Originally Published MDDI October 2005
Q & A
Deciding between paper and electronic device records may seem obvious. Less obvious are the considerations that go into creating a DHR that is not only functional, but also makes the manufacturing process more efficient.
By Erik Swain
Understanding what FDA expects in terms of compliance is one of the greatest challenges a device company faces. Who better to glean insights from than Wally Pellerite, who retired from CDRH in early 2005 after 30 years of working on the agency's compliance side?
For most of his CDRH tenure, Pellerite served as assistant to the director of CDRH's Office of Compliance (OC). In that position, he wore many hats. He played a large role in developing enforcement strategies and coordinated OC's review and follow-up of particularly difficult compliance issues for various product areas. He reviewed and approved warning letters and other regulatory actions, making sure they complied with CDRH policy. He also worked with OC's division directors to guide and coordinate workload and served on the CDRH staff college and conducted training of compliance personnel. For his efforts, he received Distinguished Service Awards from FDA in 2005 and the Department of Health and Human Services in 2003, among other honors.
After retiring from FDA, Pellerite joined the Rockville, MD, office of Quintiles Consulting as director of strategic compliance. There, he helps FDA-regulated companies develop quality systems, implement corrective action plans, train employees in GMP and QSR issues, and formulate quality policies and procedures. He spoke to MD&DI East Coast editor Erik Swain in June.
Q: What are the most common compliance issues giving medical device firms trouble today?
A: My experience has led me to believe that it's the failure to properly investigate complaints and take care of them. The agency has continued to see this for years and years. Firms just don't have the processes and procedures in place to achieve consistent and complete reviews and investigations of complaints. That includes failure to have a proper medical device reporting [MDR] system. Over the years, MDR issues have been confusing. It's not a black-and-white area. In the big picture, though, you have to ask: What is the significant downside to not reporting? Why not err on the side of caution, when it can come back to hurt you if you don't file reports?
Another issue is that firms don't understand the intent of the quality system regulation [QSR]. When firms would solve problems, they would implement patchwork solutions. They would fix the problem and think it was solved without going through and looking at the system itself to identify why the problem occurred. It's one thing to fix a problem, but another to fix the inadequacies in the system that led to the problem.
The agency is in a bit of a state of flux as to how to best use its enforcement tools. The biggest change now is that the agency is looking at management responsibility, especially in larger companies with multiple facilities. The agency believes that when problems are uncovered at one facility, the management with executive responsibilities should make sure that the other facilities are aware of those problems and that necessary actions are taken in those facilities. That [approach] will be more [widespread] in the future, instead of using FDA resources to identify issues on a plant-by-plant basis.
Q: How have agency priorities changed?
A: Going way back, the agency has looked at complaints and process controls and what went wrong with various issues surrounding them. Now, there is less emphasis on process controls and more on corrective and preventive actions [CAPA]. In the old days, if investigators focused on CAPA and management controls, it was a sign that they did not want to work very hard. But there's been a big change now. CAPA and management control issues are seen much more frequently, and the agency is relying on that. A for-cause inspection may look more directly at process controls, since there is already an indication of a problem there.
Q: Did the Medical Device User Fee and Modernization Act of 2002 (MDUFMA) bring about any changes at OC? If so, how well did OC adapt?
A: When MDUFMA came about, there was a lot of interaction between the agency, industry, and Congress. Unfortunately for OC, all of it was on the premarket side. That resulted in an obligation for the agency to perform within certain parameters. What was never considered was the required preapproval inspection. As a consequence, the flexibility FDA had in “stopping the clock” was not built into MDUFMA protocols. So OC was stuck with limited time constraints and virtually no ability to stop the clock.
In my opinion, the agency has done an outstanding job in meeting the time frames. It is by no means easy. But there is a more troublesome and problematic issue. Industry goes through the review process, the scientific questions are answered, and then the district goes out to conduct the inspection. The reviewers routinely find that the firms are not ready. Maybe the firms won't be ready for 4–8 months. The manufacturing process is not established to a point where it can be inspected. And then when firms are ready, they expect the district to get right to it. I think the agency is trying to work something out there. It's a significant issue that places a lot of burden on the districts.
Q: What does FDA's risk-based approach mean for device firms?
A: I believe it's a more logical approach to [the process]. When you consider that there are 17,000 potential sites out there to be inspected, and the obligation is biennial, that presents problems that even a huge organization would have trouble overcoming. Considering that there are so few investigators employed by FDA, [a full biennial inspection of all plants] is a virtually impossible task. It only makes sense to approach it from where the problems are. More often than not, those involve life-supporting devices, or Class III and Class II devices with critical functions. When a problem occurs with those devices, there is more likely to be an associated risk to public health.
It also means FDA will look at a firm's history. The agency will continue to use recalls as an indication of a problem, because a recall indicates a violative product. It's a good sign there is a system problem at that facility.
There is more emphasis on trending problems through MDR, especially in high-risk device areas. For example, the agency got concerned when the reports showed widespread problems with infusion pumps. So that has resulted in more inspections of those facilities.
Q: At times over the years, FDA has been perceived as anti-industry, but more recently the perception is that it is industry-friendly. With recent Congressional and public criticism of FDA, there is concern that the pendulum may swing back. To what extent does political pressure affect OC?
A: When it comes to specific enforcement actions, I don't believe there's political pressure at work. Occasionally, a firm will pull in a congressman or senator on a legal issue. That does not have much of an effect. By that point, the problem is already documented, and we end up trying to explain the legal issues to the politicians. It's more of a burden on OC.
When you go back in history and look at violation rates and recalls, you see bell curves that coincide with these pendulum swings. There was a lot of pressure in the 1980s to get products on the market quickly, and the agency sped up approvals. By the late 1980s, Congress said, “Hey, what are you doing here? Who's protecting the public health?” There were hearings on pacemakers, heart valves, and other products. That led to, under Commissioner Kessler, a much more enforcement-minded agency in the early 1990s. There were corporate-wide actions against large firms.
My opinion is that when the enforcement arm is reduced, it leads to problems that pose a risk to the public health. Take warning letters. Essentially, they are just an official notice to firms that FDA believes a problem exists. The large majority of them are solved voluntarily. Only when there is a failure to voluntarily work to cooperate with us and solve a problem is there a seizure or an injunction.
But when warning letters are not sent, problems are not addressed. To me, it was just a matter of time [before the public would complain about inadequate FDA enforcement] after there was a great reduction in warning-letter enforcement by the agency. [Former FDA Chief Counsel] Dan Troy wanted FDA to write them only when the violations were egregious. He subscribed to a literal reading of the law. Firms noticed that and began to take more chances. In the long run, that catches up with you. The lack of a strong enforcement atmosphere lends itself to taking greater risks. And that leads to Congress saying, “What are you doing? How did that happen?”
What's astounding to me is that there is not a greater interest by firms to get to the root of problems and fix them. Recalls can cost millions. Failure to do something can come back to haunt firms. I believe the big issue is usually money. Some firms are very shortsighted about it. If they have two to five recalls, how much does that affect their business? They don't consider the long-term costs of taking shortcuts.
The agency's job is to protect the public health and to take action if needed. If it loses a court case because it didn't have the authority to do something, then it should go to Congress to correct that deficiency. The likely result of the Congressional hearings is an environment of increased enforcement, trying to bring things back to normal.
Q: In a recent interview, Troy said he believes the agency should go to Congress for more authority before a case makes it to court, not after losing in court. He believes losing court cases undermines the agency's credibility.
A: Yes, you shouldn't take bad cases, but losing a court case is not necessarily bad. The court's role is to decide the extent of legal jurisdiction. If you only bring the cases you're guaranteed to win, you won't be able to point out any problems or inconsistencies of current laws. I think the approach of simply looking at it from a legal standpoint fails to protect the public health. Lawyers do not have the scientific or medical expertise necessary to make the final decision about which public health issues warrant legal action. That is the role of the centers. If FDA loses a court case, then that informs Congress that the agency does not have the authority in that area and can't adequately protect public health. In a utopia, [Troy's approach] would work. But it's not practical for the commissioner of FDA to lobby Congress to change a law every time a significant public health issue comes up and FDA's authority is not absolutely clear. That's not how the system works.
Q: Both Troy and former ODE deputy director Phil Phillips, whom we also recently interviewed, believe most firms want to do the right thing. You seem to have a different philosophy. Do you think firms inherently cut corners?
A: I agree with much of what Phil and Dan told you. Most firms see the importance of producing quality products, abiding by the law, and doing the right thing. The number of renegade firms is extremely small. Most firms do want to do the right thing.
Where I might differ is that some firms just don't get it. It's not that they want to do the wrong thing or are trying to get around regulatory requirements. I believe that they get into the habit of having tunnel vision. They believe that they are doing the right thing and do not need to address the issues raised by FDA. They say “we've been doing this for 20 years, we know what we're doing.” They are reluctant to change. I don't mean to imply that they are intentionally cutting corners. They just do not see the need to do all these so-called extras, especially in an era of reduced enforcement.
Q: How should device firms be handling 21 CFR Part 11 now that FDA is exercising enforcement discretion?
A: That unfortunately was a very, very confusing mess. There are two things firms must do when they go down the electronic roadway. First is to conduct a survey. Identify all of the systems, software, off-the-shelf devices, etc. being used. Firms are often surprised at how many different facilities use different products. It is critical to identify everything you are using, including software. When you do develop a system, you have to build in protection and ensure security. If you require a signature, only individuals who are authorized should have access to that portion of the system. The second thing is that you have to validate whatever system you implement.
At some point in time, the agency will work electronically. If you know what you are using, set up a good system, and validate your software, you will be in much better shape. I'm no Part 11 expert, but that's basically the road to success in that area.
Q: What sort of risk management program is OC looking for from a device manufacturer?
A: We're not necessarily looking for risk management programs in firms. Since the inception of the quality systems inspection technique, every inspection has looked at CAPA and one other quality system element. Complaint handling, evaluating, and investigating are the keys. These unlock the problems out there. We are trying to get to the root causes of problems. Shortcuts, such as dismissing a complaint by saying, “The doctor didn't think it was device related,” or “I didn't get the product back,” are not a systems approach. You can certainly take a look at the device history record and other complaints. You have access to information besides what was specifically received in that one complaint. That kind of approach sends a message to the agency that you are aggressive about investigating and addressing problems when they come in, and that you have processes and procedures that allow you to handle these issues the same way, no matter where [complaints originate] or who reviews them.
Q: What is OC's role in enforcing compliance with device advertising and promotion regulations? What are the most common problems in that area?
A: OC is at the forefront. It takes a lead role in the responsibilities that go with that area. That has always been a frustration of mine. In my career, there were two attempts at producing a restricted-device [advertising and promotion] regulation. Both times, it fell by the wayside.
People always want to compare device advertising to drug advertising. But the fact is that the laws and regulations are different. There are 45 people in the Division of Drug Marketing, Advertising, and Communication who are looking at drug advertising and promotion. On the device side, before a recent increase, OC was down to two. And CDRH has more products, more facilities, and more manufacturers out there. So the failure to have a restricted-device regulation really limits FDA's authority.
If a device goes through the premarket approval [PMA] process, or if a device—for example, a hearing aid—has a specific regulation, then that gives FDA more authority to address promotion and advertising issues. The agency does have control over promotion and advertising of PMA products. What OC tends to go after is promotion of unapproved uses. There it has a regulatory hammer: lack of a PMA or 510(k) for that use. In other areas—how ads are placed, acknowledgment of risks—there has been an effort to parallel what has worked in the drug area, but with no hammer behind it. That being said, OC has been able to get a fair amount of cooperation from firms to do the right thing in these ads.
What escapes people is that all the regulations in this area were promulgated in the 1970s. There was no such thing as overnight delivery or global access or buying devices on the Internet. The regulations really haven't caught up with the significant changes that have come about in the last 20–30 years. So you're trying to put square pegs in round holes.
Q: Industry sometimes complains about inconsistencies in enforcement. While no one would expect complete consistency to be achieved, has OC done anything to improve it?
A: This is not just an OC issue. Most enforcement issues start in the districts. They have a lot of independence. Certain districts do more device work, while others do more with food or drugs. With more than 20 districts, you are bound to get some differences of opinion. Some district directors may have different philosophies than others. You can't have everything perfectly consistent when there are this many entities, laws, and regulations. Everything is not black and white. There are different opinions as to whether something is violative.
But I believe the agency is fairly consistent. You can always pull out an outlier. That happens every so often. A firm will say, “Go after these guys because they're doing the same thing.” I always like to use the analogy of a state trooper. They may pull someone over for going 65 in a 55 zone, and while they are dealing with that, someone else may be speeding by at 80. We can't catch everyone at once. We don't have the resources to do it.
Major inconsistencies are by and large a rare exception. What I always told firms that raised this issue was, “If you believe that, send me a formal complaint.” When the agency receives that information, it is obligated to look into it. Firms are entitled to a level playing field, but it's impossible to catch every problem. There are checks and balances: the individual branches and districts, OC, the Office of Investigations, the Office of Chief Counsel. Compliance policy guides are available to advise firms on well-established agency policies and positions.
I must also point out that OC had a two-and-a-half-year period with no permanent director. That places [an acting director] in a very, very tough position. You're damned if you do and damned if you don't. Either you're accused of making waves or not doing your job. It's hard for anyone in an acting position to establish an enforcement policy.
Q: A device firm is preparing to be inspected for the first time. What steps should it take?
A: The one thing you should do is hit a home run with CAPA. Whatever you do, know that the first thing the agency will be looking at is CAPA. How you handle a problem and what procedures you have in place are the first things FDA looks at. Make sure you have a system in place that is appropriate to evaluate, investigate, address, and determine the root cause of problems; take corrective action when necessary; and do it uniformly. It's a fact of life that not every product is perfect. It may be the result of any number of things. That's why you have a quality system. You need to address each issue to help minimize problems. If you can't prevent all problems, the key is what you do when you have one.
Another thing that tends to be overlooked is the corporate quality philosophy. It's often not top-down. I would receive a letter from a CEO talking about the company's commitment to quality. But when you looked at the record, the employees were not properly trained, procedures were not being followed, and management with executive responsibility seemed to be out of the loop.
Everything flows down. Management needs to lead by example. When managers take training courses in these areas, it sends a signal to employees.
Q: What sorts of things will earn a firm a bad reputation with OC?
A: There are two things that come to mind. One is firms that try to hide data. The second is firms that attempt to phone-shop for an answer. Some firms keep calling people at FDA until they get the answer they want. If you have a compliance issue, call a compliance person. If you're trying to interpret whether you've made a significant change to your product, call the Office of Device Evaluation [ODE]. Don't call ODE for an OC issue. I always tell people that if they are making a business decision, don't rely on a telephone conversation. If you call me and I say something, and two years later an inspector questions it and you say, “But I talked to Wally Pellerite,” that won't do you much good. I could have retired, forgotten the call, or have a difference of opinion on what was said. Use the phone to get a general idea of the agency's position, but if you're going to make a business decision, get something in writing. Some firms use the Division of Small Manufacturers Assistance, International and Consumer Affairs. They do a great job at giving general information. But if you have an issue that is specific to your device, go to OC or ODE and get something in writing, even if it's e-mail. If in two years, [the opinion] turns out to be wrong, you have a “get out of jail free” card.
Q: Is there such a thing as earning a good reputation with OC? If so, what can a firm do to achieve it?
A: I can recall my bosses, including [OC director] Timothy Ulatowski, saying that the proof is in the pudding. It's not about making promises and telling us how great you do things, but about demonstrating that you know what the issues are and are working to resolve them, that you demonstrate to the agency that you understand it, that you're making progress and can document it. Provide evidence of how things have changed. What new procedures have been written? What training has been conducted?
An example may be a case where one firm purchases another. As part of their due diligence, they uncover a significant regulatory problem. They request a meeting with OC, make OC aware of the problem, and bring OC a plan that corrects the problem. There are different philosophies about telling on yourself. Some consultants say never to do it, because it will hurt you in the long run or present you with a potential legal problem. However, I believe it sends a good signal to OC and gives the agency reassurance that you know what you're doing, and you might even avoid a warning letter. If a warning letter is issued, it would likely note the actions being taken to ameliorate the situation. An open dialogue does more good than harm, especially when firms find themselves in trouble. When you can, provide the agency with the documents that clearly establish you are working to correct the problem.
Another way to think of it is this: You can't control how a problem is presented if an FDA investigator uncovers it and it is publicized in a press release from FDA.
Q: What recourse does a firm have if it disagrees with an OC action?
A: Any time you have an issue, it's critical to go through the chain of command. If the problem is with an investigator, go to the next supervisor, the district director. It's important to remember that the center is not responsible for field investigators. That's the job of the Office of Regulatory Affairs. The district and regional directors have authority over those employees. If you exhaust the district channel, then go to OC and start with the branch chief. If you start with the office director, it will just be sent down to the branch level anyway. Follow the chain of command. You have options, and they can be found in 21 CFR 10.33 and 10.75. There are appeals. You can ask for a reconsideration.
The best advice I can give is not to make it confrontational. When you meet with the agency, make your point and stick to the issues. Identify what the problem is and limit the discussion to that. Give as much background information as possible. Keep the meeting to an hour. When all else fails, the ombudsman, Les Weinstein, is available. His role is more of a facilitator, but he will ensure that your concerns are heard.
Q: When should a firm hire a consultant for compliance issues?
A: Any time you have a significant problem with FDA, it is usually a good idea to get an outside opinion to determine whether you have a proper handle on the issue. Often, firms believe they are on the right track, working hard to resolve issues, and spending a lot of time and resources, only to find out the agency does not agree. Having an outside pair of eyes looking at things can go a long way to getting a firm a better understanding of the exact issues that FDA is raising, what the FDA expectations are, and the best way to resolve those issues.
When you've always worked in industry, it can be hard to understand how FDA sees things, just like when you've only worked at FDA, it can be hard to understand industry's point of view.
Copyright ©2005 Medical Device & Diagnostic Industry