HACCP: Resolving Product Safety and Liability Nightmares

Originally Published MDDI January 2003

INDUSTRY CLOSE-UP

In today's business environment, the benefits of implementing HACCP into a product development and manufacturing process are well worth the effort.

Lorena L. Williams
The Chubb Group of Insurance Companies

Late in 2001, a Minnesota man died from tainted tissue implanted during reconstructive knee surgery. After his death—and numerous serious infections among other patients—FDA ordered CryoLife Inc. (Kennesaw, GA) to recall and halt sales of the implantable human tissue that accounted for a large share of its revenues.

The agency alleged CryoLife could not ensure that the implantable tissue was free from fungal and bacterial contaminants. Costs associated with the recall turned a projected $2.8 million profit for the second quarter of 2002 into a $5.5 million loss. CryoLife stock slid, the firm laid off workers, and its bank warned it might call in loans.¹

Even as CryoLife expresses optimism about its prospects for full financial and regulatory recovery, its problems continue to serve as a striking reminder that medical device companies whose products can cause death or serious injury should be looking at ways to make those products safer. This means taking an honest look at vulnerabilities that can compromise a product's safety and taking action to prevent them from occurring.

Companies would go a long way toward resolving product safety and liability nightmares if they implemented Hazard Analysis and Critical Control Points (HACCP), a scientific and systematic approach to minimizing the impact of manufacturing processes on product safety and performance. Unlike current safety systems, which focus on finding defects during manufacturing through spot checks and by testing the end product, HACCP focuses on three key areas: identifying critical safety hazards in advance, establishing preventive measures to control hazards reasonably likely to occur, and monitoring each critical control point for the hazards identified. HACCP would best suit the medical device industry if it could be adapted to encompass the entire product life cycle.

A Space-Age Solution

HACCP was developed three decades ago by Pillsbury Co., the National Aeronautics and Space Administration, and the U.S. Army Laboratories at Natick. The collaboration sought a way to meet the space program's need for nutritious food that would not spoil and did not need preparation. The program focused on preventing hazards that could cause food-borne illnesses by applying science- based controls, from raw material acquisition through production of the finished item.

Since then, HACCP has become accepted worldwide as an effective way to ensure food safety. Not long ago, momentum was building at FDA to incorporate HACCP into its safety program for medical devices, but the effort stalled because of a lackluster response by the industry.

Proponents of HACCP—academics and industry experts who have studied it and teach companies how to use it—don't believe FDA regulation should be the primary reason that medical device manufacturers embrace HACCP. Companies should adopt the approach because it can protect patients and save companies money. A company that can minimize, during the manufacturing process, errors that compromise safety can save the expense of a potential recall and product liability costs. And because using HACCP can identify problems long before the end product testing stage, companies can save the cost of rework and product that must be scrapped.

HACCP Principles

HACCP consists of seven steps: Conducting hazard analyses, determining the critical control points, establishing the critical limits for each control point, establishing procedures to monitor each critical control point, establishing corrective actions, establishing verification procedures, and establishing recordkeeping and documentation procedures.

Conducting Hazard Analyses. Companies conduct an analysis of each manufacturing process to identify potential product safety hazards and develop preventive measures to control them. The hazards might be biological, chemical, or physical. Hazards are ranked in order, from most to least significant, and controls are ranked from most to least effective.

Determining Critical Control Points. Critical control points are those points in the manufacturing process where product safety can be compromised if a problem occurs. They are also points at which potential hazards can be controlled or eliminated. There may be many possible control points, but it is important to focus on those that are considered critical and for which preventive measures can eliminate the hazard or reduce it to an acceptable level.

Establishing Critical Limits for Each Control Point. Critical limits are parameters, such as maximum or minimum values, used to ensure that a process is working properly or that the product meets a safety specification.

Establishing Procedures to Monitor Each Critical Control Point. Continuous or frequent monitoring of critical control points is essential to ensure that processing systems are working properly and that critical limits are not breached.

Establishing Corrective Actions. Corrective actions must be defined in advance and must be taken when monitoring reveals that a critical limit has been compromised. This may involve removing defective materials from production to get the control point back within the critical limit.

Establishing Verification Procedures. There must be procedures, in addition to monitoring, to verify that the HACCP system is working correctly. They often take the form of an audit.

Establishing Recordkeeping and Documentation Procedures. The company must keep records of hazards and their control methods, monitoring data for critical control points, actions taken to correct potential problems, and verification activities and results.

HACCP and FDA

FDA first considered making HAACP a mandatory requirement as part of the evaluation of new products in the 1970s. "That didn't go over well [with industry], and it died a quick death," said Philip Frappaolo, acting director of compliance for CDRH. Then, in the late 1990s, as part of FDA's reengineering initiative, CDRH developed a pilot project to measure the effectiveness of HACCP.

According to Frappaolo, FDA did not intend to make HACCP mandatory; the agency expected hundreds of companies to jump on the HACCP bandwagon because of the potential for saving money on waste and rework while controlling risks in the manufacturing process. Companies participated in developing the training manuals and FDA's HACCP team trained about 1200 people, representing hundreds of companies. But when it came time to sign the feasibility agreement protocol they helped write, few companies stepped forward.

Some HACCP proponents reasoned that once it became clear FDA would not make HACCP mandatory, industry lost interest. There is also another factor that may have contributed to the loss of momentum: the agency's new quality system inspection technique (QSIT) was developing on a parallel course with HACCP. Even though many at CDRH believed that HACCP and QSIT worked well hand in hand, Frappaolo said, others viewed the systems as being competing inspection programs.

Even firms that may have been using HACCP appeared unwilling to submit data to FDA. Some firms feared that if they submitted a HACCP plan with their premarket approval application, approval might be delayed because of the study. It's just as likely that firms feared that HACCP would reveal a problem with their product and that the product would not be approved until the problem was corrected.

Why Use HACCP?

It's true that HACCP exposes a company's product safety vulnerabilities; many companies may be reluctant to run the risk that FDA would force them to make expensive corrections to problems that the process unveiled. While that position is understandable, it is not defensible. Indeed, HACCP brings vulnerabilities to light for that precise purpose: so manufacturers can address them before they cause harm.

That is not to say that HACCP is perfect; it's not. Nothing can guarantee safety, and to serve the medical device industry well, HACCP should be broadened to address hazards and controls during the design stage of the product. Companies also must address those residual risks that are not considered critical. Even with these weaknesses, though, prudent medical device manufacturers can look to the principles of HACCP as the foundation of a robust, enterprisewide risk management program.

There are a number of reasons—aside from obvious concern over patient safety—that the time is right for medical device manufacturers to embrace and adopt HACCP.

Corporate Responsibility. In the post-Enron, post-Worldcom business environment, there is a growing focus on corporate responsibility. With increasing skepticism of business, regulators, investors, and other stakeholders will be paying closer attention to best practices and will be punishing those companies that put their assets at risk by cutting corners.

The Information Age. If a company experiences a product crisis, news about it—whether fair and accurate or not—will spread like wildfire, reaching more people more rapidly than ever possible because of the Internet and the proliferation of round-the-clock news channels. The more steps a company can take to avoid or mitigate such crises, the better able it will be to defend itself in the court of public opinion.

Litigation and Insurance. An aggressive plaintiffs' bar has had great success targeting companies that manufacture medical products. Medical device companies must necessarily be concerned about their vulnerability to product liability lawsuits. In the 1990s, the average verdict in medical product liability lawsuits was almost $2.8 million, with 47% of verdicts over $1 million, according to Jury Verdict Research (Horsham, PA).

A company that has implemented a HACCP plan has a better chance of successfully defending itself in court. Why? Because the HACCP process requires that a company be vigilant about safety and document the steps it takes to ensure it. The courts recognize that companies cannot prevent injuries 100% of the time; the fact that a company has complemented its quality program with a formal, rigorous hazard analysis and risk management process will demonstrate just how vigilant it is.

At a time when many insurers are raising prices, tightening underwriting, and restricting coverage, implementation of an HACCP program might also save money on insurance premiums. Some insurance companies have specialty programs that address the unique needs of the medical device industry. As part of the underwriting process, these insurers may offer better prices and better coverage to companies that implement product safety controls that exceed minimum standards.

HACCP and Quality Controls

HACCP does not replace substantive quality control measures, such as those called for by FDA's quality system regulation (QSR). Rather, it is a set of protocols that enable medical device manufacturers to minimize process errors. The QSR focuses attention on the design process, during which medical device companies are required to conduct a hazard analysis and implement controls into the design of their products. At times, however, those controls are lost as the designs move into the production stage. The QSR does not require that companies have a formal process for documenting and communicating all the hazards and controls that were identified in the design phase to the people who take control as the device moves into production.

One of the weaknesses of HACCP is that the program has been focused solely on the manufacturing phase. But a company that considers HACCP principles during the design stage and implements them in manufacturing—as well as during distribution and use in the field—may reduce the risk of fatal errors throughout the product life cycle.

Conclusion

One common criticism of HACCP is that it applies more to process industries than to discrete manufacturing. This is a misconception. With HACCP, a company must identify hazards up front and control them during manufacturing and use. The complexity of the device has nothing to do with whether HACCP can be used. For complex products, the manufacturing process is subdivided and separate HACCP plans may be developed for each process step.

Given FDA's tight funding, it is unlikely that it will engage in promoting HACCP or promulgating HACCP principles. That is why it is essential that industry take the lead and look for ways to take this risk management system, which is so widely accepted for food safety, and adapt it to work just as effectively for medical device manufacturers. And should FDA revisit the idea of HACCP and revive its feasibility study, it is incumbent upon prudent medical device manufacturers to step forward and volunteer.

REFERENCES

1. "CryoLife Announces Filing and Certification of 10-Q; Revises Previously Announced 2002 Second Quarter Results due to FDA Order," CryoLife Inc. news release, September 4, 2002.

2. OV Oparah, Implementation of Hazard Analysis and Critical Control Points (HACCP) Plan as a Continual Improvement Initiative in the Manufacturing Process of Medical Devices (master's thesis, Massachusetts College of Pharmacy and Health Sciences, Boston, 2001).

3. S Maschino and W Duffell Jr., "Can Inspection Time Be Reduced?: Developing a HACCP Plan," Medical Device & Diagnostic Industry 20, no. 10 (1998): 64.

The author will be responding to questions and comments about this article in MD&DI's Author Forums during the week beginning February 10, 2003. Visit www.devicelink.com/mddi and select the Author Forums link.

Copyright ©2003 Medical Device & Diagnostic Industry