An MD&DI February 1997 Feature Article
FDA Makes Quality the Rule (continued)
10. RECORDS
The requirements for recordkeeping are spelled out in subpart M of the new regulation. The section includes both modifications of requirements that already existed in the 1978 GMP regulation and entirely new requirements. In addition, the organization of many requirements has been changed, in some cases to harmonize them with the requirements of ISO 9001.
General Requirements (820.180). The record retention and confidentiality requirements of the new regulation are the same as those in the 1978 regulation. This section makes it clear that records not stored at the manufacturing site must nevertheless be readily available to FDA. And in the preamble to the regulation, the agency defines readily available as meaning "during the course of an inspection" (comment 180). This section also requires that records be stored so that there is no adverse effect on them, and that automated records be backed up. This section of the regulation also includes the exemptions from FDA review and copying for quality audits, management review reports, and supplier audits (820.180(c)). No significant changes from the 1995 draft have been made.
Device Master Record (820.181). In the quality system regulation, items have been identified for inclusion in the DMR that were not required by the 1978 GMP regulation. These are software specifications and installation, maintenance, and servicing procedures and methods. The 1995 working draft had also proposed to include software source code, but this reference was deleted because, according to FDA, software specifications include source code.
Device History Record (820.184). In the 1978 GMP regulation, requirements for the documents to be included in the DHR vary, depending on whether or not the product is a critical device. The new regulation combines these requirements.
The 1995 working draft's proposal that the DHR should include "the specific label and labeling used for each production unit" has been changed to the "primary identification label and labeling used for each production unit" (820.184(e)). This change resulted from industry comments that some devices have many labels, and that only the primary labeling should be required for the DHR. However, FDA does not define what is meant by primary labeling, so manufacturers should define the labeling they intend to be part of the DHR. Of course, the DMR must contain or reference all labeling specifications.
The DHR must now also include "the acceptance records which demonstrate that the device is manufactured in accordance with the DMR" (820.184(d)). This requirement previously appeared in the 1978 GMP regulation, but applied only to critical devices. Even so, FDA has enforced this requirement to some degree, because the 1978 definition of the DHR required the "complete production history" of a device. The final form of the requirement was also included in the 1995 working draft.
Quality System Record (820.186). As currently formulated, the requirements of this section of the new regulation do not appear in either the 1978 GMP regulation or the 1995 working draft.
The requirements proposed in the 1995 working draft were a subtle attempt at harmonizing GMPs with the ISO 9001 section on quality systems (clause 4.2) by requiring a quality plan and a quality manual without using the ISO terminology. The quality plan requirements have now been moved to the section on management responsibility (820.20), and the new regulation now makes their intent clear.
The new requirements included in this section make it necessary for manufacturers to compile a quality system record (QSR), which must include or reference any quality system procedures or documentation that are shared among a number of products. The QSR must also include the records required by 820.20. The end product is basically a quality manual. Many manufacturers have already developed such records, so these new requirements should not represent a new burden for them.
Complaint Files (820.198). The differences between the 1978 GMP regulation's complaint requirements and the revised ones consist of the following:
- The definition of complaint is found in 820.3(b).
- Written complaint-handling procedures are now required.
- The contents of the complaint investigation record are specified, with additional requirements.
- Copies of complaints as well as of complaint investigation records must now be accessible to the manufacturing site.
- If a manufacturer's complaint unit is outside the United States, records must be accessible at a location in the United States.
The complaint-handling requirements are essentially those proposed in the 1995 working draft, with some language changes to clarify certain requirements. For example, the statement that investigations must be conducted Òunless such investigation has already been performed for a similar complaint and another investigation is not necessary' was added to make it clear that investigations need not be duplicated if there is enough information to show that a similar complaint was investigated previously.
The new regulation eliminates the proposed requirement that complaints and complaint investigation records be "concurrently maintained" at the manufacturing site and at the designated complaint-handling unit when the two are physically separate. This was not a well-understood requirement. The final rule requires only that the records be reasonably accessible to the manufacturing facility. This will allow manufacturers to access these records via computer rather than having to keep hard copies.
The 1995 proposal that events considered reportable under the medical device reporting (MDR) regulation be "immediately" reviewed has been changed in the final regulation, which requires such events to be "promptly" reviewed. This terminology is consistent with the MDR regulation and also a better reflection of reality. Sometimes it's not possible to review such events "immediately."
Also, the requirement for a "written record" of investigation has been replaced with a "record" of investigation to allow for automated reporting (820.198(e)).
