Medical Device Link.

Originally Published IVD Technology January/February 2004

REGULATIONS & STANDARDS

Steve Buxton and Harvey Rudolph

Steve Buxton (left) is a conformity assessment manager, and Harvey Rudolph, PhD, is the global program manager for medical devices at Underwriters Laboratories Inc. (Northbrook, IL). They can be reached at steve.g.buxton@uk.ul.com and harvey.rudolph@us.ul.com, respectively.

IVD manufacturers that market their products globally are faced with an ever-increasing panoply of regulations. Countries are continually defining and redefining their approaches to medical device regulation and what they believe is necessary to demonstrate that a device is safe and effective in order for it to gain market access in their respective jurisdictions. To add to this confusion, there are two main opposing models of device regulation: the U.S. model in which the government maintains strict control, and the European Union (EU) model in which governments delegate much of their responsibility to independent third parties. All other countries that regulate medical devices, including IVDs and blood-screening products, fall somewhere in between these distinct systems.

In a sense, the global regulatory arena is complex and confusing. However, some universal themes have emerged in the regulatory schemes in different countries, which can be an advantage for those manufacturers that recognize them. Almost all regulatory schemes for medical devices have the following features and requirements in common:

• A classification scheme for determining the level of oversight.
• Assessment of technical documentation before a device can be marketed.
• Basic criteria that devices have to meet.
• Risk management throughout the device's life cycle.
• Effective quality management systems.
• Registration of a firm and representation in the country or regional market.
• Complaint handling and adverse-event reporting.

Although many of these regulatory activities may still currently differ from market to market, some common themes are already in place, and other unifying trends may make the regulatory road much simpler in the future. In addition to discussing these common traits, this article will examine some of the global regulatory requirements and point out some significant differences (see Table I).

Classification

While there are some similarities among countries regarding medical device classification, some intriguing differences also exist that significantly affect the evidential rigor required for clearing specific devices. In some jurisdictions, other factors may affect the rigor of regulatory scrutiny. For example, in Japan, blood-screening products are not regulated under the medical device law. These differences aside, the common theme is that in each region or country, classification is based primarily on risk (see Table II). However, the way risk is determined can vary significantly.

The EU and Canada both use rules-based systems for classifying devices, while the United States uses expert panels that are given broad guidance to determine classification.^1,2 The United States view of risk is also slightly different from the EU and Canada in that a device's effectiveness and safety are factors used to establish risk. One consequence of these differences in classification methods is that new devices are handled differently. Under a rules-based system, the proper classification for the device can be ascertained fairly easily. However, in the United States, new devices are automatically placed into the highest-risk category (Class III) until FDA is presented with evidence that demonstrates the appropriateness of a lower- risk category.

The classification of IVDs can be complex. In the EU, the IVD Directive defines high risk (List A) and moderate risk (List B) IVDs. Presumably, classification under the law is based upon input from scientific and medical experts in the EU. However, the fact that chlamydia tests are classified as medium risk while other diagnostics for sexually transmitted diseases are classified as low risk is perplexing. Instead, risk for IVDs may be assessed by estimating the effect on patient safety if the device fails to produce the correct diagnostic test result. The worst performance failure mode is the occurrence of false-negative results, because such results will rarely be followed up with a second test. This has obvious implications for HIV testing. Risk to users may also be important but does not necessarily drive the classification process as such risks are usually well understood and controlled.

In addition, it is almost impossible to properly compare IVD classification across all regulatory schemes because the methods of assessing risk are not directly comparable. Some devices are considered high risk in one region and medium to low risk in another. Consequently, the rigors applied to determining an IVD's safety and effectiveness can differ among jurisdictions. One example is the automatic Pap smear test system for detecting cervical cancer. While under U.S. regulations this test is considered high risk, in the EU it is low risk. This represents an astonishing difference in approach and cost of compliance between these two regions.

Conformity Assessment

Demonstrating conformity to regulatory requirements consists of quality- system element assessments and technical documentation examinations, which are usually supported by testing procedures and ongoing monitoring activities. In the EU, high-risk IVDs are also subjected to an additional element, batch release testing.³

The entity responsible for verifying compliance differs among the various jurisdictions. In the United States, only FDA assesses the conformity of high-risk devices by inspecting both the quality systems and the technical documentation. For most medium-risk devices, U.S. regulations provide two options: either FDA or accredited third parties can review 510(k) applications.⁴ Soon, IVD manufacturers will be able to choose either FDA or accredited third parties to assess their conformity to quality system requirements and perform inspections of facilities that manufacture their devices.⁵ In the EU, notified bodies appointed by national competent authorities are permitted to assess the conformity of high-risk devices.

Blood grouping devices that determine ABO blood type and rhesus factors provide another example of how different regulations affect market access for manufacturers. Since U.S. regulations classify these devices as Class III, they need premarket approval, which requires extensive performance evaluation by FDA.⁶ The EU meanwhile only requires intervention by a notified body. Assuming that sufficient performance data exist, the process for EU market approval takes a fraction of the time and cost required in the United States. In Japan, the Ministry of Health, Labor, and Welfare performs all required conformity assessments of devices. However, this will change in 2005 when recognized third parties will begin assessing moderate-risk devices.

Essential Requirements

The concept of essential requirements was first developed in the EU to support the new directives. In the European medical device directives, the essential requirements are divided into two parts: general requirements (part A) and design and manufacturing requirements (part B).⁷ The part B requirements describe the following: physical and chemical properties, manufacturing and environmental properties, measuring function requirements, protection against radiation, power source considerations, self-test device requirements, and labeling requirements with a specific section relating to self-test devices. While the IVD Directive infers that all essential requirements apply to all devices, not all of the requirements may be relevant. Notwithstanding, it is incumbent on IVD manufacturers to justify why a particular requirement is not relevant.

FDA regulations embrace the concept of essential requirements but in a different way. Labeling requirements are included in the U.S. Code of Federal Regulations. In addition, FDA guidance documents provide both generic and product-specific parameters that are closely akin to essential requirements.

Interestingly, European and Canadian regulations are similar with regard to the format of essential requirements documentation. However, while both regulations cover general and specific requirements, the IVD Directive goes into more detail in many areas. Meanwhile, in the safety and effectiveness requirements of the Canadian medical device regulations, the application of risk management is combined with the concept of essential requirements. Japan is also adopting an approach that takes guidance from the Global Harmonization Task Force (GHTF) and is similar to the EU and Canada, further reinforcing the value of essential requirements to device regulation.

Technical Documentation

Each jurisdiction requires the establishment of technical documentation by the manufacturer, regardless of device classification and the detail required to be submitted for assessment. Annex III in the IVD Directive, 21 CFR Part 820.181 regarding device master records, and section 32 of the Canadian regulations clearly describe the documentation requirements.

To satisfy the EU requirements, manufacturers must present technical documentation in one of two ways: either a complete file is prepared, or an index is drafted to provide a road map of where to find individual reports and data that support compliance with the essential requirements. Technical files required in the EU overlap considerably with U.S. requirements for a device master record and design history file, as well as with Canadian requirements. In the United States, premarket notification is usually a subset of the technical information that manufacturers must maintain.

Risk Management

All of the jurisdictions discussed so far require risk management to help make medical devices safer. While risk management may not be explicitly stated as a requirement in the laws or regulations, the elements related to managing risk have been established. In the EU, the directives instruct manufacturers to analyze risks, control risks in a hierarchical manner, balance risks and benefits, and make safety of their products commensurate with the state of the art. Similarly, in Canada, the elements of risk management are also stated in the medical device law.

In the United States, risk analysis is required as part of the quality system regulations (QSR). The preamble to the final rule establishing the QSR makes it clear that risk management is a requirement in the United States.⁸ In addition, many FDA guidance documents explicitly identify risk management as a necessary part of premarket applications to the agency.^9,10 Japan will also require risk management for all devices cleared for marketing in that country after April 2005.

Predicate Devices versus State of the Art

For low- and medium-risk devices, FDA merely requires comparison with other existing legally marketed devices, or predicate devices. On the other hand, the EU requires that these devices demonstrate state-of-the-art performance according to Annex I of the IVD Directive, which is a much more stringent requirement. In the absence of performance standards for some IVDs (except for List A devices, which are defined by the Common Technical Specifications), IVD manufacturers that market in the EU are left with the notified body interpretations of what is considered state of the art.¹¹ Obviously, notified body in-house expertise has a significant influence on the ease of this process from a manufacturer's perspective, as there are no published performance standards for the majority of medium-risk devices. Moreover, guidance documents from other regions must often serve as reference points for both manufacturers and notified bodies.

Taking Advantage of Common Themes

Despite the differences discussed above, some common elements exist among the various regulatory schemes. All of the jurisdictions require that quality management systems be established. The jurisdictions have implemented ISO 13485:1996 as the basic standard for operating a quality management system.¹² Even the United States' QSR has been harmonized to this standard. Therefore, it is necessary, although not sufficient in all cases, for IVD manufacturers to follow this standard for their quality systems in order to satisfy all existing and emerging medical device regulatory schemes. This situation will become more harmonized as jurisdictions convert to ISO 13485:2003, which is even closer to the QSR.¹³

Risk management is also required in all jurisdictions. ISO 14971 is now the only universally accepted risk management standard that can be used to satisfy these regulatory requirements.¹⁴ This standard is not only harmonized in the EU but also recognized in the United States as appropriate for fulfilling the risk management requirements. It can also be used as a fundamental decision- making tool for determining which essential requirements apply to a particular device under EU regulations. In addition, ISO 14971 will be adopted by Canada and converted into a national standard in Japan. It is also an informative reference in ISO 13485:2003 (section 7.1, note 3) and a normative reference in several existing and developing international standards. Consequently, IVD manufacturers that conform to ISO 14971 could simultaneously satisfy many regulatory requirements globally.

All of the regulatory schemes include procedures for assessing technical performance. In most cases, relying on conformity to international standards is essential to providing evidence that safety or effectiveness requirements have been met. In the EU, harmonized standards that are based on or identical to international standards are published in the European Journal and are used to establish conformity to the essential requirements. Where harmonized standards do not exist, national and international standards can be taken into account. FDA recognizes hundreds of international and national standards that can be used to demonstrate conformity to particular requirements. Canada also uses harmonized international standards to satisfy some safety requirements. Japan has translated numerous international standards into Japanese industrial standards, which then become de facto requirements. All of these countries are involved in developing international standards, so informed IVD manufacturers can parlay conformity to select standards into easing their regulatory burdens.

The content and format of technical documentation is becoming more simplified. The EU permits IVD manufacturers to submit a road map of their technical files. This allows existing device master records to be used to fulfill the vast majority of the EU technical documentation requirements without re-creating region-specific documentation. In addition, more countries are considering implementing the GHTF's draft guidance on Summary Technical Documentation for Demonstrating Conformity to the Essential Principles of Safety and Performance of Medical Devices (STED). Japan is looking at the STED guidance as a model for its required technical documentation. The United States has also recently published a guidance on a voluntary pilot program using the STED format for some submissions to FDA.¹⁵ Unfortunately, IVDs are not included in this program at this time.

Using essential requirements rather than device-specific requirements is becoming more common. As noted above, the EU and Canada lead the way, but Japan is also moving in this direction. In the United States, the pilot STED program will use an essential-requirements approach, and recent FDA guidance documents for device submissions contain an essential-requirements flavor.

Finally, all jurisdictions seem to be using independent third parties more to assess conformity to their laws and regulations. The EU is the primary example with its use of notified bodies. However, the United States, Canada, and Japan have begun to increase their use of independent third parties. FDA has used accredited third parties for 510(k) reviews since 1997 and has begun a third- party inspection program. Canada relies entirely upon accredited third parties to assess an IVD manufacturer's conformity to ISO 13485. Japan will soon have in place recognized third parties to assess the conformity of moderate-risk devices to its laws. Third parties are also being used more in other jurisdictions such as China, Brazil, Korea, and Argentina.

Conclusion

Although medical device regulatory schemes around the world differ in many ways, they are moving toward having requirements that are more in common. The unifying features include:

• Basing quality system requirements on ISO 13485.
• Requiring risk management and relying on ISO 14971.
• International standards or harmonized versions to demonstrate conformity.
• Common or compatible specifications for technical documentation.
• Essential requirements to define the requirements for device safety and effectiveness.
• Independent third parties to assess conformity to regulations.

Even in other areas, there is hope for adopting further unifying features from the GHTF, as regulators and IVD manufacturers around the world discuss and begin to develop consensus on regulatory approaches for medical devices.

References

1. Directive 98/79/EC of the European Parliament and of the Council of 27 October 1998 on In Vitro Diagnostic Medical Devices, Annex II, Lists A and B [accessed 5 November 2003]; available from Internet: http://europa.eu.int/eurlex/pri/en/oj/dat/1998/l_331/l_33119981207en00010037.pdf.

2. "Medical Device Regulations, Part 2, Rule 1-9" Extract Canada Gazette, Part II (1998) [accessed 4 April 2003]; available from Internet: http://laws.justice.gc.ca/en/f-27/sor-98-282/126851.html.

3. Directive 98/79/EC of the European Parliament and of the Council of 27 October 1998 on In Vitro Diagnostic Medical Devices, Annex IV, Section 6 [accessed 5 November 2003]; available from Internet: http://europa. eu.int/eurlex/pri/en/oj/dat/1998/l_331/l_33119981207en00010037.pdf.

4. "Third-Party Review," FDA Web Site (2003) [accessed 5 November 2003]; available from Internet: www.fda.gov/cdrh/thirdparty/.

5. "Medical Device User Fee and Modernization Act (MDUFMA) of 2002: About the Act," (Rockville, MD; FDA, Center for Devices and Radiological Health, 2003) [accessed 4 April 2003]); available from Internet: www.fda.gov/cdrh/mdufma/.

6. "Premarket Approval of Medical Devices," 21 CFR Part 814. [accessed 4 April 2003]; available from Internet: www.access.gpo.gov/nara/cfr/waisidx_03/21cfr814_03.html

7. Directive 98/79/EC of the European Parliament and of the Council of 27 October 1998 on In Vitro Diagnostic Medical Devices, Annex I [accessed 5 November 2003]; available from Internet: http://europa.eu.int/eur-lex/pri/en/oj/dat/1998/l_331/l_33119981207en00010037.pdf.

8. "Quality System Regulation," 21 CFR Part 820 [accessed 5 November 2003]; available from Internet: www.access.gpo.gov/nara/cfr/waisidx_02/21cfr820_02.html.

9. Contents of a Product Development Protocol [accessed 19 November 2003]; available from Internet: www.fda.gov/cdrh/pdp/pdpguide.pdf.

10. Medical Device Use Safety: Incorporating Human Factors Engineering into Risk Management Needs [accessed on 11/19/03]; available from Internet: www.fda.gov/cdrh/humfac/1497.pdf.

11. Commission Decision of 07.05.2002 on Common Technical Specifications for In Vitro Diagnostic Medical Devices (Brussels: Commission of the European Communities, 2002) [accessed 5 November 2003]; available from Internet: http://europa.eu.int/comm/enterprise/medical_devices/c2002_1344final.pdf.

12. "Quality Systems—Medical Devices—Particular Requirements for the Application of ISO 9001, 1st ed.," ANSI/AAMI/ISO 13485: 1996 (Arlington, VA: Association for the Advancement of Medical Instrumentation, 1996).

13. "Quality Systems—Medical Devices—System Requirements for Regulatory Purposes," ANSI/AAMI/ISO 13485:2003 (Arlington, VA: Association for the Advance- ment of Medical Instrumentation, 2003).

14. "Medical Devices—Application of Risk Management to Medical Devices," ANSI/AAMI/ ISO 14971:2000 (Arlington, VA: Association for the Advancement of Medical Instrumentation, 2003).

15. "A Pilot Program to Evaluate a Proposed Globally Harmonized Alternative for Premarket Procedures; Guidance for Industry and FDA Staff" (Rockville, MD: Center for Devices and Radiological Health, 2003) [accessed 5 November 2003]; available from Internet: www.fda.gov/cdrh/ode/guidance/1347.pdf.

Copyright ©2004 IVD Technology