FDA 21 CFR Part 820, also known as the Quality System Regulation (QSR), outlines Current Good Manufacturing Practice (CGMP) regulations. These requirements will ensure the safety and effectiveness of medical devices.
Traceability, Continuous Improvement and Customer Feedback
The work companies complete to become ISO 13485 certified satisfy much of the qualifications of complying with CFR 820. Once a company registers with the FDA, Lissy explains, it is placed on the audit cycle.
“FDA auditors, then, will come to your facility and make sure that you’re doing what you say you’re doing,” she says, “and have the required quality systems in place. The audit focuses in three main areas: traceability, continuous improvement and handling of customer complaints.”
While none of this is specific to AM, auditors will scrutinize your processes, Lissy says, including those related to AM including powder handling and qualification, processes for keeping work areas clean, the effectiveness of the air-handling system, and the ability to produce metal-AM parts free from powder residue and sterilize those parts.
“In medical, we actually care about these details,” Lissy says. “And, FDA auditors will scrutinize your IQ/OQ (input and operational qualification) processes.”
On the IQ front, manufacturers must be able to verify that newly installed or modified equipment, including that for AM, can produce the desired results, “from the first printed part to the last,” Lissy says. This stage requires documentation verifying that the machine and its components have been installed and configured according to the manufacturer’s specifications.
“The quality-assurance process also must document the plan for ensuring the consistent use of all aspects of the machine,” Lissy adds, “including powders, instruments (process parameters) and software.”
Regarding OQ, manufacturers must define and follow procedures for periodically testing their equipment to ensure consistent performance. Separately, performance qualification (PQ) is the documentation process for assessing whether the equipment continues to function within the desired working range.
“ISO 13485 and CFR 820 provide the recipes for ensuring that all of the necessary processes are in place,” Lissy says, “to prove that you’re doing what you say you are doing, that you have the required training in place and training records, and that you have process traceability from beginning to end. Again, all of this is meant to ensure that the first build and the last are exactly the same.”
Top-Down Continuous Improvement
ISO certification and FDA registration also require a detailed continuous-improvement (CI) plan that brings together the entire team, including management, and that encompasses customer feedback.
“Client complaints must be accounted for,” Lissy stresses, “along with complete traceability, as this is where the lawsuits happen. If a customer complains, you should be able to track lot numbers, identify the machine used to print the part and the machine operator, and explain what might have gone wrong. Then the CI cycle kicks in, including performing and documenting a root-cause analysis of what happened and why, and the process-improvement plan to ensure that it doesn’t happen again.”
Inconsistent results often are the bane of the metal-AM industry, Lissy opines, meaning that AM companies must have the processes in place to ensure consistent production. “The scrutiny from the FDA is there,” she stresses. “A lot of companies can perform AM and there’s very little traceability required in most cases. But when it comes to building medical devices, manufacturers must understand and adhere to the regulations, requiring a careful and diligent approach to their quality systems. And, if there’s a problem, they must be able to go back and trace the root cause and solve it, and have a CI program and feedback loop.”
A Proactive Approach to Risk Management
In 2016 the ISO 13485 standard evolved with new reporting and risk-management language, to where risk management requires that manufacturers proactively identify potential process hiccups and implement plans to avoid them, rather than react to issues after the fact.
“In effect, FDA, when auditing to this,” says Lissy, “says to point a lens toward your quality system to identify potential issues and implement plans to avoid them. For our company, as an example, we at one time had siloed business units for finance, sales and operations, which we believed created a high level of risk. In response, we implemented a new software package that aligned these three units and eliminated the data silos, reducing our risk.”
Lissy goes on to list the six most common mistakes that manufacturers, including those producing metal-AM medical products, make when implementing ISO 13485 and seeking FDA registration:
- Treating processes as “checkbox” activities
- Internal auditing
- Death by CAPA (corrective and preventive actions)
- Customer feedback
- Management reviews
- Risk-based processes.
The top three issues, she says: underuse of the CAPA system, lack of appropriate investigation of complaints, and inattention to design and document changes.
“Don’t be afraid of your CAPA system,” Lissy says. “A properly utilized CAPA program is a good indication of a diligent quality system. And, a good CAPA process will help fuel a productive and rewarding continuous-improvement process.
“When it comes to metal AM,” she adds, “the most significant thing I’ve learned is the importance of a clean workspace and clean air. I’ve seen, for example, setups with multiple AM machines in one huge room, and others where each machine has its own room. AM really requires a clean workspace, especially when compared to subtractive manufacturing and even more so when making medical parts.”
A final bit of advice: Don’t overlook management review, Lissy warns, which in medical-device manufacturing is a must. “Your management team must pay close attention, day in and day out, to everything that’s happening, good and bad, and, most importantly, how the quality system addresses the bad.
“For example,” Lissy continues, “at Empirical Technologies we conduct an effectiveness checkup 6 months after we implement any corrective action—and we document it. In quality, actions don’t count if you don’t document them. At smaller companies, this often requires a mind shift—talk about it, take notes and document the action plan. Then go back later and recheck it and document any further actions. Most quality systems require management review at least annually, but I believe that most companies supplying metal-AM medical parts should conduct these reviews at least twice per year.” 3DMP
See also: Additive Manufacturing Users Group (AMUG), Empirical Technologies Corp
Technologies:
Generally, manufacturers required to register with the FDA also must list the devices made there and the processes performed. Most medical devices distributed in the United States also must include a unique identifier, submitted to the Global Unique Device Identifier Database. And, FDA now requires medical-device manufacturers, and importers, to submit adverse-event reports, in electronic format, to FDA when evidence suggests that a device may have contributed to a patient death or serious injury, or when a device malfunctions and reoccurrence of the malfunction would likely contribute to death or serious injury.
