With integrated, value-based healthcare moving health awareness and care "upstream" to prevent hospital care, medical devices are becoming more and more integrated in the lives of patients. That is, in our everyday lives, since digital healthcare technology is used even before (and specifically to prevent that) we become patients.
The group of products regulated by various medical standards is expanding to include everything from health monitoring smartphone apps to high-tech neurostimulation devices. Developers of these products now face the challenge of having to adhere to continuously updated regulations in order to achieve compliance, and thus to be able to market their products. As one of the most critical requirements of several medical standards (and specifically covered by ISO 14971), the adequate management of product risks is becoming a source of headache for medical device developers around the world.
Related reading: Medical Technology Trends in 2018
Standards regulating risk management in medical device development
Due to their safety-critical nature, developers of medical devices have to ensure that their products function reliably and as expected, causing no harm to patients, the operators of the device, or the environment. One aspect of making sure that everything works as intended is, quite simply, to reduce or mitigate the chances of anything going wrong; a crude definition of risk management itself.
As mentioned above, the standard ISO 14971 focuses specifically on the application of risk management to medical devices. But other standards also require developers to implement risk management practices: ISO 13485, the regulation covering Quality Management Systems for medical devices, calls for the application of adequate "risk management throughout product realization". By FDA regulations, risk assessment is required as part of design validation (820.30 (g)).
Learn more about compliance with ISO 14971 in our webinar from March 2017:
So it's clear that managing risks is a crucial process for all developers of medical devices and some other digital healthcare products. Regardless of the large number of companies affected, interpreting the requirements of the various regulations, and putting into practice a system of risk management that fulfils all those requirements is still a challenge. In the following, we'll give a quick rundown of managing risks according to ISO 14971, an immensely complex topic on its own. Implementing management policies, procedures and practices for managing risks is best supported by Intland's Medical IEC 62304 and ISO 14971 Template 3.0. This all-inclusive template may be used out of the box to reduce the time, effort, and cost requirements of compliance, and to make sure your risk management is as thorough as it needs to be.
The risk management lifecycle explained
With or without the help of advanced software tools, you'll have to follow certain steps in order to implement a thorough risk management lifecycle:
1) Establish risk management framework
Any risk management process that aims to be compliant with ISO 14971 and other regulations needs to start with establishing a risk management framework. Essentially, what this means is that you will have to define the process you'll be using, and the roles and responsibilities that will help you get there. You will also need to make sure that your risk management plan & lifecycle is adequately documented: a risk management file needs to be established to contain all the documents and records that the risk management process produces.
2) Analyzing risks
The risk analysis stage starts with defining the intended use of your product, as this will help guide your risk management efforts going forward. By specifying the cope of your product and detailing its intended use, it will be easier for you to overview all the hazards that might be relevant, which is the second step of risk analysis. All potential sources of harm ("hazards" in ISO 14971 terminology) will need to be analyzed to understand not only the causes, but also the risks these hazardous situations. You will need to identify the foreseeable series of events resulting from a hazard, and assess the risks based on this.
Defining the values of severity and occurrence (probability) will help quantify and evaluate risks. For instance, you will not have to worry too much about a hazardous situation that is very likely to occur, but will not cause much harm. An unlikely, but possibly lethal or otherwise tragic hazardous situation will need to be treated as a high-risk situation. Visualizing your risk overview on a matrix diagram is a good idea:
After determining the level of acceptable risk, you'll be able to clearly identify on the matrix if taking risk actions will be necessary.
3) Risk control process
This is where some of the actual risk management takes place. The aim of implementing risk controls is to reduce or mitigate risks to an overall acceptable level. In the context of medical device development, there are a few ways you can do this: ideally, you'll adjust the design of your device so that the risk is reduced or even mitigated. Should that not be possible, your next best option is to integrate protective measures in your device to prevent risks from occurring or causing harm. The least effective option is adjusting the labeling, or adding certain instructions related to the risk to the device's manual.
It's important to note that documenting your risk management processes shouldn't be limited to just certain stages of the lifecycle. After implementing these measures, you will have to confirm and document the effectiveness of all your risk control actions in order to be compliant. Not only that, but you will also have to keep an eye out for any risks resulting from your risk mitigation actions. By redesigning the product or adding further protective measures, you might be exposing the device to even more risks which will need to be taken into consideration. A risk/benefit analysis may be necessary, and residual risks will need to be evaluated to determine if the overall risk level of your device is acceptable.
4) Risk management reporting & documentation
Adequately reporting on your risk management activities throughout the lifecycle is crucial to achieving compliance. Make sure your risk management file contains all the actions, reports, assessments and diagrams created during the process of risk management. You will also need to update this file with any feedback regarding your medical device, whether it's coming from the market, internal audits, or any other source.
While not exactly easy, implementing thorough risk management processes in compliance with ISO 14971 is far from impossible. Using the right tools to automate as much of the process as possible, and to manage all relevant data in a structured manner helps a great deal. To find out more about the medical-related capabilities of codeBeamer ALM and Intland's Medical IEC 62304 and ISO 14971 Template, simply request a free 1-on-1 demo today.