As promised in the previous edition of DG, Dr. D will continue with the analysis of a warning letter FDA awarded to an Illinois-based sterilization facility in May of this year. As you remember, the warning letter specifically mentioned instances of “employee data manipulation/falsification.”

Now as the doctor has previously established with the readers of DG, Dr. D is not a biologist. In fact, Dr. D will always be the first to acknowledge, germs are bad things when it comes to finished medical devices; and the proper sterilization of finished devices will kill these nasty little microbes. However, what about the potential impact to polymers and plastics employed in the manufacture of finished medical devices when these materials are over exposed to gamma radiation? Does the over exposure potentially shorten the shelf-life of the product? Does the device still function as advertised? What about product packaging? Better yet, what if the device has only been qualified for 1X sterilization versus what now might be considered 1.2X or even 1.5X. What about product that was under-dosed? Are these devices actually sterile? How does the under-dosing impact product shelf-life? These are questions that Dr. D believes are germane to potential issues associated with the improper sterilization of finished devices through the use of gamma radiation.

For this edition of DG, the doctor will add two additional questions. One – what in the heck were these employees thinking? Two – what was management thinking in regards to what the agency believes was a slow response time to pursue action. Maybe it was the “algid” (look-it-up) air associated with the long Chicago-area winters? Regardless, the QMS was seriously flawed to allow this to occur and it is Dr. D’s not-so-humble opinion, the responsibility for a fundamental breakdown in the QMS falls squarely on the shoulders of management in the medical device industry and all other industries. Enjoy.

FDA Warning Letter – 22 May 2014

Dr. D read this warning multiple times and actually grew angrier with each read. In fact, the PIP debacle in France came to mind. Did these employees realize that their actions could seriously jeopardize the health of patients that were exposed to finished medical devices that were not properly sterilized? What was management thinking? Yes – I know, stop with the questions already Dr. D, but seriously the doctor would really like to understand what happened at this facility. That being said, the agency threw this sterilization’s management team under the proverbial bus for their inaction, so please read on my dear readers.

“5. Management with executive responsibility has not reviewed the suitability and effectiveness of the quality system, as required by 21 CFR 820.20(c). Specifically, your firm failed to adequately perform a review of the suitability and effectiveness of your quality system in light of three separate incidents involving data manipulation/falsification by five STERIS Isomedix Services employees at three STERIS Isomedix facilities since 2008.

We have reviewed your responses and have determined that they are inadequate because the responses failed to identify actions to address the reasons why it took three discrete incidents of data manipulation/falsification and an FDA inspection to initiate a change in the quality system, including a shift in responsibilities to the Quality Unit to approve or reject processed medical devices. The responses also indicated a number of other corrective actions, including revisions to PROC-00034, “(b)(4) Processing Review and Approval”, and the creation of a new policy regarding the re-reading of dosimeters; however, no documentation was included with the responses to support these statements.

6. Failure to adequately establish and maintain the organizational structure to ensure that devices are produced in accordance with 21 CFR 820, as required by 21 CFR 820.20(b). Specifically, your firm has not established the appropriate organizational structure with respect to responsibility, authority, and interrelation for all personnel who manage, perform and assess work for quality. For example, your firm’s operators and material handlers are directly responsible for reading dosimeters that they have placed on the product processing runs. The analysis of the dosimeters is the primary quality control activity that determines the calculated dose for dosimeters in a gamma irradiation run and is the basis for product release. Operators and material handlers report through Operations personnel; this reporting structure was shown in Run (b)(4) to be a conflict of interest in that Run (b)(4) was found to be overdosed by an employee who reported the information to an Operations Team Lead who provided guidance on how to falsify the absorbance readings so that they would appear to be within specification. This reporting structure removes the Quality Unit from the ability to approve/reject irradiation runs based on dosimetry analysis and hinders the identification and correction of potential quality problems by the Quality Unit.

We have reviewed your responses and acknowledge your firm’s revisions to PROC-00183, “Procedure for Processing Product at the Libertyville North Facility” which indicate that all review and evaluation of dosimeter readings and dosimetric data will be performed and documented by trained Quality personnel. A follow-up inspection will be conducted to verify the implementation of the revised procedure. Your responses indicated that a new policy was created requiring that a second independent operator must perform a re-read and management must be notified of the re-read; however, documentation to support this new policy, including reconfiguration of the (b)(4) system to align with the policy, was not provided in the responses.”

21 CFR, Part 820 §820.20 – Management Responsibility

(a) Quality policy. Management with executive responsibility shall establish its policy and objectives for, and commitment to, quality. Management with executive responsibility shall ensure that the quality policy is understood, implemented, and maintained at all levels of the organization.

(b) Organization. Each manufacturer shall establish and maintain an adequate organizational structure to ensure that devices are designed and produced in accordance with the requirements of this part.

1. Responsibility and authority. Each manufacturer shall establish the appropriate responsibility, authority, and interrelation of all personnel who manage, perform, and assess work affecting quality, and provide the independence and authority necessary to perform these tasks.
2. Resources. Each manufacturer shall provide adequate resources, including the assignment of trained personnel, for management, performance of work, and assessment activities, including internal quality audits, to meet the requirements of this part.
3. Management representative. Management with executive responsibility shall appoint, and document such appointment of, a member of management who, irrespective of other responsibilities, shall have established authority over and responsibility for:
   • Ensuring that quality system requirements are effectively established and effectively maintained in accordance with this part; and
   • Reporting on the performance of the quality system to management with executive responsibility for review.

(c) Management review. Management with executive responsibility shall review the suitability and effectiveness of the quality system at defined intervals and with sufficient frequency according to established procedures to ensure that the quality system satisfies the requirements of this part and the manufacturer’s established quality policy and objectives. The dates and results of quality system reviews shall be documented.

(d) Quality planning. Each manufacturer shall establish a quality plan which defines the quality practices, resources, and activities relevant to devices that are designed and manufactured. The manufacturer shall establish how the requirements for quality will be met.

(e) Quality system procedures. Each manufacturer shall establish quality system procedures and instructions. An outline of the structure of the documentation used in the quality system shall be established where appropriate.

Compliance for Dummies

Management responsibility, in Dr. D’s humble opinion, is one of the most important requirements delineated in the QSR. If management has no clue as to what is going on in their facility or fails to take appropriate action when serious issues transpire, e.g., data falsification, then just maybe a warning letter isn’t appropriate. Maybe a do not pass go and do not collect $200.00 and proceed directly to Consent Decree is in order.Regardless, management review is also one of the QSR requirements that an engaged management team can employ to ensure their organization remains in the good graces of FDA.

For starters, the quality policy is a fundamental requirement for all quality management systems. It needs to be appropriate for the business and reviewed during management review for ongoing effectiveness. For example, if your quality policy is we build great cars and you actually manufacture electrophysiological catheters, well Houston we have a problem.

Additionally, the organizational structure must be appropriate for supporting the design, development, manufacture, and entering into commerce finished medical devices, after clearance or approval is obtained. It is another one of Dr. D’s humble opinions that when quality reports into operations, bad things happen. If you do not believe Dr. D, re-read the warning letter. In fact, your management representative, also a requirement for any QMS, should be an individual of unquestionable integrity and in the doctor’s humble opinion, not the VP of operations. The quality organization, let the doctor repeat, the QUALITY Organization and the QUALITY Organization Alone, needs to determine if and when a product or service has been successfully completed and the results lend themselves to devices that are safe and effective in their intended use. On another note, it is also imperative that the device establishment provide adequately trained individuals that do not falsify data, while ensuring all work is performed accurately and with integrity. PS – including quality audits.

Furthermore, management reviews should never be a burden or an exercise in just going through the motions because it is a requirement. Highly functional and engaged management teams provide adequate oversight to ensure the QMS remains suitable and effective for the purpose of manufacturing medical devices or providing critical services to the medical device industry. Now granted, the default industry standard, thanks in part to industry’s interpretation of ISO 13485 and assorted regulations, is at least annually for management review meeting. This frequency, in another one of Dr. D’s humble opinions, is not nearly frequent enough. The doctor is a big proponent of quarterly reviews, as a minimum. Yes, it is a lot more work but the extra work is worth every bit of the additional time invested. Don’t forget to review the quality policy as part of the management review.

Another significant watch out is that quality planning and well-written quality system procedures are an integral part of a high-performing QMS. Considering that quality planning is not optional, a well-developed quality plan that defines practices, resources, and activities relevant to the devices being manufactured or the services provided must be scripted; and as applicable revised to support changes. Finally, the devil is always in the details and that means quality system procedures that are well-written and appropriate for the organization. Dr. D is a big advocate of procedures that are actually effective and easy to follow. The doctor has also been a big proponent of holding an annual review of all quality system procedures and forms to ensure they are still relevant and capable of driving an effective QMS.

Takeaways

To end this week’s guidance, Dr. D would love to use a one-liner or other clever phrase to lighten my mood, but I have to be honest: the Falsification of Data rubs the doctor the wrong way. There is a special place in quality hell, for those that do bad things in the medical device industry. That being said, the doctor is going to leave (in my humble opinion) the most important takeaways for anyone in industry. One – if you do not have integrity, then you have nothing at all. In fact, please find another line of work. Two – the United States Marine in Dr. D leads me to the ultimate conclusion that leaders are always accountable for their organization’s actions. Failure to act swiftly and decisively when a serious breach in organizational trust and integrity has occurred is almost as bad as the individuals that act without any personal integrity at all. Three – always do the right thing. If mistakes and errors occur; take ownership and do not make the same mistakes again. Finally, the doctor wishes you the best of luck recovering from when such a serious breach of trust occurs. The doctor hopes that the orange jumpsuits make you itch and the shiny stainless-steel bracelets leave a mark.

In closing, thank you again for joining Dr. D and I hope you find value in the guidance provided. Until the next installment of DG – cheers from Dr. D. and best wishes for continued professional success.

References:

1. Code of Federal Regulation. (2013, April) Title 21 Part 820: Quality system regulation. Washington, D.C.: U.S. Government Printing Office.
2. Devine, C. (2011). Devine guidance for complying with the FDA’s quality system regulation – 21 CFR, Part 820. Charleston, SC: Amazon.
3. FDA’s enforcement page. (2014, May). FDA.gov Website. Retrieved June 4, 2014, from http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/2014/ucm399011.htm.