Records (General Requirements)
In this edition of Devine Guidance (DG), Dr. D will provide guidance for 21 CFR, Part 820, Subpart – M (Records), specifically 820.180 (General Requirements). Yes, the doctor understands that general requirements are boring; however, just like basic blocking and tackling drills in football, device manufacturers must get the basics correct. If you want to watch an FDA investigator scintillate (look-it-up if you must) during a friendly visit, fail to execute in regards to the basic requirements depicted throughout the Quality System Regulation (QSR). Even better, present the investigator with a farrago (look-it-up) of policies and procedures, and dare to call it a cohesive quality system!
Warning letter violations
It is a salient requirement to consider the importance of records while understanding that fundamentally sound record accuracy and retention practices equates to having a reasonable defense in regards to claiming compliance to the QSR. Dr. D scoured through a significant number of warning letter and observations before finding an offending device manufacturer. The good news is that it appears, at least on the surface, the majority of device manufacturers understand the general requirements for records. In short, they get it. However, as the doctor is always quick to point out, there is always at least one in the bunch.
The warning letter recipient, documented in this edition of DG, discarded the inspection checklist after each device was shipped. WHAT WERE THEY THINKING? For starters, what is the purpose of employing a documented checklist if it is discarded after shipment? Remember the world is going green; and now we have a device manufacturer killing trees for no apparent reason. Obviously, the documenting of final acceptance activities and the retention of the results, pass or fail, is considered documented evidence and a salient requirement of the QSR. Once the only evidence is tossed into the circular file by this manufacturer, there is no evidence the inspection ever occurred. This is a clear violation of the QSR, in which case, this device manufacturer was appropriately rewarded with a Form 483 and subsequent warning letter. It was also a violation of DG Rule # 3 – Document the results of all events in writing, because if it is not documented in writing, the event did not occur.
Warning Letter One (March 2010): Observation 7 of 7 – Failure to retain records required by this part for a period of time equivalent to the design and expected life of the device, but in no case less than 2 years from the date of release for commercial distribution by the manufacturer, as required by 21 CFR 820.180(b). For example, your firm documents the final inspection of the Water Lily on a checklist, but discards the checklist after each Water Lily device is shipped.
FDA Response to Observation 7 of 7 – We have reviewed your response and have concluded that it is inadequate. Your firm has not adequately addressed the requirements of 21 CFR 820.180(b) nor have you informed us of any specific plan or provided evidence of immediate corrections and systemic corrective actions.
Quality System Regulation – 21 CFR, Part 820
QSR – Subpart M – Records
Section 820.180 General Requirements
All records required by this part shall be maintained at the manufacturing establishment or other location that is reasonably accessible to responsible officials of the manufacturer and to employees of FDA designated to perform inspections. Such records, including those not stored at the inspected establishment, shall be made readily available for review and copying by FDA employee(s). Such records shall be legible and shall be stored to minimize deterioration and to prevent loss. Those records stored in automated data processing systems shall be backed up.
- (a) Confidentiality. Records deemed confidential by the manufacturer may be marked to aid FDA in determining whether information may be disclosed under the public information regulation in part 20 of this chapter.
- (b) Record retention period. All records required by this part shall be retained for a period of time equivalent to the design and expected life of the device, but in no case less than 2 years from the date of release for commercial distribution by the manufacturer.
- (c) Exceptions. This section does not apply to the reports required by 820.20(c) Management review, 820.22 Quality audits, and supplier audit reports used to meet the requirements of 820.50(a) Evaluation of suppliers, contractors, and consultants, but does apply to procedures established under these provisions. Upon request of a designated employee of FDA, an employee in management with executive responsibility shall certify in writing that the management reviews and quality audits required under this part, and supplier audits where applicable, have been performed and documented, the dates on which they were performed, and that any required corrective action has been undertaken.
Records
The first salient point is that records SHALL be maintained at the device manufacturer or another accessible location. The records must be reasonably accessible and quickly retrievable when the agency shows up on the doorstep for a friendly visit. For example, storing records in Dr. D’s garage would be a bad thing. With a third fridge for storing cold beer, pool supplies stored in a corner and dog food stacked near the atrium door! Not only does the ability to prevent damage to records come into play, the safety of individuals may come into question (especially if the dogs are in the garage). My recommendation is to define, by procedure, how long records are retained on site, and when records should be sent to the archives.
Additionally, ensure the record storage facility such as Iron Mountain (Dr. D is not a paid spokesperson for this supplier), is listed on the Approved Supplier List (ASL). Furthermore, ensure the supplier quality organization adds the record storage facility to the assessment list. Finally, I recommend putting the record retention facility through the proverbial paces. For example, if an FDA inspection is pending, notify the record retention facility in advance. I strongly recommend a few dry runs by requesting records and verifying the speed of delivery and accuracy.
Another significant concern, when dealing with record storage and retention, is the preservation of the actual records. If a device manufacturer really wants get on FDA’s good side, request records from an offsite storage location; and present records that appear to have been a family meal for the local rodent population. Now you must be saying to yourselves, no way this could possibly happen Dr. D! But guess what, it has happened, along with fire and water damaged records. Can you say Form 483?
Finally, if a device manufacturer has automated systems, electronic media, and other electronic data devices; these types of records must also be backed up. It is up to the device manufacturer to decide the frequency and type of storage. However, the term “fire-proof” always comes to mind. The terms duplicate copy and stored off-site also come to mind.
Confidentiality
This requirement is pretty self-explanatory. If a device manufacturer provides FDA with a record that contains proprietary information, the record (all pages) should be stamped with a confidentiality stamp. It is Dr. D’s strong opinion, the stamp’s font should be large, bold, contain the manufacturer’s name, date released, with bright red ink employed. Otherwise, the Freedom of Information Act could result in proprietary information being released to the public. In this scenario, the public can be equated to the competition.
Record retention period
Reflecting back to warning letter depicted in this edition of DG, the minimum requirement is “two years from the date of release for commercial distribution by the manufacturer.” This is not a DG rule, but a cut and dry QSR requirement. One mistake Dr. D sees device manufacturers make is retaining all records either forever or far too long. The doctor strongly suggests that device manufacturers develop a comprehensive record retention procedure that clearly delineates the retention period for every-single type of record. For example, small samples of purchase orders, calibration records, receiving inspection records, preventive maintenance records, bio-testing, environmental monitoring etc., should each have their very own retention time period. It is up to the device manufacturer to decide how long; however, (hint, hint) remember the minimum two-year QSR requirement.
Exceptions to the rules
Dr. D hates exceptions to the rules, which is pretty funny coming from a guy that broke all of the rules as a young engineer. However, there are exceptions delineated under 820.180 of the QSR. Exceptions to section 820.180 are “the reports are required by 820.20(c) Management review, 820.22 Quality audits, and supplier audit reports used to meet the requirements of 820.50(a) Evaluation of suppliers, contractors, and consultants, but does apply to procedures established under these provisions.” However, device manufacturers still must provide evidence that these types of activities have occurred by providing a signed and dated attendance sheet and agenda as evidence the event occurred. Additionally, if these activities required corrective action, evidence of correction shall be provided to the FDA, upon request. Remember, CAPA is one area the agency will have a proverbial field day, if a device manufacturer is not proactive in their approach to pursuing effective corrective and preventive action.
Takeaways
Remember, accurate records and documentation is always a device manufacturer’s best friend during FDA inspections. Dr, D strongly suggests that the record retention procedure be extremely prescriptive in regards to how long each type of record is retained and actual storage locations.
Do not forget to add suppliers selected for off-site record storage to the ASL; and ensure that these record storage facilities are audited. Finally, just because management reviews are not explicitly covered under this section of the QSR, does not mean records associated with this activity should not be retained. This type of record is equally important.
In closing, thank you again for joining Dr. D and I hope you find value in the guidance provided. Until the next installment of DG, when I begin providing guidance for Subpart – M (Records), specifically 820.181 (Device Master Record) – cheers from Dr. D. and best wishes for continued professional success.
References:
- Code of Federal Regulation. (2009, April). Title 21 Part 820: Quality system regulation. Washington, D.C.: U. S. Government Printing Office.
- Devine. C. (2009, July). Exploring the effectiveness of defensive-receiving inspection for medical device manufacturers: a mixed method study. Published doctoral dissertation. Northcentral University. Prescott Valley, AZ.
- FDA – U.S. Food and Drug Administration Website. (2010). Warning letters. Retrieved September 23, 2010, from http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/
Related Articles
-
The new guidance is intended to establish confidence in automation used for production or quality assurance systems and describe various methods and testing activities that may be applied to establish computer software assurance and meet regulatory software validation requirements.
-
The updated guidance document clarifies what constitutes a statement of the basis for the deficiency and includes examples of well-constructed deficiencies and industry responses to facilitate a more efficient review process.
-
The revised cybersecurity draft publication is not intended to be a checklist for healthcare organizations to follow, but rather a guide to help them comply with the HIPAA Security Rule.
-
The draft guidance proposes updates to clarify how the Breakthrough Devices Program may be applicable to certain medical devices that promote health equity, as well as considerations in designating eligible devices that may benefit populations impacted by disparities in health…
