When Furry Critters Aren’t So Cute
One of the challenges all device establishments face is the storage and protection of records and the ability to make the records available to FDA and other regulators upon request. During an agency inspection performed in 2016, an investigator from the FDA identified a serious problem with record storage at an establishment located in the Southwest of the United States—a rodent infestation. Based on the observations made by an investigator of the FDA, device history records (DHRs) were being used as a bed and breakfast (the doctor assumes other meals, too) by a family, or should the doctor say, extended family of rodents. These furry critters appeared to be fairly intelligent as one banker’s box was used as their outhouse, one box for sleeping quarters, and the balance for their meals. Dr. D would not want to be the chief jailable officer (CJO) attempting to explain to FDA as to what the methodology was going to be for record restoration. The doctor assumes that there was about to be a fierce struggle—an agon (look-it-up) —between the rodents, the exterminator, the CJO and the FDA. Enjoy!
Warning Letter – February 29, 2016
The recipient of this prized agency warning letter received 13 form 483 observations during an inspection that lasted 13 days. One observation for each day of the inspection, a CJO could not ask for more. The one violation that grabbed the doctor’s attention was the one pertaining to the protection of records and the deterioration of records resulting in loss. In fact, the observation mentioned pest control or should Dr. D say, lack of pest control. The doctor has experienced, firsthand, the damaged caused when hungry guests are looking for a meal of processed tree pulp, a warm bed and toilet paper. There is nothing like a banker’s box full of important records such as DHRs to accommodate these unexpected and usually unwelcomed guests. Unfortunately, Mr. Murphy is alive and well in the device industry, so it was no surprise that Mr. Murphy presented a few of these furry guests as subject matter experts (SMEs) on record deterioration and the need to protect quality records during an inspection. Yummy, yummy, yummy they have DHRs in their tummy (sounds like a 60’s rock song or not)!
Warning Letter Excerpt
Observation Thirteen (13) – “Failure to adequately establish procedures to ensure that all records are appropriately maintained in accordance with §820.180 requirements. For example, during an inspection of your off-site record storage facility, rodent dropping were noticed in the banker boxes containing Device History Records (DHRs) from 2015. Additionally, when asked to examine records from Box 2015-06, evidence of record destruction, due to hungry rodents, was duly noted. Moreover, when asked to inspect Box 2015-09, said rodents were found to actually be in the process of enjoying a meal of recently stored DHRs. Finally, when asked to examine the procedure for pest control, the request was refused, as a procedure for pest control had not been established.
We reviewed your response and find it to be not adequate. Calling an exterminator to resolve the infestation is not sufficient. The FDA requires a procedure to be established for pest control. Additionally, the agency requests that you examine the rodent droppings for pieces of consumed DHRs and reconstruct the DHRs that have deteriorated due to rodent hunger to the best of your establishment’s ability. Furthermore, storing cafeteria supplies near DHRs is not considered a best practice. The abundance of picante sauce in the same area of DHRs can be considered an enabler. Finally, according to the U. S. Department of the Interior, the rodents noted during the inspection are considered a protected species so appropriate care must be taken in support of their relocation.
Title 21: Food and Drugs
PART 820—QUALITY SYSTEM REGULATION
Subpart M—Records
§820.180 General requirements.
“All records required by this part shall be maintained at the manufacturing establishment or other location that is reasonably accessible to responsible officials of the manufacturer and to employees of FDA designated to perform inspections. Such records, including those not stored at the inspected establishment, shall be made readily available for review and copying by FDA employee(s). Such records shall be legible and shall be stored to minimize deterioration and to prevent loss. Those records stored in automated data processing systems shall be backed up.
(a) Confidentiality. Records deemed confidential by the manufacturer may be marked to aid FDA in determining whether information may be disclosed under the public information regulation in part 20 of this chapter.
(b) Record retention period. All records required by this part shall be retained for a period of time equivalent to the design and expected life of the device, but in no case less than 2 years from the date of release for commercial distribution by the manufacturer.
(c) Exceptions. This section does not apply to the reports required by §820.20(c) Management review, §820.22 Quality audits, and supplier audit reports used to meet the requirements of §820.50(a) Evaluation of suppliers, contractors, and consultants, but does apply to procedures established under these provisions. Upon request of a designated employee of FDA, an employee in management with executive responsibility shall certify in writing that the management reviews and quality audits required under this part, and supplier audits where applicable, have been performed and documented, the dates on which they were performed, and that any required corrective action has been undertaken.
Compliance for Dummies
The control of records is an extremely important and albeit a fairly easy requirement to comply with. For example, the FDA has a requirement for records to be reasonably accessible for review when the agency drops by for a cup of coffee and an inspection. Additionally, electronic records should be backed up. Can you say the cloud (a.k.a., server farm)? Furthermore, records are expected to be legible and protected from deterioration, or in the case of the warning letter observation, a meal for the local family of Giant Gambian Rats (do you remember the movie Ben or the movie Willard)? Yes, the doctor is dating himself. Finally, no whiteout correction fluid should ever be used in the correction of mistakes. Seriously, the doctor still comes across the use of whiteout, but not too often. Can you say good documentation practices (GDP)?
Other elements to keep in mind when dealing with the control of records are:
- Record confidentiality and the protection of IP, so the FDA knows what it can share with the public and what it must keep confidential (including HIPAA compliance)
- Record retention of two years (essentially two years from when the last device is entered into commerce for DHRs)
- And most important: Knowing what records have to be shared with FDA and what records do not (management review, internal audits and supplier audits do not have to be shared with the agency, only documented proof that they have occurred)
Takeaways
For this week’s guidance the doctor will leave the readers with just one takeaway: Is this an April Fool’s Day ruse by the old doctor or did the aforementioned events really occur? April Fools? In closing, thank you again for joining Dr. D, and the doctor hopes you found value (and some humor) in the guidance provided. Until the next installment of DG, cheers from Dr. D., and best wishes for continued professional success.
Think this story is the fake news? Correct, it is! Happy April Fool’s Day!
References
- Code of Federal Regulation. (April 2017). Title 21 Part 820: Quality system regulation. Washington, D.C.: U.S. Government Printing Office.
- Devine, C. (2011). Devine guidance for complying with the FDA’s quality system regulation –21 CFR, Part 820. Charleston, SC: Amazon.
- Devine, C. (2013). Devine guidance for managing key attributes of a FDA-compliant quality management system – 21 CFR, Part 820 Compliance. Charleston, SC: Amazon.
- Dr. D’s enforcement page. (February 2016). DGII Website. Accessed March 27, 2018. Retrieved from http://www.devineguidanceinternational.com
Related Articles
-
The new guidance is intended to establish confidence in automation used for production or quality assurance systems and describe various methods and testing activities that may be applied to establish computer software assurance and meet regulatory software validation requirements.
-
The updated guidance document clarifies what constitutes a statement of the basis for the deficiency and includes examples of well-constructed deficiencies and industry responses to facilitate a more efficient review process.
-
The revised cybersecurity draft publication is not intended to be a checklist for healthcare organizations to follow, but rather a guide to help them comply with the HIPAA Security Rule.
-
The draft guidance proposes updates to clarify how the Breakthrough Devices Program may be applicable to certain medical devices that promote health equity, as well as considerations in designating eligible devices that may benefit populations impacted by disparities in health…
