[Federal Register Volume 61, Number 195 (Monday, October 7, 1996)]
[Rules and Regulations]
[Pages 52602-52662]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 96-25720]
[[Page 52601]]
_______________________________________________________________________
Part VII
Department of Health and Human Services
_______________________________________________________________________
Food and Drug Administration
_______________________________________________________________________
21 CFR Parts 808, 812, and 820
Medical Devices; Current Good
Manufacturing Practice (CGMP); Final Rule
Federal Register / Vol. 61, No. 195 / Monday, October 7, 1996 / Rules
and Regulations
[[Page 52602]]
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Food and Drug Administration
21 CFR Parts 808, 812, and 820
[Docket No. 90N-0172]
RIN 0910-AA09
Medical Devices; Current Good Manufacturing Practice (CGMP) Final
Rule; Quality System Regulation
AGENCY: Food and Drug Administration, HHS.
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: The Food and Drug Administration (FDA) is revising the current
good manufacturing practice (CGMP) requirements for medical devices and
incorporating them into a quality system regulation. The quality system
regulation includes requirements related to the methods used in, and
the facilities and controls used for, designing, manufacturing,
packaging, labeling, storing, installing, and servicing of medical
devices intended for human use. This action is necessary to add
preproduction design controls and to achieve consistency with quality
system requirements worldwide. This regulation sets forth the framework
for device manufacturers to follow and gives them greater flexibility
in achieving quality requirements.
DATES: The regulation is effective June 1, 1997. For more information
on compliance with 21 CFR 820.30 see section IV. of this document.
Written comments on the information collection requirements should
be submitted by December 6, 1996.
ADDRESSES: Submit written comments on the information collection
requirements to the Dockets Management Branch (HFA-305), Food and Drug
Administration, 12420 Parklawn Dr., rm. 1-23, Rockville, MD 20857. All
comments should be identified with the docket number found in brackets
in the heading of this document.
FOR FURTHER INFORMATION CONTACT: Kimberly A. Trautman, Center for
Devices and Radiological Health (HFZ-341), Food and Drug
Administration, 2098 Gaither Rd., Rockville, MD 20850, 301-594-4648.
SUPPLEMENTARY INFORMATION:
I. Background
Manufacturers establish and follow quality systems to help ensure
that their products consistently meet applicable requirements and
specifications. The quality systems for FDA-regulated products (food,
drugs, biologics, and devices) are known as CGMP's. CGMP requirements
for devices in part 820 (21 CFR part 820) were first authorized by
section 520(f) of the Federal Food, Drug, and Cosmetic Act (the act)
(21 U.S.C. 360j(f)), which was among the authorities added to the act
by the Medical Device Amendments of 1976 (Pub. L. 94-295).
Under section 520(f) of the act, FDA issued a final rule in the
Federal Register of July 21, 1978 (43 FR 31 508), prescribing CGMP
requirements for the methods used in, and the facilities and controls
used for the manufacture, packing, storage, and installation of medical
devices. This regulation became effective on December 18, 1978, and is
codified under part 820. Except for editorial changes to update
organizational references in the regulation and revisions to the list
of critical devices that was included in the preamble to the final
regulation, the device CGMP requirements have not been revised since
1978. This final rule is the result of an extensive effort begun in
1990 to revise this regulation.
The Safe Medical Devices Act of 1990 (the SMDA) (Pub. L. 101-629),
enacted on November 28, 1990, amended section 520(f) of the act,
providing FDA with the authority to add preproduction design controls
to the CGMP regulation. This change in law was based on findings that a
significant proportion of device recalls were attributed to faulty
design of product. Specifically, in January 1990, FDA published the
results of an evaluation of device recalls that occurred from October
1983 through September 1989, in a report entitled ``Device Recalls: A
Study of Quality Problems'' (Ref. 1). (See 55 FR 21108, May 22, 1990,
where FDA announced the availability of the report.) FDA found that
approximately 44 percent of the quality problems that led to voluntary
recall actions during this 6-year period were attributed to errors or
deficiencies that were designed into particular devices and may have
been prevented by adequate design controls. These design-related
defects involved both noncritical devices (e.g., patient chair lifts,
in vitro diagnostics, and administration sets) and critical devices
(e.g., pacemakers and ventilators). Also in 1990, the Department of
Health and Human Services' Inspector General conducted a study entitled
``FDA Medical Device Regulation From Premarket Review to Recall'' (Ref.
2), which reached similar conclusions. With respect to software used to
operate medical devices, the data were even more striking. A subsequent
study of software-related recalls for the period of fiscal year (FY)
1983 through FY 1991 indicated that over 90 percent of all software-
related device failures were due to design-related errors, generally,
the failure to validate software prior to routine production (Ref. 3).
The SMDA also added new section 803 to the act (21 U.S.C. 383)
which, among other things, encourages FDA to work with foreign
countries toward mutual recognition of CGMP requirements. FDA undertook
the revision of the CGMP regulation to add the design controls
authorized by the SMDA to the CGMP regulation, as well as because the
agency believed that it would be beneficial to the public and the
medical device industry for the CGMP regulation to be consistent, to
the extent possible, with the requirements for quality systems
contained in applicable international standards, primarily, the
International Organization for Standards (ISO) 9001:1994 ``Quality
Systems--Model for Quality Assurance in Design, Development,
Production, Installation, and Servicing'' (Ref. 4), and the ISO
committee draft (CD) revision of ISO/CD 13485 ``Quality Systems--
Medical Devices--Supplementary Requirements to ISO 9001'' (Ref. 5).
This action is being taken under those provisions of the SMDA and
in response to the following: (1) Notices that appeared in the Federal
Register of April 25, 1990 (55 FR 17502), and in the Federal Register
of April 17, 1991 (56 FR 15626), that announced meetings of the
agency's Device Good Manufacturing Practice Advisory Committee (GMP
Advisory Committee), at which the need for revisions to the CGMP
regulation was explored; (2) an advance notice of proposed rulemaking
(ANPRM) that appeared in the Federal Register of June 15, 1990 (55 FR
24544), that announced the agency's intent to revise the CGMP
regulation; (3) a notice of availability of a document that appeared in
the Federal Register of November 30, 1990 (55 FR 49644), entitled
``Medical Devices; Current Good Manufacturing Practices (CGMP)
Regulations Document; Suggested Changes; Availability'' (Ref. 6) and
comments solicited from the public about the document; (4) a proposed
rule in the Federal Register of November 23, 1993 (58 FR 61952), (Ref.
7) and comments solicited from the public about the proposal; (5) a
notice of availability that appeared in the Federal Register of July
24, 1995 (60 FR 37856), announcing the availability of the ``Working
Draft of the Current Good Manufacturing Practice (CGMP) Final Rule''
(hereinafter referred to as the Working Draft) (Ref. 8) and comments
[[Page 52603]]
solicited from the public about the Working Draft; (6) testimony at an
August 23, 1995, open public meeting announced in the Federal Register
(60 FR 37856); (7) and testimony and advisory committee recommendations
from the September 13 and 14, 1995, meeting of the GMP Advisory
Committee announced in the Federal Register of August 24, 1995 (60 FR
44036). Thus, FDA's decision to revise the CGMP regulation is based on
changes in the law made by the SMDA, the agency's discussions with
others including its GMP Advisory Committee, responses to the Federal
Register notices on this matter, FDA's analysis of recall data, its
experience with the regulatory application of the original CGMP
regulation, and its assessment of international quality standards.
The agency's final rule embraces the same ``umbrella'' approach to
the CGMP regulation that is the underpinning of the original CGMP
regulation. Because this regulation must apply to so many different
types of devices, the regulation does not prescribe in detail how a
manufacturer must produce a specific device. Rather, the regulation
provides the framework that all manufacturers must follow by requiring
that manufacturers develop and follow procedures and fill in the
details that are appropriate to a given device according to the current
state-of-the-art manufacturing for that specific device. FDA has made
changes to the proposed regulation and the Working Draft, as the final
rule evidences, to provide manufacturers with even greater flexibility
in achieving the quality requirements.
The Supreme Court recently addressed the preemptive effect, under
section 521 of the act (21 U.S.C. 360k), of the original CGMP
regulation and other FDA requirements for medical devices on State tort
actions. In Medtronic, Inc. v. Lohr, 116 S. Ct. 2240 (1996), the
Supreme Court gave substantial deference to the agency's interpretation
of section 521 of the act found at Sec. 808.1 (21 CFR 808.1). The Court
noted that CGMP requirements are general rather than ``specific
requirements applicable to a particular device,'' and that State common
law remedies are similarly general, and do not establish a
``substantive requirement for a specific device.'' (Lohr at 2257; see
also Sec. 808.1(d) and (d)(6)(ii).) Moreover, the Court drew a
distinction between remedies and requirements, noting that while common
law tort actions may provide remedies different from those available
under the act, no preemption occurs unless the substantive requirements
of the State law are ``different from, or in addition to,'' those
imposed by the act. (See Lohr at 2255.) Under the Supreme Court's
analysis in Lohr, the requirements imposed by the original CGMP
regulation would rarely have preemptive effect.
FDA believes that the reasoning of Medtronic v. Lohr applies
equally to the new quality system regulation, which, as does the
original CGMP regulation, prescribes requirements that apply to medical
devices in general, rather than to any particular medical device.
Therefore, FDA has concurrently amended part 808 (21 CFR part 808) to
make clear the new quality system regulation does not preempt State
tort and common law remedies.
II. Decision to Make a Working Draft Available for Comment
In the Federal Register of November 23, 1993, the agency issued the
proposed revisions to the CGMP regulation, entitled ``Medical Devices;
Current Good Manufacturing Practice (CGMP) Regulations; Proposed
Revisions; Request for Comments,'' and public comment was solicited.
After the proposal issued, FDA met with the Global Harmonization Task
Force (the GHTF) Study Group in early March 1994, in Brussels, to
compare the provisions of the proposal with the provisions of ISO
9001:1994 and European National Standard (EN) 46001 ``Quality Systems--
Medical Devices--Particular Requirements for the Application of EN
29001'' (Ref. 9). ISO 9001:1994 and EN 46001:1994 are written as
voluntary standards, but when used to fulfill the requirements of the
European Medical Device Directives, or other national regulations,
these standards are mandatory requirements similar to the CGMP
requirements. The GHTF includes: Representatives of the Canadian
Ministry of Health and Welfare, the Japanese Ministry of Health and
Welfare, FDA, and industry members from the European Union (EU),
Australia, Canada, Japan, and the United States. The participants at
the GHTF meeting favorably regarded FDA's effort toward harmonization
with international standards. The GHTF submitted comments, however,
noting where FDA could more closely harmonize to achieve consistency
with quality system requirements worldwide. Since the proposal
published, FDA has also attended numerous industry and professional
association seminars and workshops, including ISO Technical Committee
(TC) 210 ``Quality Management and Corresponding General Aspects for
Medical Devices'' meetings, where the proposed revisions were
discussed.
The original period for comment on the proposal closed on February
22, 1994, and was extended until April 4, 1994. Because of the heavy
volume of comments and the desire to increase public participation in
the development of the quality system regulation, FDA decided to
publish the notice of availability in the Federal Register to allow
comment on the Working Draft before issuing a final regulation.
The Working Draft represented the agency's views at the time on how
it would respond to the many comments received, and on how the agency
believed a final rule should be framed. FDA solicited public comment on
the Working Draft until October 23, 1995, to determine if the agency
had adequately addressed the many comments received and whether the
agency had framed a final rule that achieved the public health goals to
be gained from implementation of quality systems in the most efficient
manner.
III. Open Public Meeting and GMP Advisory Committee Meeting
FDA held an open public meeting on the quality system regulation on
August 23, 1995. The public meeting consisted of prepared presentations
followed by an open discussion period. Both the agency and the
participants found the meeting to be very productive in focusing
attention on the few main areas of concern in the Working Draft. The
main issues were: The application of the regulation to component
manufacturers; the application of the regulation to third party
servicers and refurbishers; and the implementation timeframe of the
final rule. A transcript of the proceedings of the public meeting, as
well as data and information submitted to FDA during the public
meeting, are available from the Dockets Management Branch (HFA-305),
Food and Drug Administration, 12420 Parklawn Dr., rm. 1-23, Rockville,
MD 20857, between 9 a.m. and 4 p.m., Monday through Friday.
There also was a meeting of the GMP Advisory Committee on the
Working Draft on September 13 and 14, 1995. A notice of the meeting was
published in the Federal Register of August 24, 1995. FDA made a brief
presentation to the committee on the changes from the 1993 proposal to
the 1995 Working Draft and discussed some changes that FDA was
recommending as a result of the August 1995 meeting. Two consultants
also made presentations to the committee, one a representative from ISO
TC 176 (the TC that authored the ISO 9000 series) and the other a
representative from the European Committee for Standardization (CEN).
The remainder of the meeting consisted of prepared
[[Page 52604]]
presentations from the public and the committee's discussion on the
main issues.
The overwhelming majority of the committee members believed that
the Working Draft met the public health needs, gave manufacturers
sufficient flexibility to comply with the regulation, and met the
agency's goal of harmonizing the quality system requirements with those
of other countries. The GMP Advisory Committee strongly supported FDA's
recommendation, in response to the August 1995 public meeting, to not
include component manufacturers under this final rule. However, the GMP
Advisory Committee was clearly divided on several issues related to the
proposed regulation of third party servicers and refurbishers. A
transcript of the proceedings of the GMP Advisory Committee meeting, as
well as data and information submitted to FDA during the meeting, are
available from the Dockets Management Branch (address above).
After considering the written comments and the views expressed at
meetings with the GHTF, at the August 1995 public meeting, and at the
September 1995 GMP Advisory Committee meeting, FDA is publishing this
final rule. A summary of changes from the July 1995 Working Draft to
the final rule is contained at the end of this preamble.
IV. Implementation of the Final Rule
FDA has decided, in response to the many comments and concerns
expressed about the need for more time to implement design controls, to
implement the final rule in two stages. Under stage one, on June 1,
1997, approximately 1 year after this rule is published in the Federal
Register, all elements of the final rule become effective. However,
with respect to the design control requirements in Sec. 820.30, as long
as manufacturers are taking reasonable steps to come into compliance,
FDA will implement a special 1-year transition program, with a
midcourse review, during which official agency action will not be
initiated, including FDA Form 483 observations, warning letters, or
enforcement cases, based on failure to comply with Sec. 820.30. Under
stage two, beginning June 1, 1998, FDA will treat noncompliance with
design control requirements in Sec. 820.30 the same as noncompliance
with other provisions of the CGMP regulation.
To prepare for stage one of this implementation plan, FDA intends
to develop, by April of 1997, a strategy for inspecting the design
control requirements. Both industry and FDA field investigators will
then be trained on this inspectional strategy for design controls
during April and May 1997. Starting June 1, 1997, manufacturers will be
inspected for compliance with all the new quality system requirements,
including design controls, in the manner described in the inspectional
strategy. However, as part of the transition program, from June 1,
1997, for a period of 1 year, although FDA will inspect firms for
compliance with the design control requirements, the field will issue
any observations to the manufacturer on a separate design control
inspectional strategy report, not on FDA Form 483. The design control
inspectional strategy report will be made a part of the manufacturer's
establishment inspection report (EIR), but the observations relating to
Sec. 820.30 will not be included in any warning letters or regulatory
actions during this initial 1-year period. FDA notes that it can, at
any time, take action against unsafe or adulterated medical devices
under different regulatory or statutory authorities. FDA wants to
emphasize that manufacturers are required to take reasonable steps to
come into compliance with the design control requirements during the
June 1, 1997, to June 1, 1998, period.
FDA also emphasizes that this transition period relates only to the
design control requirements of Sec. 820.30, and that beginning June 1,
1997, the agency will issue observations on FDA Form 483's, issue
warning letters, and take any necessary regulatory action for
violations of all other provisions of the CGMP final rule. The time
period from June 1, 1997, to June 1, 1998, is intended to allow both
the industry and FDA field investigators time to become familiar with
the design control requirements and the enforcement aspects of this new
area.
Finally, as described elsewhere in this preamble, FDA intends to
conduct a midcourse review of the new design control requirements
during the transition year (June 1997 to June 1998). Specifically, the
results of the first several months of design control inspections will
be reviewed by early 1998. FDA will review all of the completed design
control inspectional strategy reports that were given to manufacturers
from between June 1, 1997, through December 1, 1997. The completed
strategy reports will be reviewed with particular attention paid to
clarity of information obtained, the appropriateness of the information
collected with respect to the design control requirements, the
appropriateness of the questions on the inspectional strategy, the
manner in which the investigators are writing out their observations,
and any requirements that seem to be giving manufacturers a problem or
where there might be misunderstandings as to what the regulation
requires. FDA will then hold an open public meeting in early 1998 to
discuss with industry these findings and to further explore any
concerns industry might be having in implementing the new design
control requirements. As a result of the midcourse review and open
public meeting, FDA might hold additional workshops, meetings, and/or
training sessions.
Any midcourse adjustments to the inspectional strategy will be
instituted and made public by the spring of 1998. Also during this
midcourse review, FDA will evaluate the information gathered at that
point and determine if the design control requirements as written in
this final rule are appropriate to obtain the goals expressed in this
preamble. FDA will consider minor or even major changes, based on
experience to date. Any necessary adjustments or proposed revisions
will be published in the Federal Register and comments will be
solicited as necessary during the spring of 1998. This implementation
strategy is responsive to requests by industry for FDA to harmonize the
quality system regulation's implementation with the mandatory date for
implementation of the EU's Medical Device Directive, which is June
1998. However, if during the midcourse review of stage one it is
determined that the industry and/or FDA needs more time to fully
implement the design control requirements, FDA will publish an
extension of the regulatory implementation date for design control
requirements prior to June 1, 1998.
V. Response to Comments and Rationale for Changes
Approximately 280 separate individuals or groups commented on the
proposal published in the Federal Register of November 23, 1993, and
approximately 175 separate individuals or groups commented on the
Working Draft that was announced in a notice of availability published
in the Federal Register on July 24, 1995. FDA made many changes in
response to the comments. Most of the changes were made in response to
specific comments, in response to comments for clarity, understanding,
and readability, or to further harmonize FDA requirements with
international standards, as many comments requested.
Numerous comments stated that industry was very pleased with FDA's
[[Page 52605]]
Working Draft and the effort that was made to harmonize with ISO, as
well as to engage industry in commenting on the Working Draft through
the open public meeting and the GMP Advisory Committee meeting that
were held in August and September 1995, respectively.
FDA's responses to the comments received on the proposal and the
Working Draft, as well as explanations for the changes made, follow.
A. General Provisions (Subpart A)
i. Scope (Sec. 820.1)
1. The title of the regulation, as reflected in this section, has
been changed from the ``Current Good Manufacturing Practices (CGMP)''
regulation to the ``Quality System'' regulation. This revision follows
the suggestion underlying many comments on specific provisions that FDA
generally harmonize the CGMP requirements and terminology with
international standards. ISO 9001:1994, ISO/CD 13485, and EN 46001
employ this terminology to describe the CGMP requirements. In addition,
this title accurately describes the sum of the requirements, which now
include the CGMP requirements for design, purchasing, and servicing
controls. CGMP requirements now cover a full quality system.
FDA notes that the principles embodied in this quality system
regulation have been accepted worldwide as a means of ensuring that
acceptable products are produced. While the regulation has been
harmonized with the medical device requirements in Europe, Australia,
and Japan, as well as the requirements proposed by Canada, it is
anticipated that other countries will adopt similar requirements in the
near future.
FDA, however, did not adopt ISO 9001:1994 verbatim for two reasons.
First, there were complications in dealing with the issue of copyrights
and, second, FDA along with health agencies of other governments does
not believe that for medical devices ISO 9001:1994 alone is sufficient
to adequately protect the public health. Therefore, FDA has worked
closely with the GHTF and TC 210 to develop a regulation which is
consistent with both ISO 9001:1994 and ISO/CD 13485. FDA made several
suggestions to TC 210 on the drafts of the ISO/CD 13485 document in
order to minimize differences and move closer to harmonization. In some
cases, FDA has explicitly stated requirements that many experts believe
are inherent in ISO 9001:1994. Through the many years of experience
enforcing and evaluating compliance with the original CGMP regulation,
FDA has found that it is necessary to clearly spell out its
expectations. This difference in approach does not represent any
fundamentally different requirements that would hinder global
harmonization. In fact, numerous comments expressed their approval and
satisfaction with FDA's effort to harmonize the quality system
requirements with those of ISO 9001:1994 and ISO/CD 13485.
2. One comment suggested that the term ``purchasing'' in the scope
be deleted because it could be interpreted to mean the purchase of
finished medical devices by health care institutions and medical
professionals, instead of the purchase of components and manufacturing
materials as intended.
FDA agrees and has deleted the term ``purchasing'' throughout the
regulation when used in this context.
3. Several comments suggested that Sec. 820.1(a)(1) should not
state that the regulation establishes the ``minimum'' requirements
because it implies that compliance with the stated requirements may be
insufficient. They asked that FDA delete the word ``minimum,'' to avoid
having auditors search for additional requirements.
FDA does not believe that the provision would have required that
manufacturers meet additional requirements not mandated by the
regulation but has modified the section to clarify its intent by
stating that the regulation establishes the ``basic'' requirements for
manufacturing devices. The quality system regulation provides a
framework of basic requirements for each manufacturer to use in
establishing a quality system appropriate to the devices designed and
manufactured and the manufacturing processes employed. Manufacturers
must adopt current and effective methods and procedures for each device
they design and manufacture to comply with and implement the basic
requirements. The regulation provides the flexibility necessary to
allow manufacturers to adopt advances in technology, as well as new
manufacturing and quality system procedures, as they become available.
During inspections, FDA will assess whether a manufacturer has
established procedures and followed requirements that are appropriate
to a given device under the current state-of-the-art manufacturing for
that specific device. FDA investigators receive extensive training to
ensure uniform interpretation and application of the regulation to the
medical device industry. Thus, the agency does not believe that FDA
investigators will cite deviations from requirements not contained in
this part. However, as noted above, FDA has altered the language of the
scope to make clear that additional, unstated requirements do not
exist.
4. A few comments suggested eliminating the distinction between
critical and noncritical devices, thus eliminating the need for
distinct requirements for critical devices. Other comments disagreed,
asserting that eliminating the distinction would increase the cost of
production of low-risk devices without improving their safety and
effectiveness.
FDA agrees in part with the comments that suggest eliminating the
distinction between critical and noncritical devices and has eliminated
the term ``critical device'' from the scope, definitions, and
regulation in Secs. 820.65 Critical devices, traceability and 820.165
Critical devices, labeling. However, FDA has retained the concept of
distinguishing between devices for the traceability requirements in
Sec. 820.65. As addressed in the discussion under that section, FDA
believes that it is imperative that manufacturers be able to trace, by
control number, any device, or where appropriate component of a device,
that is intended for surgical implant into the body or to support or
sustain life whose failure to perform when properly used in accordance
with instructions for use provided in the labeling can be reasonably
expected to result in a significant injury to the user.
The deletion of the terminology will bring the regulation in closer
harmony with ISO 9001:1994 and the quality system standards or
requirements of other countries.
Finally, FDA notes that eliminating the term ``critical device''
and the list of critical devices does not result in the imposition of
new requirements. In fact the new regulation is less prescriptive and
gives the manufacturer the flexibility to determine the controls that
are necessary commensurate with risk. The burden is on the
manufacturer, however, to describe the types and degree of controls and
how those controls were decided upon. Such determinations are made in
accordance with standard operating procedures (SOP's) established by
the manufacturer.
5. In response to numerous comments, FDA has added the sentence
``If a person engages in only some operations subject to the
requirements in this part, and not in others, that person need only
comply with those requirements applicable to the operations in which he
or she is engaged.'' This sentence was added to clarify the scope of
the regulation and
[[Page 52606]]
the responsibility of those who fall under this regulation. The wording
is the same as that used in the drug CGMP.
6. Several comments recommended that the short list of class I
devices subject to design control requirements be deleted from the
regulation and be placed in the preamble, to allow additions or
deletions without requiring a change to the entire regulation. Others
commented that the list of class I devices should be entirely
eliminated to harmonize with Europe and Japan.
FDA disagrees that the list of devices subject to design control
requirements should be deleted from the regulation. FDA has experienced
problems or has concerns with the class I devices listed and has
determined that design controls are needed for the listed devices.
Further, placing the list in the regulation establishes the
requirements related to those devices, and is convenient for use by
persons who are not familiar with, or who do not have access to, the
preamble. Further, FDA notes that individual sections of a regulation
may be revised independent of the remainder of the regulation.
7. Numerous written comments and persons who testified at the
August and September 1995 meetings stated that application of the
regulation to component manufacturers would increase product cost, with
questionable value added to device safety and effectiveness, and that
many component suppliers would refuse to supply components or services
to the medical device industry. This would be especially likely to
occur, it was suggested, where medical device manufacturers account for
a small fraction of the supplier's sales.
FDA believes that because of the complexity of many components used
in medical devices, their adequacy cannot always be assured through
inspection and testing at the finished device manufacturer. This is
especially true of software and software-related components, such as
microprocessors and microcircuits. Quality must be designed and built
into components through the application of proper quality systems.
However, FDA notes that the quality system regulation now
explicitly requires that the finished device manufacturer assess the
capability of suppliers, contractors, and consultants to provide
quality products pursuant to Sec. 820.50 Purchasing controls. These
requirements supplement the acceptance requirements under Sec. 820.80.
Manufacturers must comply with both sections for any incoming component
or subassembly or service, regardless of the finished device
manufacturer's financial or business affiliation with the person
providing such products or services. FDA believes that these purchasing
controls are sufficient to provide the needed assurance that suppliers,
contractors, and consultants have adequate controls to produce
acceptable components.
Therefore, balancing the many concerns of the medical device
industry and the agency's public health and safety concerns, FDA has
decided to remove the provision making the CGMP regulation applicable
to component manufacturers and return to the language in the original
CGMP regulation. This approach was unanimously endorsed by the members
of the GMP Advisory Committee at the September 1995 meeting. FDA will
continue to focus its inspections on finished device manufacturers and
expects that such manufacturers will properly ensure that the
components they purchase are safe and effective. Finished device
manufacturers who fail to comply with Secs. 820.50 and 820.80 will be
subject to enforcement action. FDA notes that the legal authority
exists to cover component manufacturers under the CGMP regulation
should the need arise.
8. One comment stated that proposed Sec. 820.1(a)(2) should be
revised to include the District of Columbia and the Commonwealth of
Puerto Rico, as in the original CGMP regulation.
FDA agrees with the comment. These localities were inadvertently
omitted and have been added to the regulation.
9. FDA added Sec. 820.1(a)(3) on how to interpret the phrase
``where appropriate'' in the regulation, as recommended by the GMP
Advisory Committee. This section is consistent with the statement in
ISO/CD 13485.
10. Some comments on proposed Sec. 820.1(c) recommended that the
section be deleted as it already appears in the act. Others stated that
the provision implies that FDA will subject devices or persons to legal
action, regardless of the level of noncompliance. Still others
suggested that only intentional violations of the regulation should
give rise to regulatory action.
FDA disagrees with these comments. The consequences of the failure
to comply, and the legal authority under which regulatory action may be
taken, are included in the regulation so that the public may be fully
apprised of the possible consequences of noncompliance and understand
the importance of compliance. FDA notes that the agency exercises
discretion when deciding whether to pursue a regulatory action and does
not take enforcement action for every violation it encounters. Further,
FDA generally provides manufacturers with warning prior to initiating
regulatory action and encourages voluntary compliance. The agency also
notes, however, that violations of this regulation need not be
intentional to place the public at serious risk or for FDA to take
regulatory action for such violations.
In response to the concerns regarding the tone of the section,
however, the title has been changed. FDA has also deleted the specific
provisions referenced in the proposed section with which the failure to
comply would render the devices adulterated. The term ``part'' includes
all of the regulation's requirements.
11. A few comments on proposed Sec. 820.1(c)(2), now Sec. 820.1(d),
requested that the agency clarify what is meant by requiring that
foreign manufacturers ``schedule'' an inspection. A few comments stated
that FDA was adding new requirements for foreign manufacturers in this
section. Others stated that the proposed language would prohibit global
harmonization because it would limit third party audits in place of FDA
inspections.
FDA has moved the provision related to foreign manufacturers into a
separate section and has modified the language. The language in the
regulation reflects the language in section 801(a) of the act (21
U.S.C. 381(a)). FDA disagrees that it is adding new requirements for
foreign manufacturers in Sec. 820.1(d) because the section recites the
current requirement and standard used, and is consistent with current
agency policy. The agency believes that it is imperative that foreign
facilities be inspected for compliance with this regulation and that
they be held to the same high standards to which U.S. manufacturers are
held. Otherwise, the U.S. public will not be sufficiently protected
from potentially dangerous devices, and the U.S. medical device
industry will be at a competitive disadvantage.
FDA intends to continue scheduling inspections of foreign
manufacturers in advance to assure their availability and avoid
conflicts with holidays and shut down periods. However, the language
pertaining to the ``scheduling'' of such inspections has been deleted
to allow flexibility in scheduling methods.
FDA disagrees that, as written, the language would prohibit
inspections by third parties. FDA may use third party inspections, as
it uses other compliance information, in setting its priorities and
utilizing its resources related to foreign inspections. In this regard,
FDA looks forward to entering into agreements with foreign countries
related to CGMP
[[Page 52607]]
inspections that would provide FDA with reliable inspectional
information.
12. Two comments stated that the section on ``Exemptions or
variances,'' now Sec. 820.1(e), should require that FDA provide a
decision on petitions within 60 days of receipt and state that the
agency will take no enforcement action with respect to the subject of
the petition until a decision is rendered. The comments said that the
petition process is long, arduous, and not practical.
FDA disagrees with the comments. Currently, FDA is required by
section 520(f)(2)(B) of the act to respond within 60 days of receipt of
the petition, unless the petition is referred to an advisory committee.
When the 1978 CGMP regulation was published, there was a prediction
that FDA would be overwhelmed with petitions for exemption and variance
from the regulation. Over the past 18 years, since the CGMP regulation
first became effective, FDA has only received approximately 75
petitions. It is FDA's opinion that few petitions have been received
because of the flexible nature of the CGMP regulation. FDA has
attempted to write the current regulation with at least the same degree
of flexibility, if not more, to allow manufacturers to design a quality
system that is appropriate for their devices and operations and that is
not overly burdensome.
Guidelines for the submission of petitions for exemption or
variance are available from the Division of Small Manufacturers
Assistance (the DSMA). The petition guidelines state that FDA will not
process a petition for exemption or variance while an FDA inspection of
a manufacturer is ongoing. Until FDA has approved a petition for an
exemption or variance, a manufacturer should not deviate from the
requirements of this regulation. FDA must first have the opportunity to
ensure that the manufacturer has established that an exemption or
variance is warranted, to carry out its obligation of ensuring that
devices are safe and effective.
13. Several comments stated that the proposed requirements are not
necessary for all manufacturers, particularly small manufacturers with
few employees and low-risk devices. Other comments stated that the
documentation requirements are excessive.
FDA generally disagrees with these comments. The regulation
provides the ``basic'' requirements for the design and manufacture of
medical devices. And, as noted in the previous response, the
requirements are written in general terms to allow manufacturers to
establish procedures appropriate for their devices and operations.
Also, as discussed above, a manufacturer need only comply with those
requirements applicable to the operations in which he or she is
engaged. However, because the regulation requirements are basic, they
will apply in total to most manufacturers subject to the regulation.
The extent of the documentation necessary to meet the regulation
requirements may vary with the complexity of the design and
manufacturing operations, the size of the firm, the importance of a
process, and the risk associated with the failure of the device, among
other factors. Small manufacturers may design acceptable quality
systems that require a minimum of documentation and, where possible,
may automate documentation. In many situations, documentation may be
kept at a minimum by combining many of the recordkeeping requirements
of the regulation, for example, the production SOP's, handling, and
storage procedures. When manufacturers believe that the requirements
are not necessary for their operations, they may petition for an
exemption or variance from all or part of the regulation pursuant to
section 520(f)(2) of the act.
In addition, FDA has added a variance provision in Sec. 820.1(e)(2)
under which the agency can initiate a variance when it is in the best
interest of the public health. Under this provision, for instance, the
agency may initiate and grant a variance to manufacturers of devices
during times of product shortages, where the devices are needed by the
public and may not otherwise be made available, if such manufacturers
can adequately assure that the resulting devices are safe and
effective. The agency envisions this provision as a bridge, providing a
manufacturer with the time necessary to fulfill the requirements in the
regulation while providing important and needed devices to the public.
Thus, the variance would only be granted for a short period of time,
and only while the devices remained necessary and in short supply.
Under this provision, FDA will require a manufacturer to submit a plan
detailing the action it is taking to assure the safety and
effectiveness of the devices it manufactures and to meet the
requirements of the regulation.
This agency initiated variance provision is in accordance with
section 520(f) of the act which permits, but does not require, FDA to
promulgate regulations governing the good manufacturing practices for
devices and section 701(a) of the act (21 U.S.C. 371(a)), which permits
FDA to promulgate regulations for the efficient enforcement of the act.
Because the statute does not mandate that the agency establish any
requirements for device CGMP's, the agency has the authority to
determine that the manufacturers of certain devices need not follow
every requirement of the regulation.
Further, the agency initiated variance provision is in keeping with
the intent of Congress that FDA prevent hazardous devices from reaching
the marketplace, H. Rept. 853, 94th Cong., 2d sess. 25-26 (1976), and
the general intent of the act that the agency undertake to protect the
public health. The agency will only initiate such a variance where the
devices are needed and may not otherwise be made available, and the
manufacturer can assure the agency that its procedures are likely to be
adequate and that it is actively pursuing full compliance. The
variances will only be in effect for a limited time.
Section 820.1(e) has been modified to include the above addition,
to reflect the title change of the regulation, and to provide the most
current address for the DSMA.
ii. Definitions (Sec. 820.3)
14. Several comments were received regarding the definition of
``complaint.'' Comments generally believed that the definition was
unclear and could be interpreted to include routine service requests,
communications from customers unrelated to the quality, safety, or
effectiveness of the device, and internal communications.
FDA agrees with the comments in part and has modified the
definition to make clear that a communication would be considered a
``complaint'' only if the communication alleged some deficiency related
to the identity, quality, durability, reliability, safety,
effectiveness, or performance of the device after it is released for
distribution. The definition is now very similar to the definition used
in ISO/CD 13485.
The regulation addresses service requests and in-house indications
of dissatisfaction under Sec. 820.100 Corrective and preventive action.
This section requires manufacturers to establish procedures to identify
quality problems and process the information received to detect and
correct quality problems. Information generated in-house relating to
quality problems should be documented and processed as part of this
corrective and preventive action program.
With respect to service requests, Sec. 820.200 Servicing states
that a service report that represents an event which
[[Page 52608]]
must be reported to the FDA under part 803 or 804 (21 CFR part 803 or
804) shall automatically be considered a complaint. All other service
reports must be analyzed for trends or systemic problems and when
found, these trends or systemic problems must be investigated according
to the provisions of Sec. 820.100 Corrective and preventive action.
15. One comment suggested that the agency delete the phrase ``used
during device manufacturing'' in the definition of ``component''
because it was confusing and may cause problems with certain aspects of
distributor operations.
FDA agrees and has deleted the words ``used during device
manufacturing'' from the definition because it was not intended to
differentiate between distributors and manufacturers. Further, FDA
deleted the term ``packaging'' to clarify that every piece of packaging
is not necessarily a component. Only the materials that are part of the
``finished, packaged, and labeled device'' are considered to be
components.
16. Several comments stated that the term ``complete history'' in
the definition of ``control number'' should be clarified or deleted
because it is unclear what a complete production history is, and the
term could be construed to require full traceability for all component
lots of any product containing a control number.
FDA agrees in part with the comments. The control number is the
means by which the history of the device, from purchase of components
and materials through distribution, may be traced, where traceability
is required. The definition does not require that a manufacturer be
able to trace the device whenever control numbers are used. In fact,
the definition itself does not establish any requirements. The agency
notes, however, that the manufacturer's traceability procedures should
ensure that a complete history of the device, including environmental
conditions which could cause the device to fail to conform to its
specified requirements, can be traced and should facilitate
investigation of quality problems and corrective action. FDA notes,
however, that the level of detail required for this history is
dependent on the nature of the device, its intended use, and its
complexity. Therefore, FDA has removed the term ``complete'' in the
definition for clarity and flexibility.
FDA has also amended the definition for added flexibility, to state
that symbols may be used and has included the term ``unit'' for any
device that is not manufactured as a lot or batch.
17. The definition of ``critical device'' has been deleted for the
reasons discussed above.
18. Several comments stated that the term ``design history record''
should be changed because the acronym for the term is the same as that
for device history record (the DHR). Other comments said the ``design
history record'' should not need to contain documentation of a
``complete'' design history. One comment stated that the definition
should allow reference to records containing the design history of the
device. A few comments stated that the term should be deleted
altogether because it is redundant with the definition of device master
record (the DMR).
FDA agrees in part with these comments and has changed the term
``design history record'' to ``design history file.'' In addition, FDA
has amended the provisions to require that the file describe the design
history, as it may not be necessary to maintain a record of every step
in the design phase, although the ``entire history'' should be apparent
from the document. Section 820.30(j) further delineates what should be
in the design history file (the DHF), specifically records sufficient
to verify that the design was developed in accordance with the design
and development plan and other applicable design requirements of the
regulation.
FDA does not agree that the definitions of the DHF and the DMR are
redundant. The DHF for each type of device should include, for example,
the design and development plan, design review results, design
verification results, and design validation results, as well as any
other data necessary to establish compliance with the design
requirements. The DMR should contain all of the procedures related to
each type of device as required by this part and the most current
manufacturing specifications of the device, once the design
specifications have been transferred into production.
19. One comment on ``design input'' stated it was confused by the
term ``requirements'' and wanted to know whose requirements are
encompassed in this definition.
The term ``requirement'' is meant in the broadest sense, to
encompass any internally or externally imposed requirements such as
safety, customer-related, and regulatory requirements. All of these
requirements must be considered as design inputs. How these
requirements are handled and dealt with is up to the manufacturer.
20. Two comments stated that the definition of ``design output''
should be revised because it is not necessary, and would be burdensome,
to keep records of and review the ``results of a design effort at each
design phase and at the end.'' Other comments suggested that the design
output definition should be restricted to physical characteristics of
the device.
FDA agrees in part, but has not deleted the phrase ``results of a
design effort at each design phase and at the end'' from the
definition. The intent was not to dictate when design phases would
occur. Such phases will be defined in the design and development plan.
For example, a manufacturer may only have a few design phases for a new
type of syringe. Thus, design output would be the results of those few
efforts. The results of each design phase constitute the total design
output. The definition has been amended, however, to clarify that the
finished design output is the basis for the DMR.
FDA disagrees with the comments that suggest that the design output
should be restricted to physical characteristics of the device. Design
output is more than just the device specifications. Design output
includes, among other things, the specifications for the manufacturing
process, the quality assurance testing, and the device labeling and
packaging. It is important to note that the design effort should not
only control the design aspects of the device during the original
development phase, but also all subsequent design and development
activities including any redesign or design changes after the original
design is transferred to production.
21. A few comments on the definition of ``design review'' stated
that proposing solutions to problems is not part of the design review
activity. Two other comments expressed concern that the definition
would require that each design review be ``comprehensive.''
In response to the comments on the proper role of design review,
FDA agrees that the design review participants are typically not
responsible for establishing solutions, although they may do so in many
small operations. The definition has been amended, but FDA wants to
make clear that although the design review participants need not
propose solutions, they should ensure that solutions to any identified
problems are adequate and implemented appropriately.
Regarding the scope of design review, each design review need not
be ``comprehensive'' for the entire design process but must be
``comprehensive'' for the design phase being reviewed. However, at the
end of the design process when the design is transferred
[[Page 52609]]
to production, all aspects of the design process should have been
reviewed.
A few other changes were made to harmonize with the definition in
ISO 8402:1994 ``Quality--Vocabulary.''
22. Comments on the definition of ``device master record'' pointed
out that the definition is not consistent with the requirements of
Sec. 820.181 Device master record. Other comments stated that the
definition should allow reference to records. One comment stated that
``all'' procedures related to a specific finished device need not be
included in the DMR, such as the procedures for the design and
development, since they may be in the DHF.
FDA agrees in part with the comments that found the DMR definition
and requirements to be inconsistent and has amended the definition to
be consistent with the requirements set forth in Sec. 820.181. FDA does
not believe, however, that it is necessary to modify the definition to
include the referencing of records because the DMR requirements in
Sec. 820.181 state that the DMR ``shall include or refer to the
location of'' the required information. FDA agrees that the term
``all'' is not necessary and has deleted it in order to give
manufacturers the necessary flexibility.
23. The definition for the term ``end-of-life'' was added to the
Working Draft because this term was used in the definitions for
``refurbisher'' and ``servicing'' to help distinguish the activities of
refurbishing from those of servicing. FDA determined that such a
distinction was necessary, due to comments and ongoing confusion
regarding the difference between the two functions, and the different
requirements applicable to the functions.
Many written comments and persons who testified at the August and
September 1995 meetings stated that the term was confusing,
unnecessary, and introduced many new legal and liability issues. FDA
agrees with these comments and has deleted the term throughout the
regulation. FDA has also deleted definitions for ``refurbisher'' and
``servicing'' for the reasons discussed below.
24. The few comments received on the definition of ``establish''
indicated a concern that the regulation requires too much documentation
and is more onerous than ISO 9001 requirements.
FDA disagrees with the comments. The term ``establish'' is only
used where documentation is necessary. FDA also notes that the quality
system regulation is premised on the theory that adequate written
procedures, which are implemented appropriately, will likely ensure the
safety and effectiveness of the device. ISO 9001:1994 relies on the
same premise. The 1994 version of ISO 9001 broadly requires the
manufacturer to ``establish, document, and maintain a quality system,''
which includes documenting procedures to meet the requirements.
The definition has been amended, however, in response to general
comments received, to clarify that a ``document'' may be in writing or
on electronic media, to allow flexibility for any type of recorded
media.
25. FDA received comments questioning the inclusion of a device
that is intended to be sterile, but that is not yet sterile, in the
definition of ``finished device.'' A few comments stated that ``capable
of functioning'' is ambiguous, and ``suitable for use'' is not
necessary. Another comment requested that the term ``accessory'' be
defined.
FDA disagrees with the comments, but has amended the definition for
clarification. Since the 1978 CGMP regulation was promulgated, FDA has
been repeatedly asked whether devices intended to be sold as sterile
are considered subject to the CGMP requirements, even though they have
not yet been sterilized. The agency had intended the new definition to
make explicit the application of the regulation to the manufacture of
sterile devices that have yet to be sterilized. Although FDA believes
it should be obvious that such devices are subject to CGMP
requirements, some manufacturers have taken the position that the
regulation does not apply because the device is not ``finished'' or
``suitable for use'' until it has been sterilized.
To better clarify its intent, FDA has amended the definition to add
that all devices that are capable of functioning, including those
devices that could be used even though they are not yet in their final
form, are ``finished devices.'' For example, devices that have been
manufactured or assembled, and need only to be sterilized, polished,
inspected and tested, or packaged or labeled by a purchaser/
manufacturer are clearly not components, but are now in a condition in
which they could be used, therefore meeting the definition of
``finished device.''
The distinction between ``components'' and ``finished devices'' was
not intended to permit manufacturers to manufacture devices without
complying with CGMP requirements by claiming that other functions, such
as sterilization, incoming inspection (where sold for subsequent minor
polishing, sterilization, or packaging), or insertion of software, will
take place. The public would not be adequately protected in such cases
if a manufacturer could claim that a device was not a ``finished''
device subject to the CGMP regulation because it was not in its
``final'' form.
The phrase ``for commercial distribution'' was deleted from the
proposed definition of ``finished device'' because it is not necessary
for a device to be in commercial distribution to be considered a
finished device. Further, FDA notes that the term ``accessory'' is
described in Sec. 807.20(a)(5) (21 CFR 807.20(a)(5)).
26. Two comments on the definition of ``lot or batch'' requested
that the definition be clarified: One to reflect that single units may
be produced for distribution, the other to indicate that what
constitutes a lot or a batch may vary depending on the context.
In response to the comments, FDA has modified the definition to
make clear that a lot or batch may, depending on circumstances, be
comprised of one finished device. Whether for inspection or for
distribution, a lot or batch is determined by the factors set forth in
the definition; of course, a manufacturer may determine the size of the
lot or batch, as appropriate.
27. Several comments received on the definition of ``executive
management'' objected that the definition is inconsistent with ISO
9001. Others thought that FDA should better define the level of
management the term was intended to describe.
FDA agrees with both concerns and has modified the definition by
deleting the second half, which appeared to bring executive authority
and responsibility too far down the organization chart. The term was
intended to apply only to management that has the authority to bring
about change in the quality system and the management of the quality
system. Although such management would clearly have authority over, for
example, distribution, those who may have delegated management
authority over distribution would not necessarily have authority over
the quality system and quality policy. Accordingly, the definition has
been modified to include only those who have the authority and
responsibility to establish and make changes to the quality policy and
quality system. It is the responsibility of top management to establish
and communicate the quality policy. In addition, the term ``executive
management'' has been changed to ``management with executive
responsibility,'' to harmonize with ISO 9001:1994.
28. Several comments in response to the proposed definition of
[[Page 52610]]
``manufacturer'' stated that refurbishers and servicers should be added
to the definition of a ``manufacturer.'' Other comments recommended
adding the term ``remanufacturer.'' Other comments requested deletion
of contract sterilizers, installers, specification developers,
repackagers, relabelers, and initial distributors from the definition.
One comment stated that the phrase ``processes a finished device''
should be explained in the definition of manufacturer.
FDA's Compliance Policy Guide (CPG) 7124.28 contains the agency's
policy regarding the provisions of the act and regulations with which
persons who recondition or rebuild used devices are expected to comply.
This CPG is in the process of being revised in light of FDA's
experience in this area. FDA is not including the terms ``servicer'' or
``refurbisher,'' as they relate to entities outside the control of the
original equipment manufacturer, in this final regulation, even though
it believes that persons who perform such functions meet the definition
of manufacturer. Because of a number of competitive and other issues,
including sharply divided views by members of the GMP Advisory
Committee at the September 1995 meeting, FDA has elected to address
application of the CGMP requirements to persons who perform servicing
and refurbishing functions outside the control of the original
manufacturer in a separate rulemaking later this year, with another
opportunity for public comment.
FDA agrees that the term ``remanufacturing'' should be added to the
definition of ``manufacturer'' and has separately defined the term. A
remanufacturer is defined as ``any person who processes, conditions,
renovates, repackages, restores, or does any other act to a finished
device that significantly changes the finished device's performance or
safety specifications, or intended use.''
However, FDA disagrees that contract sterilizers, installers,
specification developers, repackagers, relabelers, and initial
distributors should be deleted from the definition, primarily because
all such persons may have a significant effect on the safety and
effectiveness of a device and on the public health. All persons who
perform these functions meet the definition of manufacturer, and
therefore should be inspected to ensure that they are complying with
the applicable provisions. For example, a specification developer
initiates the design requirements for a device that is manufactured by
a second party for subsequent commercial distribution. Such a developer
is subject to design controls. Further, those that perform the
functions of contract sterilization, installation, relabeling,
remanufacturing, and repacking have routinely been considered to be
manufacturers under the original CGMP definition, and the agency has
treated them as such by inspecting them to ensure that they comply with
the appropriate portions of the original CGMP. By explicitly including
them in the definition of ``manufacturer'' the agency has simply
codified its longstanding policy and interpretation of the original
regulation.
The phrase ``processes a finished device'' applies to a finished
device after distribution. Again, this phrase has been part of the CGMP
regulation definition of ``manufacturer'' for 18 years.
29. A number of comments on the definition of ``manufacturing
material,'' and on other parts of the proposal containing requirements
for ``manufacturing material,'' stated that while the control of
manufacturing material is important, it need not be as extensive as
required throughout the regulation. Other comments stated that the
meaning of the phrase ``or other byproducts of the manufacturing
process'' is unclear, and should be deleted. One comment suggested that
the definition be modified to separate the definition from the
examples.
FDA agrees that, depending on the manufacturing material and the
device, the degree of control that is needed will vary. FDA believes
that manufacturing materials must be assessed, found acceptable for
use, and controlled. Therefore, the regulation requires manufacturers
to assess, assure acceptability of, and control manufacturing materials
to the degree necessary to meet the specified requirements. The agency
notes that international standards such as ISO 8402:1994 include
manufacturing material in their definition of ``product,'' to which all
requirements apply, and notes that FDA has added the same definition in
Sec. 820.3(r) in its effort toward harmonization.
FDA amended the definition of manufacturing material to read ``a
concomitant constituent, or a byproduct constituent produced during the
manufacturing process'' to help clarify this definition. These terms
refer to those materials or substances that naturally occur as a part
of the material or during the manufacturing process which are intended
to be removed or reduced in the finished device. For example, some
components, such as natural rubber latex, contain allergenic proteins
that must be reduced or removed from the finished devices. The
definition has been modified to include ``concomitant constituents'' to
clarify the meaning.
In addition to clarifying the definition, FDA has deleted the
specific examples. Therefore, FDA notes that cleaning agents, mold
release agents, lubricating oils, latex proteins, and sterilant
residues are just some examples of manufacturing materials.
30. The comments received on the definition for ``nonconforming''
conveyed a general sense that the definition was confusing, with
various comments suggesting that different parts of the definition
should be deleted and one suggesting that the definition be deleted
altogether.
In response to these comments, the definition of ``nonconforming''
has been deleted. However, the definition from ISO 8402:1994 for
``nonconformity'' was added to ensure that the requirements in the
regulation, especially those in Secs. 820.90 Nonconforming product and
820.100 Corrective and preventive action are understood. FDA emphasizes
that a ``nonconformity'' may not always rise to the level of a product
defect or failure, but a product defect or failure will typically
constitute a nonconformity.
31. Several comments requested various revisions to the definition
of ``production'' to make it more clear, and one thought that it was a
common term and should be deleted.
In response, FDA has deleted the definition for ``production''
because it should be commonly understood.
As noted in response to comments on the definition of manufacturing
material, FDA has added a definition of ``product'' to conform to the
definition in ISO 8402:1994 and to avoid the necessity of repeating the
individual terms throughout the regulation. Whenever a requirement is
not applicable to all types of product, the regulation specifically
states the product(s) to which the requirement is applicable.
It should be noted that the regulation has acceptance requirements
for incoming ``product'' and other requirements for ``product,'' which
by definition includes manufacturing materials. Manufacturing materials
should be controlled in a manner that is commensurate with their risk
as discussed above. However, for manufacturing materials that are
``concomitant constituents,'' FDA realizes that incoming acceptance,
identification, etc., may not be feasible. The important control
measure for ``concomitant constituents'' is the
[[Page 52611]]
reduction or removal requirement found in Sec. 820.70(h).
32. A few comments stated that the definition of ``quality'' should
be changed to be identical to ISO 8402. Others stated that the
terminology adopted from ISO 8402, ``that bear on,'' is too broad and
could cover every potential and imaginable factor. Still others wanted
to add the phrase, ``as defined by the manufacturer'' to the end of the
sentence.
FDA disagrees with the comments and believes that the definition is
closely harmonized to that in ISO 8402:1994. FDA believes that the
definition appropriately defines quality in the context of a medical
device and believes that the phrase from ISO 8402:1994, ``stated and
implied needs,'' has the same meaning as the phrase ``fitness-for-use,
including safety and performance'' in the context of the Quality System
regulation. Further, ``quality'' is not just ``defined by the
manufacturer'' but is also defined by customer need and expectation.
33. Many comments received on the ``quality audit'' definition
suggested that the definition should not state that it is an
examination of the ``entire'' quality system because that would require
that every audit include the ``entire'' quality system. Other comments
on ``quality audit'' stated that it is unclear what is meant by the
last sentence of the proposed definition, namely, that `` `[q]uality
audit' is different from * * * other quality system activities required
by or under this part.''
FDA agrees that while the quality audit is an audit of the
``entire'' quality system, audits may be conducted in phases, with some
areas requiring more frequent audits than other areas, and that each
audit need not review the whole system. The frequency of internal
quality audits should be commensurate with, among other things, the
importance of the activity, the difficulty of the activity to perform,
and the problems found. To avoid any misunderstanding, the word
``entire'' before quality system has been deleted.
FDA emphasizes that if conducted properly, internal quality audits
can prevent major problems from developing and provide a foundation for
the management review required by Sec. 820.20(c), ``Management
review.''
In response to the confusion about the last sentence of the
proposed definition, FDA has deleted the last sentence. The purpose of
the sentence was to clarify that the internal audit requirement is
different from, and in addition to, the requirements for establishing
quality assurance procedures and recording results. On occasion,
manufacturers have attempted to prevent FDA investigators from
reviewing such quality assurance procedures and results (for example,
trend analysis results) by stating that they are part of the internal
quality audit report and not subject to review during a CGMP
inspection. FDA disagrees with this position. To clarify which records
are exempt from routine FDA inspection, FDA has added Sec. 820.180(c).
34. One comment said that the word ``executive'' should be deleted
from the definition of ``quality policy'' because quality policy should
be supported by all personnel, not just those in executive management.
A few comments stated that ``formally expressed'' should be deleted
because it is incompatible with the requirements in Sec. 820.20(a) and
(c) which require that the quality policy be ``established.'' Other
comments stated that the ``quality'' before ``intentions'' was
tautological.
FDA agrees that all company personnel must follow the quality
policy. However, the definition is intended to make clear that the
quality policy must be established by top management. Therefore it has
been retained. The term ``executive management'' has been modified to
``management with executive responsibility'' to be consistent with the
revised ISO 9001:1994. FDA agrees with the remaining comments and has
changed ``formally expressed'' to ``established'' for consistency and
has deleted the ``quality'' before ``intentions.''
35. A few comments suggested using the definition of ``quality
systems'' from ISO 8402 and 9001. Other comments on the definition of
``quality system'' said that the term ``quality management'' should be
defined.
FDA agrees in part with the comments. The term ``specifications''
has been deleted to harmonize the definition with ISO 8402:1994. FDA
does not agree that the term ``quality management'' must be defined. A
definition can be found in ISO 8402:1994 that is consistent with FDA's
use of the term.
36. Many comments on the definition of ``record'' were received.
Some thought the term was too broad, giving FDA access to all documents
and exceeding FDA's inspection authority. Others thought that the
definition of ``record'' would tremendously increase the recordkeeping
burden. Several comments recommended that FDA adopt the ISO definition.
The definition of ``record'' was deleted because it seemed to add
more confusion than clarity. The definition was intended to clarify
that ``records'' may include more than the traditional hardcopy
procedures and SOP's, for example, plans, notes, forms, data, etc. FDA
was trying to clarify that ``records'' could be written, electronic,
optical, etc., as long as they could be stored and controlled. FDA
could not adopt the ISO 8402:1994 definition because of how the term
``record'' is used in the act, which is broader than the ISO
definition. Therefore, FDA will allow the act and case law to continue
to define the term.
37. The definition in the Working Draft of ``refurbisher'' was
deleted and will be addressed in the separate rulemaking described
above.
38. FDA added the definition of ``remanufacturer'' to codify FDA's
longstanding policy and interpretation of the original CGMP. The
language is consistent with the 510(k) provisions and the premarket
approval amendment/supplement requirements, because FDA has always
considered remanufacturers in fact to be manufacturers of a new device.
39. Several comments on the definition of ``reprocessing''
requested clarification of the difference between that term and
``refurbishing.'' Several other comments on the definition of
``reprocessing'' stated that FDA should clarify that ``reprocessing''
is an activity performed before a device is distributed. Others
commented that the term ``rework'' should be used instead of the term
``reprocessing,'' to be consistent with ISO terminology.
FDA agrees with the comments and has changed the term to
``rework,'' adopted the ISO 8402:1994 definition, and added that
``rework'' is performed according to specified DMR requirements before
the device is released for distribution.
40. A few comments stated that including the term ``maintenance''
in the proposed definition of ``servicing'' implies that preventative
maintenance would be subject to the regulation. Other comments said
that it may not be desirable to return old devices or devices that have
received field modifications to the original specifications. Therefore,
the comments suggested deleting the last part of the definition that
states that ``servicing'' is returning a device to its specifications.
FDA has deleted the definition of ``servicing'' and has not added a
definition of ``servicer'' because this will be covered in the separate
rulemaking discussed above. FDA notes, however, that servicing
performed by manufacturers and remanufacturers is subject to the
requirements in Sec. 820.200 Servicing. These requirements are a
codification of longstanding interpretations of the original CGMP,
[[Page 52612]]
Sec. 820.20(a)(3), and current agency policy.
41. Several comments were received on the proposed definition of
``special process.'' Many asked for clarification or adoption of the
ISO definition. Some stated that it is impossible to completely verify
processes in every instance.
FDA has deleted the definition because the term ``special process''
is no longer used in ISO 9001:1994, except in a note. FDA has, however,
modified the requirements of the regulation to reflect that, in many
cases, testing and inspecting alone may be insufficient to prove the
adequacy of a process. One of the principles on which the quality
systems regulation is based is that all processes require some degree
of qualification, verification, or validation, and manufacturers should
not rely solely on inspection and testing to ensure processes are
adequate for their intended uses.
42. Several comments on the definition of ``specification''
suggested that the term should not apply to quality system
requirements. One comment suggested that the phrase ``other activity''
be deleted because it is too broad. Another comment noted that the
definition in ISO 9001 pertains to requirements, not only documents.
In response, FDA has amended the definition to make clear that it
applies to the requirements for a product, process, service, or other
activity. The reference to the quality system has been deleted. FDA
disagrees that the definition is too broad and has not deleted the term
``other activity'' because a specification can be developed for
anything the manufacturer chooses. FDA notes, however, that ISO
9001:1994 does not contain a definition for ``specification'' but uses
the definition found in ISO 8402:1994.
43. Numerous comments were received on the definitions of
``validation'' and ``verification.'' Almost all stated that the two
definitions overlapped and that there was a need to rewrite the
definitions to prevent confusion. Many suggested that the ISO
definitions be adopted. Others stated that there was a need to
distinguish between design validation and process validation.
FDA agrees with the comments and has rewritten the two definitions
to better reflect the agency's intent. FDA has adopted the ISO
8402:1994 definition of validation. ``Validation'' is a step beyond
verification to ensure the user needs and intended uses can be
fulfilled on a consistent basis. FDA has further distinguished
``process validation'' from ``design validation'' to help clarify these
two types of ``validation.'' The ``process validation'' definition
follows from FDA's ``Guidelines on General Principles of Process
Validation'' (Ref. 10). The definition for ``design validation'' is
consistent with the requirements contained in Sec. 820.30 Design
controls.
The ISO 8402:1994 definition of ``verification'' has been adopted.
``Verification'' is confirmation by examination and provision of
objective evidence that specified requirements for a particular device
or activity at hand have been met.
iii. Quality System (Sec. 820.5)
44. Several comments suggested that the requirement should be more
general, in that the requirement that devices be safe and effective is
covered elsewhere in the regulation. The comments recommended that the
quality system requirements be harmonized with international standards
and focus on requiring that a system be established that is appropriate
to the specific device and that meets the requirements of the
regulation.
FDA agrees in part with the comments and has modified the language
as generally suggested by several comments to require that the quality
system be ``appropriate for the specific medical device(s) designed or
manufactured, and [] meet[] the requirements of this part.'' This is
essentially the requirement of the original CGMP regulation with the
added reference to design control.
The requirements that effective quality system instructions and
procedures be established and effectively maintained are retained;
however, they were moved to Sec. 820.20(b)(3)(i). As previously noted,
the quality system regulation is premised on the theory that the
development, implementation, and maintenance of procedures designed to
carry out the requirements will assure the safety and effectiveness of
devices. Thus, the broad requirements in Sec. 820.5 are in a sense the
foundation on which the remaining quality system requirements are
built.
B. Quality System Requirements (Subpart B)
i. Management Responsibility (Sec. 820.20)
45. Several comments on Sec. 820.20(a), ``Quality policy,'' related
to the use of the term ``executive management.'' A few comments stated
that quality system development and implementation are the
responsibility of the chief executive officer, but how he or she
chooses to discharge the responsibility should be left to the
discretion of the manufacturer. Other comments stated that the
requirement that executive management ensure that the quality policy is
understood is impossible and should be deleted or rewritten.
FDA agrees in part with the comments. In response to the comments,
FDA has deleted the term ``executive management'' and replaced it with
``management with executive responsibility,'' which is consistent with
ISO 9001:1994. Management with executive responsibility is that level
of management that has the authority to establish and make changes to
the company quality policy. The establishment of quality objectives,
the translation of such objectives into actual methods and procedures,
and the implementation of the quality system may be delegated. The
regulation does not prohibit the delegation. However, it is the
responsibility of the highest level of management to establish the
quality policy and to ensure that it is followed. (See United States v.
Dotterweich, 320 U.S. 277 (1943), and United States v. Park, 421 U.S.
658 (1975).)
For this reason, FDA disagrees that the requirement that management
ensure that the quality policy is understood should be deleted. It is
without question management's responsibility to undertake appropriate
actions to ensure that employees understand management's policies and
objectives. Understanding is a learning process achieved through
training and reinforcement. Management reinforces understanding of
policies and objectives by demonstrating a commitment to the quality
system visibly and actively on a continuous basis. Such commitment can
be demonstrated by providing adequate resources and training to support
quality system development and implementation. In the interest of
harmonization, the regulation has been amended to be very similar to
ISO 9001:1994.
46. A few comments stated that the words ``adequate'' and
``sufficient'' should be deleted from Sec. 820.20(b) ``Organization,''
as they are subjective and too difficult to define. One comment thought
that the general requirements in the paragraphs are addressed by
Sec. 820.25 Personnel. Another comment stated that ``designed'' should
be added prior to ``produced'' for consistency with the scope.
FDA agrees that the requirement for ``sufficient personnel'' is
covered in Secs. 820.20(b)(2), ``Resources,'' and 820.25 Personnel,
both of which require manufacturers to employ sufficient personnel with
the training and
[[Page 52613]]
experience necessary to carry out their assigned activities properly.
The phrase is, therefore, deleted. However, FDA has retained the
requirement for establishing an ``adequate organizational structure''
to ensure compliance with the regulation, because such an
organizational structure is fundamental to a manufacturer's ability to
produce safe and effective devices. The organizational structure should
ensure that the technical, administrative, and human factors functions
affecting the quality of the device will be controlled, whether these
functions involve hardware, software, processed materials, or services.
All such control should be oriented towards the reduction, elimination,
or ideally, prevention of quality nonconformities. Further, the agency
does not believe that the term is ambiguous. The organizational
structure established will be determined in part by the type of device
produced, the manufacturer's organizational goals, and the expectations
and needs of customers. What may be an ``adequate'' organizational
structure for manufacturing a relatively simple device may not be
``adequate'' for the production of a more complex device, such as a
defibrillator. FDA has also added ``designed'' prior to ``produced'' to
be consistent with the scope of the regulation.
47. A number of comments on proposed Sec. 820.20 (b)(1)(i) through
(b)(1)(v), ``Responsibility and authority,'' objected to the section,
stating that it was too detailed and confusing and that the wording was
redundant with other sections of the proposal.
FDA agrees generally with the comments in that the proposed
paragraphs set forth examples of situations in which independence and
authority are important. Therefore, the examples provided in
Sec. 820.20 (b)(1)(i) through (b)(1)(v) are deleted. However, FDA has
retained the broad requirement that the necessary independence and
authority be provided as appropriate to every function affecting
quality. FDA emphasizes that it is crucial to the success of the
quality system for the manufacturer to ensure that responsibility,
authority, and organizational freedom (or independence) is provided to
those who initiate action to prevent nonconformities, identify and
document quality problems, initiate, recommend, provide, and verify
solutions to quality problems, and direct or control further
processing, delivery, or installation of nonconforming product.
Organizational freedom or independence does not necessarily require a
stand-alone group, but responsibility, authority, and independence
should be sufficient to attain the assigned quality objectives with the
desired efficiency.
48. Several comments on proposed Sec. 820.20(b)(2), ``Verification
resources and personnel,'' stated that requiring ``adequately'' trained
personnel was subjective and that the section was not consistent with
ISO 9001.
FDA agrees that the section is not consistent with ISO 9001, and
has adopted the language used in ISO 9001:1994, section 4.1.2.2,
``Resources,'' and has renamed the section ``Resources.'' The provision
is now a broad requirement that the manufacturer provide adequate
resources for the quality system and is not restricted to the
verification function. FDA acknowledges that Sec. 820.25(a),
``General,'' requires that sufficiently trained personnel be employed.
However, Sec. 820.20(b)(2), ``Resources,'' emphasizes that all resource
needs must be provided for, including monetary, supplies, etc., as well
as personnel resources. In contrast, Sec. 820.25(a) specifically
addresses education, background, training, and experience requirements
for personnel.
49. Comments on Sec. 820.20(b)(3), ``Management representative,''
stated that the management representative should not be limited to
``executive'' management. A few comments stated that the appointment
should be documented. In addition, a few comments from proposed
Sec. 820.5 stated that the terms ``effective'' and ``effectively''
should be defined.
The agency agrees that the responsibility need not be assigned to
``executive'' management and has modified the requirement to allow
management with executive responsibility to appoint a member of
management. When a member of management is appointed to this function,
potential conflicts of interest should be examined to ensure that the
effectiveness of the quality system is not compromised. In addition, in
response to many comments, the requirement was amended to make clear
that the appointment of this person must be documented, moving the
requirement up from Sec. 820.20(b)(3)(ii). The amended language is
consistent with ISO 9001:1994. Further, FDA has amended this section to
change ``executive management'' to ``management with executive
responsibility'' for consistency with the definition.
The terms ``effective'' and ``effectively'' are no longer used in
Sec. 820.5 but ``effectively'' is found in Sec. 820.20(b)(3)(i). FDA
does not believe that these terms require a definition. Instructions
and procedures must be defined, documented, implemented, and maintained
in such a way that the requirements of this part are met. If they are,
they will be ``effective.''
50. A few comments stated that the improvement of the quality
system is not a requirement under the act and the reference to such
improvement in Sec. 820.20(b)(3)(ii) should, therefore, be deleted.
FDA agrees in part with the comments and has deleted the
requirement that the person appointed under this section provide
information for improving the quality system. The provision implied
that the manufacturer must go beyond the requirements of the
regulation. FDA notes, however, that information collected in complying
with Secs. 820.20(b)(3)(ii) and 820.100 Corrective and preventive
action, should be used not only for detecting deficiencies and for
subsequent correction of the deficiencies but also to improve the
device and quality system.
51. Many comments stated that the report required by
Sec. 820.20(c), ``Management review,'' should not be subject to FDA
review, due to the same liability and self-incrimination concerns
related to the internal audit.
FDA agrees in part with the comments. The proposed regulation did
not state FDA's intentions with respect to inspectional review of the
results of the required management review. After careful consideration
of the comments, FDA agrees that it will not request to inspect and
copy the reports of reviews required by Sec. 820.20(c) when conducting
routine inspections to determine compliance with this part. FDA
believes that refraining from routinely reviewing these reports may
help ensure that the audits are complete and candid and of maximum use
to the manufacturer. However, FDA believes that it is important that
the dates and results of quality system reviews be documented, and FDA
may require that management with executive responsibility certify in
writing that the manufacturer has complied with the requirements of
Sec. 820.20(c). FDA will also review the written procedures required by
Sec. 820.20(c), as well as all other records required under
Sec. 820.20.
52. A few comments stated that the management review should not be
dictated by established review procedures because management level
employees should be fully capable of reviewing documents without a
written procedure.
As noted above, FDA has retained the requirement for establishing
procedures to conduct the required management review in Sec. 820.20(c).
FDA believes that
[[Page 52614]]
a manufacturer can establish procedures flexible enough for management
to vary the way in which a review is conducted, as appropriate.
Procedures should require that the review be conducted at appropriate
intervals and should be designed to ensure that all parts of the
quality system are adequately reviewed. A manufacturer may, of course,
develop procedures that permit review of different areas at different
times, so long as such reviews are sufficient to carry out the
objectives of this section. If there are known problems, for example, a
``sufficient frequency'' may be fairly frequent. Further, because FDA
will not be reviewing the results of such reviews, FDA must be assured
that this function will occur in a consistent manner.
53. A few comments stated that Sec. 820.20(c) should be deleted
because it duplicates the quality audit required by Sec. 820.22.
FDA disagrees that Sec. 820.20(c) duplicates the requirements in
Sec. 820.22. The purpose of the management reviews required by
Sec. 820.20(c) is to determine if the manufacturer's quality policy and
quality objectives are being met, and to ensure the continued
suitability and effectiveness of the quality system. An evaluation of
the findings of internal and supplier audits should be included in the
Sec. 820.20(c) evaluation. The management review may include a review
of the following: (1) The organizational structure, including the
adequacy of staffing and resources; (2) the quality of the finished
device in relation to the quality objectives; (3) combined information
based on purchaser feedback, internal feedback (such as results of
internal audits), process performance, product (including servicing)
performance, among other things; and (4) internal audit results and
corrective and preventive actions taken. Management reviews should
include considerations for updating the quality system in relation to
changes brought about by new technologies, quality concepts, market
strategies, and other social or environmental conditions. Management
should also review periodically the appropriateness of the review
frequency, based on the findings of previous reviews. The quality
system review process in Sec. 820.20(c), and the reasons for the
review, should be understood by the organization.
The requirements under Sec. 820.22 Quality audit are for an
internal audit and review of the quality system to verify compliance
with the quality system regulation. The review and evaluations under
Sec. 820.22 are very focused. During the internal quality audit, the
manufacturer should review all procedures to ensure adequacy and
compliance with the regulation, and determine whether the procedures
are being effectively implemented at all times. In contrast, as noted
above, the management review under Sec. 820.20(c) is a broader review
of the organization as a whole to ensure that the quality policy is
implemented and the quality objectives are met. The reviews of the
quality policy and objectives (Sec. 820.20(c)) should be carried out by
top management, and the review of supporting activities (Sec. 820.22)
should be carried out by management with executive responsibility for
quality and other appropriate members of management, utilizing
competent personnel as decided on by the management.
54. Some comments suggested that the requirements in
Sec. 820.186(a) and (d) be moved to Sec. 820.20 for clarity and to
better align with the structure of ISO 9001:1994 and ISO/CD 13485.
FDA agrees and has moved the specific requirements from
Sec. 820.186 and rewritten them into new Sec. 820.20 (d) and (e) for
clarity, better organization, and closer harmonization. Therefore,
Sec. 820.20(d) is consistent with ISO 9001:1994, section 4.2.3,
``Quality planning,'' and Sec. 820.20(e) is consistent with ISO
9001:1994, sections 4.2.1, ``General,'' and 4.2.2, ``Quality-system
procedures.'' Section 820.20(e) discusses ``[a]n outline of the
structure of the documentation used in the quality system.'' FDA
believes that outlining the structure of the documentation is
beneficial and, at times, may be critical to the effective operation of
the quality system. FDA recognizes, however, that it may not be
necessary to create an outline in all cases. For example, it may not be
necessary for smaller manufacturers and manufacturers of less
complicated devices. Thus, the outline is only required where
appropriate.
ii. Quality Audit (Sec. 820.22)
55. A few comments suggested that FDA delete the requirement that
persons conducting the audit be ``appropriately trained'' from the
second sentence of proposed Sec. 820.22(a), because it is subjective
and not consistent with ISO 9001.
FDA has deleted the requirement from Sec. 820.22(a) because
Sec. 820.25 Personnel requires that such individuals be appropriately
trained. Further, FDA has attempted to better harmonize with ISO
9001:1994, which does not explicitly state personnel qualifications in
each provision. Similarly, in response to general comments suggesting
better harmonization, FDA has added the requirement that the audit
``determine the effectiveness of the quality system'' as required by
ISO 9001:1994. This requirement underscores that the quality audit must
not only determine whether the manufacturer's requirements are being
carried out, but whether the requirements themselves are adequate.
56. Some comments stated that requiring ``individuals who do not
have direct responsibility for the matters being audited'' to conduct
the audits is impractical and burdensome, particularly for small
manufacturers.
FDA disagrees with the comments. Both small and large manufacturers
have been subject to the identical requirement since 1978 and FDA knows
of no hardship, on small or large manufacturers, as a result. Small
manufacturers must generally establish independence, even if it means
hiring outside auditors, because the failure to have an independent
auditor could result in an ineffective audit.
Manufacturers must realize that conducting effective quality audits
is crucial. Without the feedback provided by the quality audit and
other information sources, such as complaints and service records,
manufacturers operate in an open loop system with no assurance that the
process used to design and produce devices is operating in a state of
control. ISO 9001:1994 has the same requirement for independence from
the activity being audited.
57. Several comments claimed that the last sentence in proposed
Sec. 820.22(a), which required that followup corrective action be
documented in the audit report, made no sense. The comments said that
corrective action would be the subject of a followup report.
It was the agency's intent that the provision require that where
corrective action was necessary, it would be taken and documented in a
reaudit report. The provision has been rewritten to make that clear.
New Sec. 824.22 also clarifies that a reaudit is not always required,
but where it is indicated, it must be conducted. The report should
verify that corrective action was implemented and effective. Because
FDA does not review these reports, the date on which the audit and
reaudit were performed must be documented and will be subject to FDA
review. The revised reaudit provision is consistent with ISO 9001:1994.
58. Many comments were received on proposed Sec. 820.22(b)
regarding the reports exempt from FDA review. Most of the comments
objected to FDA reviewing evaluations of suppliers. FDA has decided not
to review such
[[Page 52615]]
evaluations at this time and will revisit this decision after the
agency gains sufficient experience with the new requirement to
determine its effectiveness. A thorough response to the comments is
found with the agency's response to other comments received on
Sec. 820.50 Purchasing controls. FDA has moved the section regarding
which reports the agency will refrain from reviewing from
Sec. 820.22(b) to new Sec. 820.180(c), ``Exemptions,'' under the
related records requirements. FDA believes this organization is easier
to follow.
iii. Personnel (Sec. 820.25)
59. A few comments stated that the requirement in Sec. 820.25
Personnel for the manufacturer to employ ``sufficient'' personnel
should be deleted, because whether there are ``sufficient'' personnel
is a subjective determination, and it is unnecessary to require it
since the manufacturer will know how best to staff the organization. A
few other comments stated that the provision should not base the
personnel requirements on ensuring that the requirements of the
regulation are ``correctly'' performed, because no manufacturer can
ensure that all activities are performed correctly. Another comment
stated that the term ``employ'' should be changed because personnel may
include qualified temporaries, contractors, and others who may not
typically be considered ``employees.''
FDA disagrees with the suggestions that the terms ``sufficient''
and ``correctly'' be deleted. Whether ``sufficient'' personnel are
employed will be determined by the requirements of the quality system,
which must be designed to ensure that the requirements of the
regulation are properly implemented. In making staffing decisions, a
manufacturer must ensure that persons assigned to particular functions
are properly equipped and possess the necessary education, background,
training, and experience to perform their functions correctly. However,
FDA changed ``ensure'' to ``assure'' to address the concerns that
people do make mistakes and management cannot guarantee that work is
correctly performed all of the time. Further, FDA agrees that the
manufacturer must determine for itself what constitutes ``sufficient''
personnel with proper qualification in the first instance. However, if
the manufacturer does not employ sufficient personnel, or personnel
with the necessary qualifications to carry out their functions, the
manufacturer will be in violation of the regulation. FDA has often
found that the failure to comply with this requirement leads to other
significant regulatory violations. FDA agrees with the comment that the
term ``employ'' should be deleted so that the requirement covers all
personnel who work at a firm.
60. In Sec. 820.25(b), ``Training,'' FDA deleted the requirement
that employees be trained ``by qualified individuals,'' because
Sec. 820.25(a) requires this. Several comments stated that FDA should
add the requirement that the training procedure include the
identification of training needs, to be consistent with the
requirements in ISO 9001:1994 and ISO/CD 13485. Other comments stated
that personnel need not be trained to the extent that they can quote
chapter and verse of the regulation as long as they can adequately
perform their assigned responsibilities. Several comments suggested
deleting the requirements in the last two sentences in favor of a
broad, general requirement that personnel be trained. A few comments
stated that the last two sentences should be retained because they are
crucial and sound requirements but that validation activities should be
included with verification activities.
FDA amended the requirement so that the training procedure includes
the identification of training needs. FDA deleted the requirement on
understanding the CGMP requirements applicable to job functions to
avoid the perception that personnel would need to know ``chapter and
verse of the regulation.'' FDA notes, however, that a training program
to ensure personnel adequately perform their assigned responsibilities
should include information about the CGMP requirements and how
particular job functions relate to the overall quality system. FDA
further believes that it is imperative that training cover the
consequences of improper performance so that personnel will be apprised
of defects that they should look for, as well as be aware of the effect
their actions can have on the safety and effectiveness of the device.
In addition, FDA disagrees with comments that suggested that only
``personnel affecting quality'' should be required to be adequately
trained. In order for the full quality system to function as intended,
all personnel should be properly trained. Each function in the
manufacture of a medical device must be viewed as integral to all other
functions. FDA has reorganized the last two sentences, however, to
place the requirements under Sec. 820.25(b), ``Training,'' and has
added validation activities as suggested by the comments.
61. Many comments objected to the proposed requirements of
Sec. 820.25(c), ``Consultants,'' stating that requiring a manufacturer
to chose consultants that have sufficient qualifications and to keep
records subject to FDA review of all consultants used, along with
copies of their resumes and lists of previous jobs, would unreasonably
interfere with the manufacturer's business activities and restrict the
right of a manufacturer to hire consultants on any basis it chooses.
Other comments said that a manufacturer's employment of a consultant
has the same potential impact on the safety and effectiveness of
medical devices as employment of any other contractor for services, and
that consultants should, therefore, be covered by Sec. 820.50
Purchasing controls.
FDA agrees in part with these comments. Although employing a
consultant is a business decision, when a manufacturer hires
consultants who do not have appropriate credentials, and manufacturing
decisions are made based on erroneous or ill-conceived advice, the
public suffers. Of course, the manufacturer is still ultimately
responsible for following the CGMP requirements and will bear the
consequences of a failure to comply. FDA notes that the use of
unqualified consultants has led to regulatory action for the failure to
comply with the CGMP regulation in the past. Thus, because of the
significant impact a consultant can have on the safety and
effectiveness of a device, FDA believes that some degree of control is
required in the regulation.
The requirements are revised somewhat in response to comments,
however, to reflect that it is not FDA's goal to dictate whom a
manufacturer may use as a consultant, but instead to require that a
manufacturer determine what it needs to adequately carry out the
requirements of the regulation and to assess whether the consultant can
adequately meet those needs. The requirements related to consultants
have been added in Sec. 820.50 Purchasing controls because a consultant
is a supplier of a service.
C. Design Controls (Subpart C)
Since early 1984, FDA has identified lack of design controls as one
of the major causes of device recalls. The intrinsic quality of
devices, including their safety and effectiveness, is established
during the design phase. Thus, FDA believes that unless appropriate
design controls are observed during preproduction stages of
development, a finished device may be neither safe nor effective for
its intended use. The SMDA provided FDA with the
[[Page 52616]]
authority to add preproduction design controls to the device CGMP
regulation. Based on its experience with administering the original
CGMP regulation, which did not include preproduction design controls,
the agency was concerned that the original regulation provided less
than an adequate level of assurance that devices would be safe and
effective. Therefore, FDA has added general requirements for design
controls to the device CGMP regulation for all class III and II devices
and certain class I devices. FDA is not subjecting the majority of
class I devices to design controls because FDA does not believe that
such controls are necessary to ensure that such devices are safe and
effective and otherwise in compliance with the act. However, all
devices, including class I devices exempt from design controls, must be
properly transferred to production in order to comply with
Sec. 820.181, as well as other applicable requirements. For most class
I devices, FDA believes that the production and other controls in the
new quality system regulation and other general controls of the act
will be sufficient, as they have been in the past, to ensure safety and
effectiveness.
62. Many comments were submitted in response to the addition of
design control requirements in general, many questioning how these new
requirements would be implemented and enforced. For instance, several
comments stated that the design control requirements do not reflect how
medical devices are actually developed, because the concept of a design
rarely originates with the manufacturer, who may not become involved
until relatively late in the design evolution. Others expressed concern
that FDA investigators will second-guess design issues in which they
are not educated or trained, and stated that investigators should not
debate whether medical device designs are ``safe and effective.''
FDA agrees in part with the comments. The design control
requirements are not intended to apply to the development of concepts
and feasibility studies. However, once it is decided that a design will
be developed, a plan must be established to determine the adequacy of
the design requirements and to ensure that the design that will
eventually be released to production meets the approved requirements.
Those who design medical devices must be aware of the design
control requirements in the regulation and comply with them. Unsafe and
ineffective devices are often the result of informal development that
does not ensure the proper establishment and assessment of design
requirements which are necessary to develop a medical device that is
safe and effective for the intended use of the device and that meets
the needs of the user.
However, FDA investigators will not inspect a device under the
design control requirements to determine whether the design is
appropriate or ``safe and effective.'' Section 520(f)(1)(a) of the act
precludes FDA from evaluating the ``safety or effectiveness of a
device'' through preproduction design control procedures. FDA
investigators will evaluate the process, the methods, and the
procedures that a manufacturer has established to implement the
requirements for design controls. If, based on any information gained
during an inspection, an investigator believes that distributed devices
are unsafe or ineffective, the investigator has an obligation to report
the observations to the Center for Devices and Radiological Health
(CDRH).
63. Several comments expressed concern that the application of
design controls would severely restrict the creativity and innovation
of the design process and suggested that design controls should not
apply too early in the design development process.
FDA disagrees with the comments. It is not the intent of FDA to
interfere with creativity and innovation, and it is not the intent of
FDA to apply the design control requirements to the research phase.
Instead, the regulation requires the establishment of procedures to
ensure that whatever design is ultimately transferred to production is,
in fact, a design that will translate into a device that properly
performs according to its intended use and user needs.
To assist FDA in applying the regulation, manufacturers should
document the flow of the design process so that it is clear to the FDA
investigator where research is ending and development of the design is
beginning.
64. A few comments stated that design controls should not be
retroactive and that ongoing design development should be exempted.
FDA agrees in part with the comments. FDA did not intend the design
requirements to be retroactive, and Sec. 820.30 Design controls will
not require the manufacturer to apply such requirements to already
distributed devices. When the regulation becomes effective on June 1,
1997, it will apply to designs that are in the design and development
phase, and manufacturers will be expected to have the design and
development plan established. The manufacturer should identify what
stage a design is in for each device and will be expected to comply
with the established design and development plan and the applicable
paragraphs of Sec. 820.30 from that point forward to completion. If a
manufacturer had a design in the development stage before June 1, 1997,
and cannot comply with any particular paragraph of Sec. 820.30, the
manufacturer must provide a detailed justification as to why such
compliance is not possible. However, designs will not have to be
recycled through previous phases that have been completed.
Manufacturers will be expected to comply in full by June 1, 1998. As
stated earlier, FDA wants to emphasize that it expects manufacturers to
be in a reasonable state of compliance with the design control
requirements from June 1, 1997, to June 1, 1998, because extra time was
given to the industry for implementing design controls before the final
regulation became effective.
When changes are made to new or existing designs, the design
controls of Sec. 820.30 must be followed to ensure that the changes are
appropriate and that the device will continue to perform as intended.
FDA notes that the original CGMP regulation contained requirements for
specification controls and controls for specification or design changes
under Sec. 820.100(a).
65. One comment asked how the proposed design controls would apply
to investigational device exemption (IDE) devices, since devices under
approved IDE's have been exempt from the CGMP regulation. Some comments
suggested that any changes to the IDE regulation should be done in a
separate rulemaking. Other comments stated that any change to the IDE
regulation should be worded so that all of Sec. 820.30 applies since
the IDE process is supplying information in support of the design
validation requirements but that all design requirements need not be
completed prior to the start of the IDE because the clinical evaluation
process often brings valuable information to the design project which
may need to be incorporated into the design before design transfer.
The IDE regulation was published in 1976 and last updated in 1978,
and has been in effect since that time. Devices being evaluated under
IDE's were exempted from the original CGMP regulation because it was
believed that it was not reasonable to expect sponsors of clinical
investigations to ensure compliance with CGMP's for devices that may
never be approved for commercial distribution. However, sponsors of IDE
studies were required to ensure that investigational devices were
manufactured under a state of control.
[[Page 52617]]
With respect to the new regulation, FDA believes that it is
reasonable to expect manufacturers who design medical devices to
develop the designs in conformance with design control requirements and
that adhering to such requirements is necessary to adequately protect
the public from potentially harmful devices. The design control
requirements are basic controls needed to ensure that the device being
designed will perform as intended when produced for commercial
distribution. Clinical evaluation is an important aspect of the design
verification and validation process during the design and development
of the device. Because some of the device design occurs during the IDE
stage, it is logical that manufacturers who intend to commercially
produce the device follow design control procedures. Were a
manufacturer to wait until all the IDE studies were complete, it would
be too late to take advantage of the design control process, and the
manufacturer would not be able to fulfill the requirements of the
quality system regulation for that device.
Therefore, FDA has concurrently amended the IDE regulation,
812.1 Scope to state:
(a) * * * An IDE approved under Sec. 812.30 or considered
approved under Sec. 812.2(b) exempts a device from the requirements
of the following sections of the Federal Food, Drug, and Cosmetic
Act (the act) and regulations issued thereunder: * * * good
manufacturing practice requirements under section 520(f) except for
the requirements found in Sec. 820.30, if applicable (unless the
sponsor states an intention to comply with these requirements under
Sec. 812.20(b)(3) or Sec. 812.140(b)(4)(v)) and color additive
requirements under section 721. (Emphasis added.)
FDA does not expect any new information in IDE applications as a
result of this amendment, nor will FDA inspect design controls during
bioresearch monitoring inspections. FDA is simply making a conforming
amendment to the IDE regulation to make clear that design controls must
be followed when design functions are undertaken by manufacturers,
including design activity which occurs under an approved IDE. FDA will
evaluate the adequacy of manufacturers' compliance with design control
requirements in routine CGMP inspections, including preapproval
inspections for premarket approval applications (PMA's).
66. Many written comments and oral comments at the August and
September 1995 meetings recommended that, because design controls are a
major addition to the regulation, the effective date for design
controls should be delayed until 18 months after publication of the
final rule.
FDA has addressed these comments by extending the effective date of
the regulation until June 1, 1997, and by the inspectional strategy
described earlier.
67. A couple of comments suggested that FDA lacked the authority to
establish the design control requirements.
FDA disagrees with the comments. The act and its legislative
history make clear that FDA has the authority to impose those controls
necessary to ensure that devices are safe and effective. The SMDA gave
FDA explicit authority to promulgate design controls, including a
process to assess the performance of a device (see section 520(f)(1)(A)
of the act). The legislative history of the SMDA supports a
``comprehensive device design validation regulation.'' H. Rept. 808,
101st Cong., 2d sess. 23 (emphasis added). Congress stated that the
amendment to the statute was necessary because almost half of all
device recalls over a 5-year period were ``related to a problem with
product design.'' Id. There is a thorough discussion on the evolution
of and need for the design controls in the preamble to the November 23,
1993 (58 FR 61952), proposal.
68. A few comments objected to FDA requiring design controls for
any class I devices in Sec. 820.30(a).
FDA believes that, for the class I devices listed, design controls
are necessary and has retained the requirements. Those relatively few
devices, while class I, require close control of the design process to
ensure that the devices perform as intended, given the serious
consequences that could occur if their designs were flawed and the
devices were to fail to meet their intended uses. In fact, some of the
devices included on the list have experienced failures due to design
related problems that have resulted in health hazards, injuries, or
death. Further, verification, or even validation, cannot provide the
assurance of proper design for some devices, especially those
containing extensive software. Thus, all automated devices must be
developed under the design control requirements.
69. Several comments stated that FDA has underestimated the
complexity of a design project in requiring that the plans identify
``persons responsible for each activity'' in proposed Sec. 820.30(b).
One comment stated that ``define responsibility for implementation''
and ``activities shall be assigned'' were basically redundant
requirements. A few other comments stated that ISO 9001:1994 does not
call for the design plans to be ``approved'' and that this requirement
should be deleted because it would be burdensome.
FDA agrees in part with the comments and has revised Sec. 820.30(b)
to require the plan to describe or reference design activities and
define responsibility for implementing the activities, rather than
requiring that the plan identify each person responsible for carrying
out each activity. In making this change, FDA notes that
Sec. 820.20(b)(1) requires manufacturers to establish the appropriate
responsibility for activities affecting quality, and emphasizes that
the assignment of specific responsibility is important to the success
of the design control program and to achieving compliance with the
regulation. Also, the design and development activities should be
assigned to qualified personnel equipped with adequate resources as
required under Sec. 820.20(b)(2). The requirements under Sec. 820.30(b)
were rewritten to be very similar to the requirements in ISO 9001:1994,
sections 4.4.2 and 4.4.3. FDA does not agree that the design plan
should not be ``approved.'' ISO 9001:1994, section 4.4.2 requires that
the plan be ``updated,'' and section 4.4.3 requires that the plan be
``regularly reviewed.'' Therefore, the approval is consistent with ISO
9001:1994 and would not be unduly burdensome since the FDA does not
dictate how or by whom the plan must be approved. The regulation gives
the manufacturer the necessary flexibility to have the same person(s)
who is responsible for the review also be responsible for the approval
of the plan if appropriate.
70. A few comments stated that the proposed requirement to describe
``any interaction between or among different organizational and
technical groups'' in Sec. 820.30(b) for the design and development
plan should be deleted because it is overly broad, unnecessary, and
burdensome. One comment said that the communication expected between
these groups should be clarified.
In response, FDA has amended the requirement as suggested by one
comment so that the plan shall identify and describe the interfaces
with different groups or activities that provide, or result in, input
to the design process. Many organization functions, both inside and
outside the design group, may contribute to the design process. For
example, interfaces with marketing, purchasing, regulatory affairs,
manufacturing, service groups, or information systems may be necessary
during the design
[[Page 52618]]
development phase. To function effectively, the design plan must
establish the roles of these groups in the design process and describe
the information that should be received and transmitted.
71. One comment stated that the requirement in Sec. 820.30(b) that
manufacturers establish a design plan completely ignores the creative
and dynamic process of designing by requiring a plan to have complete
design and testing criteria established, with specifications, before
the design process is started.
FDA disagrees with the comment. Section 820.30(b) does not require
manufacturers to complete design and testing criteria before the design
process begins. This section has been revised to state that ``plans
shall be reviewed, updated, and approved as design and development
evolves,'' indicating that changes to the design plan are expected. A
design plan typically includes at least proposed quality practices,
assessment methodology, recordkeeping and documentation requirements,
and resources, as well as a sequence of events related to a particular
design or design category. These may be modified and refined as the
design evolves. However, the design process can become a lengthy and
costly process if the design activity is not properly defined and
planned. The more specifically the activities are defined up front, the
less need there will be for changes as the design evolves.
72. One comment stated that the language contained in proposed
Sec. 820.30(c) should more closely match that of ISO 9001. Many other
comments stated that the provision should not require the input
requirements to ``completely'' address the intended use of the device
because inputs could never ``completely'' address the intended use.
Several comments stated that the requirement of ISO 9001 that
``incomplete, ambiguous or conflicting requirements shall be resolved
with those responsible for imposing these requirements'' should be
added to Sec. 820.30(c), ``Design input,'' because it is important that
the regulation identify the method of resolving conflicting
information.
FDA agrees with the harmonization comment and has revised the
language to incorporate the requirement of section 4.4.4, ``Design
input,'' of ISO 9001:1994. FDA does not believe that it is necessary to
have identical language to harmonize quality system requirements. ISO
9001:1994, section 4.4.1, ``General,'' requires that the manufacturer
``establish and maintain documented procedures to control and verify
the design of the product in order to ensure that the specified
requirements are met.'' FDA's regulation, under Sec. 820.30(a), imposes
the same requirements.
Regarding the comments that input requirements cannot completely
address the intended use of the device, FDA recognizes that the
provision could be interpreted to impose a burden that may not always
be possible to meet and has deleted the word ``completely.'' FDA did
not intend the provision to suggest that a manufacturer must foresee
every possible event.
FDA emphasizes, however, that the section requires the manufacturer
to ensure that the design input requirements are appropriate so the
device will perform to meet its intended use and the needs of the user.
In doing this, the manufacturer must define the performance
characteristics, safety and reliability requirements, environmental
requirements and limitations, physical characteristics, applicable
standards and regulatory requirements, and labeling and packaging
requirements, among other things, and refine the design requirements as
verification and validation results are established. For example, when
designing a device, the manufacturer should conduct appropriate human
factors studies, analyses, and tests from the early stages of the
design process until that point in development at which the interfaces
with the medical professional and the patient are fixed. The human
interface includes both the hardware and software characteristics that
affect device use, and good design is crucial to logical,
straightforward, and safe device operation. The human factors methods
used (for instance, task/function analyses, user studies, prototype
tests, mock-up reviews, etc.) should ensure that the characteristics of
the user population and operating environment are considered. In
addition, the compatibility of system components should be assessed.
Finally, labeling (e.g., instructions for use) should be tested for
usability.
FDA agrees with the comments, in that it is important that
incomplete, ambiguous, or conflicting requirements be resolved with
those responsible for imposing these requirements. Therefore, FDA has
added the requirement that the procedures shall include a mechanism for
addressing incomplete, ambiguous, or conflicting requirements. FDA
notes that this must be done to ``ensure that the design requirements
are appropriate and address the intended use of the device,'' as
required under Sec. 820.30(c).
73. A few other comments stated that ISO 9001:1994 does not call
for the design input to be ``approved'' and therefore, this requirement
should be deleted because it would be burdensome.
FDA does not agree that the ``approval'' of design input
requirements should be deleted, nor that the requirement is
inconsistent with ISO. ISO 9001:1994, section 4.4.4, ``Design Input,''
requires that the design input requirements be ``reviewed by the
supplier for adequacy.'' Therefore, the approval would not add any
additional burden because FDA does not dictate how or by whom the
design input requirements must be approved, thus giving the
manufacturer the necessary flexibility to have the same person(s) who
is responsible for the ``review for adequacy'' also be responsible for
the approval, if appropriate. Further, it is important that the design
input be assessed as early as possible in the development process,
making this an ideal time in the device's design development to have a
design review to ``approve'' the design input.
74. A few comments stated that the proposed requirement under
Sec. 820.30(c) that ``design input shall be reviewed and approved by a
designated qualified individual'' should be deleted as it implies that
one person must be designated to review and approve a design, and that
there may not be one person who is qualified to assess all of the
design input requirements. Addressing the same point, several comments
suggested that the provision be revised to allow for more than one
person to review and approve the design. One comment said that the
FDA's requirement appears to be at odds with the team approach.
FDA agrees with the concern expressed by the comments and has
modified the requirement to allow more than one individual to review
and approve the design input. FDA endorses the team approach and
believes that designs should be reviewed and evaluated by all
disciplines necessary to ensure the design input requirements are
appropriate.
75. Two comments stated that proposed Sec. 820.30(c) should be
reworded to focus on systems for assuring adequate design input, not on
the input itself. One additional comment on this section said that the
design input requirements should include not only the device's intended
use and needs of the user, but the environmental limits of where it
will be used.
FDA agrees that procedures for ensuring appropriate design controls
are of the utmost importance and has modified the section to clarify
that the
[[Page 52619]]
manufacturer must establish and maintain procedures to ensure that the
design requirements are properly addressed. FDA made this change to the
other paragraphs as well, but notes that Sec. 820.30(a), ``General,''
requires the manufacturer to establish and maintain procedures to
control the design of the device in order to ensure that specified
design requirements are met. The sections that follow set forth some of
the requirements for which procedures must be established. It should be
emphasized that the input itself must also be appropriate; the
requirement is for the procedures to be defined, documented, and
implemented. Thus, if the input requirements related to a device fail
to address the intended use of the device, for example, the
manufacturer has failed to comply with the provision.
FDA also agrees with the additional comment but believes that
identifying and establishing the environmental limits for safe and
effective device operation is inherent in the requirements for ensuring
that a device is appropriate for its intended use. Some factors that
must be considered when establishing inputs include, where applicable,
a determination of energy (e.g., electrical, heat, and electromagnetic
fields), biological effects (e.g., toxicity and biocompatibility) and
environmental effects (e.g., electromagnetic interference and
electrostatic discharge).
76. Several comments stated that proposed Sec. 820.30(f), ``Design
output,'' should be rewritten or deleted because many of the
requirements were already stated in proposed Secs. 820.30(d), ``Design
verification,'' and 820.30(e), ``Design review,'' and, if retained,
should be reordered similar to ISO 9001.
FDA agrees in part with the comments and has rewritten the
requirements of design output to be consistent with ISO 9001:1994,
section 4.4.5, ``Design output,'' and reordered the sections to be
consistent with ISO 9001:1994. FDA retained the provision, however,
because it does not agree that the section is redundant with the
sections on design verification, design validation, or design review.
Design output are the design specifications which should meet design
input requirements, as confirmed during design verification and
validation and ensured during design review. The output includes the
device, its labeling and packaging, associated specifications and
drawings, and production and quality assurance specifications and
procedures. These documents are the basis for the DMR. The total
finished design output consists of the device, its labeling and
packaging, and the DMR.
77. One comment stated that the sentence ``Design output procedures
shall ensure that design output meets the design input requirements''
is redundant with the requirement under design verification. Another
comment asked what is meant by ``release.''
FDA agrees with the first comment and has deleted that sentence in
Sec. 820.30(d) but notes that the design output must be documented and
expressed in terms that can be verified against the design input
requirements.
Design output can be ``released'' or transferred to the next design
phase at various stages in the design process, as defined in the design
and development plan. The design output is reviewed and approved before
release or transfer to the next design phase or production. The design
output requirements are intended to apply to all such stages of the
design process.
78. One small manufacturer commented that the problems that
Sec. 820.30(e), ``Design review,'' is meant to reveal involve
coordination, cooperation, or communication difficulties among the
members of an organization and that these difficulties do not exist in
a small company. Therefore, the comment stated that the design review
requirements should not apply to small manufacturers.
The purpose of conducting design reviews during the design phase is
to ensure that the design satisfies the design input requirements for
the intended use of the device and the needs of the user. Design review
includes the review of design verification data to determine whether
the design outputs meet functional and operational requirements, the
design is compatible with components and other accessories, the safety
requirements are achieved, the reliability and maintenance requirements
are met, the labeling and other regulatory requirements are met, and
the manufacturing, installation, and servicing requirements are
compatible with the design specifications. Design reviews should be
conducted at major decision points during the design phase.
For a large manufacturer, design review provides an opportunity for
all those who may have an impact on the quality of the device to
provide input, including manufacturing, quality assurance, purchasing,
sales, and servicing divisions. While small manufacturers may not have
the broad range of disciplines found in a large company, and the need
to coordinate and control technical interfaces may be lessened, the
principles of design review still apply. The requirements under
Sec. 820.30(e) allow small manufacturers to tailor a design review that
is appropriate to their individual needs.
79. One comment stated that the wording of proposed Sec. 820.30(e)
implies that only one design review is expected, and that design review
should be conducted at several stages of product development. Several
comments stated that to demand that every design review be conducted by
individuals who do not have direct responsibility for design
development is impractical, especially for small companies.
FDA agrees with the first comment and has rewritten the requirement
to make clear that design reviews must be conducted at appropriate
stages of design development, which must be defined in the established
design and development plan. The number of design reviews will depend
on the plan and the complexity of the device. FDA also amended the
requirements so that the results of a design review include
identification of the design, the date, and the individual(s)
performing the review. Thus, multiple reviews can occur and the
manufacturer must document what is being reviewed, when, and by whom.
FDA never intended to mandate that an individual without design
responsibility conduct the design reviews and, to clarify its position,
has rewritten the requirement. The requirement now states that the
procedures shall ensure that each design review includes an
individual(s) who does not have direct responsibility for the design
stage being reviewed. This requirement will provide an ``objective
view'' from someone not working directly on that particular part of the
design project, to ensure that the requirements are met. In making this
change, FDA also notes that it was not FDA's intention to prohibit
those directly responsible for the design from participating in the
design review.
80. One comment stated that as part of the systematic review of the
adequacy of the device design, it is occasionally necessary to produce
a prototype device and have it evaluated by a physician who is an
expert in the area of the device's intended use. Thus, the comment
stated that the regulation should be revised to allow a means for a
manufacturer to ship a prototype device to a physician for evaluation.
One comment questioned whether design verification and validation can
be conducted using prototypes or machine shop models.
FDA regulations do not prohibit the shipment of prototypes for
clinical or
[[Page 52620]]
other studies. Prototypes used in clinical studies involving humans may
be shipped in accordance with the IDE provisions in part 812 (21 CFR
part 812).
FDA understands that it is not always practical to conduct clinical
studies on finished production units and, therefore, the use of
prototypes in clinical studies is acceptable. When prototype devices
are used on humans they must be verified as safe to the maximum extent
feasible. Final design validation, however, cannot be done on
prototypes because the actual devices produced and distributed are
seldom the same as the research and development prototypes. The final
verification and validation, therefore, must include the testing of
actual production devices under actual or simulated use conditions.
81. A few comments stated that Sec. 820.30(d), ``Design
verification,'' should be rewritten and reordered similar to ISO 9001.
FDA agrees with the comments and has rewritten and reordered this
section to be consistent with ISO 9001:1994. The language in revised
Sec. 820.30(f) and (g) incorporates the requirement of ISO 9001:1994,
sections 4.4.7, ``Design verification,'' and 4.4.8, ``Design
validation,'' respectively.
Under the revised provisions, the design must be verified and
validated. It is important to note that design validation follows
successful design verification. Certain aspects of design validation
can be accomplished during the design verification, but design
verification is not a substitute for design validation. Design
validation should be performed under defined operating conditions and
on the initial production units, lots, or batches, or their equivalents
to ensure proper overall design control and proper design transfer.
When equivalent devices are used in the final design validation, the
manufacturer must document in detail how the device was manufactured
and how the manufacturing is similar to and possibly different from
initial production. Where there are differences, the manufacturer must
justify why design validation results are valid for the production
units, lots, or batches. Manufacturers should not use prototypes
developed in the laboratory or machine shop as test units to meet these
requirements. Prototypes may differ from the finished production
devices. During research and development, conditions for building
prototypes are typically better controlled and personnel more
knowledgeable about what needs to be done and how to do it than are
regular production personnel. When going from laboratory to scale-up
production, standards, methods, and procedures may not be properly
transferred, or additional manufacturing processes may be added. Often,
changes not reflected in the prototype are made in the device to
facilitate the manufacturing process, and these may adversely affect
device functioning and user interface characteristics. Proper testing
of devices that are produced using the same methods and procedures as
those to be used in routine production will prevent the distribution
and subsequent recall of many unacceptable medical devices.
In addition, finished devices must be tested for performance under
actual conditions of use or simulated use conditions in the actual or
simulated environment in which the device is expected to be used. The
simulated use testing provision no longer requires that the testing be
performed on the first three production runs. However, samples must be
taken from units, lots, or batches that were produced using the same
specifications, production and quality system methods, procedures, and
equipment that will be used for routine production. FDA considers this
a critical element of the design validation. The requirement to conduct
simulated use testing of finished devices is found in the original CGMP
in Sec. 820.160, as part of finished device inspection. This
requirement has been moved to Sec. 820.30(g) because FDA believes that
simulated use testing at this point is more effective in ensuring that
only safe and effective devices are produced. Manufacturers must also
conduct such tests when they make changes in the device design or the
manufacturing process that could affect safety or effectiveness as
required in the original CGMP in Sec. 820.100(a)(2). The extent of
testing conducted should be governed by the risk(s) the device will
present if it fails. FDA considers these activities essential for
ensuring that the manufacturing process does not adversely affect the
device.
Design validation may also be necessary in earlier stages, prior to
product completion, and multiple validations may need to be performed
if there are different intended uses. Proper design validation cannot
occur without following all the requirements set forth in the design
control section of the regulation.
82. Several comments stated that adequate controls for verification
of design output are contained in proposed Sec. 820.30(d), ``Design
verification,'' and repeated in proposed Sec. 820.30(f), ``Design
output.'' One comment stated that this section will place undue burden
on designers and require additional documentation which will add little
value to a device's safety and effectiveness.
FDA disagrees with the comments. Revised Sec. 820.30(f), ``Design
verification,'' and Sec. 820.30(g), ``Design validation,'' require
verification and validation of the design output. Section 820.30(d),
``Design output,'' requires that the output be documented in a fashion
that will allow for verification and validation. These sections thus
contain different requirements that are basic to establishing that the
design output meets the approved design requirements or inputs,
including user needs and intended uses. All the requirements are
essential to assuring the safety and effectiveness of devices. FDA does
not believe that these requirements place undue burden on designers or
require additional documentation with no value added. These basic
requirements are necessary to assure the proper device performance,
and, therefore, the production of safe and effective devices, and are
acknowledged and accepted as such throughout the world.
83. Several comments stated that the term ``hazard analysis''
should be defined in reference to design verification. A couple of
comments stated that the proposed requirement for design verification,
to include software validation and hazard analysis, where applicable,
was ambiguous, and may lead an FDA investigator to require software
validation and hazard analysis for devices in cases where it is not
needed. One comment stated that FDA should provide additional guidance
regarding software validation and hazard analysis and what
investigators will expect to see. Another comment stated that by
explicitly mentioning only software validation and hazard analysis, FDA
was missing the opportunity to introduce manufacturers to some powerful
and beneficial tools for better device designs and problem avoidance.
FDA has deleted the term ``hazard analysis'' and replaced it with
the term ``risk analysis.'' FDA's involvement with the ISO TC 210 made
it clear that ``risk analysis'' is the comprehensive and appropriate
term. When conducting a risk analysis, manufacturers are expected to
identify possible hazards associated with the design in both normal and
fault conditions. The risks associated with the hazards, including
those resulting from user error, should then be calculated in both
normal and fault conditions. If any risk is judged unacceptable, it
should be reduced to acceptable levels by the appropriate
[[Page 52621]]
means, for example, by redesign or warnings. An important part of risk
analysis is ensuring that changes made to eliminate or minimize hazards
do not introduce new hazards. Tools for conducting such analyses
include Failure Mode Effect Analysis and Fault Tree Analysis, among
others.
FDA disagrees with the comments that state the requirement is
ambiguous. Software must be validated when it is a part of the finished
device. FDA believes that this control is always needed, given the
unique nature of software, to assure that software will perform as
intended and will not impede safe operation by the user. Risk analysis
must be conducted for the majority of devices subject to design
controls and is considered to be an essential requirement for medical
devices under this regulation, as well as under ISO/CD 13485 and EN
46001. FDA has replaced the phrase ``where applicable'' with ``where
appropriate'' for consistency with the rest of the regulation.
FDA believes that sufficient domestic and international guidelines
are available to provide assistance to manufacturers for the validation
of software and risk analysis. For example, ``Reviewer Guidance for
Computer Controlled Medical Devices Undergoing 510(k) Review,'' August
1991; ``A Technical Report, Software Development Activities,'' July
1987; and ISO-9000-3 contain computer validation guidance. Further, FDA
is preparing a new ``CDRH Guidance for the Scientific Review of Pre-
Market Medical Device Software Submissions.'' Regarding guidance on
``risk analysis,'' manufacturers can reference the draft EN (prEN)
1441, ``Medical Devices--Risk Analysis'' standard and the work
resulting from ISO TC 210 working group No. 4 to include ISO/CD 14971,
``Medical Devices--Risk Management--Application of Risk Analysis to
Medical Devices.''
FDA disagrees that it is missing the opportunity to introduce
manufacturers to some powerful and beneficial tools for better device
designs and problem avoidance because the manufacturer must apply
current methods and procedures that are appropriate for the device, to
verify and validate the device design under the regulation. Therefore,
FDA need not list all known methods for meeting the requirements. A
tool that may be required to adequately verify and validate one design
may be unnecessary to verify and validate another design.
84. One comment stated that for some design elements it may be more
appropriate to reference data from another prior experimentation rather
than conduct new testing, and that the requirement to list verification
methods should be modified.
FDA agrees in part with the comment. The revised language of
Sec. 820.30(f) will permit the use of data from prior experimentation
when applicable. When using data from previous experimentation,
manufacturers must ensure that it is adequate for the current
application.
85. ``Design transfer,'' now Sec. 820.30(h), has been revised in
response to the many comments objecting to the requirements in the
proposed section on ``Design transfer.'' Specifically, the proposed
requirement for testing production units under actual or simulated use
conditions was rewritten and moved to current Sec. 820.30(g), ``Design
validation.''
FDA again emphasizes that testing production units under actual or
simulated use conditions prior to distribution is crucial for ensuring
that only safe and effective devices are distributed and FDA has
therefore retained the requirement. ISO 9001:1994 discusses this
concept in notes 12 and 13. As noted above, it is not always possible
to determine the adequacy of the design by successfully building and
testing prototypes or models produced in a laboratory setting.
The requirement for testing from the first three production lots or
batches has been deleted. While FDA believes that three production runs
during process validation (process validation may be initiated before
or during design transfer) is the accepted standard, FDA recognizes
that all processes may not be defined in terms of lots or batches. The
number three is, however, currently considered to be the acceptable
standard. Therefore, although the number requirement is deleted, FDA
expects validation to be carried out properly in accordance with
accepted standards, and will inspect for compliance accordingly.
Revised Sec. 820.30(h) now contains a general requirement for the
establishment of procedures to ensure that the design basis for the
device is correctly translated into production methods and procedures.
This is the same requirement that is contained in Sec. 820.100(a) of
the original CGMP regulation.
86. A few comments stated that the proposed requirements for
``Design release'' would prohibit the release of components, partial
designs, and production methods before the design was final because the
requirements mandate a review of all drawings, analysis, and production
methods before allowing the product to go into production. Several
comments stated that the proposed section on ``Design release'' was a
duplication of requirements in other paragraphs of Sec. 820.30 and
should be deleted.
FDA did not intend the requirements for ``Design release'' to
prohibit manufacturers from beginning the production process until all
design activities were completed. The intent of the requirement was to
ensure that all design specifications released to production have been
approved, verified, and validated before they are implemented as part
of the production process. This requirement is now explicitly contained
in Sec. 820.30(d).
FDA agrees in part with the second set of comments and has moved
the requirement that design output be reviewed and approved to current
Sec. 820.30(d), ``Design output.'' The remainder of the requirements
have been deleted.
87. Several comments on Sec. 820.30(i), ``Design changes,'' stated
that it is unnecessary to control all design changes and to do so would
inhibit change and innovation.
FDA disagrees with the comments. Manufacturers are not expected to
maintain records of all changes proposed during the very early stages
of the design process. However, all design changes made after the
design review that approves the initial design inputs for incorporation
into the design, and those changes made to correct design deficiencies
once the design has been released to production, must be documented.
The records of these changes create a history of the evolution of the
design, which can be invaluable for failure investigation and for
facilitating the design of future similar products. Such records can
prevent the repetition of errors and the development of unsafe or
ineffective designs. The evaluation and documentation should be in
direct proportion to the significance of the change. Procedures must
ensure that after the design requirements are established and approved,
changes to the design, both pre- production and post-production are
also reviewed, validated (or verified where appropriate), and approved.
Otherwise, a device may be rendered unable to properly perform, and
unsafe and ineffective. ISO 9001:1994, section 4.4.9, similarly
provides that ``all design changes and modifications shall be
identified, documented, reviewed, and approved by authorized personnel
before their implementation.''
Note that when a change is made to a specification, method, or
procedure, each manufacturer should evaluate the
[[Page 52622]]
change in accordance with an established procedure to determine if the
submission of a premarket notification (510(k)) under Sec. 807.81(a)(3)
(21 CFR 807.81(a)(3)), or the submission of a supplement to a PMA under
Sec. 814.39(a) (21 CFR 814.39) is required. Records of this evaluation
and its results should be maintained.
88. Several comments recommended that only changes after design
validation and design transfer to full-scale production need to be
documented.
FDA disagrees with the comments. The safety and effectiveness of
devices cannot be proven by final inspection or testing. Product
development is inherently an evolutionary process. While change is a
healthy and necessary part of product development, quality can be
ensured only if change is controlled and documented in the development
process, as well as the production process. Again, manufacturers are
not expected to maintain records of changes made during the very early
stages of product development; only those design changes made after the
approval of the design inputs need be documented. Each manufacturer
must establish criteria for evaluating changes to ensure that the
changes are appropriate for its designs.
89. One comment on proposed Sec. 820.30(i), ``Design changes,''
stated that validation of design changes is not always necessary and
the regulation should provide for other methods to be used. FDA agrees
with the comments and has amended the requirement to permit
verification where appropriate. For example, a change in the
sterilization process of a catheter will require validation of the new
process, but the addition of more chromium to a stainless steel
surgical instrument may only require verification through chemical
analysis. Where a design change cannot be verified by subsequent
inspection and test, it must be validated.
90. Many comments noted that the acronym for proposed design
history record (DHR) was the same as that of ``device history record''
(DHR), and suggested that the name of the ``design history record'' be
changed. Several comments stated that the requirements of the ``design
history record'' should be deleted because they were redundant with the
requirements of the ``device master record.''
FDA agrees with the first set of comments and has changed the name
to ``design history file.''
FDA disagrees with the second set of comments. The DMR contains the
documentation necessary to produce a device. The final design output
from the design phase, which is maintained or referenced in the DHF,
will form the basis or starting point for the DMR. Thus, those outputs
must be referred to or placed in the DMR. The total finished design
output includes the final device, its labeling and packaging, and the
DMR that includes device specifications and drawings, as well as all
instructions and procedures for production, installation, maintenance,
and servicing. The DHF, in contrast, contains or references all the
records necessary to establish compliance with the design plan and the
regulation, including the design control procedures. The DHF
illustrates the history of the design, and is necessary so that
manufacturers can exercise control over and be accountable for the
design process, thereby maximizing the probability that the finished
design conforms to the design specifications.
91. A few comments stated that the proposed requirements in
Sec. 820.30(j) for the design history record should allow a single
design history record for each device family or group having common
design characteristics.
FDA agrees with the comments. The intent of the DHF is to document,
or reference the documentation of, the activities carried out to meet
the design plan and requirements of Sec. 820.30. A DHF is, therefore,
necessary for each type of device developed. The DHF must provide
documentation showing the actions taken with regard to each type of
device designed, not generically link devices together with different
design characteristics and give a general overview of how the output
was reached.
92. Some comments stated that the requirement that the DHF contain
``all'' records necessary to demonstrate that the requirements are met
should be deleted because not ``all'' efforts need documentation.
FDA received similar comments on almost every section of the
regulation that had the word ``all.'' The proposed requirement does not
state that all records must be contained in the DHF, but that all
records necessary to demonstrate that the requirements were met must be
contained in the file. FDA has deleted the word ``all'' but cautions
manufacturers that the complete history of the design process should be
documented in the DHF. Such records are necessary to ensure that the
final design conforms to the design specifications. Depending on the
design, that may be relatively few records. Manufacturers who do not
document all their efforts may lose the information and experience of
those efforts, thereby possibly requiring activities to be duplicated.
D. Document Controls (Subpart D)
93. One comment stated that subpart D of part 820 should be titled
``Document Controls,'' instead of the proposed ``Document and Record
Controls'' because the ``record'' requirements are addressed in subpart
M. One comment stated that removal of obsolete or unneeded documents
should be performed to maintain the integrity of the product
configuration and the quality system. The comment suggested adding a
requirement for a verification step for document distribution and
removal to ensure this important element of a quality system is
performed correctly. A few comments stated that proposed Sec. 820.40
should be rewritten to be similar to ISO 9001 and to delete the
requirement that documents be ``accurate'' because the comments feared
that typographical errors would be considered violations.
FDA agrees with the first comment and has changed the title
accordingly. FDA agrees in part with the second comment. The
verification of document distribution and removal is very important and
can directly affect the quality of a product. Section 820.40, which
requires that the manufacturer establish and maintain procedures to
control all documents, including those that are obsolete and/or to be
removed, requires that the removal (or prevention of use) of obsolete
documents be verified. FDA agrees in part with the last set of comments
and has rewritten the section, following ISO 9001:1994, to be a general
requirement for procedures to control documents that are required under
the regulation. The procedures established must, among other things,
ensure control of the accuracy and usage of current versions of the
documents and the removal or prevention from use of obsolete documents,
as well as ensure that the documentation developed is adequate to
fulfill its intended purpose or requirement. FDA retained the
requirement that the procedures ensure that documents meet the
requirements of the regulation because that is the purpose of
controlling the documents. FDA deleted the term ``accurate'' but notes
that a typographical error can change the meaning of a document and
have undesirable consequences.
94. Several comments on proposed Sec. 820.40(a), ``Document
approval and issue,'' as well as other sections throughout the
regulation, suggested that the term ``signature'' be replaced by the
term ``identification.'' Such a change would allow for electronic or
computerized identification in lieu of formal written signatures. Other
comments stated that ``or stamps''
[[Page 52623]]
should be added after ``signature'' since they are legally recognized
in some foreign countries.
FDA is aware that many documentation systems are now maintained
electronically, and is in the process of developing an agency-wide
policy that will be implemented through rulemaking on the use of
electronic signatures. The agency identified several important issues
related to the use of such signatures, including how to ensure that the
identification is in fact the user's ``signature.'' These issues are
discussed in FDA's ANPRM on the use of electronic signatures, published
in the Federal Register on July 21, 1992 (57 FR 32185), and the
proposed regulation published in the Federal Register on August 31,
1994 (59 FR 45160). Therefore, FDA has not revised the regulation to
use the term ``identification,'' but notes that the quality system
regulation's use of the term ``signature'' will permit the use of
whatever electronic means the agency determines is the equivalent of a
handwritten signature. FDA recommends that manufacturers use the two
Federal Register documents as guidance until the regulation is
finalized. FDA has not added the term ``or stamps'' to the regulation;
however, stamps could be acceptable if the manufacturer has a formal
procedure on how stamps are used in place of handwritten signatures.
The procedure would have to address many of the same issues addressed
in the electronic signature Federal Register documents, most
importantly how the stamps would be controlled and how the manufacturer
would ensure that the stamp was in fact the user's ``signature.''
95. Several comments stated that proposed Sec. 820.40(b),
``Document distribution,'' should be rewritten to be consistent with
ISO 9001.
In response, FDA has deleted the section. The requirements for
making documents available at all appropriate locations (ISO 9001:1994,
section 4.5.2(a)) and the requirements for promptly removing obsolete
documents (ISO 9001:1994, section 4.5.2(b)) have been moved, in revised
form, to Sec. 820.40(a). In response to comments, FDA has added that
obsolete documents, in lieu of being promptly removed from points of
use, may be ``otherwise prevented from unintended use.''
96. Several comments suggested major changes to proposed
Sec. 820.40(c), ``Documentation changes.'' Some stated that the
requirements should be revised to be consistent with ISO 9001. Others
stated that the requirements related to validation should be rewritten
and moved to another section under this part, because Sec. 820.40(c)
should only address document changes, not device changes. Several
comments stated that the reference to determining whether a 510(k) or
PMA supplement is required after making changes to a device should be
deleted because it is covered under different parts of the act and
regulations. One comment stated that the requirement in Sec. 820.40(c)
for changes to be ``approved by individuals in the same functions/
organizations that performed the original review and approval, unless
specifically designated otherwise'' is unrealistic and does not reflect
the way things are done in real life.
FDA agrees with many of the comments and has substantially
rewritten Sec. 820.40(c), now designated as Sec. 820.40(b), to relate
specifically to changes to a document. The requirements are now very
similar to the ISO 9001:1994 requirements in section 4.5.3. FDA has
retained the requirement that the approved changes must be communicated
in a timely manner to appropriate personnel. FDA has had many
experiences where manufacturers made corrections to documents, but the
changes were not communicated in a timely manner to the personnel
utilizing the documents. The result of these untimely communications
was the production of defective devices.
In addition, FDA has moved the requirement for validating
production and process changes to Sec. 820.70(b), ``Production and
process changes,'' and notes that changes to the design specifications,
at any time during the lifetime of the design of the device, must
conform to the requirements in Sec. 820.30(i), ``Design changes.''
FDA has also deleted the sentence referencing 510(k)'s and PMA
supplements because FDA believes this is covered elsewhere, but notes
that this sentence is in the preamble above for Sec. 820.30(i).
FDA disagrees that the requirement for changes to be ``approved by
an individual(s) in the same function or organization that performed
the original review and approval, unless specifically designated
otherwise'' should be deleted and notes that this is a requirement of
ISO 9001:1994 as well. The intent of the requirement is to ensure that
those who originally approved the document have an opportunity to
review any changes because these individuals typically have the best
insight on the impact of the changes. The requirement is flexible,
however, because it permits the manufacturer to specifically designate
individuals who did not perform the original review and approval to
review and approve the changes. To designate such individuals, the
manufacturer will need to determine who would be best suited to perform
the function, thus ensuring adequate control over the changes. In this
way, review and approval will not be haphazard.
97. One comment on proposed Sec. 820.40(d), ``Documentation change
record,'' stated that this section should be deleted because the other
paragraphs of Sec. 820.40 adequately cover the proposed requirements.
Two comments suggested replacing the section with the requirements of
section 4.5.2 of ISO 9001.
FDA has deleted Sec. 820.40(d) and placed the revised requirements
in paragraphs (a) and (b) of this section. The general requirement of
Sec. 820.40 now requires the manufacturer to establish adequate
procedures to control all documents required by part 820. The
procedures must cover the requirements listed in Sec. 820.40 (a) and
(b). Thus, the manufacturer must establish a procedure for ensuring
that only the current and approved version of a document is used,
achieving the objective of the ``Master list or equivalent document
control procedure,'' required in ISO 9001:1994, section 4.5.2.
The other requirement in Sec. 820.40(d), ``Document change
record,'' was to maintain a record of changes, to include a description
of the changes, among other things. FDA has retained this requirement
and has moved it into Sec. 820.40(b), ``Document changes,'' because the
agency believes this information to be important and useful when
investigating and performing corrective or preventive actions.
FDA believes Sec. 820.40 on Document controls now adequately
harmonizes with ISO 9001:1994, sections 4.5.1, 4.5.2, and 4.5.3.
E. Purchasing Controls (Subpart E)
98. One comment stated that the proposed CGMP regulation omits any
discussion of contract reviews, such as that contained in ISO 9001,
section 4.3. Rather than leaving these procedures to the
interpretations of individual manufacturers and investigators, the
comment stated that FDA should explicitly state its general policy
regarding contract reviews in the regulation.
FDA agrees with the concepts underlying the contract review
requirements of ISO 9001:1994, but believes these principles are
already reflected in requirements in the regulation, such as
Secs. 820.50 Purchasing controls and 820.160 Distribution.
[[Page 52624]]
Therefore, the agency has not added a separate section on contract
review.
99. One comment stated that the requirements in Sec. 820.50 amount
to overregulation. The comment stated that components are purchased by
providing a specification sheet. They are then inspected upon receipt,
and defective components are returned. According to the comment, under
Sec. 820.50, the manufacturer would be required to spend more time on
paperwork, and product would still have to be inspected upon receipt.
Another comment stated that the cost of the quality assurance
documentation program is going to be significantly higher for a company
that runs a Just In Time (JIT) program than what FDA estimated.
FDA disagrees with the comments. The failure to implement adequate
purchasing controls has resulted in a significant number of recalls due
to component failures. Most of these were due to unacceptable
components provided by suppliers. Since FDA is not regulating component
suppliers, FDA believes that the explicit addition to CGMP requirements
of the purchasing controls of ISO 9001:1994 is necessary to provide the
additional assurance that only acceptable components are used. To
ensure purchased or otherwise received product or services conform to
specifications, purchasing must be carried out under adequate controls,
including the assessment and selection of suppliers, contractors, and
consultants, the clear and unambiguous specification of requirements,
and the performance of suitable acceptance activities. Each
manufacturer must establish an appropriate mix of assessment and
receiving acceptance to ensure products and services are acceptable for
their intended uses. The specifications for the finished device cannot
be met unless the individual parts of the finished device meet
specifications. The most efficient and least costly approach is to
ensure that only acceptable products and services are received. This
means that only suppliers, contractors, and consultants that meet
specifications should be used.
The regulation has been written to allow more flexibility in the
way manufacturers may ensure the acceptability of products and
services. Under the requirements, manufacturers must clearly define in
the procedures the type and extent of control they intend to apply to
products and services. Thus, a finished device manufacturer may choose
to provide greater in-house controls to ensure that products and
services meet requirements, or may require the supplier to adopt
measures necessary to ensure acceptability, as appropriate. FDA
generally believes that an appropriate mix of supplier and manufacturer
quality controls are necessary. However, finished device manufacturers
who conduct product quality control solely in-house must also assess
the capability of suppliers to provide acceptable product. Where audits
are not practical, this may be done through, among other means,
reviewing historical data, monitoring and trending, and inspection and
testing.
After evaluation of all of the comments on Sec. 820.50, FDA has
decided to change the wording of Sec. 820.50(a) and adopt the wording
of ISO 9001:1994 to make clear that manufacturers have flexibility in
determining the degree of assessment and evaluation necessary for
suppliers, contractors, and consultants. Thus the degree of supplier
control necessary to establish compliance may vary with the type and
significance of the product or service purchased and the impact of that
product or service on the quality of the finished device. In addition,
the requirement for manufacturers to establish assessment criteria has
been deleted but the evaluation still must include a description how
the assessment was made (according to what criteria or objective
procedure) and the results must be documented. Each manufacturer must
now define the type and extent of control it will exercise over
suppliers, contractors, and consultants. This is consistent with the
1994 version of ISO 9001.
Thus, FDA believes that the flexibility of the regulation will
allow manufacturers to implement JIT procedures without additional
cost. In fact, the new regulation is more conducive to JIT practices by
permitting the assessment or evaluation of product or services up
front, thereby lessening the degree of in-house control that may be
necessary.
100. Several comments said that it was unclear what FDA meant by
the phrase ``or held by other persons under contract conform to
specifications'' and that this phrase should be deleted.
FDA agrees with the comments and has deleted the phrase. The phrase
was intended to mean product and services which were purchased or
processed in some manner by other organizations. Section 820.50 now
applies to ``purchased or otherwise received product and services'' to
convey this meaning. FDA emphasizes that the requirements apply to all
product and service received from outside of the finished device
manufacturer, whether payment occurs or not. Thus, a manufacturer must
comply with these provisions when it receives product or services from
its ``sister facility'' or some other corporate or financial affiliate.
``Otherwise received product'' would include ``customer supplied
product'' as in ISO 9001:1994, section 4.7, but would not apply to
``returned product'' from the customer.
101. One comment stated that ``manufacturing materials'' should be
deleted from the first sentence of the introductory text of the
proposed Sec. 820.50, as the assessment of the manufacturers of
manufacturing materials would be a monumental task.
FDA disagrees with the comment. The first sentence of the
introductory text of Sec. 820.50 is rewritten to be a general
requirement that each manufacturer must establish procedures to ensure
that received product and services (purchased or otherwise received)
conform to specified requirements. All manufacturers are expected to
apply controls to manufacturing materials appropriate to the
manufacturing material, the intended use, and the effect of the
manufacturing materials on safety and effectiveness. For example, the
procedures necessary to ensure that a mold release agent conforms to
specified requirements may be less involved than the procedures for
controlling latex proteins. The provision allows the manufacturer the
flexibility of establishing the procedures to meet its needs and to
ensure that the product conforms to specified requirements.
102. One comment said that FDA should delete the last sentence of
the introductory text of proposed Sec. 820.50 because it is unnecessary
for manufacturers to develop specifications for services that are
unrelated to product or process quality, and because the terms
``service'' and ``other persons'' lack definition. Other comments
stated that ``all'' should be deleted in the general requirement.
FDA disagrees with the comments. First, as used in the regulation,
``service'' means parts of the manufacturing or quality system that are
contracted to others, for example, plating of metals, testing, and
sterilizing, among others. Second, FDA believes that all suppliers of
such services must be assessed and evaluated, just like a supplier of a
product. As always, the degree of control necessary is related to the
product or service purchased. FDA has, however, deleted the term
``provided by other persons'' because it was unnecessary. FDA did not
delete the word ``all'' because, as discussed above, component
manufacturers are not subject to this regulation, so it is the
[[Page 52625]]
finished device manufacturer who is responsible for ``all'' product and
services.
103. One comment stated that many suppliers of components to the
medical device industry have their quality systems certified to an ISO
9000 standard by an independent third party auditor, and that such
registration of component manufacturers should be considered in vendor
assessment plans.
FDA agrees in part with the comment in that certification may play
a role in evaluating suppliers, but cautions manufacturers against
relying solely on certification by third parties as evidence that
suppliers have the capability to provide quality products or services.
FDA has found during inspections that some manufacturers who have been
certified to the ISO standards have not had acceptable problem
identification and corrective action programs. Therefore, the initial
assessment or evaluation, depending on the type and potential effect on
device quality of the product or service, should be a combination of
assessment methods, to possibly include third party or product
certification. However, third party certification should not be relied
on exclusively in initially evaluating a supplier. If a device
manufacturer has established confidence in the supplier's ability to
provide acceptable products or services, certification with test data
may be acceptable.
104. Some comments stated that consultants should not be included
in the regulation at all. Others stated that it was not consistent with
ISO 9001.
FDA added ``consultants'' to Sec. 820.50(a) in response to the
comments from Sec. 820.25(c). FDA disagrees that ``consultants'' should
be deleted because over the years FDA has observed that a surprising
number of firms hire consultants who have no particular expertise in
the area in which the firm is seeking assistance. Section 820.50
addresses this problem by ensuring that a consultant's capability for
the specific tasks for which he or she is retained be assessed and
documented. Further, FDA does not believe this requirement is
inconsistent with ISO 9001:1994 because ISO uses the term
``subcontractor.'' The term ``subcontractor'' includes consultants.
105. One comment said that requiring evaluation of potential
suppliers, contractors, and consultants ``on the basis of their ability
to meet requirements'' is vague and should be clearly defined.
FDA disagrees that the phrase is vague. Suppliers, contractors, and
consultants selected by manufacturers of medical devices should have a
demonstrated capability of providing products and services that meet
the requirements established by the finished device manufacturer. The
capability of the product or service suppliers should be reviewed at
intervals consistent with the significance of the product or service
provided and the review should demonstrate conformance to specified
requirements.
106. One comment questioned the usefulness of Sec. 820.50, given
that the requirements under Sec. 820.80 Receiving, in-process, and
finished device acceptance, require manufacturers to establish and
maintain procedures for acceptance of incoming components.
The intent of Sec. 820.50 is to ensure that device manufacturers
select only those suppliers, contractors, and consultants who have the
capability to provide quality product and services. As with finished
devices, quality cannot be inspected or tested into products or
services. Rather, the quality of a product or service is established
during the design of that product or service, and achieved through
proper control of the manufacture of that product or the performance of
that service. Section 820.50 thus mandates that products be
manufactured and services be performed under appropriate quality
assurance procedures. Finished device manufacturers are required under
Sec. 820.50 to establish the requirements for, and document the
capability of, suppliers, contractors, and consultants to provide
quality products and services.
Section 820.80 is specific to a device manufacturer's acceptance
program. While finished device manufacturers are required to assess the
capability of suppliers, contractors, and consultants to provide
quality products and services, inspections and tests, and other
verification tools, are also an important part of ensuring that
components and finished devices conform to approved specifications. The
extent of incoming acceptance activities can be based, in part, on the
degree to which the supplier has demonstrated a capability to provide
quality products or services. An appropriate product and services
quality assurance program includes a combination of assessment
techniques, including inspection and test.
107. Several comments stated that it was not clear how a
manufacturer could evaluate an off-the-shelf component that is
purchased from a distributor rather than directly from its
manufacturer, and stated that it would not be helpful to audit the
distributor.
FDA agrees that auditing a distributor would not meet the intent of
Sec. 820.50. Manufacturers should remember that the purpose of
assessing the capability of suppliers is to provide quality products
and to provide a greater degree of assurance, beyond that provided by
receiving inspection and test, that the products received meet the
finished device manufacturer's requirements. The agency recognizes that
finished device manufacturers may not always be able to audit the
supplier of a product. In such cases, the manufacturer must apply other
effective means to assure that products are acceptable for use.
108. Many comments from both domestic and foreign firms in response
to proposed Sec. 820.22(b) said that making supplier audit reports
subject to FDA review would have a major adverse impact on the
relationships between the finished device manufacturers and their
suppliers and service providers. Some stated that the requirement would
cause suppliers to refuse to sell components to medical device
manufacturers, especially suppliers who provide only a small part of
their production to device manufacturers. Others said that this policy
is not consistent with FDA's policy for internal audits.
FDA recognizes that quality audits of suppliers have a significant
and demonstrated value as a management tool for corrective action,
quality improvement, and overall assurance of component and service
quality, and does not seek to undermine their value. Therefore, based
on the concerns raised by the comments, FDA will not review supplier
audit reports during a routine FDA inspection for compliance with part
820, as noted in Sec. 820.180(c), ``Exceptions.'' The audit procedures,
the evaluation procedures, and documents other than the supplier audit
reports themselves that demonstrate conformance with Sec. 820.50 will
be subject to review by an FDA investigator.
109. One comment stated that it was unclear what is meant by the
requirement to specify ``quality requirements'' that must be met by
suppliers, contractors, and consultants, as stated in Sec. 820.50(a).
The term ``quality requirements'' means the quality control and
quality assurance procedures, standards, and other requirements
necessary to assure that the product or service is adequate for its
intended use. FDA does not believe the term is unclear.
110. Several comments on proposed Sec. 820.50(b), ``Purchasing
forms,'' suggested that the term ``forms'' be replaced by ``data.''
Other comments stated that use of the term would not allow electronic
data exchange. One comment stated that the use of an
[[Page 52626]]
exclusive form for purchasing is unnecessary and redundant, and that it
is unduly burdensome to require detailed documentation on those
commonly available items such as fasteners. The comment stated that it
is common practice to use prints or drawings to fulfill the purpose of
the form.
FDA agrees in part with the comments, but does not believe that
Sec. 820.50(b) prohibits the use of drawings or prints, assuming that
the documents contain data clearly describing the product or service
ordered, and that the specified requirements are met. However,
Sec. 820.50(b) has been rewritten and now requires manufacturers to
establish purchasing ``data.'' This provides manufacturers with the
flexibility to use both written and electronic means to establish
purchasing information.
111. One comment stated that the inclusion of an additional
provision mandating that suppliers notify manufacturers of any change
in their product or service places an undue burden on suppliers and
inhibits their ability to make minor adjustments within the parameters
of agreed upon specifications and quality requirements. Many other
comments stated that the requirement in Sec. 820.50(b) is feasible only
for components that are custom made for the manufacturer, and is
meaningless for off-the-shelf components purchased from distributors.
Other comments stated that the requirement is part of the original CGMP
regulation and experience has shown that suppliers are not willing to
supply device manufacturers with such information. A few other comments
stated that ``any'' should be deleted because the term is too broad and
could result in burdensome reporting of variables which are irrelevant
to the continued performance or specifications of the product or
service.
FDA agrees in part with the comments and has amended the
requirement to state that such agreement should be obtained ``where
possible.'' FDA still believes that this change information is very
important to the manufacturer, and that the manufacturer should obtain
information on changes to the product or service. Where a supplier
refuses to agree to provide such notification, depending on the product
or service being purchased, it may render him an unacceptable supplier.
However, where the product is in short supply and must be purchased,
the manufacturer will need to heighten control in other ways.
FDA has also deleted the term ``any'' to give manufacturers the
flexibility to define in the agreement the types of changes that would
require notification.
112. One comment stated that Sec. 820.50(b) should incorporate a
provision that would allow manufacturers to cite published standards in
purchasing forms as one suitable method for specifying purchased item
quality requirements.
FDA believes the addition is unnecessary, because the regulation
permits manufacturers to clearly describe or reference requirements. A
reference could be to a standard.
113. One comment stated that it is unclear whether the requirement
for a signature to approve purchasing documents pertains to approval of
the form used for purchasing or approval of the individual purchasing
transaction. The comment also stated that a signature approval by
transaction is not practical for firms using electronic document
transmittals.
FDA has rewritten the requirement to be more clear. The requirement
is for approval of purchasing data or information on the purchasing
document used to purchase a product or service. Thus, each manufacturer
must review and approve the purchasing data before release of the data.
Approval of each purchasing transaction is not required. FDA addressed
the use of electronic signatures in response to another comment, and
notes that FDA is in the process of developing an agency-wide policy on
the use of electronic signatures.
114. One comment stated that purchasing is carried out verbally in
many small firms, without the use of component-specific purchasing
forms, and that the regulation should be revised to allow such verbal
purchasing to continue.
FDA disagrees with the comment. About 15 percent of the recalls
each year are due to unacceptable purchased products. Many of these
products are unacceptable because the finished device manufacturer did
not properly describe the product. The requirements for purchased
products and services must be documented to ensure that the supplier,
contractor, and consultant provide a product or service which conforms
to specified requirements. This requirement, and the goal it seeks to
achieve, are applicable to both small and large companies.
115. One comment stated that the requirement that purchasing forms
spell out the specifications for manufacturing materials in all cases
is excessive, and that the need for specifications should be based on
the criticality of and risk associated with the use of the specific
manufacturing material.
FDA agrees that the specifications for many manufacturing materials
may be so well established that the trade name of the product may be
sufficient to describe the material needed. For other materials,
specific written specifications may be necessary to ensure that the
desired materials are received. The extent of the specification detail
necessary to ensure that the product or service purchased meets
requirements will be related to the nature of the product or service
purchased, taking into account the effect the product or service may
have on the safety or effectiveness of the finished device, among other
factors. The term ``specification'' has been replaced with the term
``specified requirements'' to better reflect the intent of the
requirement.
116. FDA has deleted the last two sentences of Sec. 820.50(b) in
the Working Draft and has replaced them with a reference to
Sec. 820.40, the general document control provision. This does not
change the requirement but simply eliminates any confusion about the
reviews and approvals being duplicative.
F. Identification and Traceability (Subpart F)
i. Identification (Sec. 820.60)
117. A few comments on proposed Secs. 820.60 Identification and
traceability and 820.65 Critical device, traceability stated that the
two sections should be rewritten to delete the distinction between
critical and noncritical devices. Some stated they should be consistent
with ISO.
FDA agrees in part with the comments and has rewritten Sec. 820.60
to be consistent with ISO 9001:1994 and broad enough to allow the
manufacturer the flexibility needed to identify product by whatever
means described by the required procedure. The term ``critical device''
has also been deleted, and traceability is addressed solely in
Sec. 820.65.
118. One comment stated that manufacturing materials should be
deleted from Sec. 820.60, as the requirements are excessive and not
economically justifiable with regard to such materials.
FDA disagrees with the comment. The purpose of Sec. 820.60 is to
ensure that all products, including manufacturing materials used in the
manufacture of a finished device, are properly identified. This
requirement is intended to help prevent inadvertent use or release of
unacceptable product into manufacturing. It is as important that the
proper manufacturing materials be
[[Page 52627]]
used as it is that the proper component be used.
119. A few comments thought that Sec. 820.60 Identification in the
Working Draft was redundant with Sec. 820.86 Acceptance status.
FDA disagrees with the comments. Section 820.60 only requires that
product be identified but says nothing about the acceptance status of
that product. Section 820.86 requires that the acceptance status be
identified so that inadvertent use of product does not occur. The
manufacturer may choose to set up a system by which the identification
required by Sec. 820.60 can also show the acceptance status required by
Sec. 820.86, but this is up to the manufacturer.
ii. Traceability (Sec. 820.65)
120. A few comments stated that proposed Sec. 820.65 Critical
devices, traceability implies that traceability requirements exist for
all devices. Several other written comments and oral testimony at the
August and September 1995 meetings stated that the wording of the
Working Draft was too broad, vague, and ambiguous, and in effect would
require that all devices be traced.
As noted above, FDA has deleted the critical device terminology.
Section 820.65 is now entitled Traceability and uses the definition
from the original CGMP of a critical device to provide the necessary
clarity and delineation for this requirement. Thus, traceability is
required for the critical devices listed in the Federal Register notice
of March 17, 1988 (53 FR 8854). However, FDA is using the definition of
critical device in the requirement of Sec. 820.65, rather than a
reference to the 1988 list of critical devices, because that list has
not been updated since 1988 and there are no plans to revise that list.
Therefore, it is imperative that manufacturers use the definition
within the requirement of Sec. 820.65 to determine if a particular
device needs to be traced; it may not be sufficient to rely solely on
the 1988 list. Manufacturers may find it advantageous to provide unit,
lot, or batch traceability for devices for which traceability is not a
requirement to facilitate control and limit the number of devices that
may need to be recalled due to defects or violations of the act.
It is important that the traceability requirements in part 820 are
not confused with the Medical Device Tracking regulation in part 821
(21 CFR part 821). The tracking regulation is intended to ensure that
tracked devices can be traced from the device manufacturing facility to
the person for whom the device is indicated, that is, the patient.
Effective tracking of devices from the manufacturing facility, through
the distribution network (including distributors, retailers, rental
firms and other commercial enterprises, device user facilities, and
licensed practitioners) and, ultimately, to any person for whom the
device is intended is necessary for the effectiveness of remedies
prescribed by the act, such as patient notification (section 518(a) of
the act (21 U.S.C. 360h(a)) or device recall (section 518(e).) In
contrast, the traceability provision requires that a device that meets
the definition of a ``critical device'' can be traced from the
manufacturing facility only to the ``initial consignee'' as discussed
in Sec. 820.160 Distribution.
121. Another comment on proposed Sec. 820.65 stated that critical
device component traceability could be interpreted to be required for
almost all electronic components and other components in a critical
device. The comment stated that the extent of component traceability
should be left to the manufacturer's discretion, since it is an
economic risk decision. Several comments stated that component
traceability should only be required ``where appropriate,'' that all
``critical device'' components do not require traceability to comply
with the act.
FDA disagrees that the traceability determination should be based
solely on economic risk. As noted in the preamble to the November 23,
1993, proposal (58 FR 61964), where traceability is important to
prevent the distribution of devices that could seriously injure the
user, traceability of components must be maintained so that potential
and actual problem components can be traced back to the supplier. The
revised requirement mandates traceability of components ``where
appropriate'' as recommended by the GMP Advisory Committee and limited
by the discussion in the scope, Sec. 820.1(a)(3). The critical
component definition in the original CGMP regulation may be used as
guidance. However, to carry out the requirement of the revised
provision, the manufacturer should perform risk analysis first on the
finished device, and subsequently on the components of such device, to
determine the need for traceability. FDA believes that the extent of
traceability for both active and inactive implantable devices should
include all components and materials used when such products could
cause the medical device not to satisfy its specified requirements.
ISO/CD 13485 also requires that the manufacturer's agents or
distributors maintain records of distribution of medical devices with
regard to traceability and that such records be available for
inspection. This requirement is found in Sec. 820.160 Distribution of
this regulation and is consistent with the requirements in Sec. 820.151
of the original CGMP.
While FDA understands that traceability entails additional cost,
the agency notes that, if a product recall is necessary, more devices
would be subject to recall if units, lots, or batches of specific
devices are not traceable, with associated higher recall costs to the
manufacturer.
G. Production and Process Controls (Subpart G)
i. Production and Process Controls (Sec. 820.70)
122. A few comments stated that the requirements in proposed
Sec. 820.70(a) General are similar to those in ISO 9001, but that ISO
9001 makes clear that the requirements apply only ``where applicable''
and where deviations from device specifications would ``directly affect
quality.'' The comments suggested that FDA similarly employ such
language to avoid being too restrictive and overly burdensome.
The requirements in Sec. 820.70(a) are intended to ensure that each
manufacturer produces devices that conform to their specifications.
Thus, where any deviations from specifications could occur during
manufacturing, the process control procedures must describe those
controls necessary to ensure conformance. Those controls listed in the
regulation may not always be relevant; similarly others may be
necessary. For example, where deviations from device specifications
could occur as a result of the absence of written production methods,
procedures, and workmanship criteria, such production controls are
required. Thus, FDA has retained the provision, but revised it slightly
to conform with the original CGMP requirements in Sec. 820.100(b)(1).
As noted, the process control requirements apply when any deviation
from specifications could occur. FDA believes that such deviations must
be controlled, and that linking the requirements to deviations that
directly affect quality is inappropriate and subjective, and that it
could lead to the manufacture of potentially dangerous devices through
the lack of control of processes known to directly affect a device's
specifications. Therefore, the provision has not been restricted in
this manner. FDA has, however, revised the requirements to state
``Where process controls are needed they shall include:'' to make it
clear that a manufacturer only has to comply with the requirements
[[Page 52628]]
stated in Sec. 820.70 (a)(1) through (a)(5) if the general criteria
described in Sec. 820.70(a) have been met.
123. One comment stated that the second sentence of proposed
Sec. 820.70(a) was too restrictive, in that some processes can be
accomplished by adequately trained personnel without the use of
procedures.
FDA disagrees with the comment because the establishment of
procedures is necessary to ensure consistency in manufacture. The
procedures may be tailored under the requirement to cover only those
controls necessary to ensure that a device meets its specifications.
FDA notes that the deletion of the word ``all'' does not alter the
requirements. The first sentence in the general requirement also serves
to tie the production and process controls to the design and
development phase where many of these controls are originally
established in order for the device to conform to its design
specifications.
In addition to these changes, FDA has added the requirement that
production processes be ``monitored'' because a manufacturer must
monitor a controlled process to ensure that the process remains in
control.
124. FDA deleted the requirement for process controls related to
``installation and servicing'' from proposed Sec. 820.70 (a)(1) and
(a)(2) in response to comments. Such control is adequately assured by
the requirements in Secs. 820.170 Installation and 820.200 Servicing.
FDA amended Sec. 820.70(a)(3) in response to some comments that were
confused about compliance with ``applied reference standards.'' The
term ``applied'' was replaced with ``specified'' to make it clear that
the manufacturer must comply with reference standards or codes which he
or she has specified in the DMR. FDA has also deleted ``and process
control procedures'' because that requirement is inherent in
Sec. 820.70(a), ``General.'' FDA amended Sec. 820.70(a)(5) by adding
``identified and approved'' in response to comments and to clarify that
the ``representative samples'' have to be identified and deemed
appropriate before they are used as reference standards.
125. One comment believed that there is no longer a requirement
that process changes be validated. Other comments on the Working Draft
Sec. 820.70(b) stated the requirement was still confusing with respect
to ``unless inspection and test fully verifies,'' and when the
``approval'' was to occur.
Revised Sec. 820.70(b), ``Production and process changes,''
addresses the requirement for production and process changes to be
``verified or where appropriate validated according to Sec. 820.75.''
This requirement for validation was moved from Sec. 820.40(c), in
revised form, to Sec. 820.70. Verification was added to give the
manufacturer the flexibility to verify changes that can be tested and
inspected because FDA believes that validation is not always necessary.
FDA has provided guidance on when changes should be validated in its
``Guideline on General Principles of Process Validation.'' The agency
notes that wherever changes may influence a validated process, the
process must be revalidated as described in Sec. 820.75. A few examples
of processes that must be validated include sterilization, molding, and
welding.
FDA has deleted the last part in Sec. 820.70(b) of the Working
Draft about approving changes and has replaced it with ``Changes shall
be approved in accordance with Sec. 820.40.'' This does not change the
requirement but simply refers back to Sec. 820.40 because this requires
the same review and approval. This was done to eliminate any confusion
about the reviews and approvals being duplicative.
126. The EU Commission and others stated that environmental
conditions only affect the quality of certain devices and that the
requirements should, therefore, be limited in their application. Other
comments stated that the requirements in proposed Sec. 820.70(b),
``Environmental control,'' were not consistent with the requirements in
the original CGMP, Sec. 820.46. Another comment requested that FDA
delete the reference to ``facilities'' inspection and limit the
requirement to review of the control system, as contained in the
original CGMP regulation.
FDA has amended the requirements now in Sec. 820.70(c) to apply
only where environmental conditions could ``reasonably be expected to
have an adverse effect on product quality.'' The requirements for
procedures to ensure control of conditions, periodic inspection of
control systems, and documentation and review of results are similar to
the original CGMP requirements. However, the specific list of
conditions to be considered for control, which was carried over from
the original CGMP regulation to the proposal, was deleted in response
to a comment from the GHTF that the list would be better suited for a
guidance document. FDA agrees that it is not necessary to give examples
of conditions that may need controlling in a regulation, and notes that
lighting, ventilation, temperature, humidity, air pressure, filtration,
airborne contamination, and static electricity are among many
conditions that should be considered for control.
FDA reworded the requirement to make it clear that the inspection
must be of the control system. FDA also added that the inspection of
the control system(s) shall include ``any necessary equipment,'' e.g.,
pumps, filters, measurement equipment, etc. The sufficiency of
facilities is covered in a new Sec. 820.70(f), ``Buildings,'' that
requires that buildings be of suitable design and contain sufficient
space to allow for the proper manufacture of devices. Section 820.70(f)
is worded similarly to the original CGMP regulation Sec. 820.40, and is
intended to achieve the same objectives as that section.
127. One comment stated that the last sentence of proposed
Sec. 820.70(b), ``Environmental control,'' should be deleted because it
is redundant with the audits required in Sec. 820.22(a). Another
comment said that environmental conditions are currently reviewed via
internal audit, which an FDA investigator cannot review.
FDA disagrees with the comments. The inspection and review of
environmental control systems are routine quality assurance functions
that are part of the production quality assurance program. The audits
required by Sec. 820.22(a) are audits of the quality system, conducted
to ensure the adequacy of and conformance with the quality system
requirements. The requirement to conduct a quality audit is in addition
to other provisions in the regulation which require that a manufacturer
review its specific controls to ensure the requirements are met. FDA
may review the activities and results of environmental control system
inspections.
128. The GHTF commented that the requirements of proposed
Sec. 820.70(c), ``Cleaning and sanitation,'' should be placed in
guidance.
After careful consideration, FDA agrees that a separate section on
cleaning and sanitation is unnecessary. The objective of proposed
Sec. 820.70(c) is adequately met through the requirement of
Sec. 820.70(e), ``Contamination control,'' and Sec. 820.70(a), the
general process control procedure requirement. Contamination control
must include establishing and maintaining adequate cleaning procedures
and schedules, if such control is necessary to meet manufacturing
process specifications. In addition, Sec. 820.25 Personnel requires
that employees have a thorough understanding of their job functions,
which would include a requirement that the appropriate employees
comprehend
[[Page 52629]]
the cleanliness and sanitation procedures.
129. The GHTF and others commented that the requirements of
proposed Sec. 820.70 (d)(1) through (d)(3) should be deleted and placed
in guidance because they are redundant with the first sentence in
proposed Sec. 820.70(d), ``Personnel health and cleanliness.''
FDA agrees with the comments and has deleted Sec. 820.70 (d)(1)
through (d)(3). FDA has also rewritten the section, now entitled
``Personnel,'' to require procedures to achieve the desired result,
rather than dictate the means to achieve the result. The section as
rewritten provides the manufacturer with more flexibility and is
consistent with ISO/CD 13485. Under this section, a manufacturer's
requirements must not permit unclean or inappropriately clothed
employees, or employees with medical conditions, to work with devices
where such conditions could reasonably be expected to have an adverse
effect on product quality. The procedures must also address acceptable
clothing, hygiene, and personal practices, if contact between personnel
and product or environment could reasonably be expected to have an
adverse effect on product quality.
FDA also added the requirement, from ISO/CD 13485, that personnel
who are working temporarily (such as maintenance and cleaning
personnel) under special environmental conditions (such as a clean
room) be appropriately trained or supervised by someone trained to work
in such an environment.
130. One comment stated that the requirements of Sec. 820.70(e),
``Contamination control,'' should be deleted and placed in guidance.
Another comment stated that the reference to manufacturing materials
should be deleted because it is redundant with Sec. 820.70(g),
``Equipment.''
FDA has rewritten the section to delete the specific references to
contaminants that probably gave rise to the suggestion that the section
would be more appropriate as guidance. The section now contains a broad
requirement for the establishment of procedures to prevent
contamination of equipment or product by any substance that could
reasonably be expected to have an adverse effect on product quality.
Again, this revision adds flexibility.
FDA disagrees with the comment that manufacturing materials should
be deleted from this section. Section 820.70(e) requires procedures to
ensure that manufacturing materials do not become contaminated. Section
820.70(g), in contrast, establishes requirements related solely to the
equipment used in the manufacturing process, and Sec. 820.70(h),
``Manufacturing material,'' addresses requirements for the removal or
limitation of manufacturing materials. Thus, Sec. 820.70 (g) and (h)
are distinct and are intended to achieve different objectives.
131. The only two comments received on proposed Sec. 820.70(f),
``Sewage and refuse disposal,'' recommended that it be deleted because
it was unnecessary and/or covered by other Federal regulations.
Section 820.70(f) has been deleted because the requirements are
adequately covered in the current requirements under Sec. 820.70(e),
``Contamination control,'' and Sec. 820.70(c), ``Environmental
control.'' Under these sections, sewage, trash, byproducts, chemical
effluvium, and other refuse that could affect a device's safety,
effectiveness, or fitness-for-use must be adequately controlled.
132. Two comments stated that the requirement related to equipment
in Sec. 820.70(g) should ensure that equipment meets ``specified
requirements,'' not be ``adequate for its intended use,'' because
intended use is determined during the design phase, and because it is
easier to assess whether equipment meets specified requirements.
From these comments, FDA can see that the requirement should be
revised because it may have been misinterpreted. The requirement is
reworded as suggested. Under the requirement, the equipment must be
appropriately designed to facilitate maintenance, adjustment, cleaning,
and use. It must also meet the requirements that are necessary to
ensure its proper functioning for the manufacture of the device.
133. A few comments stated that not all equipment requires
maintenance, and the requirement for a maintenance schedule in
Sec. 820.70(g)(1) should be revised to make that clear. The GHTF
recommended that the second sentence of proposed Sec. 820.70(g)(1),
which required that the maintenance schedule be posted or readily
available, be deleted and placed in guidance.
FDA agrees that not all equipment may require maintenance and notes
that the general requirement of Sec. 820.70(a) requires process control
procedures that describe only those controls which are necessary.
Therefore, FDA did not revise the requirement.
FDA has deleted the requirement that the maintenance schedule be
posted or readily available. Section 820.70(g), which directs a
manufacturer to ensure that equipment meets specified requirements,
requires that the manufacturer ensure that maintenance is carried out
on schedule to comply with the requirement. To satisfactorily meet this
requirement, FDA expects that the schedule will be posted on or near
the equipment to be maintained, or otherwise made readily available to
appropriate personnel. Deletion of the requirement, however, permits
the manufacturer added flexibility in complying with this section.
134. Several comments stated that Sec. 820.70(g)(2),
``Inspection,'' and (g)(3), ``Adjustment,'' should be deleted and
placed in guidance because the requirements are adequately covered in
Sec. 820.70(g)(1). Another comment stated that the requirement for
limitations or tolerances to be ``visibly posted on or near equipment''
should be deleted.
FDA believes that to adequately ensure that equipment continues to
meet its specifications, and to ensure that inherent limitations and
allowable tolerances are known, these requirements are imperative. FDA
notes inherent limitations and allowable tolerances must be visibly
posted on or near equipment or made readily available to personnel to
allow the manufacturer the flexibility to utilize any system to make
sure that the limitations or tolerances are readily available to the
personnel that need them. Both Sec. 820.70(g)(2) and (g)(3) are
requirements in the original CGMP regulation and the agency has found
them to be useful and necessary.
135. One comment stated that requiring the removal of manufacturing
material to be documented in proposed Sec. 820.70(g)(4),
``Manufacturing material,'' would result in impossible requirements,
such as the requirement to document how much cutting oil is lost during
a metal removing operation, such as drilling. Others commented that the
requirement needs to be amended to clarify that only manufacturing
materials that have an adverse effect or that are unwanted need to be
removed or limited.
FDA disagrees with the first comment because Sec. 820.70(g)(4) (now
Sec. 820.70(h)) only requires that the fact that manufacturing material
was removed or reduced be documented, not how much was removed or how
much was lost due to processing. This requirement is carried over from
the original CGMP regulation, Sec. 820.60(d). FDA has amended the
section, however, to clarify that this requirement is necessary ``Where
a manufacturing material could reasonably be expected to have an
adverse effect on product quality.'' FDA
[[Page 52630]]
purposefully qualifies the general requirement by that which adversely
affects ``product quality'' (product as defined in Sec. 820.3(r)) and
limits the requirement for removal or reduction to ``an amount that
does not adversely affect the device's quality.''
136. One comment on Sec. 820.70(h), ``Automated processes,'' (now
Sec. 820.70(i)), stated that the section should be revised to reflect
that software used in such systems must be validated for ``its intended
use,'' not simply validated. Another comment stated that most companies
buy software currently available on the market and do not make changes
to the software. It was recommended that Sec. 820.70(h) allow for use
of outside personnel for validation runs and not necessarily require
the development of a software validation procedure. One comment
suggested that the section should allow verification rather than
validation of off-the-shelf software. Several comments on ``automated
processes'' stated that the term ``data processing systems'' was
unclear and its inclusion rendered the requirement too broad. Others
asked for clarification of ``automated data processing systems.''
FDA has modified the requirement to mandate validation for the
intended use of the software. In addition, the requirement that the
software be validated by individuals designated by the manufacturer has
also been deleted to make clear that validation may be performed by
those other than the manufacturer. However, whether the manufacturer
designates its own personnel or relies on outside assistance to
validate software, there must be an established procedure to ensure
validation is carried out properly.
FDA has maintained the requirement for validation because the
agency believes that it is necessary that software be validated to the
extent possible to adequately ensure performance. Where source code and
design specifications cannot be obtained, ``black box testing'' must be
performed to confirm that the software meets the user's needs and its
intended uses.
FDA emphasizes that manufacturers are responsible for the adequacy
of the software used in their devices, and activities used to produce
devices. When manufacturers purchase ``off-the- shelf'' software, they
must ensure that it will perform as intended in its chosen application.
FDA has amended the requirement to state ``When computers or
automated data processing systems are used as part of production or the
quality system,'' for clarification. Software used in production or the
quality system, whether it be in the designing, manufacturing,
distributing, or tracing, must be validated.
ii. Inspection, Measuring, and Test Equipment (Sec. 820.72)
137. A few comments stated that it is unclear what is meant by the
requirement in proposed Sec. 820.84 Inspection, measuring, and test
equipment that equipment be capable of producing ``valid results.'' The
comments stated that such equipment may be ``suitable for its intended
purpose'' and still not always ``produce valid results.''
FDA believes that the term ``valid results'' is commonly understood
and notes that it has been in the original CGMP regulation under
Sec. 820.61 for 18 years. The requirement is for the equipment to work
properly, thereby providing ``valid results.''
FDA renumbered Sec. 820.84 as Sec. 820.72 in response to comments
that stated these requirements were more appropriate under subpart G
Production and Process Controls. FDA revised the requirement in new
Sec. 820.72(a), ``Control of inspection, measuring, and test
equipment,'' to make clear that the procedures must also ensure that
the equipment is maintained and moved the requirement that the
procedure include provisions for handling, preservation and storage of
equipment from Sec. 820.84(d) in the Working Draft to Sec. 820.72(a).
FDA deleted the term ``test software'' that was in Sec. 820.84(e)
because FDA believes that ``test software'' is now covered under
``electronic inspection and test equipment'' in Sec. 820.72(a).
138. A few comments stated that the last sentence in proposed
Sec. 820.84(a), ``Calibration,'' is unnecessary because the requirement
for trained personnel is redundant with Sec. 820.25(a) Personnel. A few
comments stated that FDA should identify what must be remedied in
proposed Sec. 820.84(a).
FDA agrees that the requirement for trained personnel is redundant
and has deleted this sentence from Sec. 820.72(b), ``Calibration.'' FDA
has also added to this section the requirement that the calibration
procedure include provisions for remedial action to ``reestablish the
limits and to evaluate whether there was any adverse effect on the
device's quality'' to clarify this remedial action requirement and its
relationship to the requirements in Sec. 820.100 Corrective and
preventive action.
139. Several comments stated that Sec. 820.84(b), ``Calibration
standards,'' should allow for the use of international standards.
FDA agrees and has rewritten the section, now Sec. 820.72(b)(1),
``Calibration standards,'' to allow the use of international standards.
The standards used must be generally accepted by qualified experts as
the prevailing standards.
140. FDA has deleted the requirement in proposed Sec. 820.84(c),
now Sec. 820.72(b)(2), ``Calibration records,'' that calibration
records be ``maintained by individuals designated by the manufacturer''
because, on further reflection, the agency believes such a requirement
is unnecessary. As long as the required procedures and records are
maintained and displayed or readily available as required, the
objective of the section, ensuring that calibration is performed and
acceptable, will be met. FDA did add ``equipment identification'' to
the list of items that had to be documented in response to a comment
that requested clarification in this regard, so that equipment is
clearly identified in the calibration records even if the records are
not displayed on or near the particular piece of equipment.
141. Two comments suggested deleting proposed Sec. 820.84(d)
because they believed it was unnecessary to establish procedures to
maintain equipment, because most manufacturers simply store equipment
in protective covers.
As already noted, FDA has moved the requirement for establishing
maintenance procedures into the general requirement in Sec. 820.72. FDA
has retained the requirement because some equipment requires special
handling, preservation, and storage. For example, the temperature and
humidity of a room may affect the equipment and procedures would need
to be established taking those factors into account.
142. Several comments stated that proposed Sec. 820.84(e),
``Facilities,'' should be deleted because it is redundant with the
requirements under Sec. 820.70(g) and the general requirements of
proposed Sec. 820.84(a).
FDA agrees that revised Sec. 820.84(a), which is now
Sec. 820.72(a), would require procedures to ensure that equipment is
protected from adjustments that could invalidate the calibration, in
that the section requires procedures to ensure that equipment is
properly maintained. The procedures that require equipment to be
routinely calibrated, inspected, and checked, will also ensure that
improperly calibrated equipment is not used. Therefore, FDA has deleted
proposed Sec. 820.84(e).
[[Page 52631]]
iii. Process Validation (Sec. 820.75)
143. A few comments on proposed Sec. 820.75 Special processes
stated that the meaning of the term ``special processes'' was unclear.
Other comments stated that FDA should provide examples of processes
that would be considered ``special processes.'' Several comments stated
the term ``fully verified'' was unclear and should be deleted.
In response to the comments, the term ``special processes'' has
been dropped from the regulation and the term ``process validation'' is
defined in Sec. 820.3(z)(1). The section now requires that when a
process ``cannot be fully verified by subsequent inspection and test,
the process shall be validated with a high degree of assurance. * * *''
Examples of such processes include sterilization, aseptic processing,
injection molding, and welding, among others. The validation method
must ensure that predetermined specifications are consistently met. The
new Sec. 820.75, entitled ``Process validation,'' is consistent with
ISO 9001:1994, section 4.9, including the terminology ``fully
verified.'' FDA does not believe this terminology is unclear since it
has been used in ISO 9001:1987 and 1994 and explained in several
guidance documents.
FDA amended this section by removing the requirement for the
signature of the individual(s) performing the process and placing the
signature requirement on the approval of the validation where FDA
believes it is more important and appropriate. FDA also added that
``where appropriate, the major equipment validated'' must be
documented. Depending on the process that is validated, it may be
necessary to document the person performing the process or the
equipment or both in order to have adequate controls on the process.
144. Several comments were received on proposed Sec. 820.75(a)(1)
through (a)(4) that stated that the requirements were redundant with
other parts of the regulation and should be modified or deleted.
FDA disagrees with the comments and believes that, due to the
importance of process validation and correct performance of the
validated process, the requirements are necessary. The requirements
have been rearranged in the revised section.
145. Comments on the first sentence of proposed Sec. 820.75(b)
stated that it was unclear and unrealistic. Other comments stated that
the requirement for continuous monitoring is not practical or
necessary.
In response to the comments, FDA has revised the requirements.
Section 820.75(b) applies to the performance of a process after the
process has been validated. In contrast, Sec. 820.75(a) relates to the
initial validation of the process. FDA deleted the term ``continuous''
because the agency concurs that monitoring can be accomplished at a
determined interval and frequency depending on the type of validated
process being monitored and controlled. FDA notes that the interval and
frequency should be periodically evaluated for adequacy, especially
during any evaluation or revalidation that occurs in accordance with
the requirements in new Sec. 820.75(c).
New Sec. 820.75(b)(1), which was proposed Sec. 820.75(c) of the
Working Draft, requires that validated processes be performed by a
qualified individual(s). FDA notes that Sec. 820.75(b)(1) is similar to
the requirements under Sec. 820.25 Personnel but emphasizes that
validated processes must not only be performed by personnel with the
necessary education, background, training, and experience for their
general jobs but must be performed by personnel qualified for those
particular functions. Revised Sec. 820.75(b)(2), which was proposed
Sec. 820.75(d) of the Working Draft, contains the amended documentation
requirements for validated processes, to include the monitoring and
control methods and data. FDA notes that it is always ``appropriate''
to document the equipment used in the process where the manufacturer
uses different equipment on different manufacturing lines. To
investigate a problem with the device, the manufacturer will need to
know which equipment was used, since the problem could be with the
equipment itself. The same holds true for the individual(s) performing
the process.
Section 820.75(c) contains requirements on process revalidation in
response to several comments and concerns on when revalidation
activities were necessary. FDA believes that the new arrangement of
Sec. 820.75 should clarify the requirement.
H. Acceptance Activities (Subpart H)
i. Receiving, In-Process, and Finished Device Acceptance (Sec. 820.80)
146. One comment stated that the emphasis on testing and inspection
in proposed Sec. 820.80 completely ignores the quality goals, the
benefit of requiring purchasing controls, and statements made in the
preamble of the proposal reflecting FDA's negative opinion about
manufacturers relying solely on testing and inspection. A few comments
on the Working Draft stated that ``acceptance activities'' should be
defined as inspections, tests, or other verification activities so that
the regulation does not require all of these activities but gives the
manufacturer the flexibility to choose the appropriate method.
FDA agrees with the comments and has replaced the term ``inspection
and test'' with ``acceptance activities'' in Sec. 820.80. Further, FDA
now defines ``acceptance activities'' to include inspections, test, or
other verification activities, such as supplier audits.
147. One comment stated that recordkeeping is a significant cost
factor in the operation of a total quality system, and that the revised
CGMP regulation should not add cost through duplication of
documentation. The comment said recording all quantitative data is
inappropriate and of little value.
FDA agrees that unnecessary duplication of documentation should be
avoided. FDA believes that the quality system regulation requires the
minimum documentation necessary to ensure that safe and effective
devices are designed and produced. FDA similarly believes that
maintaining records of results of acceptance activities is imperative
to ensure that nonconforming product is not inadvertently used or
distributed. FDA has, however, deleted from Sec. 820.80(a) the
requirement for recording the results of inspections and testing
because Sec. 820.80(e) requires that the results of acceptance
activities be recorded. The requirement in Sec. 820.80(a) was therefore
unnecessary. Further, the regulation does not specify quantitative data
but simply requires that the results be recorded. FDA believes that it
is essential for the manufacturer to maintain records which provide
evidence that the product has gone through the defined acceptance
activities. These records must clearly show whether the product has
passed or failed the acceptance activities according to the defined
acceptance criteria. Where product fails to pass acceptance activities,
the procedures for control of nonconforming product must be
implemented, to include investigations where defined. If the acceptance
records are not clear about how the product failed, then the
manufacturer may end up duplicating the acceptance activities in order
to perform appropriate investigations.
148. Several comments stated that proposed Sec. 820.80(b),
``Receiving inspection and testing,'' did not allow for urgent use of
incoming items. The comments said that urgent use should be permitted
if forward traceability is maintained so that recall and
[[Page 52632]]
replacement is possible if the material is subsequently found to be
nonconforming. One comment stated that the requirements in proposed
Sec. 820.80(b) were too specific and did not allow flexibility.
FDA agrees in part with the comments. FDA has permitted
manufacturers to use incoming items that had not yet been proven
acceptable for use, provided that the manufacturer maintained control
of the unapproved items and could retrieve the product that contained
the unapproved items before distribution. Therefore, the requirement
that product ``shall not be used or processed until * * * verified''
has been deleted from Sec. 820.80(b), now entitled ``Receiving
acceptance activities.'' However, FDA emphasizes that while the product
can be used in production prior to verification, it cannot be
distributed prior to verification. FDA does not permit the distribution
of unapproved product through an urgent use provision, because all
finished devices must comply with Sec. 820.80(d), ``Final acceptance
activities,'' before they are released for distribution.
In addition to the changes noted above, FDA has deleted the
requirement that ``individual(s) designated by the manufacturer shall
accept or reject incoming'' product. FDA does not believe this
requirement is necessary in Sec. 820.80(b) because Sec. 820.80(e)
requires that the identification of the individual(s) conducting the
acceptance activities be recorded.
149. Several comments stated that an absolute requirement under
proposed Sec. 820.80(c), ``In-process inspection and testing,'' for in-
process testing was inconsistent with the preamble, which stated that
an appropriate mix of controls should be established. Other comments
stated that in-process inspection and testing is unnecessary if the
process is validated and the devices are subject to final inspection. A
few comments on the Working Draft stated that the term ``held'' was too
restrictive and was not consistent with the requirements and the
preamble discussion for Sec. 820.80(b).
FDA agrees with the comments in part, but believes that Sec. 820.80
as now written, with the inclusion of ``where appropriate,'' does not
mandate in-process inspection and testing. FDA acknowledges that in-
process acceptance activities may not be necessary or possible for
every device, for example, medical socks. Further, the requirement
states that in-process product must be controlled until the required
inspection and test, or other verification activities, have been
performed. This will permit manufacturers to use, under defined
conditions and procedures, product that has not completed the
acceptance activities described in Sec. 820.80(b) and (c). This does
not means that manufacturers can ignore the requirements in
Sec. 820.80(b) and (c) because these requirements must be completed in
order to comply with Sec. 820.80(d), which must be satisfied before
devices are released for distribution.
150. FDA received a similar comment on proposed Sec. 820.80(d),
``Final inspection and test,'' which said that the provision requires
finished device inspection for all devices, without defining what
inspection is expected. The comment suggested that Sec. 820.80(d) could
be interpreted to require actual product inspection, which has been
shown to be ineffective as a means of controlling product quality. One
comment stated that signatures should not be the only approved method
for identification of the individual(s) responsible for release. The
comment stated that use of inspection stamps and initials should be
allowed.
FDA has rewritten Sec. 820.80(d) to require that manufacturers
establish and maintain procedures for finished device acceptance to
ensure that each production run, lot, or batch of finished devices
meets specified requirements. Manufacturers have the flexibility to
choose a combination of methods, including finished device inspection
and test, provided such methods will accomplish the required result.
FDA believes that it is important for the person responsible for
release to have personally documented and dated that release. This can
be accomplished through use of an inspection stamp, if the stamp is
controlled as discussed above under Sec. 820.40 Document controls.
Therefore, FDA has retained the requirement for a signature.
151. Several comments on proposed Sec. 820.80(e), ``Inspection and
test records,'' stated that manufacturers should not be required to
record the use of general equipment in inspection and test records,
because this requirement would be burdensome to large manufacturers who
use many common pieces of equipment. A few comments stated that the
record requirements under Sec. 820.80(e) are overly prescriptive and go
well beyond ISO 9001's comparable requirements. The comments stated
that recordkeeping should be specified by the manufacturer in the
spirit of ISO 9001, and should include only the minimum records
necessary to show that finished device inspections are performed in
accordance with established procedures.
FDA agrees that it may not be necessary to document every piece of
equipment used in acceptance activities. The requirement, renamed
``Acceptance records,'' now provides that equipment used shall be
documented ``where appropriate.'' For some critical operations and
testing, identification of the equipment used will be imperative for
proper investigations into nonconforming product.
The requirements, as revised, are similar to those in ISO
9001:1994. As discussed above, certain information must be captured on
acceptance records for the records to be useful in evaluating
nonconformance. Through many years of experience, FDA has determined
what it believes to be a minimum requirement for these records. Section
820.80(e) reflects that determination.
ii. Acceptance Status (Sec. 820.86)
152. Several comments on proposed Sec. 820.86, ``Inspection and
test status,'' stated that the section was not flexible enough to allow
identification of the inspection and test status of product by various
means, because the requirement was for the status to be ``visible.''
One comment questioned why ``component acceptance'' was addressed
separately.
FDA agrees that the inspection and test status may be identified by
any method that will achieve the result, which might include acceptable
computerized identification, markings, etc. The section has been
rewritten to reflect this intent, has been renamed ``Acceptance
status,'' and is now consistent with ISO 9001:1994. FDA also agrees
that ``component acceptance'' is covered by ``manufacturing'' and has
deleted the term.
153. FDA has deleted proposed Sec. 820.86(b) which required that
records identify those responsible for release of the product, because
the agency believes that the records required by Sec. 820.80(e) will
identify those responsible for release of product.
I. Nonconforming Product (Subpart I)
154. FDA has rewritten Sec. 820.90 Nonconforming product to utilize
the term ``product'' throughout, as defined in Sec. 820.3(r), for both
shorthand purposes and consistency with ISO 9001:1994.
155. One comment suggested deleting the term ``inadvertently'' and
adding the word ``distributed'' before ``installed'' in Sec. 820.90(a).
Several written comments and persons who testified at the August and
September 1995 meetings stated that Sec. 820.90(a) should be written so
[[Page 52633]]
that it is not interpreted to require investigations for every
nonconformance. A few comments stated that the term ``provide for'' was
too broad and unclear. Other comments stated that the requirement to
``ensure'' nonconforming product was ``not used or distributed'' was
inconsistent with the provisions in Sec. 820.90(b) which allowed for
concessions under certain circumstances. One comment stated that the
requirement that persons responsible for nonconforming product be
``notified'' should be deleted because it is overly burdensome and not
needed in all cases.
FDA has reworded the general requirement for procedures to control
nonconforming product and has deleted the term ``inadvertently.'' FDA
has also added the requirement that the procedures provide for the
``evaluation'' of nonconforming product because evaluation is key to
protecting against recurring nonconformance. The addition is consistent
with ISO 9001:1994.
FDA has further revised Sec. 820.90 in response to the comments on
the Working Draft. First, the manufacturer must establish procedures to
``control'' nonconforming product. Second, the procedures shall
``address the identification, documentation, evaluation, segregation,
and disposition of nonconforming product,'' which gives the
manufacturers the flexibility to define how they are going to
``control'' products that are nonconforming. Third, the evaluation
process addressed in the procedure ``shall include a determination of
the need for an investigation.'' Therefore, the procedures will need to
set forth the manufacturer's SOP on when investigations will take place
and provisions for trending and/or monitoring the situation in the
future. Fourth, FDA added ``The evaluation and any investigation shall
be documented,'' which would include the explanations for not
performing investigations and how nonconformances will be trended and/
or monitored. Further, the phrase ``is not used or distributed'' has
been deleted to be consistent with Sec. 820.90(b).
FDA disagrees that the notification requirement should be deleted.
Where some person or organization is responsible for nonconformances,
they must be notified to ensure that future nonconformances are
prevented. This requirement is also in ISO 9001:1994, section 4.13.1.
156. FDA has rewritten Sec. 820.90(b)(1), ``Nonconformity review
and disposition,'' to make clear that the section requires procedures
that define the responsibility for review and authority for disposition
of nonconforming product and that set forth the review and disposition
process. FDA believes that proper disposition of nonconforming product
is essential for ensuring the safety and effectiveness of devices.
Manufacturers have made determinations that nonconforming product may
be used which have resulted in defective devices being distributed.
Thus, although it may be appropriate at times to use nonconforming
products, the disposition process must be adequately controlled.
The revision requires that disposition and justification for
concessions be documented. FDA believes that the justification should
be based on scientific evidence, which a manufacturer should be
prepared to provide upon request. Concessions should be closely
monitored and not become accepted practice. This section is consistent
with ISO 9001:1994, section 4.13.2.
Several comments on the Working Draft stated that the term
``concession'' should be deleted because it is confusing. FDA has
rewritten the sentence to ensure the meaning of this requirement is
clear. The sentence now reads, ``Documentation shall include the
justification for the use of nonconforming product and the signature of
the individual(s) authorizing the use.''
157. Several comments were received on proposed Sec. 820.90(b)(2).
One comment stated that the requirement should allow for other types of
disposition besides reprocessing. One comment suggested replacing the
term ``reinspection'' with ``evaluation,'' to allow for greater
flexibility in verification methods. Many comments suggested that the
requirement for identification of reprocessed product should be deleted
because they believed it would cause the consumer to forego purchasing
the product. Several comments requested that the term ``rework'' be
used instead of ``reprocessing'' to harmonize terminology with ISO
standards.
FDA agrees in part with the comments. FDA, as noted in the
definition section, has substituted the term ``rework'' and the ISO
8402:1994 definition for the term ``reprocessing'' in response to the
comments. FDA believes that the revised Sec. 820.90(b)(1) clearly
allows for other methods of disposition besides rework. Section
820.90(b)(2), which governs rework when it is chosen as a method of
disposition, has been revised as requested by replacing the term
``reinspection'' with ``reevaluation.'' The change will allow
manufacturers the flexibility to inspect or use other verification
activities.
FDA has also deleted the requirement for identification of reworked
product from this section because FDA believes that it is adequately
covered in Secs. 820.60 Identification and 820.86 Acceptance status.
Other minor changes made to the section include requiring that a
determination of any adverse effect of the rework upon the product be
made, whether there is ``repeated'' rework or not. FDA's intent is that
such a determination be made with any rework, given the potential
harmful effect rework could have on the product. The change harmonizes
Sec. 820.90 with ISO/CD 13485. In addition, the sentence requiring a
``complete reinspection'' for reworked product was deleted because the
section already requires retesting and reevaluation of reworked
product. FDA has also substituted ``current'' for ``original or
subsequently modified'' approved specifications for clarity. The
requirements as written are consistent with the original CGMP
requirements in Secs. 820.115 and 820.116.
J. Corrective and Preventive Action (Subpart J)
158. A few comments suggested revising proposed Sec. 820.100
Corrective and preventive action to require procedures for implementing
corrective and preventive action, consistent with ISO 9001. One comment
stated that the procedures should provide for an initial halt of
distribution of suspect products or tight control and action concerning
products already distributed before taking the long term action listed
in this section.
FDA agrees that it is essential that the manufacturer establish
procedures for implementing corrective and preventive action and has
revised Sec. 820.100(a) accordingly. The procedures must include
provisions for the remaining requirements in the section. These
procedures must provide for control and action to be taken on devices
distributed, and those not yet distributed, that are suspected of
having potential nonconformities.
159. Other comments stated that the degree of remedial action
should be commensurate with the risk associated with a product failure.
FDA agrees that the degree of corrective and preventive action
taken to eliminate or minimize actual or potential nonconformities must
be appropriate to the magnitude of the problem and commensurate with
the risks encountered. FDA cannot dictate in a regulation the degree of
action that
[[Page 52634]]
should be taken because each circumstance will be different, but FDA
does expect the manufacturer to develop procedures for assessing the
risk, the actions that need to be taken for different levels of risk,
and how to correct or prevent the problem from recurring, depending on
that risk assessment.
FDA emphasizes that any death, even if the manufacturer attributes
it to user error, will be considered relevant by FDA and will have a
high risk potentially associated with it. User error is still
considered to be a nonconformity because human factors and other
similar tools should have been considered during the design phase of
the device. FDA acknowledges that a manufacturer cannot possibly
foresee every single potential misuse during the design of a device,
but when the manufacturer becomes aware of misuse, the corrective and
preventive action requirements should be implemented to determine if
redesign of the device or labeling changes may be necessary.
160. Several comments on proposed Sec. 820.100(a)(1) stated that
requiring a manufacturer to analyze ``all'' processes, work operations,
and other factors listed, is excessive and unrealistic. Some comments
stated that there should not be a requirement to conduct an analysis
for ``potential causes'' of nonconformances. A few comments stated that
including ``quality audits'' in the list was inconsistent with the FDA
policy of not reviewing internal audits. A few comments stated that the
requirement that the analysis include ``trend analysis'' should be
modified because it places unnecessary emphasis on only one statistical
method or tool. Other comments stated that statistical tools are not
always necessary and that the requirement should be modified.
FDA agrees in part with the comments. It was not FDA's intent to
require that processes unrelated to an existing nonconformity be
analyzed. Instead, Sec. 820.100(a)(1) requires an analysis of those
items listed that could be related to the problem. To prevent
confusion, the word ``all'' has been deleted. The requirement is
similar to that of ISO 9001:1994, section 4.14.3(a).
The inclusion of ``quality audits'' as a valuable feedback
mechanism for the manufacturer does not conflict with FDA's policy of
not reviewing internal quality audits. Internal audits are valuable and
necessary tools for the manufacturer to evaluate the quality system.
The audit reports should be used to analyze the entire quality system
and provide feedback into the system to close the feedback loop, so
that corrective or preventive actions can be taken where necessary. FDA
will review the corrective and preventive action procedures and
activities performed in conformance with those procedures without
reviewing the internal audit reports. FDA wants to make it clear that
corrective and preventive actions, to include the documentation of
these activities, which result from internal audits and management
reviews are not covered under Sec. 820.180(c).
FDA has further revised the requirement to delete the reference to
trend analysis in response to the comments. The provision now requires
that ``appropriate statistical methodology'' be employed where
necessary to detect recurring quality problems. This revision is made
because there may be other statistical tools available beyond ``trend
analysis.'' FDA emphasizes that the appropriate statistical tools must
be employed when it is necessary to utilize statistical methodology.
FDA has seen far too often the misuse of statistics by manufacturers in
an effort to minimize instead of address the problem. Such misuse of
statistics would be a violation of this section.
FDA has retained the requirement for analysis to identify
``potential causes of nonconforming product,'' however, because FDA
believes this is an important aspect of preventive action. FDA notes
that ISO 9001:1994, section 4.14.1, specifically acknowledges that
corrective and preventive actions are associated with actual and
potential nonconformities.
161. Several comments stated that proposed Sec. 820.100(a)(2) was
redundant with requirements in Sec. 820.198 Complaints.
FDA agrees in part with the comments and has written the section to
require investigation of the cause of nonconformities relating to
process, product, and the quality system, consistent with ISO
9001:1994, section 4.14.2(b). The requirement in this section is
broader than the requirement for investigations under Sec. 820.198,
because it requires that nonconforming product discovered before or
after distribution be investigated to the degree commensurate with the
significance and risk of the nonconformity. At times a very indepth
investigation will be necessary, while at other times a simple
investigation, followed by trend analysis or other appropriate tools
will be acceptable. In addition, in contrast to Sec. 820.198, the
requirement in this section applies to process and quality system
nonconformities, as well as product nonconformities. For example, if a
molding process with its known capabilities has a normal 5 percent
rejection rate and that rate rises to 10 percent, an investigation into
the nonconformance of the process must be performed.
162. One comment stated that proposed Sec. 820.100(a)(3) should not
require identification of action necessary to correct ``other quality
problems.'' Another stated that the section should be harmonized with
ISO. One comment thought that the requirement should be to identify
action to correct problems identified by ``trend analysis.''
FDA agrees that harmonization is important and has harmonized the
terminology (and intent) of the section with ISO 9001:1994, sections
4.14.2(c) and 4.14.3(b). However, FDA disagrees that the section should
not require identification of action necessary to correct ``other
quality problems'' because the objective of Sec. 820.100 is to correct
and prevent poor practices, not simply bad product. Correction and
prevention of unacceptable quality system practices should result in
fewer nonconformities related to product. Therefore, this section
addresses problems within the quality system itself. For example, it
should identify and correct improper personnel training, the failure to
follow procedures, and inadequate procedures, among other things.
FDA also disagrees with the suggestion to link the requirement in
Sec. 820.100(a)(3) to trend analysis and has deleted the reference to
trend analysis in Sec. 820.100(a)(1) to give the manufacturer the
flexibility to use whatever method of analysis is appropriate.
163. FDA has revised Sec. 820.100(a)(4) to reflect that preventive,
as well as corrective, action must be verified or validated. The
section is now consistent with ISO 9001:1994, sections 4.14.2(d) and
4.14.3(c). Two comments stated that the definitions of validation and
verification cause confusion here, but FDA believes that these concerns
should be resolved with the amended definitions under Sec. 820.3 (z)
and (aa).
164. FDA has also revised Sec. 820.100(a)(5) in the same manner, to
relate the requirements to preventive action. This section is
consistent with ISO 9001:1994, section 4.14.1, third paragraph.
165. One comment suggested that proposed Sec. 820.100(a)(6) be
revised to reflect that minor quality problems may not need to be
disseminated to those directly responsible for ensuring quality and to
be reviewed by management.
[[Page 52635]]
FDA agrees in part with this comment. The revised Sec. 820.100
(a)(6) and (a)(7) require that procedures ensure that information is
disseminated to those directly responsible for assuring quality or the
prevention of such problems, and provide for submitting relevant
information on identified quality problems, as well as corrective and
preventive actions, for management review. This revision should address
the concern raised by the comment because only certain information need
be directed to management. The manufacturer's procedures should clearly
define the criteria to be followed to determine what information will
be considered ``relevant'' to the action taken and why. FDA emphasizes
that it is always management's responsibility to ensure that all
nonconformity issues are handled appropriately. This section is now
consistent with ISO 9001:1994, section 4.14.3(d).
166. Two comments stated that the records required under
Sec. 820.100(b) should be treated as part of the internal audit.
FDA disagrees with these comments because this information is
directly relevant to the safety and effectiveness of finished medical
devices. FDA has the authority to review such records and the
obligation to do so to protect the public health. Comparable
information and documentation is reviewed by the FDA under the
requirements of the original CGMP, Secs. 820.20 (a)(3) and (a)(4) and
820.162. Manufacturers will be required to make this information
readily available to an FDA investigator, so that the investigator may
properly assess the manufacturer's compliance with these quality system
requirements.
K. Labeling and Packaging Control (Subpart K)
i. Device Labeling (Sec. 820.120)
167. Several comments on proposed Sec. 820.162 Device labeling
stated that the section should be deleted and placed in guidance
because it is unnecessary and redundant with requirements under
Secs. 820.80 and 820.86. A few comments stated that the section should
be changed to be the same as that in the original CGMP regulation,
under Secs. 820.120 and 820.121. Another comment stated that labeling
and packaging requirements should be in subpart K of part 820 and
handling, storage, distribution, and installation requirements should
be in subpart L of part 820 because labeling and packaging functionally
occur before distribution and installation.
FDA believes that the section, as written, is consistent with the
requirements in the original CGMP. Section 820.120 relates specifically
to labeling and its requirements are in addition to those in both
Secs. 820.80 and 820.86. Further, FDA believes that the degree of
detail in this section is necessary because these same requirements
have been in place for 18 years, yet numerous recalls every year are
the result of labeling errors or mixups. FDA therefore believes that
more, not less, control is necessary.
FDA has reordered the subparts but notes that the handling and
storage requirements apply throughout the production process.
168. One comment stated that ``to maintain labeling integrity and
to prevent labeling mixups'' should be deleted from the general
requirement because the requirements are detailed in the following
sections. Other comments stated that all labels need not be affixed to
the device and others stated that ``legible and affixed'' may not be
appropriate for all implantable devices.
FDA agrees with the comments and has revised the requirements
accordingly.
169. A few comments stated that what is now Sec. 820.120(b),
``Labeling inspections,'' should allow automated readers to be used in
place of a ``designated individual(s)'' to examine the labeling.
FDA disagrees with the comments because several recalls on labeling
have been attributed to automated readers not catching errors. The
requirement does not preclude manufacturers from using automated
readers where that process is followed by human oversight. A
``designated individual'' must examine, at a minimum, a representative
sampling of all labels that have been checked by the automated readers.
Further, automated readers are often programmed with only the base
label and do not check specifics, such as control numbers and
expiration dates, among other things, that are distinct for each label.
The regulation requires that labeling be inspected for these items
prior to release.
170. FDA has amended Sec. 820.120(b) to add ``any'' to additional
processing instructions in response to a comment for clarity. FDA has
amended Sec. 820.120(d) to include ``The label and labeling used for
each production unit, lot, or batch shall be documented in the DHR'' in
response to comments questioning whether the labeling used should be
recorded in the DMR or the DHR. FDA also amended Sec. 820.120(e) by
adding ``or shall accompany the device through distribution'' and
deleting ``itself or its label'' for clarity.
171. A few comments on proposed Sec. 820.165 Critical devices,
labeling stated that this section should be deleted to eliminate any
distinction between critical and noncritical devices.
FDA agrees in part and has deleted Sec. 820.165, but has added the
requirement on control numbers to Sec. 820.120(e).
ii. Device Packaging (Sec. 820.130)
172. Two comments on proposed Sec. 820.160 Device packaging stated
that the section should be changed to allow manufacturers to use third
parties, if desired, for packaging. Another comment stated that it is
very difficult if not impossible to protect from intentional damage,
such as tampering.
FDA agrees with the comments and has changed the requirement, now
in Sec. 820.130, accordingly. FDA believes, however, that any
intentional tampering would not be covered because the requirement
states ``during customary conditions.''
L. Handling, Storage, Distribution, and Installation (Subpart L)
i. Handling (Sec. 820.140)
173. One comment on proposed Sec. 820.120 Handling suggested that
the procedures be ``designed to prevent,'' rather than be established
to ``ensure that,'' problems delineated in the section do not occur.
The comment stated that the word ``prevent'' would add clarity, without
compromising the meaning of the sentence. Another comment stated that
the handling procedures should apply ``prior to distribution,'' not
during ``any stage of handling.'' One comment stated that the
requirement does not cover the need for special precautions in handling
used devices which may be contaminated, and that this is an important
issue covered by ISO/CD 13485.
FDA does not believe that Sec. 820.120, now Sec. 820.140, as
written is unclear. The procedures are expected to ensure that mixups,
damage, deterioration, contamination, or other adverse effects do not
occur. FDA amended the requirement, however, to remove ``any stage of''
so it reads ``during handling.'' The requirement continues to apply to
all stages of handling in which a manufacturer is involved, which may
in some cases go beyond initial distribution.
The comparable provision in ISO/CD 13485 states, ``If appropriate,
special provisions shall be established, documented and maintained for
the handling of used product in order to prevent contamination of other
product, the manufacturing environment and
[[Page 52636]]
personnel.'' FDA agrees with this requirement and has therefore added
the term ``contamination'' to Secs. 820.140 Handling and 820.150
Storage.
ii. Storage (Sec. 820.150)
174. Two comments stated that proposed Sec. 820.122 Storage should
be amended to be similar to ISO 9001, and that the rest of the
requirements should be deleted and included in a guidance document. One
comment stated that the term ``obsolete'' should be deleted because,
although a device may no longer be sold, thereby making it obsolete,
the components for that device may still be stored for customer support
of the existing devices.
FDA agrees that Sec. 820.122, now Sec. 820.150, could be more
consistent with ISO 9001 and has revised the section to harmonize with
ISO 9001:1994. FDA has not deleted the term ``obsolete.'' FDA
understands that a device may no longer be sold, but that parts and
subassemblies may still be required for customer support; therefore,
those components or subassemblies are not ``obsolete.'' FDA's intent in
this requirement is to ensure that only the appropriate product be used
or distributed.
FDA has deleted the requirement that control numbers or
identifications be legible and visible because it believes the
requirement is inherent in Sec. 820.150(a), which requires the
manufacturer to establish procedures to prevent mixups. To do this, a
manufacturer must ensure that product can be properly identified.
175. A comment stated that restricting access to designated areas
through the use of keys, bar code readers, or other means, should be
sufficient to meet the intent of the requirement in proposed
Sec. 820.122(b), without the need for written procedures for
authorizing receipt.
FDA has not deleted the requirement for procedures, now in
Sec. 820.150(b), to authorize receipt of product because the agency
believes that strict control over product in storage areas and stock
rooms results in decreased distribution of nonconforming product. Thus,
even where locked storage rooms are utilized, the procedures should
detail, among other things, who is permitted access and what steps
should be followed prior to removal.
iii. Distribution (Sec. 820.160)
176. A few comments on proposed Sec. 820.124 Distribution stated
that there are times when ``first in, first out'' inventory procedures
may not be in the best interest of the customer. The comments said that
especially when expiration dating is defined and labeled, a ``first in,
first out'' system should not be required. The GHTF and other EU
comments stated that if a new section ``Contract review,'' similar to
ISO 9001:1994, section 4.3 was not added to the regulation, the
requirement that ``purchase orders are reviewed to ensure that
ambiguities and errors are resolved before devices are released for
distribution'' should be added to this section.
FDA agrees with the comments. FDA has amended the requirement in
Sec. 820.160 to state that the procedures must ensure that ``expired
devices or devices deteriorated beyond acceptable fitness for use'' are
not distributed. FDA has also added the sentence on reviewing purchase
orders.
177. A few comments on proposed Sec. 820.124(b) stated that class I
devices should be exempt, or that the requirement should apply only to
critical devices, because all devices do not require control numbers.
Other comments stated that the term ``consignee'' should be defined, or
the word ``primary'' should be added before ``consignee'' for clarity.
FDA agrees in part with the comments and in Sec. 820.160(b) has
added the term ``initial'' before ``consignee'' to make clear that the
requirement for maintaining distribution records extends to the first
consignee. FDA has retained the word ``consignee'' and notes that it is
a person to whom the goods are delivered. FDA has also clarified
Sec. 820.160(b)(4) by requiring ``Any control number(s) used.''
Therefore, if the manufacturer is required by Sec. 820.65 to have
control numbers, these must be recorded along with any control numbers
voluntarily used. Logically, control numbers are used for traceability
so they should be recorded in the DHR distribution records. FDA
disagrees, however, that the requirement to maintain distribution
records should not apply to class I devices. The information required
by this section is basic information needed for any class of product in
order to conduct recalls or other corrective actions when necessary.
iv. Installation (Sec. 820.170)
178. Several comments received on proposed Sec. 820.126,
Installation stated that not all devices require installation. Several
comments on the Working Draft asked that, ``The results of the
installation inspection shall be made available to FDA upon request''
be deleted because this was redundant with FDA's access to these
documents under Sec. 820.180.
FDA agrees with the first set of comments. As discussed in
Sec. 820.1, the installation requirements only apply to devices that
are capable of being installed. However, to further clarify the
requirements in Sec. 820.170, FDA has made clear that the requirement
applies to ``devices requiring installation.'' FDA also agrees that the
sentence on document availability is redundant with Sec. 820.180 for
all records and has deleted the sentence.
179. Several comments raised the issue of applying the regulation
requirements to third party installers.
FDA has rewritten Sec. 820.170. Persons who install medical devices
have been regulated under the original CGMP under Sec. 820.3(k) which
describes a manufacturer as one who ``assembles or processes a finished
medical device,'' and continue to be regulated under this quality
system regulation under Sec. 820.3(o). Section 820.152 Installation of
the original CGMP discussed the manufacturer or its authorized
representative and persons other than the manufacturer's
representative. This regulation eliminates that terminology. Under the
revised requirement in Sec. 820.170(a), the manufacturer establishes
installation and inspection instructions, and where appropriate test
procedures. The manufacturer distributes the instructions and
procedures with the device or makes them available to person(s)
installing the device. Section 820.170(b) requires that the person(s)
installing the device follow the instructions and procedures described
in Sec. 820.170(a) and document the activities described in the
procedures and instructions to demonstrate proper installation.
The revised provisions in Sec. 820.170(b) explicitly require that
the installation be performed according to the manufacturer's
instructions, regardless of whether the installer is employed by or
otherwise affiliated with the manufacturer. Section 820.170(b) requires
records to be kept by whomever performs the installation to establish
that the installation was performed according to the procedures. Such
records will be available for FDA inspection. FDA does not expect the
manufacturer of the finished device to maintain records of installation
performed by those installers not affiliated with the manufacturer, but
does expect the third party installer or the user of the device to
maintain such records.
FDA believes that making these requirements explicit in the
regulation is necessary to ensure that devices are safe and effective,
and that they perform as intended after installation. FDA notes
[[Page 52637]]
again that installers are considered to be manufacturers under the
original CGMP regulation and that their records are, and will continue
to be, subject to FDA inspections when the agency deems it necessary to
review such records.
M. Records (Subpart M)
i. General Requirements (Sec. 820.180)
180. Several comments under Sec. 820.180 General requirements
suggested that FDA delete the requirement that records be stored to
allow ``rapid retrieval'' because a reasonable time frame should be
allowed. One comment stated that the wording of the section needed to
be amended to allow records to be located in different places,
especially for foreign manufacturers and distributors. Two comments
stated that the requirement should be qualified by ``subject to
conflicting legal requirements in other countries'' because some
countries have ``blocking statutes'' that would prohibit the release of
some information. One comment stated that wherever the word ``all''
appeared in the requirements, FDA should remove it.
FDA has rearranged this section, and notes that records must be
kept in a location that is ``reasonably accessible'' to both the
manufacturer and FDA investigators, and that records must be made
``readily available.'' FDA expects that such records will be made
available during the course of an inspection. If the foreign
manufacturer maintains records at remote locations, such records would
be expected to be produced by the next working day or 2, at the latest.
FDA has clarified that records can be kept at other than the inspected
establishment, provided that they are made ``readily available'' for
review and copying. This should provide foreign manufacturers and
initial distributors the necessary flexibility.
FDA has not qualified Sec. 820.180 in response to the comments on
the ``blocking statues'' because if manufacturers want to import
medical devices into the United States, then they must comply with
applicable statutory and regulatory requirements, including part 820.
The records section of this regulation is essentially the same as that
of the original CGMP and FDA has not found these ``blocking statutes''
to present a problem. Further, countries increasingly realize the
importance of a global market, thus FDA does not anticipate this issue
to be a problem in the future.
In response to the comment on the term ``all'', FDA notes that
where a requirement exists for ensuring that records are maintained in
a certain fashion, a manufacturer must keep all records subject to the
regulation in that manner. The revised section makes clear that it is
``all records required'' by the regulation to which the section's
requirements pertain.
181. A few comments on Sec. 820.180(b), ``Record retention
period,'' stated that the section should be amended because all quality
records may not be tied to a specific device; therefore, such quality
records may not need to be maintained over the lifetime of a device. A
few comments stated that the retention period requirement is unclear
and burdensome, while others stated that the period should be left to
the manufacturer to define. One comment suggested the deletion of the
requirements related to photocopying records in proposed
Sec. 820.180(b) because it is technology that is not necessarily being
used.
FDA believes that all records should be retained for a period
equivalent to the design and expected life of the device, but in no
case less than 2 years, whether the records specifically pertain to a
particular device or not. The requirement has been amended to make
clear that all records, including quality records, are subject to the
requirement. FDA believes this is necessary because manufacturers need
all such records when performing any type of investigation. For
example, it may be very important to access the wording of a complaint
handling procedure at the time a particular complaint came in when
investigating a trend or a problem that extends to several products or
over an extended period of time. Further, FDA does not believe that
allowing the manufacturer to define the retention period will serve the
public's best interest with regard to safety concerns and hazard
analysis.
In response to the comment on photocopying, FDA has deleted the
last two sentences. The agency believes that this requirement is
outdated and does not necessarily reflect the technology being utilized
today. Section 820.180 requires that records be readily available for
inspection and copying by FDA, and FDA will interpret ``copying'' to
include the printing of computerized records, as well as photocopying.
182. One comment on proposed Sec. 820.180(c) stated that all
quality audit reports should be subject to FDA review and public
disclosure. A few other comments stated that for a management
representative to certify that ``corrective action has been taken''
would be difficult because some corrective actions are long term and
may not be completed at the time of certification.
FDA disagrees with the comment that quality audit reports should be
subject to FDA review for the reasons given in the preamble of the
original CGMP regulation, published in the Federal Register on July 21,
1978 (43 FR 31508), and believes that the disclosure of the audit
reports themselves would be counterproductive to the intent of the
quality system. FDA has added Sec. 820.180(c), ``Exceptions,'' to
address which records FDA, as a matter of policy, will not request to
review or copy during a routine inspection; such records include
quality audit reports. FDA may request an employee in management with
executive responsibility to certify in writing that the management
reviews, quality audits, and supplier audits (where conducted) have
been performed, among other things. FDA may also seek production of
these reports in litigation under applicable procedural rules or by
inspection warrant where access to the records is authorized by
statute. Again, FDA emphasizes that its policy of refraining from
reviewing these reports extends only to the specific reports, not to
the procedures required by the sections or to any other quality
assurance records, which will be subject to review and copying.
FDA agrees with the comments on the timing of corrective actions
and has amended the certification requirement to state ``corrective
action has been undertaken.''
ii. Device Master Record (DMR) (Sec. 820.181)
183. A few comments on proposed Sec. 820.181 Device master record
stated that the requirement for a ``qualified'' individual to prepare
the DMR should be deleted because it is unclear or redundant with the
requirements in Sec. 820.25.
FDA has not deleted the requirement for the DMR to be prepared,
dated, and approved by a qualified individual because the agency
believes this is necessary to assure consistency and continuity within
the DMR. The section is consistent with the original CGMP,
Sec. 820.181. FDA has, however, substituted the phrase ``prepared and
approved in accordance with Sec. 820.40'' to be consistent with the
requirements already in Sec. 820.40 and to eliminate any redundancy.
184. Two comments on Sec. 820.181(a) stated that ``software design
specifications'' should not be included in the DMR because these
documents will be located in the DHF. Another comment requested that
the requirement that the DMR contain ``software source code''
information be amended because
[[Page 52638]]
source codes for commercialized software will not be available to the
device manufacturers. Another comment stated that the source code
should not be in the DMR because it will already be in the DHF.
FDA deleted the reference to ``software source code'' because this
is already covered with the requirement for ``software
specifications.'' The final software specifications should be
transferred into production. Therefore, the final software
specification for the particular device or type of device should be
located or referenced in the DMR, while any earlier version should be
located or referenced in the DHF. FDA believes that it is more
important for manufacturers to construct a document structure that is
workable and traceable, than to worry about whether something is
contained in one file as compared to another. The DMR is set up to
contain or reference the procedures and specifications that are current
on the manufacturing floor. The DHF is meant to be more of a historical
file for utilization during investigations and continued design
efforts.
185. One comment on Sec. 820.181(c) stated that the DMR should not
contain quality system documents, but rather the quality control
documents related to the specific device. Three comments stated that
validation and verification information belongs in the DHF, not the
DMR.
FDA agrees in part with the comments and has revised the section to
clarify that the quality records required in the DMR relate to the
specific current design, not the more general requirements of the
quality system, which are addressed under new Sec. 820.186. However,
the comments are incorrect that all validation and verification
information is related solely to design. There are requirements for
validation and verification pertaining to device processing that may be
better kept in the DMR instead of the DHF. The documentation of such
verification and validation activities relating to processes that are
performed for several different devices or types of devices can be
placed or referenced in the location that best suits the manufacturer.
Again, it is more important that the manufacturer store and retrieve
information in a workable manner, than keep such information in
particular files.
186. FDA notes that the regulation contains a few requirements
which apply ``where appropriate'' or ``at appropriate stages.'' FDA
emphasizes that the procedures that the manufacturer places in the DMR
must clearly define the requirements the manufacturer is following and
when particular activities are appropriate. The manufacturer will have
failed to comply with the requirements of the section if the procedures
simply state that the review or activity occurs at ``appropriate
stages.''
The same principle applies for every section of this regulation,
which is written to be flexible enough to cover the manufacture of all
types of devices. Manufacturers must adopt quality systems appropriate
for their specific products and processes. In establishing these
procedures, FDA will expect manufacturers to be able to provide
justifications for the decisions reached.
iii. Device History Record (Sec. 820.184)
187. One comment on Sec. 820.184 stated that labeling should not be
required in the DHR because it is already required in the DMR. Another
comment stated that some devices have 25 or more labels and that only
the primary identification labels are necessary in the DHR. One comment
stated the requirement should be amended because it explicitly requires
that dates and quantities for each batch be in the DHR, while only
implying through the general requirement that the DHR must also contain
the batch test data.
FDA agrees that it may not be necessary to include all labeling
used in the DHR. However, FDA continues to believe, as it explained in
the preamble to proposed regulation published in the Federal Register
on November 23, 1993 (58 FR 61952 at 61968), that increased control
over labeling is necessary due to the many labeling errors resulting in
recalls. Therefore, FDA has retained a requirement related to labeling
in the DHR, but revised it to make it less burdensome. The requirement
was amended to ``the primary identification label and labeling'' which
is consistent with that contained in the original CGMP regulation,
Sec. 820.185. FDA believes that the requirement that the DHR contain
the primary label and labeling used for each production unit, coupled
with the labeling controls in Sec. 820.120, should help to ensure that
proper labeling is used and, hopefully, decrease the number of recalls
due to improper labeling.
FDA agrees with the last comment and has added in Sec. 820.184
``(d) The acceptance records which demonstrate the device is
manufactured in accordance with the DMR'' to explicitly state the
requirement to avoid any confusion.
188. FDA has deleted the requirement for the DHR to be ``readily
accessible and maintained by a designated individual(s)'' because it
believes that the objective of that requirement is met through
Secs. 820.40 Document controls and 820.180 General requirements.
FDA has also added ``device identification'' to the requirement
under Sec. 820.184(f) because it believes that any identification or
control number used should be documented in the DHR to facilitate
investigations, as well as corrective and preventive actions. FDA notes
that this provision does not add any requirement for identification or
traceability not already expressed in Secs. 820.60 and 820.65.
iv. Quality System Record (Sec. 820.186)
189. Several comments stated that the regulation should more
closely harmonize with ISO 9001:1994. A few comments stated that the
regulation should include the requirements for a quality manual. One
comment stated that general quality system procedures and instructions
should not be required in the DMR because the DMR is device specific,
and many quality system procedures are not tied to a particular device.
FDA agrees in part with these comments and has developed new
Sec. 820.186 Quality system record. This section separates the
procedures and documentation of activities that are not specific to a
particular type of device from the device specific records.
v. Complaint Files (Sec. 820.198)
190. Two comments on proposed Sec. 820.198 Complaint files stated
that the requirements were very detailed and that much of the language
should be placed in a guidance document.
FDA disagrees with the comments. These requirements are essentially
the same as the original CGMP requirements under Sec. 820.198, and 18
years of experience with these requirements shows that many
manufacturers still do not understand and properly handle complaints.
Therefore, FDA believes that the amount of detail in Sec. 820.198 is
appropriate and necessary. In an effort to make the requirements more
clear, however, the section has been reorganized to better illustrate
how complaint information should be handled.
Section 820.198(a) sets forth the general requirement for
establishing and maintaining a complaint handling procedure and
includes a few items that the procedure needs to address. Section
820.198(b) discusses the initial review and evaluation of the
complaints in order to determine if complaints are ``valid.'' It is
important to note that this evaluation is not the same as a complaint
investigation. The evaluation
[[Page 52639]]
is performed to determine whether the information is truly a complaint
or not and to determine whether the complaint needs to be investigated
or not. If the evaluation decision is not to investigate, the
justification must be recorded. Section 820.198(c) then describes one
subset of complaints that must be investigated, but explains that
duplicative investigations are not necessary. In cases where an
investigation would be duplicative, a reference to the original
investigation is an acceptable justification for not conducting a
second investigation. Section 820.198(d) describes another subset of
complaints that must be investigated (those that meet the MDR criteria)
and the information that is necessary in the record of investigation of
those types of complaints. Section 820.198(e) sets out the type of
information that must be recorded whenever complaints are investigated.
The information described in Sec. 820.198 (e)(1) through (e)(5) would
most likely be attained earlier in order to perform the evaluation in
Sec. 820.198(b). This information need not be duplicated in the
investigation report as long as the complaint and investigation report
can be properly identified and tied together. Section 820.198 (e)(1)
through (e)(5) are considered to be basic information essential to any
complaint investigation. If there is some reason that the information
described in Sec. 820.198(e) cannot be obtained, then the manufacturer
should document the situation and explain the efforts made to ascertain
the information. This will be considered to be acceptable as long as a
reasonable and good faith effort was made. For example, a single phone
call to a hospital would not be considered by FDA to be a reasonable,
good faith effort to obtain information. Section 820.198(f) is the same
as Sec. 820.198(d) of the original CGMP, where the manufacturing
facility is separate or different from that of the formally designated
complaint handling unit. In such cases, it is important that the
facility involved in the manufacturing of the device receive or have
access to complaint and investigation information. In order to give
manufacturers the flexibility of using computer or automated data
processing systems, the term ``reasonably accessible,'' from
Sec. 820.180, is used. Section 820.198(g) is the complaint
recordkeeping requirement for distributors. In order to give
manufacturers the same flexibility as described in Sec. 820.198(f), FDA
has included ``reasonably accessible'' in Sec. 820.198(g).
Throughout Sec. 820.198, when there is reference to the MDR
regulation or to the types of events that are reportable under the MDR
regulation, this section simply refers to events or complaints that
``represent an event which is required to be reported to FDA under part
803 or 804 of this chapter.''
191. A few comments on Sec. 820.198(a) stated that the section
should allow for more than one ``formally designated unit'' to handle
complaints, especially for large corporations where it would not be
feasible or beneficial for all divisions to have a single complaint
handling unit. A few other comments stated that Sec. 820.198(a)(2) on
oral complaints should be deleted because it is too subjective.
FDA disagrees with these comments. Large corporations may have
different complaint handling units for different product types or
different manufacturing establishments. However, there should be only
one formally designated complaint handling unit for each product type
or establishment. If a corporation chooses to operate with different
complaint handling units for products and/or establishments, the
manufacturer must clearly describe and define its corporate complaint
handling procedure to ensure consistency throughout the different
complaint handling units. A system that would allow multiple
interpretations of handling, evaluating, categorizing, investigating,
and following up, would be unacceptable. Each manufacturer should
establish in its procedures which one group or unit is ultimately
responsible for coordinating all complaint handling functions.
FDA also disagrees that the requirement that oral complaints be
documented upon receipt should be deleted. A December 1986 General
Accounting Office (GAO) report entitled ``Medical Devices; Early
Warning of Problems Is Hampered by Severe Underreporting,'' (Ref. 11)
showed that approximately 83 percent of the hospitals report complaints
orally. FDA believes that these oral complaints must be captured in the
complaint handling process.
192. FDA, as noted above, has added to Sec. 820.198(c) the phrase
``unless such investigation has already been performed for a similar
complaint and another investigation is not necessary'' to clarify that
duplicative investigations are not required if the manufacturer can
show that the same type of failure or nonconformity has already been
investigated.
193. Several comments on proposed Sec. 820.198(b), now
Sec. 820.198(d), stated that the evaluation of complaints pertaining to
death, injury, or hazard to health should be removed from this section
because it is redundant with the MDR regulation. Several other comments
on Sec. 820.198(b) stated that complaints pertaining to death, injury,
or hazard to health need not be maintained separately, as long as they
are identified.
FDA disagrees that the requirements are redundant, but believes
that they expressly state what is expected in the handling of this type
of complaint information. The requirements have been moved to a
separate section, Sec. 820.198(d).
FDA agrees with the second set of comments and has revised the
section to permit such complaints to be ``clearly identified.'' This
will give a manufacturer flexibility in choosing a means of ensuring
that these types of complaints can be immediately recognized and
segregated for purposes of prioritizing and meeting other requirements.
FDA has substituted the term ``promptly'' for the term
``immediately'' to be more consistent with the new MDR regulation
timeframes. FDA has also clarified that Sec. 820.198 (d)(1) through
(d)(3) are in addition to the information that must be recorded in
Sec. 820.198(e).
194. A few comments on proposed Sec. 820.198 (c) and (d) stated
that FDA should make clear that some of the requirements will not
always be applicable. For example, the comments stated that a record of
corrective action cannot be made if such action is not required, and is
not taken.
Where corrective action is not necessary and is not taken, it
cannot be documented. The section was revised to make that clear. As
stated in the preamble to the proposal (58 FR 61952 at 61968), the
manufacturer's procedures should clearly identify when corrective
action will be taken.
In addition, FDA combined provisions in Sec. 820.198 (c) through
(e) to eliminate redundancy and added the requirement that the records
include any device identification, as well as control number used, to
facilitate corrective and preventive actions. FDA has also deleted the
term ``written'' in Sec. 820.198(e) to be consistent with FDA's
statements on electronic and computer systems.
195. FDA deleted the requirements in proposed Sec. 820.198(f) in
response to comments because it agrees that it is not necessary to
repeat the requirements of the MDR regulation in the quality system
regulation. Section 820.198(a) requires that all complaints be
evaluated to determine whether they are subject to
[[Page 52640]]
the requirements of the MDR regulation under part 803 or 804.
196. A few comments on proposed Sec. 820.198(g), now
Sec. 820.198(f), stated that duplicate records are not needed in this
age of computer systems, and that the requirement as written would be
counterproductive.
FDA agrees with the comments and has rewritten the section to allow
the complaints and records of investigation to be reasonably accessible
at the formally designated complaint unit and the manufacturing site,
where these locations are distinct. A manufacturer's procedures must
ensure that the manufacturing site is alerted to complaints concerning
devices produced at that site.
197. Several comments on proposed Sec. 820.198(h), now
Sec. 820.198(g), stated that the requirement is unnecessary, given that
FDA can inspect a foreign manufacturer that imports devices, and is
burdensome.
FDA has revised the section to permit the records to be reasonably
accessible, similar to Sec. 820.198(f), which should alleviate any
burden. However, the agency must have access to these records in the
United States.
198. Several comments on proposed Sec. 820.198 (i) and (j) stated
that the requirements should be deleted because they are redundant with
the MDR requirements in part 803.
FDA disagrees that all of the requirements in Sec. 820.198 (i) and
(j) are redundant. The requirement that procedures ensure that
complaints are processed uniformly and in a timely manner, and
evaluated to determine whether they are reportable under part 803 or
804, has been moved up to Sec. 820.198(a). These are basic requirements
for complaint handling. If the complaint is determined to be of the
type subject to part 803 or 804, those requirements apply. The
requirements of parts 803 and 804 are not repeated in this regulation.
FDA has deleted Sec. 820.198(j).
N. Servicing (Subpart N)
199. Numerous comments were received on the servicing requirements
that were proposed. Many of these comments dealt with competitive
issues between manufacturers that perform or contract out their own
servicing and third party service organizations. The comments received,
as well as the recommendations from the GMP Advisory Committee, were
split on many issues. Therefore in this regulation, FDA has chosen to
codify only longstanding requirements for servicing performed by
original manufacturers and remanufacturers. The requirements in
Sec. 820.200 are similar to those in ISO 9001:1994, with some
supplemental requirements for clarification on monitoring service
reports, on the relationship of service reports and complaints, and on
the type of information FDA believes is essential in any service
report. As described above in the definition section of this preamble,
a separate rulemaking will specify and clarify the requirements for
third party service organizations.
200. Other comments on proposed Sec. 820.200(a) stated that it is
impractical to return a used device to its original specifications
because a certain amount of wear and tear should be expected, without
detriment to the safety and effectiveness of the device. Several
comments on Sec. 820.200(a) stated that the term ``records'' should be
replaced by ``reports,'' to be consistent with ISO 9001.
FDA agrees and has revised the requirements in Sec. 820.200(a) to
be similar to the requirements in ISO 9001:1994 as recommended by
comments at the GMP Advisory Committee meeting to require that the
servicing instructions and procedures ensure that the device will meet
``specified requirements'' for the device's intended use. FDA is aware
that with use and age, a device may be serviced to function as
intended, but may not meet original specifications.
FDA agrees with the comments and has modified the language in
Sec. 820.200(b), (c), and (d) to use the term ``service reports.''
201. A few comments on proposed Sec. 820.200(b), ``Service report
evaluation,'' questioned whether full corrective action was necessary
for every service report and whether service calls need to be handled
as complaints only when there is a death, injury, or hazard to safety.
FDA has rewritten this section into Sec. 820.200(b) and (c) to
clarify the agency's intent and to use terms consistent with those used
in Sec. 820.198. Section 820.200(b) now states that ``Each manufacturer
shall analyze service reports with appropriate statistical methodology
in accordance with Sec. 820.100.'' Full corrective action may not be
required for every service report. However, if the analysis of a
service report indicates a high risk to health, or that the frequency
of servicing is higher than expected, the remainder of the corrective
and preventive action elements are applicable, in accordance with the
corrective and preventive action procedures established under
Sec. 820.100.
Section 820.200(c) provides that when a service report ``represents
an event which must be reported to FDA under part 803 or 804 of this
chapter,'' it is automatically considered by FDA to be a complaint that
must be handled according to Sec. 820.198. FDA emphasizes that this
provision is not intended to limit ``complaints'' to MDR reportable
events.
202. FDA has also added in Sec. 820.200(d) the requirements for
recording the name of the device, any device identification(s) and
control number(s) used, as well as test and inspection data, because
FDA believes such documentation in the service report will facilitate
investigations. This additional documentation provision does not add
any requirement for identification or traceability not already
expressed in Secs. 820.60 and 820.65. Therefore, Sec. 820.200(d) as
amended focuses on the type of information that should be captured on
the service report instead of where the information should be sent.
O. Statistical Techniques (Subpart O)
203. FDA amended Sec. 820.250(a) to be consistent with the
requirements in ISO 9001:1994, section 4.20.
204. Several comments on Sec. 820.250(b) stated that the provision
as written seems to require the use of sampling plans, and that every
manufacturer does not necessarily use sampling plans. Another comment
stated that sampling plans are not often used during reviews of
nonconformities, quality audits, or complaints, and that these examples
should, therefore, be deleted. Two other comments questioned the
meaning of ``regularly reviewed.''
FDA's intent was not to require the use of sampling plans, but to
require that where they are used, they should be written and valid.
Section 820.250 was revised to make that clear. Sampling plans are not
always required, but any time sampling plans are used, they must be
based on a valid statistical rationale. Further, FDA acknowledges that
the most common use of sampling plans is during receiving acceptance,
and has deleted the examples. FDA has also clarified the review
requirement by stating ``to ensure that when changes occur the sampling
plans are reviewed.''
VI. Summary of Changes From the July 1995 Working Draft to the
Final Rule and Rationale
Note: Minor changes to improve grammar, readability, and
clarity, as well as changes in terminology and organization for the
sake of consistency throughout the regulation, are not listed.
[[Page 52641]]
A. Section 820.1 Scope
1. Inserted sentence, ``If a manufacturer engages in only some
operations subject to the requirements in this part, and not in others,
that manufacturer need only comply with those requirements applicable
to the operations in which it is engaged'' for further clarification of
the scope in response to many comments.
2. Amended sentence on component manufacturers to read, ``This
regulation does not apply to manufacturers of components or parts of
finished devices, but such manufacturers are encouraged to use
appropriate provisions of this regulation as guidance'' as a result of
the many written comments and oral testimony at the August and
September 1995 meetings.
3. Inserted sentence on how to interpret the phrase ``where
appropriate'' in the regulation, as recommended by the GMP Advisory
Committee. This sentence is consistent with International Organization
for Standards (ISO)/CD 13485-- ``Application of Quality Systems to
Medical Devices.''
B. Section 820.3 Definitions
4. Amended the definition of Complaint by inserting ``after it is
released for distribution'' in response to comments for clarification
and to harmonize with ISO/CD 13485.
5. Amended the definition of Component by deleting ``packaging''
for clarification that every piece of packaging is not necessarily a
component, only the materials that are part of the ``finished,
packaged, and labeled device.''
6. Amended the definition of Design output to clarify its
relationship with the Device Master Record.
7. Amended the definition of Design review to delete ``and propose
the development of solutions'' in order to allow the manufacturer the
flexibility to determine whom the appropriate person(s) is to propose
solutions.
8. Deleted the definition of End of life in response to the many
written comments and oral testimony at the August and September 1995
meetings.
9. Amended the definition of Manufacturer to delete component
manufacturers and to remove the terms ``servicer'' and ``refurbisher.''
The obligations of servicers and refurbishers will be addressed in a
separate rulemaking later this year. The terms ``installation'' and
``remanufacturing'' were added to codify longstanding FDA policy and
interpretations of the original CGMP regulation.
10. Amended the definition of Manufacturing material in response to
comments requesting clarification and separation of examples.
11. Deleted the definition of Record to avoid confusion. Record
will continue to be defined by the act and case law.
12. Removed the definition of Refurbisher for reasons discussed in
paragraph 28, section V.A. of this document.
13. Inserted the definition of Remanufacturer for reasons discussed
in paragraph 28, section V.A. of this document, and made the language
consistent with that of the 510(k) provision and the PMA amendment/
supplement requirements.
14. Changed the term Reprocessing to Rework and adopted a
definition consistent with ISO 8402 Quality Management and Assurance
Vocabulary Standard in response to comments for closer harmonization of
terminology.
15. Removed the definition of Servicing, and Servicer which was
proposed to the GMP Advisory Committee, for reasons discussed above.
16. Amended the definition of Validation as recommended by the GMP
Advisory Committee for further clarity by delineating the terms
validation, process validation, and design validation.
17. Amended the definition of Verification for further clarity in
response to comments and to more closely harmonize with ISO 8402.
C. Section 820.5 Quality System
18. Deleted the requirements in Sec. 820.5(a) and (b) because these
requirements are now found in Sec. 820.20.
D. Section 820.20 Management Responsibility
19. Moved the requirements from Sec. 820.186 and rewrote into new
Sec. 820.20(d) and (e) for clarity, better organization, and closer
harmonization with ISO/CD 13485.
E. Section 820.25 Personnel
20. Inserted the phrase, ``establish procedures for identifying
training needs'' in Sec. 820.25(b) in response to comments to add this
requirement and to harmonize with the requirement in ISO/CD 13485.
21. Deleted the sentence in Sec. 820.25 on understanding the ``CGMP
requirements applicable to their job function'' to provide
manufacturers with the flexibility to appropriately train personnel.
F. Section 820.30 Design Controls
22. Amended the requirements in Design and development planning for
clarity and to more closely harmonize with ISO/CD 13485.
23. In Sec. 820.30(c), inserted the sentence, ``The procedures
shall include a mechanism for addressing incomplete, ambiguous, or
conflicting requirements'' in response to comments to add this
requirement and to harmonize with the requirement in ISO/CD 13485.
24. In Sec. 820.30(d), deleted the sentence, ``Design output
procedures shall ensure that design output meets the design input
requirements'' because this was redundant with the requirement in
Sec. 820.30(f) Design verification.
25. Amended Sec. 820.30(e) Design review to clarify that the
procedures shall ensure that an independent person is included in
design reviews.
26. Section 820.30(f) Design verification and validation was split
into two paragraphs, (f) Design verification and (g) Design validation
and the requirements were separated between the two paragraphs, in
response to many written comments and oral testimony at the August and
September 1995 meetings and to improve clarity and consistency with
ISO/CD 13485.
27. Amended the requirement for Sec. 820.30(i) Design changes to
add the phrase ``before their implementation'' due to an inadvertent
omission in the July 1995 Working Draft.
G. Section 820.50 Purchasing Controls
28. Deleted the last two sentences in Sec. 820.50(b) and inserted
``Purchasing data shall be approved in accordance with Sec. 820.40''
because the last two sentences were redundant with the requirements in
Sec. 820.40.
H. Section 820.65 Traceability
29. Substituted the definition of critical device from the original
CGMP for the phrase ``where necessary to ensure the protection of the
public health,'' in response to many comments requesting clarification
as to when traceability is necessary.
30. Added ``where appropriate'' for the traceability of components
in response to the recommendation of the GMP Advisory Committee, the
written comments, and to harmonize with ISO/CD 13485.
I. Section 820.70 Production and Process Controls
31. Inserted ``identified and approved'' in Sec. 820.70(a)(5)
before ``representative samples'' to clarify that the samples have to
be established and deemed appropriate before they are used as a
standard.
32. Substituted in Sec. 820.70(b) ``where appropriate validated
according to Sec. 820.75'' for ``unless inspection and test
[[Page 52642]]
fully verifies the results of the changes'' because it was redundant
with the requirements set forth in Sec. 820.75.
33. Amended the requirement in Sec. 820.70(c) to apply only ``Where
environmental conditions could reasonably be expected to have an
adverse effect on product quality,'' in response to comments and to be
consistent with the original CGMP requirements.
34. Amended the requirements in Sec. 820.70(d) and (e) to include
``could reasonably be expected to have an adverse effect on product
quality'' to consistently qualify when these provisions are
appropriate.
35. Amended the requirement in Sec. 820.70(h) to apply only ``Where
a manufacturing material could reasonably be expected to have an
adverse effect on product quality,'' in response to comments and to be
consistent with the original CGMP requirements.
36. Rearranged the wording in Sec. 820.70(i) to clarify ``automated
data processing systems.''
J. Section 820.72 Inspection, Measuring, and Test Equipment
37. Renumbered Sec. 820.84 as Sec. 820.72 for better organization
because Inspection, measuring, and test equipment requirements are more
appropriate under Subpart G--Production and Process Controls than under
Subpart H--Acceptance Activities.
38. Section 820.72(b) ``Calibration standards'' and (c)
``Calibration records'' were reorganized as paragraphs(1) and (2),
respectively under paragraph (b) ``Calibration.''
39. Amended Sec. 820.72(b) to include provisions for remedial
action to ``reestablish the limits and to evaluate whether there was
any adverse effect on the device's quality'' in response to comments
which questioned whether this was adequately covered under
Sec. 820.100.
40. Section 820.84(d), ``Maintenance,'' is reorganized into
Sec. 820.72(a) ``Control of inspection, measuring, and test equipment''
and ``test software'' is deleted because it is considered to be covered
under ``electronic inspection and test equipment'' in the general
requirement.
K. Section 820.75 Process Validation
41. Section 820.75(a) is amended for clarity. The phrase ``with a
high degree of assurance'' was deleted from the definition of
``Validation'' and added as a requirement under process validation.
42. Section 820.75(b)(2) was amended to state ``where appropriate,
the individual(s) performing the process or the major equipment used''
in response to comments requesting that flexibility be given to the
manufacturer to determine when these items needed to be documented.
43. Section 820.75 (c) and (d) were redesignated as paragraphs
(b)(1) and (b)(2) for better organization and flow.
44. Section 820.75(c) was added to address comments and concerns on
when revalidation activities were necessary.
L. Section 820.80 Receiving, In-process, and Finished Device
Acceptance
45. Section 820.80(c) was amended to add ``where appropriate'' to
reinforce the discussion in the preamble that in- process testing is
not always necessary depending upon the type of device and the
manufacturing set-up.
M. Section 820.90 Nonconforming Product
46. Amended the requirement in Sec. 820.90(a) to include, ``The
evaluation of nonconformance shall include a determination of the need
for an investigation * * *. The evaluation and any investigation shall
be documented.'' in response to many written comments and oral
testimony at the August and September 1995 meetings on whether every
nonconformance had to be investigated.
47. Amended the requirement in Sec. 820.90(b)(1) to read,
``Documentation shall include the justification for use of
nonconforming product'' in response to several comments confused about
the meaning of the term ``concession.''
48. In Sec. 820.90(b)(2), substituted the term ``rework'' for the
term ``reprocessing'' for reasons described in the definitions section.
49. Deleted the sentence, ``Reprocessed product shall be clearly
identified during reprocessing, and shall be subjected to
reevaluation'' in Sec. 820.90(b)(2) because the requirement was
redundant with the requirements in Secs. 820.60 Identification and
820.86 Acceptance status.
N. Section 820.100 Corrective and Preventive Action
50. Amended Sec. 820.100(a)(7) to clarify what information is to be
submitted to management for review.
O. Section 820.120 Device Labeling
51. Inserted ``where appropriate'' before ``use'' in
Sec. 820.120(a) because every device may not have a label directly
affixed to the device itself (e.g. implantable devices).
52. Inserted the sentence, ``The label and labeling used for each
production unit, lot, or batch shall be documented in the DHR'' into
Sec. 820.120(d) in response to comments questioning whether the
labeling used should be recorded in the device master record or the
device history record.
P. Section 820.160 Distribution
53. Inserted the requirement in Sec. 820.160 ``that purchase orders
are reviewed to ensure that ambiguities and errors are resolved before
devices are released for distribution'' in response to the GHTF
comments and other EU comments that the regulation did not address the
requirements in ISO 9001, section 4.3, ``Contract Review.''
Q. Section 820.170 Installation
54. Amended the installation requirements for clarity and deleted
the last sentence in Sec. 820.170(b), ``The results of the installation
inspection shall be made available to FDA upon request'' because this
sentence is redundant with the requirements in Sec. 820.180 for all
records.
R. Section 820.181 Device Master Record (DMR)
55. In Sec. 820.181 deleted the phrase ``dated, and signature of
the qualified individual(s) designated by the manufacturer'' and
inserted ``and approved in accordance with Sec. 820.40'' to be
consistent with the requirements already in Sec. 820.40.
56. In Sec. 820.181 deleted the phrase ``and software source code
for customized software'' because comments stated that this was already
covered with the requirement for ``software specifications.''
S. Section 820.186 Quality System Record (QSR)
57. Amended the requirement in Sec. 820.186 by adding the sentence,
The QSR shall include, or refer to the location of, procedures
and the documentation of activities required by this part that are
not specific to a particular type of device(s), including but not
limited to the records required by Sec. 820.20. Each manufacturer
shall ensure that the QSR is prepared and approved in accordance
with Sec. 820.40.
Deleted the requirements in Sec. 820.186(a) through (d) because those
requirements are now found in Sec. 820.20. This change was in response
to comments and suggestions made by the GHTF for further harmonization
with ISO/CD 13485 and for clarity.
T. Section 820.198 Complaint Files
58. In Sec. 820.198 deleted the terminology ``pertaining to death,
[[Page 52643]]
injury, or any hazard to safety'' throughout this section and inserted
``an event which must be reported to the FDA under part 803 or 804 of
this chapter'' to reference the MDR regulation.
59. Added the phrase ``unless such investigation has already been
performed for a similar complaint and another investigation is not
necessary'' in Sec. 820.198(c) in response to comments which thought a
second investigation was always mandated by this requirement.
60. Amended Sec. 820.198(d) by changing the word ``immediately'' to
``promptly'' to be consistent with the new MDR regulation. Added, ``In
addition to the information required by Sec. 820.198(e),'' to clarify
that an investigation under Sec. 820.198(d) was to include requirements
under paragraphs (d)(1) through (d)(3) and under paragraphs (e)(1)
through (e)(8).
61. Substituted the phrase ``reasonably accessible'' for
``concurrently maintained'' in Sec. 820.198 (f) and (g) as recommended
by the GMP Advisory Committee to clarify FDA's intent of allowing these
records to be available in other media forms besides the hard copies
which were previously required.
U. Section 820.200 Servicing
62. Amended Sec. 820.200(a) to adopt language consistent with ISO/
CD 13485, which was suggested at the GMP Advisory Committee meeting, in
order to clarify the requirement and further harmonize.
63. Deleted the last two sentences in Sec. 820.200(a) on providing
information to third party servicers since this industry will be
addressed in a separate rulemaking, as discussed above.
64. Section 820.200(d) was amended for clarity and to focus on the
service report and what type of information should be captured on the
report instead of where the information should be sent.
V. Section 820.250 Statistical Techniques
65. Amended Sec. 820.250(b) by inserting the phrase, ``to ensure
that when changes occur the sampling plans are reviewed'' in response
to comments for clarification on when the plans needed to be reviewed.
VII. Environmental Impact
The agency has determined under 21 CFR 25.24(a)(8) and (a)(10) that
this action is of a type that does not individually or cumulatively
have a significant effect on the human environment. Therefore, neither
an environmental assessment nor an environmental impact statement is
required.
VIII. Intergovernmental Partnership
The agency has analyzed this rulemaking in accordance with the
principles and criteria set forth in Executive Order 12875, ``Enhancing
the Intergovernmental Partnership'' and in the Unfunded Mandates Reform
Act of 1995 (Pub. L. 104-4). Executive Order 12875 states that no
agency or executive department shall issue any regulation that is not
required by statute and that creates a mandate upon a State, local, or
tribal government unless the Federal Government supplies funds
necessary to comply with the mandate, or the agency provides the Office
of Management and Budget (OMB) a description of the agency's
consultation with affected State, local, and tribal governments, the
nature of their concerns, any written communications submitted to the
agency by such units of government, and the agency's position
supporting the need to issue the regulation containing the mandate.
Executive Order 12875 does not apply to this final rule because the
regulatory requirements are not generally applicable to government
facilities but to finished device manufacturers. The agency notes,
however, that the membership of the advisory committee established to
review this regulation and make recommendations to the agency on the
feasibility and reasonableness of the regulation (GMP Advisory
Committee) must include three members who are officers or employees of
any State or local government or of the Federal Government, and that in
1995 this committee included two State government representatives and
one Federal Government representative.
The agency has also examined the consistency of this final rule
with the Unfunded Mandates Reform Act of 1995. The Unfunded Mandates
Reform Act requires (in section 202) that agencies prepare an
assessment of anticipated costs and benefits before proposing any rule
that may result in an annual expenditure by State, local, and tribal
governments, in the aggregate, or by the private sector, of $100
million (adjusted annually for inflation). FDA believes that the
private sector expenditures for this rule fall below $100 million
annually but nonetheless, due to uncertainties of these estimates, the
agency has prepared for the private sector an assessment of anticipated
costs and benefits for the 1993 proposed rule and this final rule as
described in section IX. of this document.
IX. Economic Impact
A. Summary
FDA has examined the impacts of the final rule under Executive
Order 12866 and the Regulatory Flexibility Act (Pub. L. 96-354).
Executive Order 12866 directs agencies to assess all costs and benefits
of available regulatory alternatives and, when regulation is necessary,
to select regulatory approaches that maximize net benefits (including
potential economic, environmental, public health and safety, and other
advantages; distributive impacts; and equity). The agency believes that
this final rule is consistent with the regulatory philosophy and
principles identified in the Executive Order. As explained in detail
below, FDA finds that this final rule has an estimated total annual
incremental cost of $81.9 million to the U.S. industry and an estimated
average annual benefit of from $180 million to $220 million in lives
saved and is economically significant under Executive Order 12866.
Consequently, the agency has completed this full regulatory flexibility
analysis which demonstrates that this rule is consistent with the
principles set forth in the Executive Order and the Regulatory
Flexibility Act, and also with the Unfunded Mandates Reform Act as
described in section VIII. of this document. This analysis, together
with the preamble published in the Federal Register and supporting
analysis and materials, constitutes a final regulatory flexibility
analysis. In addition, this document has been reviewed by OMB as an
economically significant regulatory action under Executive Order 12866.
The detailed data for this analysis were developed by Eastern
Research Group, Inc. (ERG), under contract to FDA and their two
reports: ``Economic Analysis of the Proposed Revisions to the Good
Manufacturing Practices Regulation for Medical Devices,'' and
``Addendum to the Final Report'' are on file at the Dockets Management
Branch (HFA-305), Food and Drug Administration, 12420 Parklawn Dr., rm.
1-23, Rockville, MD 20857.
The objective of this rule is to reduce the number of fatalities
and injuries attributable to defective medical devices. FDA finds that
private market incentives do not adequately reduce the risk of design-
related device failures because neither physicians nor consumers have
all of the information needed to make adequate judgments of product
quality and legal tort remedies are slow, inefficient, and extremely
costly.
The changes to the CGMP regulation will require manufacturers to
extend
[[Page 52644]]
their quality systems to include several new areas, such as design and
purchasing, and to clarify or expand selected existing requirements.
Several of the changes to the regulation make it more consistent with
ISO 9001:1994 quality standards. The rule will affect all medical
device establishments engaged in the design, manufacture, contract
sterilization, and packaging of medical devices.
This analysis presents the costs and benefits of the final CGMP
rule and reflects the differences between the proposed and final
regulation. The complete methodology and preliminary economic analysis
was presented in the November 1993 ERG report, ``Economic Analysis of
Proposed Revisions to the Good Manufacturing Practices Regulation for
Medical Devices''. While the proposed rule covered component
manufacturers, the cost of compliance for such manufacturers was
inadvertently omitted from the November 1993 ERG report. However, FDA
has decided not to cover component manufacturers, therefore most of the
preliminary analysis remains valid (e.g., estimates of labor and
resource requirements, level of compliance, and number of firms remain
the same for the final analysis, except where noted).
Based on the ERG study, the total annual incremental costs to the
U.S. industry of the final CGMP regulation are estimated to be about
$81.9 million. These costs are more than offset, however, by benefits
to public health and by economic benefits to the medical device
industry. FDA estimates that the benefits to public health will include
36 to 44 fewer deaths and 484 to 677 fewer serious injuries per year,
which are attributed to design-related device failures. Studies on the
value of a statistical-life have reported estimates ranging from $1.6
million to $8.5 million.1 Assuming an economic value of $5 million
per fatality avoided, the monetary value of saving 36 to 44 lives each
year will be $180 to $220 million. Therefore, the value of the public
health benefits of preventing deaths alone easily exceeds the cost of
compliance even without estimating benefits from a reduced number of
serious injuries. Moreover, additional economic benefits to medical
device establishments will result from cost savings due to fewer
design-related product recalls, better product quality, and greater
productivity. In addition, medical device establishments exporting to
the EU will greatly benefit from the harmonization of the CGMP
regulation with the ISO 9001:1994 quality standards. Because the EU is
adopting ISO 9001:1994 as a basis for its medical device manufacturing
quality system, the harmonization of the two quality requirements will
eliminate the need for device manufacturers to maintain different
quality systems for each market.
---------------------------------------------------------------------------
1 Fisher, A.; Chestnut, L.; and Violette, D. (1989). ``The
Value of Reducing Risks of Death: A Note on New Evidence.'' Journal
of Policy Analysis and Management, 8 (pp. 88-100).
---------------------------------------------------------------------------
FDA supports the international harmonization of standards and
regulations governing medical devices and the eventual mutual
recognition of CGMP inspections between major device markets. While
full achievement of this goal is still in the future, the harmonization
of quality standards is an important first step.
FDA believes in a step wise approach toward harmonization and
eventual mutual recognition. For CGMP inspections or Quality System
Conformity Assessments, these goals comprise four basic steps. First,
the harmonization of quality system requirements is a fundamental
building block of all future work in this area. FDA believes that by
working with the GHTF, specifically Study Group #3 of the GHTF, it has
developed a final rule that incorporates the harmonized quality system
requirements which are recognized around the world. Second is the
harmonization of regulatory auditing or compliance inspections. This
work is currently underway in the GHTF in Study Group #4, which has
developed one draft document entitled ``Guidelines For Regulatory
Auditing Quality Systems of Medical Device Manufacturers,'' expected to
be finalized in 1997. The third step is for harmonization of the
policy, interpretation, and regulatory consequences of noncompliance
with the quality system requirements in this rule and in counterpart
requirements of other countries. Underlying these activities is an
ongoing need for confidence building between the parties working
towards mutual recognition. FDA believes that this regulation will
provide a sound foundation for the goal of mutual recognition of
inspections, a goal that will benefit industry, as well as the agency.
The Health Industry Manufacturers Association has stated that
reciprocity for quality assurance inspections could save the medical
device industry millions of dollars as well as provide significant
savings to governments.2
---------------------------------------------------------------------------
2 Gilmartin, R.V. (1992). ``The Benefits of Cooperation for
Industry and Regulators Alike: A Global Perspective.'' Presented at
the Third Annual Global Medical Device Conference, October 2.
---------------------------------------------------------------------------
For individual establishments, the economic impact of the
regulation will depend on a number of factors, such as the level of
current compliance, the type of activities performed at the
establishment, and the nature of the product. On average, the smaller
establishments will bear a relatively greater economic burden.
B. Industry Profile
Firms in the medical device industry are heterogeneous. They vary
in size, product type, product and process technology, and rate of new
product introductions. There are over 7,000 medical device
establishments involved in the production of approximately 4,000
different types of devices (Table 1). Sixty-two percent of these
establishments are very small (fewer than 20 employees), while 27
percent are of medium-size (20 to 99 employees), 7 percent are large
(100 to 249 employees), and 4 percent are very large (250 or more
employees). These size categories were developed to reflect size
categories within the medical device industry and differ from the Small
Business Administration definition. Under the Small Business
Administration definition, over 98% of all establishments would be
small.
Table 1.--Distribution of Affected Establishments by Employment Size
----------------------------------------------------------------------------------------------------------------
Employment size \2\
--------------------------------------------------------
Type of establishment Total \1\ Small (1- Medium (20- Large (100- Very large (250)
----------------------------------------------------------------------------------------------------------------
Design and Production Manufacturer........ 5,415 3,323 1,414 415 265
Contract manufacturer..................... 419 257 109 32 20
Specification developer................... 541 352 162 27 0
Repacker/relabeler........................ 828 538 248 41 0
[[Page 52645]]
Contract sterilizer....................... 34 22 10 2 0
---------------------------------------------------------------------
Total............................... 7,237 4,492 1,943 517 285
----------------------------------------------------------------------------------------------------------------
\1\ Based on data from FDA's Registration and Listing Branch, 1992, adjusted to reflect 13 percent not required
to register and 6 percent exempt from CGMP requirements.
\2\ ERG (1993), Section 3.
C. Comments to November, 1993 Proposed Changes to the CGMP Regulation
A small percentage of the public comments on the November 1993
proposed regulation addressed the economic impact analysis. The
majority of these comments made very general, nonspecific observations
and therefore cannot be addressed directly. Many of these comments
stated that FDA underestimated the regulatory burden that the proposed
CGMP regulation would place on medical device manufacturers. Others
stated that their companies would expend more than the per
establishment estimated costs; some discussed the hiring of additional
personnel to address the compliance requirements.
In developing the cost estimates for the 1993 proposal, ERG
attempted to describe the labor hours (and associated costs) needed to
achieve an acceptable minimum level of compliance with each
requirement. These estimates took into account the incremental labor
and capital resources that would be needed to progress from the
existing compliance level to the new level required by the proposal.
For individual establishments, the economic impact of the CGMP
regulation would depend on a number of factors, such as the level of
current compliance, the type of activities performed, and the nature of
the product. Not surprisingly, those establishments that currently
undertake relatively few of the activities to be required would incur
greater compliance costs than the averages presented.
In the final rule, FDA has eliminated or modified several
requirements to give medical device establishments greater flexibility
in selecting compliance methods. In general, the words ``where
appropriate'' were added to many requirements to make them less
prescriptive and allow establishments to determine if or when they are
appropriate for their product. For example, in Sec. 820.65
Traceability, the final requirement allows the manufacturer to identify
which components require traceability. In addition, many procedures may
not need to be changed, only documented. To further minimize compliance
costs, FDA intends to provide additional guidance materials. The DSMA
currently offers guidance materials and regional seminars on CGMP
matters.
1. Health Industry Manufacturers Association (HIMA)
HIMA commented that FDA understated the costs for personnel
training, maintenance of new systems, documentation revisions, and
operational costs.
ERG agrees that it did not fully address the initial training
requirements in the cost analysis for the proposed CGMP regulation. New
costs for initial training were included in the cost analysis for the
final CGMP regulation. However, the existing CGMP regulation requires
periodic training of personnel. Therefore no incremental costs for
periodic training were estimated.
ERG did not change its cost estimate for quality system maintenance
and procedure revisions. Estimates were made for the incremental
compliance costs associated with an annual review of each new
procedure, but these procedures would be revised only sporadically and
probable estimates of their future costs would be small and could not
be reasonably quantified.
ERG recognized that companies will incur incremental costs to use
new procedures. Although a separate estimate of these operational costs
was not made, they were incorporated into the estimates of the
individual requirements where applicable.
2. Other General Comments
Some manufacturers of low-risk devices and some that have never
experienced a product recall or MDR event questioned the merit and
benefits of applying design controls to all products. In the proposed
and final CGMP regulation, FDA exempted almost all class I devices
because the public health benefits gained did not exceed the costs of
implementation. However, FDA believes that all class II and III devices
should be covered because their failure could adversely affect public
health. Even firms with excellent past records put their consumers at
future risk if their design systems are inadequate. ERG estimates that
strict compliance to the final CGMP regulation will avert about 43
deaths and over 600 serious injuries per year. In addition, the
literature on quality systems consistently states that firms
implementing such systems, which begin with design controls, report
cost savings in the long-run.
A number of comments argued that the proposed CGMP regulation would
slow product innovation and increase health care costs. FDA believes
that the gains from improvements in quality control and greater
efficiencies will lessen the impact on both innovation and health care
costs and will not lower the innovation rate for products with
significant medical benefit. Manufacturers will also avoid the costs of
most design-related medical device recalls. ERG estimated that design-
related recalls cost industry approximately $40 million per year.
Health care spending overall will also decrease as deaths, injuries and
malfunctions from medical device failures decrease.
Some comments suggested that the proposed CGMP regulation would
hurt the domestic medical device industry's competitiveness and
encourage companies to move their operations to foreign countries. FDA
has sought to harmonize the final CGMP regulation with ISO 9001:1994
and ISO/CD 13485. Some comments had stated they would like to see even
greater harmonization in the final regulation. The harmonization of
regulatory requirements will benefit medical device establishments
because they will be able to maintain a single regulatory compliance
program. The harmonization of CGMP requirements is also a first step in
developing mutual recognition agreements between U.S. and foreign
governments. An FDA sponsored survey of innovative medical
[[Page 52646]]
device companies found that nearly 65 percent of them sold their
products outside the United States, including 40 percent of the small
and 70 percent of the medium-sized companies.3 Thus, a majority of
firms should benefit from harmonization efforts. Since foreign firms
exporting their products to the United States must comply with the U.S.
CGMP regulation, they will incur essentially the same incremental costs
to comply with the final CGMP regulation as domestic establishments.
---------------------------------------------------------------------------
\3\ ERG (1994). FDA Survey of Establishments Introducing New
Medical Devices. (Task Order 3, Contract No. 223-91-8100.)
---------------------------------------------------------------------------
3. Small Business Concerns
Some comments representing small businesses were concerned about
the increase in procedural and documentation requirements. The
procedures and paperwork requirements will be simpler for small medical
device establishments relative to larger firms. Further, small
businesses can reduce compliance costs by using FDA guidance and
training materials, industry-generated guidance, and other technical
assistance that is available. FDA is preparing an extensive range of
technical support regarding the final CGMP regulation, including
guidance documents, workshops, and other materials and presentations.
Several small businesses argued that the regulatory costs fall
disproportionately on small business, hindering industry growth. The
regulatory requirements apply equally to whoever is designing and
developing new devices. However, the vast majority of firms are small
and medium in size and these firms are least likely to have such design
control procedures already in place. As a result, their incremental
costs may be higher. Nevertheless, because procedures reflect the
complexity of the processes they guide, small and medium-sized
establishments should incur proportionately lower gross compliance
costs for those activities than larger establishments.
4. Section 820.22 Quality audit
Some comments believed that requiring quality audits to be
performed by individuals without direct responsibility for the matters
being audited poses a severe burden for small business. This
requirement is already present in the original CGMP regulation and thus
was not addressed in the economic analysis of the final regulation.
5. Section 820.25 Personnel
Comments stated that the requirement to maintain files on
consultants was onerous and interfered with manufacturers' selection
processes. FDA modified this requirement and moved it to Sec. 820.50
Purchasing, in the final CGMP regulation. Companies will now be
required to verify that consultants meet specified requirements and
define the type and extent of control they will exercise over them. The
incremental compliance costs were judged to be negligible.
6. Section 820.30 Design control
Comments believed that the requirement stipulating that devices be
sampled from three production runs before a device is released for
routine distribution was too prescriptive and burdensome. FDA has
modified the requirement in the final rule to require design validation
of initial production units, lots, or batches, or their equivalent.
This modification should give manufacturers greater flexibility in
implementing this requirement.
Some comments from small businesses were critical of the
requirement that independent personnel perform design reviews and
stated that they will have to hire outside engineers for this task. In
the final rule FDA allows greater flexibility and states that the
independent personnel can be individual(s) who do not have direct
responsibility for the design stage being reviewed. Thus, staff
personnel (including engineers working on other components of the
device and nonengineering personnel) can perform design reviews.
7. Section 820.40 Document control
Some comments believed that the cost of implementing documentation
systems and other paperwork was understated. However, ERG's estimates
included the incremental compliance costs for formalizing a written
document control procedure and ERG considered paperwork requirements in
its estimation. The final rule also extends document control
requirements to the design phase and cost estimates for these
requirements were added to the economic assessment.
Most companies consider document control procedures to be essential
and have realized some benefits from such procedures, typically in the
form of efficiency gains and avoided documentation mixups. These
potential benefits were not quantified.
8. Section 820.50 Purchasing control
Comments questioned the need to establish the quality of materials
purchased from long-established suppliers or from new suppliers of
small quantities of components. Historical records, however, even for
suppliers of small quantities, can be used to assess a supplier's
quality. Supplier audits are not mandated in the CGMP regulation, but
may be a useful tool in assessing a supplier's capabilities. Cost
estimates for auditing from one- half to four new suppliers per year
for small to very large establishments were included in the economic
assessment.
9. Section 820.80 Receiving, in-process, and finished device
acceptance
One comment believed that requiring manufacturers to retain the
quantitative results of testing was excessive. The final rule
stipulates that ``the results'' of acceptance activities are to be
recorded, but does not specify that all quantitative results must be
recorded. Because this requirement is consistent with current industry
practices, incremental costs were not assigned to this section.
10. Section 820.90 Nonconforming product
Comments noted that identifying a product as ``reprocessed'' has a
negative impact on sales. (FDA now uses the term ``reworked''.) This
language was revised in the final rule to clarify that reworked devices
need to be identified as such at the manufacturing facility to avoid
mixups. No costs were estimated for this requirement.
D. Industry Costs
ERG estimated the total annual incremental cost of the final rule
at $81.9 million. This includes $9.5 million in one-time costs that
were annualized over 5 years at a 10 percent discount rate. Table 2
lists the most costly of the new requirements.
Costs were based on the incremental tasks each manufacturer must
perform to achieve compliance. ERG retained most of the methodology and
data from the proposed rule to estimate the costs of the final rule.
Where applicable, costs were estimated for additional or changed final
requirements. Also, the distribution of costs across establishment size
was modified to reflect new information on the rate of product
innovation.4 The rates of innovation per year used for this
analysis are: 0.4 percent for small, 1.3 percent for medium-sized, 2.6
percent for large, and 6.5 percent for very large establishments.
---------------------------------------------------------------------------
4 ERG (1994). FDA Survey of Establishments Introducing New
Medical Devices. (Task Order 3, Contract No. 223-91-8100).
[[Page 52647]]
Table 2.--Total Compliance Costs, by Most Costly Incremental Tasks
[$ millions]
----------------------------------------------------------------------------------------------------------------
Annual
Incremental tasks One-time -------------------------- Total
annualized Labor Nonlabor annualized
-----------------------------------------------------------------\1\--------------------------------------------
Design Controls:
Design Verification................................... NA 18.2 27.4 45.6
Design Review......................................... NA 6.2 NA 6.2
Design Changes........................................ NA 4.0 NA 4.0
Design and Development Planning....................... NA 1.2 NA 1.2
Other:
Quality Audit......................................... 0.5 4.7 NA 5.2
Evaluation of Suppliers and Contractors............... 0.6 1.9 0.9 3.4
Management Review..................................... NA 2.2 NA 2.2
Purchasing Data....................................... NA 1.1 NA 1.1
All Remaining............................................. 8.4 4.6 0.0 13.0
-----------------------------------------------------
Total for Final Regulation........................ 9.5 44.1 28.3 81.9
----------------------------------------------------------------------------------------------------------------
\1\ One-time costs annualized over 5 years at discount rate of 10 percent.
NA=Not Applicable.
Note: Totals may not add due to rounding.
Source: ERG (1996), Section 4.
The great majority of costs for all size establishments will be
associated with the establishment of design controls for new products.
Therefore, the more innovative establishments will experience greater
compliance costs than the less innovative establishments. The estimated
annual design control costs total $57.5 million, which represents 70
percent of the total annual incremental costs of compliance. The most
costly task within the design control category is design verification
($45.6 million), which includes design validation. Other costly tasks
are design review ($6.2 million), which encompasses conducting and
documenting design reviews; design changes ($4.0 million), which
includes documenting and maintaining design change procedures; and
design and development planning ($1.2 million), which includes
documenting and maintaining plans for device design and development.
The requirement for extending the quality system audit ($5.2 million)
and the evaluation of suppliers and contractors ($3.4 million) are also
relatively high cost items.
The estimated total cost of compliance for the final rule ($81.9
million) is $2.6 million less than the estimated cost of the November
1993 proposed rule ($84.5 million). Some cost increases were due to
added requirements for increased documentation. However, these cost
increases were offset partly by a decrease of $0.5 million from the
modification of some requirements (e.g. Secs. 820.65 Traceability and
820.160 Distribution). The remaining changes resulted from changes in
assumptions or new information about cost and compliance rates in
design control and supplier audits and from new information regarding
product innovation rates across establishment size.
The projected average cost per establishment (see Table 3) varies
substantially across industry sectors and establishment size
categories. As expected, the average incremental costs are largest for
establishments that design medical devices: design and production
manufacturers and specification developers. For these two sectors, the
average per establishment costs are $15,994 for design and production
manufacturers and $14,767 for specification developers. Actual per
establishment costs will vary substantially depending on the product
type, design complexity, innovation rate, and level of design control
currently in place. The average incremental costs for the other three
sectors are significantly lower: $3,554 for contract manufacturer,
$1,995 for repacker/relabeler, and $2,040 for contract sterilizer.
Table 3.--Average Total Annualized \1\ Costs Per Establishment by Type and Size
[Dollars]
----------------------------------------------------------------------------------------------------------------
Medium (20- Large (100- Very large (250) All
----------------------------------------------------------------------------------------------------------------
Design and Production Manufacturer.... 11,085 25,800 22,748 12,258 15,994
Specification Developer............... 9,927 24,052 20,583 NA 14,767
Contract Manufacturer................. 2,357 4,027 5,802 10,678 3,554
Repacker/Relabeler.................... 1,471 2,588 3,969 NA 1,995
Contract Sterilizer................... 1,491 2,621 3,999 NA 2,400
----------------------------------------------------------------------------------------------------------------
\1\ One-time costs annualized over 5 years at a discount rate of 10 percent.
NA=Not Applicable.
Source: ERG (1996), Section 6.
Because average current compliance rates tend to vary directly with
establishment size and there are relatively few large and very large
establishments (7 and 4 percent of all medical device establishments,
respectively), the largest share of the costs are incurred by small
establishments, $35.2 million (43
[[Page 52648]]
percent) and medium-size establishments, $34.5 million (42 percent),
while the smallest share is incurred by very large establishments, $3.4
million (4 percent) (see Table 4).
Table 4.--Total Annualized Costs by Size Category
[$ millions]
----------------------------------------------------------------------------------------------------------------
Annual
Establishment size One-time -------------------------- Total
annualized Labor Nonlabor annualized
-----------------------------------------------------------------\1\--------------------------------------------
Small (1-19).............................................. 4.9 18.2 12.1 35.2
Medium (20-99)............................................ 3.0 18.2 13.3 34.5
Large (100-249)........................................... 1.0 5.1 2.8 8.8
Very large (250)............................... 0.7 2.6 0.1 3.4
All establishments........................................ 9.5 44.1 28.3 81.9
----------------------------------------------------------------------------------------------------------------
\1\ One-time costs annualized over five years at discount rate of 10 percent.
Note: Totals may not add due to rounding.
Source: ERG (1996), Section 4.
E. Benefits From Proposed Changes to the CGMP Regulation
ERG used the methodology and data from the proposed rule to
estimate the benefits of the final CGMP regulation. Adjustments to the
number and distribution of MDR's were made based on updated numbers of
closed cases. Also, more reliable estimates of industry savings from
avoided design-related recalls were incorporated.
The changes to the CGMP regulation will provide public health
benefits to medical device users and economic benefits to the medical
device industry. Based on its review of medical device recalls over the
4-year period 1988 to 1991, FDA has estimated that 30 percent of all
medical device product recalls are due to inadequate design controls.
It is extremely difficult to judge how many of these recalls could
reasonably have been avoided, but ERG judged that a majority would have
been prevented if manufacturers had fully implemented the CGMP design
control requirements.
1. Public Health Benefits
ERG used the MDR database to estimate the public health benefits of
the final CGMP regulation. There were over 41,600 MDR's submitted to
FDA in 1991; 97 percent of these MDR's are closed (i.e., a review of
the case is completed). Of these closed cases, FDA determined that 9.3
percent of the fatalities and 12.4 percent of the serious injuries were
due to device failures. The bulk of the remaining incidents were due to
user problems, but also include cases where cause could not be clearly
established. To estimate the total number of deaths and serious
injuries for 1991 by cause, the 1988-1991 averages of device recalls
were used. To estimate the number of deaths and serious injuries due to
design-related causes, ERG assumed that the percent of MDR's that were
design-related was the same as that for recalls (30 percent).5
Based on these assumptions, medical devices contributed to an estimated
49 fatalities and 663 serious injuries in 1991 due to design-related
problems in class II and III devices (see Table 5). To correct for the
substantial under reporting of MDR's, ERG made an upward adjustment in
the number of MDR's of 20 percent for fatalities and 40 percent for
serious injuries. The number of estimated fatalities adjusted for
underreporting of MDR's would be 59, with 929 serious injuries.
---------------------------------------------------------------------------
\5\ There is no code in the MDR database to identify design-
related events.
Table 5.--Number of Design-Related Reports and Estimated Avoided Deaths and Serious Injuries
----------------------------------------------------------------------------------------------------------------
Fatalities Serious Injuries
-----------------------------------------------------------------------
Class II Class III Total Class II Class III Total
----------------------------------------------------------------------------------------------------------------
Number in 1991.......................... 555 475 1,030 4,391 11,794 16,185
Device-related.......................... 105 59 164 330 1,881 2,211
Design-related \1\...................... 32 18 49 99 564 663
Number avoided.......................... 23 13 36 72 412 484
Adjusted number of design-related MDR's
\2\.................................... 38 21 59 139 790 929
Adjusted Number avoided................. 28 15 43 101 576 677
----------------------------------------------------------------------------------------------------------------
\1\ Assumes 30 percent of device-related MDR's are design-related, based on FDA recall data.
\2\ Total number of fatalities and injuries increased by 20 and 40 percent, respectively, to adjust for under-
reporting.
Source: ERG (1996), Section 5.
To develop an approximate idea of the preventability of these
incidents, ERG convened a panel of industrial engineers and regulatory
specialists with extensive experience in the design of medical devices.
The panel examined a random sample of 100 design-related medical device
recalls and judged whether implementation of design controls could have
prevented the recall. ERG found that the expected value of their
judgments implied that proper design controls would have prevented
about 73 percent of these recalls. Assuming the same preventability
ratio for design-related MDR events, ERG calculated that the proposal
would prevent about 36 to 43 deaths and 484 to 677 serious injuries per
year, depending on the degree of MDR underreporting.
To verify the reasonableness of the estimates, FDA examined an
alternative method of estimating the number of
[[Page 52649]]
fatalities caused by design-related failures. For this calculation, 3
years of design-related recalls were assumed linked to MDR fatalities
that occurred for these devices 1 year before or 3 months after the
date of the recall. This approach, which provides a conservative
estimate because not all relevant fatalities and subsequent MDR's would
occur during this limited time period, found that about 60 deaths per
year were due to design-related device failures. If 73 percent of such
incidents could be avoided through compliance with the proposed CGMP
regulation, 44 deaths per year would be prevented.
These estimates of the public health benefits from fewer design-
related deaths and serious injuries represent FDA's best projections,
given the limitations and uncertainties of the data and assumptions.
The above numbers, however, do not capture the quality of life losses
to patients who experience less severe injuries than those reported in
MDR's, who experience anxiety as a result of treatment with an
unreliable medical device, or who experience inconvenience and
additional medical costs because of device failure.
Medical device malfunctions are substantially more numerous than
deaths or injuries from device failures and also represent a cost to
society. Malfunctions represent a loss of product and an inconvenience
to users and/or patients. Additionally, medical device malfunctions
burden medical personnel with additional tasks, such as repeating
treatments, replacing devices, returning and seeking reimbursement for
failed devices, and providing reports on the circumstances of medical
device failures. No attempt was made to quantify these additional
costs.
2. Industry Benefits
The medical device industry would gain substantial economic
benefits from the proposed changes to the CGMP regulation in three
ways: Cost savings from fewer recalls, productivity gains from improved
designs, and efficiency gains for export-oriented manufacturers who
would now need to comply with only one set of quality standards.
An average of 359 medical device recall events per year were
reported to FDA over the period 1988 to 1991. As stated above, FDA
estimates that design-related deficiencies contributed to 30 percent of
those recall events annually. Applying the 73 percent recall
preventability factor, ERG projects that there would be 67 fewer
recalls of class II and III devices each year under the final CGMP
regulation (see Table 6). Based on data from a recent survey of recall
costs, 67 fewer recalls implies that the industry would avoid roughly
$29 million worth of recall expenses per year by complying with the
final CGMP regulation.6
---------------------------------------------------------------------------
6 Design-related medical device recalls cost the industry
approximately $40 million annually. (Eastern Research Group, Inc.
(1994). FDA Survey of Medical Device Recall Costs. (Task Order 3,
Contract Number 223-91-8100).
Table 6.--Number of Avoided Design-Related Recall Events by Class of
Device
[FY 1988-FY 1991]
------------------------------------------------------------------------
Average Number of
number of avoided
design- design-
Device class related related
recall recall
events\1\ events\2\
------------------------------------------------------------------------
I................................................. 15 NA
II................................................ 80 58
III............................................... 12 9
---------------------
All Devices..................................... 107 67
------------------------------------------------------------------------
\1\ Office of Compliance and Surveillance, CDRH.
\2\ ERG estimates based on random sample of 100 design-related recalls.
Source: ERG (1996), Section 5.
ERG also found that the design control requirements in the final
CGMP regulation would require manufacturers to integrate their design
and production operations and that most industry experts believe that
this change would lead to better quality products, more efficient
engineering, lower manufacturing costs, and reduced product development
time. These savings, however, could not be quantified.
Still another benefit of the revised regulation relates to the
harmonization of the final CGMP regulation with the ISO 9001:1994
international standard. This change would especially benefit export-
oriented establishments, because they would need to meet only one set
of quality standards. ERG could not derive quantitative measures of
this benefit. However, 65 percent of innovative medical device
companies export their products, thus a majority should benefit from
harmonization of CGMP regulation between major trading partners.7
---------------------------------------------------------------------------
7 ERG (1994). FDA Survey of Establishments Introducing New
Medical Devices. (Task Order 3, Contract No. 223-91-8100.)
---------------------------------------------------------------------------
F. Economic and Small Business Impact
The ability of medical device establishments to pass on the added
cost of the final regulation will determine the economic impact to the
industry. The diversity of medical devices precludes any easy
characterization of their product markets. Under the current medical
care system, however, the demand for many medical devices tends to be
price inelastic because they are often prescribed by physicians and
frequently paid for by third parties. Thus, small price increases have
not typically prompted significant declines in industry sales.
Nonetheless, competitive pressures have increased substantially under
new health care cost-containment measures. Therefore, to examine the
potential effect of the costs of compliance on the industry's
competitive structure, ERG calculated the maximum impact on industry
average prices and products, using extreme scenarios. Financial data
characterizing the scope of FDA-regulated medical device establishments
are not available. To make estimates of the regulatory impact on price
and profits, ERG used a combination of census and Dun and Bradstreet
data (see ERG (1993) for methodology). ERG assumed that the firms
characterized in these data sources had the same size and product
distribution, and introduced new products at the same rate as the
population of FDA-regulated establishments. While the validity of these
assumptions is uncertain, it was the only data available to measure
regulatory impact. ERG presents two extreme scenarios, the first
reflects the magnitude of the potential impact on product prices if all
costs were passed forward. The second demonstrates the maximum drop in
profits if no costs were passed forward. In reality, some combination
of these scenarios will occur.
Based on the assumption that all costs of compliance are passed
through to the end user, with no loss in sales and no offset for
avoided recalls or other industry productivity gains, ERG found that
the average increase in the price of medical devices would be less than
0.13 percent. Estimated price increases ranged from 0.04 percent for X-
Ray Apparatus and Tubes (SIC 3844) to 0.34 percent for Dental Equipment
and Supplies (SIC 3843) (see Table 7). The maximum price increase was
calculated using aggregate compliance costs as a percentage of the
value of shipments. The price increases calculated by size of
establishment suggest that small establishments will be under greater
pressure to increase prices. The cost of compliance represented an
average of 1.36 percent of the value of shipments for small
establishments and 0.01 percent for very large establishments. These
differences in impacts by size reflect the finding that small
[[Page 52650]]
establishments have lower current compliance than large establishments.
To estimate the potential impact of compliance costs on medical
device industry profits, ERG calculated after-tax compliance costs as a
percentage of after-tax income for each medical device SIC (see Table
7). Again, no adjustments were made for avoided recalls or expected
productivity gains. If manufacturers have no ability to increase prices
to offset the increase in compliance costs, this estimate represents an
upper bound of the potential effect on entity income. Under these
circumstances, the medical device sectors could incur reductions in
income ranging from about 0.81 percent (SIC 3845, Electromedical
Equipment) to about 4.27 percent (SIC 3843, Dental Equipment and
Supplies). ERG concluded that such impacts may affect some
establishments' decisions to develop new products where expected
profits are marginal or highly uncertain, but judged that the level of
incremental costs imposed by this regulation would not substantially
lower the innovation rate especially for products with significant
medical benefits.
Table 7.--Maximum Potential Impact on Price or Profits by Industry and
Employment Size
------------------------------------------------------------------------
Total
annualized After-tax
compliance compliance
costs as a costs as a
percentage percentage
of of after-
shipments tax income
------------------------------------------------------------------------
Industry:
3841 Surgical and medical instruments......... 0.12 2.00
3842 Surgical appliance and supplies.......... 0.14 1.78
3843 Dental equipment and supplies............ 0.34 4.27
3844 x-ray apparatus and tubes................ 0.04 0.88
3845 Electromedical equipment................. 0.05 0.81
3851 Ophthalmic goods......................... 0.24 3.54
All........................................... 0.13 1.87
Establishment size:
Small (1-19).................................. 1.36 NA
Medium (20-99)................................ 0.35 NA
Large (100-249)............................... 0.09 NA
Very large (250)................... 0.01 NA
All........................................... 0.13 NA
------------------------------------------------------------------------
NA = not available.
Source: ERG (1996), Section 6.
The Regulatory Flexibility Act requires agencies to analyze
regulatory options that would minimize any significant impact of a rule
on small entities. This section together with other discussions in this
preamble and supporting analysis and materials constitute the agency's
regulatory flexibility analysis. A description of the projected
reporting, recordkeeping, and compliance requirements including the
type of professional skills required is included in the ERG economic
analysis reports that are referenced above and on file at the Dockets
Management Branch (address above). In accordance with the Regulatory
Flexibility Act, FDA has considered the effect of this action on small
businesses and has determined that there will be a significant impact
on a substantial number of small businesses. Almost all medical device
establishments are classified as small under the Small Business
Administrations definition of size.8 The incremental costs are
greatest for establishments that design medical devices and that
currently have lower levels of compliance with the new design control
requirements. These requirements account for 70 percent of the total
incremental costs of the final rule but affect only design and
production manufacturers and specification developers (82 percent of
the total affected establishments). Other sectors of the industry will
incur substantially lower costs (see Table 3).
---------------------------------------------------------------------------
8 The Small Business Administrations definition is by the
employment size at the company level. Detailed demographic and
financial data is not available by company size, therefore FDA used
establishment data. FDA does not know the impact on companies.
---------------------------------------------------------------------------
The actual added cost per establishment will vary by the
establishment's current level of compliance, complexity of product
design, product type, and rate of product innovation. As indicated in
Table 3, the average medium-size and large manufacturers of devices
will incur greater compliance costs ($25,800 and $22,748 per
establishment, respectively) relative to small and very large
establishments ($11,085 and $12,258, respectively). However, the
potential impact on product price (measured as a percent of the value
of shipments) is greatest for small (1.36 percent) and medium-size
(0.35 percent) establishments. Large and very large establishments will
incur only a 0.09 percent and 0.01 percent increase, respectively, due
to much larger values of shipments and higher rates of compliance with
the final rule. Smaller establishments producing differentiated
products or marketing to niche markets may not be at a disadvantage
because of their ability to pass on the added cost of compliance.
However, those smaller establishments that compete with larger
establishments based on price alone would suffer a drop in profits if
they currently operate at lower levels of compliance than their
competitors.
FDA believes that actual per establishment compliance costs will be
lower than estimated for the following reasons: First, the final CGMP
regulation closely parallels the ISO 9001:1994 quality standards, which
have been adopted as the quality standard for the EU and are becoming
the international quality standards for medical devices. Close to 65
percent of domestic medical device manufacturers export their products
and generate approximately one-third of their sales from exports.9
Compliance with the quality control requirements is necessary for firms
to maintain international competitiveness and in fact many U.S. medical
device manufacturers have become ISO certified since the 1993
publication of the proposed CGMP regulation and the EU implementation
of unified regulatory requirements.
---------------------------------------------------------------------------
9 ERG (1994). FDA Survey of Establishments Introducing New
Medical Devices. (Task Order 3, Contract No. 223-91-8100.)
---------------------------------------------------------------------------
Second, the FDA has extended the effective date of the final rule
to June 1, 1997, and has chosen not to take regulatory action for an
additional year on the design control requirements. This revised
effective date will also reduce the cost of implementation estimated
for the 1993 proposal where the proposed effective date was only 180
days after date of publication. The extension will give manufacturers a
longer time to implement the new requirements, allowing the costs to be
spread over almost a 2-year period as compared to 180 days. June 1998
coincides with the implementation of the EU's Inactive Medical Device
Directive. Therefore, the economic impact of complying with the new
quality system regulation will be shared with the economic impact of
complying with the new EU Medical Device Directive for any manufacturer
who also produces devices for sale in the EU, lessening the direct
impact of the new quality system regulation.
Third, ERG estimates of the number of labor hours needed for design
controls assume that many establishments have little or no formal
system in place. Once an establishment has developed a system, minor
modifications to an establishment's existing product (for which many
510(k) applications and PMA supplements are submitted) may be less
costly than ERG assumed.
[[Page 52651]]
Finally, cost estimates assume that establishments will use in-
house expertise or hired consultants for all compliance activities. In
fact, FDA and trade publications have disseminated much of the
information that would be needed by the firms. FDA has taken many steps
specifically to assist small businesses in complying with this final
rule. The two stage implementation of the regulation was a concerted
effort to reduce the regulatory burden on small businesses. Stage 1 was
set up to be a 1 year training and cooperative phase for the entire
medical device community. FDA and industry would be participating in a
number of cooperative efforts as well as joint training exercises. Most
importantly, FDA would be evaluating design controls and providing
industry with feedback in the nature of a report. During this time, to
truly allow it to be a learning experience for both the device
manufacturers and the FDA investigators, there would be no regulatory
actions taken as a result of these evaluations and reports. The biggest
benefactor of the two stage implementation would clearly be small
businesses.
Further, several guidances have been prepared by FDA for this
regulation as a whole, as well as on subject matters that are
significant in this final rule. FDA plans to release the following
three guidances within 60 days after the final rule is published: (1)
DSMA's ``Medical Device Quality Systems Manual: A Small Entity
Compliance Guide,'' which includes discussion on the entire regulation
plus multiple examples of procedures and forms that can be adopted and
modified by manufacturers; (2) ``Design Control Guidance For Medical
Device Manufacturers,'' which is intended to assist manufacturers in
understanding the intent of the design control requirements. Assistance
is provided by interpreting the language of the regulation and
explaining the underlying concepts in practical terms; and (3) ``Do It
By Design: An Introduction to Human Factors in Medical Devices,'' which
contains background information about human factors as a discipline,
descriptions and illustrations of device problems, and a discussion of
human factors principles and methods as a part of the design control
system. FDA also plans to release the following guidances after
publication of this final rule: (1) A guidance on ``Validation,'' which
will include discussions on design validation, computer validation, and
process validation; and (2) a draft of the ``Design Control
Inspectional Strategy,'' which will be the questions that FDA
investigators will be asking when assuring compliance with the design
control requirements.
FDA is also prepared to release shortly after publication of this
final rule a 4 hour series of videotapes discussing the Quality System
Regulation. The videotapes will also be accompanied by a guidebook
entitled ``The FDA and World Wide Quality System Requirements Guidebook
For Medical Devices.'' This guidebook will contain the entire Quality
System Regulation from FDA, the entire text of ISO 9001:1994, FDA
guidance from the regulation's preamble, and guidance on quality
systems from the GHTF.
FDA has also tentatively scheduled two teleconferences. The first
teleconference, which would be to discuss the Quality System Regulation
and answer questions that have come up from manufacturers beginning to
implement the regulation, is tentatively scheduled for December 1996. A
second teleconference is tentatively scheduled for April/May of 1997
and will specifically address design controls and the final Design
Control Inspectional Strategy. FDA is also exploring the possibility of
conducting regional workshops in May of 1997 to further discuss the
design control requirements and their implementation.
In addition to these activities, FDA and DSMA will continue to
provide guidance and workshops that can help small business with their
compliance activities, and will continue to participate in industry
association workshops, conferences, and meetings. While all of the
above-mentioned activities will be available to all manufacturers,
small manufacturers will benefit the most from these FDA activities
without having to pay substantial costs, as most of the guidance and
written material will be available on the world wide web, and the
teleconferences and other workshops sponsored or cosponsored by FDA
will be of nominal cost.
Finally, as described elsewhere in this preamble, FDA intends to
conduct a midcourse review of the new design control requirements
during the transition year (June 1997 to June 1998). Specifically, the
results of the first several months of design control inspections will
be reviewed by early 1998, and any midcourse adjustments to the
inspectional strategy will be instituted and made public by the Spring
of 1998. Also during this midcourse review FDA will evaluate the
information gathered at that point and determine if the design control
requirements as written in this final rule are appropriate to obtain
the goals expressed in this preamble. Any necessary adjustments or
proposed revisions will be published in the Federal Register and
comments will be solicited as necessary during the spring of 1998. This
implementation strategy is responsive to requests by industry for FDA
to harmonize the quality system regulation's implementation with the
mandatory date for implementation of the EU's Medical Device Directive,
which is June 1998. However, if during the midcourse review of stage
one it is determined that the industry and/or FDA needs more time to
fully implement the design control requirements, FDA will publish that
decision in the Spring of 1998 prior to the June 1, 1998, regulatory
implementation date.
Small businesses will also benefit in that FDA considered but
rejected applying design requirements to all class I devices, because
the added benefits to public health were not great enough to offset the
increased burden on industry. Two requirements were eliminated or
modified in the final rule that decreased the burden on industry: The
applicability of the CGMP regulation to component suppliers was
removed, and Sec. 820.65 Traceability was limited to traceability of
components where necessary to assure the protection of public health.
These changes will particularly aid small businesses. In addition,
revisions were made to many requirements in the final rule to make it
less prescriptive and to allow establishments greater flexibility in
implementing the requirements. Cost savings from these changes were not
estimated.
In addition, revisions were made to many requirements in the final
rule to make it less comprehensive in scope, less prescriptive and to
allow establishments greater flexibility in implementing the
requirements. Cost savings from these changes were not estimated. Based
on the above, the agency has determined that the current rule
represents the least burdensome alternative that meets the public
health goal of reducing deaths and serious injuries attributable to
defective medical devices.
In summary, FDA concludes that the estimated $81.9 million annual
incremental cost to comply with the final CGMP regulation is likely an
upward bound figure and that it would be substantially offset by
significant savings from avoided recalls and more importantly, the
avoidance of deaths and serious injuries due to design-related device
failures. FDA's estimate of public health benefits includes the
[[Page 52652]]
prevention of 36 to 44 deaths and 484 to 677 serious injuries annually.
Establishing design controls will also result in better designed and
higher quality devices and fewer device failures. This quality
improvement will in turn reduce the inconvenience and expense of
repetitive treatments or diagnoses. The agency also believes the actual
cost to comply with the final rule will be lower than estimated because
the industry compliance baselines used to estimate costs are from 1993.
Since that time, market pressures have induced many firms that export
to the EU to become ISO 9001:1994 certified. These firms would now be
in compliance with most of FDA's final CGMP regulation. Further, FDA
has provided continued education efforts over the past 15 years, to
mitigate industry costs.
IX. Paperwork Reduction Act of 1995
This final rule contains information collections that are subject
to review by OMB under the Paperwork Reduction Act of 1995 (Pub. L.
104-13). The title, description and respondents of the information
collection are shown below with an estimate of the annual incremental
increase in the recordkeeping burden that respondents must undertake to
achieve compliance with the final regulation.
Title: Medical Devices, Quality System Regulations, Current Good
Manufacturing Practice Requirements.
Description: This final quality system regulation amends and
revises the current good manufacturing practice requirements for
medical devices, set out at 21 CFR part 820. This final regulation
replaces quality assurance program requirements with quality system
requirements; adds design and purchasing controls; modifies the
critical device requirements; revises certain existing requirements,
such as validation and management responsibility, to clarify the intent
of the requirements; and harmonizes the CGMP regulations for medical
devices with quality system specifications in ISO 9001:1994 ``Quality
Systems-Model for Quality Assurance in Design, Development, Production,
Installation and Servicing.''
Description of Respondents: Business or other for-profit and small
businesses or organizations.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Total
Number of Annual Total annual Hours per operating and
CFR section record-keepers frequency of records record-keeper Total hours maintenance
recordkeeping costs
--------------------------------------------------------------------------------------------------------------------------------------------------------
820.20(a)............................................... 7,237 1 7,237 10.96 79,386 ..............
820.20(b)............................................... 7,237 1 7,237 4.88 35,285 ..............
820.20(c)............................................... 7,237 1 7,237 10.28 74,364 ..............
820.20(d)............................................... 7,237 1 7,237 16.49 119,305 ..............
820.20(e)............................................... 7,237 1 7,237 16.49 119,305 ..............
820.22(a)............................................... 7,237 1 7,237 52.03 376,507 ..............
820.25(b)............................................... 7,237 1 7,237 21.13 152,896 ..............
820.30(a)(1)............................................ 7,237 1 7,237 2.92 21,162 ..............
820.30(b)............................................... 7,237 1 7,237 9.91 71,718 ..............
820.30(c)............................................... 7,237 1 7,237 2.92 21,162 ..............
820.30(d)............................................... 7,237 1 7,237 2.92 21,162 ..............
820.30(e)............................................... 7,237 1 7,237 38.98 282,115 ..............
820.30(f)............................................... 7,237 1 7,237 62.37 451,342 $27,359,420
820.30(g)............................................... 7,237 1 7,237 62.37 451,342 ..............
820.30(h)............................................... 7,237 1 7,237 5.56 40,236 ..............
820.30(i)............................................... 7,237 1 7,237 28.77 208,173 ..............
820.30(j)............................................... 7,237 1 7,237 4.40 31,848 ..............
820.40.................................................. 7,237 1 7,237 11.76 85,081 ..............
820.40(b)............................................... 7,237 1 7,237 .............. .............. ..............
820.50 (a)(1) to (a)(3)................................. 7,237 1 7,237 31.12 225,240 898,500
820.50(b)............................................... 7,237 1 7,237 10.04 72,679
820.60.................................................. 7,237 1 7,237 0.54 3,914 ..............
820.65.................................................. 7,237 1 7,237 .............. .............. ..............
820.70 (a)(1) to (a)(5)................................. 7,237 1 7,237 .............. .............. ..............
820.70 (b)-(c).......................................... 7,237 1 7,237 .............. .............. ..............
820.70(d)............................................... 7,237 1 7,237 3.09 22,335 ..............
820.70(e)............................................... 7,237 1 7,237 .............. .............. ..............
820.70 (g)(1) to (g)(3)................................. 7,237 1 7,237 ..............
820.70(h)............................................... 7,237 1 7,237 .............. .............. ..............
820.70(i)............................................... 7,237 1 7,237 9.41 68,092 ..............
829.72(a)............................................... 7,237 1 7,237 5.83 42,165 ..............
820.72 (b)(1) to (b)(3)................................. 7,237 1 7,237 .............. .............. ..............
820.75(a)............................................... 7,237 1 7,23 72.79 20,172 ..............
820.75(b)............................................... 7,237 1 7,237 .............. .............. ..............
820.75(b)(2)............................................ 7,237 1 7,237 0.15 1,096 ..............
820.75(c)............................................... 7,237 1 7,237 0.15 1,096 ..............
820.80 (a)-(e).......................................... 7,237 1 7,237 .............. .............. ..............
820.86.................................................. 7,237 1 7,237 .............. .............. ..............
820.90(a)............................................... 7,237 1 7,237 6.11 44,217 ..............
820.90 (b)(1) to (b)(2)................................. 7,237 1 7,237 6.11 44,217 ..............
820.100 (a)(1) to (a)(7)................................ 7,237 1 7,237 20.06 145,144 ..............
820.100(b).............................................. 7,237 1 7,237 .............. .............. ..............
820.120................................................. 7,237 1 7,237 .............. .............. ..............
820.120(b).............................................. 7,237 1 7,237 .............. .............. ..............
820.120(d).............................................. 7,237 1 7,237 .............. .............. ..............
820.130................................................. 7,237 1 7,237 .............. .............. ..............
820.140................................................. 7,237 1 7,237 9.45 68,418 ..............
820.150 (a)-(b)......................................... 7,237 1 7,237 9.45 68,418 ..............
820.160 (a)-(b)......................................... 7,237 1 7,237 .............. .............. ..............
[[Page 52653]]
820.170 (a)-(b)......................................... 7,237 1 7,237 .............. .............. ..............
820.180................................................. 7,237 1 7,237 .............. .............. ..............
820.181 (a)-(e)......................................... 7,237 1 7,237 .............. .............. ..............
820.184 (a)-(f)......................................... 7,237 1 7,237 .............. .............. ..............
820.186................................................. 7,237 1 7,237 .............. .............. ..............
820.198 (a)-(c)......................................... 7,237 1 7,237 3.71 26,850 ..............
820.200(a) and 820.200(d)............................... 7,237 1 7,237 4.35 31,459 ..............
820.250................................................. 7,237 1 7,237 .............. .............. ..............
-----------------------------------------------------------------------------------------------
Totals.............................................. 7,237 1 7,237 487.50 3,527,901 28,257,920
--------------------------------------------------------------------------------------------------------------------------------------------------------
\1\ Incremental increase in hours and costs to achieve compliance with additional requirements.
Note: Totals may not add due to rounding
Under OMB information collection 0910-0073, which expired on June
30, 1995, there were 375,266 burden hours approved for recordkeeping
requirements currently contained in part 820 to include 114,882 burden
hours as a one time start up expenditure for 750 new firms. The
additional requirements contained in this final rule will add 3,527,901
burden hours to the burden, resulting in a total annual recordkeeping
burden of 3,903,167 hours. The 3,527,901 burden hours includes
1,433,579 burden hours for a one time start up expenditure for 7,237
manufacturers and 2,094,321 burden hours expended annually by 7,237
manufacturers.
The final rule estimate of recordkeeping burden includes about 9.6
times as many manufacturers with a one time start up expenditure, due
to the addition of the design control requirements, than did FDA's
estimate of the manufacturers that would have had a one time start up
expenditure under the old regulation. Further the recordkeeping burden
hour calculations for the new regulation were done under contract using
a more complex methodology involving the estimated noncompliance ratio
for small, medium, large, and very large manufacturers (as defined
above) times the number of manufacturers in each category and factors
in a rate of product innovation for new products, including 510(k)
devices. This methodology is more precise than the methodology
previously utilized. Therefore, it is very difficult to directly
compare the total burden hours in this final rule as compared to the
estimated burden hours filed for the old regulation which expired June
1995.
Approximately 85 percent of the additional burden hours for the
final rule are from the following four subparts of part 820: (1)
Subpart B--Quality System Requirements; (2) Subpart C--Design Controls;
(3) Subpart E--Purchasing Controls; and (4) Subpart J--Corrective and
Preventive Action. Over 45 percent of the 3,527,901 burden hours are
attributed directly to the addition of design control requirements. The
recordkeeping burden hours for design control are significant because
of the nature of the new requirements, as well as in response to
numerous comments on the 1993 and 1995 proposals. The comments
requested that the regulation focus on procedures required under design
control as compared to prescriptive requirements on the design
activities. The quality system requirements, as well as the corrective
and preventive action requirements combined are approximately 31
percent of the additional recordkeeping burden hours and were in
response to two major issues: (1) Most importantly, FDA had identified
these two areas as two of the top four deficiencies found during
inspections of the medical device industry, across all sizes of
manufacturers; and (2) numerous comments requested harmonization with
the ISO 9000 series standards. The involvement of management with
executive responsibility, the concept of a total quality system which
is a closed feedback loop system, and the practice of using that closed
loop system in taking appropriate corrective and preventive action is
paramount in ensuring that safe and effective medical devices are
available to the public. The purchasing control requirements and the
respective recordkeeping burden are approximately 8 percent of the
additional recordkeeping burden. Purchasing requirements were the
overwhelming choice of the medical device industry as compared to the
option of the final rule encompassing component manufacturers. See the
discussion in section V.7. of this document.
It is important to note that small manufacturers may comply with
this final rule with less procedures and paperwork than larger
manufacturers of the same product because the structure and interfaces
for a small manufacturer often require less documentation and
paperwork.
Although the November 23, 1993, proposed rule provided a 90 day
comment period under the Paperwork Reduction Act of 1980, and this
final rule incorporates the comments received, as required by 44 U.S.C.
section 3507(d), FDA is providing additional opportunities for public
comment under the Paperwork Reduction Act of 1995, which applies to
this final rule and was enacted after the expiration of the comment
period.
Therefore, the agency solicits public comment on the information
collection requirements in order to: (1) Evaluate whether the proposed
collection of information is necessary for the proper performance of
the functions of the agency, including whether the information will
have practical utility; (2) evaluate the accuracy of the agency's
estimate of the burden of the proposed collection of information,
including the validity of the methodology and assumptions used; (3)
enhance the quality, utility, and clarity of the information to be
collected; and (4) minimize the burden of the collection of information
on those who are to respond, including through the use of appropriate
automated, electronic, mechanical, or other technological collection
techniques or other forms of information technology, e.g., permitting
electronic submission of responses.
Individuals and organizations may submit comments on the
information collection requirements by December 6, 1996, and should
direct comments to FDA's Dockets Management Branch (address above).
Prior to the effective date of this final rule, FDA will publish a
notice in the Federal Register when the information collection
requirements in this rule are submitted for OMB approval, and again
when OMB makes a decision to approve, modify, or disapprove the
[[Page 52654]]
information collection requirements. Persons are not required to
respond to a collection of information unless it displays a currently
valid OMB control number.
X. Congressional Review
This final rule has been determined to be a major rule for purposes
of 5 U.S.C. 801 et seq., Subtitle E of the Small Business Regulatory
Enforcement Fairness Act of 1996 (Pub. L. 104-121). FDA is submitting
the information and reports as required by that statute.
XI. References
The following references have been placed on display in the
Dockets Management Branch and may be seen by interested persons
between 9 a.m. and 4 p.m., Monday through Friday.
1. ``Device Recalls: A Study of Quality Problems,'' FDA, Center
for Devices and Radiological Health, Rockville, MD 20857, HHS
Publication FDA 90-4235, January 1990.
2. ``FDA Medical Device Regulation From Premarket Review to
Recall,'' Office of Inspector General, Washington, DC, HHS
Publication OEI 09-90-00040, February 1991.
3. ``Software Related Recalls for Fiscal Years FY 83--FY 91,''
FDA, Center for Devices and Radiological Health, Rockville, MD
20857, May 1992.
4. ISO 9001:1994 ``Quality Systems-- Model for Quality Assurance
in Design, Development, Production, Installation, and Servicing.''
5. ISO draft revision of ISO/CD 13485 ``Quality Systems--Medical
Devices-- Supplementary Requirements to ISO 9001.''
6. Federal Register notice entitled ``Medical Devices; Current
Good Manufacturing Practices (CGMP) Regulations Document; Suggested
Changes; Availability,'' November 30, 1990 (55 FR 49644).
7. Federal Register notice entitled ``Medical Devices; Current
Good Manufacturing Practice (CGMP) Regulations; Proposed Revisions;
Request for Comments,'' November 23, 1993 (55 FR 61952).
8. Federal Register notice entitled ``Medical Devices; Working
Draft of the Current Good Manufacturing Practice (CGMP) Final Rule;
Notice of Availability; Request for Comments; Public Meeting,'' July
24, 1995 (60 FR 37856).
9. European Standard (EN) 46001 ``Quality Systems--Medical
Devices--Particular Requirements for the Application of EN 29001.''
10. ``Guidelines on General Principles of Process Validation,''
Center for Drugs and Biologics, and Center for Devices and
Radiological Health, FDA, Rockville, MD 20857, May 11, 1987.
11. ``Medical Devices; Early Warning of Problems Is Hampered by
Severe Underreporting,'' United States General Accounting Office,
Washington, DC, GAO/PEMD-87-1.
List of Subjects
21 CFR Part 808
Intergovernmental relations, Medical devices.
21 CFR Part 812
Health records, Medical devices, Medical research, Reporting and
recordkeeping requirements.
21 CFR Part 820
Medical devices, Reporting and recordkeeping requirements.
Therefore, under the Federal Food, Drug, and Cosmetic Act and under
authority delegated to the Commissioner of Food and Drugs, 21 CFR parts
808, 812, and 820 are amended as follows:
PART 808--EXEMPTIONS FROM FEDERAL PREEMPTION OF STATE AND LOCAL
MEDICAL DEVICE REQUIREMENTS
1. The authority citation for 21 CFR part 808 is revised to read as
follows:
Authority: Secs. 520, 521, 701 of the Federal Food, Drug, and
Cosmetic Act (21 U.S.C. 360j, 360k, 371).
2. Section 808.1 is amended by adding new paragraph (d)(10) to read
as follows:
Sec. 808.1 Scope.
* * * * *
(d) * * *
(10) Part 820 of this chapter (21 CFR part 820) (CGMP requirements)
does not preempt remedies created by States or Territories of the
United States, the District of Columbia, or the Commonwealth of Puerto
Rico.
* * * * *
PART 812--INVESTIGATIONAL DEVICE EXEMPTIONS
3. The authority citation for 21 CFR part 812 is revised to read as
follows:
Authority: Secs. 301, 501, 502, 503, 505, 506, 507, 510, 513-
516, 518-520, 701, 702, 704, 721, 801, 803 of the Federal Food,
Drug, and Cosmetic Act (21 U.S.C. 331, 351, 352, 353, 355, 356, 357,
360, 360c-360f, 360h-360j, 371, 372, 374, 379e, 381, 383); secs.
215, 301, 351, 354-360F of the Public Health Service Act (42 U.S.C.
216, 241, 262, 263b-263n).
4. Section 812.1 Scope is amended by revising the fourth sentence
of paragraph (a) to read as follows:
Sec. 812.1 Scope.
(a) * * * An IDE approved under Sec. 812.30 or considered approved
under Sec. 812.2(b) exempts a device from the requirements of the
following sections of the Federal Food, Drug, and Cosmetic Act (the
act) and regulations issued thereunder: Misbranding under section 502
of the act, registration, listing, and premarket notification under
section 510, performance standards under section 514, premarket
approval under section 515, a banned device regulation under section
516, records and reports under section 519, restricted device
requirements under section 520(e), good manufacturing practice
requirements under section 520(f) except for the requirements found in
Sec. 820.30, if applicable (unless the sponsor states an intention to
comply with these requirements under Sec. 812.20(b)(3) or
Sec. 812.140(b)(4)(v)) and color additive requirements under section
721.
* * * * *
5. Part 820 is revised to read as follows:
PART 820--QUALITY SYSTEM REGULATION
Subpart A--General Provisions
Sec.
820.1 Scope.
820.3 Definitions.
820.5 Quality system.
Subpart B--Quality System Requirements
820.20 Management responsibility.
820.22 Quality audit.
820.25 Personnel.
Subpart C--Design Controls
820.30 Design controls.
Subpart D--Document Controls
820.40 Document controls.
Subpart E--Purchasing Controls
820.50 Purchasing controls.
Subpart F--Identification and Traceability
820.60 Identification.
820.65 Traceability.
Subpart G--Production and Process Controls
820.70 Production and process controls.
820.72 Inspection, measuring, and test equipment.
820.75 Process validation.
Subpart H--Acceptance Activities
820.80 Receiving, in-process, and finished device acceptance.
820.86 Acceptance status.
Subpart I--Nonconforming Product
820.90 Nonconforming product.
Subpart J--Corrective and Preventive Action
820.100 Corrective and preventive action.
Subpart K--Labeling and Packaging Control
820.120 Device labeling.
820.130 Device packaging.
Subpart L--Handling, Storage, Distribution, and Installation
820.140 Handling.
820.150 Storage.
[[Page 52655]]
820.160 Distribution.
820.170 Installation.
Subpart M--Records
820.180 General requirements.
820.181 Device master record.
820.184 Device history record.
820.186 Quality system record.
820.198 Complaint files.
Subpart N--Servicing
820.200 Servicing.
Subpart O--Statistical Techniques
820.250 Statistical techniques.
Authority: Secs. 501, 502, 510, 513, 514, 515, 518, 519, 520,
522, 701, 704, 801, 803 of the Federal Food, Drug, and Cosmetic Act
(21 U.S.C. 351, 352, 360, 360c, 360d, 360e, 360h, 360i, 360j, 360l,
371, 374, 381, 383).
Subpart A--General Provisions
Sec. 820.1 Scope.
(a) Applicability.
(1) Current good manufacturing practice (CGMP) requirements are set
forth in this quality system regulation. The requirements in this part
govern the methods used in, and the facilities and controls used for,
the design, manufacture, packaging, labeling, storage, installation,
and servicing of all finished devices intended for human use. The
requirements in this part are intended to ensure that finished devices
will be safe and effective and otherwise in compliance with the Federal
Food, Drug, and Cosmetic Act (the act). This part establishes basic
requirements applicable to manufacturers of finished medical devices.
If a manufacturer engages in only some operations subject to the
requirements in this part, and not in others, that manufacturer need
only comply with those requirements applicable to the operations in
which it is engaged. With respect to class I devices, design controls
apply only to those devices listed in Sec. 820.30(a)(2). This
regulation does not apply to manufacturers of components or parts of
finished devices, but such manufacturers are encouraged to use
appropriate provisions of this regulation as guidance. Manufacturers of
human blood and blood components are not subject to this part, but are
subject to part 606 of this chapter.
(2) The provisions of this part shall be applicable to any finished
device as defined in this part, intended for human use, that is
manufactured, imported, or offered for import in any State or Territory
of the United States, the District of Columbia, or the Commonwealth of
Puerto Rico.
(3) In this regulation the term ``where appropriate'' is used
several times. When a requirement is qualified by ``where
appropriate,'' it is deemed to be ``appropriate'' unless the
manufacturer can document justification otherwise. A requirement is
``appropriate'' if nonimplementation could reasonably be expected to
result in the product not meeting its specified requirements or the
manufacturer not being able to carry out any necessary corrective
action.
(b) Limitations. The quality system regulation in this part
supplements regulations in other parts of this chapter except where
explicitly stated otherwise. In the event that it is impossible to
comply with all applicable regulations, both in this part and in other
parts of this chapter, the regulations specifically applicable to the
device in question shall supersede any other generally applicable
requirements.
(c) Authority. Part 820 is established and issued under authority
of sections 501, 502, 510, 513, 514, 515, 518, 519, 520, 522, 701, 704,
801, 803 of the act (21 U.S.C. 351, 352, 360, 360c, 360d, 360e, 360h,
360i, 360j, 360l, 371, 374, 381, 383). The failure to comply with any
applicable provision in this part renders a device adulterated under
section 501(h) of the act. Such a device, as well as any person
responsible for the failure to comply, is subject to regulatory action.
(d) Foreign manufacturers. If a manufacturer who offers devices for
import into the United States refuses to permit or allow the completion
of a Food and Drug Administration (FDA) inspection of the foreign
facility for the purpose of determining compliance with this part, it
shall appear for purposes of section 801(a) of the act, that the
methods used in, and the facilities and controls used for, the design,
manufacture, packaging, labeling, storage, installation, or servicing
of any devices produced at such facility that are offered for import
into the United States do not conform to the requirements of section
520(f) of the act and this part and that the devices manufactured at
that facility are adulterated under section 501(h) of the act.
(e) Exemptions or variances. (1) Any person who wishes to petition
for an exemption or variance from any device quality system requirement
is subject to the requirements of section 520(f)(2) of the act.
Petitions for an exemption or variance shall be submitted according to
the procedures set forth in Sec. 10.30 of this chapter, the FDA's
administrative procedures. Guidance is available from the Center for
Devices and Radiological Health, Division of Small Manufacturers
Assistance, (HFZ-220), 1350 Piccard Dr., Rockville, MD 20850, U.S.A.,
telephone 1-800-638-2041 or 1-301-443-6597, FAX 301-443-8818.
(2) FDA may initiate and grant a variance from any device quality
system requirement when the agency determines that such variance is in
the best interest of the public health. Such variance will remain in
effect only so long as there remains a public health need for the
device and the device would not likely be made sufficiently available
without the variance.
Sec. 820.3 Definitions.
(a) Act means the Federal Food, Drug, and Cosmetic Act, as amended
(secs. 201-903, 52 Stat. 1040 et seq., as amended (21 U.S.C. 321-394)).
All definitions in section 201 of the act shall apply to the
regulations in this part.
(b) Complaint means any written, electronic, or oral communication
that alleges deficiencies related to the identity, quality, durability,
reliability, safety, effectiveness, or performance of a device after it
is released for distribution.
(c) Component means any raw material, substance, piece, part,
software, firmware, labeling, or assembly which is intended to be
included as part of the finished, packaged, and labeled device.
(d) Control number means any distinctive symbols, such as a
distinctive combination of letters or numbers, or both, from which the
history of the manufacturing, packaging, labeling, and distribution of
a unit, lot, or batch of finished devices can be determined.
(e) Design history file (DHF) means a compilation of records which
describes the design history of a finished device.
(f) Design input means the physical and performance requirements of
a device that are used as a basis for device design.
(g) Design output means the results of a design effort at each
design phase and at the end of the total design effort. The finished
design output is the basis for the device master record. The total
finished design output consists of the device, its packaging and
labeling, and the device master record.
(h) Design review means a documented, comprehensive, systematic
examination of a design to evaluate the adequacy of the design
requirements, to evaluate the capability of the design to meet these
requirements, and to identify problems.
(i) Device history record (DHR) means a compilation of records
containing the production history of a finished device.
(j) Device master record (DMR) means a compilation of records
containing the procedures and specifications for a finished device.
[[Page 52656]]
(k) Establish means define, document (in writing or
electronically), and implement.
(l) Finished device means any device or accessory to any device
that is suitable for use or capable of functioning, whether or not it
is packaged, labeled, or sterilized.
(m) Lot or batch means one or more components or finished devices
that consist of a single type, model, class, size, composition, or
software version that are manufactured under essentially the same
conditions and that are intended to have uniform characteristics and
quality within specified limits.
(n) Management with executive responsibility means those senior
employees of a manufacturer who have the authority to establish or make
changes to the manufacturer's quality policy and quality system.
(o) Manufacturer means any person who designs, manufactures,
fabricates, assembles, or processes a finished device. Manufacturer
includes but is not limited to those who perform the functions of
contract sterilization, installation, relabeling, remanufacturing,
repacking, or specification development, and initial distributors of
foreign entities performing these functions.
(p) Manufacturing material means any material or substance used in
or used to facilitate the manufacturing process, a concomitant
constituent, or a byproduct constituent produced during the
manufacturing process, which is present in or on the finished device as
a residue or impurity not by design or intent of the manufacturer.
(q) Nonconformity means the nonfulfillment of a specified
requirement.
(r) Product means components, manufacturing materials, in- process
devices, finished devices, and returned devices.
(s) Quality means the totality of features and characteristics that
bear on the ability of a device to satisfy fitness-for-use, including
safety and performance.
(t) Quality audit means a systematic, independent examination of a
manufacturer's quality system that is performed at defined intervals
and at sufficient frequency to determine whether both quality system
activities and the results of such activities comply with quality
system procedures, that these procedures are implemented effectively,
and that these procedures are suitable to achieve quality system
objectives.
(u) Quality policy means the overall intentions and direction of an
organization with respect to quality, as established by management with
executive responsibility.
(v) Quality system means the organizational structure,
responsibilities, procedures, processes, and resources for implementing
quality management.
(w) Remanufacturer means any person who processes, conditions,
renovates, repackages, restores, or does any other act to a finished
device that significantly changes the finished device's performance or
safety specifications, or intended use.
(x) Rework means action taken on a nonconforming product so that it
will fulfill the specified DMR requirements before it is released for
distribution.
(y) Specification means any requirement with which a product,
process, service, or other activity must conform.
(z) Validation means confirmation by examination and provision of
objective evidence that the particular requirements for a specific
intended use can be consistently fulfilled.
(1) Process validation means establishing by objective evidence
that a process consistently produces a result or product meeting its
predetermined specifications.
(2) Design validation means establishing by objective evidence that
device specifications conform with user needs and intended use(s).
(aa) Verification means confirmation by examination and provision
of objective evidence that specified requirements have been fulfilled.
Sec. 820.5 Quality system.
Each manufacturer shall establish and maintain a quality system
that is appropriate for the specific medical device(s) designed or
manufactured, and that meets the requirements of this part.
Subpart B--Quality System Requirements
Sec. 820.20 Management responsibility.
(a) Quality policy. Management with executive responsibility shall
establish its policy and objectives for, and commitment to, quality.
Management with executive responsibility shall ensure that the quality
policy is understood, implemented, and maintained at all levels of the
organization.
(b) Organization. Each manufacturer shall establish and maintain an
adequate organizational structure to ensure that devices are designed
and produced in accordance with the requirements of this part.
(1) Responsibility and authority. Each manufacturer shall establish
the appropriate responsibility, authority, and interrelation of all
personnel who manage, perform, and assess work affecting quality, and
provide the independence and authority necessary to perform these
tasks.
(2) Resources. Each manufacturer shall provide adequate resources,
including the assignment of trained personnel, for management,
performance of work, and assessment activities, including internal
quality audits, to meet the requirements of this part.
(3) Management representative. Management with executive
responsibility shall appoint, and document such appointment of, a
member of management who, irrespective of other responsibilities, shall
have established authority over and responsibility for:
(i) Ensuring that quality system requirements are effectively
established and effectively maintained in accordance with this part;
and
(ii) Reporting on the performance of the quality system to
management with executive responsibility for review.
(c) Management review. Management with executive responsibility
shall review the suitability and effectiveness of the quality system at
defined intervals and with sufficient frequency according to
established procedures to ensure that the quality system satisfies the
requirements of this part and the manufacturer's established quality
policy and objectives. The dates and results of quality system reviews
shall be documented.
(d) Quality planning. Each manufacturer shall establish a quality
plan which defines the quality practices, resources, and activities
relevant to devices that are designed and manufactured. The
manufacturer shall establish how the requirements for quality will be
met.
(e) Quality system procedures. Each manufacturer shall establish
quality system procedures and instructions. An outline of the structure
of the documentation used in the quality system shall be established
where appropriate.
Sec. 820.22 Quality audit.
Each manufacturer shall establish procedures for quality audits and
conduct such audits to assure that the quality system is in compliance
with the established quality system requirements and to determine the
effectiveness of the quality system. Quality audits shall be conducted
by individuals who do not have direct responsibility for the matters
being audited. Corrective action(s), including a reaudit of deficient
matters,
[[Page 52657]]
shall be taken when necessary. A report of the results of each quality
audit, and reaudit(s) where taken, shall be made and such reports shall
be reviewed by management having responsibility for the matters
audited. The dates and results of quality audits and reaudits shall be
documented.
Sec. 820.25 Personnel.
(a) General. Each manufacturer shall have sufficient personnel with
the necessary education, background, training, and experience to assure
that all activities required by this part are correctly performed.
(b) Training. Each manufacturer shall establish procedures for
identifying training needs and ensure that all personnel are trained to
adequately perform their assigned responsibilities. Training shall be
documented.
(1) As part of their training, personnel shall be made aware of
device defects which may occur from the improper performance of their
specific jobs.
(2) Personnel who perform verification and validation activities
shall be made aware of defects and errors that may be encountered as
part of their job functions.
Subpart C--Design Controls
Sec. 820.30 Design controls.
(a) General. (1) Each manufacturer of any class III or class II
device, and the class I devices listed in paragraph (a)(2) of this
section, shall establish and maintain procedures to control the design
of the device in order to ensure that specified design requirements are
met.
(2) The following class I devices are subject to design controls:
(i) Devices automated with computer software; and
(ii) The devices listed in the following chart.
------------------------------------------------------------------------
Section Device
------------------------------------------------------------------------
868.6810.......................... Catheter, Tracheobronchial Suction.
878.4460.......................... Glove, Surgeon's.
880.6760.......................... Restraint, Protective.
892.5650.......................... System, Applicator, Radionuclide,
Manual.
892.5740.......................... Source, Radionuclide Teletherapy.
------------------------------------------------------------------------
(b) Design and development planning. Each manufacturer shall
establish and maintain plans that describe or reference the design and
development activities and define responsibility for implementation.
The plans shall identify and describe the interfaces with different
groups or activities that provide, or result in, input to the design
and development process. The plans shall be reviewed, updated, and
approved as design and development evolves.
(c) Design input. Each manufacturer shall establish and maintain
procedures to ensure that the design requirements relating to a device
are appropriate and address the intended use of the device, including
the needs of the user and patient. The procedures shall include a
mechanism for addressing incomplete, ambiguous, or conflicting
requirements. The design input requirements shall be documented and
shall be reviewed and approved by a designated individual(s). The
approval, including the date and signature of the individual(s)
approving the requirements, shall be documented.
(d) Design output. Each manufacturer shall establish and maintain
procedures for defining and documenting design output in terms that
allow an adequate evaluation of conformance to design input
requirements. Design output procedures shall contain or make reference
to acceptance criteria and shall ensure that those design outputs that
are essential for the proper functioning of the device are identified.
Design output shall be documented, reviewed, and approved before
release. The approval, including the date and signature of the
individual(s) approving the output, shall be documented.
(e) Design review. Each manufacturer shall establish and maintain
procedures to ensure that formal documented reviews of the design
results are planned and conducted at appropriate stages of the device's
design development. The procedures shall ensure that participants at
each design review include representatives of all functions concerned
with the design stage being reviewed and an individual(s) who does not
have direct responsibility for the design stage being reviewed, as well
as any specialists needed. The results of a design review, including
identification of the design, the date, and the individual(s)
performing the review, shall be documented in the design history file
(the DHF).
(f) Design verification. Each manufacturer shall establish and
maintain procedures for verifying the device design. Design
verification shall confirm that the design output meets the design
input requirements. The results of the design verification, including
identification of the design, method(s), the date, and the
individual(s) performing the verification, shall be documented in the
DHF.
(g) Design validation. Each manufacturer shall establish and
maintain procedures for validating the device design. Design validation
shall be performed under defined operating conditions on initial
production units, lots, or batches, or their equivalents. Design
validation shall ensure that devices conform to defined user needs and
intended uses and shall include testing of production units under
actual or simulated use conditions. Design validation shall include
software validation and risk analysis, where appropriate. The results
of the design validation, including identification of the design,
method(s), the date, and the individual(s) performing the validation,
shall be documented in the DHF.
(h) Design transfer. Each manufacturer shall establish and maintain
procedures to ensure that the device design is correctly translated
into production specifications.
(i) Design changes. Each manufacturer shall establish and maintain
procedures for the identification, documentation, validation or where
appropriate verification, review, and approval of design changes before
their implementation.
(j) Design history file. Each manufacturer shall establish and
maintain a DHF for each type of device. The DHF shall contain or
reference the records necessary to demonstrate that the design was
developed in accordance with the approved design plan and the
requirements of this part.
Subpart D--Document Controls
Sec. 820.40 Document controls.
Each manufacturer shall establish and maintain procedures to
control all documents that are required by this part. The procedures
shall provide for the following:
(a) Document approval and distribution. Each manufacturer shall
designate an individual(s) to review for adequacy and approve prior to
issuance all documents established to meet the requirements of this
part. The approval, including the date and signature of the
individual(s) approving the document, shall be documented. Documents
established to meet the requirements of this part shall be available at
all locations for which they are designated, used, or otherwise
necessary, and all obsolete documents shall be promptly removed from
all points of use or otherwise prevented from unintended use.
(b) Document changes. Changes to documents shall be reviewed and
approved by an individual(s) in the same function or organization that
performed the original review and approval, unless specifically
designated otherwise. Approved changes shall be
[[Page 52658]]
communicated to the appropriate personnel in a timely manner. Each
manufacturer shall maintain records of changes to documents. Change
records shall include a description of the change, identification of
the affected documents, the signature of the approving individual(s),
the approval date, and when the change becomes effective.
Subpart E--Purchasing Controls
Sec. 820.50 Purchasing controls.
Each manufacturer shall establish and maintain procedures to ensure
that all purchased or otherwise received product and services conform
to specified requirements.
(a) Evaluation of suppliers, contractors, and consultants. Each
manufacturer shall establish and maintain the requirements, including
quality requirements, that must be met by suppliers, contractors, and
consultants. Each manufacturer shall:
(1) Evaluate and select potential suppliers, contractors, and
consultants on the basis of their ability to meet specified
requirements, including quality requirements. The evaluation shall be
documented.
(2) Define the type and extent of control to be exercised over the
product, services, suppliers, contractors, and consultants, based on
the evaluation results.
(3) Establish and maintain records of acceptable suppliers,
contractors, and consultants.
(b) Purchasing data. Each manufacturer shall establish and maintain
data that clearly describe or reference the specified requirements,
including quality requirements, for purchased or otherwise received
product and services. Purchasing documents shall include, where
possible, an agreement that the suppliers, contractors, and consultants
agree to notify the manufacturer of changes in the product or service
so that manufacturers may determine whether the changes may affect the
quality of a finished device. Purchasing data shall be approved in
accordance with Sec. 820.40.
Subpart F--Identification and Traceability
Sec. 820.60 Identification.
Each manufacturer shall establish and maintain procedures for
identifying product during all stages of receipt, production,
distribution, and installation to prevent mixups.
Sec. 820.65 Traceability.
Each manufacturer of a device that is intended for surgical implant
into the body or to support or sustain life and whose failure to
perform when properly used in accordance with instructions for use
provided in the labeling can be reasonably expected to result in a
significant injury to the user shall establish and maintain procedures
for identifying with a control number each unit, lot, or batch of
finished devices and where appropriate components. The procedures shall
facilitate corrective action. Such identification shall be documented
in the DHR.
Subpart G--Production and Process Controls
Sec. 820.70 Production and process controls.
(a) General. Each manufacturer shall develop, conduct, control, and
monitor production processes to ensure that a device conforms to its
specifications. Where deviations from device specifications could occur
as a result of the manufacturing process, the manufacturer shall
establish and maintain process control procedures that describe any
process controls necessary to ensure conformance to specifications.
Where process controls are needed they shall include:
(1) Documented instructions, standard operating procedures (SOP's),
and methods that define and control the manner of production;
(2) Monitoring and control of process parameters and component and
device characteristics during production;
(3) Compliance with specified reference standards or codes;
(4) The approval of processes and process equipment; and
(5) Criteria for workmanship which shall be expressed in documented
standards or by means of identified and approved representative
samples.
(b) Production and process changes. Each manufacturer shall
establish and maintain procedures for changes to a specification,
method, process, or procedure. Such changes shall be verified or where
appropriate validated according to Sec. 820.75, before implementation
and these activities shall be documented. Changes shall be approved in
accordance with Sec. 820.40.
(c) Environmental control. Where environmental conditions could
reasonably be expected to have an adverse effect on product quality,
the manufacturer shall establish and maintain procedures to adequately
control these environmental conditions. Environmental control system(s)
shall be periodically inspected to verify that the system, including
necessary equipment, is adequate and functioning properly. These
activities shall be documented and reviewed.
(d) Personnel. Each manufacturer shall establish and maintain
requirements for the health, cleanliness, personal practices, and
clothing of personnel if contact between such personnel and product or
environment could reasonably be expected to have an adverse effect on
product quality. The manufacturer shall ensure that maintenance and
other personnel who are required to work temporarily under special
environmental conditions are appropriately trained or supervised by a
trained individual.
(e) Contamination control. Each manufacturer shall establish and
maintain procedures to prevent contamination of equipment or product by
substances that could reasonably be expected to have an adverse effect
on product quality.
(f) Buildings. Buildings shall be of suitable design and contain
sufficient space to perform necessary operations, prevent mixups, and
assure orderly handling.
(g) Equipment. Each manufacturer shall ensure that all equipment
used in the manufacturing process meets specified requirements and is
appropriately designed, constructed, placed, and installed to
facilitate maintenance, adjustment, cleaning, and use.
(1) Maintenance schedule. Each manufacturer shall establish and
maintain schedules for the adjustment, cleaning, and other maintenance
of equipment to ensure that manufacturing specifications are met.
Maintenance activities, including the date and individual(s) performing
the maintenance activities, shall be documented.
(2) Inspection. Each manufacturer shall conduct periodic
inspections in accordance with established procedures to ensure
adherence to applicable equipment maintenance schedules. The
inspections, including the date and individual(s) conducting the
inspections, shall be documented.
(3) Adjustment. Each manufacturer shall ensure that any inherent
limitations or allowable tolerances are visibly posted on or near
equipment requiring periodic adjustments or are readily available to
personnel performing these adjustments.
(h) Manufacturing material. Where a manufacturing material could
reasonably be expected to have an adverse effect on product quality,
the manufacturer shall establish and maintain procedures for the use
and removal of such manufacturing material
[[Page 52659]]
to ensure that it is removed or limited to an amount that does not
adversely affect the device's quality. The removal or reduction of such
manufacturing material shall be documented.
(i) Automated processes. When computers or automated data
processing systems are used as part of production or the quality
system, the manufacturer shall validate computer software for its
intended use according to an established protocol. All software changes
shall be validated before approval and issuance. These validation
activities and results shall be documented.
Sec. 820.72 Inspection, measuring, and test equipment.
(a) Control of inspection, measuring, and test equipment. Each
manufacturer shall ensure that all inspection, measuring, and test
equipment, including mechanical, automated, or electronic inspection
and test equipment, is suitable for its intended purposes and is
capable of producing valid results. Each manufacturer shall establish
and maintain procedures to ensure that equipment is routinely
calibrated, inspected, checked, and maintained. The procedures shall
include provisions for handling, preservation, and storage of
equipment, so that its accuracy and fitness for use are maintained.
These activities shall be documented.
(b) Calibration. Calibration procedures shall include specific
directions and limits for accuracy and precision. When accuracy and
precision limits are not met, there shall be provisions for remedial
action to reestablish the limits and to evaluate whether there was any
adverse effect on the device's quality. These activities shall be
documented.
(1) Calibration standards. Calibration standards used for
inspection, measuring, and test equipment shall be traceable to
national or international standards. If national or international
standards are not practical or available, the manufacturer shall use an
independent reproducible standard. If no applicable standard exists,
the manufacturer shall establish and maintain an in-house standard.
(2) Calibration records. The equipment identification, calibration
dates, the individual performing each calibration, and the next
calibration date shall be documented. These records shall be displayed
on or near each piece of equipment or shall be readily available to the
personnel using such equipment and to the individuals responsible for
calibrating the equipment.
Sec. 820.75 Process validation.
(a) Where the results of a process cannot be fully verified by
subsequent inspection and test, the process shall be validated with a
high degree of assurance and approved according to established
procedures. The validation activities and results, including the date
and signature of the individual(s) approving the validation and where
appropriate the major equipment validated, shall be documented.
(b) Each manufacturer shall establish and maintain procedures for
monitoring and control of process parameters for validated processes to
ensure that the specified requirements continue to be met.
(1) Each manufacturer shall ensure that validated processes are
performed by qualified individual(s).
(2) For validated processes, the monitoring and control methods and
data, the date performed, and, where appropriate, the individual(s)
performing the process or the major equipment used shall be documented.
(c) When changes or process deviations occur, the manufacturer
shall review and evaluate the process and perform revalidation where
appropriate. These activities shall be documented.
Subpart H--Acceptance Activities
Sec. 820.80 Receiving, in-process, and finished device acceptance.
(a) General. Each manufacturer shall establish and maintain
procedures for acceptance activities. Acceptance activities include
inspections, tests, or other verification activities.
(b) Receiving acceptance activities. Each manufacturer shall
establish and maintain procedures for acceptance of incoming product.
Incoming product shall be inspected, tested, or otherwise verified as
conforming to specified requirements. Acceptance or rejection shall be
documented.
(c) In-process acceptance activities. Each manufacturer shall
establish and maintain acceptance procedures, where appropriate, to
ensure that specified requirements for in-process product are met. Such
procedures shall ensure that in-process product is controlled until the
required inspection and tests or other verification activities have
been completed, or necessary approvals are received, and are
documented.
(d) Final acceptance activities. Each manufacturer shall establish
and maintain procedures for finished device acceptance to ensure that
each production run, lot, or batch of finished devices meets acceptance
criteria. Finished devices shall be held in quarantine or otherwise
adequately controlled until released. Finished devices shall not be
released for distribution until: (1) The activities required in the DMR
are completed; (2) the associated data and documentation is reviewed;
(3) the release is authorized by the signature of a designated
individual(s); and (4) the authorization is dated.
(e) Acceptance records. Each manufacturer shall document acceptance
activities required by this part. These records shall include: (1) The
acceptance activities performed; (2) the dates acceptance activities
are performed; (3) the results; (4) the signature of the individual(s)
conducting the acceptance activities; and (5) where appropriate the
equipment used. These records shall be part of the DHR.
Sec. 820.86 Acceptance status.
Each manufacturer shall identify by suitable means the acceptance
status of product, to indicate the conformance or nonconformance of
product with acceptance criteria. The identification of acceptance
status shall be maintained throughout manufacturing, packaging,
labeling, installation, and servicing of the product to ensure that
only product which has passed the required acceptance activities is
distributed, used, or installed.
Subpart I--Nonconforming Product
Sec. 820.90 Nonconforming product.
(a) Control of nonconforming product. Each manufacturer shall
establish and maintain procedures to control product that does not
conform to specified requirements. The procedures shall address the
identification, documentation, evaluation, segregation, and disposition
of nonconforming product. The evaluation of nonconformance shall
include a determination of the need for an investigation and
notification of the persons or organizations responsible for the
nonconformance. The evaluation and any investigation shall be
documented.
(b) Nonconformity review and disposition. (1) Each manufacturer
shall establish and maintain procedures that define the responsibility
for review and the authority for the disposition of nonconforming
product. The procedures shall set forth the review and disposition
process. Disposition of nonconforming product shall be documented.
Documentation shall include the justification for use of nonconforming
product and the signature of the individual(s) authorizing the use.
[[Page 52660]]
(2) Each manufacturer shall establish and maintain procedures for
rework, to include retesting and reevaluation of the nonconforming
product after rework, to ensure that the product meets its current
approved specifications. Rework and reevaluation activities, including
a determination of any adverse effect from the rework upon the product,
shall be documented in the DHR.
Subpart J--Corrective and Preventive Action
Sec. 820.100 Corrective and preventive action.
(a) Each manufacturer shall establish and maintain procedures for
implementing corrective and preventive action. The procedures shall
include requirements for:
(1) Analyzing processes, work operations, concessions, quality
audit reports, quality records, service records, complaints, returned
product, and other sources of quality data to identify existing and
potential causes of nonconforming product, or other quality problems.
Appropriate statistical methodology shall be employed where necessary
to detect recurring quality problems;
(2) Investigating the cause of nonconformities relating to product,
processes, and the quality system;
(3) Identifying the action(s) needed to correct and prevent
recurrence of nonconforming product and other quality problems;
(4) Verifying or validating the corrective and preventive action to
ensure that such action is effective and does not adversely affect the
finished device;
(5) Implementing and recording changes in methods and procedures
needed to correct and prevent identified quality problems;
(6) Ensuring that information related to quality problems or
nonconforming product is disseminated to those directly responsible for
assuring the quality of such product or the prevention of such
problems; and
(7) Submitting relevant information on identified quality problems,
as well as corrective and preventive actions, for management review.
(b) All activities required under this section, and their results,
shall be documented.
Subpart K--Labeling and Packaging Control
Sec. 820.120 Device labeling.
Each manufacturer shall establish and maintain procedures to
control labeling activities.
(a) Label integrity. Labels shall be printed and applied so as to
remain legible and affixed during the customary conditions of
processing, storage, handling, distribution, and where appropriate use.
(b) Labeling inspection. Labeling shall not be released for storage
or use until a designated individual(s) has examined the labeling for
accuracy including, where applicable, the correct expiration date,
control number, storage instructions, handling instructions, and any
additional processing instructions. The release, including the date and
signature of the individual(s) performing the examination, shall be
documented in the DHR.
(c) Labeling storage. Each manufacturer shall store labeling in a
manner that provides proper identification and is designed to prevent
mixups.
(d) Labeling operations. Each manufacturer shall control labeling
and packaging operations to prevent labeling mixups. The label and
labeling used for each production unit, lot, or batch shall be
documented in the DHR.
(e) Control number. Where a control number is required by
Sec. 820.65, that control number shall be on or shall accompany the
device through distribution.
Sec. 820.130 Device packaging.
Each manufacturer shall ensure that device packaging and shipping
containers are designed and constructed to protect the device from
alteration or damage during the customary conditions of processing,
storage, handling, and distribution.
Subpart L--Handling, Storage, Distribution, and Installation
Sec. 820.140 Handling.
Each manufacturer shall establish and maintain procedures to ensure
that mixups, damage, deterioration, contamination, or other adverse
effects to product do not occur during handling.
Sec. 820.150 Storage.
(a) Each manufacturer shall establish and maintain procedures for
the control of storage areas and stock rooms for product to prevent
mixups, damage, deterioration, contamination, or other adverse effects
pending use or distribution and to ensure that no obsolete, rejected,
or deteriorated product is used or distributed. When the quality of
product deteriorates over time, it shall be stored in a manner to
facilitate proper stock rotation, and its condition shall be assessed
as appropriate.
(b) Each manufacturer shall establish and maintain procedures that
describe the methods for authorizing receipt from and dispatch to
storage areas and stock rooms.
Sec. 820.160 Distribution.
(a) Each manufacturer shall establish and maintain procedures for
control and distribution of finished devices to ensure that only those
devices approved for release are distributed and that purchase orders
are reviewed to ensure that ambiguities and errors are resolved before
devices are released for distribution. Where a device's fitness for use
or quality deteriorates over time, the procedures shall ensure that
expired devices or devices deteriorated beyond acceptable fitness for
use are not distributed.
(b) Each manufacturer shall maintain distribution records which
include or refer to the location of:
(1) The name and address of the initial consignee;
(2) The identification and quantity of devices shipped;
(3) The date shipped; and
(4) Any control number(s) used.
Sec. 820.170 Installation.
(a) Each manufacturer of a device requiring installation shall
establish and maintain adequate installation and inspection
instructions, and where appropriate test procedures. Instructions and
procedures shall include directions for ensuring proper installation so
that the device will perform as intended after installation. The
manufacturer shall distribute the instructions and procedures with the
device or otherwise make them available to the person(s) installing the
device.
(b) The person installing the device shall ensure that the
installation, inspection, and any required testing are performed in
accordance with the manufacturer's instructions and procedures and
shall document the inspection and any test results to demonstrate
proper installation.
Subpart M--Records
Sec. 820.180 General requirements.
All records required by this part shall be maintained at the
manufacturing establishment or other location that is reasonably
accessible to responsible officials of the manufacturer and to
employees of FDA designated to perform inspections. Such records,
including those not stored at the inspected establishment, shall be
made readily available for review and copying by FDA employee(s). Such
records shall be legible and shall be stored to
[[Page 52661]]
minimize deterioration and to prevent loss. Those records stored in
automated data processing systems shall be backed up.
(a) Confidentiality. Records deemed confidential by the
manufacturer may be marked to aid FDA in determining whether
information may be disclosed under the public information regulation in
part 20 of this chapter.
(b) Record retention period. All records required by this part
shall be retained for a period of time equivalent to the design and
expected life of the device, but in no case less than 2 years from the
date of release for commercial distribution by the manufacturer.
(c) Exceptions. This section does not apply to the reports required
by Sec. 820.20(c) Management review, Sec. 820.22 Quality audits, and
supplier audit reports used to meet the requirements of Sec. 820.50(a)
Evaluation of suppliers, contractors, and consultants, but does apply
to procedures established under these provisions. Upon request of a
designated employee of FDA, an employee in management with executive
responsibility shall certify in writing that the management reviews and
quality audits required under this part, and supplier audits where
applicable, have been performed and documented, the dates on which they
were performed, and that any required corrective action has been
undertaken.
Sec. 820.181 Device master record.
Each manufacturer shall maintain device master records (DMR's).
Each manufacturer shall ensure that each DMR is prepared and approved
in accordance with Sec. 820.40. The DMR for each type of device shall
include, or refer to the location of, the following information:
(a) Device specifications including appropriate drawings,
composition, formulation, component specifications, and software
specifications;
(b) Production process specifications including the appropriate
equipment specifications, production methods, production procedures,
and production environment specifications;
(c) Quality assurance procedures and specifications including
acceptance criteria and the quality assurance equipment to be used;
(d) Packaging and labeling specifications, including methods and
processes used; and
(e) Installation, maintenance, and servicing procedures and
methods.
Sec. 820.184 Device history record.
Each manufacturer shall maintain device history records (DHR's).
Each manufacturer shall establish and maintain procedures to ensure
that DHR's for each batch, lot, or unit are maintained to demonstrate
that the device is manufactured in accordance with the DMR and the
requirements of this part. The DHR shall include, or refer to the
location of, the following information:
(a) The dates of manufacture;
(b) The quantity manufactured;
(c) The quantity released for distribution;
(d) The acceptance records which demonstrate the device is
manufactured in accordance with the DMR;
(e) The primary identification label and labeling used for each
production unit; and
(f) Any device identification(s) and control number(s) used.
Sec. 820.186 Quality system record.
Each manufacturer shall maintain a quality system record (QSR). The
QSR shall include, or refer to the location of, procedures and the
documentation of activities required by this part that are not specific
to a particular type of device(s), including, but not limited to, the
records required by Sec. 820.20. Each manufacturer shall ensure that
the QSR is prepared and approved in accordance with Sec. 820.40.
Sec. 820.198 Complaint files.
(a) Each manufacturer shall maintain complaint files. Each
manufacturer shall establish and maintain procedures for receiving,
reviewing, and evaluating complaints by a formally designated unit.
Such procedures shall ensure that:
(1) All complaints are processed in a uniform and timely manner;
(2) Oral complaints are documented upon receipt; and
(3) Complaints are evaluated to determine whether the complaint
represents an event which is required to be reported to FDA under part
803 or 804 of this chapter, Medical Device Reporting.
(b) Each manufacturer shall review and evaluate all complaints to
determine whether an investigation is necessary. When no investigation
is made, the manufacturer shall maintain a record that includes the
reason no investigation was made and the name of the individual
responsible for the decision not to investigate.
(c) Any complaint involving the possible failure of a device,
labeling, or packaging to meet any of its specifications shall be
reviewed, evaluated, and investigated, unless such investigation has
already been performed for a similar complaint and another
investigation is not necessary.
(d) Any complaint that represents an event which must be reported
to FDA under part 803 or 804 of this chapter shall be promptly
reviewed, evaluated, and investigated by a designated individual(s) and
shall be maintained in a separate portion of the complaint files or
otherwise clearly identified. In addition to the information required
by Sec. 820.198(e), records of investigation under this paragraph shall
include a determination of:
(1) Whether the device failed to meet specifications;
(2) Whether the device was being used for treatment or diagnosis;
and
(3) The relationship, if any, of the device to the reported
incident or adverse event.
(e) When an investigation is made under this section, a record of
the investigation shall be maintained by the formally designated unit
identified in paragraph (a) of this section. The record of
investigation shall include:
(1) The name of the device;
(2) The date the complaint was received;
(3) Any device identification(s) and control number(s) used;
(4) The name, address, and phone number of the complainant;
(5) The nature and details of the complaint;
(6) The dates and results of the investigation;
(7) Any corrective action taken; and
(8) Any reply to the complainant.
(f) When the manufacturer's formally designated complaint unit is
located at a site separate from the manufacturing establishment, the
investigated complaint(s) and the record(s) of investigation shall be
reasonably accessible to the manufacturing establishment.
(g) If a manufacturer's formally designated complaint unit is
located outside of the United States, records required by this section
shall be reasonably accessible in the United States at either:
(1) A location in the United States where the manufacturer's
records are regularly kept; or
(2) The location of the initial distributor.
Subpart N--Servicing
Sec. 820.200 Servicing.
(a) Where servicing is a specified requirement, each manufacturer
shall establish and maintain instructions and procedures for performing
and verifying that the servicing meets the specified requirements.
(b) Each manufacturer shall analyze service reports with
appropriate
[[Page 52662]]
statistical methodology in accordance with Sec. 820.100.
(c) Each manufacturer who receives a service report that represents
an event which must be reported to FDA under part 803 or 804 of this
chapter shall automatically consider the report a complaint and shall
process it in accordance with the requirements of Sec. 820.198.
(d) Service reports shall be documented and shall include:
(1) The name of the device serviced;
(2) Any device identification(s) and control number(s) used;
(3) The date of service;
(4) The individual(s) servicing the device;
(5) The service performed; and
(6) The test and inspection data.
Subpart O--Statistical Techniques
Sec. 820.250 Statistical techniques.
(a) Where appropriate, each manufacturer shall establish and
maintain procedures for identifying valid statistical techniques
required for establishing, controlling, and verifying the acceptability
of process capability and product characteristics.
(b) Sampling plans, when used, shall be written and based on a
valid statistical rationale. Each manufacturer shall establish and
maintain procedures to ensure that sampling methods are adequate for
their intended use and to ensure that when changes occur the sampling
plans are reviewed. These activities shall be documented.
Dated: October 1, 1996.
David A. Kessler,
Commissioner of Food and Drugs.
Donna E. Shalala,
Secretary of Health and Human Services.
[FR Doc. 96-25720 Filed 10-3-96; 11:22 am]
BILLING CODE 4160-01-P