Medical Device Link.

REGULATIONS & STANDARDS

James M. Clinton is a principal consultant for Quality & Regulatory Consulting LLC (Durham, NC). He can be reached at clintonjm@gmail.com.

Initiating risk analysis activities for IVD medical device design can be a daunting task. In recent years, manufacturers have discovered that the more complex the device, the greater the potential for error and patient harm. The laws, regulations, standards, and guidance documents for product risk management have been evolving for almost 20 years. Company executives charged with protecting shareholder value and minimizing unnecessary expense look to their managers and subject matter experts to separate the “must have” from the “nice to have” in their list of requirements.

Unfortunately, such parsing is often difficult when discussing risk, given the growing complexity in both the devices and the risk management compliance landscape. Also, a “nice to have” feature from the manufacturer’s perspective may be a “must have” feature from the perspective of other stakeholders (i.e., the hospital, laboratory, healthcare provider, or patient), and a manufacturer cannot ignore the needs of other stakeholders during risk management activities. A thorough hazard assessment exercise performed early in the risk management process can serve to document needs of all stakeholders and strengthen compliance of the manufacturer’s risk management procedure.

The application of medical device risk management principles and the proper perspective of IVD risks have been skillfully described by others in previous diagnostics publications.^1-7 The intent of this article is to recommend an approach to a key prerequisite of IVD risk analysis: assessing the hazard and estimating the severity of the harm posed by such hazards. Completing hazard assessment early in a risk management process likely to span many sessions helps avoid a common pitfall in risk analysis exercises, e.g., repeatedly reassessing the same hazards after additional causes are identified or when personnel who attend later sessions were not present at earlier sessions.

Hazard Identification

Risk analysis is the first element of risk management described in ISO 14971:2007. This crucial step begins with the identification of hazards or the description of the anticipated potential sources of harm associated with use of the medical device.⁸ A hazard occurrence does not automatically mean that harm is guaranteed. A hazard must be coupled with a sequence of events to develop into a hazardous situation before it can result in harm to people and property. Therefore, a description of the anticipated sequence of events that can bring about harm should also be captured during the risk analysis step of risk management.

It is also helpful to assign a severity level for the potential harm at the time each hazard and hazardous situation is identified. IVD devices “intended for use in the collection, preparation, and examination of samples taken from the human body” pose unique risk challenges to manufacturers compared with other types of medical devices and are addressed in a separate informative annex in the ISO 14971:2007 document.⁹ IVD risk management teams should consider reviewing this guidance document when assessing the risk posed by their products.

The Annex H guidance explains that device hazards common to IVDs are often the results themselves. More specifically, device hazards occur when results are incorrect or when the device fails to deliver a result when it is needed (i.e., delayed result). Incorrect and delayed results are the primary hazards common to most IVD products.

Depending on the device, other common hazards may exist related to chemical, mechanical, electrical, and biological safety. However, incorrect and delayed results pose the most difficulty for IVD manufacturers’ risk management teams because the sequence of events that starts with the incorrect or delayed result extends into the clinical laboratory and patient-care settings, which are beyond the manufacturer’s control. An expert understanding of clinical laboratory and diagnostic techniques is required to accurately address the hazardous situations caused by the incorrect and delayed results emanating from the IVD device.

• The Annex H guidance describes a risk model for most complex IVD devices that includes multiple layers between the device and the patient:
• The device itself and safeguards designed into it by the manufacturer.
• The hospital environment and laboratory using the IVD device.
• The physician or healthcare worker responsible for interpreting the IVD test results and treating the patient.

Figure 1. (click to enlarge) In the IVD risk model, the medical device, laboratory, and physician all represent barriers to patient harm.

The risk model also depicts the IVD stakeholders as those who expect the device to perform correctly (i.e., the device manufacturer, the hospital or laboratory administering the IVD, the healthcare worker, and the patient). Each of the IVD risk model layers may be considered a protective barrier between a hazardous IVD result and the patient (see Figure 1). Stakeholders want to assume that each layer is unlikely to fail and only correct results will pass through the system. James Reason, professor of psychology at the University of Manchester (Manchester, UK), proposed a “Swiss cheese” model of system accidents that fits the IVD model described here.¹⁰ Adapting Reason’s model to the IVD paradigm illustrates how a hazardous IVD result may initiate an equally hazardous situation that causes patient harm (see Figure 2).

Figure 2. (click to enlarge) The Swiss cheese model of system accidents illustrates how hazards may pass through all layers and harm the patient.

Ideally, each layer acts as a solid barrier, preventing any hazard from passing through. However, Professor Reason’s model portrays each layer as a slice of Swiss cheese with holes or weaknesses allowing hazards to sometimes penetrate. A delayed or incorrect result (hazard) can reach the patient when each layer fails to stop it.

For example, the IVD device may yield an incorrect result that the lab fails to detect is wrong, then the lab reports the result to the patient-care provider, who uses the information to either treat the patient for a condition not present (false positive) or fails to treat for a condition actually present (false negative). A delayed result can also lead to patient harm. A delayed positive result may lead to harm if it is not available when needed or expected by the healthcare provider to aid in diagnosis and thus delays necessary treatment. Alternately, a delayed negative result may prolong unnecessary treatment that was prophylactically administered pending the IVD test result.

Hazard Assessment

A robust device design controls risk with safety features that prevent hazards from occurring and protective features that prevent the unavoidable hazard from developing into a dangerous situation. Labeling information included with the device, though not a protective feature because it requires the user or operator to act or avoid actions, may also be a risk control mechanism. Hospital laboratories, physicians, and healthcare workers using the IVDs and the results the devices provide also offer protection through their training, certification, adherence to standard procedures, and compliance with mandatory and voluntary standards of patient care.

In the event that an incorrect IVD result is generated, device manufacturers typically assume that labs and patient-care providers will catch the error and disrupt the sequence of events that could result in patient harm. Such reasoning also assumes the laboratory will detect incorrect hazardous IVD results during the practice of quality control and prevent the error from passing on to the next level, the patient-care provider. If the incorrect result survives the lab controlled environment, then the patient-care provider would question and disregard any result not in agreement with other diagnostic observations.

Unfortunately, the device manufacturer cannot readily verify to what degree hazard identification is monitored in each hospital laboratory or by each patient-care provider using the device. This is especially true for IVDs marketed globally in regions where standards and practices may vary significantly from the manufacturers’ expectations. The manufacturers may also lack the qualifications to conclude the extent to which each patient-care provider relies on IVD test results in patient diagnosis and treatment. Assuming that all intermediate IVD stakeholders between the manufacturer and patient perfectly apply their skills and responsibilities is not objective evidence that such actions actually occur.

A more justifiable approach for the IVD risk management team during hazard assessment is to assume the worst-case scenario, i.e., if the IVD yields a hazardous result, it is then treated as the beginning of a sequence of events that if left undetected has the potential to cause patient harm. This more-conservative approach saves the risk management team from wasting time trying to assess the probability of things occurring in the laboratory and clinical environment outside the control of the device manufacturer. A risk and benefit analysis conducted later in the risk management process is the proper place for deciding the acceptability of higher-risk devices, not during hazard identification and assessment.

Table I. (click to enlarge) An example of a hazard assessment table.

Severity, defined by ISO 14971:2007 as a “measure of the possible consequences of the hazard,” is a function of the harm itself and not the circumstances leading to the hazard.¹¹ Therefore, no other information than the hazard, a medical understanding of the effects of the hazard, and the severity assessment criteria defined by the manufacturer’s SOP is required to assign the severity level of the hazard. A useful approach to documenting the severity of incorrect and delayed results and hazards is to construct a hazard assessment table (see Table I).

Hazard identification and the construction of a hazard assessment table require that the risk management team understand the medical implications of incorrect and de-layed results produced when using the IVD product for its intended use. If the device is indicated for use on patients experiencing a serious disease condition, and an incorrect test result can lead to a delayed or incorrect diagnosis that might hasten death, then the hazard assessment table should reflect that potential catastrophe. Including a knowledgeable physician or healthcare practitioner on the risk management team during the hazard assessment activity will aid in documenting the hazardous situations and patient harm that can develop from a user’s perspective.

Beyond Identification and Assessment

The hazard assessment table delineates the potential hazardous situations that follow the incorrect or delayed IVD result leading to patient harm. After the hazard assessment table is constructed, the technical product experts on the risk management team systematically identify the potential and actual causes of the IVD hazards that start the hazardous situation sequence of events. The causes of an inaccurate or delayed IVD results can originate within the IVD itself or with human error by those involved in sample handling, IVD operation, and results reporting. Therefore, causal analysis often requires both clinical application and device engineering skill sets to succeed.

Risk is defined in ISO 14971:2007 as the “combination of the probability of occurrence of harm and the severity of that harm.”¹¹ The worst-case scenario approach described above assumes that when the IVD produces an inaccurate or delayed result and hazard, it has the potential to trigger a hazardous situation that may lead to patient harm. The probability of occurrence of patient harm should then be equated with the probability of occurrence of product failure or human error that triggers the foreseeable sequence of events. The hazard assessment process is intended only to document device hazard information and the severity of harm the device may potentially cause. If the resulting risk is not judged acceptable because of a high severity rating, then a proper risk management program would require the manufacturer to conduct a risk and benefit analysis to justify any decision to proceed with the design.

In a previous IVD Technology issue, Donald M.Powers, PhD, described many useful tools for completing the risk analysis after the hazards have been identified and rated, such as fault tree analysis (FTA), failure mode effects and criticality analysis (FMECA), and hazard analysis and critical control points (HACCP).³ To comply with regulations, manufacturers must provide evidence of identification, management, and reduction of product risks to the extent necessary to minimize harm to persons, property, and environment. The choice of tools should be based on the objective of the risk management exercise and the complexity of the device and its manufacturing processes.

For example, a product risk management plan may call for starting with an FTA to categorize several areas for concentrated FMEA, FMECA, or HACCP protocols. The FTA might show that four distinct areas contribute to incorrect or delayed results:

• Sample collection and handling errors (preanalytical).
• Laboratory testing and processing errors (analytical).
• Instrument manufacturing and servicing errors.
• Reagent manufacturing, shipping, and storage errors.

Then, each area might be systematically assessed using FMECA. The hazard assessment table provides key input for each FMECA. The combined output from the four separate risk management exercises would constitute a major portion of the product risk management file.

The initial risk management report needs to show that the team identified all anticipated product risks arising from its intended use and foreseeable misuse, and that any risks exceeding a predefined threshold limit were appropriately reduced. The report should be revised at suitable times after production has begun and post-production failures become known that were not anticipated in the initial report.

Conclusion

Regulatory bodies throughout the world currently require manufacturers to identify and manage the potential risks to patients posed by their devices. IVD manufacturers’ risk management teams require training, expert leadership, and the correct subject matter experts in order to produce and maintain compliant product risk management files. Hazard identification, hazard assessment, and a thorough examination of the severity of the potential harm that can follow a hazardous result should be completed and documented early in the risk management process with the appropriate level of medical input.

A well-justified hazard assessment is key to completing the remaining elements of risk analysis, evaluation, and control. It will also serve as an initial entry point to risk management during production and postproduction phases to assess information for new or modified risks requiring additional product controls.