Abstract
Risk management is a requirement that must
be met by medical devices manufacturers; therefore, as
established by the ISO 14971, a methodology to properly manage
design, production and post-production risks was introduced at
ICID. So, a team of experts conducted a preliminary diagnosis and
proposed a schematic representation associated with the risk
management process. Finally, a risk management procedure was
implemented in January 2012. The procedure implementation allowed
the identification, estimation and evaluation of the risks in the
whole life cycle of products. It facilitated the analysis of the
data related to the classification of the hazards, its effects
and possible causes to determine which risks are unacceptable,
and to propose necessary corrective and preventive actions to
reduce the impact of these on the safety and efficacy of medical
devices. The result in the application of a
defibrillator validated the proposed methodology,
identified 88 hazards, 32 of them unacceptable,
which was proposed control measures and risk prior to
introduction to the production were evaluated, becoming
acceptable risks .
Keywords— risk
management, risks, hazards, medical devices,
safety
I.
INTRODUCTION
ICID, a Digital Medical Technology Company, has worked
for more than 30 years in the design, production and post-
production of medical devices. Its portfolio includes devices for
monitoring critical patient"s vital signs, as well as others
mainly intended for cardiology [1]. Figure 1 show some medical
devices developed at ICID.
Fig. 1: ICID"s
Portfolio
The evaluation and validation of the design, production
and post -production of medical devices regarding compliance with
regulatory requirements of safety is mandatory for all
manufacturers [2][3]. The adoption of a quality management system
according to the international standard ISO 13485 [4] throughout
the life cycle of the medical device ensures product safety. The
above standard incorporates the risk management process in clause
7.1.The ISO 14971 [5] standard requires
manufacturers to establish a process of risk management to
medical devices. The manufacturer shall establish, document and
maintain throughout the life cycle of the product, a process for
identifying hazards associated with the medical device, estimate
and evaluate the associated risks and ensure the effectiveness of
its control. This process includes: the analysis, evaluation, and
control of the risks, risk management report and the production
and post-production information [4-6].
This paper presents both the experiences and the
obtained results in the implementation of the risk management
process at ICID.
II. MATERIALS AND
METHODS
The first step for the implementation of the process of
risk management was the creation of a commission integrated by
experts with the necessary expertise in the design, production
and post production of medical devices, and specialists with
knowledge in systems of quality assurance and risk management
techniques [6-8]. The created commission worked during several
months using team work and brainstorming.
The group of experts carried out a diagnosis of the
operation of the ISO 9001quality system [8] implanted at ICID to
determine the common aspects to retain when establishing a new
quality system based on the ISO 13485 standard. The group pointed
out the strategies for the implementation of the risk management
system during the cycle of life of the medical device, based on
the analysis of the strengths, weaknesses, opportunities and
threats, and also doing brainstorming sessions.
General, individual and collateral standards for safety
of medical devices (eg IEC 60601-1) and standards related to
techniques for risk management (eg, IEC 60812 and IEC
61025) were reviewed [9-12].
The elements of the process were defined: Plan risk
management, analysis; evaluation and control of risks, the risk
management report and the production and post- production
information.
Finally, the commission elaborated a procedure
considering the elements of ISO 14971 and PDCA cycle Deming
(Plan-Do-Check-Act) [8].
In the presentation and discussion of the procedure for
its approval for the top management were used brainstorming
sessions and the innovation cycle.
To implement the procedure were used courses, seminars,
case studies, techniques for the decision making, histograms and
pie chart.
In the assessment of the efficacy of the process were
used flow charts and the data collection sheet.
III. RESULTS AND
DISCUSSIONS
As a result of the diagnosis the following weaknesses,
strengths, opportunities and threats were identified:
Strengths: to have a multidisciplinary
group of researchers, producers, technicians, buying specialists,
marketing experts and specialists in quality assurance, the
existence of system quality assurance based on ISO 9001:2008, and
to have a failure database in production and post-production.
Weaknesses: deficient risk management training of the production
and post-production personnel, and inadequate information to
ensure a productive process.
Opportunities: necessity to expand the export market of
medical devices under a quality system based on ISO 13485 and CE
marking.
Threats: the absence in Cuba of certification bodies or
experienced consulting organization in quality systems ISO
13485.
The commission proposed a schematic representation of
the risk management process (figure 2), taking into account all
the stages in the life of a medical device from the initial
conception to decommissioning and disposal. The procedure
includes:
Responsibilities in the Risk Management Process:
General Manager, Director of Research and
Development, Project Managers, Technologists of medical devices
and Risk Manager.
Risk Management Plan: Includes the scope of
activities planned of the risk management process, the
identification and description of medical devices and life cycle
stages for which each element of the plan applies; the allocation
of responsibilities and authorities; the requirements for the
review of risk management activities; the criteria for risk
acceptability and verification activities.
Risk Analysis: It describes and identifies the
products, features related to the safety of medical devices,
according to general safety standards (IEC 60601-1) and
regulatory documents (CECMED), also it identifies individuals and
organizations involved in risk analysis and the scope and date of
analysis. Hazards are identified during the life cycle of
medical devices.
Estimation of the Risk: Matrix qualitative risk
(5x 5) into Research-Development and determining the Number of
Risk Priority (RPN), using the criteria of probability, severity
and detectability on a scale of 1 to 5 in Production and Post-
Production.
Risk Evaluation: For each hazard identified the
manufacturer decides whether the estimated risk is
not sufficient to implement control measures to reduce them.
Research- Development indicated in the risk matrix and Production
and Postproduction compares the RPN calculated with the
manufacturer.
Risk Control: Control measures are applied to
reduce unacceptable risks. Also, in this phase it is checked
whether the measures taken have been effective or not and new
risks are identified if entered as a result of taken
actions.
Residual Risk Evaluation: After applying the
control measures, the residual risk is evaluated. If the risk of
a medical device is greater than the manufacturer"s
criteria for acceptable risk, it is necessary to apply additional
measures and to evaluate the risk benefit for all the interested
parts.
Risk Management Report: It provides
evidence that the manufacturer has ensured that the risk
management plan has been implemented appropriately, it is
declared the methods to obtain the production and post-production
information, including the training required by all the
interested parts. Production and Post-production
Information: Production and post-production data, from
various sources, such as users, service personnel, training
personnel, incident reports of adverse events, complaints and
claims from customers are collected.
Risk Management File: Each process
is controlled and saved in a file to show evidence
of traceability of the process of risk management throughout the
life of the medical device. The file contains the risk management
plan, analysis, evaluation and control of risks, the risk
management report and the production and post-production
information.
The procedure was implemented gradually in
all products. Table 1 shows the hazard identification for a class
IIb medical device (defibrillator) in Research
Development.
Table 2 presents the hazard identification defibrillator
manufacturing process.
Production and Post-production information is an element
to evaluate the impact of the risk management process, keeping in
mind the description of the presented hazards, the probability of
occurrence of them and the harm that it causes for the security
of all parts. This information is the input for the process to
control and reduce to acceptable levels the unacceptable risks.
Insufficient control of the manufacturing process compromises
safety requirements of medical devices. The preparation of
production information, whenever a lot is done, identifies the
most vulnerable steps of the production process and control
actions needed to reduce unacceptable risks. Figure 3 shows the
behavior of the hazards in the production of
defibrillator.
Fig. 2: A schematic
representation of the risk management process
Fig.3: Hazards in the
defibrillator production
Post-production information is another
source of data to identify, evaluate and control risks. Figure 4
shows the behavior of the hazards in the defibrillator after
finishing the first post-production information.
Studies on the behavior of the hazards and the
percentage of unacceptable risks have been conducted on the ICID
products. The calculation of the risk index allowed comparing the
results obtained in the production and post-production of the
medical device (1):
(1)
rna: unacceptable risks pi: identified
hazards IGR: risk index
Figure 5 shows the behavior of the risk
index for the defibrillator.
Fig.4: Hazards in the
defibrillator post-production
Fig.5: Behavior of the risk
index for the defibrillator.
In the first lot of production and in the
first post-production information for the defibrillator, risk
indexes are equal and greater than those established
by the ICID, so measures were taken to reduce the risk at a
reasonable cost without affecting the safety of the medical
device. Each improvement activity includes an analysis of the
technical feasibility and economic evaluation that
allows evaluating the medical device"s risk- benefit for all
interested parts.
The causes of hazards situations in the defibrillator
were reviewed to reduce the risks. Figure 4 shows that a large
percentage of the risks are associated to the use of the medical
device. The user and technical service manual were reviewed and
modified to ease their use by the service personnel, as well as
by the medical and paramedical personnel operating
the device in health units. Training was provided to
operators to improve their performance or ability to
detect errors.
The impact assessment on the implementation of the risk
management process during the life cycle is carried out by
analyzing the trend of the residual index after applying and
implementing control measures. Note that after controlling
unacceptable risks at the end of the third post-production
information, the risk index is reduced to 2%, applying additional
measures with regard to the training of the personnel operating
the medical device.
In the initial evaluation in the defibrillator, 88
hazards were identified, 56 acceptable and 32 unacceptable risks
were estimated. The highest incidence of unacceptable risks was
errors in the use, operation and design. Figure 6 shows the risk
evaluation. All measures to control the risk or minimize the
incidence of unacceptable risks focused on the use of standards
for the design of medical equipment, the location of warnings or
signals about the product and / or manual and preparation manuals
for the operation of medical equipment in a clear and concise
understanding for service personnel who install and repair the
equipment, as well as for medical and paramedical personnel who
operate the equipment in the health unit. Figure 7 shows that
after implementing control measures the risks unacceptable became
acceptable.
Fig.6:
Risk evaluation in the defibrillator
Fig.7:
Residual risk in the defibrillator
IV
CONCLUSIONES
A risk management process for medical devices was
implanted at ICID. The developed procedure was incorporated to
the quality system ISO 13485, as an obligatory requisite that all
manufactures must comply throughout the medical device"s life
cycle.
The identification, estimation and control of risks in
research and development, production and post-production enable
monitoring of the risk index to assess the effectiveness of the
processes according to the criteria set out in the risk
management plan for the manufacturer the medical
device.
The hazards data and their estimation in Production and
Post-production allow the evaluation and control of the
unacceptable risks. The application of well-timed improvement
actions guarantees the security and effectiveness of the medical
device.
The procedure application experience resulted in an
improvement in the quality and safety of medical
devices
We have identified a number of hazards in the
defibrillator and was controlled non-acceptable risks at the
stage of Research and Development. The monitoring in the process
of Production and Postproduction identified new sources of
unacceptable risks, which were monitored in real time, taking
more secure medical device.
CONFLICT OF
INTEREST
"The authors declare that they have no
conflict of interest".
REFERENCES
1.
http://www.combiomed.sld.cu/html/perfil.htm Portfolio of medical
device.
2. CECMED. State Center for the Quality
Control of Medicaments, Equipment and Medical Devices
3. http://www.ghtf.org. Global
Harmonization Task Force.
4. ISO 13485:2003. Medical devices.
Quality.management Systems. Requirements for
regulatory purpose.
5. ISO 14971:2012. Medical devices.
Application of risk management to medical devices.
6. ISO 31000:2009. Risk management.
Principles and guidelines.
7. IEC ISO 31010, Ed 1.0: 2009 Risk
management .Risk assessment techniques.
8. ISO 9001:2008. Quality.management
.General requirements
9. IEC 60812: 2006. Analysis and
techniques for system reliability. Procedure for
failure mode and effects analysis
10. ISO Guide 73:2009. Risk management.
Vocabulary.
11. IEC 61025: 2006.Fault tree
analysis
12. IEC 60601-1:2012. Medical electrical
equipment. Part 1: General requirements for basic safety and
essential performance.
Autor:
Tamara Rodriguez-Parra
Rivas1
Evelia Medina
Martínez1
Arlem Fernández
Sigler1
Jorge A. Rodriguez
Rubio1
Leonor Calaña
Fuentes2
José Folgueras
Méndez2
Teresa González
García2
Ing. Jorge Luis Espinosa
Portieles2
1,2ICID / Miembro SCBI, Habana,
Cuba