All medical devices have risk.

“You, as the manufacturer, are responsible for determining the risk of your medical device and if that risk is acceptable,” said Joseph Tartal, FDA deputy director in the Division of Industry and Consumer Education, who presented during the agencies virtual public workshop Understanding Risk with Medical Devices, Tuesday.

To start, it helps to understand the terminology.

While “risk” has no formal across-the-board definition in FDA documents, Tartal describes risk as looking at the harm that the device can cause patients and users and their environment. That includes harm from medical device failures.

Risk in this realm does not mean financial risk, he said.

The combination of the probability of occurrence of harm and severity of that harm go into determining the risk of a medical device.

But it’s not only risk that comes into play in risk management. Benefit is new to FDA’s definition of risk when it comes to medical devices, according to Tartal.

Here too there is no formal definition for benefit, but Tartal describes the benefit as “… the positive impact or desired outcome of the use of a medical device on the health of an individual or a positive impact on patient management or public health.”

Analyzing medical device risk

To analyze risk, systematically use available information to identify hazards and estimate risk. There are different approaches for this. Tartal suggested starting here: identify possible hazards, including user error; calculate or estimate risk in normal and fault conditions; determine risk acceptability; reduce risk to an acceptable level; and evaluate changes to make sure you’re not introducing new hazards.

It is up to the manufacturers to identify possible hazards and risk associated to reduce the risk to acceptable levels, according to workshop speaker Tonya Wilbon, branch chief, Postmarket and Consumer Branch, Division of Industry and Consumer Education at FDA.

Risk occurs throughout a device’s lifecycle, she said.

FDA uses risk-based decisions for medical devices, too

FDA classifies medical devices based on risk, with class 1 medical devices being the lowest risk and class 3 being the highest, Tartal noted.

“The Office of Regulatory Affairs uses risk to schedule medical device inspections. Recall classifications are based on risk, as are enforcement actions,” Tartal said. “We even use risk analysis tools such as health hazard evaluations and health risk assessments when determining a recall’s classification.”

The International Organization for Standardization (ISO) 14971 2019 “Medical Devices Application of Risk Management to Medical Devices” is the international standard for medical devices accepted around the world and is recognized by the FDA to establish a risk management process.

Risk management technique examples

Tartal talked about three commonly use risk analysis techniques: Preliminary Hazard Analysis (PHA), Fault Tree Analysis (FTA), a top-down approach; and Failure Mode and Effects Analysis (FMEA), which looks at risk according to individual line items, single component, or single processes.

Preliminary Hazard Analysis, usually done early in a device’s development, helps identify and prioritize hazards, hazardous situations and events that can cause harm, according to Wilbon.

“For each hazard identified, you identify and document the hazardous situation, the possible harm, the severity of the harm, and the probability of the hazard and hazardous situation leading to harm,” she said.

The Preliminary Hazard Analysis also includes identifying possible risk control measures, according to Wilbon.

Those doing risk analyses might use the Fault Tree Analysis to analyze identified hazards, estimating their probability and identifying situations when they might occur.

And Failure Mode and Effects Analysis identifies and evaluates individual fault or failure modes and is a bottom-up method that starts with cause and works toward effect or how it affects device use. This technique analyzes not only device failure but also failures in manufacturing and component assembly, Wilbon said.

Enter benefit-risk analysis

Once manufacturers have made all risk reduction measures and only acceptable residual risk remains, FDA conducts a benefit-risk analysis. FDA’s benefit-risk analysis considers many factors when determining benefits and risk for Premarket Approval Application (PMA) and de Novo classification; substantial equivalence in Premarket Notifications (501(k)); Investigational Device Exemption (IDE); and product availability, compliance, and enforcement decisions, according to Wilbon.

The factors that FDA considers in each of these areas often differ. For example, medical necessity is a factor FDA considers only when doing benefit-risk analysis for availability, compliance, and enforcement decisions, while “magnitude of benefit” applies in all four categories.

“… severity of risk or harm is considered during premarket review process and when making product availability, compliance and enforcement decisions,” she said.

Wilbon used the example of a benefit-risk analysis in product availability, compliance, and enforcement for a human chorionic gonadotropin (hCG) device—essentially, an over-the-counter pregnancy test that detects hCG in urine.

She said a healthcare provider noticed a higher rate of positive results, but the positive results were not confirmed in blood samples. So, the device yielded a higher rate of false positives than expected by the manufacturer. The manufacturer identified the problem in specific lots and disclosed that the end user is not able to detect this malfunction.

FDA considered that there are other such devices on the market that don’t have the same risk and reduced the benefit due to the test’s potential inaccuracy. Considering these and other factors, FDA decided there was no need for the product to continue to be available, and FDA and the manufacturer decided to recall the device, classifying it as a class 2 recall, according to Wilbon.

“… risk management activities are essential throughout the product lifecycle and not just required during design validation,” Wilbon said. “…  manufacturers should use more than one risk management technique in their risk management process.”