Originally published August, 1996
Paul J. Sordellini and Marjorie Lang
Because microbiological destruction is logarithmic and therefore can only be expressed in terms of the probability of a survivor, the term sterile device does not actually refer to a device that is totally free of viable organisms, but rather to one whose probability of containing a viable organism is so small that it is considered acceptable. Hence the use of the sterility assurance level (SAL) to describe the degree of sterility of a device. According to FDA regulations, topical devices must have an SAL of 103 or better while devices that will come in contact with blood or compromised tissues must have an SAL of 106.
For a product lot to be declared sterile and released to market following routine ethylene oxide (EtO) sterilization, the biological indicators (BIs) that are placed within the lot prior to processing must show no growth following postprocessing incubation. On occasion, however, one or more BIs exhibit growth even after being subjected to a validated EtO process based on parameters that ensure a substantial amount of overkill capability. Some may argue that such an occasional sterility failure is likely due simply to the laws of probability. After all, by definition, a validated sterilization process allows one contaminated device for every million devices sterilized. In reality, however, when an EtO sterilization cycle is properly engineered and validated, the SAL of the processed product usually exceeds the 106 required. The possibility of a positive BI following processing, based on probability and not a specific cause, becomes so small as to be unbelievable. What is more probable is that somewhere in the process, which may involve as many as four key players, a human error or mechanical malfunction has occurred.
The failure of a validated sterilization cycle is a serious matter, but little guidance is available on how to respond to such situations. This article, therefore, suggests an investigative method to pinpoint the cause of the failure. Suggestions for preventing the occurrence of positive BIs in future cycles are also presented.
THE STERILITY FAILURE INVESTIGATION
As mentioned above, there are four primary parties whose actions might affect the results of the sterilization cycle: the BI manufacturer, the device manufacturer (and packager, if not done in-house), the testing laboratory (in-house or contract), and the contract sterilizer (or in-house sterilization department). For the purpose of simplifying this discussion, it is assumed that the device manufacturer is also the packager, sterilization is performed by an outside contractor, and BI incubation is performed by an outside laboratory. It is the responsibility of the device manufacturer to investigate the sterility failure so that the product lot can be released, but the other parties must also contribute to this task.
During the sterility failure investigation, the product lot in question should remain in quarantine at the sterilization site since it will most likely require reprocessing. If possible, the lot should remain in the same configuration as when it was removed from the sterilization vessel.
Biological Indicator Integrity. If the device manufacturer has any additional BIs from the same lot as those that resulted positive, samples should be tested to confirm that the population count and resistance match the data supplied and certified by the BI manufacturer. The BI manufacturer should also be notified and asked whether there have been other complaints or problems pertaining to that particular lot. The request for information should be in writing and a copy of it should be placed, along with the supplier's response, in the file maintained throughout the failure investigation. Even if the BI manufacturer is unaware of any irregularities, it is possible that something (e.g., desiccation) increased the resistance of the BIs during transport or storage. Such possibilities should be examined and evaluated.
Product Changes. The device manufacturer should also determine whether the product lot that yielded the positive BI differed in any way from that being processed at the time the original sterilization validation was performed. The contract between a device manufacturer and an outside sterilizer usually contains a clause obligating the manufacturer to notify the sterilization firm of any significant changes made to the
device or its packaging. Certain device or packaging modifications or changes in load configuration or density can increase the permeation times of moisture or EtO, or both, thus decreasing the efficacy of the cycle. Samples from the failed lot should be compared to samples retained from previous lots. If changes have been made, an engineering review should be ordered to evaluate the effect these modifications might have on the diffusion coefficient of each packaging layer of the load, including shrink wrapping if used.
Laboratory Procedures. As part of a proper good manufacturing practices (GMP) program, one of the device manufacturer's responsibilities is to audit its testing laboratory to confirm that it is in compliance with applicable regulatory requirements regarding operating procedures. Whenever a
sterility failure occurs during a validated production cycle, all previous lab audits should be reviewed and the need to conduct a new audit should be evaluated.
In addition, the device manufacturer, contract sterilizer, and testing lab should discuss the possibility that, during handling, a positive control was exchanged for an exposed BI. If only one positive control was sent with the product lot, this is easy to determine. An accidental swap will result in an "exposed BI" that exhibits growth during incubation and a "positive control" that does not. However, some manufacturers may send several positive controls from which the lab selects only a few to test. The three parties involved must try to establish how many positive controls were sent to the contract sterilizer, whether they were all accounted for, and whether they were always kept isolated. They should also determine if the positive controls could have been mixed with the exposed indicators following processing and if such a mixup could have occurred at the laboratory.
Sterilization Audit. The final part of the investigation involves the device manufacturer and the contract sterilizer. Working together, they should review the sterilization cycle data (a QA audit) and inspect the sterilization equipment (a maintenance audit).
Document Review. All documentation concerning the suspect product lot should be reviewed carefully, starting with the sterilization batch record, to determine if any characteristics were different from previous cycles run in the same vessel for the same device manufacturer. Any deviations that may have occurred must be evaluated for their impact on the critical cycle parameters of time, temperature, moisture, and sterilant concentration. For each phase of the cycle, pressure set points, elapsed times, ramp rates, temperatures, and general temperature profiles should be compared to the physical parameters specified in the sterilization protocol. It is particularly important to compare the thermal profile of the cycle, obtained by graphing the water-jacket and chamber temperatures throughout each phase, to previous cycles. If the suspect cycle required more heat to achieve set point, then a sterilizer malfunction, a preconditioning malfunction, or an inappropriate increase in product load density may be the cause of the sterility failure. All should be investigated and documented.
A review of inventory records may reveal an intermittent problem related to the mixing of products within the same sterilizer load. When BIs are placed inside primary packaging, they may have to compete with different products or components that present a greater humidity absorption capability. Solving such a problem may require selecting a different type of BI, using a different carrier, or increasing both steam injection differential and conditioning dwell time.
Inspection and Testing. Whether or not the paperwork review identifies the cause of the failure, all equipment should be checked to confirm compliance with the master installation qualification (IQ) and operational qualification (OQ) protocols. This entails comparing the serial numbers for each
component with those listed in the IQ to
determine if any unauthorized replacements have taken place.
The sterilizer vessel, control system, and ancillary equipment should also be inspected for any abnormalities and then tested to confirm that system performance has not been inadvertently altered. All routine and unscheduled maintenance and calibration documentation must be reviewed and evaluated, followed by an actual calibration verification of the time, temperature, pressure, and humidity sensors. The calibration of preconditioning room equipment and the scales used to weigh the EtO cylinders before and after gas charge should also be verified. Any instrumentation found to be out of an acceptable state of calibration must be documented and its role in causing the sterility failure evaluated.
Diagnostic testing of the sterilizer follows, including leak rate determination, thermal profiling of inside walls, and operational qualification cycles (up to three consecutive cycles without deviation). Such diagnostic work should not be limited to the sterilizer, but should also include the preconditioning room. Thermal and humidity profiles should be constructed for the room, especially in the area where the suspect product lot was located.
Steam quality is another critical parameter that should be evaluated. If moisture is present in the steam in the form of aggregates instead of as a true gas, the BIs (and product) may not be properly humidified. Instead, the water can present a physical barrier, effectively shielding spores from the EtO. Device manufacturers can test samples of primary and secondary packaging materials for postaeration residual EtO and EtO derivatives during the initial process validation. Later, should a sterility failure occur, similar samples can be taken from the location of the failure and tested for residuals. A higher than normal level of glycols in the materials from the suspect location would suggest that moisture levels were too high (i.e., steam quality was poor).
To ensure that good steam quality is maintained, all traps, separators, and coalescing devices must be inspected periodically. Steam traps are especially susceptible to problems. Proper functioning can be evaluated by measuring and recording the temperature and pressure drop across each trap or by infrared examination of the steam lines. An experienced technician can perform a visual inspection of the steam released through each trap's blowdown valve. If continuous monitoring is necessary to identify an intermittent problem, a stethoscope connected to a continuous chart recorder may be used and the recorded sound
data evaluated by an expert. All steam lines to the sterilizer and preconditioning room also should be inspected periodically for proper pitch, since stress applied to the lines during routine maintenance may cause them to bend, creating pockets for condensate to collect.
Data Comparisons. Once the diagnostic testing has been completed, the data collected can be compared to those from comparable tests performed during the original commissioning of the facility and then repeated during revalidations, usually annually. These existing data provide investigators with a valuable performance history. For example, the first series of thermal and humidity profiles of the preconditioning room, conducted during the commissioning of the facility, will have revealed the locations that are most difficult to heat and most difficult to humidify. A temperature sensor and humidity sensor would then be placed in these respective locations to control the room's conditions. By contrasting the original OQ data with those from the sterility failure investigation, it can be determined if these "difficult" locations have remained stationary. If they have changed, then the sensors should be moved accordingly and the room requalified.
A common mistake is to pinpoint the critical locations by profiling an empty preconditioning room, not realizing that later, when the room is filled with product, the dynamics of heat and humidity will vary depending on product quantity and location within the room. If this occurs, then several temperature and humidity sensors should be installed throughout the room along with a control system that bases heat and humidity additions on the sensors registering the lowest reading.
A similar comparison should be performed on the new and historic data for sterilizer performance characteristics and any changes noted and evaluated. A review of the OQ data from the vessel commissioning will reveal the locations that are most difficult to heat. Typically, device manufacturers require these cold spots to be probed with extra temperature and humidity sensors and will place BIs there. Therefore, the sterility failure investigation will indicate whether such spots have moved or intensified. If a sterilizer's cold spots have indeed moved, engineering studies of the flow throughout the vessel's jackets should be conducted to determine the presence of blockages, restrictions, or excessive pressure drops.
Product Resterilization. After the physical testing and data analysis are completed, new BIs can be placed in the product lot in the same pattern as used previously. If there is a new suspected cold spot in the vessel, then additional BIs should be added at this location. The load also should be probed for temperature and humidity and placed in the preconditioning room in the same manner as it was for the production cycle that yielded the sterility failure. (This is possible only if records are kept during routine production cycles indicating each pallet's position within the preconditioning room.)
Preconditioning should be performed for the same amount of time as used previously, and the resulting temperature and humidity data should be compared with historical data to determine if any changes have occurred to the product's ability to absorb heat and humidity. If so, the minimum preconditioning time may have to be increased to compensate.
After preconditioning, the lot should be loaded into the vessel, complete with probes, in the same pallet order and orientation as used in the failed sterilization cycle. Again, the temperature and humidity profiles generated during this resterilization should be compared with those on file to evaluate whether there is a need to increase temperature set points, steam injection differentials, or dwell times.
Following resterilization, all BIs should be retrieved and forwarded to a laboratory for incubation. If the results are all negative, the product may be released from quarantine. (It is assumed that during the original process validation the device manufacturer exposed a quantity of product samples to two sterilization cycles and confirmed packaging and product integrity and functionality, thus permitting this option of allowing sterilization of the same lot twice.)
If the sterility failure investigation found that the original BIs were in acceptable condition and the diagnostic testing indicated the equipment was functioning in an acceptable state of calibration, the device manufacturer should consider adding a sterilization permeation verification protocol to its process validation program. An effective method of determining any role product packaging may have played in obstructing the penetration of moisture and sterilant from the sterilizer bulkhead to the center
of each pallet is to use several quantitative chemical indicators for EtO and moisture during the resterilization of the lot that experienced the failure. A finding that the packaging did obstruct sterility might indicate a problem with the packaging material manufacturer or with the way this particular load was configured. Revalidation using a different cycle or constant use of permeation monitors during routine production may be necessary.
AVOIDING FUTURE STERILITY FAILURES
The implementation by the United States of the international standard Medical Devices--Validation and Routine Control of Ethylene Oxide Sterilization (ANSI/AAMI/
ISO 11135) in 1994 has increased quality in the contract sterilization industry by requiring stringent and thorough process validation. But there are still additional measures that a device manufacturer may voluntarily institute to prevent sterility failures during routine production cycles. The remainder of this article presents some suggestions.
Device manufacturers should purchase BIs not as needed, but rather in bulk lots. Once received, they must be stored within a climate-controlled container where temperature and humidity remain within the BI manufacturer's specifications. A small dedicated refrigerator may be used, provided it does not have a "no frost" feature, which functions by desiccating the air. A simple continuous chart recorder can be used to collect the temperature and humidity data, which should be examined for deviations in storage conditions each time BIs are removed for use.
Whenever a shipment of BIs arrives, the device manufacturer should send samples to a laboratory for a population count and resistance verification. Such data can be helpful in the case of a sterility failure investigation, confirming that nothing affected the spore population or resistance during shipment of the BIs from the manufacturer to the client. Should the lab results not confirm the claims of the BI manufacturer, the lot should be rejected and replaced.
Maintaining BI humidity at the level specified by the manufacturer is especially important. Properly stored BIs are expected to contain a certain amount of moisture. During the preconditioning and in-chamber conditioning cycles of the EtO sterilization process, BIs and the products they accompany are exposed to more humidity, making contact with EtO lethal for all microbes. However, if BIs are allowed to dry out, the microbes they carry can enter a spore state, making them extremely resistant to EtO. Reestablishing a normal level of humidity so that the microbes are once again vulnerable to the gas will then require more conditioning time than usual. The key to solving this problem is never to let the paper carrier or its microbes dry out in the first place.
The sterilization cycle should be designed to reflect the environmental factors encountered during product shipment to the contract sterilization site, since they may influence the outcome of the cycle. Product shipped to the site in summer may require less preconditioning time to achieve equilibrium than if the same lot were shipped in January. Therefore, regardless of when a sterilization challenge is performed, worst-case conditions should be simulated by using a refrigerated cargo container. The product should be stored in the container with the temperature set as low as possible without causing damage to the product, and the resident time
inside the container should be twice the amount of time needed to complete shipment from the device manufacturing site to the sterilization firm. The use of the refrigerated container means that adverse weather conditions will have been factored into the engineering of the cycle parameters, thus avoiding future positive BIs caused by insufficient preconditioning.
The speed at which the sterilization vessel is charged with gas or evacuated, known as the ramp rate, can also influence the efficacy of the process. For example, steam and EtO injection cycles kill most effectively when their ramp rate is slow, while vacuums and nitrogen washes are most effective when their ramp rate is fast. To validate these cycles, manufacturers should devise a worst-case challenge by using a fast ramp rate for steam and EtO injection, and a slow ramp rate for vacuums and nitrogen washes. Thus, once a cycle time has been validated, it will represent the extreme ramp rate at which the cycle is held to be effective. When the production parameters are written for such cycles, the opposite rule should be followed: starting with the validated times, the manufacturer should employ a slower ramp rate for steam and EtO injection, and a faster ramp rate for vacuums and nitrogen washes. For instance, a process in which the validated ramp rate for EtO injection is 11 minutes could be written to have a slower production parameter of 30 minutes, providing the manufacturer with a significant overkill margin and little chance of finding a positive BI after completion of the process.
Certain precautions can be taken to avoid exchanging a positive control BI for an exposed one. The exact number of positive controls to be sent with each product lot should be established in the validation protocol, which should be followed at all times. The positive controls should be sealed in a preaddressed package (an express-delivery pouch, for example) and attached to the shipping papers accompanying the load. Once the load reaches the sterilization facility, the pouch should be forwarded directly to the testing lab. This procedure minimizes the possibility of a mixup, because the positive controls are physically segregated from the ones placed in the load.
A sterility failure during a validated production cycle means that, following exposure to a sterilization process that had been proven effective, reproducible, and reliable, a BI exhibited growth when incubated. The sterility failure investigation should be as elaborate and efficient as possible to uncover the cause of this growth, and sterilization cycles should factor a sufficient overkill capability into the production parameters to compensate for elements that might interfere with the efficacy of the process. Except when attributable to improper BI handling or laboratory error, the bottom line in any BI sterility failure is always the same: there was an insufficient quantity of heat or moisture, or the EtO gas did not physically reach the location of the positive BI. Permeation needs to be confirmed empirically.
Booth AF, "ISO 11135: New Standard Presents New Challenges," Med Dev Diag Indust, 16(2): 6467, 1994.
Guideline for Industrial Ethylene Oxide Sterilization of Medical Devices, ANSI/AAMI ST27, Arlington, VA, Association for the Advancement of Medical Instrumentation (AAMI), 1988.
Hoborn J, "Ethylene Oxide Sterilisation--A Proven Method," in Ethylene Oxide Sterilisation Conference Proceedings 1989, London, EUCOMED, pp 3350, 1989.
Makansi J, "Operations, Maintenance, and Inspection Services for Steam Systems," in Managing Steam, Princeton, NJ, Leslie Co., pp 187200, 1985.
Manning CR, "Validating EtO Packaging/Sterilizer Configurations," Med Dev Diag Indust, 11(1): 130136, 1990.
Medical Devices--Validation and Routine Control of Ethylene Oxide Sterilization, ANSI/AAMI/ISO 11135-1994, Arlington, VA, AAMI, 1994.
O'Brien JD, Medical Device Packaging Handbook, New York, Marcel Dekker, 1990.
Perkins JJ, Principles and Methods of Sterilization in Health Sciences, Springfield, IL, Charles C. Thomas, 1983.
Pinto TJA, Saito T, and Iossif M, "Ethylene Oxide Sterilization: III--Influence of Carrier Nature in a Biological Monitor Performance," J Pharm Sci Tech, 48(3):155158, 1994.
Winckels H, "Equipment and Process Validation," in Ethylene Oxide Sterilisation Conference Proceedings 1989, London, EUCOMED, pp 1323, 1989.
Paul J. Sordellini is an industry consultant with Quality Solutions, Inc. (Annandale, NJ), and Marjorie Lang is an industry consultant with Lang Consulting Services (Minnetonka, MN). *