An expert explains why it is worthwhile for suppliers to make software validation easier for medical device manufacturers.
David A. Vogel, PhD
Validation costs can easily exceed the purchase cost of the software. Whatever the suppliers of software-controlled equipment and instruments can do to reduce their customers’ cost of validation therefore reduces the overall cost of use of the system. This can be used as a marketing advantage and will eventually become a necessity to stay competitive in the medical device market.
There have been several articles and industry workshops on this idea since the publication of “Validation for Software for Regulated Processes” (AAMI TIR36:2007). To say that software suppliers didn’t embrace the idea then would be an understatement. However, now that the idea has had seven or eight years to settle there seems to be renewed interest in the topic of software suppliers assisting their customers with validation of the software purchased from the supplier. Since the publication of TIR36, there seems to have been more activity in enforcement of the FDA regulation that requires validation, which may also have had a stimulating effect on the topic. Perhaps this idea’s time finally has come.
The current Good Manufacturing Practices, Quality System Regulation (QSR) 21CFR820.70(i) and ANSI/AAMI/ISO 13485:2003 all require medical device manufacturers (MDMs), contract manufacturers, and specification developers to validate, for its intended use, any software used in their devices or alternatively, in the development or manufacture of a device. The latter category includes production equipment, test instruments, software systems such as CAPA or complaint handling software systems, or software tools such as compilers, automated test software used by medical device manufacturers.
Often, little information is available from the suppliers to assist users in validating the equipment or instruments for their intended use. However, anticipating an IQ/OQ/PQ type validation, installation and operational qualification (IQ and OQ) templates and/or information are readily available from these suppliers. The performance qualification (PQ) is commonly the responsibility of the end user after successful installation and operational qualifications. This creates an opportunity for system, equipment, and instrumentation manufacturers (EIMs) to stand out in their competitive markets by assisting their users with their validation needs.
The Medical Device Manufacturer’s Validation Obligations
It is a popular misconception that validation is simply volumes of testing. It is not. Software validation, as described by the "General Principles of Software Validation" (GPSV) includes many activities in addition to testing. Validation as recommended by FDA’s GPSV includes, among others, the following components:
- Determination of the software lifecycle
- Document intended use
- Risk analysis and risk management
- Configuration-management and version control
- Technical evaluations and design review
The GPSV also lists a number of other “best practices” during the development of the software (such as reviews) that also might be considered development activities. What happens if the software is purchased off the shelf rather than custom developed? Are those development practices bypassed simply because the software is purchased?
The short answer is “no.” Theoretically, there are no short cuts through or bypasses around regulation. If certain activities are not possible because of the way the software was acquired, other activities should be substituted that would leave the user with the same level of confidence as if they had developed the software themselves using the recommended best practices.
These substituted activities often take the form of some sort of qualification of the supplier. Supplier audits are not uncommon. Often times alternative methods that involve research into the supplier, the user base, user experience base, and any other source of information are used to ascertain the level of confidence about the way the software was developed. Often times this seems more of an art than a science and leaves the device manufacturer with a lot of information, but some uncertainty about how to use the information to establish a level of confidence in the supplier and the software in question.
Validation Ideas for Equipment and Instrument Manufacturers
For embedded software that is acquired from a vendor, the MDM has little control over or visibility into the software development process. Validating such software takes some creativity on the part of MDMs. EIMs can make the validation process easier for the MDM by providing a “validation package” that gives the MDM some insight into the process used by the EIM to create the software. Providing evidence that the EIM followed something akin to the FDA’s Design Controls (for MDMs) would give the MDM a boost in confidence.
EIM’s can provide proof of development process and objective evidence of the software verification process. That’s a big help to the MDM. However, only the MDM, in most cases, can validate for intended use.
MDMs have a lot to gain from “validation savvy” EIMs. The EIMs also have a lot to gain from helping out their medical device customers. Here are a few ideas:
Sell validation reports or use them as a sales advantage. Validating manufacturing and quality-system software is difficult and costly for MDMs. The typical users responsible for validation are not software engineers, nor are they validation professionals . . . they just want to be users. Vendors of software-controlled equipment and instruments can profit by selling validation packages to their MDM customers. At a minimum they will create a sales advantage over suppliers who ignore validation. These validation packages could include validation documentation, training, and/or consulting with MDM users on validating for their intended use. Supporting MDM customers through the validation process can reduce their cost of acquisition and ownership of the software or software controlled equipment.
Implement design controls and validation practices. EIMs can do much to gain the confidence of their MDM customers if they follow good practices in developing their software and follow a documented quality process that is largely compliant with the FDA’s design control regulations. That process should include creating and maintaining the equivalent of a design history file for their products which includes verification testing for all the requirements for the equipment or instrument.
Perform verification testing according to a documented protocol. Software verification involves testing each requirement in the specifications for its existence and proper implementation. The test designs and results of execution should be documented in detailed test protocols. As mentioned before the EIM cannot validate for the MDM user’s intended use, but it can and should verify that the software correctly implements the requirements.
Provide enough information to eliminate the need for an audit. Some MDM customers will be satisfied with that as evidence that a controlled process was used to develop the software. For those who are not satisfied with that (or if the EIM considers that information confidential and is unwilling to let it leave the premises), encourage them to audit your design process, making the validation and design control documentation available to them for viewing. This will satisfy some of your MDM customers’ obligations for validation. Such audits might also fit well with any ISO 9000 or ISO 13485 audits that the MDM’s purchasing group may require.
Don't try to hide your mistakes. In fact, make them public in known issue databases that are available to your customers and prospects. Even a well-tested instrument or software item is likely to have a list of residual defects at release whose resolution was deferred for future releases. Make the list available to the users and prospective users of the software or software-driven instrumentation so that they can assess the risk of the defect for their intended use.
Be your customer’s teacher. It has already been mentioned several times that, in most cases, only the user of the instrument or equipment can define his or her intended use. Validation testing to confirm that the software fulfills the intended use will depend on this definition. The risk associated with the use of the instrument also will depend on the intended use, and that analysis generally is the responsibility of the MDM also. Not all MDMs are familiar with these concepts.
The EIM has experience with its own products, and how its customers are using them. EIMs can play the role of consultant or teacher to their customers in helping them fulfill the MDM’s responsibilities for validation.
Bring in validation experts if needed. Sometimes, the EIMs may be inexperienced with validation or the medical device industry in general. Rather than ignoring the needs of the MDM customer, the EIM can and should recommend a validation expert to guide the MDM through his validation responsibilities.
Sometimes, even the EIM is uncomfortable with its role in developing the quality system, the documentation to support it, or even the design and execution of verification tests. In these cases an outsourced validation expert can consult with the EIM. These consultants can develop or work with internal software development and validation resources to prepare for MDM customer audits. Additionally, the validation expert can work with customers to assist them in final validation for their intended use.
Getting equipment and instrumentation manufacturers involved with validation of the software that drives their systems is a win-win situation whose time has come. The EIM benefits from increased sales with shorter lead times because validation no longer seems like an obstacle to the customer’s acquisition of the instrument. The MDM benefits because the validation burden is reduced, and the product is likely of better quality due to the increased attention to engineering processes and validation on the part of the EIM.
|Want to learn more? Vogel will lead a session called "A Model for Supplier Participation in Streamlining the Validation of Non-Device Software" during the MD&M East Conference, June 9–11, 2015, in New York City.|
David A. Vogel, PhD, is president of Intertech Engineering Associates, Inc.
[Image courtesy of MAPICHAI/FREEDIGITALPHOTOS.NET]