Regulatory Outlook

On January 26, 2006, Boston Scientific, received a warning letter from FDA. The letter alleged that Boston Scientific had violated numerous provisions of FDA's regulatory requirements. The violations included failing to notify the agency under 21 CFR 806 when the firm recalled two devices that had the potential for overheating and creating a fire hazard. The devices were to be used on patients receiving ablation for arrhythmias.

The precise thought process used by Boston Scientific's legal and regulatory experts is a matter of speculation. However, the fact that FDA issued the warning letter demonstrates that the agency disagreed with the firm's interpretation of the notification requirements under 21 CFR 806.¹

Boston Scientific is not alone in sometimes differing with FDA's judgment of when firms need to notify the agency of a correction or removal under 21 CFR 806. When FDA issues a warning letter, it states its interpretation of how a firm has violated the law. If the agency wanted a final determination of the issue, it would institute a legal action, and a court would make the final determination. FDA rarely brings legal actions. FDA's interpretation is provided to the company and to the public. No definitive resolution is provided that clarifies whether a firm actually violated 21 CFR 806.

Because FDA-483 observations and warning letters are public, firms don't want FDA to allege that they failed to submit a required report. To help firms develop approaches to determine whether they need to notify the agency under 21 CFR 806, this article examines the rule, as well as instances when reports are not required. The results of an audio conference in which FDA officials and industry experts applied the rule in hypothetical situations is also presented.

Regulatory Options under Part 806

When a medical device manufacturer realizes that one of its products has a defect, it can select one of the following options:

• Ignore it and hope that its customers won't notice.

• Try to correct the problem (by sending its customers a letter, or replacing, repairing, relabeling or destroying the device) without telling FDA.

• Try to correct the problem and tell FDA.

• Remove the product from the market and not tell FDA.

• Remove the product from the market and tell FDA.

After a manufacturer determines which option is appropriate under 21 CFR 806, FDA will make its own assessment about how the regulation should have been applied.

Why Not Notify FDA?

Corrections. One reason device firms don't want to tell FDA about a correction is that they don't want the agency to second-guess their strategy for handling the problem. Each situation differs, and company officials who understand the product line and conduct the failure investigation may believe they are in the best position to implement the corrective action.

Removals. One of the reasons firms don't want to tell FDA about a removal is that they don't want the action to be categorized as a recall and thus be listed in FDA's Enforcement Report. (This report is accessible to the public and the firm's competitors. These parties may use the information in the report to discredit the firm or its product line.)

The Rule: History and Requirements

Prior to the passage of the Safe Medical Device Act of 1990 (SMDA), FDA lacked the authority to require firms to notify the agency when they recalled their products or assisted their customers in correcting product problems.

This changed with the passage of SMDA. The new law required FDA to publish a regulation obligating medical device firms to inform the agency when they recalled their product or corrected a product problem that could pose a risk to health. On May 19, 1997, FDA published the final rule on Reports of Corrections and Removals, which was codified in 21 CFR 806.

It is important to note that 21 CFR 806.10 generally requires each device manufacturer to submit a written report to FDA of any correction or removal that was initiated to reduce a risk to health posed by the device, or to remedy a violation of the Act caused by the device that may present a health risk.
To understand how to apply the rule, firms need to understand how specific terms are defined.

Correction. Correction is defined as the repair, modification, adjustment, relabeling, destruction, or inspection of a device without its physical removal from its point of use.

Removal. Removal is defined as the physical removal of a device from its point of use to some other location for repair, modification, adjustment, relabeling, destruction, or inspection.

Risk to Health. Risk to health consists of a two-part definition. For a risk to health to occur, only one part of the definition needs to be satisfied.
The first part is a “reasonable probability that use of or exposure to the product will cause serious adverse health consequences or death.” The second part is “the use of, or exposure to, the product may cause temporary medically reversible adverse consequences, or an outcome where the probability of serious adverse health consequence is remote.”

Terms: Common Understanding. Although medical device firms may disagree with FDA about the application of 21 CFR 806, they generally understand the concept about when the use of or exposure to a product will cause serious adverse health consequences or death. This tracks the definition of a Class I recall.²

Medical device firms also generally understand the concept of the definition, “the use of or exposure to the product may cause temporary medically reversible adverse consequences.” This tracks the definition of a Class II recall.³

Terms: Confusion and Controversy. The phrase, “use or exposure to, the product will cause . . . an outcome where the probability of serious adverse health consequence is remote,” continues to cause confusion for many firms.

Risk Assessment Tools

During product design, firms are required in the quality system regulation and ISO 14971:2000 to practice risk management.^4,5 This includes identifying potential hazards, conducting a risk evaluation, risk analysis, risk elimination and mediation, and ultimately risk control. The purpose of these activities is to determine the potential health hazard in the event that the product malfunctions or fails. Most firms use a decision path or matrix to help analyze these situations (see Figure 1).

Using such methods, firms can determine the likelihood that any particular problem will occur, the potential for injury, and the seriousness of that injury if the problem does occur.

Reporting to FDA

When Do Firms Need to Report? Firms are required to notify FDA within 10 working days of initiating the correction or removal.⁶ The clock starts the moment a firm makes the first contact within or outside the firm.

How Are Firms Protected? FDA does not want to penalize firms for making corrections or removals and notifying the agency about these activities. The rule provides that a correction or removal report submitted to the agency does not necessarily reflect a conclusion by the manufacturer or FDA that the device caused or contributed to a death or serious injury. This section of the regulation is similar to the provision in 21 CFR 803.16 that prevents a Medical Device Report (MDR) from being an admission that the device caused or contributed to a death or serious injury.⁷

When Reports Are Not Required

In certain instances, firms are not obligated to report a correction or removal to FDA. Some of these instances are discussed below.

Previously Filed Reports. Firms are exempted from filing a report if they have previously provided correction and removal information to the agency through an MDR, on a MedWatch Form, or if they have filed a report under the Radiation Control and Safety Act.

User Error. Generally, firms are not required to report isolated instances of user error that would result in remote trivial risks. However, user error should be reported if there is a reasonable probability that the use of the product could bring about adverse health situations.

Normal Stock Rotation/Stock Recovery. A report is also not required if product was removed from the market for normal stock rotation practices. Additionally, firms do not have to tell FDA if they correct product problems before a product is distributed and if the entire inventory is within the firm's direct control.

Market Withdrawal. Additionally, a report is not required if the removal was taken merely to improve the performance or quality of the device. In this instance, the product problem could not pose a health risk.

Furthermore, the product problem could not be more than a technical violation of the requirements, where if the product remained on the market, FDA would use its discretion and refrain from initiating a seizure action. Such a technical violation might include an insignificant typographical error. The problem is that companies would rather not be in the position of second-guessing when FDA would or would not institute a seizure action.

When deciding whether to report, firms should consider several factors. One of the factors should be whether FDA has issued a warning letter on the problem or whether it was cited as an observation on an FDA-483. If the problem is common and FDA has used its discretion not to act, then it is likely the firm would be correct in categorizing the action as a market withdrawal and not submit a report to FDA.

Routine Servicing. Firms do not need to tell the agency about their routine servicing activities. Neither should they inform FDA about regularly scheduled maintenance, such as providing replacement parts at the end of a component's expected life cycle, calibration, or normal wear and tear.

However, repairs of an unexpected nature, such as parts replaced earlier than predicted in the design requirements, would not fit within this definition. If a device contained a battery that was supposed to last for three years, but failed within six months, that would not be considered routine servicing. Firms should maintain reliability and usage pattern data as part of their design controls practices. When events occur that require corrective actions, firms need to ascertain whether the event falls within the predetermined normal use of their product-servicing plan.

Software Corrections. Firms that correct their software to mitigate a problem where there is no risk to health are not required to notify FDA. Although bug lists are not normally considered to be a reportable correction, if a bug list is used as relabeling to avoid a risk to health, then a report would need to be filed.

Hypothetical Examples

On October 26, 2005, FOI Services in cooperation with Compliance-Alliance held an audio conference on medical device reports of corrections and removals. Prior to the audio conference, the registrants were given 11 hypothetical situations and asked to determine which of the following five options should be taken to interpret 21 CFR 806.

• Take no action.

• Do a correction and do not submit a report to FDA.

• Do a correction and submit a report to FDA under 21 CFR 806.

• Remove the product from the market and do not submit a report.

• Remove the product and submit a report under 21 CFR 806.

The registrants were informed that the scenarios did not contain enough facts to provide specific guidance, but they were useful for establishing an approach to determine which option to pursue.

More than 70 locations participated in the conference. The faculty consisted of Frances Akelewicz, Practical Solution; Nancy Singer, Compliance-Alliance; Cap Uldriks, FDA; and representatives from two medical device firms. The remainder of this article discusses five of the hypothetical situations for which there was a consensus among the registrants, FDA, and industry participants.

Hypothetical 1. When one of the modules in Ace's new software program used to interpret the results of a glucose tolerance test is opened, the screen momentarily freezes. This does not result in the software malfunctioning or giving incorrect results. It's just a nuisance to some of Ace's impatient customers. Ace issues a software patch to correct the problem. What should Ace do?

Answer: Correction—Not Reportable. Ace's software patch would be considered a correction, but Ace would not have to notify FDA. Ace would review its risk evaluation and analysis documents and most likely would conclude that the fact that screen froze momentarily does not create a risk to health.

Uldriks reminded attendees that when the correction was made, Ace would be required to validate the fix to be sure there was no negative effect on another function in the software. He advises firms to document exactly how the software was changed so that, if the fix actually creates a different problem, the firm would know what it did and when.

Hypothetical 2. Each time version 3.2 of Beta's software program is opened, a malfunction causes a 3-second delay in the initial cycle of the cardiac pump, which supports an intraaortic balloon catheter. The secretary at the hospital who reported the complaint stated that there does not appear to be any effect on the patient. What should Beta do?

Answer: Correction—Reportable. Beta should do a correction by providing a software patch to its customers, and it should submit a report to FDA. There is an element of uncertainty associated with the patient risk. Although the secretary stated in the scenario that there did not appear to be any effect on the patient, the cardiac pump is a life-sustaining device. Because a malfunction has occurred, and the malfunction caused an interruption in the circulation of blood, there is a health risk.

Hypothetical 3. Delta plans to distribute a sterile kit that has an outer sealed package and an inner package. The kit includes a sterile drape, latex gloves, a surgical gown, and an oncology treatment port. Delta's QA director notices that a corner of the outer sealed package was found to be unattached to the rest of the package on several lots that were located within Delta's distribution center. What should Delta do?

Answer: Correction—Not Reportable. Delta should correct the problem by repackaging and resterilizing the outer and inner packages, but the company would not have to submit a report to FDA because the entire product is under Delta's control. If any of the products had been released for distribution, Delta would have had to remove the product and notify FDA.

Any time there is a breach of a sterile barrier, as evidenced by the outer corner being lifted in this example, there is a risk of infection that constitutes a potential health risk. Uldriks stated that when looking at the history of recalls involving sterility, nearly 98% are usually considered an activity that would meet the definition of a Class II recall. So, unless there is clear evidence to the contrary, firms should conclude that there is a risk to health.

In this situation, there were two sterile barriers. An argument could be made that, even if the first barrier is compromised, the second one is still intact and will maintain the device's sterility. Firms must use caution when making this assumption. If the outer seal has been compromised, bacteria might still be introduced into the sterile field, contaminating the product.

Hypothetical 4. During dialysis treatment at the Harris Dialysis Treatment Center, the femoral artery catheter manufactured by Tops Medical would not draw blood. When a physician's assistant removed the catheter, he noted that the tip was occluded with tissue. This occurs about half the time when doctors are in a hurry and improperly use the catheter. What should Tops Medical do?

Answer: Correction/Removal—Reportable. If the data within the firm confirm that this is not an isolated incident, Tops needs to take the appropriate corrective action and report the correction or removal to FDA. The occluded catheter clearly poses a health risk to dialysis patients, a population already at risk. If Tops modified the instructions or conducted physician training, this would be considered a correction. If Tops removed the product from the market and redesigned the catheter to decrease the likelihood that the tissue would occlude at the top of the catheter when the physician inserts it into the patient, this would be considered a removal.

If, after the first instance, Tops filed an MDR and notified FDA in the report of its correction or removal activities, then Tops would not be required to file an additional report under 21 CFR 806.

Hypothetical 5. The vice president for quality of Tone Dental Supplies was informed that an intermittent software failure of the gamma sterilization cycle might have resulted in the shipment of nonsterile dental instruments that were labeled as sterile. What should Tone Dental Supplies do?

Answer: Removal—Reportable. Tone Dental would need to remove the product from the market and file a report with FDA under 21 CFR 806. Because the instruments are used in a dental office where the patient may experience bleeding, they must be sterile to minimize the transfer of bacteria that may cause infection. Because Tone Dental can't confirm that the product shipped is sterile (due to the software failure that occurred during the sterilization cycle), the company must assume that the device is nonsterile, and there is a potential for a health risk.

Conclusion

Regulatory and quality officials in medical device firms want to comply with 21 CFR 806. They need to study the rule contained in 21 CFR 806 and the preamble to the rule contained in the May 19, 1997 Federal Register, 62 FR: 27183.

When an incident occurs, they need to collect the facts, perform a failure investigation, and then evaluate the results using risk management tools. When appropriate, they should implement corrective action and determine whether they need to notify FDA under 21 CFR 806.

If FDA were to publish a guidance in collaboration with industry illustrating the use of risk management tools, this could provide a common approach for determining risk to health. Additionally, FDA should continue to educate industry so firms can benchmark their techniques for analyzing and correcting product problems and FDA can provide feedback to them.

References

1. Code of Federal Regulations, 21 CFR 806.
2. 21 CFR 7.3(m)(1).
3. 21 CFR 7.3(m)(2).
4. 21 CFR 820.
5. ISO 14971:2000, “Medical Devices—Application of Risk Management to Medical Devices” (Geneva: International Organization for Standardization, 2000).
6. 21 CFR 806.10(e).

Nancy Singer is president of Compliance-Alliance LLC, in Arlington, VA. She can be reached at [email protected]. Frances Akelewicz is founder of Practical Solution Inc. (New Providence, NJ). She can be contacted at [email protected].

Copyright ©2006 Medical Device & Diagnostic Industry