QMS for Software as a Medical Device [SaMD] Lessons Learned from a Quality Perspective

(1)

MedCon 2015

Francis Blacha, Robert Banta

QMS for Software as a Medical Device [SaMD]

Lessons Learned from a Quality Perspective

(2)

Evolution from Physical to Digital Devices

App running on mobile device

From

To

Mechanical injection pens:

--Instructions for Use (IFU) (printed)

--Labeling (printed)

--Patient Inserts (PI) (printed)

--Secondary Packaging (required)

--Cartons (required)

Software as a Medical Device (SaMD):

--Instructions for Use (IFU) (on screen)

--Labeling (on screen)

--Patient Inserts (PI) (none)

--Secondary Packaging (none)

--Cartons (none)

(3)

QS Elements Commonalities & Differences

Physical vs Digital Devices

Elements Common? Different?

Data Integrity



Training



Product Launch Approvals



CAPA



Cybersecurity



Risk Management



Human Factors



Purchasing Controls/Supplier Management



Digital Connectivity



Complaints



Recall/Market Withdrawal



Change Control/Configuration Management



(4)

Challenge:

Evaluate & enhance Device QMS to enable Development

& Commercialization of SaMDs

QS Elements Commonalities & Differences

Physical vs Digital Devices

App running on mobile device

(5)

Assessing QMS: Support

Development & Commercialization of SaMD

Typical linear development life cycle model for physical devices

(6)

Source IBM: http://www.ibm.com/developerworks/rational/library/compliant-agile-medical-device/fig05_lg.html

Typical nonlinear (iterative) development life cycle model for SaMD

Assessing QMS: Support

(7)

1. Integrating Standards:

Provide clear expectations on how to achieve quality objectives. The standards describe what and who is responsible.

2. Business Processes:

Simple and effective, provide information on how operations are to be performed to meet requirements per the integrated standards.

3. Organizational:

Defined roles to assure clear responsibilities and accountabilities. Skills must meet the needs of the specific roles.

4. Governance/Management Oversight:

Ensures management is involved when decisions are required at the appropriate accountable levels.

“System of Quality” Model

(8)

Applying the Lilly “System of Quality” results in consistent outputs:

 High-quality products  Accurate and

complete safety and efficacy data through

design, execution,

monitoring and continuous improvement of Quality

These outputs are achieved via:  Applying sound scientific principles  Balancing product commercialization effort commensurate with risk  Facilitating continuous improvement

(9)

Lessons Learned So Far…

Some Recent Experiences

(10)

U.S. Medical Device Classification Decision Process

Integrated Standards

Integrated Standards – Device Classification

Determine Intended Use Determine Product Codes(s) & Regulation Number(s)

Decision Process

Outcomes

510(k) Submission & “GMP’s” required No submission, but GMP’s are required Device ?

Mobile App (NOT mobile medical apps) Yes

No No submission, GMP

“exempt”, except for specific provisions

Class II

Class I

PMA Submission & “GMP’s” required

Class III

(11)

EU Device “Standalone Software” Decision Process

1

Integrated Standards – Device Classification

Determine Intended Purpose Device ? Stand Alone S/W NOT a medical device No

•the software does not perform an

action on data, or it performs an action limited to storage, archival,

Communication, ‘simple search’

1_{MEDDEV 2.1/6 January 2012} Active medical

device

Yes _influenceDrive or another device ? Classification Rules 9 - 12 Classified the same as the other device Yes No

Decision Process

Outcomes & Requirements

Class IIb Class IIa Class I (It depends) Annex VII: •Tech Documentation •Declaration of Conformity

•AE reporting &

complaint handling

•Recalls

Annex II:

•Quality System •Notified Body Cert •Tech Documentation •Declaration of

Conformity

•AE reporting &

complaint handling

•Recalls

11 11

(12)

International Medical Device Regulators Forum

(IMDRF)

Source: http://www.imdrf.org/docs/imdrf/final/meetings/imdrf-meet-140829-washington-presentation-samd.pdf

(13)

IMDRF Framework for Risk Categorization of SaMDs

Integrated Standards – Device Classification

(14)

Mapping Standards Applicable to SaMDs

Source: http://www.emdt.co.uk/article/developing-medical-device-software-iso-62304

(15)

Integrated Standards –Standards Analysis

Assessed traditional Device Standards associated with software, including:

• Software Validation

• Medical Device Software

• Device QSR

• Device QSM

Evaluation of Various Standards

(16)

Mapping Standards Applicable to SaMDs

Integrated Standards –Standards Analysis

(17)

Standards Analysis Exercise Output was a Roadmap addressing

IEC 62304 Risk-scaled Deliverables across Design Control Phases

SaMD Medical Device Software Lifecycle Model (IEC 62304: 2006)

(18)

Developed a Global Quality Standard that defines

SaMD quality requirements for (among others):

 Design controls

 Risk management (including cybersecurity)

 Human Factors

 Distribution

 Purchasing Controls

 Labeling

 Privacy

 Data Integrity

 Product Recall

Integrated Standards – Analysis Output

(19)

SaMD Formative Human Factors Studies

• Formative HF Study to verify the effectiveness of knowledge gained

• Essential to have a cross-functional HF team

Rapid iteration of HF Studies allows for easier change/verify cycles in software

versus conventional change/verify cycles for physical devices.

Users interact

with software

Usability experts

take user feedback

Programmers make design

changes based on feedback

Users/Programmers

verify changes

Business

Processes – Human Factors

Business Processes

(20)

Business

Processes – Product Recall

SaMD Recall/Market Withdrawal

Commonalities/Differences

Problem Identification

Risk Assessment & Decision to recall

Recall plan & communication planning Issue recall communications Recall / Market Withdrawal Monitor/review recall Effectiveness/ Update stakeholders Recall Complete Plan for physical removal

from market

Accomplished via print media and traditional mailings

Physical removal from market

Physical counting of recalled product

Plan for SaMD deactivation or forced

software upgrade

Accomplished via e-mail notifications

Digital deactivation or forced software upgrade

Measured digitally via SaMD connection with

cloud

(21)

Business

Processes – Patient Instructions

Labels and Instructions for Use (IFU)

Physical Device

SaMD

Label attached to device Label integrated into software and displayed on screen

IFU included with packaging IFU integrated into software and displayed on screen

Label update via printing of new labels Label updated electronically via software upgrade

IFU update via printing of new IFU IFU updated electronically via software upgrade

Label and IFU subject to loss, alteration, or replacement without authorization

Software label and IFU cannot be lost, altered, or replaced

(22)

Source: http://www.pmoplanet.com

Organization

: Roles and Responsibilities

SaMD require new technical expertise:

 Mobile Application Software Engineer

 IT Network Infrastructure Specialist

 Global Information Security Architect

SaMD require identification of right span of control plus

clear accountability:

 Device classification

 Software safety classification determination

 Risk management process ownership

 Patient safety decision ownership

 Cloud service provider supplier chain ownership

(23)

Source: http://blog.procore.com/

Organization: Defining Roles and Responsibilities

SaMDs require clear lines of accountability for

among other items issue escalation/resolution

regarding:

 SaMD commercialization decisions

 SaMD launch approvals

 Privacy decisions

 Data analytics usages

 Cybersecurity practices (app level and Cloud level)

 Due diligence of Cloud vendors

(24)

Organization - Capability

Physical Device Team:

 Project Manager

 Regulatory Affairs/Qualified Person  Medical Device Development Engineer

 Medical Device Quality Assurance Representative  Human Factors Consultant

 Medical Affairs Consultant

Additional Software skills:

 Mobile Application Software Developer  Global Information Security Architect  IT Quality Assurance Representative  Cloud Infrastructure Consultant

Example of Team Participants

(25)

Gov./Mgmt. Oversight

Focusing on

governance/

management

oversight:

 Management

involvement

 Problem

escalation

 Decision

making

 Auditing

Source: http://www.praxity.com/about-us/Pages/The-Governance-of-the-Alliance.aspx

(26)

Governance/Management Oversight

Gov./Mgmt. Oversight

(27)

So far…

 Early identification of the regulatory classification for SaMD both US and OUS

 Establish global quality standard (quality requirements)

 Ensure involvement of IT team in oversight of Cloud infrastructure

 Modify recall/market withdrawal processes to address SaMD technology

capability

 Formative HF Studies enhanced by modifying SaMD code from daily patient

interactions

 Enhance product surveillance processes and patient safety processes to address

the unique technology associated with SaMD

(28)

Conclusion

Integrated Standards Business Processes Organization Governance/ Management Oversight

 Established Cloud change control governance

 Developed cross-functional due diligence process for selection of Cloud vendors

 Addressed auditing

responsibilities for MMA/SaMDs

 Increased HF Study design enhancements  Modified recall/

market withdrawal

 Adapted process controls for e-labels/e-IFUs

 Brought mobile app

software SMEs into device design team

 Added Cloud

infrastructure vendor & established supplier

controls for Cloud vendor  Created a Quality

standard that addresses design control and product commercialization requirements for MMA/SaMDs

“System of Quality’ Model used to enhance device QMS to support development and

commercialization of SaMD

(29)