Collecting Information - Setting Up a Post-Market Surveillance System

The data that manufacturers must collect is:

• All the information related to an incident, such as “[a]ny malfunction or deterioration in the characteristics and/or performance of a device… inadequacy in the labelling or the instructions for use which… might lead to…the death of a patient…or to a serious deterioration in their state of health;”2
• The result of post market clinical data studies; 
• Any complaints that don’t arise from an incident; 
• Any data from users, including patients and health care professionals;
• Any information that gives the manufacturer an overview of the evolution of the state of the art;
• The post-market clinical follow-up (PMCF) study. 

The European Commission recently released a new MEDDEV guidance document on PMCF studies and their importance to the manufacturer’s vigilance procedures.3 It provides guidance for manufacturers and notified bodies assessing the system for “identifying and investigating residual risks associated with the use of medical devices placed on the market.”4 Using the device’s risk management file, manufacturers can decide to conduct a PMCF study to monitor any residual risks and continually examine the device’s risk to benefit ratio.  According to the MEDDEV guidance document, some circumstances that arise that justify a PMCF include significant changes or innovation to the device and where the device would be implanted.5

A PMCF study should be outlined in the manufacturer’s post-market surveillance information for the specific device.  According to the guidance document, the study outline should include:

• Study objectives, endpoints, and research questions, including identifying residual risks;
• Sound design plan with a statistical analysis plan;
• A plan to conduct the study in accordance with the appropriate standards; and
• A plan for analyzing the data and for drawing appropriate conclusions.6

Generally, the study should be designed to answer the research questions and address the study’s objectives.  The study may conform to different methodologies  and it should describe the methodology7 to ensure the manufacturer can draw conclusions from the study. Note that the evaluation by the notified body or a competent authority will be easier if the methodology is clearly described.

While manufacturers have the duty to collect data, they can delegate the complaint-collecting task to local distributors.  Because manufacturers have this duty, however, they must make sure to include this task in their contracts and enforce it.  Essentially, a manufacturer should be able to use the post-market surveillance system they design to collect data, analyze the data, and act on the data they receive. 

Analyzing and Acting on Data Received by the Post-Market Surveillance System 

Case of the Data Related to an Incident

The post-market surveillance system must have a method for manufacturers to analyze the data related to incidents it collects from its PMCF studies and complaint collecting.  For medical devices sold in Europe, the criteria and procedure manufacturers use to report incidents is found in MEDDEV 2.12-1 rev 6, Guidelines on a Medical Devices Vigilance System.  This guidance document outlines the procedure manufacturers should use to determine if an event should be reported and the duties of each actor in the vigilance process.

The guidance document first specifies the elements of what a reportable incident is for a competent authority.  According to reporting criteria, when a manufacturer receives a complaint that an event that is linked to their device occurs and a patient or user dies or experiences a serious deterioration in health, the manufacturer must report the incident.8 These incidents must be reported to the relevant competent authorities for the countries in which the manufacturer sells the device in a field incident report.  Depending on the severity of the event, the manufacturer may need to report the incident sooner rather than later.  The manufacturer’s notified body may be informed too.

The manufacturer, monitored by the competent authority, must then perform an investigation to determine what exactly happened in the event.  A format for an investigation report can be found in Annex 3 of the guidance document.  Generally speaking, the manufacturer should report almost all events to the relevant competent authorities and the notified body.  However, the guidance document specifies events that may not need to be reported, such as:

• If the user found a fault with the device and did not end up using the device;
• If the event was actually caused by a patient’s condition;
• If the device exceeded its service life or shelf-life;
• If, by the device’s design, the fail-safe protected against the device’s becoming a hazard when it failed; and
• If an expected and foreseeable side effect that is clearly identified in the manufacturer’s labeling, is clinically well-known to happen, is documented in the device’s records, and is clinically acceptable with regards to the patient’s health.

These events don’t trigger the manufacturer’s vigilance procedure, unlike an incident, and so don’t need to be reported.  It should be noted that if any of these exceptions happen such that the manufacturer notices a trend, the manufacturer should report the trend to the competent authorities.  The GHTF published a document for manufacturers that details the method a manufacturer could use to determine when a set of isolated events that wouldn’t otherwise be reportable should be reported.9

Vigilance in Action - Risk Management

Risk management plays a large role in both the pre- and post-market phases Manufacturers must not only analyze the device’s risk before marketing, but must also continue to analyze the device’s risk throughout its lifetime.  EN ISO 14971 provides clear rules for a manufacturer’s risk management file including the requirements and the process that manufacturers should maintain.  Section three of EN ISO 14971:2009 lists the requirements for risk management:

• A risk management process that extends through the life-cycle of the device including risk analysis, evaluation, control, and production and post-production information;
• Management responsibilities including ensuring that the proper personnel will deal with the risk management and defining the acceptable risk level;
• Qualified personnel who perform the risk management tasks;
• A plan for all the risk management activities that, at minimum, includes the scope of the activities, assignments and requirements for responsibilities, criteria for determining what is acceptable risk, and methods to collect data; and
• Maintaining a risk management file that includes information on the risk analysis, evaluation, implementation and verification of the risk control measures, and the assessment of the acceptability of any residual risks.

Establishing a risk management process is important for manufacturers because it allows them to collect post-market clinical or non-clinical data on their device.  Maintaining a risk management process allows a manufacturer to continually monitor the safety of their device and identify any new hazards or dangerous trends.

To effectively manage a device’s risk, the manufacturer must also continually analyze and document the risk using the process outlined in EN ISO 14971:2009.  In other words, as a part of the update of the risk management file, the PMCF study results is used to analyze the device’s risk throughout its lifetime.  At this stage of the device’s life, the risk analysis should include, among others:

• Investigation of the residual risks identified during the pre-market risk analysis;
• Any modification in the acceptability of identified risks;
• Investigation of emerging risks on the basis of factual evidence;
• Investigation about any lack of clarity on long term clinical performance that may impact the benefit/risk ratio;
• Investigation of new risks identified from the literature or other data sources for similar marketed devices;

Assessing the Post-Market Surveillance System – A Notified Body’s Role

Notified Bodies step in at the start of the post-market surveillance timeline because it must assess a manufacturer’s post-market surveillance system as part of the manufacturer’s quality management system.  A notified body, however, doesn’t help the manufacturer in its post-market surveillance duties.  Instead, the notified body’s role is to verify that the manufacturer has a system in place, that the system conforms to the regulations and standards, and that the system works.  To do this, the notified body first evaluates the planning of these activities.  The notified body could take sample incidents or results of a PMCF study from the manufacturer’s files, audit them to ensure the system was followed, and confirm that the manufacturer implemented any corrective or preventive actions.10 

When assessing a manufacturer’s vigilance system, a notified body first makes sure that the manufacturer’s system conforms to the regulations and standards.  This means that the manufacturer defines which person or position will take on each role in the system and the timeframe to report any adverse events.  The notified body also makes sure that the system is built in a way that the manufacturer could use it.  For example, for a high-risk implantable device that must be traceable, the manufacturer can trace the device from its own factory through the distributor to the user and the end patient.  On the other hand, a system that is not complete cannot give the manufacturer accurate data on the device and its safety and efficacy, which may prove problematic in the future. 

The notified body will also assess the method the manufacturer uses to collect and report incidents about their device.  In this way, it is important for manufacturers to stay on top of the differences in the national laws for each country in which the manufacturer sells a device.  Maintaining a post-market surveillance system that takes these differences into account is extremely important to ensure the manufacturer logs user complaints related to incidents properly according to the different countries.

While having a functioning post-market surveillance system that is properly audited won’t prevent a device recall or adverse event, the system will ensure the patient’s safety isn’t compromised any more than it needs to be as it can be reasonably predictable using some very factual data.  As a result, the post-market surveillance system is an important and integral part of the manufacturer’s quality management system.  It is also part of the elements a company’s board of directors or CEO should take into account when defining the quality and strategic objectives, as it could impact the company’s public image. LNE/G-MED is a notified body with decades of experience in auditing and assessing quality management systems.  For more information on how to use LNE/G-MED’s expertise in pointing out how your quality management system could improve, contact us.

1National Competent Authorities Summary Record of Notifications, 2003-2010, http://ec.europa.eu/health/medical-devices/files/summary_en.pdf;  Nagreha, Nitin MD, Meeta Parmar.  “Study of Medical Device Recalls by FDA Over Last Four Years (2008-2011).”  Applied Clinical Trials Online.  Sep. 20, 2011.  

2MEDDEV 2.12-1 rev 6

3Guidelines on Medical Devices: Post Market Clinical Follow-Up Studies, A Guide for Manufacturers and Notified Bodies.  MEDDEV 2.12/2 rev2.  January 2012. 

4Id. l.49-51.

5Id. l. 206-232.

6Id. l. 250-256.

7Id. l. 169

8MEDDEV 2.12-1 rev 6 §5.1.1

9GHTF/SG2/N36R7:2003

10NBOG 2009-2, Role of Notified Bodies in the Medical Device Vigilance System, §2.1