Risk classification guide for medical device establishment inspections GUI-0079

Month Day, Year

Date issued: TBD

Date implemented: TBD

Replaces: Guidance on Risk Classification of Medical Device Observations (October 1, 2010)

Également disponible en français sous le titre :
Guide de classification des risques pour les inspections d'établissements d'instruments médicaux

For more information, please contact:

Health Canada
Address Locator 0900C2, Ottawa, ON K1A 0K9
Tel.: 613-957-299
Toll free: 1-866-225-0709
TTY: 1-800-465-7735
Email: publications@hc-sc.gc.ca

^©Her Majesty the Queen in Right of Canada, as represented by the Minister of Health, 2019

Publication date: Month 20XX

This publication may be reproduced for personal or internal use only without permission provided the source is fully acknowledged.

Cat.: H14-327/2019E-PDF
ISBN: 978-0-660-30982-8
Pub.: 190053

About this document

1. Purpose

This document is intended to help ensure consistency among Health Canada inspectors during medical device establishment inspections when:

• classifying observations of deviations, deficiencies or failures according to risk
• assigning an overall compliance rating to an inspection

It also informs anyone with a medical device establishment licence (MDEL) of the situations Health Canada considers unacceptable that may result in a non-compliant (NC) rating and/or compliance and enforcement actions.

2. Scope

These guidelines apply to any medical devices regulated under the Food and Drugs Act and the Medical Devices Regulations.

The ratings in this guide apply to you if you have a medical device establishment licence (MDEL) and are a:

• manufacturer (Class I medical devices)
• importer (Classes I - IV medical devices)
• distributor (Classes I - IV medical devices)

Inspections may also be conducted on companies exempted from having an MDEL, who are still subject to the Act and Regulations. These include:

• Class I manufacturers who are not subject to an establishment licence
• Companies subject to one of the following sections in the Regulations:
  • Part 2 - "Custom-made devices and medical devices to be imported or sold for special access"
  • Part 3 - "Medical devices for investigational testing involving human subjects"
• Class II, III or IV manufacturers (including private-label manufacturers)

3. Introduction

Health Canada may inspect anyone who conducts activities under the Food and Drugs Act (Act) or the Medical Devices Regulations (Regulations), including companies exempted from having an MDEL.

Health Canada inspectors carry out inspections which support the national compliance and enforcement program.

During an inspection, the inspector will:

• Look for the extent to which you comply with the sections of the Act and Regulations that apply to you.
• Confirm that your written procedures meet the requirements and determine how well you are following them.
• Write down deviations, deficiencies or failures as observations in an inspection report.
• Rate these observations by their level of risk.
• Recommend giving your establishment a compliant or non-compliant rating based on these observations.

Three levels of risk for observations

During an inspection, the inspector will assign a risk classification to each observation, ranging from 1 for higher risk issues to 3 for lower risk issues. The three levels of risk are defined as follows:

• Critical observation (Risk 1) A situation that:
  • is likely to result in an immediate or underlying health or safety risk, or that
  • involves any effort by a person to deceive, misrepresent or falsify medical devices or records.
• Major observation (Risk 2) A situation:
  • where there is a failure to meet the requirements of the Act and Regulations regarding the processing, importation and/or distribution of medical devices, and
  • where the chance of an immediate health and safety risk is remote because processes or procedures are in place to reduce the risk.
• Other observation (Risk 3) A situation that:
  • has low or minor impact on the safety of Canadians using medical devices, or
  • is neither critical (Risk 1) nor major (Risk 2).

See appendix A for examples of how inspectors may rate the failure to meet all or part of specific sections of the Act or Regulations.

Compliant and non-compliant ratings

The inspector makes a judgment based on the observations noted, taking into account the nature and extent of deviations, and gives an overall inspection rating recommendation for the establishment.

The possible inspection ratings are:

• C (Compliant)- At the time of the inspection, the regulated party has demonstrated that the activities it conducts are in compliance with the Food and Drugs Act and its associated regulations. A "C" rating does not mean that there are no observations or corrective actions required.
• NC (Non-Compliant)- At the time of the inspection, the regulated party has not demonstrated that the activities it conducts are in compliance with the Food and Drugs Act and its associated regulations.

A non-compliant rating may have serious consequences. These can include:

• stopping the sale of devices
• recalling devices
• stopping the importation of devices
• seizing devices
• suspending an establishment licence
• prosecuting the licensed company

Guidance

4. Determining the risk level of observations

Inspectors use the following criteria to rate observations noted during inspections:

• nature of the deviation, deficiency or failure
• likelihood of a hazardous situation occurring
• likelihood of a hazardous situation leading to harm
• severity of the harm or potential harm
• number and classification of the medical devices involved
• time taken to complete corrective and preventive actions
• number of times the deviation, deficiency or failure has occurred

The inspector will immediately bring any observation rated as Risk 1, along with any other observations requiring immediate correction action, to the attention of the company.

Repeat observations

A deviation, deficiency or failure that happens again in a later inspection (including a re-inspection) is considered a repeat observation. This includes:

• Deviations, deficiencies or failures reported during a previous inspection were not adequately addressed by the company.
• Suitable processes that would prevent the deviation, deficiency or failure from happening again were not put in place.

The inspector may rate a repeated deviation, deficiency or failure at a higher risk level than it was first rated.

Rating the risk level of repeat observations

The inspector will consider the following questions when rating a repeat observation:

• Was there a failure to address the deviation, deficiency or failure?
• Did corrective actions fall short of addressing the deviation, deficiency or failure?
• Did the corrective actions taken produce new risks?
• Was the company willing and able to correct the deviation, deficiency or failure?
• Did the company consider the risk of all identified hazardous situations?
• Have new hazards or hazardous situations shown up since the last inspection?
• How long did it take to complete the corrective and preventive actions?

5. Assigning a compliance rating

An inspector's decision to rate a company as compliant or non-compliant with the Act and Regulations takes into account the following factors:

• The nature and extent of the deviations, deficiencies or failures the inspector sees during the inspection.
• The record of compliance shown in previous inspections.
• The procedures that have been developed and how well they have been applied.

The inspector will advise the company of the recommended rating at the inspection closing meeting. More information can be found in section 4 (Inspection process) in How Health Canada inspects medical device establishments (GUI-0064).

Situations that may produce a non-compliant rating

A non-compliant (NC) rating may result if an inspector:

• Rates an observation as Risk 1.
• Sees any attempt by a company to deceive, misrepresent or falsify medical devices, records or documents (regardless of the classification of devices involved).
• Deals with an company or representative who does not provide requested information (e.g. records, labels, etc.).
• Finds poor control over processes and operations including many Risk 2 observations
• Finds one or several repeat observations.
• Finds actions inadequate to prevent deviations, deficiencies or failures from recurring.

Increasing the likelihood of a compliant rating

Generally, a compliant (C) rating will be assigned in the following situations:

• when few Risk 2 observations are noted (and are focused on isolated issues)
• when only Risk 3 observations are noted

The actions an establishment takes during an inspection can also affect its compliance rating. The likelihood of getting a compliant rating increases if immediate action is taken to address observations rated as Risk 1 and any other significant observation(s) noted by the inspector.

Company must:

• Correct whatever is causing the situation (i.e. take corrective measures).
• Prevent the situation from recurring (i.e. take preventive measures).

If an company can demonstrate that any high risk and other critical observations have been resolved at the closing meeting, the inspector will assess the situation and may consider changing the overall inspection rating to a compliant rating.

6. Disputing inspection results

Company may report concerns to Health Canada if you disagree with:

• the inspection rating
• any of the content in the inspection report

To report any disagreement, you must:

• Contact the Manager of Medical Devices Inspections within 5 business days after receiving your inspection report (the cover letter for your inspection report will provide contact information)
• Respond in writing with the reason for the disagreement along with the specific sections of the report identified as an issue.

The Manager of Medical Device Inspections will acknowledge receipt of your disagreement within 10 business days.

Appendices

Appendix A - Sample observations and ratings

The following are sample observations inspectors may note during an inspection when there are violations related to the Food and Drugs Act (FDA) and Medical Devices Regulations (MDR). It is not intended to be an all-inclusive list, and inspectors may use other observations where needed. At the inspector's discretion, the observations are ranked as risk level 1, 2 or 3 and may be escalated (e.g. if it's a repeat observation).

Food and Drugs Act (FDA)

s.3 General (advertising)

Risk 2 (major) observations

• FDA s.3(1) - Advertisements claimed a device is a treatment/prevention/cure for diseases/disorders/abnormal physical states prohibited in Schedule A.
  (Note: Applies to both paper and electronic formats.)
• FDA s.3(2)(a) - A device with a Schedule A claim on the label was offered for sale.
• FDA s.3(2)(b) - A device with a Schedule A claim on the label was advertised to the public.
• FDA s.3(3) - A contraceptive device was advertised to the general public. (Note: Section 24 of the Medical Devices Regulations allows some advertising of contraceptive devices, but not intrauterine devices.)

s.19-21 Devices

Risk 1 (critical) observations

• FDA s.19 - A device was sold that, when used as directed, may cause injury to the health of the buyer or user.
• FDA s.20(1) - The company was labelling, packaging, treating, processing, selling, and/or advertising devices in a way that was likely to create an incorrect impression about their design, construction, performance, intended use, quality, character, value, composition, merit, and/or safety, which presented a risk to health and safety.
• FDA s.20(2) - Labelling or packaging presented a risk to health and safety.
• FDA s.21 - A device was labelled, packaged, sold or advertised in a way that did not meet prescribed standards, and presented a significant risk to health.

Risk 2 (major) observations

• FDA s.20(1) - The company was labelling, packaging, treating, processing, selling, and/or advertising devices in a way that was likely to create an incorrect impression about their design, construction, performance, intended use, quality, character, value, composition, merit, and/or safety.
• FDA s.20(1) - Expired medical devices were available for sale.
• FDA s.20(1) - The company was conducting manufacturing activities it was not authorized to perform.
• FDA s.20(2) - Labelling or packaging may present a risk to health and safety.
• FDA s.21 - A device was labelled, packaged, sold or advertised in a way that did not meet prescribed standards.

s.37-38 Exports

Risk 2 (major) observations

• FDA s.37 - The requirements for an Export Certificate were not met.

Medical Devices Regulations (MDR) Part 1 - General

s.9 Manufacturer's obligations

Risk 1 (critical) observations

• MDR s.9(1) - Devices did not meet safety and effectiveness requirements (listed in MDR sections 10-20) and may present a significant risk to health and safety.
• MDR s.9(2) - Records proving safety and effectiveness were missing for all devices and may pose a risk.

Risk 2 (major) observations

• MDR s.9 (1) - Devices did not meet safety and effectiveness requirements listed in MDR sections 10-20.
• MDR s.9(2) - Records proving safety and effectiveness were incomplete for some devices.

s.10-20 Safety and effectiveness

Risk 1 (critical) observations

• MDR s.10-20 - Safety and effectiveness requirements for the design, manufacture, characteristics, performance and use of device were not met, and the device presents a significant risk to health and safety.

Risk 2 (major) observations

• MDR s.10-20 - Safety and effectiveness requirements for the design, manufacture, characteristics, performance and use of device were not met.

s.21-23 Labelling

Risk 1 (critical) observations

• MDR s.21(1)(h) - Device label did not describe purpose or intended use, which poses a risk to health and safety.
• MDR s.21(1)(i) - Device label does not have directions for safe and effective use, which presents a risk to health and safety.

Risk 2 (major) observations

• MDR s.21(1)-23(3) - There were multiple labelling deficiencies. [Apply highest risk rating based on which requirements are missing.]
• MDR s.21(1) - Devices available for sale had no label.
• MDR s.21(1) - Devices available for sale were improperly labelled.
• MDR s.21(1)(a) - Labels on devices available for sale had the incorrect or missing the name of the device.
• MDR s.21(1)(b) - Labels on devices available for sale had the incorrect or missing the manufacturer's name and address.
• MDR s.21(1)(c) - Labels on devices available for sale did not have device identifiers. [If device is unlicensed, assess under section 26 of the Medical Devices Regulations.]
• MDR s.21(1)(d) - Labels on Class III or IV devices available for sale did not have control numbers.
• MDR s.21(1)(f) - Labels on devices sold in a sterile state did not say "Sterile". [Consider intended use of device and classification.]
• MDR s.21(1)(g) - Labels on devices available for sale did not have expiry dates based on the shortest projected useful life.
• MDR s.21(1)(h) - Labels on devices available for sale did not describe intended use.
• MDR s.21(1)(i) - Labels on devices available for sale had inadequate or missing directions for use.
• MDR s.21(1)(j) - Labels on devices available for sale did not include storage conditions. [Consider intended use of device and classification.]
• MDR s.21.1(a) Was not notified prior to importation.
• MDR s.21.1(b) Not relabelled within three months of importation.
• MDR s.21.2 Did not notify when relabelling was not done by the manufacturer.
• MDR s.21(2) - The manufacturer could not be clearly identified because more than one company's name and address were on the label.
• MDR s.21(2) - Labels on devices available for sale did not have the required information in a legible, permanent and/or prominent manner, in terms that are easily understood by the intended user. [If label is not at all legible, it is technically not a label. In that case cite under subsection 21(1) (Device has no label) of the Regulations.]
• MDR s.23(1) - Labels on devices available for sale did not have the required information in either official languages.
• MDR s.23(2) - Directions for use were not made available in the other official language upon request.

Risk 3 (other) observations

• MDR s.21(1)-23(3) - There were multiple labelling deficiencies. [Apply highest risk rating based on which requirements are missing.]
• MDR s.21(1)(e) - Labels on devices available for sale did not list contents.
• MDR s.22(1)(a) - Labels on devices available for sale to the general public did not show all required information on the outside of the package.
• MDR s.22(1)(b) - Required information on device label was not visible.
• MDR s.22(2) - Directions for use were not made available with the device.
• MDR s.23(3) Missing bilingual label when sold to general public.

s.25 Class I medical devices

Risk 1 (critical) observations

• MDR s.25(2) - The company received official notice to stop selling a Class I device and continued to sell.

Risk 2 (major) observations

• MDR s.25(2)(a) - The company did not provide safety and effectiveness information upon request.
• MDR s.25(2)(b) - Safety and effectiveness requirements for a Class 1 device were not met.

s.26-31 Class II, III, and IV medical devices

Risk 1 (critical) observations

• MDR s.26 - Devices not authorised for sale by Health Canada were sold by the company under any of the following conditions:
  • Documented evidence shows unlicensed device (or devices) poses risk to health
  • A higher number of unlicensed devices found
  • Company received official notice and continued to sell

Risk 2 (major) observations

• MDR s.26 - Devices not authorised for sale by Health Canada were found available for sale [Consider risk to health and high number of unlicensed devices found].
• MDR s.27(a) - The company advertised unlicensed devices.

Risk 3 (other) observations

• MDR s.27(b) - The company advertised unlicensed devices in a catalogue without a clear and visible warning it may not be licensed in Canada. [Consider intended use of device and classification. If higher risk devices, rate as Risk 2].

s.44-51 Establishment licence

Risk 1 (critical) observations

• MDR s.44(1) - The company imported and/or sold medical devices without an establishment licence. [Consider intended use of device, classification and whether establishment received official notice to stop import/sale.]
• MDR s.45(g) - The company did not have any written procedures or processes in place for maintaining distribution records, complaint handling and recall.

Risk 2 (major) observations

• MDR s.44(1) - The company imported and/or sold medical devices without an establishment licence. [Consider intended use of device and classification.]
• MDR s.44(3) - The company imported from an unapproved source [Source does not hold establishment licence and are not the manufacturer.]
• MDR s.45(c) - The establishment licence application did not list all of the company's activities (import and/or distribute).
• MDR s.45(g) - The company did not have written procedures in place or was inadequate for distribution records. [Evaluate procedures under sections 52 to 56 of the Regulations.]
• MDR s.45(g) - The company did not have written procedures in place for complaint handling. [If procedures are missing evaluate procedures under sections 57 to 58, of the Regulations.]
• MDR s.45(g) - The company did not have written procedures in place for recalls. [Evaluate procedures under sections 58, 64 and 65 of the Regulations.]
• MDR s.45(h) - The importer did not have a written procedure in place or was inadequate for mandatory problem reporting. [ (Evaluate procedures under sections 59 to 61 of the Regulations.]
• MDR s.45(i) - The company did not have written procedure(s) in place or was inadequate for handling, storing, delivering, installing, and/or servicing medical devices. [If one or more procedures are missing or ineffective.]

Risk 3 (other) observations

• MDR s.45(a) - The establishment licence application did not include the company's correct name and address.
• MDR s.45(b) - The establishment licence application did not include the correct name, title and telephone number of the company's contact.
• MDR s.45(d) - The name and address of manufacturers provided by the company on its establishment licence application were not accurate. [If numerous, rate as 2.]
• MDR s.45(f) - The classes of devices that were being imported and/or distributed did not match the information provided by the company on its establishment licence application.
• MDR s.45(g) - The written procedure for distribution records was inadequate (missing minor elements) [Evaluate procedure under s.52 to 56 of the Regulations. If missing important elements, rate as 2.]
• MDR s.45(h) - The written procedure for mandatory problem reporting was inadequate. [If procedures are missing minor elements, but could still work. If procedures are completely missing or important elements are missing, rate as 2.]
• MDR s.45(i) - The written procedure for handling, storage, delivery, installing and/or servicing was inadequate. [If procedures are missing minor elements, but could still work. If procedures are completely missing or important elements are missing, rate as 2.]
• MDR s.45(i) - The company's implementation of procedures for storage, delivery, handling, installing, and/or servicing of medical devices was inadequate.
• MDR s.45(j) - The company did not list the address of each building using procedures in (g) to (i). [If procedures are missing elements, but could still work.]
• MDR s.48 - The company did not notify Health Canada that it had changed its name and /or address.
• MDR s.48 - The company did not notify Health Canada within the required timeline that the name, title or telephone number of the contact person had changed.

s.52-56 Distribution records

Risk 1 (critical) observations

• MDR s.52(1) - The company did not maintain distribution records for its devices. [Most or all of records are missing.]
• MDR s.53 - The company's distribution records did not have enough information to allow for a complete and rapid withdrawal of device(s) from the marketplace. [Most or all of records are missing information.]
• MDR s.54(1) - The company's distribution records were missing information from implant registration cards. [Most or all of records are missing information.]
• MDR s.54(2) - The company's distribution records had outdated implant registration information. [Most or all of the records had outdated information.]

Risk 2 (major) observations

• MDR s.52(1) - The company did not maintain complete distribution records for some of its devices. [If most or all of records are missing, rate as 1.]
• MDR s.53 - Some of the company's distribution records were missing information needed to allow for a complete and rapid withdrawal of device(s) from the marketplace. [If most or all of records are missing information rate as 1.]
• MDR s.54(1) - Some of the company's distribution records were missing information from implant registration cards. [If most or all of the records are missing information, rate as 1.]
• MDR s.54(2) - Some of the company's distribution records had outdated implant registration information. [If most or all of the records are missing information, rate as 1.]
• MDR s.55 - The company did not maintain distribution records for the required period of time.
• MDR s.56 - Distribution records could not be retrieved in a timely manner.

s.57-58 Complaint handling

Risk 1 (critical) observations

• MDR s.57(1)(a) - The company did not keep records of complaints.

Risk 2 (major) observations

• MDR s.57(1)(a) - The company could not provide a complete record of complaints. [If no records, rate as 1.]
• MDR s.57(1)(b) - The company could not provide a complete record to show it properly investigated a complaint about a device.
• MDR s.57(1)(b) - The company did not document or provide complete record of the actions it had taken to deal with a complaint. [If no action, rate as 1.]
• MDR s.58(a) - The written procedure for handling complaints was inadequate or missing important elements. [If procedures would be ineffective. Or, if no procedures in place, but reported problems are being investigated. If no records, rate as 1.]
• MDR s.58(a) - The written procedure for complaint handling was not implemented by the company.
• MDR s.58(b) - The written procedure for recalling devices was missing important elements or inadequate. [If procedures would be ineffective. Or, if no procedures in place, but recalls are being conducted. If no records, rate as 1.]
• MDR s.58(b) - The written procedure for recalls was not implemented by the company.

Risk 3 (other) observations

• MDR s.57(1)(b) - Records of actions taken to deal with complaints were inadequate. [If records are missing elements, but could still work.]
• MDR s.58(a) - The written procedure for handling complaints was inadequate. [If records are missing elements, but could still work.]
• MDR s.58(b) - The written procedure for recalling devices was inadequate. [If procedures are missing elements, but could still work.]

s.59-62 Mandatory problem reporting

Risk 2 (major) observations

• MDR s.59(1) - The company did not submit mandatory problem reports for a reportable incident.
• MDR s.59(2) - The company did not submit mandatory problem reports for incidents that occurred outside Canada requiring corrective action. [If problems not being reported and no mechanism in place at all), rate as 1.]
• MDR s.60(1)(a)(i) - The company did not submit a preliminary report within 10 days for an incident involving death or serious harm. [Consider device's classification.]
• MDR s.60(1)(a)(ii) - The company did not submit a preliminary report within 30 days.
• MDR s.60(1)(b) - The company did not submit a preliminary report as soon as possible.
• MDR s.60(2)(a)-(i) - The preliminary report did not contain the required information.

Risk 3 (other) observations

• MDR s.59(1) - The preliminary report was inadequate.
• MDR s.61(1) - The final report was not submitted according to the timetable committed to by the company.
• MDR s.61(2)(a) - The final report inadequately described the incident.
• MDR s.61(2)(b) - The final report inadequately described the cause of incident and justification for actions taken.
• MDR s.61(2)(c)(i)-(ii) - The final report inadequately described the actions taken as a result of the investigation.
• MDR s.61.1(2) - The manufacturer failed to notify Health Canada that the importer was preparing mandatory problem reports on its behalf.

s.63-65 Recall

Risk 2 (major) observations

• MDR s.64 - The company did not provide an initial recall report to Health Canada.
• MDR s.64 - The company did not report one or more recalls.
• MDR s.64 - The company did not provide an initial recall report to Health Canada within the required timeline.
• MDR s.64(a)-(k) - The initial recall report was inadequate. [Consider risk of recall. If recall not reported and recall not carried out, rate as 1.]
• MDR s.65 - The company did not submit a final recall report to Health Canada. [Consider risk of recall. If low risk, rate as 3. If higher risk, rate as 2.]
• MDR s.65(a)-(b) - The final recall report was inadequate. [Consider risk of recall. If low risk, rate as 3. If higher risk, rate as 2.]

Risk 3 (other) observations

• MDR s.65 - The company did not submit a final report as soon as possible after completing the recall. [Consider risk of recall. If low risk, rate as 3. If higher risk, rate as 2.]
• MDR s.65(a)-(b) - The final recall report was inadequate. [Consider risk of recall. If low risk, rate as 3. If higher risk, rate as 2.]
• MDR s.65.1(2) - The manufacturer failed to notify Health Canada that the importer was preparing recall reports on its behalf. [Consider risk of recall. If low risk, rate as 3. If higher risk, rate as 2.]

s.66-68 Implant registration

Risk 2 (major) observations

• MDR s.66(1)(a)-(d) - Implant registration cards did not include required information.
• MDR s.66(2)(a)-(e) - Implant registration cards did not allow required information to be recorded.
• MDR s.66(3) - Implant registration cards were not available in both English and French.
• MDR s.68(3) - The company did not meet the requirements of sections 66 and 67 when implementing their alternate implant registration method.

Risk 3 (other) observations

• MDR s.67(1) - The health care facility did not record required information and give it to both the patient and manufacturer.
• MDR s.67(2) - The patient's name and address were included on the implant registration card without the patient's written consent.
• MDR s.67(3) - The company disclosed the patient's name and address when it was not required by law.

MDR Part 2 - Custom-made devices and medical devices to be imported or sold for special access

s.70 General

Risk 1 (critical) observations

• MDR s.70 - The company was consistently selling or importing Class III or IV devices without authorization.

Risk 2 (major) observations

• MDR s.70 - The company sold or imported a Class III or IV device without authorization.

s.75 Labelling

Risk 2 (major) observations

• MDR s.75(a)-(c) - The company sold or imported a custom-made or special access device without proper labelling.

s.76 Distribution records

Risk 1 (critical) observations

• MDR s.76 - The company did not maintain distribution records and there was no process in place.

Risk 2 (major) observations

• MDR s.76 - Distribution records were missing or inadequate. [The more records missing or inadequate, the higher the risk.]

s.77 Reporting an incident

Risk 1 (critical) observations

• MDR s.77 - Health care staff did not report incidents with custom-made or special access devices and there was no mechanism in place.

Risk 2 (major) observations

• MDR s.77 - Health care staff did not report incidents within 72 hours.

MDR Part 3 - Medical devices for investigational testing involving human subjects

s.80 General

Risk 1 (critical) observations

• MDR s.80(2) - The company consistently sold Class II, III or IV devices to an investigator without authorization for investigational testing and without appropriate records.

Risk 2 (major) observations

• MDR s.80(2) - The company sold a Class II, III or IV device to an investigator without authorization for investigational testing.
• MDR s.80(3) - The company sold a Class I device to an investigator without maintaining appropriate records.

s.81 Records

Risk 2 (major) observations

• MDR s.81(i) - The company did not have records demonstrating the protocol for investigational testing and copies of patient consent forms.
• MDR s.81(k)(i) - The company did not have written proof of the investigator's agreement to follow manufacturer protocol.
• MDR s.81(k)(ii) - The company did not have written proof of the investigator's agreement to get patients' written consent.
• MDR s.81(k)(iii) - The company did not have written proof of the investigator's agreement to use the device only for investigational testing.
• MDR s.81(k)(iv) - The company did not have written proof of the investigator's agreement to forbid anyone from using the device unless under the direction of a qualified investigator.
• MDR s.81(k)(v) - The company did not have written proof of the investigator's agreement to report incidents within 72 hours.

Risk 3 (other) observations

• MDR s.81(a) - Investigational testing records did not include the name, address and telephone number of the manufacturer and importer.
• MDR s.81(b) - Investigational testing records did not include the name, classification and identifier of the device.
• MDR s.81(c) - Investigational testing records did not include a description of the device and manufacturing and packaging materials.
• MDR s.81(d) - Investigational testing records did not include a description of the device features, purposes and uses.
• MDR s.81(e) - Investigational testing records did not include the foreign countries where the device was sold, total number of units sold, and any reported problems and recalls.
• MDR s.81(f)(i)-(iii) - Investigational testing records did not include risk assessment and risk reduction measures.
• MDR s.81(g) - Investigational testing records did not include the names of qualified investigators to whom the device is proposed to be sold.
• MDR s.81(h) - Investigational testing records did not include the names and addresses of institutions that will be conducting investigational testing (and, for Class III or IV devices, written approval).
• MDR s.81(i) - The company did not have adequate records demonstrating the protocol for investigational testing and copies of patient consent forms.
• MDR s.81(j) - Investigational testing records did not include a copy of the device label.

s.86 Labelling

Risk 2 (major) observations

• MDR s.86(a) - The investigational testing device label did not include the name of the manufacturer.
• MDR s.86(b) - The investigational testing device label did not include the name of the device.
• MDR s.86(d) - The investigational testing device label did not include required statements about qualified investigator use only in French and English.
• MDR s.86(e) - The in vitro diagnostic device label did not include cautions about performance specifications in both English and French.

Risk 3 (other) observations

• MDR s.86(c) - The investigational testing device label did not say "Investigational Device" in English and French.

s.87 Advertising

Risk 2 (major) observations

• MDR s.87(a) - The company advertised an investigational testing device without authorization.

Risk 3 (other) observations

• MDR s.87(b) - The company advertised an investigational testing device without indicating that the device is the subject of investigational testing, and for what purpose.

MDR Part 4 - Export certificates

s.89-92 Export certificates

Risk 1 (critical) observations

• MDR s.90 - The company's export certificate was falsified and contained a forged signature. [False signature violates subsection 20(1) of the Food and Drugs Act.]

Risk 2 (major) observations

• MDR s.89(2)(a)-(b) - The company's export certificate was not signed and dated.
• MDR s.90 - The company's signed export certificate contained false or misleading information.
• MDR s.91 - The company was unable to produce records of export certificates when requested by the inspector.
• MDR s.92 - The company did not keep its export certificates for five years.

Risk 3 (other) observations

• MDR s.89(1) - The company's export certificate was inadequate.
• MDR s.89(2)(a)-(b) - The company's export certificate was signed by the wrong person.
• MDR s.90 - The company's signed export certificate was missing information.
• MDR s.91 - The company's records of export certificates were inadequate or not maintained at the company's place of business.

Appendix B - Glossary

Critical observation - An observation that has contributed to the overall rating of the inspection report.

Harm - Physical injury or damage to the health of people, or damage to property or the environment. (ISO 14971:2009)

Hazard - Potential source of harm. (ISO 14971:2009)

Hazardous situation - Circumstances in which people, property or the environment are exposed to one or more hazards. (ISO 14971:2009)

Observation (medical devices) - A deviation, deficiency or failure to comply with the Food and Drugs Act or the Medical Devices Regulations that an inspector:

• Sees during an inspection of a medical device establishment.
• Confirms in an inspection report given to the establishment.

See Introduction for more information about how observations are classified by risk.

Person - Includes a partnership and an association. (Medical Devices Regulations, s.1)

Risk - Combination of the probability of occurrence of harm and the severity of that harm. (ISO 14971:2009)

Severity - Measure of the possible consequence of a hazard. (ISO 14971:2009)

Appendix C - References

Guidance on Medical Device Establishment Licensing and Medical Device Establishment Licence Fees (GUI-0016)
https://www.canada.ca/en/health-canada/services/drugs-health-products/compliance-enforcement/establishment-licences/directives-guidance-documents-policies/guidance-medical-device-establishment-licensing-medical-device-establishment-licence-fees-guide-0016.html

Food and Drugs Act
http://laws-lois.justice.gc.ca/eng/acts/f-27/

Guidance on Medical Device Compliance and Enforcement (GUI-0073)
https://www.canada.ca/en/health-canada/services/drugs-health-products/compliance-enforcement/information-health-product/medical-devices/guidance-medical-device-compliance-enforcement-0073.html

How Health Canada inspects medical device establishments (GUI-0064)
https://www.canada.ca/en/health-canada/services/drugs-health-products/compliance-enforcement/information-health-product/medical-devices/inspects-medical-device-establishments-0064.html

Medical Devices Regulations
http://laws-lois.justice.gc.ca/eng/regulations/SOR-98-282/

The following icons are used in this document: