Medical device makers that have facilities outside the United States and use foreign suppliers are still being scrutinized by FDA. An expert weighs in on the specific challenges device manufacturers face today.

Marie Thibault

The medical device industry is becoming increasingly global, with U.S. companies gaining foreign facilities and trial sites through outsourcing, acquisitions, and geographic expansions. Suppliers from outside the United States are providing the components for medical devices cleared and sold in the United States.

But even though these facilities and suppliers are physically located far beyond the U.S. borders, FDA still has responsibility to ensure U.S. devices are safe. This means FDA has had to expand its OUS presence as well. 

What is FDA doing to increase its global oversight? What does this expansion mean for U.S. device makers who work with foreign subsidiaries and suppliers? We asked Mohan Ponnudurai, industry solutions director at Sparta Systems, to tell us more about the shifting global regulatory landscape. Here, in edited excerpts from our discussion, he tells us what device companies need to know.

MD+DI: What oversight does FDA have now over foreign facilities and clinical trial sites used by medical device makers?

Mohan Ponnudurai: FDA did not really have too much in terms of execution of their powers from a foreign supplier standpoint until recently. Mainly it comes to pharmaceutical products, even the US or European companies, there’s a lot of APIs, active pharmaceutical ingredients, that come into these products, and a lot of them come from foreign countries that are beyond the reaches of FDA, until recently.

With the changes FDA has a mandate to really audit those API companies and also they have created more close relationships with the local regulatory bodies. Two of the countries that provide the greatest number of the APIs are China and India. They are probably the largest exporters outside of the U.S. So, they have close relationships and FDA also has field offices open in those countries as part of regulating and mandating the requirement. So, both those countries’ regulations pretty much mirror what FDA requirements are from the applied perspective.

So, the challenge for FDA is two-fold. One, is they recognize there is a global expansion of these API suppliers, and their requirement particularly is, they have to advise them just like they would a U.S. company. The biggest issue is the bandwidth. They can’t really audit all of them so they have to depend on the local regulatory compliance agencies. So, that’s the biggest balance. Really how to really audit them and how to really approve them. But in a country like China, where one API supplier is shut down, they can just pop open another one. So it’s really, how to keep track of all that? That’s the biggest challenge they have.

. . . It’s very similar in all the life sciences, both medical devices and pharmaceuticals. How do they really mandate from the registration and tracking perspective, because they are working with different systems, right? So that is actually the biggest challenge, I think, on a management of the data and how to really track and trace what goes into the final product mainly when it comes to issues, like adverse events, complaints, and public safety, for example. . .

MD+DI: Is it the same sort of situation for medical devices?

MP: It is pretty similar, but the device side is somewhat easier. It’s not easy, but is easier, because devices are more discrete manufacturing as opposed to process manufacturing, unless it’s a combination product. It is a lot easier to track a discrete manufactured product because they are individual components of products that make up the devices as opposed to process manufacturing involved with pharmaceuticals products. So, it’s somewhat easier but it has its own challenges as well, mainly when it comes to master data management . . . So UDI, that’s one of the reasons for the UDI, right?

MD+DI: What will it take for FDA to expand globally? It seems to me they are stretched for resources already.

MP: One of the main challenges is the bandwidth of auditing. They can’t possibly audit every supplier of every component that goes into every device that’s released in the U.S., right? They include audits based on risk profiles, because that’s one way to make their resources more efficient. They also use excellent third party auditors. But still, the challenge is, how do you unify and really maximize efficiency and share the information with the other regulatory body?

For that, they started this program about a year ago, called MDSAP (Medical Device Single Audit Program). . . It takes a lot of effort, because there are a lot of moving parts involving a lot of different regulatory bodies and observer regulatory bodies. So it really takes a lot of time to unify something like that, the thinking behind it.

It's moving very slowly. It requires a lot of effort . . . what is the criteria for auditing, what is the criteria for frequency of the audits, things like that. . . They have the right idea, but it's going to take a while for it to really come to fruition . . . 

MD+DI: What are the biggest challenges device makers face with their overseas facilities? What are the common problems and issues that you see frequently?

MP: What we see in the field, between the U.S., Europe, and countries like India and other large markets is, they are striving to standardize, at least follow the lead of FDA, because this is the biggest market for them. European standards are pretty much similar to FDA, with a little bit of nuanced differences. So, they are trying to standardize them, but the problem comes from the fact that a lot of these companies have grown by acquisition, so they kind of inherited systems that came along with those acquisitions. They may have the same products or components that go into their products, but because of the different systems, they have different product numbers or things like that. Really the challenge for them is MDM, Master Data Management. What is the record of truth that they need to use to centralize on that? Usually that's the biggest hurdle that they're facing from a structural perspective.

They also understand that once they reach that, once they have an accepted single data source for these common components, they have no choice. They have to abide . . . UDI (Unique Device Identifier) is one of them. They have to get that right information into the right place. Then they can file the UDI supplements. . . 

I think there is a sense that the master information would be common between Europe and the U.S. That's the sense behind UDIs. We have seen the challenge, they are going through it, and they also know that they have to go through the requirements, at least for Class III, which started already, and Class II is going to be coming up in September and Class I, they still have three years left.

So, definitely going through some teething pains, but I think they are really getting the hang of it, at least for the Class III products, so far.

MD+DI: After the UDI process is over, do you think all companies will have a strong grasp on making sure foreign facilities are standardized with their U.S. facilities? Do you think the problem is solved or are there further challenges?

MP: I would not say the problem is solved. It's just the tip of the iceberg. That's the kind of sentiment that we are hearing, but I think that companies are a lot more optimistic about the UDI solutions, I think, because technology-wise, there are tools to support that. That's one of the ways that we are helping our customers . . . we had three customers that were ready before the UDI requirement was out of the gate in September of last year. . . 

They feel confident that they have the right platform, they have the right solution base, so they can scale it. China is coming with their UDI—it's going to have some variations, it's not going to be identical to the U.S. solution—but the core of that is going to be the same. 

MD+DI: After working with those customers that you guided successfully through the UDI process, what is your best advice to other companies who are still struggling?

MP: We basically say, don't think of UDI as just a UDI because UDI is connected to other things. You need to have the other things in place before you tackle the UDI. Because otherwise, garbage in, garbage out. Down the road, UDI is also going to be connected with eMDR (electronic medical device record), so think about that as well. . . 

MD+DI: Recently, FDA announced its participation in the International Medical Device Regulators Forum's (IMDRF) Regulated Product Submission Table of Contents voluntary pilot program. I'm curious what you think of this type of pilot program, where regulators are working together. What are your thoughts on that?

MP: I think this is kind of a blueprint for what is going to happen from the regulatory world. UDI was one of the first examples of the IMDRF cooperation and their final guideline for Europe was pretty much mirrored on FDA. Of the members of IMDRF . . . they kind of accepted that as the baseline. I think that's the way to go because if the FDA has these issues, the Chinese FDA has these similar issues, Indian regulators have similar issues, Health Canada has similar, so everybody is facing these similar challenges. 

MD+DI: What else should device companies know?

MP: More and more companies are relying on external partners like CROs, CMOs for manufacturing, they have partners for packaging and distribution, and it does not really absolve the parent company of any risks because they have partners. They still are responsible. They have to really manage the data that is coming from those partners as if it is theirs. When there is a recall or a 483 comes up, the company is stil ultimately responsible. When it comes to that point, that means they need to make sure that they have the access to the right data. They need to have the right traceability. They need to provide the evidence documentation to FDA. So basically they have the challenge as a company even though they are using external partners. I think that is one of the biggest problems for companies.

If you look at the top three causes of 483s, one of them is supplier controls . . . anyone who is part of the supply chains. That is one of the biggest pain points that we hear from our customers as they move through this, on how they can manage that information flow with the right traceability and getting the right information out in a timely manner when such things happen and FDA comes to audit them . . . 

MD+DI: Does that mean that these companies' regulatory and quality assurance departments have to just keep growing? 

MP: That's a good question. That's one of the solutions we (Sparta Systems) provide, because they can't really put in more people and think that putting more warm bodies will make everything work well . . . What we provide as a solution as part of this is how those external stakeholders can access the system of the company without really infringing on the security and the safety and the firewalls. . . so really, your process is efficient and effective without really adding more from an infrastructure or people perspective.

MD+DI: We just published our Regulatory Report Card. What do you think the new challenges will be for FDA in 5–10 years?

MP: It's a timely question. I was with a customer yesterday and one of the things that they were complaining about why things take so long to close . . . one of their complaints was about the approval cycles. They said the regulatory approval cycle at FDA is very unpredictable and the foreign regulatory body approval cycles are quite unpredictable as well. So it's a very fragmented methodology that the agencies use. These companies are challenged because they have to manage all that as part of the approval before they can even go into the marketing phase of the product. . . I don't know what the real root cause of that is. I think that challenge will remain because as we move forward, there are going to be more and more applications filed, more and more requests will come in. I'm not sure if that is going to change anytime soon.

Marie Thibault is the associate editor at MD+DI. Reach her at [email protected] and on Twitter @medtechmarie.  

[Image courtesy of STOCKIMAGES/FREEDIGITALPHOTOS.NET]