While small manufacturers may not have the broad range of disciplines found in a large company, and the need to coordinate and control technical interfaces may be lessened, the principles of design review still apply. The requirements under Sec. 820.30(e) allow small manufacturers to tailor a design review that is appropriate to their individual needs. 79. One comment stated that the wording of proposed Sec. 820.30(e) implies that only one design review is expected, and that design review should be conducted at several stages of product development. Several comments stated that to demand that every design review be conducted by individuals who do not have direct responsibility for design development is impractical, especially for small companies. FDA agrees with the first comment and has rewritten the requirement to make clear that design reviews must be conducted at appropriate stages of design development, which must be defined in the established design and development plan. The number of design reviews will depend on the plan and the complexity of the device. FDA also amended the requirements so that the results of a design review include identification of the design, the date, and the individual(s) performing the review. Thus, multiple reviews can occur and the manufacturer must document what is being reviewed, when, and by whom. FDA never intended to mandate that an individual without design responsibility conduct the design reviews and, to clarify its position, has rewritten the requirement. The requirement now states that the procedures shall ensure that each design review includes an individual(s) who does not have direct responsibility for the design stage being reviewed. This requirement will provide an ``objective view'' from someone not working directly on that particular part of the design project, to ensure that the requirements are met. In making this change, FDA also notes that it was not FDA's intention to prohibit those directly responsible for the design from participating in the design review. 80. One comment stated that as part of the systematic review of the adequacy of the device design, it is occasionally necessary to produce a prototype device and have it evaluated by a physician who is an expert in the area of the device's intended use. Thus, the comment stated that the regulation should be revised to allow a means for a manufacturer to ship a prototype device to a physician for evaluation. One comment questioned whether design verification and validation can be conducted using prototypes or machine shop models. FDA regulations do not prohibit the shipment of prototypes for clinical or [Page 52620] other studies. Prototypes used in clinical studies involving humans may be shipped in accordance with the IDE provisions in part 812 (21 CFR part 812). FDA understands that it is not always practical to conduct clinical studies on finished production units and, therefore, the use of prototypes in clinical studies is acceptable. When prototype devices are used on humans they must be verified as safe to the maximum extent feasible. Final design validation, however, cannot be done on prototypes because the actual devices produced and distributed are seldom the same as the research and development prototypes. The final verification and validation, therefore, must include the testing of actual production devices under actual or simulated use conditions. 81. A few comments stated that Sec. 820.30(d), ``Design verification,'' should be rewritten and reordered similar to ISO 9001. FDA agrees with the comments and has rewritten and reordered this section to be consistent with ISO 9001:1994. The language in revised Sec. 820.30(f) and (g) incorporates the requirement of ISO 9001:1994, sections 4.4.7, ``Design verification,'' and 4.4.8, ``Design validation,'' respectively. Under the revised provisions, the design must be verified and validated. It is important to note that design validation follows successful design verification. Certain aspects of design validation can be accomplished during the design verification, but design verification is not a substitute for design validation. Design validation should be performed under defined operating conditions and on the initial production units, lots, or batches, or their equivalents to ensure proper overall design control and proper design transfer. When equivalent devices are used in the final design validation, the manufacturer must document in detail how the device was manufactured and how the manufacturing is similar to and possibly different from initial production. Where there are differences, the manufacturer must justify why design validation results are valid for the production units, lots, or batches. Manufacturers should not use prototypes developed in the laboratory or machine shop as test units to meet these requirements. Prototypes may differ from the finished production devices. During research and development, conditions for building prototypes are typically better controlled and personnel more knowledgeable about what needs to be done and how to do it than are regular production personnel. When going from laboratory to scale-up production, standards, methods, and procedures may not be properly transferred, or additional manufacturing processes may be added. Often, changes not reflected in the prototype are made in the device to facilitate the manufacturing process, and these may adversely affect device functioning and user interface characteristics. Proper testing of devices that are produced using the same methods and procedures as those to be used in routine production will prevent the distribution and subsequent recall of many unacceptable medical devices. In addition, finished devices must be tested for performance under actual conditions of use or simulated use conditions in the actual or simulated environment in which the device is expected to be used. The simulated use testing provision no longer requires that the testing be performed on the first three production runs. However, samples must be taken from units, lots, or batches that were produced using the same specifications, production and quality system methods, procedures, and equipment that will be used for routine production. FDA considers this a critical element of the design validation. The requirement to conduct simulated use testing of finished devices is found in the original CGMP in Sec. 820.160, as part of finished device inspection. This requirement has been moved to Sec. 820.30(g) because FDA believes that simulated use testing at this point is more effective in ensuring that only safe and effective devices are produced. Manufacturers must also conduct such tests when they make changes in the device design or the manufacturing process that could affect safety or effectiveness as required in the original CGMP in Sec. 820.100(a)(2). The extent of testing conducted should be governed by the risk(s) the device will present if it fails. FDA considers these activities essential for ensuring that the manufacturing process does not adversely affect the device. Design validation may also be necessary in earlier stages, prior to product completion, and multiple validations may need to be performed if there are different intended uses. Proper design validation cannot occur without following all the requirements set forth in the design control section of the regulation. 82. Several comments stated that adequate controls for verification of design output are contained in proposed Sec. 820.30(d), ``Design verification,'' and repeated in proposed Sec. 820.30(f), ``Design output.'' One comment stated that this section will place undue burden on designers and require additional documentation which will add little value to a device's safety and effectiveness. FDA disagrees with the comments. Revised Sec. 820.30(f), ``Design verification,'' and Sec. 820.30(g), ``Design validation,'' require verification and validation of the design output. Section 820.30(d), ``Design output,'' requires that the output be documented in a fashion that will allow for verification and validation. These sections thus contain different requirements that are basic to establishing that the design output meets the approved design requirements or inputs, including user needs and intended uses. All the requirements are essential to assuring the safety and effectiveness of devices. FDA does not believe that these requirements place undue burden on designers or require additional documentation with no value added. These basic requirements are necessary to assure the proper device performance, and, therefore, the production of safe and effective devices, and are acknowledged and accepted as such throughout the world. 83. Several comments stated that the term ``hazard analysis'' should be defined in reference to design verification. A couple of comments stated that the proposed requirement for design verification, to include software validation and hazard analysis, where applicable, was ambiguous, and may lead an FDA investigator to require software validation and hazard analysis for devices in cases where it is not needed. One comment stated that FDA should provide additional guidance regarding software validation and hazard analysis and what investigators will expect to see. Another comment stated that by explicitly mentioning only software validation and hazard analysis, FDA was missing the opportunity to introduce manufacturers to some powerful and beneficial tools for better device designs and problem avoidance. FDA has deleted the term ``hazard analysis'' and replaced it with the term ``risk analysis.'' FDA's involvement with the ISO TC 210 made it clear that ``risk analysis'' is the comprehensive and appropriate term. When conducting a risk analysis, manufacturers are expected to identify possible hazards associated with the design in both normal and fault conditions. The risks associated with the hazards, including those resulting from user error, should then be calculated in both normal and fault conditions. If any risk is judged unacceptable, it should be reduced to acceptable levels by the appropriate [Page 52621] means, for example, by redesign or warnings. An important part of risk analysis is ensuring that changes made to eliminate or minimize hazards do not introduce new hazards. Tools for conducting such analyses include Failure Mode Effect Analysis and Fault Tree Analysis, among others. FDA disagrees with the comments that state the requirement is ambiguous. Software must be validated when it is a part of the finished device. FDA believes that this control is always needed, given the unique nature of software, to assure that software will perform as intended and will not impede safe operation by the user. Risk analysis must be conducted for the majority of devices subject to design controls and is considered to be an essential requirement for medical devices under this regulation, as well as under ISO/CD 13485 and EN 46001. FDA has replaced the phrase ``where applicable'' with ``where appropriate'' for consistency with the rest of the regulation. FDA believes that sufficient domestic and international guidelines are available to provide assistance to manufacturers for the validation of software and risk analysis. For example, ``Reviewer Guidance for Computer Controlled Medical Devices Undergoing 510(k) Review,'' August 1991; ``A Technical Report, Software Development Activities,'' July 1987; and ISO-9000-3 contain computer validation guidance. Further, FDA is preparing a new ``CDRH Guidance for the Scientific Review of Pre- Market Medical Device Software Submissions.'' Regarding guidance on ``risk analysis,'' manufacturers can reference the draft EN (prEN) 1441, ``Medical Devices--Risk Analysis'' standard and the work resulting from ISO TC 210 working group No. 4 to include ISO/CD 14971, ``Medical Devices--Risk Management--Application of Risk Analysis to Medical Devices.'' FDA disagrees that it is missing the opportunity to introduce manufacturers to some powerful and beneficial tools for better device designs and problem avoidance because the manufacturer must apply current methods and procedures that are appropriate for the device, to verify and validate the device design under the regulation. Therefore, FDA need not list all known methods for meeting the requirements. A tool that may be required to adequately verify and validate one design may be unnecessary to verify and validate another design. 84. One comment stated that for some design elements it may be more appropriate to reference data from another prior experimentation rather than conduct new testing, and that the requirement to list verification methods should be modified. FDA agrees in part with the comment. The revised language of Sec. 820.30(f) will permit the use of data from prior experimentation when applicable. When using data from previous experimentation, manufacturers must ensure that it is adequate for the current application. 85. ``Design transfer,'' now Sec. 820.30(h), has been revised in response to the many comments objecting to the requirements in the proposed section on ``Design transfer.'' Specifically, the proposed requirement for testing production units under actual or simulated use conditions was rewritten and moved to current Sec. 820.30(g), ``Design validation.'' FDA again emphasizes that testing production units under actual or simulated use conditions prior to distribution is crucial for ensuring that only safe and effective devices are distributed and FDA has therefore retained the requirement. ISO 9001:1994 discusses this concept in notes 12 and 13. As noted above, it is not always possible to determine the adequacy of the design by successfully building and testing prototypes or models produced in a laboratory setting. The requirement for testing from the first three production lots or batches has been deleted. While FDA believes that three production runs during process validation (process validation may be initiated before or during design transfer) is the accepted standard, FDA recognizes that all processes may not be defined in terms of lots or batches. The number three is, however, currently considered to be the acceptable standard. Therefore, although the number requirement is deleted, FDA expects validation to be carried out properly in accordance with accepted standards, and will inspect for compliance accordingly. Revised Sec. 820.30(h) now contains a general requirement for the establishment of procedures to ensure that the design basis for the device is correctly translated into production methods and procedures. This is the same requirement that is contained in Sec. 820.100(a) of the original CGMP regulation. 86. A few comments stated that the proposed requirements for ``Design release'' would prohibit the release of components, partial designs, and production methods before the design was final because the requirements mandate a review of all drawings, analysis, and production methods before allowing the product to go into production. Several comments stated that the proposed section on ``Design release'' was a duplication of requirements in other paragraphs of Sec. 820.30 and should be deleted. FDA did not intend the requirements for ``Design release'' to prohibit manufacturers from beginning the production process until all design activities were completed. The intent of the requirement was to ensure that all design specifications released to production have been approved, verified, and validated before they are implemented as part of the production process. This requirement is now explicitly contained in Sec. 820.30(d). FDA agrees in part with the second set of comments and has moved the requirement that design output be reviewed and approved to current Sec. 820.30(d), ``Design output.'' The remainder of the requirements have been deleted. 87. Several comments on Sec. 820.30(i), ``Design changes,'' stated that it is unnecessary to control all design changes and to do so would inhibit change and innovation. FDA disagrees with the comments. Manufacturers are not expected to maintain records of all changes proposed during the very early stages of the design process. However, all design changes made after the design review that approves the initial design inputs for incorporation into the design, and those changes made to correct design deficiencies once the design has been released to production, must be documented. The records of these changes create a history of the evolution of the design, which can be invaluable for failure investigation and for facilitating the design of future similar products. Such records can prevent the repetition of errors and the development of unsafe or ineffective designs. The evaluation and documentation should be in direct proportion to the significance of the change. Procedures must ensure that after the design requirements are established and approved, changes to the design, both pre- production and post-production are also reviewed, validated (or verified where appropriate), and approved. Otherwise, a device may be rendered unable to properly perform, and unsafe and ineffective. ISO 9001:1994, section 4.4.9, similarly provides that ``all design changes and modifications shall be identified, documented, reviewed, and approved by authorized personnel before their implementation.'' Note that when a change is made to a specification, method, or procedure, each manufacturer should evaluate the [Page 52622] change in accordance with an established procedure to determine if the submission of a premarket notification (510(k)) under Sec. 807.81(a)(3) (21 CFR 807.81(a)(3)), or the submission of a supplement to a PMA under Sec. 814.39(a) (21 CFR 814.39) is required. Records of this evaluation and its results should be maintained. 88. Several comments recommended that only changes after design validation and design transfer to full-scale production need to be documented. FDA disagrees with the comments. The safety and effectiveness of devices cannot be proven by final inspection or testing. Product development is inherently an evolutionary process. While change is a healthy and necessary part of product development, quality can be ensured only if change is controlled and documented in the development process, as well as the production process. Again, manufacturers are not expected to maintain records of changes made during the very early stages of product development; only those design changes made after the approval of the design inputs need be documented. Each manufacturer must establish criteria for evaluating changes to ensure that the changes are appropriate for its designs. 89. One comment on proposed Sec. 820.30(i), ``Design changes,'' stated that validation of design changes is not always necessary and the regulation should provide for other methods to be used. FDA agrees with the comments and has amended the requirement to permit verification where appropriate. For example, a change in the sterilization process of a catheter will require validation of the new process, but the addition of more chromium to a stainless steel surgical instrument may only require verification through chemical analysis. Where a design change cannot be verified by subsequent inspection and test, it must be validated. 90. Many comments noted that the acronym for proposed design history record (DHR) was the same as that of ``device history record'' (DHR), and suggested that the name of the ``design history record'' be changed. Several comments stated that the requirements of the ``design history record'' should be deleted because they were redundant with the requirements of the ``device master record.'' FDA agrees with the first set of comments and has changed the name to ``design history file.'' FDA disagrees with the second set of comments. The DMR contains the documentation necessary to produce a device. The final design output from the design phase, which is maintained or referenced in the DHF, will form the basis or starting point for the DMR. Thus, those outputs must be referred to or placed in the DMR. The total finished design output includes the final device, its labeling and packaging, and the DMR that includes device specifications and drawings, as well as all instructions and procedures for production, installation, maintenance, and servicing. The DHF, in contrast, contains or references all the records necessary to establish compliance with the design plan and the regulation, including the design control procedures. The DHF illustrates the history of the design, and is necessary so that manufacturers can exercise control over and be accountable for the design process, thereby maximizing the probability that the finished design conforms to the design specifications. 91. A few comments stated that the proposed requirements in Sec. 820.30(j) for the design history record should allow a single design history record for each device family or group having common design characteristics. FDA agrees with the comments. The intent of the DHF is to document, or reference the documentation of, the activities carried out to meet the design plan and requirements of Sec. 820.30. A DHF is, therefore, necessary for each type of device developed. The DHF must provide documentation showing the actions taken with regard to each type of device designed, not generically link devices together with different design characteristics and give a general overview of how the output was reached. 92. Some comments stated that the requirement that the DHF contain ``all'' records necessary to demonstrate that the requirements are met should be deleted because not ``all'' efforts need documentation. FDA received similar comments on almost every section of the regulation that had the word ``all.'' The proposed requirement does not state that all records must be contained in the DHF, but that all records necessary to demonstrate that the requirements were met must be contained in the file. FDA has deleted the word ``all'' but cautions manufacturers that the complete history of the design process should be documented in the DHF. Such records are necessary to ensure that the final design conforms to the design specifications. Depending on the design, that may be relatively few records. Manufacturers who do not document all their efforts may lose the information and experience of those efforts, thereby possibly requiring activities to be duplicated. D. Document Controls (Subpart D) 93. One comment stated that subpart D of part 820 should be titled ``Document Controls,'' instead of the proposed ``Document and Record Controls'' because the ``record'' requirements are addressed in subpart M. One comment stated that removal of obsolete or unneeded documents should be performed to maintain the integrity of the product configuration and the quality system. The comment suggested adding a requirement for a verification step for document distribution and removal to ensure this important element of a quality system is performed correctly. A few comments stated that proposed Sec. 820.40 should be rewritten to be similar to ISO 9001 and to delete the requirement that documents be ``accurate'' because the comments feared that typographical errors would be considered violations. FDA agrees with the first comment and has changed the title accordingly. FDA agrees in part with the second comment. The verification of document distribution and removal is very important and can directly affect the quality of a product. Section 820.40, which requires that the manufacturer establish and maintain procedures to control all documents, including those that are obsolete and/or to be removed, requires that the removal (or prevention of use) of obsolete documents be verified. FDA agrees in part with the last set of comments and has rewritten the section, following ISO 9001:1994, to be a general requirement for procedures to control documents that are required under the regulation. The procedures established must, among other things, ensure control of the accuracy and usage of current versions of the documents and the removal or prevention from use of obsolete documents, as well as ensure that the documentation developed is adequate to fulfill its intended purpose or requirement. FDA retained the requirement that the procedures ensure that documents meet the requirements of the regulation because that is the purpose of controlling the documents. FDA deleted the term ``accurate'' but notes that a typographical error can change the meaning of a document and have undesirable consequences. 94. Several comments on proposed Sec. 820.40(a), ``Document approval and issue,'' as well as other sections throughout the regulation, suggested that the term ``signature'' be replaced by the term ``identification.'' Such a change would allow for electronic or computerized identification in lieu of formal written signatures. Other comments stated that ``or stamps'' [Page 52623] should be added after ``signature'' since they are legally recognized in some foreign countries. FDA is aware that many documentation systems are now maintained electronically, and is in the process of developing an agency-wide policy that will be implemented through rulemaking on the use of electronic signatures. The agency identified several important issues related to the use of such signatures, including how to ensure that the identification is in fact the user's ``signature.'' These issues are discussed in FDA's ANPRM on the use of electronic signatures, published in the Federal Register on July 21, 1992 (57 FR 32185), and the proposed regulation published in the Federal Register on August 31, 1994 (59 FR 45160). Therefore, FDA has not revised the regulation to use the term ``identification,'' but notes that the quality system regulation's use of the term ``signature'' will permit the use of whatever electronic means the agency determines is the equivalent of a handwritten signature. FDA recommends that manufacturers use the two Federal Register documents as guidance until the regulation is finalized. FDA has not added the term ``or stamps'' to the regulation; however, stamps could be acceptable if the manufacturer has a formal procedure on how stamps are used in place of handwritten signatures. The procedure would have to address many of the same issues addressed in the electronic signature Federal Register documents, most importantly how the stamps would be controlled and how the manufacturer would ensure that the stamp was in fact the user's ``signature.'' 95. Several comments stated that proposed Sec. 820.40(b), ``Document distribution,'' should be rewritten to be consistent with ISO 9001. In response, FDA has deleted the section. The requirements for making documents available at all appropriate locations (ISO 9001:1994, section 4.5.2(a)) and the requirements for promptly removing obsolete documents (ISO 9001:1994, section 4.5.2(b)) have been moved, in revised form, to Sec. 820.40(a). In response to comments, FDA has added that obsolete documents, in lieu of being promptly removed from points of use, may be ``otherwise prevented from unintended use.'' 96. Several comments suggested major changes to proposed Sec. 820.40(c), ``Documentation changes.'' Some stated that the requirements should be revised to be consistent with ISO 9001. Others stated that the requirements related to validation should be rewritten and moved to another section under this part, because Sec. 820.40(c) should only address document changes, not device changes. Several comments stated that the reference to determining whether a 510(k) or PMA supplement is required after making changes to a device should be deleted because it is covered under different parts of the act and regulations. One comment stated that the requirement in Sec. 820.40(c) for changes to be ``approved by individuals in the same functions/ organizations that performed the original review and approval, unless specifically designated otherwise'' is unrealistic and does not reflect the way things are done in real life. FDA agrees with many of the comments and has substantially rewritten Sec. 820.40(c), now designated as Sec. 820.40(b), to relate specifically to changes to a document. The requirements are now very similar to the ISO 9001:1994 requirements in section 4.5.3. FDA has retained the requirement that the approved changes must be communicated in a timely manner to appropriate personnel. FDA has had many experiences where manufacturers made corrections to documents, but the changes were not communicated in a timely manner to the personnel utilizing the documents. The result of these untimely communications was the production of defective devices. In addition, FDA has moved the requirement for validating production and process changes to Sec. 820.70(b), ``Production and process changes,'' and notes that changes to the design specifications, at any time during the lifetime of the design of the device, must conform to the requirements in Sec. 820.30(i), ``Design changes.'' FDA has also deleted the sentence referencing 510(k)'s and PMA supplements because FDA believes this is covered elsewhere, but notes that this sentence is in the preamble above for Sec. 820.30(i). FDA disagrees that the requirement for changes to be ``approved by an individual(s) in the same function or organization that performed the original review and approval, unless specifically designated otherwise'' should be deleted and notes that this is a requirement of ISO 9001:1994 as well. The intent of the requirement is to ensure that those who originally approved the document have an opportunity to review any changes because these individuals typically have the best insight on the impact of the changes. The requirement is flexible, however, because it permits the manufacturer to specifically designate individuals who did not perform the original review and approval to review and approve the changes. To designate such individuals, the manufacturer will need to determine who would be best suited to perform the function, thus ensuring adequate control over the changes. In this way, review and approval will not be haphazard. 97. One comment on proposed Sec. 820.40(d), ``Documentation change record,'' stated that this section should be deleted because the other paragraphs of Sec. 820.40 adequately cover the proposed requirements. Two comments suggested replacing the section with the requirements of section 4.5.2 of ISO 9001. FDA has deleted Sec. 820.40(d) and placed the revised requirements in paragraphs (a) and (b) of this section. The general requirement of Sec. 820.40 now requires the manufacturer to establish adequate procedures to control all documents required by part 820. The procedures must cover the requirements listed in Sec. 820.40 (a) and (b). Thus, the manufacturer must establish a procedure for ensuring that only the current and approved version of a document is used, achieving the objective of the ``Master list or equivalent document control procedure,'' required in ISO 9001:1994, section 4.5.2. The other requirement in Sec. 820.40(d), ``Document change record,'' was to maintain a record of changes, to include a description of the changes, among other things. FDA has retained this requirement and has moved it into Sec. 820.40(b), ``Document changes,'' because the agency believes this information to be important and useful when investigating and performing corrective or preventive actions. FDA believes Sec. 820.40 on Document controls now adequately harmonizes with ISO 9001:1994, sections 4.5.1, 4.5.2, and 4.5.3. E. Purchasing Controls (Subpart E) 98. One comment stated that the proposed CGMP regulation omits any discussion of contract reviews, such as that contained in ISO 9001, section 4.3. Rather than leaving these procedures to the interpretations of individual manufacturers and investigators, the comment stated that FDA should explicitly state its general policy regarding contract reviews in the regulation. FDA agrees with the concepts underlying the contract review requirements of ISO 9001:1994, but believes these principles are already reflected in requirements in the regulation, such as Secs. 820.50 Purchasing controls and 820.160 Distribution. [Page 52624] Therefore, the agency has not added a separate section on contract review. 99. One comment stated that the requirements in Sec. 820.50 amount to overregulation. The comment stated that components are purchased by providing a specification sheet. They are then inspected upon receipt, and defective components are returned. According to the comment, under Sec. 820.50, the manufacturer would be required to spend more time on paperwork, and product would still have to be inspected upon receipt. Another comment stated that the cost of the quality assurance documentation program is going to be significantly higher for a company that runs a Just In Time (JIT) program than what FDA estimated. FDA disagrees with the comments. The failure to implement adequate purchasing controls has resulted in a significant number of recalls due to component failures. Most of these were due to unacceptable components provided by suppliers. Since FDA is not regulating component suppliers, FDA believes that the explicit addition to CGMP requirements of the purchasing controls of ISO 9001:1994 is necessary to provide the additional assurance that only acceptable components are used. To ensure purchased or otherwise received product or services conform to specifications, purchasing must be carried out under adequate controls, including the assessment and selection of suppliers, contractors, and consultants, the clear and unambiguous specification of requirements, and the performance of suitable acceptance activities. Each manufacturer must establish an appropriate mix of assessment and receiving acceptance to ensure products and services are acceptable for their intended uses. The specifications for the finished device cannot be met unless the individual parts of the finished device meet specifications. The most efficient and least costly approach is to ensure that only acceptable products and services are received. This means that only suppliers, contractors, and consultants that meet specifications should be used. The regulation has been written to allow more flexibility in the way manufacturers may ensure the acceptability of products and services. Under the requirements, manufacturers must clearly define in the procedures the type and extent of control they intend to apply to products and services. Thus, a finished device manufacturer may choose to provide greater in-house controls to ensure that products and services meet requirements, or may require the supplier to adopt measures necessary to ensure acceptability, as appropriate. FDA generally believes that an appropriate mix of supplier and manufacturer quality controls are necessary. However, finished device manufacturers who conduct product quality control solely in-house must also assess the capability of suppliers to provide acceptable product. Where audits are not practical, this may be done through, among other means, reviewing historical data, monitoring and trending, and inspection and testing. After evaluation of all of the comments on Sec. 820.50, FDA has decided to change the wording of Sec. 820.50(a) and adopt the wording of ISO 9001:1994 to make clear that manufacturers have flexibility in determining the degree of assessment and evaluation necessary for suppliers, contractors, and consultants. Thus the degree of supplier control necessary to establish compliance may vary with the type and significance of the product or service purchased and the impact of that product or service on the quality of the finished device. In addition, the requirement for manufacturers to establish assessment criteria has been deleted but the evaluation still must include a description how the assessment was made (according to what criteria or objective procedure) and the results must be documented. Each manufacturer must now define the type and extent of control it will exercise over suppliers, contractors, and consultants. This is consistent with the 1994 version of ISO 9001. Thus, FDA believes that the flexibility of the regulation will allow manufacturers to implement JIT procedures without additional cost. In fact, the new regulation is more conducive to JIT practices by permitting the assessment or evaluation of product or services up front, thereby lessening the degree of in-house control that may be necessary. 100. Several comments said that it was unclear what FDA meant by the phrase ``or held by other persons under contract conform to specifications'' and that this phrase should be deleted. FDA agrees with the comments and has deleted the phrase. The phrase was intended to mean product and services which were purchased or processed in some manner by other organizations. Section 820.50 now applies to ``purchased or otherwise received product and services'' to convey this meaning. FDA emphasizes that the requirements apply to all product and service received from outside of the finished device manufacturer, whether payment occurs or not. Thus, a manufacturer must comply with these provisions when it receives product or services from its ``sister facility'' or some other corporate or financial affiliate. ``Otherwise received product'' would include ``customer supplied product'' as in ISO 9001:1994, section 4.7, but would not apply to ``returned product'' from the customer. 101. One comment stated that ``manufacturing materials'' should be deleted from the first sentence of the introductory text of the proposed Sec. 820.50, as the assessment of the manufacturers of manufacturing materials would be a monumental task. FDA disagrees with the comment. The first sentence of the introductory text of Sec. 820.50 is rewritten to be a general requirement that each manufacturer must establish procedures to ensure that received product and services (purchased or otherwise received) conform to specified requirements. All manufacturers are expected to apply controls to manufacturing materials appropriate to the manufacturing material, the intended use, and the effect of the manufacturing materials on safety and effectiveness. For example, the procedures necessary to ensure that a mold release agent conforms to specified requirements may be less involved than the procedures for controlling latex proteins. The provision allows the manufacturer the flexibility of establishing the procedures to meet its needs and to ensure that the product conforms to specified requirements. 102. One comment said that FDA should delete the last sentence of the introductory text of proposed Sec. 820.50 because it is unnecessary for manufacturers to develop specifications for services that are unrelated to product or process quality, and because the terms ``service'' and ``other persons'' lack definition. Other comments stated that ``all'' should be deleted in the general requirement. FDA disagrees with the comments. First, as used in the regulation, ``service'' means parts of the manufacturing or quality system that are contracted to others, for example, plating of metals, testing, and sterilizing, among others. Second, FDA believes that all suppliers of such services must be assessed and evaluated, just like a supplier of a product. As always, the degree of control necessary is related to the product or service purchased. FDA has, however, deleted the term ``provided by other persons'' because it was unnecessary. FDA did not delete the word ``all'' because, as discussed above, component manufacturers are not subject to this regulation, so it is the [Page 52625] finished device manufacturer who is responsible for ``all'' product and services. 103. One comment stated that many suppliers of components to the medical device industry have their quality systems certified to an ISO 9000 standard by an independent third party auditor, and that such registration of component manufacturers should be considered in vendor assessment plans. FDA agrees in part with the comment in that certification may play a role in evaluating suppliers, but cautions manufacturers against relying solely on certification by third parties as evidence that suppliers have the capability to provide quality products or services. FDA has found during inspections that some manufacturers who have been certified to the ISO standards have not had acceptable problem identification and corrective action programs. Therefore, the initial assessment or evaluation, depending on the type and potential effect on device quality of the product or service, should be a combination of assessment methods, to possibly include third party or product certification. However, third party certification should not be relied on exclusively in initially evaluating a supplier. If a device manufacturer has established confidence in the supplier's ability to provide acceptable products or services, certification with test data may be acceptable. 104. Some comments stated that consultants should not be included in the regulation at all. Others stated that it was not consistent with ISO 9001. FDA added ``consultants'' to Sec. 820.50(a) in response to the comments from Sec. 820.25(c). FDA disagrees that ``consultants'' should be deleted because over the years FDA has observed that a surprising number of firms hire consultants who have no particular expertise in the area in which the firm is seeking assistance. Section 820.50 addresses this problem by ensuring that a consultant's capability for the specific tasks for which he or she is retained be assessed and documented. Further, FDA does not believe this requirement is inconsistent with ISO 9001:1994 because ISO uses the term ``subcontractor.'' The term ``subcontractor'' includes consultants. 105. One comment said that requiring evaluation of potential suppliers, contractors, and consultants ``on the basis of their ability to meet requirements'' is vague and should be clearly defined. FDA disagrees that the phrase is vague. Suppliers, contractors, and consultants selected by manufacturers of medical devices should have a demonstrated capability of providing products and services that meet the requirements established by the finished device manufacturer. The capability of the product or service suppliers should be reviewed at intervals consistent with the significance of the product or service provided and the review should demonstrate conformance to specified requirements. 106. One comment questioned the usefulness of Sec. 820.50, given that the requirements under Sec. 820.80 Receiving, in-process, and finished device acceptance, require manufacturers to establish and maintain procedures for acceptance of incoming components. The intent of Sec. 820.50 is to ensure that device manufacturers select only those suppliers, contractors, and consultants who have the capability to provide quality product and services. As with finished devices, quality cannot be inspected or tested into products or services. Rather, the quality of a product or service is established during the design of that product or service, and achieved through proper control of the manufacture of that product or the performance of that service. Section 820.50 thus mandates that products be manufactured and services be performed under appropriate quality assurance procedures. Finished device manufacturers are required under Sec. 820.50 to establish the requirements for, and document the capability of, suppliers, contractors, and consultants to provide quality products and services. Section 820.80 is specific to a device manufacturer's acceptance program. While finished device manufacturers are required to assess the capability of suppliers, contractors, and consultants to provide quality products and services, inspections and tests, and other verification tools, are also an important part of ensuring that components and finished devices conform to approved specifications. The extent of incoming acceptance activities can be based, in part, on the degree to which the supplier has demonstrated a capability to provide quality products or services. An appropriate product and services quality assurance program includes a combination of assessment techniques, including inspection and test. 107. Several comments stated that it was not clear how a manufacturer could evaluate an off-the-shelf component that is purchased from a distributor rather than directly from its manufacturer, and stated that it would not be helpful to audit the distributor. FDA agrees that auditing a distributor would not meet the intent of Sec. 820.50. Manufacturers should remember that the purpose of assessing the capability of suppliers is to provide quality products and to provide a greater degree of assurance, beyond that provided by receiving inspection and test, that the products received meet the finished device manufacturer's requirements. The agency recognizes that finished device manufacturers may not always be able to audit the supplier of a product. In such cases, the manufacturer must apply other effective means to assure that products are acceptable for use. 108. Many comments from both domestic and foreign firms in response to proposed Sec. 820.22(b) said that making supplier audit reports subject to FDA review would have a major adverse impact on the relationships between the finished device manufacturers and their suppliers and service providers. Some stated that the requirement would cause suppliers to refuse to sell components to medical device manufacturers, especially suppliers who provide only a small part of their production to device manufacturers. Others said that this policy is not consistent with FDA's policy for internal audits. FDA recognizes that quality audits of suppliers have a significant and demonstrated value as a management tool for corrective action, quality improvement, and overall assurance of component and service quality, and does not seek to undermine their value. Therefore, based on the concerns raised by the comments, FDA will not review supplier audit reports during a routine FDA inspection for compliance with part 820, as noted in Sec. 820.180(c), ``Exceptions.'' The audit procedures, the evaluation procedures, and documents other than the supplier audit reports themselves that demonstrate conformance with Sec. 820.50 will be subject to review by an FDA investigator. 109. One comment stated that it was unclear what is meant by the requirement to specify ``quality requirements'' that must be met by suppliers, contractors, and consultants, as stated in Sec. 820.50(a). The term ``quality requirements'' means the quality control and quality assurance procedures, standards, and other requirements necessary to assure that the product or service is adequate for its intended use. FDA does not believe the term is unclear. 110. Several comments on proposed Sec. 820.50(b), ``Purchasing forms,'' suggested that the term ``forms'' be replaced by ``data.'' Other comments stated that use of the term would not allow electronic data exchange. One comment stated that the use of an [Page 52626] exclusive form for purchasing is unnecessary and redundant, and that it is unduly burdensome to require detailed documentation on those commonly available items such as fasteners. The comment stated that it is common practice to use prints or drawings to fulfill the purpose of the form. FDA agrees in part with the comments, but does not believe that Sec. 820.50(b) prohibits the use of drawings or prints, assuming that the documents contain data clearly describing the product or service ordered, and that the specified requirements are met. However, Sec. 820.50(b) has been rewritten and now requires manufacturers to establish purchasing ``data.'' This provides manufacturers with the flexibility to use both written and electronic means to establish purchasing information. 111. One comment stated that the inclusion of an additional provision mandating that suppliers notify manufacturers of any change in their product or service places an undue burden on suppliers and inhibits their ability to make minor adjustments within the parameters of agreed upon specifications and quality requirements. Many other comments stated that the requirement in Sec. 820.50(b) is feasible only for components that are custom made for the manufacturer, and is meaningless for off-the-shelf components purchased from distributors. Other comments stated that the requirement is part of the original CGMP regulation and experience has shown that suppliers are not willing to supply device manufacturers with such information. A few other comments stated that ``any'' should be deleted because the term is too broad and could result in burdensome reporting of variables which are irrelevant to the continued performance or specifications of the product or service. FDA agrees in part with the comments and has amended the requirement to state that such agreement should be obtained ``where possible.'' FDA still believes that this change information is very important to the manufacturer, and that the manufacturer should obtain information on changes to the product or service. Where a supplier refuses to agree to provide such notification, depending on the product or service being purchased, it may render him an unacceptable supplier. However, where the product is in short supply and must be purchased, the manufacturer will need to heighten control in other ways. FDA has also deleted the term ``any'' to give manufacturers the flexibility to define in the agreement the types of changes that would require notification. 112. One comment stated that Sec. 820.50(b) should incorporate a provision that would allow manufacturers to cite published standards in purchasing forms as one suitable method for specifying purchased item quality requirements. FDA believes the addition is unnecessary, because the regulation permits manufacturers to clearly describe or reference requirements. A reference could be to a standard. 113. One comment stated that it is unclear whether the requirement for a signature to approve purchasing documents pertains to approval of the form used for purchasing or approval of the individual purchasing transaction. The comment also stated that a signature approval by transaction is not practical for firms using electronic document transmittals. FDA has rewritten the requirement to be more clear. The requirement is for approval of purchasing data or information on the purchasing document used to purchase a product or service. Thus, each manufacturer must review and approve the purchasing data before release of the data. Approval of each purchasing transaction is not required. FDA addressed the use of electronic signatures in response to another comment, and notes that FDA is in the process of developing an agency-wide policy on the use of electronic signatures. 114. One comment stated that purchasing is carried out verbally in many small firms, without the use of component-specific purchasing forms, and that the regulation should be revised to allow such verbal purchasing to continue. FDA disagrees with the comment. About 15 percent of the recalls each year are due to unacceptable purchased products. Many of these products are unacceptable because the finished device manufacturer did not properly describe the product. The requirements for purchased products and services must be documented to ensure that the supplier, contractor, and consultant provide a product or service which conforms to specified requirements. This requirement, and the goal it seeks to achieve, are applicable to both small and large companies. 115. One comment stated that the requirement that purchasing forms spell out the specifications for manufacturing materials in all cases is excessive, and that the need for specifications should be based on the criticality of and risk associated with the use of the specific manufacturing material. FDA agrees that the specifications for many manufacturing materials may be so well established that the trade name of the product may be sufficient to describe the material needed. For other materials, specific written specifications may be necessary to ensure that the desired materials are received. The extent of the specification detail necessary to ensure that the product or service purchased meets requirements will be related to the nature of the product or service purchased, taking into account the effect the product or service may have on the safety or effectiveness of the finished device, among other factors. The term ``specification'' has been replaced with the term ``specified requirements'' to better reflect the intent of the requirement. 116. FDA has deleted the last two sentences of Sec. 820.50(b) in the Working Draft and has replaced them with a reference to Sec. 820.40, the general document control provision. This does not change the requirement but simply eliminates any confusion about the reviews and approvals being duplicative. F. Identification and Traceability (Subpart F) i. Identification (Sec. 820.60) 117. A few comments on proposed Secs. 820.60 Identification and traceability and 820.65 Critical device, traceability stated that the two sections should be rewritten to delete the distinction between critical and noncritical devices. Some stated they should be consistent with ISO. FDA agrees in part with the comments and has rewritten Sec. 820.60 to be consistent with ISO 9001:1994 and broad enough to allow the manufacturer the flexibility needed to identify product by whatever means described by the required procedure. The term ``critical device'' has also been deleted, and traceability is addressed solely in Sec. 820.65. 118. One comment stated that manufacturing materials should be deleted from Sec. 820.60, as the requirements are excessive and not economically justifiable with regard to such materials. FDA disagrees with the comment. The purpose of Sec. 820.60 is to ensure that all products, including manufacturing materials used in the manufacture of a finished device, are properly identified. This requirement is intended to help prevent inadvertent use or release of unacceptable product into manufacturing. It is as important that the proper manufacturing materials be [Page 52627] used as it is that the proper component be used. 119. A few comments thought that Sec. 820.60 Identification in the Working Draft was redundant with Sec. 820.86 Acceptance status. FDA disagrees with the comments. Section 820.60 only requires that product be identified but says nothing about the acceptance status of that product. Section 820.86 requires that the acceptance status be identified so that inadvertent use of product does not occur. The manufacturer may choose to set up a system by which the identification required by Sec. 820.60 can also show the acceptance status required by Sec. 820.86, but this is up to the manufacturer. ii. Traceability (Sec. 820.65) 120. A few comments stated that proposed Sec. 820.65 Critical devices, traceability implies that traceability requirements exist for all devices. Several other written comments and oral testimony at the August and September 1995 meetings stated that the wording of the Working Draft was too broad, vague, and ambiguous, and in effect would require that all devices be traced. As noted above, FDA has deleted the critical device terminology. Section 820.65 is now entitled Traceability and uses the definition from the original CGMP of a critical device to provide the necessary clarity and delineation for this requirement. Thus, traceability is required for the critical devices listed in the Federal Register notice of March 17, 1988 (53 FR 8854). However, FDA is using the definition of critical device in the requirement of Sec. 820.65, rather than a reference to the 1988 list of critical devices, because that list has not been updated since 1988 and there are no plans to revise that list. Therefore, it is imperative that manufacturers use the definition within the requirement of Sec. 820.65 to determine if a particular device needs to be traced; it may not be sufficient to rely solely on the 1988 list. Manufacturers may find it advantageous to provide unit, lot, or batch traceability for devices for which traceability is not a requirement to facilitate control and limit the number of devices that may need to be recalled due to defects or violations of the act. It is important that the traceability requirements in part 820 are not confused with the Medical Device Tracking regulation in part 821 (21 CFR part 821). The tracking regulation is intended to ensure that tracked devices can be traced from the device manufacturing facility to the person for whom the device is indicated, that is, the patient. Effective tracking of devices from the manufacturing facility, through the distribution network (including distributors, retailers, rental firms and other commercial enterprises, device user facilities, and licensed practitioners) and, ultimately, to any person for whom the device is intended is necessary for the effectiveness of remedies prescribed by the act, such as patient notification (section 518(a) of the act (21 U.S.C. 360h(a)) or device recall (section 518(e).) In contrast, the traceability provision requires that a device that meets the definition of a ``critical device'' can be traced from the manufacturing facility only to the ``initial consignee'' as discussed in Sec. 820.160 Distribution. 121. Another comment on proposed Sec. 820.65 stated that critical device component traceability could be interpreted to be required for almost all electronic components and other components in a critical device. The comment stated that the extent of component traceability should be left to the manufacturer's discretion, since it is an economic risk decision. Several comments stated that component traceability should only be required ``where appropriate,'' that all ``critical device'' components do not require traceability to comply with the act. FDA disagrees that the traceability determination should be based solely on economic risk. As noted in the preamble to the November 23, 1993, proposal (58 FR 61964), where traceability is important to prevent the distribution of devices that could seriously injure the user, traceability of components must be maintained so that potential and actual problem components can be traced back to the supplier. The revised requirement mandates traceability of components ``where appropriate'' as recommended by the GMP Advisory Committee and limited by the discussion in the scope, Sec. 820.1(a)(3). The critical component definition in the original CGMP regulation may be used as guidance. However, to carry out the requirement of the revised provision, the manufacturer should perform risk analysis first on the finished device, and subsequently on the components of such device, to determine the need for traceability. FDA believes that the extent of traceability for both active and inactive implantable devices should include all components and materials used when such products could cause the medical device not to satisfy its specified requirements. ISO/CD 13485 also requires that the manufacturer's agents or distributors maintain records of distribution of medical devices with regard to traceability and that such records be available for inspection. This requirement is found in Sec. 820.160 Distribution of this regulation and is consistent with the requirements in Sec. 820.151 of the original CGMP. While FDA understands that traceability entails additional cost, the agency notes that, if a product recall is necessary, more devices would be subject to recall if units, lots, or batches of specific devices are not traceable, with associated higher recall costs to the manufacturer. G. Production and Process Controls (Subpart G) i. Production and Process Controls (Sec. 820.70) 122. A few comments stated that the requirements in proposed Sec. 820.70(a) General are similar to those in ISO 9001, but that ISO 9001 makes clear that the requirements apply only ``where applicable'' and where deviations from device specifications would ``directly affect quality.'' The comments suggested that FDA similarly employ such language to avoid being too restrictive and overly burdensome. The requirements in Sec. 820.70(a) are intended to ensure that each manufacturer produces devices that conform to their specifications. Thus, where any deviations from specifications could occur during manufacturing, the process control procedures must describe those controls necessary to ensure conformance. Those controls listed in the regulation may not always be relevant; similarly others may be necessary. For example, where deviations from device specifications could occur as a result of the absence of written production methods, procedures, and workmanship criteria, such production controls are required. Thus, FDA has retained the provision, but revised it slightly to conform with the original CGMP requirements in Sec. 820.100(b)(1). As noted, the process control requirements apply when any deviation from specifications could occur. FDA believes that such deviations must be controlled, and that linking the requirements to deviations that directly affect quality is inappropriate and subjective, and that it could lead to the manufacture of potentially dangerous devices through the lack of control of processes known to directly affect a device's specifications. Therefore, the provision has not been restricted in this manner. FDA has, however, revised the requirements to state ``Where process controls are needed they shall include:'' to make it clear that a manufacturer only has to comply with the requirements [Page 52628] stated in Sec. 820.70 (a)(1) through (a)(5) if the general criteria described in Sec. 820.70(a) have been met. 123. One comment stated that the second sentence of proposed Sec. 820.70(a) was too restrictive, in that some processes can be accomplished by adequately trained personnel without the use of procedures. FDA disagrees with the comment because the establishment of procedures is necessary to ensure consistency in manufacture. The procedures may be tailored under the requirement to cover only those controls necessary to ensure that a device meets its specifications. FDA notes that the deletion of the word ``all'' does not alter the requirements. The first sentence in the general requirement also serves to tie the production and process controls to the design and development phase where many of these controls are originally established in order for the device to conform to its design specifications. In addition to these changes, FDA has added the requirement that production processes be ``monitored'' because a manufacturer must monitor a controlled process to ensure that the process remains in control. 124. FDA deleted the requirement for process controls related to ``installation and servicing'' from proposed Sec. 820.70 (a)(1) and (a)(2) in response to comments. Such control is adequately assured by the requirements in Secs. 820.170 Installation and 820.200 Servicing. FDA amended Sec. 820.70(a)(3) in response to some comments that were confused about compliance with ``applied reference standards.'' The term ``applied'' was replaced with ``specified'' to make it clear that the manufacturer must comply with reference standards or codes which he or she has specified in the DMR. FDA has also deleted ``and process control procedures'' because that requirement is inherent in Sec. 820.70(a), ``General.'' FDA amended Sec. 820.70(a)(5) by adding ``identified and approved'' in response to comments and to clarify that the ``representative samples'' have to be identified and deemed appropriate before they are used as reference standards. 125. One comment believed that there is no longer a requirement that process changes be validated. Other comments on the Working Draft Sec. 820.70(b) stated the requirement was still confusing with respect to ``unless inspection and test fully verifies,'' and when the ``approval'' was to occur. Revised Sec. 820.70(b), ``Production and process changes,'' addresses the requirement for production and process changes to be ``verified or where appropriate validated according to Sec. 820.75.'' This requirement for validation was moved from Sec. 820.40(c), in revised form, to Sec. 820.70. Verification was added to give the manufacturer the flexibility to verify changes that can be tested and inspected because FDA believes that validation is not always necessary. FDA has provided guidance on when changes should be validated in its ``Guideline on General Principles of Process Validation.'' The agency notes that wherever changes may influence a validated process, the process must be revalidated as described in Sec. 820.75. A few examples of processes that must be validated include sterilization, molding, and welding. FDA has deleted the last part in Sec. 820.70(b) of the Working Draft about approving changes and has replaced it with ``Changes shall be approved in accordance with Sec. 820.40.'' This does not change the requirement but simply refers back to Sec. 820.40 because this requires the same review and approval. This was done to eliminate any confusion about the reviews and approvals being duplicative. 126. The EU Commission and others stated that environmental conditions only affect the quality of certain devices and that the requirements should, therefore, be limited in their application. Other comments stated that the requirements in proposed Sec. 820.70(b), ``Environmental control,'' were not consistent with the requirements in the original CGMP, Sec. 820.46. Another comment requested that FDA delete the reference to ``facilities'' inspection and limit the requirement to review of the control system, as contained in the original CGMP regulation. FDA has amended the requirements now in Sec. 820.70(c) to apply only where environmental conditions could ``reasonably be expected to have an adverse effect on product quality.'' The requirements for procedures to ensure control of conditions, periodic inspection of control systems, and documentation and review of results are similar to the original CGMP requirements. However, the specific list of conditions to be considered for control, which was carried over from the original CGMP regulation to the proposal, was deleted in response to a comment from the GHTF that the list would be better suited for a guidance document. FDA agrees that it is not necessary to give examples of conditions that may need controlling in a regulation, and notes that lighting, ventilation, temperature, humidity, air pressure, filtration, airborne contamination, and static electricity are among many conditions that should be considered for control. FDA reworded the requirement to make it clear that the inspection must be of the control system. FDA also added that the inspection of the control system(s) shall include ``any necessary equipment,'' e.g., pumps, filters, measurement equipment, etc. The sufficiency of facilities is covered in a new Sec. 820.70(f), ``Buildings,'' that requires that buildings be of suitable design and contain sufficient space to allow for the proper manufacture of devices. Section 820.70(f) is worded similarly to the original CGMP regulation Sec. 820.40, and is intended to achieve the same objectives as that section. 127. One comment stated that the last sentence of proposed Sec. 820.70(b), ``Environmental control,'' should be deleted because it is redundant with the audits required in Sec. 820.22(a). Another comment said that environmental conditions are currently reviewed via internal audit, which an FDA investigator cannot review. FDA disagrees with the comments. The inspection and review of environmental control systems are routine quality assurance functions that are part of the production quality assurance program. The audits required by Sec. 820.22(a) are audits of the quality system, conducted to ensure the adequacy of and conformance with the quality system requirements. The requirement to conduct a quality audit is in addition to other provisions in the regulation which require that a manufacturer review its specific controls to ensure the requirements are met. FDA may review the activities and results of environmental control system inspections. 128. The GHTF commented that the requirements of proposed Sec. 820.70(c), ``Cleaning and sanitation,'' should be placed in guidance. After careful consideration, FDA agrees that a separate section on cleaning and sanitation is unnecessary. The objective of proposed Sec. 820.70(c) is adequately met through the requirement of Sec. 820.70(e), ``Contamination control,'' and Sec. 820.70(a), the general process control procedure requirement. Contamination control must include establishing and maintaining adequate cleaning procedures and schedules, if such control is necessary to meet manufacturing process specifications. In addition, Sec. 820.25 Personnel requires that employees have a thorough understanding of their job functions, which would include a requirement that the appropriate employees comprehend [Page 52629] the cleanliness and sanitation procedures. 129. The GHTF and others commented that the requirements of proposed Sec. 820.70 (d)(1) through (d)(3) should be deleted and placed in guidance because they are redundant with the first sentence in proposed Sec. 820.70(d), ``Personnel health and cleanliness.'' FDA agrees with the comments and has deleted Sec. 820.70 (d)(1) through (d)(3). FDA has also rewritten the section, now entitled ``Personnel,'' to require procedures to achieve the desired result, rather than dictate the means to achieve the result. The section as rewritten provides the manufacturer with more flexibility and is consistent with ISO/CD 13485. Under this section, a manufacturer's requirements must not permit unclean or inappropriately clothed employees, or employees with medical conditions, to work with devices where such conditions could reasonably be expected to have an adverse effect on product quality. The procedures must also address acceptable clothing, hygiene, and personal practices, if contact between personnel and product or environment could reasonably be expected to have an adverse effect on product quality. FDA also added the requirement, from ISO/CD 13485, that personnel who are working temporarily (such as maintenance and cleaning personnel) under special environmental conditions (such as a clean room) be appropriately trained or supervised by someone trained to work in such an environment. 130. One comment stated that the requirements of Sec. 820.70(e), ``Contamination control,'' should be deleted and placed in guidance. Another comment stated that the reference to manufacturing materials should be deleted because it is redundant with Sec. 820.70(g), ``Equipment.'' FDA has rewritten the section to delete the specific references to contaminants that probably gave rise to the suggestion that the section would be more appropriate as guidance. The section now contains a broad requirement for the establishment of procedures to prevent contamination of equipment or product by any substance that could reasonably be expected to have an adverse effect on product quality. Again, this revision adds flexibility. FDA disagrees with the comment that manufacturing materials should be deleted from this section. Section 820.70(e) requires procedures to ensure that manufacturing materials do not become contaminated. Section 820.70(g), in contrast, establishes requirements related solely to the equipment used in the manufacturing process, and Sec. 820.70(h), ``Manufacturing material,'' addresses requirements for the removal or limitation of manufacturing materials. Thus, Sec. 820.70 (g) and (h) are distinct and are intended to achieve different objectives. 131. The only two comments received on proposed Sec. 820.70(f), ``Sewage and refuse disposal,'' recommended that it be deleted because it was unnecessary and/or covered by other Federal regulations. Section 820.70(f) has been deleted because the requirements are adequately covered in the current requirements under Sec. 820.70(e), ``Contamination control,'' and Sec. 820.70(c), ``Environmental control.'' Under these sections, sewage, trash, byproducts, chemical effluvium, and other refuse that could affect a device's safety, effectiveness, or fitness-for-use must be adequately controlled. 132. Two comments stated that the requirement related to equipment in Sec. 820.70(g) should ensure that equipment meets ``specified requirements,'' not be ``adequate for its intended use,'' because intended use is determined during the design phase, and because it is easier to assess whether equipment meets specified requirements. From these comments, FDA can see that the requirement should be revised because it may have been misinterpreted. The requirement is reworded as suggested. Under the requirement, the equipment must be appropriately designed to facilitate maintenance, adjustment, cleaning, and use. It must also meet the requirements that are necessary to ensure its proper functioning for the manufacture of the device. 133. A few comments stated that not all equipment requires maintenance, and the requirement for a maintenance schedule in Sec. 820.70(g)(1) should be revised to make that clear. The GHTF recommended that the second sentence of proposed Sec. 820.70(g)(1), which required that the maintenance schedule be posted or readily available, be deleted and placed in guidance. FDA agrees that not all equipment may require maintenance and notes that the general requirement of Sec. 820.70(a) requires process control procedures that describe only those controls which are necessary. Therefore, FDA did not revise the requirement. FDA has deleted the requirement that the maintenance schedule be posted or readily available. Section 820.70(g), which directs a manufacturer to ensure that equipment meets specified requirements, requires that the manufacturer ensure that maintenance is carried out on schedule to comply with the requirement. To satisfactorily meet this requirement, FDA expects that the schedule will be posted on or near the equipment to be maintained, or otherwise made readily available to appropriate personnel. Deletion of the requirement, however, permits the manufacturer added flexibility in complying with this section. 134. Several comments stated that Sec. 820.70(g)(2), ``Inspection,'' and (g)(3), ``Adjustment,'' should be deleted and placed in guidance because the requirements are adequately covered in Sec. 820.70(g)(1). Another comment stated that the requirement for limitations or tolerances to be ``visibly posted on or near equipment'' should be deleted. FDA believes that to adequately ensure that equipment continues to meet its specifications, and to ensure that inherent limitations and allowable tolerances are known, these requirements are imperative. FDA notes inherent limitations and allowable tolerances must be visibly posted on or near equipment or made readily available to personnel to allow the manufacturer the flexibility to utilize any system to make sure that the limitations or tolerances are readily available to the personnel that need them. Both Sec. 820.70(g)(2) and (g)(3) are requirements in the original CGMP regulation and the agency has found them to be useful and necessary. 135. One comment stated that requiring the removal of manufacturing material to be documented in proposed Sec. 820.70(g)(4), ``Manufacturing material,'' would result in impossible requirements, such as the requirement to document how much cutting oil is lost during a metal removing operation, such as drilling. Others commented that the requirement needs to be amended to clarify that only manufacturing materials that have an adverse effect or that are unwanted need to be removed or limited. FDA disagrees with the first comment because Sec. 820.70(g)(4) (now Sec. 820.70(h)) only requires that the fact that manufacturing material was removed or reduced be documented, not how much was removed or how much was lost due to processing. This requirement is carried over from the original CGMP regulation, Sec. 820.60(d). FDA has amended the section, however, to clarify that this requirement is necessary ``Where a manufacturing material could reasonably be expected to have an adverse effect on product quality.'' FDA [Page 52630] purposefully qualifies the general requirement by that which adversely affects ``product quality'' (product as defined in Sec. 820.3(r)) and limits the requirement for removal or reduction to ``an amount that does not adversely affect the device's quality.'' 136. One comment on Sec. 820.70(h), ``Automated processes,'' (now Sec. 820.70(i)), stated that the section should be revised to reflect that software used in such systems must be validated for ``its intended use,'' not simply validated. Another comment stated that most companies buy software currently available on the market and do not make changes to the software. It was recommended that Sec. 820.70(h) allow for use of outside personnel for validation runs and not necessarily require the development of a software validation procedure. One comment suggested that the section should allow verification rather than validation of off-the-shelf software. Several comments on ``automated processes'' stated that the term ``data processing systems'' was unclear and its inclusion rendered the requirement too broad. Others asked for clarification of ``automated data processing systems.'' FDA has modified the requirement to mandate validation for the intended use of the software. In addition, the requirement that the software be validated by individuals designated by the manufacturer has also been deleted to make clear that validation may be performed by those other than the manufacturer. However, whether the manufacturer designates its own personnel or relies on outside assistance to validate software, there must be an established procedure to ensure validation is carried out properly. FDA has maintained the requirement for validation because the agency believes that it is necessary that software be validated to the extent possible to adequately ensure performance. Where source code and design specifications cannot be obtained, ``black box testing'' must be performed to confirm that the software meets the user's needs and its intended uses. FDA emphasizes that manufacturers are responsible for the adequacy of the software used in their devices, and activities used to produce devices. When manufacturers purchase ``off-the- shelf'' software, they must ensure that it will perform as intended in its chosen application. FDA has amended the requirement to state ``When computers or automated data processing systems are used as part of production or the quality system,'' for clarification. Software used in production or the quality system, whether it be in the designing, manufacturing, distributing, or tracing, must be validated. ii. Inspection, Measuring, and Test Equipment (Sec. 820.72) 137. A few comments stated that it is unclear what is meant by the requirement in proposed Sec. 820.84 Inspection, measuring, and test equipment that equipment be capable of producing ``valid results.'' The comments stated that such equipment may be ``suitable for its intended purpose'' and still not always ``produce valid results.'' FDA believes that the term ``valid results'' is commonly understood and notes that it has been in the original CGMP regulation under Sec. 820.61 for 18 years. The requirement is for the equipment to work properly, thereby providing ``valid results.'' FDA renumbered Sec. 820.84 as Sec. 820.72 in response to comments that stated these requirements were more appropriate under subpart G Production and Process Controls. FDA revised the requirement in new Sec. 820.72(a), ``Control of inspection, measuring, and test equipment,'' to make clear that the procedures must also ensure that the equipment is maintained and moved the requirement that the procedure include provisions for handling, preservation and storage of equipment from Sec. 820.84(d) in the Working Draft to Sec. 820.72(a). FDA deleted the term ``test software'' that was in Sec. 820.84(e) because FDA believes that ``test software'' is now covered under ``electronic inspection and test equipment'' in Sec. 820.72(a). 138. A few comments stated that the last sentence in proposed Sec. 820.84(a), ``Calibration,'' is unnecessary because the requirement for trained personnel is redundant with Sec. 820.25(a) Personnel. A few comments stated that FDA should identify what must be remedied in proposed Sec. 820.84(a). FDA agrees that the requirement for trained personnel is redundant and has deleted this sentence from Sec. 820.72(b), ``Calibration.'' FDA has also added to this section the requirement that the calibration procedure include provisions for remedial action to ``reestablish the limits and to evaluate whether there was any adverse effect on the device's quality'' to clarify this remedial action requirement and its relationship to the requirements in Sec. 820.100 Corrective and preventive action. 139. Several comments stated that Sec. 820.84(b), ``Calibration standards,'' should allow for the use of international standards. FDA agrees and has rewritten the section, now Sec. 820.72(b)(1), ``Calibration standards,'' to allow the use of international standards. The standards used must be generally accepted by qualified experts as the prevailing standards. 140. FDA has deleted the requirement in proposed Sec. 820.84(c), now Sec. 820.72(b)(2), ``Calibration records,'' that calibration records be ``maintained by individuals designated by the manufacturer'' because, on further reflection, the agency believes such a requirement is unnecessary. As long as the required procedures and records are maintained and displayed or readily available as required, the objective of the section, ensuring that calibration is performed and acceptable, will be met. FDA did add ``equipment identification'' to the list of items that had to be documented in response to a comment that requested clarification in this regard, so that equipment is clearly identified in the calibration records even if the records are not displayed on or near the particular piece of equipment. 141. Two comments suggested deleting proposed Sec. 820.84(d) because they believed it was unnecessary to establish procedures to maintain equipment, because most manufacturers simply store equipment in protective covers. As already noted, FDA has moved the requirement for establishing maintenance procedures into the general requirement in Sec. 820.72. FDA has retained the requirement because some equipment requires special handling, preservation, and storage. For example, the temperature and humidity of a room may affect the equipment and procedures would need to be established taking those factors into account. 142. Several comments stated that proposed Sec. 820.84(e), ``Facilities,'' should be deleted because it is redundant with the requirements under Sec. 820.70(g) and the general requirements of proposed Sec. 820.84(a). FDA agrees that revised Sec. 820.84(a), which is now Sec. 820.72(a), would require procedures to ensure that equipment is protected from adjustments that could invalidate the calibration, in that the section requires procedures to ensure that equipment is properly maintained. The procedures that require equipment to be routinely calibrated, inspected, and checked, will also ensure that improperly calibrated equipment is not used. Therefore, FDA has deleted proposed Sec. 820.84(e). [Page 52631] iii. Process Validation (Sec. 820.75) 143. A few comments on proposed Sec. 820.75 Special processes stated that the meaning of the term ``special processes'' was unclear. Other comments stated that FDA should provide examples of processes that would be considered ``special processes.'' Several comments stated the term ``fully verified'' was unclear and should be deleted. In response to the comments, the term ``special processes'' has been dropped from the regulation and the term ``process validation'' is defined in Sec. 820.3(z)(1). The section now requires that when a process ``cannot be fully verified by subsequent inspection and test, the process shall be validated with a high degree of assurance. * * *'' Examples of such processes include sterilization, aseptic processing, injection molding, and welding, among others. The validation method must ensure that predetermined specifications are consistently met. The new Sec. 820.75, entitled ``Process validation,'' is consistent with ISO 9001:1994, section 4.9, including the terminology ``fully verified.'' FDA does not believe this terminology is unclear since it has been used in ISO 9001:1987 and 1994 and explained in several guidance documents. FDA amended this section by removing the requirement for the signature of the individual(s) performing the process and placing the signature requirement on the approval of the validation where FDA believes it is more important and appropriate. FDA also added that ``where appropriate, the major equipment validated'' must be documented. Depending on the process that is validated, it may be necessary to document the person performing the process or the equipment or both in order to have adequate controls on the process. 144. Several comments were received on proposed Sec. 820.75(a)(1) through (a)(4) that stated that the requirements were redundant with other parts of the regulation and should be modified or deleted. FDA disagrees with the comments and believes that, due to the importance of process validation and correct performance of the validated process, the requirements are necessary. The requirements have been rearranged in the revised section. 145. Comments on the first sentence of proposed Sec. 820.75(b) stated that it was unclear and unrealistic. Other comments stated that the requirement for continuous monitoring is not practical or necessary. In response to the comments, FDA has revised the requirements. Section 820.75(b) applies to the performance of a process after the process has been validated. In contrast, Sec. 820.75(a) relates to the initial validation of the process. FDA deleted the term ``continuous'' because the agency concurs that monitoring can be accomplished at a determined interval and frequency depending on the type of validated process being monitored and controlled. FDA notes that the interval and frequency should be periodically evaluated for adequacy, especially during any evaluation or revalidation that occurs in accordance with the requirements in new Sec. 820.75(c). New Sec. 820.75(b)(1), which was proposed Sec. 820.75(c) of the Working Draft, requires that validated processes be performed by a qualified individual(s). FDA notes that Sec. 820.75(b)(1) is similar to the requirements under Sec. 820.25 Personnel but emphasizes that validated processes must not only be performed by personnel with the necessary education, background, training, and experience for their general jobs but must be performed by personnel qualified for those particular functions. Revised Sec. 820.75(b)(2), which was proposed Sec. 820.75(d) of the Working Draft, contains the amended documentation requirements for validated processes, to include the monitoring and control methods and data. FDA notes that it is always ``appropriate'' to document the equipment used in the process where the manufacturer uses different equipment on different manufacturing lines. To investigate a problem with the device, the manufacturer will need to know which equipment was used, since the problem could be with the equipment itself. The same holds true for the individual(s) performing the process. Section 820.75(c) contains requirements on process revalidation in response to several comments and concerns on when revalidation activities were necessary. FDA believes that the new arrangement of Sec. 820.75 should clarify the requirement. H. Acceptance Activities (Subpart H) i. Receiving, In-Process, and Finished Device Acceptance (Sec. 820.80) 146. One comment stated that the emphasis on testing and inspection in proposed Sec. 820.80 completely ignores the quality goals, the benefit of requiring purchasing controls, and statements made in the preamble of the proposal reflecting FDA's negative opinion about manufacturers relying solely on testing and inspection. A few comments on the Working Draft stated that ``acceptance activities'' should be defined as inspections, tests, or other verification activities so that the regulation does not require all of these activities but gives the manufacturer the flexibility to choose the appropriate method. FDA agrees with the comments and has replaced the term ``inspection and test'' with ``acceptance activities'' in Sec. 820.80. Further, FDA now defines ``acceptance activities'' to include inspections, test, or other verification activities, such as supplier audits. 147. One comment stated that recordkeeping is a significant cost factor in the operation of a total quality system, and that the revised CGMP regulation should not add cost through duplication of documentation. The comment said recording all quantitative data is inappropriate and of little value. FDA agrees that unnecessary duplication of documentation should be avoided. FDA believes that the quality system regulation requires the minimum documentation necessary to ensure that safe and effective devices are designed and produced. FDA similarly believes that maintaining records of results of acceptance activities is imperative to ensure that nonconforming product is not inadvertently used or distributed. FDA has, however, deleted from Sec. 820.80(a) the requirement for recording the results of inspections and testing because Sec. 820.80(e) requires that the results of acceptance activities be recorded. The requirement in Sec. 820.80(a) was therefore unnecessary. Further, the regulation does not specify quantitative data but simply requires that the results be recorded. FDA believes that it is essential for the manufacturer to maintain records which provide evidence that the product has gone through the defined acceptance activities. These records must clearly show whether the product has passed or failed the acceptance activities according to the defined acceptance criteria. Where product fails to pass acceptance activities, the procedures for control of nonconforming product must be implemented, to include investigations where defined. If the acceptance records are not clear about how the product failed, then the manufacturer may end up duplicating the acceptance activities in order to perform appropriate investigations. 148. Several comments stated that proposed Sec. 820.80(b), ``Receiving inspection and testing,'' did not allow for urgent use of incoming items. The comments said that urgent use should be permitted if forward traceability is maintained so that recall and [Page 52632] replacement is possible if the material is subsequently found to be nonconforming. One comment stated that the requirements in proposed Sec. 820.80(b) were too specific and did not allow flexibility. FDA agrees in part with the comments. FDA has permitted manufacturers to use incoming items that had not yet been proven acceptable for use, provided that the manufacturer maintained control of the unapproved items and could retrieve the product that contained the unapproved items before distribution. Therefore, the requirement that product ``shall not be used or processed until * * * verified'' has been deleted from Sec. 820.80(b), now entitled ``Receiving acceptance activities.'' However, FDA emphasizes that while the product can be used in production prior to verification, it cannot be distributed prior to verification. FDA does not permit the distribution of unapproved product through an urgent use provision, because all finished devices must comply with Sec. 820.80(d), ``Final acceptance activities,'' before they are released for distribution. In addition to the changes noted above, FDA has deleted the requirement that ``individual(s) designated by the manufacturer shall accept or reject incoming'' product. FDA does not believe this requirement is necessary in Sec. 820.80(b) because Sec. 820.80(e) requires that the identification of the individual(s) conducting the acceptance activities be recorded. 149. Several comments stated that an absolute requirement under proposed Sec. 820.80(c), ``In-process inspection and testing,'' for in- process testing was inconsistent with the preamble, which stated that an appropriate mix of controls should be established. Other comments stated that in-process inspection and testing is unnecessary if the process is validated and the devices are subject to final inspection. A few comments on the Working Draft stated that the term ``held'' was too restrictive and was not consistent with the requirements and the preamble discussion for Sec. 820.80(b). FDA agrees with the comments in part, but believes that Sec. 820.80 as now written, with the inclusion of ``where appropriate,'' does not mandate in-process inspection and testing. FDA acknowledges that in- process acceptance activities may not be necessary or possible for every device, for example, medical socks. Further, the requirement states that in-process product must be controlled until the required inspection and test, or other verification activities, have been performed. This will permit manufacturers to use, under defined conditions and procedures, product that has not completed the acceptance activities described in Sec. 820.80(b) and (c). This does not means that manufacturers can ignore the requirements in Sec. 820.80(b) and (c) because these requirements must be completed in order to comply with Sec. 820.80(d), which must be satisfied before devices are released for distribution. 150. FDA received a similar comment on proposed Sec. 820.80(d), ``Final inspection and test,'' which said that the provision requires finished device inspection for all devices, without defining what inspection is expected. The comment suggested that Sec. 820.80(d) could be interpreted to require actual product inspection, which has been shown to be ineffective as a means of controlling product quality. One comment stated that signatures should not be the only approved method for identification of the individual(s) responsible for release. The comment stated that use of inspection stamps and initials should be allowed. FDA has rewritten Sec. 820.80(d) to require that manufacturers establish and maintain procedures for finished device acceptance to ensure that each production run, lot, or batch of finished devices meets specified requirements. Manufacturers have the flexibility to choose a combination of methods, including finished device inspection and test, provided such methods will accomplish the required result. FDA believes that it is important for the person responsible for release to have personally documented and dated that release. This can be accomplished through use of an inspection stamp, if the stamp is controlled as discussed above under Sec. 820.40 Document controls. Therefore, FDA has retained the requirement for a signature. 151. Several comments on proposed Sec. 820.80(e), ``Inspection and test records,'' stated that manufacturers should not be required to record the use of general equipment in inspection and test records, because this requirement would be burdensome to large manufacturers who use many common pieces of equipment. A few comments stated that the record requirements under Sec. 820.80(e) are overly prescriptive and go well beyond ISO 9001's comparable requirements. The comments stated that recordkeeping should be specified by the manufacturer in the spirit of ISO 9001, and should include only the minimum records necessary to show that finished device inspections are performed in accordance with established procedures. FDA agrees that it may not be necessary to document every piece of equipment used in acceptance activities. The requirement, renamed ``Acceptance records,'' now provides that equipment used shall be documented ``where appropriate.'' For some critical operations and testing, identification of the equipment used will be imperative for proper investigations into nonconforming product. The requirements, as revised, are similar to those in ISO 9001:1994. As discussed above, certain information must be captured on acceptance records for the records to be useful in evaluating nonconformance. Through many years of experience, FDA has determined what it believes to be a minimum requirement for these records. Section 820.80(e) reflects that determination. ii. Acceptance Status (Sec. 820.86) 152. Several comments on proposed Sec. 820.86, ``Inspection and test status,'' stated that the section was not flexible enough to allow identification of the inspection and test status of product by various means, because the requirement was for the status to be ``visible.'' One comment questioned why ``component acceptance'' was addressed separately. FDA agrees that the inspection and test status may be identified by any method that will achieve the result, which might include acceptable computerized identification, markings, etc. The section has been rewritten to reflect this intent, has been renamed ``Acceptance status,'' and is now consistent with ISO 9001:1994. FDA also agrees that ``component acceptance'' is covered by ``manufacturing'' and has deleted the term. 153. FDA has deleted proposed Sec. 820.86(b) which required that records identify those responsible for release of the product, because the agency believes that the records required by Sec. 820.80(e) will identify those responsible for release of product. I. Nonconforming Product (Subpart I) 154. FDA has rewritten Sec. 820.90 Nonconforming product to utilize the term ``product'' throughout, as defined in Sec. 820.3(r), for both shorthand purposes and consistency with ISO 9001:1994. 155. One comment suggested deleting the term ``inadvertently'' and adding the word ``distributed'' before ``installed'' in Sec. 820.90(a). Several written comments and persons who testified at the August and September 1995 meetings stated that Sec. 820.90(a) should be written so [Page 52633] that it is not interpreted to require investigations for every nonconformance. A few comments stated that the term ``provide for'' was too broad and unclear. Other comments stated that the requirement to ``ensure'' nonconforming product was ``not used or distributed'' was inconsistent with the provisions in Sec. 820.90(b) which allowed for concessions under certain circumstances. One comment stated that the requirement that persons responsible for nonconforming product be ``notified'' should be deleted because it is overly burdensome and not needed in all cases. FDA has reworded the general requirement for procedures to control nonconforming product and has deleted the term ``inadvertently.'' FDA has also added the requirement that the procedures provide for the ``evaluation'' of nonconforming product because evaluation is key to protecting against recurring nonconformance. The addition is consistent with ISO 9001:1994. FDA has further revised Sec. 820.90 in response to the comments on the Working Draft. First, the manufacturer must establish procedures to ``control'' nonconforming product. Second, the procedures shall ``address the identification, documentation, evaluation, segregation, and disposition of nonconforming product,'' which gives the manufacturers the flexibility to define how they are going to ``control'' products that are nonconforming. Third, the evaluation process addressed in the procedure ``shall include a determination of the need for an investigation.'' Therefore, the procedures will need to set forth the manufacturer's SOP on when investigations will take place and provisions for trending and/or monitoring the situation in the future. Fourth, FDA added ``The evaluation and any investigation shall be documented,'' which would include the explanations for not performing investigations and how nonconformances will be trended and/ or monitored. Further, the phrase ``is not used or distributed'' has been deleted to be consistent with Sec. 820.90(b). FDA disagrees that the notification requirement should be deleted. Where some person or organization is responsible for nonconformances, they must be notified to ensure that future nonconformances are prevented. This requirement is also in ISO 9001:1994, section 4.13.1. 156. FDA has rewritten Sec. 820.90(b)(1), ``Nonconformity review and disposition,'' to make clear that the section requires procedures that define the responsibility for review and authority for disposition of nonconforming product and that set forth the review and disposition process. FDA believes that proper disposition of nonconforming product is essential for ensuring the safety and effectiveness of devices. Manufacturers have made determinations that nonconforming product may be used which have resulted in defective devices being distributed. Thus, although it may be appropriate at times to use nonconforming products, the disposition process must be adequately controlled. The revision requires that disposition and justification for concessions be documented. FDA believes that the justification should be based on scientific evidence, which a manufacturer should be prepared to provide upon request. Concessions should be closely monitored and not become accepted practice. This section is consistent with ISO 9001:1994, section 4.13.2. Several comments on the Working Draft stated that the term ``concession'' should be deleted because it is confusing. FDA has rewritten the sentence to ensure the meaning of this requirement is clear. The sentence now reads, ``Documentation shall include the justification for the use of nonconforming product and the signature of the individual(s) authorizing the use.'' 157. Several comments were received on proposed Sec. 820.90(b)(2). One comment stated that the requirement should allow for other types of disposition besides reprocessing. One comment suggested replacing the term ``reinspection'' with ``evaluation,'' to allow for greater flexibility in verification methods. Many comments suggested that the requirement for identification of reprocessed product should be deleted because they believed it would cause the consumer to forego purchasing the product. Several comments requested that the term ``rework'' be used instead of ``reprocessing'' to harmonize terminology with ISO standards. FDA agrees in part with the comments. FDA, as noted in the definition section, has substituted the term ``rework'' and the ISO 8402:1994 definition for the term ``reprocessing'' in response to the comments. FDA believes that the revised Sec. 820.90(b)(1) clearly allows for other methods of disposition besides rework. Section 820.90(b)(2), which governs rework when it is chosen as a method of disposition, has been revised as requested by replacing the term ``reinspection'' with ``reevaluation.'' The change will allow manufacturers the flexibility to inspect or use other verification activities. FDA has also deleted the requirement for identification of reworked product from this section because FDA believes that it is adequately covered in Secs. 820.60 Identification and 820.86 Acceptance status. Other minor changes made to the section include requiring that a determination of any adverse effect of the rework upon the product be made, whether there is ``repeated'' rework or not. FDA's intent is that such a determination be made with any rework, given the potential harmful effect rework could have on the product. The change harmonizes Sec. 820.90 with ISO/CD 13485. In addition, the sentence requiring a ``complete reinspection'' for reworked product was deleted because the section already requires retesting and reevaluation of reworked product. FDA has also substituted ``current'' for ``original or subsequently modified'' approved specifications for clarity. The requirements as written are consistent with the original CGMP requirements in Secs. 820.115 and 820.116. J. Corrective and Preventive Action (Subpart J) 158. A few comments suggested revising proposed Sec. 820.100 Corrective and preventive action to require procedures for implementing corrective and preventive action, consistent with ISO 9001. One comment stated that the procedures should provide for an initial halt of distribution of suspect products or tight control and action concerning products already distributed before taking the long term action listed in this section. FDA agrees that it is essential that the manufacturer establish procedures for implementing corrective and preventive action and has revised Sec. 820.100(a) accordingly. The procedures must include provisions for the remaining requirements in the section. These procedures must provide for control and action to be taken on devices distributed, and those not yet distributed, that are suspected of having potential nonconformities. 159. Other comments stated that the degree of remedial action should be commensurate with the risk associated with a product failure. FDA agrees that the degree of corrective and preventive action taken to eliminate or minimize actual or potential nonconformities must be appropriate to the magnitude of the problem and commensurate with the risks encountered. FDA cannot dictate in a regulation the degree of action that [Page 52634] should be taken because each circumstance will be different, but FDA does expect the manufacturer to develop procedures for assessing the risk, the actions that need to be taken for different levels of risk, and how to correct or prevent the problem from recurring, depending on that risk assessment. FDA emphasizes that any death, even if the manufacturer attributes it to user error, will be considered relevant by FDA and will have a high risk potentially associated with it. User error is still considered to be a nonconformity because human factors and other similar tools should have been considered during the design phase of the device. FDA acknowledges that a manufacturer cannot possibly foresee every single potential misuse during the design of a device, but when the manufacturer becomes aware of misuse, the corrective and preventive action requirements should be implemented to determine if redesign of the device or labeling changes may be necessary. 160. Several comments on proposed Sec. 820.100(a)(1) stated that requiring a manufacturer to analyze ``all'' processes, work operations, and other factors listed, is excessive and unrealistic. Some comments stated that there should not be a requirement to conduct an analysis for ``potential causes'' of nonconformances. A few comments stated that including ``quality audits'' in the list was inconsistent with the FDA policy of not reviewing internal audits. A few comments stated that the requirement that the analysis include ``trend analysis'' should be modified because it places unnecessary emphasis on only one statistical method or tool. Other comments stated that statistical tools are not always necessary and that the requirement should be modified. FDA agrees in part with the comments. It was not FDA's intent to require that processes unrelated to an existing nonconformity be analyzed. Instead, Sec. 820.100(a)(1) requires an analysis of those items listed that could be related to the problem. To prevent confusion, the word ``all'' has been deleted. The requirement is similar to that of ISO 9001:1994, section 4.14.3(a). The inclusion of ``quality audits'' as a valuable feedback mechanism for the manufacturer does not conflict with FDA's policy of not reviewing internal quality audits. Internal audits are valuable and necessary tools for the manufacturer to evaluate the quality system. The audit reports should be used to analyze the entire quality system and provide feedback into the system to close the feedback loop, so that corrective or preventive actions can be taken where necessary. FDA will review the corrective and preventive action procedures and activities performed in conformance with those procedures without reviewing the internal audit reports. FDA wants to make it clear that corrective and preventive actions, to include the documentation of these activities, which result from internal audits and management reviews are not covered under Sec. 820.180(c). FDA has further revised the requirement to delete the reference to trend analysis in response to the comments. The provision now requires that ``appropriate statistical methodology'' be employed where necessary to detect recurring quality problems. This revision is made because there may be other statistical tools available beyond ``trend analysis.'' FDA emphasizes that the appropriate statistical tools must be employed when it is necessary to utilize statistical methodology. FDA has seen far too often the misuse of statistics by manufacturers in an effort to minimize instead of address the problem. Such misuse of statistics would be a violation of this section. FDA has retained the requirement for analysis to identify ``potential causes of nonconforming product,'' however, because FDA believes this is an important aspect of preventive action. FDA notes that ISO 9001:1994, section 4.14.1, specifically acknowledges that corrective and preventive actions are associated with actual and potential nonconformities. 161. Several comments stated that proposed Sec. 820.100(a)(2) was redundant with requirements in Sec. 820.198 Complaints. FDA agrees in part with the comments and has written the section to require investigation of the cause of nonconformities relating to process, product, and the quality system, consistent with ISO 9001:1994, section 4.14.2(b). The requirement in this section is broader than the requirement for investigations under Sec. 820.198, because it requires that nonconforming product discovered before or after distribution be investigated to the degree commensurate with the significance and risk of the nonconformity. At times a very indepth investigation will be necessary, while at other times a simple investigation, followed by trend analysis or other appropriate tools will be acceptable. In addition, in contrast to Sec. 820.198, the requirement in this section applies to process and quality system nonconformities, as well as product nonconformities. For example, if a molding process with its known capabilities has a normal 5 percent rejection rate and that rate rises to 10 percent, an investigation into the nonconformance of the process must be performed. 162. One comment stated that proposed Sec. 820.100(a)(3) should not require identification of action necessary to correct ``other quality problems.'' Another stated that the section should be harmonized with ISO. One comment thought that the requirement should be to identify action to correct problems identified by ``trend analysis.'' FDA agrees that harmonization is important and has harmonized the terminology (and intent) of the section with ISO 9001:1994, sections 4.14.2(c) and 4.14.3(b). However, FDA disagrees that the section should not require identification of action necessary to correct ``other quality problems'' because the objective of Sec. 820.100 is to correct and prevent poor practices, not simply bad product. Correction and prevention of unacceptable quality system practices should result in fewer nonconformities related to product. Therefore, this section addresses problems within the quality system itself. For example, it should identify and correct improper personnel training, the failure to follow procedures, and inadequate procedures, among other things. FDA also disagrees with the suggestion to link the requirement in Sec. 820.100(a)(3) to trend analysis and has deleted the reference to trend analysis in Sec. 820.100(a)(1) to give the manufacturer the flexibility to use whatever method of analysis is appropriate. 163. FDA has revised Sec. 820.100(a)(4) to reflect that preventive, as well as corrective, action must be verified or validated. The section is now consistent with ISO 9001:1994, sections 4.14.2(d) and 4.14.3(c). Two comments stated that the definitions of validation and verification cause confusion here, but FDA believes that these concerns should be resolved with the amended definitions under Sec. 820.3 (z) and (aa). 164. FDA has also revised Sec. 820.100(a)(5) in the same manner, to relate the requirements to preventive action. This section is consistent with ISO 9001:1994, section 4.14.1, third paragraph. 165. One comment suggested that proposed Sec. 820.100(a)(6) be revised to reflect that minor quality problems may not need to be disseminated to those directly responsible for ensuring quality and to be reviewed by management. [Page 52635] FDA agrees in part with this comment. The revised Sec. 820.100 (a)(6) and (a)(7) require that procedures ensure that information is disseminated to those directly responsible for assuring quality or the prevention of such problems, and provide for submitting relevant information on identified quality problems, as well as corrective and preventive actions, for management review. This revision should address the concern raised by the comment because only certain information need be directed to management. The manufacturer's procedures should clearly define the criteria to be followed to determine what information will be considered ``relevant'' to the action taken and why. FDA emphasizes that it is always management's responsibility to ensure that all nonconformity issues are handled appropriately. This section is now consistent with ISO 9001:1994, section 4.14.3(d). 166. Two comments stated that the records required under Sec. 820.100(b) should be treated as part of the internal audit. FDA disagrees with these comments because this information is directly relevant to the safety and effectiveness of finished medical devices. FDA has the authority to review such records and the obligation to do so to protect the public health. Comparable information and documentation is reviewed by the FDA under the requirements of the original CGMP, Secs. 820.20 (a)(3) and (a)(4) and 820.162. Manufacturers will be required to make this information readily available to an FDA investigator, so that the investigator may properly assess the manufacturer's compliance with these quality system requirements. K. Labeling and Packaging Control (Subpart K) i. Device Labeling (Sec. 820.120) 167. Several comments on proposed Sec. 820.162 Device labeling stated that the section should be deleted and placed in guidance because it is unnecessary and redundant with requirements under Secs. 820.80 and 820.86. A few comments stated that the section should be changed to be the same as that in the original CGMP regulation, under Secs. 820.120 and 820.121. Another comment stated that labeling and packaging requirements should be in subpart K of part 820 and handling, storage, distribution, and installation requirements should be in subpart L of part 820 because labeling and packaging functionally occur before distribution and installation. FDA believes that the section, as written, is consistent with the requirements in the original CGMP. Section 820.120 relates specifically to labeling and its requirements are in addition to those in both Secs. 820.80 and 820.86. Further, FDA believes that the degree of detail in this section is necessary because these same requirements have been in place for 18 years, yet numerous recalls every year are the result of labeling errors or mixups. FDA therefore believes that more, not less, control is necessary. FDA has reordered the subparts but notes that the handling and storage requirements apply throughout the production process. 168. One comment stated that ``to maintain labeling integrity and to prevent labeling mixups'' should be deleted from the general requirement because the requirements are detailed in the following sections. Other comments stated that all labels need not be affixed to the device and others stated that ``legible and affixed'' may not be appropriate for all implantable devices. FDA agrees with the comments and has revised the requirements accordingly. 169. A few comments stated that what is now Sec. 820.120(b), ``Labeling inspections,'' should allow automated readers to be used in place of a ``designated individual(s)'' to examine the labeling. FDA disagrees with the comments because several recalls on labeling have been attributed to automated readers not catching errors. The requirement does not preclude manufacturers from using automated readers where that process is followed by human oversight. A ``designated individual'' must examine, at a minimum, a representative sampling of all labels that have been checked by the automated readers. Further, automated readers are often programmed with only the base label and do not check specifics, such as control numbers and expiration dates, among other things, that are distinct for each label. The regulation requires that labeling be inspected for these items prior to release. 170. FDA has amended Sec. 820.120(b) to add ``any'' to additional processing instructions in response to a comment for clarity. FDA has amended Sec. 820.120(d) to include ``The label and labeling used for each production unit, lot, or batch shall be documented in the DHR'' in response to comments questioning whether the labeling used should be recorded in the DMR or the DHR. FDA also amended Sec. 820.120(e) by adding ``or shall accompany the device through distribution'' and deleting ``itself or its label'' for clarity. 171. A few comments on proposed Sec. 820.165 Critical devices, labeling stated that this section should be deleted to eliminate any distinction between critical and noncritical devices. FDA agrees in part and has deleted Sec. 820.165, but has added the requirement on control numbers to Sec. 820.120(e). ii. Device Packaging (Sec. 820.130) 172. Two comments on proposed Sec. 820.160 Device packaging stated that the section should be changed to allow manufacturers to use third parties, if desired, for packaging. Another comment stated that it is very difficult if not impossible to protect from intentional damage, such as tampering. FDA agrees with the comments and has changed the requirement, now in Sec. 820.130, accordingly. FDA believes, however, that any intentional tampering would not be covered because the requirement states ``during customary conditions.'' L. Handling, Storage, Distribution, and Installation (Subpart L) i. Handling (Sec. 820.140) 173. One comment on proposed Sec. 820.120 Handling suggested that the procedures be ``designed to prevent,'' rather than be established to ``ensure that,'' problems delineated in the section do not occur. The comment stated that the word ``prevent'' would add clarity, without compromising the meaning of the sentence. Another comment stated that the handling procedures should apply ``prior to distribution,'' not during ``any stage of handling.'' One comment stated that the requirement does not cover the need for special precautions in handling used devices which may be contaminated, and that this is an important issue covered by ISO/CD 13485. FDA does not believe that Sec. 820.120, now Sec. 820.140, as written is unclear. The procedures are expected to ensure that mixups, damage, deterioration, contamination, or other adverse effects do not occur. FDA amended the requirement, however, to remove ``any stage of'' so it reads ``during handling.'' The requirement continues to apply to all stages of handling in which a manufacturer is involved, which may in some cases go beyond initial distribution. The comparable provision in ISO/CD 13485 states, ``If appropriate, special provisions shall be established, documented and maintained for the handling of used product in order to prevent contamination of other product, the manufacturing environment and [Page 52636] personnel.'' FDA agrees with this requirement and has therefore added the term ``contamination'' to Secs. 820.140 Handling and 820.150 Storage. ii. Storage (Sec. 820.150) 174. Two comments stated that proposed Sec. 820.122 Storage should be amended to be similar to ISO 9001, and that the rest of the requirements should be deleted and included in a guidance document. One comment stated that the term ``obsolete'' should be deleted because, although a device may no longer be sold, thereby making it obsolete, the components for that device may still be stored for customer support of the existing devices. FDA agrees that Sec. 820.122, now Sec. 820.150, could be more consistent with ISO 9001 and has revised the section to harmonize with ISO 9001:1994. FDA has not deleted the term ``obsolete.'' FDA understands that a device may no longer be sold, but that parts and subassemblies may still be required for customer support; therefore, those components or subassemblies are not ``obsolete.'' FDA's intent in this requirement is to ensure that only the appropriate product be used or distributed. FDA has deleted the requirement that control numbers or identifications be legible and visible because it believes the requirement is inherent in Sec. 820.150(a), which requires the manufacturer to establish procedures to prevent mixups. To do this, a manufacturer must ensure that product can be properly identified. 175. A comment stated that restricting access to designated areas through the use of keys, bar code readers, or other means, should be sufficient to meet the intent of the requirement in proposed Sec. 820.122(b), without the need for written procedures for authorizing receipt. FDA has not deleted the requirement for procedures, now in Sec. 820.150(b), to authorize receipt of product because the agency believes that strict control over product in storage areas and stock rooms results in decreased distribution of nonconforming product. Thus, even where locked storage rooms are utilized, the procedures should detail, among other things, who is permitted access and what steps should be followed prior to removal. iii. Distribution (Sec. 820.160) 176. A few comments on proposed Sec. 820.124 Distribution stated that there are times when ``first in, first out'' inventory procedures may not be in the best interest of the customer. The comments said that especially when expiration dating is defined and labeled, a ``first in, first out'' system should not be required. The GHTF and other EU comments stated that if a new section ``Contract review,'' similar to ISO 9001:1994, section 4.3 was not added to the regulation, the requirement that ``purchase orders are reviewed to ensure that ambiguities and errors are resolved before devices are released for distribution'' should be added to this section. FDA agrees with the comments. FDA has amended the requirement in Sec. 820.160 to state that the procedures must ensure that ``expired devices or devices deteriorated beyond acceptable fitness for use'' are not distributed. FDA has also added the sentence on reviewing purchase orders. 177. A few comments on proposed Sec. 820.124(b) stated that class I devices should be exempt, or that the requirement should apply only to critical devices, because all devices do not require control numbers. Other comments stated that the term ``consignee'' should be defined, or the word ``primary'' should be added before ``consignee'' for clarity. FDA agrees in part with the comments and in Sec. 820.160(b) has added the term ``initial'' before ``consignee'' to make clear that the requirement for maintaining distribution records extends to the first consignee. FDA has retained the word ``consignee'' and notes that it is a person to whom the goods are delivered. FDA has also clarified Sec. 820.160(b)(4) by requiring ``Any control number(s) used.'' Therefore, if the manufacturer is required by Sec. 820.65 to have control numbers, these must be recorded along with any control numbers voluntarily used. Logically, control numbers are used for traceability so they should be recorded in the DHR distribution records. FDA disagrees, however, that the requirement to maintain distribution records should not apply to class I devices. The information required by this section is basic information needed for any class of product in order to conduct recalls or other corrective actions when necessary. iv. Installation (Sec. 820.170) 178. Several comments received on proposed Sec. 820.126, Installation stated that not all devices require installation. Several comments on the Working Draft asked that, ``The results of the installation inspection shall be made available to FDA upon request'' be deleted because this was redundant with FDA's access to these documents under Sec. 820.180. FDA agrees with the first set of comments. As discussed in Sec. 820.1, the installation requirements only apply to devices that are capable of being installed. However, to further clarify the requirements in Sec. 820.170, FDA has made clear that the requirement applies to ``devices requiring installation.'' FDA also agrees that the sentence on document availability is redundant with Sec. 820.180 for all records and has deleted the sentence. 179. Several comments raised the issue of applying the regulation requirements to third party installers. FDA has rewritten Sec. 820.170. Persons who install medical devices have been regulated under the original CGMP under Sec. 820.3(k) which describes a manufacturer as one who ``assembles or processes a finished medical device,'' and continue to be regulated under this quality system regulation under Sec. 820.3(o). Section 820.152 Installation of the original CGMP discussed the manufacturer or its authorized representative and persons other than the manufacturer's representative. This regulation eliminates that terminology. Under the revised requirement in Sec. 820.170(a), the manufacturer establishes installation and inspection instructions, and where appropriate test procedures. The manufacturer distributes the instructions and procedures with the device or makes them available to person(s) installing the device. Section 820.170(b) requires that the person(s) installing the device follow the instructions and procedures described in Sec. 820.170(a) and document the activities described in the procedures and instructions to demonstrate proper installation. The revised provisions in Sec. 820.170(b) explicitly require that the installation be performed according to the manufacturer's instructions, regardless of whether the installer is employed by or otherwise affiliated with the manufacturer. Section 820.170(b) requires records to be kept by whomever performs the installation to establish that the installation was performed according to the procedures. Such records will be available for FDA inspection. FDA does not expect the manufacturer of the finished device to maintain records of installation performed by those installers not affiliated with the manufacturer, but does expect the third party installer or the user of the device to maintain such records. FDA believes that making these requirements explicit in the regulation is necessary to ensure that devices are safe and effective, and that they perform as intended after installation. FDA notes [Page 52637] again that installers are considered to be manufacturers under the original CGMP regulation and that their records are, and will continue to be, subject to FDA inspections when the agency deems it necessary to review such records. M. Records (Subpart M) i. General Requirements (Sec. 820.180) 180. Several comments under Sec. 820.180 General requirements suggested that FDA delete the requirement that records be stored to allow ``rapid retrieval'' because a reasonable time frame should be allowed. One comment stated that the wording of the section needed to be amended to allow records to be located in different places, especially for foreign manufacturers and distributors. Two comments stated that the requirement should be qualified by ``subject to conflicting legal requirements in other countries'' because some countries have ``blocking statutes'' that would prohibit the release of some information. One comment stated that wherever the word ``all'' appeared in the requirements, FDA should remove it. FDA has rearranged this section, and notes that records must be kept in a location that is ``reasonably accessible'' to both the manufacturer and FDA investigators, and that records must be made ``readily available.'' FDA expects that such records will be made available during the course of an inspection. If the foreign manufacturer maintains records at remote locations, such records would be expected to be produced by the next working day or 2, at the latest. FDA has clarified that records can be kept at other than the inspected establishment, provided that they are made ``readily available'' for review and copying. This should provide foreign manufacturers and initial distributors the necessary flexibility. FDA has not qualified Sec. 820.180 in response to the comments on the ``blocking statues'' because if manufacturers want to import medical devices into the United States, then they must comply with applicable statutory and regulatory requirements, including part 820. The records section of this regulation is essentially the same as that of the original CGMP and FDA has not found these ``blocking statutes'' to present a problem. Further, countries increasingly realize the importance of a global market, thus FDA does not anticipate this issue to be a problem in the future. In response to the comment on the term ``all'', FDA notes that where a requirement exists for ensuring that records are maintained in a certain fashion, a manufacturer must keep all records subject to the regulation in that manner. The revised section makes clear that it is ``all records required'' by the regulation to which the section's requirements pertain. 181. A few comments on Sec. 820.180(b), ``Record retention period,'' stated that the section should be amended because all quality records may not be tied to a specific device; therefore, such quality records may not need to be maintained over the lifetime of a device. A few comments stated that the retention period requirement is unclear and burdensome, while others stated that the period should be left to the manufacturer to define. One comment suggested the deletion of the requirements related to photocopying records in proposed Sec. 820.180(b) because it is technology that is not necessarily being used. FDA believes that all records should be retained for a period equivalent to the design and expected life of the device, but in no case less than 2 years, whether the records specifically pertain to a particular device or not. The requirement has been amended to make clear that all records, including quality records, are subject to the requirement. FDA believes this is necessary because manufacturers need all such records when performing any type of investigation. For example, it may be very important to access the wording of a complaint handling procedure at the time a particular complaint came in when investigating a trend or a problem that extends to several products or over an extended period of time. Further, FDA does not believe that allowing the manufacturer to define the retention period will serve the public's best interest with regard to safety concerns and hazard analysis. In response to the comment on photocopying, FDA has deleted the last two sentences. The agency believes that this requirement is outdated and does not necessarily reflect the technology being utilized today. Section 820.180 requires that records be readily available for inspection and copying by FDA, and FDA will interpret ``copying'' to include the printing of computerized records, as well as photocopying. 182. One comment on proposed Sec. 820.180(c) stated that all quality audit reports should be subject to FDA review and public disclosure. A few other comments stated that for a management representative to certify that ``corrective action has been taken'' would be difficult because some corrective actions are long term and may not be completed at the time of certification. FDA disagrees with the comment that quality audit reports should be subject to FDA review for the reasons given in the preamble of the original CGMP regulation, published in the Federal Register on July 21, 1978 (43 FR 31508), and believes that the disclosure of the audit reports themselves would be counterproductive to the intent of the quality system. FDA has added Sec. 820.180(c), ``Exceptions,'' to address which records FDA, as a matter of policy, will not request to review or copy during a routine inspection; such records include quality audit reports. FDA may request an employee in management with executive responsibility to certify in writing that the management reviews, quality audits, and supplier audits (where conducted) have been performed, among other things. FDA may also seek production of these reports in litigation under applicable procedural rules or by inspection warrant where access to the records is authorized by statute. Again, FDA emphasizes that its policy of refraining from reviewing these reports extends only to the specific reports, not to the procedures required by the sections or to any other quality assurance records, which will be subject to review and copying. FDA agrees with the comments on the timing of corrective actions and has amended the certification requirement to state ``corrective action has been undertaken.'' ii. Device Master Record (DMR) (Sec. 820.181) 183. A few comments on proposed Sec. 820.181 Device master record stated that the requirement for a ``qualified'' individual to prepare the DMR should be deleted because it is unclear or redundant with the requirements in Sec. 820.25. FDA has not deleted the requirement for the DMR to be prepared, dated, and approved by a qualified individual because the agency believes this is necessary to assure consistency and continuity within the DMR. The section is consistent with the original CGMP, Sec. 820.181. FDA has, however, substituted the phrase ``prepared and approved in accordance with Sec. 820.40'' to be consistent with the requirements already in Sec. 820.40 and to eliminate any redundancy. 184. Two comments on Sec. 820.181(a) stated that ``software design specifications'' should not be included in the DMR because these documents will be located in the DHF. Another comment requested that the requirement that the DMR contain ``software source code'' information be amended because [Page 52638] source codes for commercialized software will not be available to the device manufacturers. Another comment stated that the source code should not be in the DMR because it will already be in the DHF. FDA deleted the reference to ``software source code'' because this is already covered with the requirement for ``software specifications.'' The final software specifications should be transferred into production. Therefore, the final software specification for the particular device or type of device should be located or referenced in the DMR, while any earlier version should be located or referenced in the DHF. FDA believes that it is more important for manufacturers to construct a document structure that is workable and traceable, than to worry about whether something is contained in one file as compared to another. The DMR is set up to contain or reference the procedures and specifications that are current on the manufacturing floor. The DHF is meant to be more of a historical file for utilization during investigations and continued design efforts. 185. One comment on Sec. 820.181(c) stated that the DMR should not contain quality system documents, but rather the quality control documents related to the specific device. Three comments stated that validation and verification information belongs in the DHF, not the DMR. FDA agrees in part with the comments and has revised the section to clarify that the quality records required in the DMR relate to the specific current design, not the more general requirements of the quality system, which are addressed under new Sec. 820.186. However, the comments are incorrect that all validation and verification information is related solely to design. There are requirements for validation and verification pertaining to device processing that may be better kept in the DMR instead of the DHF. The documentation of such verification and validation activities relating to processes that are performed for several different devices or types of devices can be placed or referenced in the location that best suits the manufacturer. Again, it is more important that the manufacturer store and retrieve information in a workable manner, than keep such information in particular files. 186. FDA notes that the regulation contains a few requirements which apply ``where appropriate'' or ``at appropriate stages.'' FDA emphasizes that the procedures that the manufacturer places in the DMR must clearly define the requirements the manufacturer is following and when particular activities are appropriate. The manufacturer will have failed to comply with the requirements of the section if the procedures simply state that the review or activity occurs at ``appropriate stages.'' The same principle applies for every section of this regulation, which is written to be flexible enough to cover the manufacture of all types of devices. Manufacturers must adopt quality systems appropriate for their specific products and processes. In establishing these procedures, FDA will expect manufacturers to be able to provide justifications for the decisions reached. iii. Device History Record (Sec. 820.184) 187. One comment on Sec. 820.184 stated that labeling should not be required in the DHR because it is already required in the DMR. Another comment stated that some devices have 25 or more labels and that only the primary identification labels are necessary in the DHR. One comment stated the requirement should be amended because it explicitly requires that dates and quantities for each batch be in the DHR, while only implying through the general requirement that the DHR must also contain the batch test data. FDA agrees that it may not be necessary to include all labeling used in the DHR. However, FDA continues to believe, as it explained in the preamble to proposed regulation published in the Federal Register on November 23, 1993 (58 FR 61952 at 61968), that increased control over labeling is necessary due to the many labeling errors resulting in recalls. Therefore, FDA has retained a requirement related to labeling in the DHR, but revised it to make it less burdensome. The requirement was amended to ``the primary identification label and labeling'' which is consistent with that contained in the original CGMP regulation, Sec. 820.185. FDA believes that the requirement that the DHR contain the primary label and labeling used for each production unit, coupled with the labeling controls in Sec. 820.120, should help to ensure that proper labeling is used and, hopefully, decrease the number of recalls due to improper labeling. FDA agrees with the last comment and has added in Sec. 820.184 ``(d) The acceptance records which demonstrate the device is manufactured in accordance with the DMR'' to explicitly state the requirement to avoid any confusion. 188. FDA has deleted the requirement for the DHR to be ``readily accessible and maintained by a designated individual(s)'' because it believes that the objective of that requirement is met through Secs. 820.40 Document controls and 820.180 General requirements. FDA has also added ``device identification'' to the requirement under Sec. 820.184(f) because it believes that any identification or control number used should be documented in the DHR to facilitate investigations, as well as corrective and preventive actions. FDA notes that this provision does not add any requirement for identification or traceability not already expressed in Secs. 820.60 and 820.65. iv. Quality System Record (Sec. 820.186) 189. Several comments stated that the regulation should more closely harmonize with ISO 9001:1994. A few comments stated that the regulation should include the requirements for a quality manual. One comment stated that general quality system procedures and instructions should not be required in the DMR because the DMR is device specific, and many quality system procedures are not tied to a particular device. FDA agrees in part with these comments and has developed new Sec. 820.186 Quality system record. This section separates the procedures and documentation of activities that are not specific to a particular type of device from the device specific records. v. Complaint Files (Sec. 820.198) 190. Two comments on proposed Sec. 820.198 Complaint files stated that the requirements were very detailed and that much of the language should be placed in a guidance document. FDA disagrees with the comments. These requirements are essentially the same as the original CGMP requirements under Sec. 820.198, and 18 years of experience with these requirements shows that many manufacturers still do not understand and properly handle complaints. Therefore, FDA believes that the amount of detail in Sec. 820.198 is appropriate and necessary. In an effort to make the requirements more clear, however, the section has been reorganized to better illustrate how complaint information should be handled. Section 820.198(a) sets forth the general requirement for establishing and maintaining a complaint handling procedure and includes a few items that the procedure needs to address. Section 820.198(b) discusses the initial review and evaluation of the complaints in order to determine if complaints are ``valid.'' It is important to note that this evaluation is not the same as a complaint investigation. The evaluation [Page 52639] is performed to determine whether the information is truly a complaint or not and to determine whether the complaint needs to be investigated or not. If the evaluation decision is not to investigate, the justification must be recorded. Section 820.198(c) then describes one subset of complaints that must be investigated, but explains that duplicative investigations are not necessary. In cases where an investigation would be duplicative, a reference to the original investigation is an acceptable justification for not conducting a second investigation. Section 820.198(d) describes another subset of complaints that must be investigated (those that meet the MDR criteria) and the information that is necessary in the record of investigation of those types of complaints. Section 820.198(e) sets out the type of information that must be recorded whenever complaints are investigated. The information described in Sec. 820.198 (e)(1) through (e)(5) would most likely be attained earlier in order to perform the evaluation in Sec. 820.198(b). This information need not be duplicated in the investigation report as long as the complaint and investigation report can be properly identified and tied together. Section 820.198 (e)(1) through (e)(5) are considered to be basic information essential to any complaint investigation. If there is some reason that the information described in Sec. 820.198(e) cannot be obtained, then the manufacturer should document the situation and explain the efforts made to ascertain the information. This will be considered to be acceptable as long as a reasonable and good faith effort was made. For example, a single phone call to a hospital would not be considered by FDA to be a reasonable, good faith effort to obtain information. Section 820.198(f) is the same as Sec. 820.198(d) of the original CGMP, where the manufacturing facility is separate or different from that of the formally designated complaint handling unit. In such cases, it is important that the facility involved in the manufacturing of the device receive or have access to complaint and investigation information. In order to give manufacturers the flexibility of using computer or automated data processing systems, the term ``reasonably accessible,'' from Sec. 820.180, is used. Section 820.198(g) is the complaint recordkeeping requirement for distributors. In order to give manufacturers the same flexibility as described in Sec. 820.198(f), FDA has included ``reasonably accessible'' in Sec. 820.198(g). Throughout Sec. 820.198, when there is reference to the MDR regulation or to the types of events that are reportable under the MDR regulation, this section simply refers to events or complaints that ``represent an event which is required to be reported to FDA under part 803 or 804 of this chapter.'' 191. A few comments on Sec. 820.198(a) stated that the section should allow for more than one ``formally designated unit'' to handle complaints, especially for large corporations where it would not be feasible or beneficial for all divisions to have a single complaint handling unit. A few other comments stated that Sec. 820.198(a)(2) on oral complaints should be deleted because it is too subjective. FDA disagrees with these comments. Large corporations may have different complaint handling units for different product types or different manufacturing establishments. However, there should be only one formally designated complaint handling unit for each product type or establishment. If a corporation chooses to operate with different complaint handling units for products and/or establishments, the manufacturer must clearly describe and define its corporate complaint handling procedure to ensure consistency throughout the different complaint handling units. A system that would allow multiple interpretations of handling, evaluating, categorizing, investigating, and following up, would be unacceptable. Each manufacturer should establish in its procedures which one group or unit is ultimately responsible for coordinating all complaint handling functions. FDA also disagrees that the requirement that oral complaints be documented upon receipt should be deleted. A December 1986 General Accounting Office (GAO) report entitled ``Medical Devices; Early Warning of Problems Is Hampered by Severe Underreporting,'' (Ref. 11) showed that approximately 83 percent of the hospitals report complaints orally. FDA believes that these oral complaints must be captured in the complaint handling process. 192. FDA, as noted above, has added to Sec. 820.198(c) the phrase ``unless such investigation has already been performed for a similar complaint and another investigation is not necessary'' to clarify that duplicative investigations are not required if the manufacturer can show that the same type of failure or nonconformity has already been investigated. 193. Several comments on proposed Sec. 820.198(b), now Sec. 820.198(d), stated that the evaluation of complaints pertaining to death, injury, or hazard to health should be removed from this section because it is redundant with the MDR regulation. Several other comments on Sec. 820.198(b) stated that complaints pertaining to death, injury, or hazard to health need not be maintained separately, as long as they are identified. FDA disagrees that the requirements are redundant, but believes that they expressly state what is expected in the handling of this type of complaint information. The requirements have been moved to a separate section, Sec. 820.198(d). FDA agrees with the second set of comments and has revised the section to permit such complaints to be ``clearly identified.'' This will give a manufacturer flexibility in choosing a means of ensuring that these types of complaints can be immediately recognized and segregated for purposes of prioritizing and meeting other requirements. FDA has substituted the term ``promptly'' for the term ``immediately'' to be more consistent with the new MDR regulation timeframes. FDA has also clarified that Sec. 820.198 (d)(1) through (d)(3) are in addition to the information that must be recorded in Sec. 820.198(e). 194. A few comments on proposed Sec. 820.198 (c) and (d) stated that FDA should make clear that some of the requirements will not always be applicable. For example, the comments stated that a record of corrective action cannot be made if such action is not required, and is not taken. Where corrective action is not necessary and is not taken, it cannot be documented. The section was revised to make that clear. As stated in the preamble to the proposal (58 FR 61952 at 61968), the manufacturer's procedures should clearly identify when corrective action will be taken. In addition, FDA combined provisions in Sec. 820.198 (c) through (e) to eliminate redundancy and added the requirement that the records include any device identification, as well as control number used, to facilitate corrective and preventive actions. FDA has also deleted the term ``written'' in Sec. 820.198(e) to be consistent with FDA's statements on electronic and computer systems. 195. FDA deleted the requirements in proposed Sec. 820.198(f) in response to comments because it agrees that it is not necessary to repeat the requirements of the MDR regulation in the quality system regulation. Section 820.198(a) requires that all complaints be evaluated to determine whether they are subject to [Page 52640] the requirements of the MDR regulation under part 803 or 804. 196. A few comments on proposed Sec. 820.198(g), now Sec. 820.198(f), stated that duplicate records are not needed in this age of computer systems, and that the requirement as written would be counterproductive. FDA agrees with the comments and has rewritten the section to allow the complaints and records of investigation to be reasonably accessible at the formally designated complaint unit and the manufacturing site, where these locations are distinct. A manufacturer's procedures must ensure that the manufacturing site is alerted to complaints concerning devices produced at that site. 197. Several comments on proposed Sec. 820.198(h), now Sec. 820.198(g), stated that the requirement is unnecessary, given that FDA can inspect a foreign manufacturer that imports devices, and is burdensome. FDA has revised the section to permit the records to be reasonably accessible, similar to Sec. 820.198(f), which should alleviate any burden. However, the agency must have access to these records in the United States. 198. Several comments on proposed Sec. 820.198 (i) and (j) stated that the requirements should be deleted because they are redundant with the MDR requirements in part 803. FDA disagrees that all of the requirements in Sec. 820.198 (i) and (j) are redundant. The requirement that procedures ensure that complaints are processed uniformly and in a timely manner, and evaluated to determine whether they are reportable under part 803 or 804, has been moved up to Sec. 820.198(a). These are basic requirements for complaint handling. If the complaint is determined to be of the type subject to part 803 or 804, those requirements apply. The requirements of parts 803 and 804 are not repeated in this regulation. FDA has deleted Sec. 820.198(j). N. Servicing (Subpart N) 199. Numerous comments were received on the servicing requirements that were proposed. Many of these comments dealt with competitive issues between manufacturers that perform or contract out their own servicing and third party service organizations. The comments received, as well as the recommendations from the GMP Advisory Committee, were split on many issues. Therefore in this regulation, FDA has chosen to codify only longstanding requirements for servicing performed by original manufacturers and remanufacturers. The requirements in Sec. 820.200 are similar to those in ISO 9001:1994, with some supplemental requirements for clarification on monitoring service reports, on the relationship of service reports and complaints, and on the type of information FDA believes is essential in any service report. As described above in the definition section of this preamble, a separate rulemaking will specify and clarify the requirements for third party service organizations. 200. Other comments on proposed Sec. 820.200(a) stated that it is impractical to return a used device to its original specifications because a certain amount of wear and tear should be expected, without detriment to the safety and effectiveness of the device. Several comments on Sec. 820.200(a) stated that the term ``records'' should be replaced by ``reports,'' to be consistent with ISO 9001. FDA agrees and has revised the requirements in Sec. 820.200(a) to be similar to the requirements in ISO 9001:1994 as recommended by comments at the GMP Advisory Committee meeting to require that the servicing instructions and procedures ensure that the device will meet ``specified requirements'' for the device's intended use. FDA is aware that with use and age, a device may be serviced to function as intended, but may not meet original specifications. FDA agrees with the comments and has modified the language in Sec. 820.200(b), (c), and (d) to use the term ``service reports.'' 201. A few comments on proposed Sec. 820.200(b), ``Service report evaluation,'' questioned whether full corrective action was necessary for every service report and whether service calls need to be handled as complaints only when there is a death, injury, or hazard to safety. FDA has rewritten this section into Sec. 820.200(b) and (c) to clarify the agency's intent and to use terms consistent with those used in Sec. 820.198. Section 820.200(b) now states that ``Each manufacturer shall analyze service reports with appropriate statistical methodology in accordance with Sec. 820.100.'' Full corrective action may not be required for every service report. However, if the analysis of a service report indicates a high risk to health, or that the frequency of servicing is higher than expected, the remainder of the corrective and preventive action elements are applicable, in accordance with the corrective and preventive action procedures established under Sec. 820.100. Section 820.200(c) provides that when a service report ``represents an event which must be reported to FDA under part 803 or 804 of this chapter,'' it is automatically considered by FDA to be a complaint that must be handled according to Sec. 820.198. FDA emphasizes that this provision is not intended to limit ``complaints'' to MDR reportable events. 202. FDA has also added in Sec. 820.200(d) the requirements for recording the name of the device, any device identification(s) and control number(s) used, as well as test and inspection data, because FDA believes such documentation in the service report will facilitate investigations. This additional documentation provision does not add any requirement for identification or traceability not already expressed in Secs. 820.60 and 820.65. Therefore, Sec. 820.200(d) as amended focuses on the type of information that should be captured on the service report instead of where the information should be sent. O. Statistical Techniques (Subpart O) 203. FDA amended Sec. 820.250(a) to be consistent with the requirements in ISO 9001:1994, section 4.20. 204. Several comments on Sec. 820.250(b) stated that the provision as written seems to require the use of sampling plans, and that every manufacturer does not necessarily use sampling plans. Another comment stated that sampling plans are not often used during reviews of nonconformities, quality audits, or complaints, and that these examples should, therefore, be deleted. Two other comments questioned the meaning of ``regularly reviewed.'' FDA's intent was not to require the use of sampling plans, but to require that where they are used, they should be written and valid. Section 820.250 was revised to make that clear. Sampling plans are not always required, but any time sampling plans are used, they must be based on a valid statistical rationale. Further, FDA acknowledges that the most common use of sampling plans is during receiving acceptance, and has deleted the examples. FDA has also clarified the review requirement by stating ``to ensure that when changes occur the sampling plans are reviewed.'' VI. Summary of Changes From the July 1995 Working Draft to the Final Rule and Rationale Note: Minor changes to improve grammar, readability, and clarity, as well as changes in terminology and organization for the sake of consistency throughout the regulation, are not listed. [Page 52641] A. Section 820.1 Scope 1. Inserted sentence, ``If a manufacturer engages in only some operations subject to the requirements in this part, and not in others, that manufacturer need only comply with those requirements applicable to the operations in which it is engaged'' for further clarification of the scope in response to many comments. 2. Amended sentence on component manufacturers to read, ``This regulation does not apply to manufacturers of components or parts of finished devices, but such manufacturers are encouraged to use appropriate provisions of this regulation as guidance'' as a result of the many written comments and oral testimony at the August and September 1995 meetings. 3. Inserted sentence on how to interpret the phrase ``where appropriate'' in the regulation, as recommended by the GMP Advisory Committee. This sentence is consistent with International Organization for Standards (ISO)/CD 13485-- ``Application of Quality Systems to Medical Devices.'' B. Section 820.3 Definitions 4. Amended the definition of Complaint by inserting ``after it is released for distribution'' in response to comments for clarification and to harmonize with ISO/CD 13485. 5. Amended the definition of Component by deleting ``packaging'' for clarification that every piece of packaging is not necessarily a component, only the materials that are part of the ``finished, packaged, and labeled device.'' 6. Amended the definition of Design output to clarify its relationship with the Device Master Record. 7. Amended the definition of Design review to delete ``and propose the development of solutions'' in order to allow the manufacturer the flexibility to determine whom the appropriate person(s) is to propose solutions. 8. Deleted the definition of End of life in response to the many written comments and oral testimony at the August and September 1995 meetings. 9. Amended the definition of Manufacturer to delete component manufacturers and to remove the terms ``servicer'' and ``refurbisher.'' The obligations of servicers and refurbishers will be addressed in a separate rulemaking later this year. The terms ``installation'' and ``remanufacturing'' were added to codify longstanding FDA policy and interpretations of the original CGMP regulation. 10. Amended the definition of Manufacturing material in response to comments requesting clarification and separation of examples. 11. Deleted the definition of Record to avoid confusion. Record will continue to be defined by the act and case law. 12. Removed the definition of Refurbisher for reasons discussed in paragraph 28, section V.A. of this document. 13. Inserted the definition of Remanufacturer for reasons discussed in paragraph 28, section V.A. of this document, and made the language consistent with that of the 510(k) provision and the PMA amendment/ supplement requirements. 14. Changed the term Reprocessing to Rework and adopted a definition consistent with ISO 8402 Quality Management and Assurance Vocabulary Standard in response to comments for closer harmonization of terminology. 15. Removed the definition of Servicing, and Servicer which was proposed to the GMP Advisory Committee, for reasons discussed above. 16. Amended the definition of Validation as recommended by the GMP Advisory Committee for further clarity by delineating the terms validation, process validation, and design validation. 17. Amended the definition of Verification for further clarity in response to comments and to more closely harmonize with ISO 8402. C. Section 820.5 Quality System 18. Deleted the requirements in Sec. 820.5(a) and (b) because these requirements are now found in Sec. 820.20. D. Section 820.20 Management Responsibility 19. Moved the requirements from Sec. 820.186 and rewrote into new Sec. 820.20(d) and (e) for clarity, better organization, and closer harmonization with ISO/CD 13485. E. Section 820.25 Personnel 20. Inserted the phrase, ``establish procedures for identifying training needs'' in Sec. 820.25(b) in response to comments to add this requirement and to harmonize with the requirement in ISO/CD 13485. 21. Deleted the sentence in Sec. 820.25 on understanding the ``CGMP requirements applicable to their job function'' to provide manufacturers with the flexibility to appropriately train personnel. F. Section 820.30 Design Controls 22. Amended the requirements in Design and development planning for clarity and to more closely harmonize with ISO/CD 13485. 23. In Sec. 820.30(c), inserted the sentence, ``The procedures shall include a mechanism for addressing incomplete, ambiguous, or conflicting requirements'' in response to comments to add this requirement and to harmonize with the requirement in ISO/CD 13485. 24. In Sec. 820.30(d), deleted the sentence, ``Design output procedures shall ensure that design output meets the design input requirements'' because this was redundant with the requirement in Sec. 820.30(f) Design verification. 25. Amended Sec. 820.30(e) Design review to clarify that the procedures shall ensure that an independent person is included in design reviews. 26. Section 820.30(f) Design verification and validation was split into two paragraphs, (f) Design verification and (g) Design validation and the requirements were separated between the two paragraphs, in response to many written comments and oral testimony at the August and September 1995 meetings and to improve clarity and consistency with ISO/CD 13485. 27. Amended the requirement for Sec. 820.30(i) Design changes to add the phrase ``before their implementation'' due to an inadvertent omission in the July 1995 Working Draft. G. Section 820.50 Purchasing Controls 28. Deleted the last two sentences in Sec. 820.50(b) and inserted ``Purchasing data shall be approved in accordance with Sec. 820.40'' because the last two sentences were redundant with the requirements in Sec. 820.40. H. Section 820.65 Traceability 29. Substituted the definition of critical device from the original CGMP for the phrase ``where necessary to ensure the protection of the public health,'' in response to many comments requesting clarification as to when traceability is necessary. 30. Added ``where appropriate'' for the traceability of components in response to the recommendation of the GMP Advisory Committee, the written comments, and to harmonize with ISO/CD 13485. I. Section 820.70 Production and Process Controls 31. Inserted ``identified and approved'' in Sec. 820.70(a)(5) before ``representative samples'' to clarify that the samples have to be established and deemed appropriate before they are used as a standard. 32. Substituted in Sec. 820.70(b) ``where appropriate validated according to Sec. 820.75'' for ``unless inspection and test [Page 52642] fully verifies the results of the changes'' because it was redundant with the requirements set forth in Sec. 820.75. 33. Amended the requirement in Sec. 820.70(c) to apply only ``Where environmental conditions could reasonably be expected to have an adverse effect on product quality,'' in response to comments and to be consistent with the original CGMP requirements. 34. Amended the requirements in Sec. 820.70(d) and (e) to include ``could reasonably be expected to have an adverse effect on product quality'' to consistently qualify when these provisions are appropriate. 35. Amended the requirement in Sec. 820.70(h) to apply only ``Where a manufacturing material could reasonably be expected to have an adverse effect on product quality,'' in response to comments and to be consistent with the original CGMP requirements. 36. Rearranged the wording in Sec. 820.70(i) to clarify ``automated data processing systems.'' J. Section 820.72 Inspection, Measuring, and Test Equipment 37. Renumbered Sec. 820.84 as Sec. 820.72 for better organization because Inspection, measuring, and test equipment requirements are more appropriate under Subpart G--Production and Process Controls than under Subpart H--Acceptance Activities. 38. Section 820.72(b) ``Calibration standards'' and (c) ``Calibration records'' were reorganized as paragraphs(1) and (2), respectively under paragraph (b) ``Calibration.'' 39. Amended Sec. 820.72(b) to include provisions for remedial action to ``reestablish the limits and to evaluate whether there was any adverse effect on the device's quality'' in response to comments which questioned whether this was adequately covered under Sec. 820.100. 40. Section 820.84(d), ``Maintenance,'' is reorganized into Sec. 820.72(a) ``Control of inspection, measuring, and test equipment'' and ``test software'' is deleted because it is considered to be covered under ``electronic inspection and test equipment'' in the general requirement. K. Section 820.75 Process Validation 41. Section 820.75(a) is amended for clarity. The phrase ``with a high degree of assurance'' was deleted from the definition of ``Validation'' and added as a requirement under process validation. 42. Section 820.75(b)(2) was amended to state ``where appropriate, the individual(s) performing the process or the major equipment used'' in response to comments requesting that flexibility be given to the manufacturer to determine when these items needed to be documented. 43. Section 820.75 (c) and (d) were redesignated as paragraphs (b)(1) and (b)(2) for better organization and flow. 44. Section 820.75(c) was added to address comments and concerns on when revalidation activities were necessary. L. Section 820.80 Receiving, In-process, and Finished Device Acceptance 45. Section 820.80(c) was amended to add ``where appropriate'' to reinforce the discussion in the preamble that in- process testing is not always necessary depending upon the type of device and the manufacturing set-up. M. Section 820.90 Nonconforming Product 46. Amended the requirement in Sec. 820.90(a) to include, ``The evaluation of nonconformance shall include a determination of the need for an investigation * * *. The evaluation and any investigation shall be documented.'' in response to many written comments and oral testimony at the August and September 1995 meetings on whether every nonconformance had to be investigated. 47. Amended the requirement in Sec. 820.90(b)(1) to read, ``Documentation shall include the justification for use of nonconforming product'' in response to several comments confused about the meaning of the term ``concession.'' 48. In Sec. 820.90(b)(2), substituted the term ``rework'' for the term ``reprocessing'' for reasons described in the definitions section. 49. Deleted the sentence, ``Reprocessed product shall be clearly identified during reprocessing, and shall be subjected to reevaluation'' in Sec. 820.90(b)(2) because the requirement was redundant with the requirements in Secs. 820.60 Identification and 820.86 Acceptance status. N. Section 820.100 Corrective and Preventive Action 50. Amended Sec. 820.100(a)(7) to clarify what information is to be submitted to management for review. O. Section 820.120 Device Labeling 51. Inserted ``where appropriate'' before ``use'' in Sec. 820.120(a) because every device may not have a label directly affixed to the device itself (e.g. implantable devices). 52. Inserted the sentence, ``The label and labeling used for each production unit, lot, or batch shall be documented in the DHR'' into Sec. 820.120(d) in response to comments questioning whether the labeling used should be recorded in the device master record or the device history record. P. Section 820.160 Distribution 53. Inserted the requirement in Sec. 820.160 ``that purchase orders are reviewed to ensure that ambiguities and errors are resolved before devices are released for distribution'' in response to the GHTF comments and other EU comments that the regulation did not address the requirements in ISO 9001, section 4.3, ``Contract Review.'' Q. Section 820.170 Installation 54. Amended the installation requirements for clarity and deleted the last sentence in Sec. 820.170(b), ``The results of the installation inspection shall be made available to FDA upon request'' because this sentence is redundant with the requirements in Sec. 820.180 for all records. R. Section 820.181 Device Master Record (DMR) 55. In Sec. 820.181 deleted the phrase ``dated, and signature of the qualified individual(s) designated by the manufacturer'' and inserted ``and approved in accordance with Sec. 820.40'' to be consistent with the requirements already in Sec. 820.40. 56. In Sec. 820.181 deleted the phrase ``and software source code for customized software'' because comments stated that this was already covered with the requirement for ``software specifications.'' S. Section 820.186 Quality System Record (QSR) 57. Amended the requirement in Sec. 820.186 by adding the sentence, The QSR shall include, or refer to the location of, procedures and the documentation of activities required by this part that are not specific to a particular type of device(s), including but not limited to the records required by Sec. 820.20. Each manufacturer shall ensure that the QSR is prepared and approved in accordance with Sec. 820.40. Deleted the requirements in Sec. 820.186(a) through (d) because those requirements are now found in Sec. 820.20. This change was in response to comments and suggestions made by the GHTF for further harmonization with ISO/CD 13485 and for clarity. T. Section 820.198 Complaint Files 58. In Sec. 820.198 deleted the terminology ``pertaining to death, [Page 52643] injury, or any hazard to safety'' throughout this section and inserted ``an event which must be reported to the FDA under part 803 or 804 of this chapter'' to reference the MDR regulation. 59. Added the phrase ``unless such investigation has already been performed for a similar complaint and another investigation is not necessary'' in Sec. 820.198(c) in response to comments which thought a second investigation was always mandated by this requirement. 60. Amended Sec. 820.198(d) by changing the word ``immediately'' to ``promptly'' to be consistent with the new MDR regulation. Added, ``In addition to the information required by Sec. 820.198(e),'' to clarify that an investigation under Sec. 820.198(d) was to include requirements under paragraphs (d)(1) through (d)(3) and under paragraphs (e)(1) through (e)(8). 61. Substituted the phrase ``reasonably accessible'' for ``concurrently maintained'' in Sec. 820.198 (f) and (g) as recommended by the GMP Advisory Committee to clarify FDA's intent of allowing these records to be available in other media forms besides the hard copies which were previously required. U. Section 820.200 Servicing 62. Amended Sec. 820.200(a) to adopt language consistent with ISO/ CD 13485, which was suggested at the GMP Advisory Committee meeting, in order to clarify the requirement and further harmonize. 63. Deleted the last two sentences in Sec. 820.200(a) on providing information to third party servicers since this industry will be addressed in a separate rulemaking, as discussed above. 64. Section 820.200(d) was amended for clarity and to focus on the service report and what type of information should be captured on the report instead of where the information should be sent. V. Section 820.250 Statistical Techniques 65. Amended Sec. 820.250(b) by inserting the phrase, ``to ensure that when changes occur the sampling plans are reviewed'' in response to comments for clarification on when the plans needed to be reviewed. VII. Environmental Impact The agency has determined under 21 CFR 25.24(a)(8) and (a)(10) that this action is of a type that does not individually or cumulatively have a significant effect on the human environment. Therefore, neither an environmental assessment nor an environmental impact statement is required. VIII. Intergovernmental Partnership The agency has analyzed this rulemaking in accordance with the principles and criteria set forth in Executive Order 12875, ``Enhancing the Intergovernmental Partnership'' and in the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4). Executive Order 12875 states that no agency or executive department shall issue any regulation that is not required by statute and that creates a mandate upon a State, local, or tribal government unless the Federal Government supplies funds necessary to comply with the mandate, or the agency provides the Office of Management and Budget (OMB) a description of the agency's consultation with affected State, local, and tribal governments, the nature of their concerns, any written communications submitted to the agency by such units of government, and the agency's position supporting the need to issue the regulation containing the mandate. Executive Order 12875 does not apply to this final rule because the regulatory requirements are not generally applicable to government facilities but to finished device manufacturers. The agency notes, however, that the membership of the advisory committee established to review this regulation and make recommendations to the agency on the feasibility and reasonableness of the regulation (GMP Advisory Committee) must include three members who are officers or employees of any State or local government or of the Federal Government, and that in 1995 this committee included two State government representatives and one Federal Government representative. The agency has also examined the consistency of this final rule with the Unfunded Mandates Reform Act of 1995. The Unfunded Mandates Reform Act requires (in section 202) that agencies prepare an assessment of anticipated costs and benefits before proposing any rule that may result in an annual expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100 million (adjusted annually for inflation). FDA believes that the private sector expenditures for this rule fall below $100 million annually but nonetheless, due to uncertainties of these estimates, the agency has prepared for the private sector an assessment of anticipated costs and benefits for the 1993 proposed rule and this final rule as described in section IX. of this document. IX. Economic Impact A. Summary FDA has examined the impacts of the final rule under Executive Order 12866 and the Regulatory Flexibility Act (Pub. L. 96-354). Executive Order 12866 directs agencies to assess all costs and benefits of available regulatory alternatives and, when regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety, and other advantages; distributive impacts; and equity). The agency believes that this final rule is consistent with the regulatory philosophy and principles identified in the Executive Order. As explained in detail below, FDA finds that this final rule has an estimated total annual incremental cost of $81.9 million to the U.S. industry and an estimated average annual benefit of from $180 million to $220 million in lives saved and is economically significant under Executive Order 12866. Consequently, the agency has completed this full regulatory flexibility analysis which demonstrates that this rule is consistent with the principles set forth in the Executive Order and the Regulatory Flexibility Act, and also with the Unfunded Mandates Reform Act as described in section VIII. of this document. This analysis, together with the preamble published in the Federal Register and supporting analysis and materials, constitutes a final regulatory flexibility analysis. In addition, this document has been reviewed by OMB as an economically significant regulatory action under Executive Order 12866. The detailed data for this analysis were developed by Eastern Research Group, Inc. (ERG), under contract to FDA and their two reports: ``Economic Analysis of the Proposed Revisions to the Good Manufacturing Practices Regulation for Medical Devices,'' and ``Addendum to the Final Report'' are on file at the Dockets Management Branch (HFA-305), Food and Drug Administration, 12420 Parklawn Dr., rm. 1-23, Rockville, MD 20857. The objective of this rule is to reduce the number of fatalities and injuries attributable to defective medical devices. FDA finds that private market incentives do not adequately reduce the risk of design- related device failures because neither physicians nor consumers have all of the information needed to make adequate judgments of product quality and legal tort remedies are slow, inefficient, and extremely costly. The changes to the CGMP regulation will require manufacturers to extend [Page 52644] their quality systems to include several new areas, such as design and purchasing, and to clarify or expand selected existing requirements. Several of the changes to the regulation make it more consistent with ISO 9001:1994 quality standards. The rule will affect all medical device establishments engaged in the design, manufacture, contract sterilization, and packaging of medical devices. This analysis presents the costs and benefits of the final CGMP rule and reflects the differences between the proposed and final regulation. The complete methodology and preliminary economic analysis was presented in the November 1993 ERG report, ``Economic Analysis of Proposed Revisions to the Good Manufacturing Practices Regulation for Medical Devices''. While the proposed rule covered component manufacturers, the cost of compliance for such manufacturers was inadvertently omitted from the November 1993 ERG report. However, FDA has decided not to cover component manufacturers, therefore most of the preliminary analysis remains valid (e.g., estimates of labor and resource requirements, level of compliance, and number of firms remain the same for the final analysis, except where noted). Based on the ERG study, the total annual incremental costs to the U.S. industry of the final CGMP regulation are estimated to be about $81.9 million. These costs are more than offset, however, by benefits to public health and by economic benefits to the medical device industry. FDA estimates that the benefits to public health will include 36 to 44 fewer deaths and 484 to 677 fewer serious injuries per year, which are attributed to design-related device failures. Studies on the value of a statistical-life have reported estimates ranging from $1.6 million to $8.5 million.1 Assuming an economic value of $5 million per fatality avoided, the monetary value of saving 36 to 44 lives each year will be $180 to $220 million. Therefore, the value of the public health benefits of preventing deaths alone easily exceeds the cost of compliance even without estimating benefits from a reduced number of serious injuries. Moreover, additional economic benefits to medical device establishments will result from cost savings due to fewer design-related product recalls, better product quality, and greater productivity. In addition, medical device establishments exporting to the EU will greatly benefit from the harmonization of the CGMP regulation with the ISO 9001:1994 quality standards. Because the EU is adopting ISO 9001:1994 as a basis for its medical device manufacturing quality system, the harmonization of the two quality requirements will eliminate the need for device manufacturers to maintain different quality systems for each market. --------------------------------------------------------------------------- 1 Fisher, A.; Chestnut, L.; and Violette, D. (1989). ``The Value of Reducing Risks of Death: A Note on New Evidence.'' Journal of Policy Analysis and Management, 8 (pp. 88-100). --------------------------------------------------------------------------- FDA supports the international harmonization of standards and regulations governing medical devices and the eventual mutual recognition of CGMP inspections between major device markets. While full achievement of this goal is still in the future, the harmonization of quality standards is an important first step. FDA believes in a step wise approach toward harmonization and eventual mutual recognition. For CGMP inspections or Quality System Conformity Assessments, these goals comprise four basic steps. First, the harmonization of quality system requirements is a fundamental building block of all future work in this area. FDA believes that by working with the GHTF, specifically Study Group #3 of the GHTF, it has developed a final rule that incorporates the harmonized quality system requirements which are recognized around the world. Second is the harmonization of regulatory auditing or compliance inspections. This work is currently underway in the GHTF in Study Group #4, which has developed one draft document entitled ``Guidelines For Regulatory Auditing Quality Systems of Medical Device Manufacturers,'' expected to be finalized in 1997. The third step is for harmonization of the policy, interpretation, and regulatory consequences of noncompliance with the quality system requirements in this rule and in counterpart requirements of other countries. Underlying these activities is an ongoing need for confidence building between the parties working towards mutual recognition. FDA believes that this regulation will provide a sound foundation for the goal of mutual recognition of inspections, a goal that will benefit industry, as well as the agency. The Health Industry Manufacturers Association has stated that reciprocity for quality assurance inspections could save the medical device industry millions of dollars as well as provide significant savings to governments.2 --------------------------------------------------------------------------- 2 Gilmartin, R.V. (1992). ``The Benefits of Cooperation for Industry and Regulators Alike: A Global Perspective.'' Presented at the Third Annual Global Medical Device Conference, October 2. --------------------------------------------------------------------------- For individual establishments, the economic impact of the regulation will depend on a number of factors, such as the level of current compliance, the type of activities performed at the establishment, and the nature of the product. On average, the smaller establishments will bear a relatively greater economic burden. B. Industry Profile Firms in the medical device industry are heterogeneous. They vary in size, product type, product and process technology, and rate of new product introductions. There are over 7,000 medical device establishments involved in the production of approximately 4,000 different types of devices (Table 1). Sixty-two percent of these establishments are very small (fewer than 20 employees), while 27 percent are of medium-size (20 to 99 employees), 7 percent are large (100 to 249 employees), and 4 percent are very large (250 or more employees). These size categories were developed to reflect size categories within the medical device industry and differ from the Small Business Administration definition. Under the Small Business Administration definition, over 98% of all establishments would be small. Table 1.--Distribution of Affected Establishments by Employment Size ---------------------------------------------------------------------------------------------------------------- Employment size \2\ -------------------------------------------------------- Type of establishment Total \1\ Small (1-19) Medium (20-99) Large (100-249) Very large (>=250) ---------------------------------------------------------------------------------------------------------------- Design and Production Manufacturer........ 5,415 3,323 1,414 415 265 Contract manufacturer..................... 419 257 109 32 20 Specification developer................... 541 352 162 27 0 Repacker/relabeler........................ 828 538 248 41 0 [Page 52645] Contract sterilizer....................... 34 22 10 2 0 --------------------------------------------------------------------- Total............................... 7,237 4,492 1,943 517 285 ---------------------------------------------------------------------------------------------------------------- \1\ Based on data from FDA's Registration and Listing Branch, 1992, adjusted to reflect 13 percent not required to register and 6 percent exempt from CGMP requirements. \2\ ERG (1993), Section 3. C. Comments to November, 1993 Proposed Changes to the CGMP Regulation A small percentage of the public comments on the November 1993 proposed regulation addressed the economic impact analysis. The majority of these comments made very general, nonspecific observations and therefore cannot be addressed directly. Many of these comments stated that FDA underestimated the regulatory burden that the proposed CGMP regulation would place on medical device manufacturers. Others stated that their companies would expend more than the per establishment estimated costs; some discussed the hiring of additional personnel to address the compliance requirements. In developing the cost estimates for the 1993 proposal, ERG attempted to describe the labor hours (and associated costs) needed to achieve an acceptable minimum level of compliance with each requirement. These estimates took into account the incremental labor and capital resources that would be needed to progress from the existing compliance level to the new level required by the proposal. For individual establishments, the economic impact of the CGMP regulation would depend on a number of factors, such as the level of current compliance, the type of activities performed, and the nature of the product. Not surprisingly, those establishments that currently undertake relatively few of the activities to be required would incur greater compliance costs than the averages presented. In the final rule, FDA has eliminated or modified several requirements to give medical device establishments greater flexibility in selecting compliance methods. In general, the words ``where appropriate'' were added to many requirements to make them less prescriptive and allow establishments to determine if or when they are appropriate for their product. For example, in Sec. 820.65 Traceability, the final requirement allows the manufacturer to identify which components require traceability. In addition, many procedures may not need to be changed, only documented. To further minimize compliance costs, FDA intends to provide additional guidance materials. The DSMA currently offers guidance materials and regional seminars on CGMP matters. 1. Health Industry Manufacturers Association (HIMA) HIMA commented that FDA understated the costs for personnel training, maintenance of new systems, documentation revisions, and operational costs. ERG agrees that it did not fully address the initial training requirements in the cost analysis for the proposed CGMP regulation. New costs for initial training were included in the cost analysis for the final CGMP regulation. However, the existing CGMP regulation requires periodic training of personnel. Therefore no incremental costs for periodic training were estimated. ERG did not change its cost estimate for quality system maintenance and procedure revisions. Estimates were made for the incremental compliance costs associated with an annual review of each new procedure, but these procedures would be revised only sporadically and probable estimates of their future costs would be small and could not be reasonably quantified. ERG recognized that companies will incur incremental costs to use new procedures. Although a separate estimate of these operational costs was not made, they were incorporated into the estimates of the individual requirements where applicable. 2. Other General Comments Some manufacturers of low-risk devices and some that have never experienced a product recall or MDR event questioned the merit and benefits of applying design controls to all products. In the proposed and final CGMP regulation, FDA exempted almost all class I devices because the public health benefits gained did not exceed the costs of implementation. However, FDA believes that all class II and III devices should be covered because their failure could adversely affect public health. Even firms with excellent past records put their consumers at future risk if their design systems are inadequate. ERG estimates that strict compliance to the final CGMP regulation will avert about 43 deaths and over 600 serious injuries per year. In addition, the literature on quality systems consistently states that firms implementing such systems, which begin with design controls, report cost savings in the long-run. A number of comments argued that the proposed CGMP regulation would slow product innovation and increase health care costs. FDA believes that the gains from improvements in quality control and greater efficiencies will lessen the impact on both innovation and health care costs and will not lower the innovation rate for products with significant medical benefit. Manufacturers will also avoid the costs of most design-related medical device recalls. ERG estimated that design- related recalls cost industry approximately $40 million per year. Health care spending overall will also decrease as deaths, injuries and malfunctions from medical device failures decrease. Some comments suggested that the proposed CGMP regulation would hurt the domestic medical device industry's competitiveness and encourage companies to move their operations to foreign countries. FDA has sought to harmonize the final CGMP regulation with ISO 9001:1994 and ISO/CD 13485. Some comments had stated they would like to see even greater harmonization in the final regulation. The harmonization of regulatory requirements will benefit medical device establishments because they will be able to maintain a single regulatory compliance program. The harmonization of CGMP requirements is also a first step in developing mutual recognition agreements between U.S. and foreign governments. An FDA sponsored survey of innovative medical [Page 52646] device companies found that nearly 65 percent of them sold their products outside the United States, including 40 percent of the small and 70 percent of the medium-sized companies.3 Thus, a majority of firms should benefit from harmonization efforts. Since foreign firms exporting their products to the United States must comply with the U.S. CGMP regulation, they will incur essentially the same incremental costs to comply with the final CGMP regulation as domestic establishments. --------------------------------------------------------------------------- \3\ ERG (1994). FDA Survey of Establishments Introducing New Medical Devices. (Task Order 3, Contract No. 223-91-8100.) --------------------------------------------------------------------------- 3. Small Business Concerns Some comments representing small businesses were concerned about the increase in procedural and documentation requirements. The procedures and paperwork requirements will be simpler for small medical device establishments relative to larger firms. Further, small businesses can reduce compliance costs by using FDA guidance and training materials, industry-generated guidance, and other technical assistance that is available. FDA is preparing an extensive range of technical support regarding the final CGMP regulation, including guidance documents, workshops, and other materials and presentations. Several small businesses argued that the regulatory costs fall disproportionately on small business, hindering industry growth. The regulatory requirements apply equally to whoever is designing and developing new devices. However, the vast majority of firms are small and medium in size and these firms are least likely to have such design control procedures already in place. As a result, their incremental costs may be higher. Nevertheless, because procedures reflect the complexity of the processes they guide, small and medium-sized establishments should incur proportionately lower gross compliance costs for those activities than larger establishments. 4. Section 820.22 Quality audit Some comments believed that requiring quality audits to be performed by individuals without direct responsibility for the matters being audited poses a severe burden for small business. This requirement is already present in the original CGMP regulation and thus was not addressed in the economic analysis of the final regulation. 5. Section 820.25 Personnel Comments stated that the requirement to maintain files on consultants was onerous and interfered with manufacturers' selection processes. FDA modified this requirement and moved it to Sec. 820.50 Purchasing, in the final CGMP regulation. Companies will now be required to verify that consultants meet specified requirements and define the type and extent of control they will exercise over them. The incremental compliance costs were judged to be negligible. 6. Section 820.30 Design control Comments believed that the requirement stipulating that devices be sampled from three production runs before a device is released for routine distribution was too prescriptive and burdensome. FDA has modified the requirement in the final rule to require design validation of initial production units, lots, or batches, or their equivalent. This modification should give manufacturers greater flexibility in implementing this requirement. Some comments from small businesses were critical of the requirement that independent personnel perform design reviews and stated that they will have to hire outside engineers for this task. In the final rule FDA allows greater flexibility and states that the independent personnel can be individual(s) who do not have direct responsibility for the design stage being reviewed. Thus, staff personnel (including engineers working on other components of the device and nonengineering personnel) can perform design reviews. 7. Section 820.40 Document control Some comments believed that the cost of implementing documentation systems and other paperwork was understated. However, ERG's estimates included the incremental compliance costs for formalizing a written document control procedure and ERG considered paperwork requirements in its estimation. The final rule also extends document control requirements to the design phase and cost estimates for these requirements were added to the economic assessment. Most companies consider document control procedures to be essential and have realized some benefits from such procedures, typically in the form of efficiency gains and avoided documentation mixups. These potential benefits were not quantified. 8. Section 820.50 Purchasing control Comments questioned the need to establish the quality of materials purchased from long-established suppliers or from new suppliers of small quantities of components. Historical records, however, even for suppliers of small quantities, can be used to assess a supplier's quality. Supplier audits are not mandated in the CGMP regulation, but may be a useful tool in assessing a supplier's capabilities. Cost estimates for auditing from one- half to four new suppliers per year for small to very large establishments were included in the economic assessment. 9. Section 820.80 Receiving, in-process, and finished device acceptance One comment believed that requiring manufacturers to retain the quantitative results of testing was excessive. The final rule stipulates that ``the results'' of acceptance activities are to be recorded, but does not specify that all quantitative results must be recorded. Because this requirement is consistent with current industry practices, incremental costs were not assigned to this section. 10. Section 820.90 Nonconforming product Comments noted that identifying a product as ``reprocessed'' has a negative impact on sales. (FDA now uses the term ``reworked''.) This language was revised in the final rule to clarify that reworked devices need to be identified as such at the manufacturing facility to avoid mixups. No costs were estimated for this requirement. D. Industry Costs ERG estimated the total annual incremental cost of the final rule at $81.9 million. This includes $9.5 million in one-time costs that were annualized over 5 years at a 10 percent discount rate. Table 2 lists the most costly of the new requirements. Costs were based on the incremental tasks each manufacturer must perform to achieve compliance. ERG retained most of the methodology and data from the proposed rule to estimate the costs of the final rule. Where applicable, costs were estimated for additional or changed final requirements. Also, the distribution of costs across establishment size was modified to reflect new information on the rate of product innovation.4 The rates of innovation per year used for this analysis are: 0.4 percent for small, 1.3 percent for medium-sized, 2.6 percent for large, and 6.5 percent for very large establishments. --------------------------------------------------------------------------- 4 ERG (1994). FDA Survey of Establishments Introducing New Medical Devices. (Task Order 3, Contract No. 223-91-8100). [Page 52647] Table 2.--Total Compliance Costs, by Most Costly Incremental Tasks [$ millions] ---------------------------------------------------------------------------------------------------------------- Annual Incremental tasks One-time -------------------------- Total annualized Labor Nonlabor annualized -----------------------------------------------------------------\1\-------------------------------------------- Design Controls: Design Verification................................... NA 18.2 27.4 45.6 Design Review......................................... NA 6.2 NA 6.2 Design Changes........................................ NA 4.0 NA 4.0 Design and Development Planning....................... NA 1.2 NA 1.2 Other: Quality Audit......................................... 0.5 4.7 NA 5.2 Evaluation of Suppliers and Contractors............... 0.6 1.9 0.9 3.4 Management Review..................................... NA 2.2 NA 2.2 Purchasing Data....................................... NA 1.1 NA 1.1 All Remaining............................................. 8.4 4.6 0.0 13.0 ----------------------------------------------------- Total for Final Regulation........................ 9.5 44.1 28.3 81.9 ---------------------------------------------------------------------------------------------------------------- \1\ One-time costs annualized over 5 years at discount rate of 10 percent. NA=Not Applicable. Note: Totals may not add due to rounding. Source: ERG (1996), Section 4. The great majority of costs for all size establishments will be associated with the establishment of design controls for new products. Therefore, the more innovative establishments will experience greater compliance costs than the less innovative establishments. The estimated annual design control costs total $57.5 million, which represents 70 percent of the total annual incremental costs of compliance. The most costly task within the design control category is design verification ($45.6 million), which includes design validation. Other costly tasks are design review ($6.2 million), which encompasses conducting and documenting design reviews; design changes ($4.0 million), which includes documenting and maintaining design change procedures; and design and development planning ($1.2 million), which includes documenting and maintaining plans for device design and development. The requirement for extending the quality system audit ($5.2 million) and the evaluation of suppliers and contractors ($3.4 million) are also relatively high cost items. The estimated total cost of compliance for the final rule ($81.9 million) is $2.6 million less than the estimated cost of the November 1993 proposed rule ($84.5 million). Some cost increases were due to added requirements for increased documentation. However, these cost increases were offset partly by a decrease of $0.5 million from the modification of some requirements (e.g. Secs. 820.65 Traceability and 820.160 Distribution). The remaining changes resulted from changes in assumptions or new information about cost and compliance rates in design control and supplier audits and from new information regarding product innovation rates across establishment size. The projected average cost per establishment (see Table 3) varies substantially across industry sectors and establishment size categories. As expected, the average incremental costs are largest for establishments that design medical devices: design and production manufacturers and specification developers. For these two sectors, the average per establishment costs are $15,994 for design and production manufacturers and $14,767 for specification developers. Actual per establishment costs will vary substantially depending on the product type, design complexity, innovation rate, and level of design control currently in place. The average incremental costs for the other three sectors are significantly lower: $3,554 for contract manufacturer, $1,995 for repacker/relabeler, and $2,040 for contract sterilizer. Table 3.--Average Total Annualized \1\ Costs Per Establishment by Type and Size [Dollars] ---------------------------------------------------------------------------------------------------------------- Small (1-19) Medium (20-99) Large (100-249 Very large (>=250) All ---------------------------------------------------------------------------------------------------------------- Design and Production Manufacturer.... 11,085 25,800 22,748 12,258 15,994 Specification Developer............... 9,927 24,052 20,583 NA 14,767 Contract Manufacturer................. 2,357 4,027 5,802 10,678 3,554 Repacker/Relabeler.................... 1,471 2,588 3,969 NA 1,995 Contract Sterilizer................... 1,491 2,621 3,999 NA 2,400 ---------------------------------------------------------------------------------------------------------------- \1\ One-time costs annualized over 5 years at a discount rate of 10 percent. NA=Not Applicable. Source: ERG (1996), Section 6. Because average current compliance rates tend to vary directly with establishment size and there are relatively few large and very large establishments (7 and 4 percent of all medical device establishments, respectively), the largest share of the costs are incurred by small establishments, $35.2 million (43 [Page 52648] percent) and medium-size establishments, $34.5 million (42 percent), while the smallest share is incurred by very large establishments, $3.4 million (4 percent) (see Table 4). Table 4.--Total Annualized Costs by Size Category [$ millions] ---------------------------------------------------------------------------------------------------------------- Annual Establishment size One-time -------------------------- Total annualized Labor Nonlabor annualized -----------------------------------------------------------------\1\-------------------------------------------- Small (1-19).............................................. 4.9 18.2 12.1 35.2 Medium (20-99)............................................ 3.0 18.2 13.3 34.5 Large (100-249)........................................... 1.0 5.1 2.8 8.8 Very large (<= 250)...............................="" 0.7="" 2.6="" 0.1="" 3.4="" all="" establishments........................................="" 9.5="" 44.1="" 28.3="" 81.9="" ----------------------------------------------------------------------------------------------------------------="" \1\="" one-time="" costs="" annualized="" over="" five="" years="" at="" discount="" rate="" of="" 10="" percent.="" note:="" totals="" may="" not="" add="" due="" to="" rounding.="" source:="" erg="" (1996),="" section="" 4.="" e.="" benefits="" from="" proposed="" changes="" to="" the="" cgmp="" regulation="" erg="" used="" the="" methodology="" and="" data="" from="" the="" proposed="" rule="" to="" estimate="" the="" benefits="" of="" the="" final="" cgmp="" regulation.="" adjustments="" to="" the="" number="" and="" distribution="" of="" mdr's="" were="" made="" based="" on="" updated="" numbers="" of="" closed="" cases.="" also,="" more="" reliable="" estimates="" of="" industry="" savings="" from="" avoided="" design-related="" recalls="" were="" incorporated.="" the="" changes="" to="" the="" cgmp="" regulation="" will="" provide="" public="" health="" benefits="" to="" medical="" device="" users="" and="" economic="" benefits="" to="" the="" medical="" device="" industry.="" based="" on="" its="" review="" of="" medical="" device="" recalls="" over="" the="" 4-year="" period="" 1988="" to="" 1991,="" fda="" has="" estimated="" that="" 30="" percent="" of="" all="" medical="" device="" product="" recalls="" are="" due="" to="" inadequate="" design="" controls.="" it="" is="" extremely="" difficult="" to="" judge="" how="" many="" of="" these="" recalls="" could="" reasonably="" have="" been="" avoided,="" but="" erg="" judged="" that="" a="" majority="" would="" have="" been="" prevented="" if="" manufacturers="" had="" fully="" implemented="" the="" cgmp="" design="" control="" requirements.="" 1.="" public="" health="" benefits="" erg="" used="" the="" mdr="" database="" to="" estimate="" the="" public="" health="" benefits="" of="" the="" final="" cgmp="" regulation.="" there="" were="" over="" 41,600="" mdr's="" submitted="" to="" fda="" in="" 1991;="" 97="" percent="" of="" these="" mdr's="" are="" closed="" (i.e.,="" a="" review="" of="" the="" case="" is="" completed).="" of="" these="" closed="" cases,="" fda="" determined="" that="" 9.3="" percent="" of="" the="" fatalities="" and="" 12.4="" percent="" of="" the="" serious="" injuries="" were="" due="" to="" device="" failures.="" the="" bulk="" of="" the="" remaining="" incidents="" were="" due="" to="" user="" problems,="" but="" also="" include="" cases="" where="" cause="" could="" not="" be="" clearly="" established.="" to="" estimate="" the="" total="" number="" of="" deaths="" and="" serious="" injuries="" for="" 1991="" by="" cause,="" the="" 1988-1991="" averages="" of="" device="" recalls="" were="" used.="" to="" estimate="" the="" number="" of="" deaths="" and="" serious="" injuries="" due="" to="" design-related="" causes,="" erg="" assumed="" that="" the="" percent="" of="" mdr's="" that="" were="" design-related="" was="" the="" same="" as="" that="" for="" recalls="" (30="">=>5 Based on these assumptions, medical devices contributed to an estimated 49 fatalities and 663 serious injuries in 1991 due to design-related problems in class II and III devices (see Table 5). To correct for the substantial under reporting of MDR's, ERG made an upward adjustment in the number of MDR's of 20 percent for fatalities and 40 percent for serious injuries. The number of estimated fatalities adjusted for underreporting of MDR's would be 59, with 929 serious injuries. --------------------------------------------------------------------------- \5\ There is no code in the MDR database to identify design- related events. Table 5.--Number of Design-Related Reports and Estimated Avoided Deaths and Serious Injuries ---------------------------------------------------------------------------------------------------------------- Fatalities Serious Injuries ----------------------------------------------------------------------- Class II Class III Total Class II Class III Total ---------------------------------------------------------------------------------------------------------------- Number in 1991.......................... 555 475 1,030 4,391 11,794 16,185 Device-related.......................... 105 59 164 330 1,881 2,211 Design-related \1\...................... 32 18 49 99 564 663 Number avoided.......................... 23 13 36 72 412 484 Adjusted number of design-related MDR's \2\.................................... 38 21 59 139 790 929 Adjusted Number avoided................. 28 15 43 101 576 677 ---------------------------------------------------------------------------------------------------------------- \1\ Assumes 30 percent of device-related MDR's are design-related, based on FDA recall data. \2\ Total number of fatalities and injuries increased by 20 and 40 percent, respectively, to adjust for under- reporting. Source: ERG (1996), Section 5. To develop an approximate idea of the preventability of these incidents, ERG convened a panel of industrial engineers and regulatory specialists with extensive experience in the design of medical devices. The panel examined a random sample of 100 design-related medical device recalls and judged whether implementation of design controls could have prevented the recall. ERG found that the expected value of their judgments implied that proper design controls would have prevented about 73 percent of these recalls. Assuming the same preventability ratio for design-related MDR events, ERG calculated that the proposal would prevent about 36 to 43 deaths and 484 to 677 serious injuries per year, depending on the degree of MDR underreporting. To verify the reasonableness of the estimates, FDA examined an alternative method of estimating the number of [Page 52649] fatalities caused by design-related failures. For this calculation, 3 years of design-related recalls were assumed linked to MDR fatalities that occurred for these devices 1 year before or 3 months after the date of the recall. This approach, which provides a conservative estimate because not all relevant fatalities and subsequent MDR's would occur during this limited time period, found that about 60 deaths per year were due to design-related device failures. If 73 percent of such incidents could be avoided through compliance with the proposed CGMP regulation, 44 deaths per year would be prevented. These estimates of the public health benefits from fewer design- related deaths and serious injuries represent FDA's best projections, given the limitations and uncertainties of the data and assumptions. The above numbers, however, do not capture the quality of life losses to patients who experience less severe injuries than those reported in MDR's, who experience anxiety as a result of treatment with an unreliable medical device, or who experience inconvenience and additional medical costs because of device failure. Medical device malfunctions are substantially more numerous than deaths or injuries from device failures and also represent a cost to society. Malfunctions represent a loss of product and an inconvenience to users and/or patients. Additionally, medical device malfunctions burden medical personnel with additional tasks, such as repeating treatments, replacing devices, returning and seeking reimbursement for failed devices, and providing reports on the circumstances of medical device failures. No attempt was made to quantify these additional costs. 2. Industry Benefits The medical device industry would gain substantial economic benefits from the proposed changes to the CGMP regulation in three ways: Cost savings from fewer recalls, productivity gains from improved designs, and efficiency gains for export-oriented manufacturers who would now need to comply with only one set of quality standards. An average of 359 medical device recall events per year were reported to FDA over the period 1988 to 1991. As stated above, FDA estimates that design-related deficiencies contributed to 30 percent of those recall events annually. Applying the 73 percent recall preventability factor, ERG projects that there would be 67 fewer recalls of class II and III devices each year under the final CGMP regulation (see Table 6). Based on data from a recent survey of recall costs, 67 fewer recalls implies that the industry would avoid roughly $29 million worth of recall expenses per year by complying with the final CGMP regulation.6 --------------------------------------------------------------------------- 6 Design-related medical device recalls cost the industry approximately $40 million annually. (Eastern Research Group, Inc. (1994). FDA Survey of Medical Device Recall Costs. (Task Order 3, Contract Number 223-91-8100). Table 6.--Number of Avoided Design-Related Recall Events by Class of Device [FY 1988-FY 1991] ------------------------------------------------------------------------ Average Number of number of avoided design- design- Device class related related recall recall events\1\ events\2\ ------------------------------------------------------------------------ I................................................. 15 NA II................................................ 80 58 III............................................... 12 9 --------------------- All Devices..................................... 107 67 ------------------------------------------------------------------------ \1\ Office of Compliance and Surveillance, CDRH. \2\ ERG estimates based on random sample of 100 design-related recalls. Source: ERG (1996), Section 5. ERG also found that the design control requirements in the final CGMP regulation would require manufacturers to integrate their design and production operations and that most industry experts believe that this change would lead to better quality products, more efficient engineering, lower manufacturing costs, and reduced product development time. These savings, however, could not be quantified. Still another benefit of the revised regulation relates to the harmonization of the final CGMP regulation with the ISO 9001:1994 international standard. This change would especially benefit export- oriented establishments, because they would need to meet only one set of quality standards. ERG could not derive quantitative measures of this benefit. However, 65 percent of innovative medical device companies export their products, thus a majority should benefit from harmonization of CGMP regulation between major trading partners.7 --------------------------------------------------------------------------- 7 ERG (1994). FDA Survey of Establishments Introducing New Medical Devices. (Task Order 3, Contract No. 223-91-8100.) --------------------------------------------------------------------------- F. Economic and Small Business Impact The ability of medical device establishments to pass on the added cost of the final regulation will determine the economic impact to the industry. The diversity of medical devices precludes any easy characterization of their product markets. Under the current medical care system, however, the demand for many medical devices tends to be price inelastic because they are often prescribed by physicians and frequently paid for by third parties. Thus, small price increases have not typically prompted significant declines in industry sales. Nonetheless, competitive pressures have increased substantially under new health care cost-containment measures. Therefore, to examine the potential effect of the costs of compliance on the industry's competitive structure, ERG calculated the maximum impact on industry average prices and products, using extreme scenarios. Financial data characterizing the scope of FDA-regulated medical device establishments are not available. To make estimates of the regulatory impact on price and profits, ERG used a combination of census and Dun and Bradstreet data (see ERG (1993) for methodology). ERG assumed that the firms characterized in these data sources had the same size and product distribution, and introduced new products at the same rate as the population of FDA-regulated establishments. While the validity of these assumptions is uncertain, it was the only data available to measure regulatory impact. ERG presents two extreme scenarios, the first reflects the magnitude of the potential impact on product prices if all costs were passed forward. The second demonstrates the maximum drop in profits if no costs were passed forward. In reality, some combination of these scenarios will occur. Based on the assumption that all costs of compliance are passed through to the end user, with no loss in sales and no offset for avoided recalls or other industry productivity gains, ERG found that the average increase in the price of medical devices would be less than 0.13 percent. Estimated price increases ranged from 0.04 percent for X- Ray Apparatus and Tubes (SIC 3844) to 0.34 percent for Dental Equipment and Supplies (SIC 3843) (see Table 7). The maximum price increase was calculated using aggregate compliance costs as a percentage of the value of shipments. The price increases calculated by size of establishment suggest that small establishments will be under greater pressure to increase prices. The cost of compliance represented an average of 1.36 percent of the value of shipments for small establishments and 0.01 percent for very large establishments. These differences in impacts by size reflect the finding that small [Page 52650] establishments have lower current compliance than large establishments. To estimate the potential impact of compliance costs on medical device industry profits, ERG calculated after-tax compliance costs as a percentage of after-tax income for each medical device SIC (see Table 7). Again, no adjustments were made for avoided recalls or expected productivity gains. If manufacturers have no ability to increase prices to offset the increase in compliance costs, this estimate represents an upper bound of the potential effect on entity income. Under these circumstances, the medical device sectors could incur reductions in income ranging from about 0.81 percent (SIC 3845, Electromedical Equipment) to about 4.27 percent (SIC 3843, Dental Equipment and Supplies). ERG concluded that such impacts may affect some establishments' decisions to develop new products where expected profits are marginal or highly uncertain, but judged that the level of incremental costs imposed by this regulation would not substantially lower the innovation rate especially for products with significant medical benefits. Table 7.--Maximum Potential Impact on Price or Profits by Industry and Employment Size ------------------------------------------------------------------------ Total annualized After-tax compliance compliance costs as a costs as a percentage percentage of of after- shipments tax income ------------------------------------------------------------------------ Industry: 3841 Surgical and medical instruments......... 0.12 2.00 3842 Surgical appliance and supplies.......... 0.14 1.78 3843 Dental equipment and supplies............ 0.34 4.27 3844 x-ray apparatus and tubes................ 0.04 0.88 3845 Electromedical equipment................. 0.05 0.81 3851 Ophthalmic goods......................... 0.24 3.54 All........................................... 0.13 1.87 Establishment size: Small (1-19).................................. 1.36 NA Medium (20-99)................................ 0.35 NA Large (100-249)............................... 0.09 NA Very large (<= 250)...................="" 0.01="" na="" all...........................................="" 0.13="" na="" ------------------------------------------------------------------------="" na="not" available.="" source:="" erg="" (1996),="" section="" 6.="" the="" regulatory="" flexibility="" act="" requires="" agencies="" to="" analyze="" regulatory="" options="" that="" would="" minimize="" any="" significant="" impact="" of="" a="" rule="" on="" small="" entities.="" this="" section="" together="" with="" other="" discussions="" in="" this="" preamble="" and="" supporting="" analysis="" and="" materials="" constitute="" the="" agency's="" regulatory="" flexibility="" analysis.="" a="" description="" of="" the="" projected="" reporting,="" recordkeeping,="" and="" compliance="" requirements="" including="" the="" type="" of="" professional="" skills="" required="" is="" included="" in="" the="" erg="" economic="" analysis="" reports="" that="" are="" referenced="" above="" and="" on="" file="" at="" the="" dockets="" management="" branch="" (address="" above).="" in="" accordance="" with="" the="" regulatory="" flexibility="" act,="" fda="" has="" considered="" the="" effect="" of="" this="" action="" on="" small="" businesses="" and="" has="" determined="" that="" there="" will="" be="" a="" significant="" impact="" on="" a="" substantial="" number="" of="" small="" businesses.="" almost="" all="" medical="" device="" establishments="" are="" classified="" as="" small="" under="" the="" small="" business="" administrations="" definition="" of="">=>8 The incremental costs are greatest for establishments that design medical devices and that currently have lower levels of compliance with the new design control requirements. These requirements account for 70 percent of the total incremental costs of the final rule but affect only design and production manufacturers and specification developers (82 percent of the total affected establishments). Other sectors of the industry will incur substantially lower costs (see Table 3). --------------------------------------------------------------------------- 8 The Small Business Administrations definition is by the employment size at the company level. Detailed demographic and financial data is not available by company size, therefore FDA used establishment data. FDA does not know the impact on companies. --------------------------------------------------------------------------- The actual added cost per establishment will vary by the establishment's current level of compliance, complexity of product design, product type, and rate of product innovation. As indicated in Table 3, the average medium-size and large manufacturers of devices will incur greater compliance costs ($25,800 and $22,748 per establishment, respectively) relative to small and very large establishments ($11,085 and $12,258, respectively). However, the potential impact on product price (measured as a percent of the value of shipments) is greatest for small (1.36 percent) and medium-size (0.35 percent) establishments. Large and very large establishments will incur only a 0.09 percent and 0.01 percent increase, respectively, due to much larger values of shipments and higher rates of compliance with the final rule. Smaller establishments producing differentiated products or marketing to niche markets may not be at a disadvantage because of their ability to pass on the added cost of compliance. However, those smaller establishments that compete with larger establishments based on price alone would suffer a drop in profits if they currently operate at lower levels of compliance than their competitors. FDA believes that actual per establishment compliance costs will be lower than estimated for the following reasons: First, the final CGMP regulation closely parallels the ISO 9001:1994 quality standards, which have been adopted as the quality standard for the EU and are becoming the international quality standards for medical devices. Close to 65 percent of domestic medical device manufacturers export their products and generate approximately one-third of their sales from exports.9 Compliance with the quality control requirements is necessary for firms to maintain international competitiveness and in fact many U.S. medical device manufacturers have become ISO certified since the 1993 publication of the proposed CGMP regulation and the EU implementation of unified regulatory requirements. --------------------------------------------------------------------------- 9 ERG (1994). FDA Survey of Establishments Introducing New Medical Devices. (Task Order 3, Contract No. 223-91-8100.) --------------------------------------------------------------------------- Second, the FDA has extended the effective date of the final rule to June 1, 1997, and has chosen not to take regulatory action for an additional year on the design control requirements. This revised effective date will also reduce the cost of implementation estimated for the 1993 proposal where the proposed effective date was only 180 days after date of publication. The extension will give manufacturers a longer time to implement the new requirements, allowing the costs to be spread over almost a 2-year period as compared to 180 days. June 1998 coincides with the implementation of the EU's Inactive Medical Device Directive. Therefore, the economic impact of complying with the new quality system regulation will be shared with the economic impact of complying with the new EU Medical Device Directive for any manufacturer who also produces devices for sale in the EU, lessening the direct impact of the new quality system regulation. Third, ERG estimates of the number of labor hours needed for design controls assume that many establishments have little or no formal system in place. Once an establishment has developed a system, minor modifications to an establishment's existing product (for which many 510(k) applications and PMA supplements are submitted) may be less costly than ERG assumed. [Page 52651] Finally, cost estimates assume that establishments will use in- house expertise or hired consultants for all compliance activities. In fact, FDA and trade publications have disseminated much of the information that would be needed by the firms. FDA has taken many steps specifically to assist small businesses in complying with this final rule. The two stage implementation of the regulation was a concerted effort to reduce the regulatory burden on small businesses. Stage 1 was set up to be a 1 year training and cooperative phase for the entire medical device community. FDA and industry would be participating in a number of cooperative efforts as well as joint training exercises. Most importantly, FDA would be evaluating design controls and providing industry with feedback in the nature of a report. During this time, to truly allow it to be a learning experience for both the device manufacturers and the FDA investigators, there would be no regulatory actions taken as a result of these evaluations and reports. The biggest benefactor of the two stage implementation would clearly be small businesses. Further, several guidances have been prepared by FDA for this regulation as a whole, as well as on subject matters that are significant in this final rule. FDA plans to release the following three guidances within 60 days after the final rule is published: (1) DSMA's ``Medical Device Quality Systems Manual: A Small Entity Compliance Guide,'' which includes discussion on the entire regulation plus multiple examples of procedures and forms that can be adopted and modified by manufacturers; (2) ``Design Control Guidance For Medical Device Manufacturers,'' which is intended to assist manufacturers in understanding the intent of the design control requirements. Assistance is provided by interpreting the language of the regulation and explaining the underlying concepts in practical terms; and (3) ``Do It By Design: An Introduction to Human Factors in Medical Devices,'' which contains background information about human factors as a discipline, descriptions and illustrations of device problems, and a discussion of human factors principles and methods as a part of the design control system. FDA also plans to release the following guidances after publication of this final rule: (1) A guidance on ``Validation,'' which will include discussions on design validation, computer validation, and process validation; and (2) a draft of the ``Design Control Inspectional Strategy,'' which will be the questions that FDA investigators will be asking when assuring compliance with the design control requirements. FDA is also prepared to release shortly after publication of this final rule a 4 hour series of videotapes discussing the Quality System Regulation. The videotapes will also be accompanied by a guidebook entitled ``The FDA and World Wide Quality System Requirements Guidebook For Medical Devices.'' This guidebook will contain the entire Quality System Regulation from FDA, the entire text of ISO 9001:1994, FDA guidance from the regulation's preamble, and guidance on quality systems from the GHTF. FDA has also tentatively scheduled two teleconferences. The first teleconference, which would be to discuss the Quality System Regulation and answer questions that have come up from manufacturers beginning to implement the regulation, is tentatively scheduled for December 1996. A second teleconference is tentatively scheduled for April/May of 1997 and will specifically address design controls and the final Design Control Inspectional Strategy. FDA is also exploring the possibility of conducting regional workshops in May of 1997 to further discuss the design control requirements and their implementation. In addition to these activities, FDA and DSMA will continue to provide guidance and workshops that can help small business with their compliance activities, and will continue to participate in industry association workshops, conferences, and meetings. While all of the above-mentioned activities will be available to all manufacturers, small manufacturers will benefit the most from these FDA activities without having to pay substantial costs, as most of the guidance and written material will be available on the world wide web, and the teleconferences and other workshops sponsored or cosponsored by FDA will be of nominal cost. Finally, as described elsewhere in this preamble, FDA intends to conduct a midcourse review of the new design control requirements during the transition year (June 1997 to June 1998). Specifically, the results of the first several months of design control inspections will be reviewed by early 1998, and any midcourse adjustments to the inspectional strategy will be instituted and made public by the Spring of 1998. Also during this midcourse review FDA will evaluate the information gathered at that point and determine if the design control requirements as written in this final rule are appropriate to obtain the goals expressed in this preamble. Any necessary adjustments or proposed revisions will be published in the Federal Register and comments will be solicited as necessary during the spring of 1998. This implementation strategy is responsive to requests by industry for FDA to harmonize the quality system regulation's implementation with the mandatory date for implementation of the EU's Medical Device Directive, which is June 1998. However, if during the midcourse review of stage one it is determined that the industry and/or FDA needs more time to fully implement the design control requirements, FDA will publish that decision in the Spring of 1998 prior to the June 1, 1998, regulatory implementation date. Small businesses will also benefit in that FDA considered but rejected applying design requirements to all class I devices, because the added benefits to public health were not great enough to offset the increased burden on industry. Two requirements were eliminated or modified in the final rule that decreased the burden on industry: The applicability of the CGMP regulation to component suppliers was removed, and Sec. 820.65 Traceability was limited to traceability of components where necessary to assure the protection of public health. These changes will particularly aid small businesses. In addition, revisions were made to many requirements in the final rule to make it less prescriptive and to allow establishments greater flexibility in implementing the requirements. Cost savings from these changes were not estimated. In addition, revisions were made to many requirements in the final rule to make it less comprehensive in scope, less prescriptive and to allow establishments greater flexibility in implementing the requirements. Cost savings from these changes were not estimated. Based on the above, the agency has determined that the current rule represents the least burdensome alternative that meets the public health goal of reducing deaths and serious injuries attributable to defective medical devices. In summary, FDA concludes that the estimated $81.9 million annual incremental cost to comply with the final CGMP regulation is likely an upward bound figure and that it would be substantially offset by significant savings from avoided recalls and more importantly, the avoidance of deaths and serious injuries due to design-related device failures. FDA's estimate of public health benefits includes the [Page 52652] prevention of 36 to 44 deaths and 484 to 677 serious injuries annually. Establishing design controls will also result in better designed and higher quality devices and fewer device failures. This quality improvement will in turn reduce the inconvenience and expense of repetitive treatments or diagnoses. The agency also believes the actual cost to comply with the final rule will be lower than estimated because the industry compliance baselines used to estimate costs are from 1993. Since that time, market pressures have induced many firms that export to the EU to become ISO 9001:1994 certified. These firms would now be in compliance with most of FDA's final CGMP regulation. Further, FDA has provided continued education efforts over the past 15 years, to mitigate industry costs. IX. Paperwork Reduction Act of 1995 This final rule contains information collections that are subject to review by OMB under the Paperwork Reduction Act of 1995 (Pub. L. 104-13). The title, description and respondents of the information collection are shown below with an estimate of the annual incremental increase in the recordkeeping burden that respondents must undertake to achieve compliance with the final regulation. Title: Medical Devices, Quality System Regulations, Current Good Manufacturing Practice Requirements. Description: This final quality system regulation amends and revises the current good manufacturing practice requirements for medical devices, set out at 21 CFR part 820. This final regulation replaces quality assurance program requirements with quality system requirements; adds design and purchasing controls; modifies the critical device requirements; revises certain existing requirements, such as validation and management responsibility, to clarify the intent of the requirements; and harmonizes the CGMP regulations for medical devices with quality system specifications in ISO 9001:1994 ``Quality Systems-Model for Quality Assurance in Design, Development, Production, Installation and Servicing.'' Description of Respondents: Business or other for-profit and small businesses or organizations. -------------------------------------------------------------------------------------------------------------------------------------------------------- Total Number of Annual Total annual Hours per operating and CFR section record-keepers frequency of records record-keeper Total hours maintenance recordkeeping costs -------------------------------------------------------------------------------------------------------------------------------------------------------- 820.20(a)............................................... 7,237 1 7,237 10.96 79,386 .............. 820.20(b)............................................... 7,237 1 7,237 4.88 35,285 .............. 820.20(c)............................................... 7,237 1 7,237 10.28 74,364 .............. 820.20(d)............................................... 7,237 1 7,237 16.49 119,305 .............. 820.20(e)............................................... 7,237 1 7,237 16.49 119,305 .............. 820.22(a)............................................... 7,237 1 7,237 52.03 376,507 .............. 820.25(b)............................................... 7,237 1 7,237 21.13 152,896 .............. 820.30(a)(1)............................................ 7,237 1 7,237 2.92 21,162 .............. 820.30(b)............................................... 7,237 1 7,237 9.91 71,718 .............. 820.30(c)............................................... 7,237 1 7,237 2.92 21,162 .............. 820.30(d)............................................... 7,237 1 7,237 2.92 21,162 .............. 820.30(e)............................................... 7,237 1 7,237 38.98 282,115 .............. 820.30(f)............................................... 7,237 1 7,237 62.37 451,342 $27,359,420 820.30(g)............................................... 7,237 1 7,237 62.37 451,342 .............. 820.30(h)............................................... 7,237 1 7,237 5.56 40,236 .............. 820.30(i)............................................... 7,237 1 7,237 28.77 208,173 .............. 820.30(j)............................................... 7,237 1 7,237 4.40 31,848 .............. 820.40.................................................. 7,237 1 7,237 11.76 85,081 .............. 820.40(b)............................................... 7,237 1 7,237 .............. .............. .............. 820.50 (a)(1) to (a)(3)................................. 7,237 1 7,237 31.12 225,240 898,500 820.50(b)............................................... 7,237 1 7,237 10.04 72,679 820.60.................................................. 7,237 1 7,237 0.54 3,914 .............. 820.65.................................................. 7,237 1 7,237 .............. .............. .............. 820.70 (a)(1) to (a)(5)................................. 7,237 1 7,237 .............. .............. .............. 820.70 (b)-(c).......................................... 7,237 1 7,237 .............. .............. .............. 820.70(d)............................................... 7,237 1 7,237 3.09 22,335 .............. 820.70(e)............................................... 7,237 1 7,237 .............. .............. .............. 820.70 (g)(1) to (g)(3)................................. 7,237 1 7,237 .............. 820.70(h)............................................... 7,237 1 7,237 .............. .............. .............. 820.70(i)............................................... 7,237 1 7,237 9.41 68,092 .............. 829.72(a)............................................... 7,237 1 7,237 5.83 42,165 .............. 820.72 (b)(1) to (b)(3)................................. 7,237 1 7,237 .............. .............. .............. 820.75(a)............................................... 7,237 1 7,23 72.79 20,172 .............. 820.75(b)............................................... 7,237 1 7,237 .............. .............. .............. 820.75(b)(2)............................................ 7,237 1 7,237 0.15 1,096 .............. 820.75(c)............................................... 7,237 1 7,237 0.15 1,096 .............. 820.80 (a)-(e).......................................... 7,237 1 7,237 .............. .............. .............. 820.86.................................................. 7,237 1 7,237 .............. .............. .............. 820.90(a)............................................... 7,237 1 7,237 6.11 44,217 .............. 820.90 (b)(1) to (b)(2)................................. 7,237 1 7,237 6.11 44,217 .............. 820.100 (a)(1) to (a)(7)................................ 7,237 1 7,237 20.06 145,144 .............. 820.100(b).............................................. 7,237 1 7,237 .............. .............. .............. 820.120................................................. 7,237 1 7,237 .............. .............. .............. 820.120(b).............................................. 7,237 1 7,237 .............. .............. .............. 820.120(d).............................................. 7,237 1 7,237 .............. .............. .............. 820.130................................................. 7,237 1 7,237 .............. .............. .............. 820.140................................................. 7,237 1 7,237 9.45 68,418 .............. 820.150 (a)-(b)......................................... 7,237 1 7,237 9.45 68,418 .............. 820.160 (a)-(b)......................................... 7,237 1 7,237 .............. .............. .............. [Page 52653] 820.170 (a)-(b)......................................... 7,237 1 7,237 .............. .............. .............. 820.180................................................. 7,237 1 7,237 .............. .............. .............. 820.181 (a)-(e)......................................... 7,237 1 7,237 .............. .............. .............. 820.184 (a)-(f)......................................... 7,237 1 7,237 .............. .............. .............. 820.186................................................. 7,237 1 7,237 .............. .............. .............. 820.198 (a)-(c)......................................... 7,237 1 7,237 3.71 26,850 .............. 820.200(a) and 820.200(d)............................... 7,237 1 7,237 4.35 31,459 .............. 820.250................................................. 7,237 1 7,237 .............. .............. .............. ----------------------------------------------------------------------------------------------- Totals.............................................. 7,237 1 7,237 487.50 3,527,901 28,257,920 -------------------------------------------------------------------------------------------------------------------------------------------------------- \1\ Incremental increase in hours and costs to achieve compliance with additional requirements. Note: Totals may not add due to rounding Under OMB information collection 0910-0073, which expired on June 30, 1995, there were 375,266 burden hours approved for recordkeeping requirements currently contained in part 820 to include 114,882 burden hours as a one time start up expenditure for 750 new firms. The additional requirements contained in this final rule will add 3,527,901 burden hours to the burden, resulting in a total annual recordkeeping burden of 3,903,167 hours. The 3,527,901 burden hours includes 1,433,579 burden hours for a one time start up expenditure for 7,237 manufacturers and 2,094,321 burden hours expended annually by 7,237 manufacturers. The final rule estimate of recordkeeping burden includes about 9.6 times as many manufacturers with a one time start up expenditure, due to the addition of the design control requirements, than did FDA's estimate of the manufacturers that would have had a one time start up expenditure under the old regulation. Further the recordkeeping burden hour calculations for the new regulation were done under contract using a more complex methodology involving the estimated noncompliance ratio for small, medium, large, and very large manufacturers (as defined above) times the number of manufacturers in each category and factors in a rate of product innovation for new products, including 510(k) devices. This methodology is more precise than the methodology previously utilized. Therefore, it is very difficult to directly compare the total burden hours in this final rule as compared to the estimated burden hours filed for the old regulation which expired June 1995. Approximately 85 percent of the additional burden hours for the final rule are from the following four subparts of part 820: (1) Subpart B--Quality System Requirements; (2) Subpart C--Design Controls; (3) Subpart E--Purchasing Controls; and (4) Subpart J--Corrective and Preventive Action. Over 45 percent of the 3,527,901 burden hours are attributed directly to the addition of design control requirements. The recordkeeping burden hours for design control are significant because of the nature of the new requirements, as well as in response to numerous comments on the 1993 and 1995 proposals. The comments requested that the regulation focus on procedures required under design control as compared to prescriptive requirements on the design activities. The quality system requirements, as well as the corrective and preventive action requirements combined are approximately 31 percent of the additional recordkeeping burden hours and were in response to two major issues: (1) Most importantly, FDA had identified these two areas as two of the top four deficiencies found during inspections of the medical device industry, across all sizes of manufacturers; and (2) numerous comments requested harmonization with the ISO 9000 series standards. The involvement of management with executive responsibility, the concept of a total quality system which is a closed feedback loop system, and the practice of using that closed loop system in taking appropriate corrective and preventive action is paramount in ensuring that safe and effective medical devices are available to the public. The purchasing control requirements and the respective recordkeeping burden are approximately 8 percent of the additional recordkeeping burden. Purchasing requirements were the overwhelming choice of the medical device industry as compared to the option of the final rule encompassing component manufacturers. See the discussion in section V.7. of this document. It is important to note that small manufacturers may comply with this final rule with less procedures and paperwork than larger manufacturers of the same product because the structure and interfaces for a small manufacturer often require less documentation and paperwork. Although the November 23, 1993, proposed rule provided a 90 day comment period under the Paperwork Reduction Act of 1980, and this final rule incorporates the comments received, as required by 44 U.S.C. section 3507(d), FDA is providing additional opportunities for public comment under the Paperwork Reduction Act of 1995, which applies to this final rule and was enacted after the expiration of the comment period. Therefore, the agency solicits public comment on the information collection requirements in order to: (1) Evaluate whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information will have practical utility; (2) evaluate the accuracy of the agency's estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions used; (3) enhance the quality, utility, and clarity of the information to be collected; and (4) minimize the burden of the collection of information on those who are to respond, including through the use of appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submission of responses. Individuals and organizations may submit comments on the information collection requirements by December 6, 1996, and should direct comments to FDA's Dockets Management Branch (address above). Prior to the effective date of this final rule, FDA will publish a notice in the Federal Register when the information collection requirements in this rule are submitted for OMB approval, and again when OMB makes a decision to approve, modify, or disapprove the [Page 52654] information collection requirements. Persons are not required to respond to a collection of information unless it displays a currently valid OMB control number. X. Congressional Review This final rule has been determined to be a major rule for purposes of 5 U.S.C. 801 et seq., Subtitle E of the Small Business Regulatory Enforcement Fairness Act of 1996 (Pub. L. 104-121). FDA is submitting the information and reports as required by that statute. XI. References The following references have been placed on display in the Dockets Management Branch and may be seen by interested persons between 9 a.m. and 4 p.m., Monday through Friday. 1. ``Device Recalls: A Study of Quality Problems,'' FDA, Center for Devices and Radiological Health, Rockville, MD 20857, HHS Publication FDA 90-4235, January 1990. 2. ``FDA Medical Device Regulation From Premarket Review to Recall,'' Office of Inspector General, Washington, DC, HHS Publication OEI 09-90-00040, February 1991. 3. ``Software Related Recalls for Fiscal Years FY 83--FY 91,'' FDA, Center for Devices and Radiological Health, Rockville, MD 20857, May 1992. 4. ISO 9001:1994 ``Quality Systems-- Model for Quality Assurance in Design, Development, Production, Installation, and Servicing.'' 5. ISO draft revision of ISO/CD 13485 ``Quality Systems--Medical Devices-- Supplementary Requirements to ISO 9001.'' 6. Federal Register notice entitled ``Medical Devices; Current Good Manufacturing Practices (CGMP) Regulations Document; Suggested Changes; Availability,'' November 30, 1990 (55 FR 49644). 7. Federal Register notice entitled ``Medical Devices; Current Good Manufacturing Practice (CGMP) Regulations; Proposed Revisions; Request for Comments,'' November 23, 1993 (55 FR 61952). 8. Federal Register notice entitled ``Medical Devices; Working Draft of the Current Good Manufacturing Practice (CGMP) Final Rule; Notice of Availability; Request for Comments; Public Meeting,'' July 24, 1995 (60 FR 37856). 9. European Standard (EN) 46001 ``Quality Systems--Medical Devices--Particular Requirements for the Application of EN 29001.'' 10. ``Guidelines on General Principles of Process Validation,'' Center for Drugs and Biologics, and Center for Devices and Radiological Health, FDA, Rockville, MD 20857, May 11, 1987. 11. ``Medical Devices; Early Warning of Problems Is Hampered by Severe Underreporting,'' United States General Accounting Office, Washington, DC, GAO/PEMD-87-1. List of Subjects 21 CFR Part 808 Intergovernmental relations, Medical devices. 21 CFR Part 812 Health records, Medical devices, Medical research, Reporting and recordkeeping requirements. 21 CFR Part 820 Medical devices, Reporting and recordkeeping requirements. Therefore, under the Federal Food, Drug, and Cosmetic Act and under authority delegated to the Commissioner of Food and Drugs, 21 CFR parts 808, 812, and 820 are amended as follows: PART 808--EXEMPTIONS FROM FEDERAL PREEMPTION OF STATE AND LOCAL MEDICAL DEVICE REQUIREMENTS 1. The authority citation for 21 CFR part 808 is revised to read as follows: Authority: Secs. 520, 521, 701 of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 360j, 360k, 371). 2. Section 808.1 is amended by adding new paragraph (d)(10) to read as follows: Sec. 808.1 Scope. * * * * * (d) * * * (10) Part 820 of this chapter (21 CFR part 820) (CGMP requirements) does not preempt remedies created by States or Territories of the United States, the District of Columbia, or the Commonwealth of Puerto Rico. * * * * * PART 812--INVESTIGATIONAL DEVICE EXEMPTIONS 3. The authority citation for 21 CFR part 812 is revised to read as follows: Authority: Secs. 301, 501, 502, 503, 505, 506, 507, 510, 513- 516, 518-520, 701, 702, 704, 721, 801, 803 of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 331, 351, 352, 353, 355, 356, 357, 360, 360c-360f, 360h-360j, 371, 372, 374, 379e, 381, 383); secs. 215, 301, 351, 354-360F of the Public Health Service Act (42 U.S.C. 216, 241, 262, 263b-263n). 4. Section 812.1 Scope is amended by revising the fourth sentence of paragraph (a) to read as follows: Sec. 812.1 Scope. (a) * * * An IDE approved under Sec. 812.30 or considered approved under Sec. 812.2(b) exempts a device from the requirements of the following sections of the Federal Food, Drug, and Cosmetic Act (the act) and regulations issued thereunder: Misbranding under section 502 of the act, registration, listing, and premarket notification under section 510, performance standards under section 514, premarket approval under section 515, a banned device regulation under section 516, records and reports under section 519, restricted device requirements under section 520(e), good manufacturing practice requirements under section 520(f) except for the requirements found in Sec. 820.30, if applicable (unless the sponsor states an intention to comply with these requirements under Sec. 812.20(b)(3) or Sec. 812.140(b)(4)(v)) and color additive requirements under section 721. * * * * * 5. Part 820 is revised to read as follows: PART 820--QUALITY SYSTEM REGULATION Subpart A--General Provisions Sec. 820.1 Scope. 820.3 Definitions. 820.5 Quality system. Subpart B--Quality System Requirements 820.20 Management responsibility. 820.22 Quality audit. 820.25 Personnel. Subpart C--Design Controls 820.30 Design controls. Subpart D--Document Controls 820.40 Document controls. Subpart E--Purchasing Controls 820.50 Purchasing controls. Subpart F--Identification and Traceability 820.60 Identification. 820.65 Traceability. Subpart G--Production and Process Controls 820.70 Production and process controls. 820.72 Inspection, measuring, and test equipment. 820.75 Process validation. Subpart H--Acceptance Activities 820.80 Receiving, in-process, and finished device acceptance. 820.86 Acceptance status. Subpart I--Nonconforming Product 820.90 Nonconforming product. Subpart J--Corrective and Preventive Action 820.100 Corrective and preventive action. Subpart K--Labeling and Packaging Control 820.120 Device labeling. 820.130 Device packaging. Subpart L--Handling, Storage, Distribution, and Installation 820.140 Handling. 820.150 Storage. [Page 52655] 820.160 Distribution. 820.170 Installation. Subpart M--Records 820.180 General requirements. 820.181 Device master record. 820.184 Device history record. 820.186 Quality system record. 820.198 Complaint files. Subpart N--Servicing 820.200 Servicing. Subpart O--Statistical Techniques 820.250 Statistical techniques. Authority: Secs. 501, 502, 510, 513, 514, 515, 518, 519, 520, 522, 701, 704, 801, 803 of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 351, 352, 360, 360c, 360d, 360e, 360h, 360i, 360j, 360l, 371, 374, 381, 383). Subpart A--General Provisions Sec. 820.1 Scope. (a) Applicability. (1) Current good manufacturing practice (CGMP) requirements are set forth in this quality system regulation. The requirements in this part govern the methods used in, and the facilities and controls used for, the design, manufacture, packaging, labeling, storage, installation, and servicing of all finished devices intended for human use. The requirements in this part are intended to ensure that finished devices will be safe and effective and otherwise in compliance with the Federal Food, Drug, and Cosmetic Act (the act). This part establishes basic requirements applicable to manufacturers of finished medical devices. If a manufacturer engages in only some operations subject to the requirements in this part, and not in others, that manufacturer need only comply with those requirements applicable to the operations in which it is engaged. With respect to class I devices, design controls apply only to those devices listed in Sec. 820.30(a)(2). This regulation does not apply to manufacturers of components or parts of finished devices, but such manufacturers are encouraged to use appropriate provisions of this regulation as guidance. Manufacturers of human blood and blood components are not subject to this part, but are subject to part 606 of this chapter. (2) The provisions of this part shall be applicable to any finished device as defined in this part, intended for human use, that is manufactured, imported, or offered for import in any State or Territory of the United States, the District of Columbia, or the Commonwealth of Puerto Rico. (3) In this regulation the term ``where appropriate'' is used several times. When a requirement is qualified by ``where appropriate,'' it is deemed to be ``appropriate'' unless the manufacturer can document justification otherwise. A requirement is ``appropriate'' if nonimplementation could reasonably be expected to result in the product not meeting its specified requirements or the manufacturer not being able to carry out any necessary corrective action. (b) Limitations. The quality system regulation in this part supplements regulations in other parts of this chapter except where explicitly stated otherwise. In the event that it is impossible to comply with all applicable regulations, both in this part and in other parts of this chapter, the regulations specifically applicable to the device in question shall supersede any other generally applicable requirements. (c) Authority. Part 820 is established and issued under authority of sections 501, 502, 510, 513, 514, 515, 518, 519, 520, 522, 701, 704, 801, 803 of the act (21 U.S.C. 351, 352, 360, 360c, 360d, 360e, 360h, 360i, 360j, 360l, 371, 374, 381, 383). The failure to comply with any applicable provision in this part renders a device adulterated under section 501(h) of the act. Such a device, as well as any person responsible for the failure to comply, is subject to regulatory action. (d) Foreign manufacturers. If a manufacturer who offers devices for import into the United States refuses to permit or allow the completion of a Food and Drug Administration (FDA) inspection of the foreign facility for the purpose of determining compliance with this part, it shall appear for purposes of section 801(a) of the act, that the methods used in, and the facilities and controls used for, the design, manufacture, packaging, labeling, storage, installation, or servicing of any devices produced at such facility that are offered for import into the United States do not conform to the requirements of section 520(f) of the act and this part and that the devices manufactured at that facility are adulterated under section 501(h) of the act. (e) Exemptions or variances. (1) Any person who wishes to petition for an exemption or variance from any device quality system requirement is subject to the requirements of section 520(f)(2) of the act. Petitions for an exemption or variance shall be submitted according to the procedures set forth in Sec. 10.30 of this chapter, the FDA's administrative procedures. Guidance is available from the Center for Devices and Radiological Health, Division of Small Manufacturers Assistance, (HFZ-220), 1350 Piccard Dr., Rockville, MD 20850, U.S.A., telephone 1-800-638-2041 or 1-301-443-6597, FAX 301-443-8818. (2) FDA may initiate and grant a variance from any device quality system requirement when the agency determines that such variance is in the best interest of the public health. Such variance will remain in effect only so long as there remains a public health need for the device and the device would not likely be made sufficiently available without the variance. Sec. 820.3 Definitions. (a) Act means the Federal Food, Drug, and Cosmetic Act, as amended (secs. 201-903, 52 Stat. 1040 et seq., as amended (21 U.S.C. 321-394)). All definitions in section 201 of the act shall apply to the regulations in this part. (b) Complaint means any written, electronic, or oral communication that alleges deficiencies related to the identity, quality, durability, reliability, safety, effectiveness, or performance of a device after it is released for distribution. (c) Component means any raw material, substance, piece, part, software, firmware, labeling, or assembly which is intended to be included as part of the finished, packaged, and labeled device. (d) Control number means any distinctive symbols, such as a distinctive combination of letters or numbers, or both, from which the history of the manufacturing, packaging, labeling, and distribution of a unit, lot, or batch of finished devices can be determined. (e) Design history file (DHF) means a compilation of records which describes the design history of a finished device. (f) Design input means the physical and performance requirements of a device that are used as a basis for device design. (g) Design output means the results of a design effort at each design phase and at the end of the total design effort. The finished design output is the basis for the device master record. The total finished design output consists of the device, its packaging and labeling, and the device master record. (h) Design review means a documented, comprehensive, systematic examination of a design to evaluate the adequacy of the design requirements, to evaluate the capability of the design to meet these requirements, and to identify problems. (i) Device history record (DHR) means a compilation of records containing the production history of a finished device. (j) Device master record (DMR) means a compilation of records containing the procedures and specifications for a finished device. [Page 52656] (k) Establish means define, document (in writing or electronically), and implement. (l) Finished device means any device or accessory to any device that is suitable for use or capable of functioning, whether or not it is packaged, labeled, or sterilized. (m) Lot or batch means one or more components or finished devices that consist of a single type, model, class, size, composition, or software version that are manufactured under essentially the same conditions and that are intended to have uniform characteristics and quality within specified limits. (n) Management with executive responsibility means those senior employees of a manufacturer who have the authority to establish or make changes to the manufacturer's quality policy and quality system. (o) Manufacturer means any person who designs, manufactures, fabricates, assembles, or processes a finished device. Manufacturer includes but is not limited to those who perform the functions of contract sterilization, installation, relabeling, remanufacturing, repacking, or specification development, and initial distributors of foreign entities performing these functions. (p) Manufacturing material means any material or substance used in or used to facilitate the manufacturing process, a concomitant constituent, or a byproduct constituent produced during the manufacturing process, which is present in or on the finished device as a residue or impurity not by design or intent of the manufacturer. (q) Nonconformity means the nonfulfillment of a specified requirement. (r) Product means components, manufacturing materials, in- process devices, finished devices, and returned devices. (s) Quality means the totality of features and characteristics that bear on the ability of a device to satisfy fitness-for-use, including safety and performance. (t) Quality audit means a systematic, independent examination of a manufacturer's quality system that is performed at defined intervals and at sufficient frequency to determine whether both quality system activities and the results of such activities comply with quality system procedures, that these procedures are implemented effectively, and that these procedures are suitable to achieve quality system objectives. (u) Quality policy means the overall intentions and direction of an organization with respect to quality, as established by management with executive responsibility. (v) Quality system means the organizational structure, responsibilities, procedures, processes, and resources for implementing quality management. (w) Remanufacturer means any person who processes, conditions, renovates, repackages, restores, or does any other act to a finished device that significantly changes the finished device's performance or safety specifications, or intended use. (x) Rework means action taken on a nonconforming product so that it will fulfill the specified DMR requirements before it is released for distribution. (y) Specification means any requirement with which a product, process, service, or other activity must conform. (z) Validation means confirmation by examination and provision of objective evidence that the particular requirements for a specific intended use can be consistently fulfilled. (1) Process validation means establishing by objective evidence that a process consistently produces a result or product meeting its predetermined specifications. (2) Design validation means establishing by objective evidence that device specifications conform with user needs and intended use(s). (aa) Verification means confirmation by examination and provision of objective evidence that specified requirements have been fulfilled. Sec. 820.5 Quality system. Each manufacturer shall establish and maintain a quality system that is appropriate for the specific medical device(s) designed or manufactured, and that meets the requirements of this part. Subpart B--Quality System Requirements Sec. 820.20 Management responsibility. (a) Quality policy. Management with executive responsibility shall establish its policy and objectives for, and commitment to, quality. Management with executive responsibility shall ensure that the quality policy is understood, implemented, and maintained at all levels of the organization. (b) Organization. Each manufacturer shall establish and maintain an adequate organizational structure to ensure that devices are designed and produced in accordance with the requirements of this part. (1) Responsibility and authority. Each manufacturer shall establish the appropriate responsibility, authority, and interrelation of all personnel who manage, perform, and assess work affecting quality, and provide the independence and authority necessary to perform these tasks. (2) Resources. Each manufacturer shall provide adequate resources, including the assignment of trained personnel, for management, performance of work, and assessment activities, including internal quality audits, to meet the requirements of this part. (3) Management representative. Management with executive responsibility shall appoint, and document such appointment of, a member of management who, irrespective of other responsibilities, shall have established authority over and responsibility for: (i) Ensuring that quality system requirements are effectively established and effectively maintained in accordance with this part; and (ii) Reporting on the performance of the quality system to management with executive responsibility for review. (c) Management review. Management with executive responsibility shall review the suitability and effectiveness of the quality system at defined intervals and with sufficient frequency according to established procedures to ensure that the quality system satisfies the requirements of this part and the manufacturer's established quality policy and objectives. The dates and results of quality system reviews shall be documented. (d) Quality planning. Each manufacturer shall establish a quality plan which defines the quality practices, resources, and activities relevant to devices that are designed and manufactured. The manufacturer shall establish how the requirements for quality will be met. (e) Quality system procedures. Each manufacturer shall establish quality system procedures and instructions. An outline of the structure of the documentation used in the quality system shall be established where appropriate. Sec. 820.22 Quality audit. Each manufacturer shall establish procedures for quality audits and conduct such audits to assure that the quality system is in compliance with the established quality system requirements and to determine the effectiveness of the quality system. Quality audits shall be conducted by individuals who do not have direct responsibility for the matters being audited. Corrective action(s), including a reaudit of deficient matters, [Page 52657] shall be taken when necessary. A report of the results of each quality audit, and reaudit(s) where taken, shall be made and such reports shall be reviewed by management having responsibility for the matters audited. The dates and results of quality audits and reaudits shall be documented. Sec. 820.25 Personnel. (a) General. Each manufacturer shall have sufficient personnel with the necessary education, background, training, and experience to assure that all activities required by this part are correctly performed. (b) Training. Each manufacturer shall establish procedures for identifying training needs and ensure that all personnel are trained to adequately perform their assigned responsibilities. Training shall be documented. (1) As part of their training, personnel shall be made aware of device defects which may occur from the improper performance of their specific jobs. (2) Personnel who perform verification and validation activities shall be made aware of defects and errors that may be encountered as part of their job functions. Subpart C--Design Controls Sec. 820.30 Design controls. (a) General. (1) Each manufacturer of any class III or class II device, and the class I devices listed in paragraph (a)(2) of this section, shall establish and maintain procedures to control the design of the device in order to ensure that specified design requirements are met. (2) The following class I devices are subject to design controls: (i) Devices automated with computer software; and (ii) The devices listed in the following chart. ------------------------------------------------------------------------ Section Device ------------------------------------------------------------------------ 868.6810.......................... Catheter, Tracheobronchial Suction. 878.4460.......................... Glove, Surgeon's. 880.6760.......................... Restraint, Protective. 892.5650.......................... System, Applicator, Radionuclide, Manual. 892.5740.......................... Source, Radionuclide Teletherapy. ------------------------------------------------------------------------ (b) Design and development planning. Each manufacturer shall establish and maintain plans that describe or reference the design and development activities and define responsibility for implementation. The plans shall identify and describe the interfaces with different groups or activities that provide, or result in, input to the design and development process. The plans shall be reviewed, updated, and approved as design and development evolves. (c) Design input. Each manufacturer shall establish and maintain procedures to ensure that the design requirements relating to a device are appropriate and address the intended use of the device, including the needs of the user and patient. The procedures shall include a mechanism for addressing incomplete, ambiguous, or conflicting requirements. The design input requirements shall be documented and shall be reviewed and approved by a designated individual(s). The approval, including the date and signature of the individual(s) approving the requirements, shall be documented. (d) Design output. Each manufacturer shall establish and maintain procedures for defining and documenting design output in terms that allow an adequate evaluation of conformance to design input requirements. Design output procedures shall contain or make reference to acceptance criteria and shall ensure that those design outputs that are essential for the proper functioning of the device are identified. Design output shall be documented, reviewed, and approved before release. The approval, including the date and signature of the individual(s) approving the output, shall be documented. (e) Design review. Each manufacturer shall establish and maintain procedures to ensure that formal documented reviews of the design results are planned and conducted at appropriate stages of the device's design development. The procedures shall ensure that participants at each design review include representatives of all functions concerned with the design stage being reviewed and an individual(s) who does not have direct responsibility for the design stage being reviewed, as well as any specialists needed. The results of a design review, including identification of the design, the date, and the individual(s) performing the review, shall be documented in the design history file (the DHF). (f) Design verification. Each manufacturer shall establish and maintain procedures for verifying the device design. Design verification shall confirm that the design output meets the design input requirements. The results of the design verification, including identification of the design, method(s), the date, and the individual(s) performing the verification, shall be documented in the DHF. (g) Design validation. Each manufacturer shall establish and maintain procedures for validating the device design. Design validation shall be performed under defined operating conditions on initial production units, lots, or batches, or their equivalents. Design validation shall ensure that devices conform to defined user needs and intended uses and shall include testing of production units under actual or simulated use conditions. Design validation shall include software validation and risk analysis, where appropriate. The results of the design validation, including identification of the design, method(s), the date, and the individual(s) performing the validation, shall be documented in the DHF. (h) Design transfer. Each manufacturer shall establish and maintain procedures to ensure that the device design is correctly translated into production specifications. (i) Design changes. Each manufacturer shall establish and maintain procedures for the identification, documentation, validation or where appropriate verification, review, and approval of design changes before their implementation. (j) Design history file. Each manufacturer shall establish and maintain a DHF for each type of device. The DHF shall contain or reference the records necessary to demonstrate that the design was developed in accordance with the approved design plan and the requirements of this part. Subpart D--Document Controls Sec. 820.40 Document controls. Each manufacturer shall establish and maintain procedures to control all documents that are required by this part. The procedures shall provide for the following: (a) Document approval and distribution. Each manufacturer shall designate an individual(s) to review for adequacy and approve prior to issuance all documents established to meet the requirements of this part. The approval, including the date and signature of the individual(s) approving the document, shall be documented. Documents established to meet the requirements of this part shall be available at all locations for which they are designated, used, or otherwise necessary, and all obsolete documents shall be promptly removed from all points of use or otherwise prevented from unintended use. (b) Document changes. Changes to documents shall be reviewed and approved by an individual(s) in the same function or organization that performed the original review and approval, unless specifically designated otherwise. Approved changes shall be [Page 52658] communicated to the appropriate personnel in a timely manner. Each manufacturer shall maintain records of changes to documents. Change records shall include a description of the change, identification of the affected documents, the signature of the approving individual(s), the approval date, and when the change becomes effective. Subpart E--Purchasing Controls Sec. 820.50 Purchasing controls. Each manufacturer shall establish and maintain procedures to ensure that all purchased or otherwise received product and services conform to specified requirements. (a) Evaluation of suppliers, contractors, and consultants. Each manufacturer shall establish and maintain the requirements, including quality requirements, that must be met by suppliers, contractors, and consultants. Each manufacturer shall: (1) Evaluate and select potential suppliers, contractors, and consultants on the basis of their ability to meet specified requirements, including quality requirements. The evaluation shall be documented. (2) Define the type and extent of control to be exercised over the product, services, suppliers, contractors, and consultants, based on the evaluation results. (3) Establish and maintain records of acceptable suppliers, contractors, and consultants. (b) Purchasing data. Each manufacturer shall establish and maintain data that clearly describe or reference the specified requirements, including quality requirements, for purchased or otherwise received product and services. Purchasing documents shall include, where possible, an agreement that the suppliers, contractors, and consultants agree to notify the manufacturer of changes in the product or service so that manufacturers may determine whether the changes may affect the quality of a finished device. Purchasing data shall be approved in accordance with Sec. 820.40. Subpart F--Identification and Traceability Sec. 820.60 Identification. Each manufacturer shall establish and maintain procedures for identifying product during all stages of receipt, production, distribution, and installation to prevent mixups. Sec. 820.65 Traceability. Each manufacturer of a device that is intended for surgical implant into the body or to support or sustain life and whose failure to perform when properly used in accordance with instructions for use provided in the labeling can be reasonably expected to result in a significant injury to the user shall establish and maintain procedures for identifying with a control number each unit, lot, or batch of finished devices and where appropriate components. The procedures shall facilitate corrective action. Such identification shall be documented in the DHR. Subpart G--Production and Process Controls Sec. 820.70 Production and process controls. (a) General. Each manufacturer shall develop, conduct, control, and monitor production processes to ensure that a device conforms to its specifications. Where deviations from device specifications could occur as a result of the manufacturing process, the manufacturer shall establish and maintain process control procedures that describe any process controls necessary to ensure conformance to specifications. Where process controls are needed they shall include: (1) Documented instructions, standard operating procedures (SOP's), and methods that define and control the manner of production; (2) Monitoring and control of process parameters and component and device characteristics during production; (3) Compliance with specified reference standards or codes; (4) The approval of processes and process equipment; and (5) Criteria for workmanship which shall be expressed in documented standards or by means of identified and approved representative samples. (b) Production and process changes. Each manufacturer shall establish and maintain procedures for changes to a specification, method, process, or procedure. Such changes shall be verified or where appropriate validated according to Sec. 820.75, before implementation and these activities shall be documented. Changes shall be approved in accordance with Sec. 820.40. (c) Environmental control. Where environmental conditions could reasonably be expected to have an adverse effect on product quality, the manufacturer shall establish and maintain procedures to adequately control these environmental conditions. Environmental control system(s) shall be periodically inspected to verify that the system, including necessary equipment, is adequate and functioning properly. These activities shall be documented and reviewed. (d) Personnel. Each manufacturer shall establish and maintain requirements for the health, cleanliness, personal practices, and clothing of personnel if contact between such personnel and product or environment could reasonably be expected to have an adverse effect on product quality. The manufacturer shall ensure that maintenance and other personnel who are required to work temporarily under special environmental conditions are appropriately trained or supervised by a trained individual. (e) Contamination control. Each manufacturer shall establish and maintain procedures to prevent contamination of equipment or product by substances that could reasonably be expected to have an adverse effect on product quality. (f) Buildings. Buildings shall be of suitable design and contain sufficient space to perform necessary operations, prevent mixups, and assure orderly handling. (g) Equipment. Each manufacturer shall ensure that all equipment used in the manufacturing process meets specified requirements and is appropriately designed, constructed, placed, and installed to facilitate maintenance, adjustment, cleaning, and use. (1) Maintenance schedule. Each manufacturer shall establish and maintain schedules for the adjustment, cleaning, and other maintenance of equipment to ensure that manufacturing specifications are met. Maintenance activities, including the date and individual(s) performing the maintenance activities, shall be documented. (2) Inspection. Each manufacturer shall conduct periodic inspections in accordance with established procedures to ensure adherence to applicable equipment maintenance schedules. The inspections, including the date and individual(s) conducting the inspections, shall be documented. (3) Adjustment. Each manufacturer shall ensure that any inherent limitations or allowable tolerances are visibly posted on or near equipment requiring periodic adjustments or are readily available to personnel performing these adjustments. (h) Manufacturing material. Where a manufacturing material could reasonably be expected to have an adverse effect on product quality, the manufacturer shall establish and maintain procedures for the use and removal of such manufacturing material [Page 52659] to ensure that it is removed or limited to an amount that does not adversely affect the device's quality. The removal or reduction of such manufacturing material shall be documented. (i) Automated processes. When computers or automated data processing systems are used as part of production or the quality system, the manufacturer shall validate computer software for its intended use according to an established protocol. All software changes shall be validated before approval and issuance. These validation activities and results shall be documented. Sec. 820.72 Inspection, measuring, and test equipment. (a) Control of inspection, measuring, and test equipment. Each manufacturer shall ensure that all inspection, measuring, and test equipment, including mechanical, automated, or electronic inspection and test equipment, is suitable for its intended purposes and is capable of producing valid results. Each manufacturer shall establish and maintain procedures to ensure that equipment is routinely calibrated, inspected, checked, and maintained. The procedures shall include provisions for handling, preservation, and storage of equipment, so that its accuracy and fitness for use are maintained. These activities shall be documented. (b) Calibration. Calibration procedures shall include specific directions and limits for accuracy and precision. When accuracy and precision limits are not met, there shall be provisions for remedial action to reestablish the limits and to evaluate whether there was any adverse effect on the device's quality. These activities shall be documented. (1) Calibration standards. Calibration standards used for inspection, measuring, and test equipment shall be traceable to national or international standards. If national or international standards are not practical or available, the manufacturer shall use an independent reproducible standard. If no applicable standard exists, the manufacturer shall establish and maintain an in-house standard. (2) Calibration records. The equipment identification, calibration dates, the individual performing each calibration, and the next calibration date shall be documented. These records shall be displayed on or near each piece of equipment or shall be readily available to the personnel using such equipment and to the individuals responsible for calibrating the equipment. Sec. 820.75 Process validation. (a) Where the results of a process cannot be fully verified by subsequent inspection and test, the process shall be validated with a high degree of assurance and approved according to established procedures. The validation activities and results, including the date and signature of the individual(s) approving the validation and where appropriate the major equipment validated, shall be documented. (b) Each manufacturer shall establish and maintain procedures for monitoring and control of process parameters for validated processes to ensure that the specified requirements continue to be met. (1) Each manufacturer shall ensure that validated processes are performed by qualified individual(s). (2) For validated processes, the monitoring and control methods and data, the date performed, and, where appropriate, the individual(s) performing the process or the major equipment used shall be documented. (c) When changes or process deviations occur, the manufacturer shall review and evaluate the process and perform revalidation where appropriate. These activities shall be documented. Subpart H--Acceptance Activities Sec. 820.80 Receiving, in-process, and finished device acceptance. (a) General. Each manufacturer shall establish and maintain procedures for acceptance activities. Acceptance activities include inspections, tests, or other verification activities. (b) Receiving acceptance activities. Each manufacturer shall establish and maintain procedures for acceptance of incoming product. Incoming product shall be inspected, tested, or otherwise verified as conforming to specified requirements. Acceptance or rejection shall be documented. (c) In-process acceptance activities. Each manufacturer shall establish and maintain acceptance procedures, where appropriate, to ensure that specified requirements for in-process product are met. Such procedures shall ensure that in-process product is controlled until the required inspection and tests or other verification activities have been completed, or necessary approvals are received, and are documented. (d) Final acceptance activities. Each manufacturer shall establish and maintain procedures for finished device acceptance to ensure that each production run, lot, or batch of finished devices meets acceptance criteria. Finished devices shall be held in quarantine or otherwise adequately controlled until released. Finished devices shall not be released for distribution until: (1) The activities required in the DMR are completed; (2) the associated data and documentation is reviewed; (3) the release is authorized by the signature of a designated individual(s); and (4) the authorization is dated. (e) Acceptance records. Each manufacturer shall document acceptance activities required by this part. These records shall include: (1) The acceptance activities performed; (2) the dates acceptance activities are performed; (3) the results; (4) the signature of the individual(s) conducting the acceptance activities; and (5) where appropriate the equipment used. These records shall be part of the DHR. Sec. 820.86 Acceptance status. Each manufacturer shall identify by suitable means the acceptance status of product, to indicate the conformance or nonconformance of product with acceptance criteria. The identification of acceptance status shall be maintained throughout manufacturing, packaging, labeling, installation, and servicing of the product to ensure that only product which has passed the required acceptance activities is distributed, used, or installed. Subpart I--Nonconforming Product Sec. 820.90 Nonconforming product. (a) Control of nonconforming product. Each manufacturer shall establish and maintain procedures to control product that does not conform to specified requirements. The procedures shall address the identification, documentation, evaluation, segregation, and disposition of nonconforming product. The evaluation of nonconformance shall include a determination of the need for an investigation and notification of the persons or organizations responsible for the nonconformance. The evaluation and any investigation shall be documented. (b) Nonconformity review and disposition. (1) Each manufacturer shall establish and maintain procedures that define the responsibility for review and the authority for the disposition of nonconforming product. The procedures shall set forth the review and disposition process. Disposition of nonconforming product shall be documented. Documentation shall include the justification for use of nonconforming product and the signature of the individual(s) authorizing the use. [Page 52660] (2) Each manufacturer shall establish and maintain procedures for rework, to include retesting and reevaluation of the nonconforming product after rework, to ensure that the product meets its current approved specifications. Rework and reevaluation activities, including a determination of any adverse effect from the rework upon the product, shall be documented in the DHR. Subpart J--Corrective and Preventive Action Sec. 820.100 Corrective and preventive action. (a) Each manufacturer shall establish and maintain procedures for implementing corrective and preventive action. The procedures shall include requirements for: (1) Analyzing processes, work operations, concessions, quality audit reports, quality records, service records, complaints, returned product, and other sources of quality data to identify existing and potential causes of nonconforming product, or other quality problems. Appropriate statistical methodology shall be employed where necessary to detect recurring quality problems; (2) Investigating the cause of nonconformities relating to product, processes, and the quality system; (3) Identifying the action(s) needed to correct and prevent recurrence of nonconforming product and other quality problems; (4) Verifying or validating the corrective and preventive action to ensure that such action is effective and does not adversely affect the finished device; (5) Implementing and recording changes in methods and procedures needed to correct and prevent identified quality problems; (6) Ensuring that information related to quality problems or nonconforming product is disseminated to those directly responsible for assuring the quality of such product or the prevention of such problems; and (7) Submitting relevant information on identified quality problems, as well as corrective and preventive actions, for management review. (b) All activities required under this section, and their results, shall be documented. Subpart K--Labeling and Packaging Control Sec. 820.120 Device labeling. Each manufacturer shall establish and maintain procedures to control labeling activities. (a) Label integrity. Labels shall be printed and applied so as to remain legible and affixed during the customary conditions of processing, storage, handling, distribution, and where appropriate use. (b) Labeling inspection. Labeling shall not be released for storage or use until a designated individual(s) has examined the labeling for accuracy including, where applicable, the correct expiration date, control number, storage instructions, handling instructions, and any additional processing instructions. The release, including the date and signature of the individual(s) performing the examination, shall be documented in the DHR. (c) Labeling storage. Each manufacturer shall store labeling in a manner that provides proper identification and is designed to prevent mixups. (d) Labeling operations. Each manufacturer shall control labeling and packaging operations to prevent labeling mixups. The label and labeling used for each production unit, lot, or batch shall be documented in the DHR. (e) Control number. Where a control number is required by Sec. 820.65, that control number shall be on or shall accompany the device through distribution. Sec. 820.130 Device packaging. Each manufacturer shall ensure that device packaging and shipping containers are designed and constructed to protect the device from alteration or damage during the customary conditions of processing, storage, handling, and distribution. Subpart L--Handling, Storage, Distribution, and Installation Sec. 820.140 Handling. Each manufacturer shall establish and maintain procedures to ensure that mixups, damage, deterioration, contamination, or other adverse effects to product do not occur during handling. Sec. 820.150 Storage. (a) Each manufacturer shall establish and maintain procedures for the control of storage areas and stock rooms for product to prevent mixups, damage, deterioration, contamination, or other adverse effects pending use or distribution and to ensure that no obsolete, rejected, or deteriorated product is used or distributed. When the quality of product deteriorates over time, it shall be stored in a manner to facilitate proper stock rotation, and its condition shall be assessed as appropriate. (b) Each manufacturer shall establish and maintain procedures that describe the methods for authorizing receipt from and dispatch to storage areas and stock rooms. Sec. 820.160 Distribution. (a) Each manufacturer shall establish and maintain procedures for control and distribution of finished devices to ensure that only those devices approved for release are distributed and that purchase orders are reviewed to ensure that ambiguities and errors are resolved before devices are released for distribution. Where a device's fitness for use or quality deteriorates over time, the procedures shall ensure that expired devices or devices deteriorated beyond acceptable fitness for use are not distributed. (b) Each manufacturer shall maintain distribution records which include or refer to the location of: (1) The name and address of the initial consignee; (2) The identification and quantity of devices shipped; (3) The date shipped; and (4) Any control number(s) used. Sec. 820.170 Installation. (a) Each manufacturer of a device requiring installation shall establish and maintain adequate installation and inspection instructions, and where appropriate test procedures. Instructions and procedures shall include directions for ensuring proper installation so that the device will perform as intended after installation. The manufacturer shall distribute the instructions and procedures with the device or otherwise make them available to the person(s) installing the device. (b) The person installing the device shall ensure that the installation, inspection, and any required testing are performed in accordance with the manufacturer's instructions and procedures and shall document the inspection and any test results to demonstrate proper installation. Subpart M--Records Sec. 820.180 General requirements. All records required by this part shall be maintained at the manufacturing establishment or other location that is reasonably accessible to responsible officials of the manufacturer and to employees of FDA designated to perform inspections. Such records, including those not stored at the inspected establishment, shall be made readily available for review and copying by FDA employee(s). Such records shall be legible and shall be stored to [Page 52661] minimize deterioration and to prevent loss. Those records stored in automated data processing systems shall be backed up. (a) Confidentiality. Records deemed confidential by the manufacturer may be marked to aid FDA in determining whether information may be disclosed under the public information regulation in part 20 of this chapter. (b) Record retention period. All records required by this part shall be retained for a period of time equivalent to the design and expected life of the device, but in no case less than 2 years from the date of release for commercial distribution by the manufacturer. (c) Exceptions. This section does not apply to the reports required by Sec. 820.20(c) Management review, Sec. 820.22 Quality audits, and supplier audit reports used to meet the requirements of Sec. 820.50(a) Evaluation of suppliers, contractors, and consultants, but does apply to procedures established under these provisions. Upon request of a designated employee of FDA, an employee in management with executive responsibility shall certify in writing that the management reviews and quality audits required under this part, and supplier audits where applicable, have been performed and documented, the dates on which they were performed, and that any required corrective action has been undertaken. Sec. 820.181 Device master record. Each manufacturer shall maintain device master records (DMR's). Each manufacturer shall ensure that each DMR is prepared and approved in accordance with Sec. 820.40. The DMR for each type of device shall include, or refer to the location of, the following information: (a) Device specifications including appropriate drawings, composition, formulation, component specifications, and software specifications; (b) Production process specifications including the appropriate equipment specifications, production methods, production procedures, and production environment specifications; (c) Quality assurance procedures and specifications including acceptance criteria and the quality assurance equipment to be used; (d) Packaging and labeling specifications, including methods and processes used; and (e) Installation, maintenance, and servicing procedures and methods. Sec. 820.184 Device history record. Each manufacturer shall maintain device history records (DHR's). Each manufacturer shall establish and maintain procedures to ensure that DHR's for each batch, lot, or unit are maintained to demonstrate that the device is manufactured in accordance with the DMR and the requirements of this part. The DHR shall include, or refer to the location of, the following information: (a) The dates of manufacture; (b) The quantity manufactured; (c) The quantity released for distribution; (d) The acceptance records which demonstrate the device is manufactured in accordance with the DMR; (e) The primary identification label and labeling used for each production unit; and (f) Any device identification(s) and control number(s) used. Sec. 820.186 Quality system record. Each manufacturer shall maintain a quality system record (QSR). The QSR shall include, or refer to the location of, procedures and the documentation of activities required by this part that are not specific to a particular type of device(s), including, but not limited to, the records required by Sec. 820.20. Each manufacturer shall ensure that the QSR is prepared and approved in accordance with Sec. 820.40. Sec. 820.198 Complaint files. (a) Each manufacturer shall maintain complaint files. Each manufacturer shall establish and maintain procedures for receiving, reviewing, and evaluating complaints by a formally designated unit. Such procedures shall ensure that: (1) All complaints are processed in a uniform and timely manner; (2) Oral complaints are documented upon receipt; and (3) Complaints are evaluated to determine whether the complaint represents an event which is required to be reported to FDA under part 803 or 804 of this chapter, Medical Device Reporting. (b) Each manufacturer shall review and evaluate all complaints to determine whether an investigation is necessary. When no investigation is made, the manufacturer shall maintain a record that includes the reason no investigation was made and the name of the individual responsible for the decision not to investigate. (c) Any complaint involving the possible failure of a device, labeling, or packaging to meet any of its specifications shall be reviewed, evaluated, and investigated, unless such investigation has already been performed for a similar complaint and another investigation is not necessary. (d) Any complaint that represents an event which must be reported to FDA under part 803 or 804 of this chapter shall be promptly reviewed, evaluated, and investigated by a designated individual(s) and shall be maintained in a separate portion of the complaint files or otherwise clearly identified. In addition to the information required by Sec. 820.198(e), records of investigation under this paragraph shall include a determination of: (1) Whether the device failed to meet specifications; (2) Whether the device was being used for treatment or diagnosis; and (3) The relationship, if any, of the device to the reported incident or adverse event. (e) When an investigation is made under this section, a record of the investigation shall be maintained by the formally designated unit identified in paragraph (a) of this section. The record of investigation shall include: (1) The name of the device; (2) The date the complaint was received; (3) Any device identification(s) and control number(s) used; (4) The name, address, and phone number of the complainant; (5) The nature and details of the complaint; (6) The dates and results of the investigation; (7) Any corrective action taken; and (8) Any reply to the complainant. (f) When the manufacturer's formally designated complaint unit is located at a site separate from the manufacturing establishment, the investigated complaint(s) and the record(s) of investigation shall be reasonably accessible to the manufacturing establishment. (g) If a manufacturer's formally designated complaint unit is located outside of the United States, records required by this section shall be reasonably accessible in the United States at either: (1) A location in the United States where the manufacturer's records are regularly kept; or (2) The location of the initial distributor. Subpart N--Servicing Sec. 820.200 Servicing. (a) Where servicing is a specified requirement, each manufacturer shall establish and maintain instructions and procedures for performing and verifying that the servicing meets the specified requirements. (b) Each manufacturer shall analyze service reports with appropriate [Page 52662] statistical methodology in accordance with Sec. 820.100. (c) Each manufacturer who receives a service report that represents an event which must be reported to FDA under part 803 or 804 of this chapter shall automatically consider the report a complaint and shall process it in accordance with the requirements of Sec. 820.198. (d) Service reports shall be documented and shall include: (1) The name of the device serviced; (2) Any device identification(s) and control number(s) used; (3) The date of service; (4) The individual(s) servicing the device; (5) The service performed; and (6) The test and inspection data. Subpart O--Statistical Techniques Sec. 820.250 Statistical techniques. (a) Where appropriate, each manufacturer shall establish and maintain procedures for identifying valid statistical techniques required for establishing, controlling, and verifying the acceptability of process capability and product characteristics. (b) Sampling plans, when used, shall be written and based on a valid statistical rationale. Each manufacturer shall establish and maintain procedures to ensure that sampling methods are adequate for their intended use and to ensure that when changes occur the sampling plans are reviewed. These activities shall be documented. Dated: October 1, 1996. David A. Kessler, Commissioner of Food and Drugs. Donna E. Shalala, Secretary of Health and Human Services. [FR Doc. 96-25720 Filed 10-3-96; 11:22 am] BILLING CODE 4160-01-P Preamble comments related to specific Quality Systems Regulation Sections