Excellence in Equipment Documentation

Penelope Trunk has an interesting post on Jake Breeden's Tipping Sacred Cows which lists sacred cows in corporate life that we should reconsider:

Balance: Disguising indecision as a bland compromise that attempts to achieve many things but ends up accomplishing nothing

Collaboration: Creating a culture of learned helplessness with little individual empowerment and accountability

Excellence: Spending too much energy producing perfect work instead of developing the quick-and-dirty solution needed now

Fairness: Keeping score and evening the score to make sure no one gets more than their “fair share”

Passion: Racing down a path seeking success only to find burn-out and misbehavior instead

I think Excellence is a controversial sacred cow, so I wanted to use an example from my medical device factory.  We have a comprehensive equipment program, whenever you have a piece of equipment it will take you at a minimum two to three weeks to get it qualified.  The two to three weeks process time applies to off the shelf equipment we probably already have 15 of that we're already using. 

21CFR820.72 and 21CFR820.70(g) cover equipment requirements, 820.72 is mainly calibration, 820.70(g) is as follows:

(g)Equipment. Each manufacturer shall ensure that all equipment used in the manufacturing process meets specified requirements and is appropriately designed, constructed, placed, and installed to facilitate maintenance, adjustment, cleaning, and use.

(1)Maintenance schedule. Each manufacturer shall establish and maintain schedules for the adjustment, cleaning, and other maintenance of equipment to ensure that manufacturing specifications are met. Maintenance activities, including the date and individual(s) performing the maintenance activities, shall be documented.

(2)Inspection. Each manufacturer shall conduct periodic inspections in accordance with established procedures to ensure adherence to applicable equipment maintenance schedules. The inspections, including the date and individual(s) conducting the inspections, shall be documented.

(3)Adjustment. Each manufacturer shall ensure that any inherent limitations or allowable tolerances are visibly posted on or near equipment requiring periodic adjustments or are readily available to personnel performing these adjustments.

These requirements can be summarized as the equipment must be sustainable and qualified.  These requirements can generally be satisfied by information in the equipment manual and the process testing that you have to do anyway. 

However, as mentioned above, at my work we go far beyond the requirements, we must release a custom drawing of the equipment, custom maintenance procedure and form, - this information is in the manual, but we like to copy it into our own forms.  All of these are held to the internal standards, even though they are absolutely worthless, if I want to do any maintenance work on the equipment, I'm going to reference the manual, not the drawing an engineer threw together to meet a requirement.

A software evaluation must be completed even if the equipment obviously has no software, along with forms for installation qualification (IQ) assessments: line voltage, environment, EMF, safety, calibration, etc.  While it is necessary to perform and document an IQ, the company culture has developed tribal knowledge requirements to do so, if you don't justify the need to not validate the non-existent software properly, well you'll just have to do it again, of course the templates contain no guidance on these.  You can't justify out of measuring line voltage even though your soldering iron clearly works fine.  Operation qualifications are sometimes performed when only installation qualification is needed because justifying out of them has become difficult.

At all steps you need appropriate sign offs, which generally consist of four or five people.  While this is someone's version of excellence, it really accomplishes nothing that isn't included in the manual for an off the shelf piece of equipment. 

A review of warning letters from the FDA reveals the most common issue with equipment is not performing required preventive maintenance or calibration.  In fact, as far as I can tell, no one has ever been cited for not finding a calibrated volt meter and checking the voltage before plugging a piece of equipment in.

All the time making excellent equipment documentation is time spent not working on further understanding of the production process.  If you're spending your energy on getting approvals for a drawing you made of box oven #12, then you are not improving something meaningful.  

The perception of risky process changes

Now that we have an approved device we're spending at least some time on process improvement instead of all out research and development. Unfortunately, even though everything is fairly new some of it is already difficult to change.

We have a piece of test equipment that displays pass or fail, prints out a page of results, and writes them to a database. The operator runs the test, marks pass or fail in the traveler, then staples the results to it. During a sort of related process change I suggested we take out the print out of the results. This was met with quite the uproar and doubt about how we could ever do it.

Apparently removing a redundant step that no one ever looked at was a big deal. Engineering and complaints thought it might be useful, even though they never used the printouts two years in- but someday they might. The change would save some minimal amount of money on supplies, transferring of materials into and out of the clean room and storage, along with associated labor. I was able to finally make headway when I pointed out that we do plenty of visual inspections that do not have another record and in this case we still had a record in the database. Everyone initially thought it sounded like a risky change based and we could be out of compliance, but it was all our own perception.

While this isn't the most impactful example, I think I may have learned the value of taking time up front to set this all up efficiently, but I'm not sure I'll be able to convince anyone to add extra time for these activities the next time around. "We can take care of that stuff during validation!"

Annual review of received parts' dimensions

Many companies perform an annual review of every dimension or 100% inspection on all received parts. While this may serve as a halfway decent preventive action, I'm not convinced it is worth it. If you have automated inspection methods, maybe then it is not too much effort, but we're still using hand tools or manual adjustments for the majority of our parts.

You could argue that you have a critical device, we have to check for dimension drift. Well why aren't you checking for that anyway? And if it is so critical shouldn't you have insured that the supplier's process was capable before you even signed up with them? If it is truly critical and you're not checking it but once a year, good luck with that.

Additionally, if you do find something out of specification, nine times out of ten it is going to be on a non-critical dimension, or else you would have caught it in receiving inspection or manufacturing anyway. Once you find the out of spec item, you have to go back to your inventory, check it, then justify why it is either okay and change the specification, or send it back, and jump through hoops to justify why it was okay to use on the ones sold, but not okay to use going forward, or whatever other contortions QA wants.

In my experience these generally boil down to unclear or unnecessary specifications or measurement issues, where to start measuring a curve, a hole over specified, etc. Another argument for doing it right the first time and checking your supplier's process.

However, this if often a difficult battle, as new parts are generally part of R&D efforts and the team from R&D is behind schedule and they always try to make up schedule time by trying to get either quality or manufacturing to compromise on one issue or another (I *may* have pointed this out at a meeting once). If this happens and you don't have time to ensure supplier process capability, it is not the worse thing in the world, you can always blame the vendor and shop around for a new one that has no familiarity with the part and uses the same process that can't meet the specification. Sometimes the best you can do is make the risks clear.

Finding Owners

More and more I'm learning one of the keys to making good devices that meet quality and regulatory standards is finding people who will take ownership. Lately I've been working in the packaging area a lot and almost every time I'm in there I find discarded labels without lines drawn through them. Of course these are always discarded by the other shift. Everyone already knows the labels need lined out when questioned, so the basic training is there.

If you're an owner, you walk into your area and you own it top to bottom. You don't not fix things because you weren't around. You correct the issue and take it up with the supervisor on shift change. These are the types of people you want, and why many large medical device companies pay way over what they could for manufacturing labor. Pointing out the same non conformance over and over to the same people is ridiculous.

I've been involved with contract manufacturing in China and they were excellent at following instructions. They picked up GDP about 3 times faster than anyone else and have maintained it. This is not to say everything is perfect, but the basics were taken care of. Some of the more complicated situations that came up with the contract manufacturer were really botched up before we were notified, but at least I know the easy stuff is covered.

I'm not sure that me telling the 19 year old putting labels on boxes that this is the era of global competition and she has to work smarter and harder than they are really sinks in. Hopefully, we have a chance to develop the skills necessary because you only get so many chances.

Labeling for Reuse of Single Use Medical Devices

Another relatively new EU requirement effective March 21, 2010 per the revised Medical Device Directive (MDD) (93/42/EEC) M5 is the following:

Where appropriate, the instructions for use must contain the following particulars:
...
If the device bears an indication that the device is for single use, information on known characteristics and technical factors known to the manufacturer that could pose a risk if the device were to be re-used. If in accordance with Section 13.1 no instructions for use are needed, the information must be made available to the user upon request;

Now it is not good enough (in the EU anyway) to just put single use device in your instructions for use (IFU), but you also must identify the risks associated with reuse (sepsis/infection is probably common). I'm sure these are already documented in your risk analysis already, just cut and paste them into your IFU. Apparently anyone already using the device off label by reusing it will be deterred by the listing of potential risks, a new mitigation is born.

This seems like a potentially slippery slope to me, why not have every warning list potential risks if not followed? Is it okay to exceed the shelf life? After all, there are no risks listed- how bad could it be? If it was really bad wouldn't they list more than just a rule like they do with reuse?

Anyway, it is not hard to comply with this requirement and we like to sell stuff in Europe, so we're in.

See my previous post on the new MDD phthalates labeling requirement.

Non conforming materials

Dealing with non conforming materials has become a more time consuming part of my job recently and a topic of debate within the company. The FDA has 21 CFR 820.90 on non conforming product which says:

"(a)Control of nonconforming product. Each manufacturer shall establish and maintain procedures to control product that does not conform to specified requirements. The procedures shall address the identification, documentation, evaluation, segregation, and disposition of nonconforming product. The evaluation of nonconformance shall include a determination of the need for an investigation and notification of the persons or organizations responsible for the nonconformance. The evaluation and any investigation shall be documented."

The FDA's definition of product in this case includes components and material. This has been interpreted by many as every nonconformance requires a full on investigation into the root cause and a corrective action, pictures, documentation changes and the whole deal. In fact, some have argued that each non conformance needs a CAPA that must be closed before the material can move on to the next stage. That is all fine and good unless you want to make money, lets be realistic here.

Besides, as a startup most of the corrective actions don't necessarily get too far. Lets say I get one custom cable out of 20 with a bad crimp that gives an intermittant signal. The signal is checked as it leaves the vendor, but since it was intermittant it wasn't caught. The conversation goes something like this:

Me: One of your cables had a bad crimp and the signal was intermittant.
Vendor: We're sorry, we check them 100% before they are sent out, return the cable and we will credit your account the $28 the cable cost or just recrimp it yourself.
Me: Okay.

I admit that getting after vendors isn't one of my strong points (isn't that for purchasing?), but we need these guys more than they need us- I don't want to source another vendor and then wait for their lead time to get more parts. Now if the cable is miswired or the part tolerance is too tight, then I'll fix the drawing, but our device has many parts and from time to time you're going to run into one off problems that shouldn't require huge amounts of wasted effort.

On the other end of the spectrum, I do know that the FDA will write you up if you just scrap every non conformance below a certain dollar value without explanation or investigation, so that is out of the question. So far I've been unable to convince people to include routine rework in the manufacturing process, this will be fine until nothing gets done because everything is waiting on evaluation and disposition then we will change. The best solution seems to be to link non-conformances with a risk analysis, then spend the majority of your time on the ones that could lead to patient risk or entire lots of incoming material being bad. At least that way I don't spend two hours on four dirty $2 boxes.

Getting contract manufacturers in line

I've spent a great deal of time recently corresponding with our US based main contract manufacturer on various quality issues, mostly paperwork. These guys assemble the electronic/computer part of the device and they're used to consumer electronics assembly. Using this company is about 40% cheaper than a company that specialized in medical device electronics and was ISO 13485 certified.

We basically came along, sent them our documentation SOP and told them to follow it while doing any work for us. This didn't happen so we have a bunch of Manufacturing Process Instructions (MPIs) that don't work as device history records (DHRs) and have a few dozen errors such as scribble outs, blanks, no calibration dates, etc that don't fly in the medical device industry. So we've rewritten everything for them and trained their line on what we require and made good progress. I've learned my lesson though and will hand hold the next group through the documentation requirements.

We also ended up providing them with calibrated test setups to make it easier to track equipment used and match what we expected. Now we're ready to go though and will be making thousands of these in no time! Or maybe closer to a dozen and then make a bunch of improvements, we'll see what happens.

CA FDA came and went

Posting has been non existent over the past few months as I've been pursuing some other projects in my free time and I like to let this blog run at least a couple months behind what is actually going on with the company, but I'm good for a post now.

The California FDA (or really DHHS) inspection mentioned before went well, with just three findings about the quality system that needed updating. The inspector spent two days on site and worked until about 3 PM both days and took quick lunches in the car. The big finding was the supplier management SOP needed better definition, what is a critical supplier, and what does that mean in terms of incoming inspections and audits. The trick to this is making a procedure where you focus on the suppliers that actually need it and don't waste your time and money. Suppliers that do not necessarily manufacture medical devices full time are a good target, hello PCA manufacturer. While sterilizers and GLP testing labs are arguably critical vendors, you're probably not going to catch them doing anything significantly bad unless you're willing to spend a week there, let the big fish do that, I want bang for the buck.

The second finding was a minor note that it was not clear how exactly it would be decided a customer complaint required a medical device report (MDR) incident. The third finding was another minor note that the CAPA chain was unclear, although I thought this one in particular was not an issue, but it is easy enough to do a small update to the procedure so I only spent four hours arguing the point. There were other comments, but those were the three that had to be responded to.

We also heard back on ISO 13485 and the CE Mark, as well as responding to and hearing back from the Federal FDA regarding our 510(k), but I will leave those updates for another day.

ISO 13485/9000 is the baseline

This medical device company I know has finally wrapped up their ISO 13485 certification and they are pretty jazzed about it, even though doing so is probably going to end up delaying their project by several months due to pulling people off project work and putting them on paperwork. However, my thinking now is that certification is unimpressive and if you're making a big deal out of this, you might have bigger problems down the road. Ten years ago, maybe this was cause for celebration, but as it stands now, ISO 13485 and 9000 are pretty much the baseline and while you will undoubtedly run into some quirks (obviously more depending on the size of your company), it shouldn't be a major effort to get certification and if it is, then maybe you should think about adding, changing, or training personnel. There are something like 400,000 companies ISO 9000 certified now, I'm just saying, if you have a hard time joining that elite group perhaps some changes are needed.

UPDATE: Tom in the comments makes a similar point: "The big deal with 13485 is that it has to be done day by day as a normal part of medical device product development. If one has to stop and "catch up" with paperwork, not only are you doing it wrong, but missing a lot of the benefits that a great quality system can give you." If you don't have the resources to keep up ISO 13485 as Tom notes, then a rethinking is in order.

File work

I've been working on a ton of paperwork the last couple weeks, getting our ISO 13485 technical file, design history file (DHF), and device master records (DMR) in order. Putting these three in order doesn't require any actual "work" it is just referencing things that have already been done. For example, all three require product specifications.

We release our important protocols and reports as controlled documents so I generally just write a page referencing whatever needs to be referenced and if someone wants to, they can dig through the master file. They will curse me for not making copies and putting them in the tech file, DHF or DMR, but it is not a requirement to make it easy for anyone and in general we don't work from these files, but from the working copies of drawings/reports/whatever on the server. Thirty years from now maybe regulators will get together and combine the file requirements into one, although that would take away some of the fun.

Disgruntled former employees

This rant against a testing lab came up in one of my news feeds. I won't discuss the complaint specifics, but I will say that in my experience the testing lab in question has done an acceptable job for us in the past, although we never audited them. This is a touchy subject, but I will plow ahead and hope no one takes what I say the wrong way. Pretty much every time someone quits a regulated company there is a chance of the former employee calling the regulators. Generally it turns out that the employee does not know as much as they think they do or that the regulators don't listen.

It would be much more beneficial for everyone involved if the employee tried to work it out within the company, even if they fill out 17 corrective actions on the last day, I would be cool with that- the company would rather know what needs to be fixed (or is perceived to not be working) than not know (plus I'm not the one following up corrective actions). The vast majority of companies are very concerned about patient safety and go above and beyond requirements.

If you are a disgruntled employee, I suggest you evaluate the problem again and make sure you're correct, talk to the person responsible, then management, then start a corrective action (you can switch those two up depending). I assume that most companies are set up where anyone can start a corrective action, although this might just be a small company thing. Once you get to that point, you're pretty much powerless to do more within the company besides complain, but the corrective action forces the issue and someone is required to document how it is being handled. If none of this works and you are certain that regulations are being violated and patient safety is in danger, then be the whistleblower.

If you are a disgruntled employee and don't know what a corrective action is and everyone is ignoring you, what you want to do is run it by two quality people at the same time, then get a copy of the quality manual, which you were probably trained on your first day, and read up.

Document Control Roundtable 6/25/08

I will be staying up late for this Document Control and Records Management in Regulated Environments meeting on Wednesday night. If you want to say hi I'm the geeky looking unshaven guy with the totally hot wife. Yes my wife is going and is in the medical device quality field- the fun discussions we have!

Materials handling- contaminated product & paper based document system

The ISO 13485 auditor picked on us for not having a procedure for dealing with returned product that was contaminated. Fortunately, MD&DI was on top of this issue in a John Lincoln article in 1999.

Also there is a request to reorganize the design history file (DHF), device master record (DMR) and the "technical file". Is it too late to get a summer intern?

We're also trying to switch from a paper based documentation system to an electronic one. This seems to be fairly popular in the quality department, but it is actually more work for them. They still have to file away the master copies with the signatures and now they have to make sure the electronic versions get put in the right place. I'm all for it, but I'm confused by their uncharacteristic willingness to do more work. The main debate is do we do it going forward as we need documents or is someone going to scan them all in. I think its a little ridiculous to not just scan them all in now and be done with it, it will save time in the long run, but I think I'm going to lose that argument. Thats fine, it better be worded very carefully or I'll bide my time until I can write up a corrective action when I can't find an electronic document I need.

510(k) response received

A while back we received our 510(k) response, about 60 days after the submission, and if a 10 was as good as could reasonably be expected we ended up with a solid 8, so we're all pretty happy. We had one hardware comment, a couple labeling comments, around six software comments and a couple non-software V&V testing comments. Nothing actually that hard to respond to or that left us scratching our heads, "How do we do that!?". If we kept key parts within the company we could probably respond in the 30 days given.

I'm trying to think of something useful I could pass on, but most of it boils down to little things we forgot to include in the submission even though they are clearly documented on the FDA website. The FDA obviously spent a lot of time reading the Software V&V and requested some more typical condition testing instead of the worse case testing that we focused on. Everything they requested was very reasonable though. Same with the non-software V&V testing, out of the 20 or so reports the FDA only commented on two, I missed a standard and tested to the wrong limit, and for one test they wanted more typical condition testing. They probably can't use the words "brilliantly done" in the letter, but they did use the phrase "generally acceptable" which is good enough I think.

Anyway, it is good to receive a response and now we have something to focus on. We'll get the work done ASAP and hopefully the next letter we get from the FDA is an approval.

ISO 13485 vs GMP

We had an ISO 13485 audit a few weeks ago, one thing I learned is that ISO is much stricter about management review meeting content than GMP. 820.20(3)(c):

Management review. Management with executive responsibility shall review the suitability and effectiveness of the quality system at defined intervals and with sufficient frequency according to established procedures to ensure that the quality system satisfies the requirements of this part and the manufacturer's established quality policy and objectives. The dates and results of quality system reviews shall be documented.

That is pretty broad, while ISO 13485 5.6.2 has more specific requirements that auditors look for in a management review, like confirming if any major regulatory standards referenced in the Quality Manual have been updated or not, customer feedback, non-conformances, etc. GMP doesn't even state CAPAs must be reviewed (I suppose you could argue 820.20(3)(i or ii), but it isn't specific). A good auditor knows about 20 of these ISO/GMP differences and can focus in on them and find them in about 15 minutes. It would be a long day for the Quality department if they had any pride!

The Medical Device Quality Plan

I got stuck with writing a quality plan for our products, here is what the FDA says in CFR 21 820.20 (part d):

Each manufacturer shall establish a quality plan which defines the quality practices, resources, and activities relevant to devices that are designed and manufactured. The manufacturer shall establish how the requirements for quality will be met.

If you're trying to please the FDA, you should probably keep the quality plan separate from the quality policy (part a) for clarity. I'm not sure why, but our documentation requires one quality plan per product, this makes it easy for me anyway. MD&DI's take:

As formulated in the new regulation, the requirements for quality planning are intended to apply to activities that are conducted during the production phase of a product's life cycle, and should refer to the company's design and development plan. In practice, the content of a company's quality plan will most often be provided by the outline of quality system documentation (820.20(e)) and by the device master record, and the plan itself may refer to sections of those documents where key activities are detailed. Guidance for establishing a quality plan can be found in ISO 9004-5.⁷

Seems simple enough, the quality plan should reference quality system procedures (part e) and design and development plan or validation and verification (V&V) activities. My example quality plan:

PURPOSE - Establish a quality plan that meets CFR 21 820.20.
SCOPE - This plan applies to product X.
QUALITY PLAN
~INSPECTIONS - sampling requirements, component receiving, in-process and final assembly inspection references (DMR reference if it includes inspection points)
~PACKAGING V&V - sterility, packaging, and shelf life V&V references
~DESIGN V&V - design V&V references including biocompatibility
REFERENCES - includes all documents listed above

Sorry, but I can't master formatting in blogger. It'll be fun updating the quality plan every time someone comes up with a new V or V protocol. Let me know if I'm missing something.

Quality System Auditing

I got tasked with heading up a quality system audit before an ISO audit scheduled to happen later this month. We also have an upcoming State of California visit due to our facility move. This audit we're doing now is actually the first quality audit our company has done not performed by quality personnel- unless you count previous state audits. I think I need to learn how to be grumpier about non-engineering work, my "somewhere in the world there is a medical device company where engineers are doing product development work and we're competing with them" line isn't working. Anyway, we had a meeting, divvied up the areas for each person to audit and we're reporting back this coming week to write up corrective actions as part of the CAPA portion of the quality system.

As a company we're relatively new at this so I know it is going to get contentious with some blame games being played, but hopefully I can head that off by not putting up with it. We are at point A and need to get point B, we need to move forward, going back doesn't get the problems fixed. If management wants to examine the problems more deeply, that is entirely up to them (and obviously management is part of the audit), but it doesn't gain anything for us to sit there and discuss what happened in the past for each item. The problems all distill down to the same two or three issues (I thought he was doing it, no one told me to do it, etc.) anyway, all of which are fixed by doing the audit and corrective actions.

For now we're just going through each SOP on a line by line basis and making sure we're doing what we're saying. Our quality system is a patchwork of procedures that mostly came from other companies that various quality consultants worked for at one point in time. A few years ago the system was traceable to the QSR, but that hasn't been checked lately and is something someone will have to go through in the future to make sure we didn't miss anything. Every item found that we're not doing generates a corrective action, no excuses are tolerated. The corrective actions are documented and clearly designate someone in charge and a time line. This ensures that problems get taken care of, instead of "Oh we were going to do that, but never got around to it." After that a re-audit is required. The quality system isn't rocket science, but some people seem to have a very hard time with it.

Moved the company

We moved our happy medical device company down the road and I've been spending my time working on projects related to moving. Thrilling stuff, like changing the address on labeling and other documentation, not to mention tracking down various missing items. The cleanroom was moved and the floor done, electricity hooked up, next the whole cleanroom will be scrubbed, the filters turned on and all the furniture will be cleaned and moved in. Then it will be given a few days before its certified and the bioburden checked.

Once that is done we can get started doing installation qualifications (IQ) on the manufacturing equipment. After that we are planning on redoing any validation that involves a manufacturing procedure, but not revalidating things that involve material properties for example. Since the validations require sterile product made at the new facility, away we go. I've written enough validations the past six months I think I could work them up in my sleep. It actually feels like running in place and I think company morale is low due to lack of cash bonuses.

I have a few other projects I work on when I have time, but it is going to take a while to get back to normal after the move. I can only imagine what a nightmare it would be moving a mid-sized or larger company. Although overall it is a good thing as it means the company is doing well enough to expand and grow.

Software Design Specification Writing

I spent the last week and today (minus time out for inane tasks that get us nowhere, focus people!) writing the software design specifications (SDS) . Honestly, I could probably spend another week on it. The SDS is key part of FDA 510(k) submission software section and verification and validation (V&V) and I suspect the software section is the section the FDA will rightly focus on. Unfortunately, the guy who wrote the software has a hard time transferring his thoughts from code into English, he wrote a really rough draft then I had to take over once we started looking at it. It is difficult to split the SDS and software V&V into parts that more than one person can work on, which means I get bugged a lot about progress by people who don't understand how one document could take a whole entire week to finish when we had a draft last week, then have other documents to write after that that may take even longer.

Before I left on vacation in December the V&V was scheduled to be done the next week- no one followed up on it and since only one person can really work on it at a time if that person is bugged to do other things, no progress is being made. I posted about getting a draft V&V before. How did it look? Brutal. Now it looks like I'm going to spend next week writing most of it. The software guy thought he should write the V&V first before the SDS and then we could work on the V&V while he wrote the SDS, but that just turned into a big mess. The company is kind of schizophrenic lately and can't seem to focus properly, which is why they had me do the SDS this week instead of two weeks ago right when I got back. If the software documentation is holding you back, every minute engineers aren't working on software documentation is delaying the submission, just keep that in mind before talking to them about anything at all, really.

Anyway, I think ideally you take the software design requirements, add to it so it becomes the SDS, then take the SDS and add the V&V steps, that way your traceability is covered without sitting around cross referencing documents for two days.

Medical Device Design History File

After much kicking and screaming, I spent a couple days this week making sure the Design History File (DHF) was adequate and up to date. The QSR (820.30) is pretty open ended regarding the requirements:

Each manufacturer shall establish and maintain a DHF for each type of device. The DHF shall contain or reference the records necessary to demonstrate that the design was developed in accordance with the approved design plan and the requirements of this part.

Some more details are available here. Thankfully, it says "or reference" so we can throw in the Engineering Change Notices (ECN - sometimes called change control records or orders), which contain a reason and description of changes, and not worry too much about the all of the actual product requirements (design input) and specifications (design output) going in there. Obviously, testing protocols and reports including V&V, biocompatibility, sterilization, etc., go in there. Our company SOP also has design meeting notes listed, which has been interpreted as pretty much every meeting that I attend is a design meeting. I think the strategy is to err on the side of completeness instead of usability. We also have some goofy things required to be in there like marketing and competitor information.

As an engineer its hard for me to efficiently maintain the DHF since I do not see every finalized ECN. I did badger the QA to run everything going into the master file by me before filing for the time being. This way the DHF shouldn't get out of date, but hopefully I can turn it over to the DHF quality department soon as they can maintain it more efficiently because they have final sign off. However, right now no one in the company outside of engineering is able to make the distinction of which documents are necessary to show "that the design was developed in accordance with the approved design plan."

Other than that we are going to miss another filing deadline, part of it due to some consultants falling behind, part of it due to management doing some things that caused a bit of a delay, but it also crushed morale, it was so bad that they tried to make amends on Friday by offering lunch and not a single person outside of management took them up on their offer of free lunch. Ouch.