In this edition of Devine Guidance (DG), Dr. D will provide guidance for 21 CFR, Part 820, Subpart – M (Records), specifically 820.181 (Device Master Record). In an earlier edition of DG, the doctor expanded on the virtues of having a compliant Device Master Record (DMR). Well, guess what, the agency actually expects device manufacturers to retain the DMR and its contents as records, while ensuring that the DMRs are prepared, approved, retained, and managed as permanent records.

Once again, this edition of DG is premised on common sense. As many of the readers of DG already know, Dr. D. can be quite a raconteur (look-up-time), as I link my real-life experiences to the requirements delineated within the QSR, in an effort to simplify the code.

Warning letter violations
This week Dr. D was able to locate multiple warning-letter observations, highlighting the lack of understanding of the DMR requirement resulting in documented non-compliances. Once again, after reading the observations, the warning letters were clearly justified. The first violator failed to ensure all of the appropriate records, such as device specifications and production processes, were identified for inclusion into the DMR. This observation was rooted in one of my favorite compliance issues, “failure to establish written procedures.” If this device manufacturer adhered to DG Rule # 6 – All procedures, work instructions, drawings, specifications, etc. must be written, well-documented, and controlled within a defined document control system – the observation could have been averted.

For those of you that are frequent readers of DG, the second warning-letter recipient should be quite familiar to you by now. The 19 observations are a dead giveaway. In fact, as my favorite comedian Carlos Mencia would say, “Duh, duh-duh!” In general, the agency was ‘thoroughly impressed’ with all aspects of this device manufacturer’s approach to compliance (just kidding of course).

In reality, the inspection resulted in two specific observations against 820.181. Not only was there an issue with the overall approach to compiling and sustaining DMRs, but when requested, specifications that should reside in the DMR could not be produced. Dr. D broken-record time again: if there is no documented evidence, i.e., specification, report, etc. the event never occurred. If there is no evidence available to provide FDA during an inspection, not only did the event not occur, the offending device manufacturer should be prepared to receive a Form 483.

Warning letter One (June 2010): Observation 4 of 6 – Failure to maintain device master records (DMRs) as required by 21 CFR § 820.181. Specifically, your firm has not established and maintained DMRs, that include, or refer to the location of the device specifications, production process specifications, quality assurance procedures and specifications, packaging and labeling specifications, and installation, maintenance, and servicing procedures and methods, for its Cranial Orthosis devices.

Warning letter Two (March 2010): Observation 13 of 19 – Failure to establish and maintain device master records (DMRs), as required by 21 CFR 820.181. For example, when requested, no DMR for the EGGSAS software used in the three 3CPM Electrogastrogram versions: Research, Research Waterload, and Waterload was provided.

Observation 14 of 19 – Failure to maintain adequate device master records that include, or refer to the location of, device specifications including appropriate drawings, composition, formulation, component specifications, and software specifications, as required by 21 CFR 820.181(a). For example, when requested, the software specifications for the software update that occurred in (b)(4) or the software updates that occurred between (b)(4) could not be located.

Quality System Regulation – 21 CFR, Part 820
QSR – Subpart M – Records
Section 820.181 Device Master Record

Each manufacturer shall maintain device master records (DMRs). Each manufacturer shall ensure that each DMR is prepared and approved in accordance with 820.40. The DMR for each type of device shall include, or refer to the location of, the following information:

• (a) Device specifications including appropriate drawings, composition, formulation, component specifications, and software specifications;
• (b) Production process specifications including the appropriate equipment specifications, production methods, production procedures, and production environment specifications;
• (c) Quality assurance procedures and specifications including acceptance criteria and the quality assurance equipment to be used;
• (d) Packaging and labeling specifications, including methods and processes used; and
• (e) Installation, maintenance, and servicing procedures and methods.

Device master record
I strongly suggest that readers scan the Devine Guidance Blog (Medical Device Summit) and read the guidance provided by Dr. D in regards to basic DMR requirements. That said, the doctor will focus on the record-retention aspects of the regulation in this edition. The salient concept associated with 820.181 is that DMRs be properly “prepared and approved.”

Additionally, there should be a DMR for every single device designed and manufactured, regardless of regulatory path, i.e., 510(k), PMA, etc. If the entire DMR process is found not to be in compliance with the QSR, device manufacturers, as a minimum, can expect a Form 483 when the agency shows up for a friendly visit. Worse case, a warning letter might make its way into the hands of the Chief Executive Officer and Chief Jailable Officer, if enough compliance issues are identified during an inspection. Regardless, these regulatory actions can and will result in a significant interruption in the day-to-day activities of device manufacturers that violate the Code.

Device specifications
As part of the DMR, device manufacturers are expected to retain specific types of records. For example, specifications applicable to the device, device drawings, component specifications, software specifications, production process and procedures, quality procedures, packaging specifications, labeling specifications, and procedures associated with maintenance and servicing need to be compiled into the DMR and retained. Remember the construction and long-term management of the DMR is not optional. In fact, the DMR should be treated as a living and breathing document receptacle, as it will never remain static.

Production process specifications
As part of the production process specification requirement, it is not enough to retain only documented production processes. The agency is expecting to see significantly more granularity. For example, for production processes, equipment specifications and settings, environmental conditions for production areas, applicable production methods, and test methods need to be captured in the DMR. Each of these documents should also be supported by evidence of verification and validation activities when appropriate. Production processes, procedures, environmental conditions, etc., are not worth a hill of beans if there is no technical data and rationale to substantiate accuracy and repeatability.

Quality assurance procedures
Similar to the production process requirements, applicable quality procedures, specifications, acceptance criteria, and inspection equipment shall be included into the DMR. Once again, significant granularity is expected in support of determining that quality assurance procedures and processes applied are effective. For example, if acceptance criterion involves employing specific types of measuring equipment, the effectiveness of the overall inspection process must be evaluated. If the criterion employed for determining product acceptance is not accurate and repeatable, a device manufacturer does not have a viable acceptance process, end of story.

Packaging and labeling specifications
Device manufacturers can take it to the proverbial bank, the possibility for the agency to identify finished devices as misbranded if the packaging and labeling does not match the specifications depicted within the DMR. Can you say RECALL? Yes, once again Dr. D has been able to invoke that nasty 6-letter word, sorry.

The QSR requirement is to ensure manufacturers retain the actual and current product packaging and labeling specifications in the DMR. Additionally, when Dr. D states “current” the doctor means it. The doctor has experienced, first hand, when a device manufacturer does an admirable job of documenting the initial release of packaging and labeling specifications, but fails to manage change. Packaging and labeling methodologies, content, specifications, etc. often do not remain in a static state. When specifications change, the DMR is the appropriate receptacle to capture these changes. Furthermore, methods, processes, and procedures employed as part of packaging and labeling shall also be retained in the DMR. For example, a validated process for pouch sealing or the actual affixing of the correct label on a device carton shall be included in the DMR.

Installation, maintenance, and servicing procedures
The record retention for installation, maintenance, and servicing methods, processes, and procedures is also redundant to the previously discussed DMR requirements. Detailed procedures and methods shall be placed into the DMR and retained. Once again, if changes to the applicable procedures and methods occur, the changes, once reviewed and approved, need to be placed into the DMR. As the doctor stated earlier, the DMR is really a dynamic document receptacle (living and breathing file). In fact, the doctor has never seen a DMR remain in a steady state.

Takeaways
Ensuring the DMR is the receptacle for the appropriate type of records and the ongoing sustaining of the DMR are the basic salient requirements associated with 820.181. Remember, the DMR will never remain in a steady state. As products mature, manufacturing technology changes, or as product complaints occur, device manufacturers are driven to modify applied methodologies, processes, and procedures. When changes occur, these changes shall be captured in the DMR.

Finally, fail to adequately manage the DMR process, and device manufacturers will be duly rewarded by their good friends at the agency.

In closing, thank you again for joining Dr. D and I hope you find value in the guidance provided. Until the next installment of DG, when I begin providing guidance for Subpart – M (Records), specifically 820.184 (Device History Record) – cheers from Dr. D. and best wishes for continued professional success.

References:

1. Code of Federal Regulation. (2009, April). Title 21 Part 820: Quality system regulation.  Washington, D.C.: U. S. Government Printing Office.
2. Devine. C. (2009, July). Exploring the effectiveness of defensive-receiving inspection for medical device manufacturers: a mixed method study. Published doctoral dissertation. Northcentral University. Prescott Valley, AZ. 
3. FDA – U.S. Food and Drug Administration Website. (2010). Warning letters. Retrieved September 29, 2010, from http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/