Guidance on Investigation of Reported Medical Device Problems (GUI-0065)
Contact Information: Medical Devices Compliance Unit, Health Products and Food Branch Inspectorate
Letter - Guide for Investigation of Reported Medical Devices Problems (GUI-0065)
To promote good nutrition and informed use of drugs, food, medical devices and natural health products, and to maximize the safety and efficacy of drugs, food, natural health products, medical devices, biologics and related biotechnology products in the Canadian marketplace and health system.
Supersedes: Guidance for Medical Device Complaint Handling and Recalls
Date issued: March 25, 2011
Date of implementation: March 25, 2011
This document does not constitute part of the Food and Drugs Act (Act) or its associated Regulations and in the event of any inconsistency or conflict between that Act or Regulations and this document, the Act or the Regulations take precedence. This document is an administrative document that is intended to facilitate compliance by the regulated party with the Act, the Regulations and the applicable administrative policies. This document is not intended to provide legal advice regarding the interpretation of the Act or Regulations. If a regulated party has questions about their legal obligations or responsibilities under the Act or Regulations, they should seek the advice of legal counsel.
Table of contents
- 1.0 Purpose
- 2.0 Scope
- 3.0 Glossary of terms
- 4.0 Risk Management
- 5.0 Roles and Responsibilities of Manufacturers, Importers and Distributors
- 6.0 Problem Investigation Procedure
- 6.1 Documenting the procedure
- 6.2 Format of the procedure
- 6.3 Implementing the procedure
- 6.4 Issues to consider in an investigation procedure
- 6.5 Key activities in a problem report investigation
- 6.5.1 Receipt and recognition of medical device problem reports
- 22.214.171.124 Mode of receipt
- 126.96.36.199 Sources
- 188.8.131.52 Screening of service calls, repairs and returned goods
- 184.108.40.206 Responsibility for receipt, time frame for communication
- 220.127.116.11 Gathering information on medical device problem reports
- 18.104.22.168 Problem report forms
- 22.214.171.124 Sample retrieval
- 6.5.2 Evaluation of problem report information
- 6.5.3 Mandatory problem reporting - manufacturers and importers
- 6.5.4 Root cause investigation, risk analysis and risk evaluation
- 6.5.5 Complete risk analysis
- 6.5.6 Risk Evaluation
- 6.5.7 Risk control
- 6.5.8 Evaluation of corrections and CAPA
- 6.5.9 Records
- 126.96.36.199 Control and retention of records
- 188.8.131.52 Control and retention of records
- 6.5.10 Closure
- 6.5.11 Analysis and Trending
- 6.5.1 Receipt and recognition of medical device problem reports
- 7.0 Appendices
- 8.0 References
- Appendix 1
- Appendix 2
- Appendix 3
- Appendix 4
- Appendix 5
This guidance document is intended to provide an interpretation of sections 57 and 58a of the Medical Devices Regulations (Regulations) in order to assist the medical device industry in establishing an effective and timely system for conducting problem report investigations that complies with these requirements.
It outlines the underlying principles of risk management and the roles and responsibilities of manufacturers, importers and distributors. It describes what a company's procedures should contain and what kinds of records should be kept in order to comply with the Regulations.
The guidance is also intended to promote transparency and consistency respecting Health Canada's role in assessing compliance with these requirements.
2.1 Regulatory requirements
This guidance applies to sections 57 and 58(a) of the Regulations under the heading Complaint Handling. Section 57 requires the maintenance of records and section 58(a), the establishment and implementation of a procedure.
This guidance also makes reference to the mandatory reporting requirements of sections 59-61 of the Regulations, but only insofar as they represent an essential step in the Complaint Handling process. More detailed guidance on these requirements is available in a separate Health Canada guidance document entitled, Mandatory Problem Reporting for Medical Devices.
The approach developed by a company to investigate, record, track and resolve reported problems should not be limited to these requirements; rather, it should ensure that the requirements are met within a system that is customized to address company and customer needs.
2.2 To whom the regulatory requirements apply
These requirements apply to manufacturers, importers and distributors of medical devices (Part 1 of the Regulations).
They also apply to manufacturers, importers and distributors of devices for investigational testing, as specified under section 88(b) (Part 3 of the Regulations).
3.0 Glossary of terms
4.0 Risk Management
Identification and management of risks is a key part of the investigation of reported problems with medical devices. Risks may arise directly from hazards created through use of the device or indirectly through defects that compromise the effectiveness and performance of the device.
Manufacturers should incorporate sound risk management principles in their problem investigation procedures. One approach that provides internationally recognized guidance on this topic is ISO 14971- Application of risk management to medical devices. Its use is recommended in ISO 13485 Medical Devices - Quality Management Systems - Requirements for Regulatory Purposes, the standard with which manufacturers of licensable medical devices are required to comply under the Regulations. Manufacturers of class I devices are not subject to ISO 13485 but they should also incorporate suitable risk management protocols within their procedure for investigation of reported problems which can include the elements of the ISO 14971.
Where medical devices are sold through importers and distributors, problem report investigation is a collaborative process. This process is more likely to be effective if all the parties involved utilize the same risk management framework, principles and terminology. The guidance in ISO 14971 provides an excellent approach which importers and distributors as well as manufacturers may incorporate into all of their relevant procedures.
The key stages in risk management as described in ISO 14971 involve:
- risk analysis;
- identification of hazards and hazardous situations (root cause investigations);
- estimation of risk;
- risk evaluation;
- risk control;
- overall residual risk evaluation.
The process begins upon receipt of each problem report and is completed when any identified risk(s) are effectively controlled. The results of each of these investigations contribute to the cumulative post-market experience with the device and serve as input for future problem investigations.
5.0 Roles and Responsibilities of Manufacturers, Importers and Distributors
The effectiveness of this collaborative process between a manufacturer and its importers and distributors respecting problem report investigations also depends, in part, on the extent to which each company:
- defines and documents its own roles and responsibilities;
- defines and documents its expectations of external parties on whom it depends for part of the process;
- establishes the agreement of external parties to carry out their responsibilities in the process.
The manufacturer, as identified on the label of a medical device, and on the device licence, if applicable, is the party originally responsible for placing the product on the market. This company bears ultimate responsibility for any residual risks associated with its handling, storage and use when label instructions are followed. In order to ensure timely awareness of potentially unacceptable risks, the manufacturer should have in place an effective system for collecting reported problems and complaints from end users, both directly, and to a reasonable extent indirectly, through the relevant importers and distributors.
Once aware of a potential risk, the manufacturer should take the lead in investigating and resolving the problem by conducting a root cause investigation and risk analysis, applying suitable time limits for action based on the estimated risk and by developing, implementing and evaluating suitable risk control measures (recalls, corrective and preventive actions), communicating with the reporter (examples: importer, distributor or end user) and closing the investigation. They must maintain complete records of investigations. Manufacturers must comply with the relevant regulatory requirements for a documented procedure and records for problem report investigations and for mandatory reporting of serious incidents to Health Canada. Manufacturers of licensable devices must also comply with the relevant requirements for complaint handling in ISO 13485 Medical Devices - Quality Management Systems - Requirements for Regulatory Purposes.
5.1.1 Private label manufacturers
A private label manufacturer is permitted to sell under its own name a medical device that is produced by another manufacturer who holds the licence for that device if certain conditions are met.
A private label manufacturer has the same responsibilities for Complaint Handling and mandatory problem reporting under the Regulations as other manufacturers. However, many of the activities involved, as described in s.5.1, such as risk analysis, root cause investigations and risk control decisions must be delegated to the original manufacturer who is appropriately qualified to carry them out. Like importers and distributors, a private label manufacturer represents a vital link between the users of a device and the original manufacturer. In this role, timely and effective communications as well as risk management responsibilities are similar to those described for importers in s.5.2.
Importers share the responsibilities for investigation of medical device problems with the manufacturer. They form a vital link between a manufacturer and the users of a device for two-way communication of safety and performance related information.
Importers should have an effective system that provides detailed instructions on the procedure for recognizing and receiving problem reports and complaints from a wide variety of sources. For each report involving device safety or performance, they should gather all the relevant information, make a preliminary risk estimation, apply suitable time limits for action, comply with mandatory requirements for reporting to Health Canada, if applicable, and submit the report to the manufacturer for root cause investigation and full risk analysis to validate the estimated risk.
If a company does not normally have a direct link to the manufacturer, it may submit problem reports to its immediate supplier on the understanding that they will be sent on to the manufacturer in a timely fashion.
As soon as a potentially serious risk is identified, importers should control further distribution of affected devices, pending recommendations from the manufacturer. They should review the results of root cause investigations; implement the manufacturer's risk control measures, such as recalls and any corrective or preventive actions that are within their control, such as improved storage and transport controls; evaluate the effectiveness of risk control measures and communicate with the reporter (examples: distributor or end user). Importers must maintain complete records of investigations.
Distributors, like importers, form a vital link between a manufacturer and the users of a device for two-way communication of safety and performance related information.
The responsibilities of distributors for investigation of problem reports are the same as those described for importers with the exception of the requirements for mandatory problem reporting to Health Canada which do not apply to distributors. Furthermore, a distributor may opt to rely on the importer or manufacturer for preliminary risk estimation provided that all reports involving device safety or performance are forwarded within a time frame commensurate with a high risk situation.
6.0 Problem Investigation Procedure
Section 58(a) of the Regulations is stated as follows:
The manufacturer, importer and distributor of a medical device shall each establish and implement documented procedures that will enable the manufacturer, importer or distributor to carry out
- an effective and timely investigation of the problems referred to in paragraph 57(1)(a)
In addition, section 45(g) of the Regulations requires a manufacturer, importer or distributor who holds a medical device establishment licence for the import or sale of devices in Canada to make an attestation on the application to having these documented procedures in place.
The guidance that follows provides an interpretation of an effective and timely investigation and describes important aspects of a documented procedure that is implemented and that would be considered sufficient to enable such an investigation. A summary of the elements of an effective procedure for problem report investigations is contained in Appendix 1.
6.1 Documenting the procedure
When documenting the procedure for investigating medical device problems, a manufacturer, importer or distributor should describe its own activities. These activities should be described in sufficient detail to ensure that they can be carried out consistently. Key activities performed by another company may simply be identified in the procedure along with sufficient directions concerning communications and time constraints. For example, an importer should provide detailed instructions in its procedure for receiving and gathering information on a reported problem, an activity for which it is directly responsible, but not for root cause investigation, an activity carried out by the manufacturer. The importer may simply identify in its procedure the manufacturer's responsibility in this respect, along with instructions for forwarding the request and receiving the results.
6.2 Format of the procedure
No standard format for the required documented procedure is mandated in regulation, nor is any particular format considered essential for an effective procedure necessary to meet the requirements of sections 57 and 58a of the Regulations. However, accepted quality system practices suggest that a number of elements may normally be included in any standard operating procedure, though the titles and order may differ. These elements are summarized in Appendix 2.
6.3 Implementing the procedure
A procedure may be considered effectively implemented where:
- activities are performed and records maintained according to the procedure;
- qualifications and training of personnel are appropriate for the activities and decision-making for which they are responsible (for example, individuals conducting root cause investigations or making risk management decisions should have sufficient technical knowledge of the device involved and its use);
- document control is effectively applied (for example, only current, approved procedures accessible to personnel, as indicated by implementation date, document history and the versions actually in use);
- a company may have particular arrangements in place to ensure that any key activity that is performed by a party external to the company, is in fact being carried out. An example may be an importer who gathers information on a complaint but relies on the manufacturer to conduct a root cause investigation and communicate the results. Another example may be an importer who relies on a distributor to collect and report complaint information back to them in a timely and effective manner. The necessary assurance concerning such arrangements may be demonstrated in a number of ways, such as;
- a documented agreement between the parties, specifying roles and responsibilities and assuring compliance with the Regulations (such as, time lines for mandatory reporting of serious incidents);
- external party's signature of approval on the company's problem investigation procedure.
6.4 Issues to consider in an investigation procedure
In order to enable timeliness and effectiveness respecting a problem report investigation, the documented procedure should address a number of important issues throughout all the steps in the process. These include:
- definitions and use of key terms, including risk management terms;
- scope of procedure;
- roles and responsibilities;
- risk-based time constraints;
The documented procedure for investigation should include definitions for key terms used to describe the activities involved. Precise definitions serve to clarify instructions and minimize ambiguities for all those responsible for carrying out the activities described. For example, a carefully worded definition for "reported problem" or "complaint" may establish the scope of the procedure for regulatory purposes (see s.6.4.2 of this guidance). Another example is the many risk management terms with similar names that apply to different stages in the process.
See section 3.0 for a glossary of terms commonly used in a medical device problem investigation procedure, including a number of risk management terms sourced from CAN/CSA-ISO 14971 Medical Devices-Application of Risk Management to Medical Devices.
6.4.2 Scope of the procedure
According to section 57(1)(a) of the Regulations, the procedure for investigation of reported problems with medical devices that is subject to regulatory requirements applies to problems involving the safety and performance of a device. The regulatory scope does not preclude a wider scope for the procedure, if a company so chooses. However, a wider approach implies that even relatively minor problems, such as errors in quantity delivered and consumer preferences, are subject to the same rigorous risk management activities as more serious problems, unless the types of problems are clearly differentiated from one another and the parts of the procedure that apply to each are clearly specified.
184.108.40.206 Reported problems
Reported problems "relating to the performance characteristics or safety of the device", as established in the regulatory scope are considered to include:
- problems, involving the device itself, its packaging and labelling, once it is released for sale by the manufacturer, or authorized for sale for investigational testing;
- compliance with regulatory requirements, among the device "performance characteristics";
- "consumer complaints", reported by patients or users of the device; and
- problems reported from any source (see s.220.127.116.11 of this guidance).
There is no regulatory definition for "reported problem", but for the purposes of this guidance, a suggested definition is listed in the glossary (section 3.0).
The term "investigation", appearing in section 58(a) of the Regulations, has no regulatory definition, but is broadly interpreted, for the purposes of this guidance, to include all activities carried out by a manufacturer, importer or distributor from the time of first awareness of a problem involving safety or performance of a medical device to its closure.
6.4.3 Documenting responsibilities within the procedure
Overall responsibility for the procedure should be assigned to a qualified individual with sufficient authority within the company to ensure its effective implementation.
Individuals or groups responsible for various tasks and decision-making carried out within the company should be identified and documented in the procedure by job title or function. Where such activities are carried out by another company, the individual or group actually responsible for a particular activity may be unknown. In this case, the responsible company and contact information for an appropriate representative may be identified or a separate document referenced.
6.4.4 Risk-based time constraints
All of the activities throughout the investigation process should be carried out within time constraints that are commensurate with the level of risk identified: the higher the risk, the shorter the time frames for completion. Where the level of risk is unknown prior to the preliminary risk analysis of a reported problem, activities, such as initial communication of a problem report to a designated coordinator, gathering of related information and preliminary risk analysis itself should be carried out within the shortest practical time frames, as if the associated risk were at the highest level.
The documented procedure for investigation should specify time frames for completion of key activities throughout the investigation using the risk based approach described. Where a prescribed time frame may not be appropriate, the procedure may require that on a case by case basis, time frames be agreed based on the associated risk. For example, when a problem report is submitted by an importer to the manufacturer for root cause investigation, the two parties may agree on an estimated time for completion and response that is commensurate with the estimated risk and expected complexity of the investigation.
Adherence to these time frames should be monitored to ensure effective implementation. A problem report log may be an effective mechanism for this purpose.
The procedure should require a mechanism for monitoring adherence to specified or agreed time frames, from receipt to closure. If a log is used, the individual or function responsible for maintaining it should be identified. At a minimum, the log should have the capability of tracking each report individually and of showing current status and target dates for each successive stage in the investigation process.
As described in the introduction to this guidance, investigation of medical device problems is a collaborative process. The related procedure should provide sufficient instructions to ensure that communications essential to the effectiveness of the investigation may be carried out consistently, accurately and in a timely fashion. They should describe, for example:
- who is responsible for sending and receiving the information;
- what information is to be communicated;
- how information is to be communicated (such as faxed or e-mailed complaint form);
- within what established time constraints;
- how and where it is recorded (in order to comply with section 57(1)(b) of the Regulations).
Examples of key communications include forwarding of a problem report from the initial receiver to the party responsible for the next activity (such as a designated coordinator), an importer's submission of a problem report to a manufacturer requesting a root cause investigation, or a manufacturer's communication to an importer of the conclusions from an investigation.
6.5 Key activities in a problem report investigation
An investigation involves a number of risk management related activities that begin when a company first becomes aware of a potential problem with a device. These include:
- receipt and recognition of medical device problem reports;
- gathering of detailed information, obtaining subject device;
- identification of safety and performance issues;
- preliminary risk analysis;
- interim risk control measures;
- preliminary mandatory reporting, as applicable;
- root cause investigation;
- complete risk analysis;
- risk evaluation;
- risk control measures (corrections, corrective and preventive actions);
- evaluation of effectiveness of risk control measures;
- final mandatory reporting, as applicable;
- closure; and
- ongoing trend analysis.
The procedure may include a flowchart of activities and responsibilities for clarification purposes. However, a flowchart without any supporting documentation may not contain sufficient instructions to be considered adequate to enable an effective and timely investigation.
6.5.1 Receipt and recognition of medical device problem reports
18.104.22.168 Mode of receipt
Problems with medical devices may be reported either orally or in writing by any means, such as telephone, face-to-face communication, e-mail, fax or letter.
Many of these initial communications may not be specifically identified as problems or complaints by the reporter, but are expressed in a variety of other ways, such as inquiries, comments of dissatisfaction, requests for repairs, or in-house test failures on released devices. Even reports of alleged incorrect use of a device should be investigated to determine whether instructions for use and cautions and warnings in labelling are adequate
The procedure should provide guidance on how to recognize potential problems that are not initially identified as such. It should require that verbal communications that are recognized as complaints or problems be recorded (see s.22.214.171.124 of this guidance).
Potential sources of reported problems are numerous and the information originally communicated may or may not be identified as a complaint. Reported problems may be received directly from end users, such as patients and health care professionals, or indirectly from importers, distributors, retailers, medical associations or a regulatory agency, such as Health Canada.
Problems with medical devices may also be identified by company staff in the course of, for example:
- receiving inspection;
- product demonstration;
- processing of returned goods;
- service or repairs.
Problems requiring investigation may not be readily identified from sources, such as returned goods, service calls and repairs. See s.126.96.36.199 of this guidance.
The procedure should identify the likely sources of medical device problem reports. Arrangements for receiving complaints through another company, such as a distributor or retailer, should be described or referenced.
188.8.131.52 Screening of service calls, repairs and returned goods
Medical device repairs and service, including preventive maintenance may not always be due to expected normal wear. The reason for returning a medical device may include information concerning device safety or effectiveness or the reason may not be expressed. Records of these activities should be routinely screened in a timely manner by a qualified individual, and further investigated where necessary, to detect evidence of potential device problems.
The procedure should require the routine review of repair and service records, where applicable, and of returned goods by a qualified individual for the detection of medical device problems. It may reference other procedure(s) where these activities are described.
184.108.40.206 Responsibility for receipt, time frame for communication
Given the large number and variety of potential sources of medical device problems, the responsibility for initially receiving such information is likely shared by almost all company employees. It is important that all responsible staff be able to recognize a potential problem with a device, regardless of whether it is initially identified as such by the reporter (see s.220.127.116.11 of this guidance).
The procedure should identify those responsible for initially receiving a problem report, provide clear instructions on how to respond (see s.18.104.22.168 of this guidance) and establish a time frame for communication of the report to the individual or group function responsible for evaluating it. Since the risk is unknown at this point, the chosen time frame should be commensurate with the highest level of risk, so that the report may be evaluated as soon as possible. For example, a time frame of one business day (after receiving information on the problem and affected device) for initial communication of problem reports for evaluation may be considered acceptable.
22.214.171.124 Gathering information on medical device problem reports
Successful determination of the root cause of a problem relies to a great extent on the quality of the information gathered on the original incident. Manufacturers, importers and distributors, should ensure that the information gathered is as complete, accurate and consistent as possible. A good approach may be to designate responsibility for this activity to a single individual or function to whom reports received by anyone in the company are sent. A coordinator may also be the point of contact for receiving problem reports from other companies to whom medical devices have been sold. The specific kinds of information that should be gathered include complete identification of the device and its manufacturer, importer and distributor, as applicable, as well as details of the incident and other relevant factors, such as patient condition, environmental conditions, ancillary equipment and medical personnel involved. A suggested checklist of information to be gathered for a reported problem is contained in Appendix 3.
The procedure should identify who is responsible for gathering all of the necessary information, specify what information is to be collected and how it is to be recorded. If the initial receiver of a report, such as a sales representative, is different from the individual or function designated as a coordinator, the procedure should specify the information to be collected and recorded by each party. It should indicate how the initial receiver is to pass the report to the coordinator and specify appropriate time constraints for this communication. (See s.6.4.4 for additional guidance on risk-based time constraints).
126.96.36.199 Problem report forms
Use of a standard reporting form or a database for the recording of problem report information may be a sound approach for ensuring completeness, accuracy and consistency. In some cases, a customized form may be more effective than a standard form. For example, where various types of devices exhibit known or expected failure modes, a problem report form may be customized to gather particular details concerning the incident that are relevant to these failure modes.
Where an importer or distributor develops its own form rather than using a variety of manufacturer's forms, it should ensure that the form is adequate to meet each manufacturer's particular information requirements.
The form should be fully accessible to all those responsible for its use. For example, a manufacturer should provide its form to all importers and distributors who agree to use it. Where such is the case, the manufacturer is also responsible for maintaining the current version in use. Furthermore, where all company staff are responsible for collecting initial information on a reported problem, the form(s) designated for this purpose should be accessible to each employee. Employees should be adequately trained to complete the correct form.
The procedure should identify all forms that are used, include the current version as an attachment or reference its location, and include or reference adequate instructions for use.
188.8.131.52 Sample retrieval
Examination and testing of the device that was involved in a reported incident provides valuable input for an effective root cause investigation. For this reason, a reasonable effort should be made to retrieve or isolate the subject device, or a sample from the same lot as the subject device (either from the user or from existing stock). Samples from the same lot can be used for testing or to try to recreate the problem.
The procedure should require that, as part of the gathering of information, availability of the sample device be initially determined and that a reasonable effort be made to retrieve or isolate the unit for examination and testing. The procedure should further require that the sample device be submitted to the manufacturer for investigation, upon request. Sufficient instructions should be included or referenced for this purpose.
6.5.2 Evaluation of problem report information
Each potential problem or complaint that is received should be evaluated as soon as possible after receipt to:
- determine whether it meets the scope of this procedure;
- estimate the associated risk;
- determine whether mandatory reporting requirements apply (manufacturers and importers only).
184.108.40.206 Identification of problem reports that meet regulatory criteria
As soon as possible following receipt of a device problem report, a qualified individual or function should evaluate the information to determine whether it could impact on the safety or performance of the device. If so, it should be investigated in accordance with the procedure established by the company to meet regulatory requirements, that is, the procedure for which this guidance is provided.
If a problem report involving device safety or performance is not investigated, the supporting rationale for this decision should be documented.
The procedure should include sufficient instructions to address these considerations and should establish suitable time constraints for the relevant activity(ies). (See s.6.4.4 for guidance on timeliness)
220.127.116.11 Preliminary risk analysis
As soon as a report is determined to involve safety or performance of a device, a qualified individual or function should carry out a preliminary risk analysis (risk is a combination of the probability of occurrence of harm and the severity of that harm) by:
- reviewing and analysing available information on the incident;
- identifying the hazard(s) involved; and
- estimating the risk(s) associated with the identified hazard(s).
If any information is missing that is essential for the risk estimation, a reasonable effort should be made to obtain it in a timely manner.
Some of the factors to consider when identifying the associated hazards and estimating the risks are listed in Appendix 4.
An abbreviated approach that may be useful for preliminary assignment of risk involves establishment of a small number of broad qualitative ranges, such as high, medium and low risk, based on previously selected criteria.
The risk analysis framework used by Health Canada for this purpose is outlined in Appendix 4.
The procedure should require that a preliminary risk analysis be carried out by a qualified individual or function for each problem report or complaint that may involve safety or performance. Specific instructions for this analysis should be included or referenced. Suitable time constraints should be specified (see s.6.4.4 for guidance on timeliness).
6.5.3 Mandatory problem reporting - manufacturers and importers
Manufacturers and importers must comply with the mandatory reporting requirements of sections 59-61 of the Regulations. In addition, documented procedures for mandatory problem reporting are required for manufacturers who hold a quality system certificate of conformity to ISO 13485, and for importers, pursuant to the attestation in the establishment licence application required under section 45(h) of the Regulations.
Each problem report that may involve device safety or performance should be evaluated by a qualified individual or function against the criteria set out in section 59 of the Regulations to determine whether it is a serious incident requiring mandatory problem reporting to Health Canada. If so, reporting must be carried out in accordance with the mandatory reporting requirements of the Regulations.
Guidance on the requirements is provided by the Health Products and Food Branch Inspectorate in the following document on the Health Canada website:
The investigation procedure for a manufacturer or importer should require that each problem involving a possible safety or performance deficiency be evaluated against the criteria for mandatory problem reporting and an initial report submitted to Health Canada where appropriate. Instructions that are sufficiently detailed to ensure regulatory compliance may be included in the investigation procedure or their location in a separate procedure may be referenced.
18.104.22.168 Time constraints for mandatory problem reporting
Prior to the preliminary estimation of associated risk, each reported problem should be handled within time limits commensurate with the highest level of risk in order to ensure compliance with the shortest time frame for mandatory reporting. Section 60(1) of the Regulations sets time limitations for the submission of mandatory reports related to incidents that occur in Canada. If the incident has led to the death or serious deterioration in that state of health of a patient, user or other person, the preliminary report should be submitted within 10 days after the manufacturer or importer becomes aware of the incident. If the incident has not led to the death or a serious deterioration in the state of health of a patient but could do so were it to recur, the preliminary report should be submitted within 30 days after the manufacturer or importer becomes aware of the incident. A manufacturer or importer is considered to be aware of an incident when an employee has acquired information concerning the device and the outcome.
The procedure should require that the evaluation necessary to determine whether the mandatory reporting requirements apply should be carried out early enough in the investigation to ensure compliance with the shortest regulated time limit. For example, it may be carried out as part of the preliminary risk analysis where the established time limits ensure compliance with those required in the Regulations.
A distributor is not subject to mandatory reporting requirements. Nevertheless, the time limits established in a distributor's procedure for investigation for reporting problems to the manufacturer or importer should be commensurate with the associated level of risk. (See s.6.4.4 for guidance on timeliness).
6.5.4 Root cause investigation, risk analysis and risk evaluation
22.214.171.124 Role of a manufacturer, importer or distributor
Where an importer, distributor or private label manufacturer does not have access to all the necessary related information or does not have a sufficiently qualified individual or function, the company should rely on the original manufacturer to conduct root cause investigations, risk analyses and evaluations, to make decisions respecting appropriate risk control measures and to communicate the conclusions and supporting rationale.
126.96.36.199 Purpose, methodology, time constraints
The purpose of a root cause investigation is to:
- establish a relationship between the problem and the device involved;
- determine the exact nature and extent of the root cause of the problem; and
- provide valuable input for risk analysis and subsequent risk control decisions.
A variety of approaches may be effectively used to determine root cause, such as:
- review and analysis of problem report information concerning the incident;
- examination, testing and analysis of the subject device, if available, and/or other unit(s) of the device with the same production history (from the same lot or batch);
- review of labelling and instructions for use;
- review of relevant design and production records and risk management file;
- review of post-market device experience including problem report information and trend analyses from all sources.
The individual responsible for the investigation should be sufficiently knowledgeable concerning the device, its intended uses and how it works, as well as its failure modes, risk reduction features and labelling, particularly cautions, contraindications and instructions for use.
The procedure should require that an investigation be conducted respecting each reported problem involving or potentially involving the performance or safety of a medical device. Where a company, such as an importer, distributor or private label manufacturer relies on another company to carry out root cause investigations, the procedure should provide sufficient instructions to ensure that reports may be submitted consistently, effectively and within suitable time constraints. (See s.6.4.4 for guidance on timeliness).
The procedure should identify the party responsible for root cause investigations. In the case of an importer, distributor or private label manufacturer, the procedure may normally identify the manufacturer as the responsible party; in the case of a manufacturer, the procedure may identify the qualified individual or function responsible for conducting root cause investigations and reference any documents that are routinely applicable.
The procedure should ensure that appropriate management oversight and deployment of commensurate resources achieve risk-based time constraints. Time constraints may be based on pre-set time limits based on the preliminary risk evaluation for completion and communication of the documented conclusion (such as ten days for a high risk, thirty days for a medium risk, etc.) or by requiring that an appropriate time frame be agreed and documented at the time the problem report is sent to the manufacturer.
188.8.131.52 Record of reason for no investigation
Where a decision is made not to conduct a root cause investigation respecting a reported problem that meets the definition in this guidance, the decision should be made by a qualified individual. Supporting rationale for the decision and the name of the responsible individual should be recorded in the problem report file. Reasons which may be acceptable include:
- an adequate investigation of the same failure mode has already been conducted;
- an investigation is ongoing for the same failure mode;
- corrective action (recall) is ongoing for the same failure mode.
A qualified individual or function should review the results and make a conclusion(s) respecting the root cause of the problem. Where no root cause is determined, this result may also represent a valid conclusion, particularly where there is limited information available concerning the reported problem. Documented conclusions and supporting rationale should be shared with the submitter (importer or distributor), while respecting confidentiality constraints and the specified or agreed time frame. Where the conclusion(s) indicate a possible unacceptable risk, the information should be utilized in a full risk analysis as outlined in s.6.5.5 of this guidance.
The manufacturer's procedure should require:
- recording and compilation of results of a root cause investigation;
- review of results by a qualified individual or function and a documented conclusion with supporting rationale;
- communication of conclusion and rationale to reporter within established or agreed time frame, and within the limitations of confidentiality.
The procedure established by an importer or a distributor should require that where the documented conclusion(s) and rationale are not received from the manufacturer, reasonable due diligence should be applied to obtain this information. If these efforts are not successful, consideration should be given to contacting Health Canada to determine whether there is an unacceptable risk that must be addressed.
6.5.5 Complete risk analysis
Where the conclusion of the root cause investigation identifies a problem that may represent a potentially unacceptable risk, a complete analysis of this risk should be conducted in order to:
- verify the results of the preliminary risk analysis;
- ensure that all the potential hazards and hazardous situations associated with the problem are identified;
- estimate the risk(s) for each identified hazard;
- define the scope of the problem (to which particular devices it applies and how many). This information is used to identify any risk present with devices currently in distribution.
The results of a complete risk analysis, based on many sources of input (see s.184.108.40.206 of this guidance), including the results of a root cause analysis, are likely to be more accurate and complete than those of a preliminary risk analysis which is carried out as early as possible in the investigation, and is based on limited information. ISO 14971 contains helpful guidance on conducting risk analysis.
A manufacturer's procedure should require that a complete risk analysis be carried out if the results of the root cause investigation identify a potentially unacceptable risk.
6.5.6 Risk Evaluation
The estimated level of risk associated with the problem, determined through a complete risk analysis, should be evaluated to determine whether it is acceptable. Guidance provided in ISO 14971, Annex E suggests that newly estimated risks may be compared with previously defined criteria for risk acceptability contained in the risk management plan for the device. Where the underlying hazard was previously identified in the risk management file for the device, the associated risk estimate should be reviewed to determine whether it is still valid and whether it is still acceptable.
If it is concluded that the identified risk is still acceptable, a manufacturer may decide to take no further action. If the identified risk is deemed unacceptable, the manufacturer should take appropriate action to control the risk (See s.6.5.7 of this guidance).
A manufacturer's procedure should require that the estimated level of risk associated with the problem be evaluated by a qualified individual or function to determine whether the risk is acceptable and that the conclusion and supporting rationale be documented. The procedure should indicate that where the risk is found to be unacceptable, risk control measures will be undertaken.
6.5.7 Risk control
Risk control measures are intended to eliminate the risk or, where it cannot be eliminated, reduce it to an acceptable level. Such measures may involve:
- corrections, aimed at eliminating or minimizing an unacceptable risk associated with devices in distribution;
- corrective actions aimed at eliminating the root cause and preventing recurrence;
- preventive actions aimed at preventing occurrence, where a potential risk is confirmed but a related incident has not yet occurred.
Corrections may be carried out either preceding or in parallel with corrective or preventive actions.
220.127.116.11 Role of manufacturer, importer and distributor
Corrections are normally initiated by the manufacturer, and implemented in collaboration with the importers and distributors of the affected devices.
Occasionally a correction may be initiated by an importer or distributor, in which case the manufacturer should be advised in order to ensure that the risk is fully addressed.
Corrective and preventive actions typically involve design or production changes for which the manufacturer is responsible.
Risk control measures necessary to address the risk(s) associated with devices that have been distributed may involve ceasing sale of the device pending identification and elimination of the root cause, advising users and patients, providing additional instructions for use, modifying the devices that have been released or removing them from use.
As soon as it appears likely that the health of users or patients is exposed to an unacceptable risk, intermediate corrections should be considered for implementation as precautionary measures, regardless of whether the risk control plan is complete. The intent of such actions as a stop sale order or a preliminary advisory to customers to discontinue use is to mitigate the perceived risk. These actions may be subsequently evaluated in the context of the completed risk control plan to determine whether they need to be revised.
The procedure of a manufacturer, importer or distributor for investigation of a problem report should require that appropriate corrections may be approved by senior management and implemented at any time, as soon as it appears that a device may present a serious risk to health.
The procedure should further require that corrections be implemented as soon as possible after they are authorized, and in accordance with the relevant company procedures for these activities. These company procedures, such as the recall procedure (required under the Regulations) or the procedure for placing devices on hold in the warehouse should be referenced. The procedure should require that the risk control measure(s) that are implemented be recorded in the problem report file.
18.104.22.168 Corrective and preventive actions (CAPA)
Risk control measures necessary to address the identified root cause of a problem may involve changes in the design, production methods, testing, components, packaging, labelling or other aspects of a finished device.
The manufacturer's procedure should require that as soon as an unacceptable risk is identified, appropriate risk control measures are chosen, and a risk control plan developed and implemented. The CAPA plan should:
- be developed by a qualified individual or function;
- contain risk control measures appropriate to eliminate the risk(s) or reduce it to an acceptable level;
- require that the planned changes are implemented in accordance with the quality system established for the device;
- require an assessment, in the case of a class III or IV device, to determine whether any of the changes meet the definition of " significant change ", and if so, compliance with the applicable requirements of the Regulations prior to sale of modified devices;
- require that any changes affecting future production are communicated to importers and distributors prior to shipping modified devices;
- require that the CAPA objectives, such as design or manufacturing changes are communicated to the importer or distributor that reported the problem. This is in order to provide these companies with key information necessary to complete their investigation documentation;
- be approved by senior management or by delegated authority of senior management.
The procedure should require that the CAPA plan be implemented as soon as possible after approval, and in accordance with the relevant company procedures for these activities. These company procedures should be referenced. The procedure should require that the risk control measure(s) that are implemented be recorded in the problem report file for all problem reports.
The procedure of both the manufacturer and the originator of a problem report (importer or distributor) should require that the manufacturer communicate to the reporting company any risk control measures that are implemented. This information is essential for an importer or distributor to complete their records of an investigation where the manufacturer has identified an unacceptable risk as a result of a root cause investigation.
6.5.8 Evaluation of corrections and CAPA
The manufacturer's procedure should require that the results of corrective and preventive actions and corrections be evaluated by a qualified individual or group to determine whether the residual risk(s) is acceptable and that the actions were effective. Information that could be reviewed, in addition to recall results may include any relevant production information, such as re-work and discard rates, as well as post-production information, such as a statistical analysis of problem trends.
If the residual risk is not acceptable, a risk/benefit analysis should be conducted to determine whether the medical benefits of the device outweigh the residual risk. If so, no further action is required; if not, further CAPA and/or an additional correction (recall) should be applied and the results evaluated in the same fashion. Details concerning the evaluation(s) should be recorded. This evaluation is required to complete the manufacturer's investigation.
Section 57 is stated as follows:
- 57(1) The manufacturer, importer and distributor of a medical device shall each maintain records of the following:
- reported problems relating to the performance characteristics or safety of the device, including any consumer complaints, received by the manufacturer, importer or distributor after the device was first sold in Canada: and
- all actions taken by the manufacturer, importer or distributor in response to the problems referred to in paragraph (a).
The procedure for investigation of problem reports should briefly describe the means established to ensure that records are kept "of all reported problems," required in section 57(1)(a) and of "all actions taken," required by section 57(1)(b) of the Regulations. For example, a file may be established for each problem report, containing all related documentation and traceable by assignment of a unique number. A problem report log (see s.6.4.4 of this guidance) may be an effective mechanism for recording and tracking the progress of an investigation and the communications necessary to collaborate with other companies that share responsibility for its implementation.
The procedure should also identify the various kinds of documents to be maintained as part of the record of an investigation. A checklist identifying the kinds of records that may be expected to be maintained in a problem report file is included in Appendix 5.
22.214.171.124 Control and retention of records
There are no specific regulatory requirements describing how problem report records are to be maintained or how long they should be kept. Nevertheless, the required procedure for a problem report investigation should, at a minimum, include or reference other documents containing:
- identification of responsible individual or group function for maintenance of records;
- a brief description of the storage format (examples: include paper, electronic, combination): if electronic, the data base and operating system should be identified;
- instructions for accessing and searching the records;
- identification of measures for protecting the integrity of problem report records, such as controlled access (examples: use of passwords, authorization limited to a few individuals, physical restricted location), regular backup for electronic files;
- instructions for archiving problem report records in a manner that ensures their retrievability;
- by specifying the period of time, such as twenty-four hours, within which records must be retrievable to facilitate an investigation of a high risk;
- by establishing means by which electronic records can continue to be accessed, despite changes in technology;
- instructions for retention of records.
The manufacturer should retain records of problem report investigations throughout the useful life of the device. This information represents vital input to the risk management process. For the same reason, an importer or distributor should retain such records for as long as the company distributes the device.
A problem report investigation may be closed when all corrective and preventive actions and corrections have been completed and evaluated and the identified risks have been eliminated or reduced to an acceptable level. For practical purposes, in view of the fact that some of these actions may take a long time to complete, a record may be closed once the root cause investigation is completed, provided that it includes, in addition to the information listed below as appropriate, a brief description of the preventive or corrective actions and corrections (recalls), as appropriate, that are ongoing and the relevant files are specifically referenced.
The procedure should identify the criteria for the closure of a problem report investigation and require that a review be conducted prior to closure by a qualified individual or group to ensure that
- all necessary steps have been completed and
- the file contains or references records of all actions taken in response to the problem;
A checklist for records that may be included in a problem report investigation is contained in Appendix 5
A problem investigation file maintained by an importer or a distributor should contain records of all aspects in which the company was involved as well as the decisions of the manufacturer respecting root cause and risk analysis, corrections and corrective and preventive actions.
The procedure established by an importer or distributor may provide for closure of a problem report where a conclusion concerning the cause cannot be reached due to lack of response from the manufacturer despite reasonable efforts to obtain it (see s.126.96.36.199 of this guidance); the reason for closure should be documented in the file.
6.5.11 Analysis and Trending
All medical device problem reports that are subject to the procedure required by the Regulations should be regularly reviewed and the data analysed for the purpose of detecting trends in various real or potential failure modes. The results of trend analyses provide valuable input for risk management decisions, such as root cause investigations, risk evaluation and application of risk control measures.
The procedure for investigation of reported problems should require that all such reports be reviewed on a specified frequency for trending and analysis and include or reference the location of sufficient instructions for this purpose. Where results such as a higher than expected rate of occurrence of a particular failure mode may indicate an unacceptable risk associated with the device, the procedure should require that they be reported to, or utilized by the manufacturer as input for risk management decisions.
- Appendix 1 - Elements of an effective procedure for investigation of reported problems
- Appendix 2 - Elements included in a standard operating procedure
- Appendix 3 - Checklist for gathering information on a problem report
- Appendix 4 - Guidance on preliminary risk analysis
- Appendix 5 - Checklist of records that may be included in a problem report file
Elements of an effective procedure for investigation of reported problems
In accordance with section 58(a) of the Regulations, the manufacturer, importer and distributor are each required to have a documented and implemented procedure for an effective investigation of reported problems.
|Element||Issues to address||Responsible party|
||M, I, D|
||M, I, D|
|Risk-based time constraints||
||M, I, D|
|Receiving, recognizing medical device problems||
||M, I, D|
|Root cause investigation||
|Risk management decisions||
||M, I, D|
M=manufacturer, I = importer, D = distributor
Evidence of implementation includes:
- document control indicators, such as approval dates, effective dates;
- training of personnel responsible for carrying out activities in the procedure, as indicated by;
- training records;
- competence of personnel concerned;
- evidence that another company, responsible for performing a key activity, such as collection of complaints or root cause investigations and risk management decision-making, agrees to carry out this activity in accordance with the procedure: for example;
- documented agreement or contract detailing the obligation(s);
- documented approval of the subject procedure by the relevant external party
Elements included in a standard operating procedure
- Purpose: includes a briefly stated reason for the procedure.
- Scope: defines the area covered and any relevant exclusions.
- Responsibility: defines as an overview, the functional unit(s) or individuals responsible for carrying out the procedure.
- References: includes, as appropriate, reference to the corresponding chapter in a quality manual, applicable quality system standards or regulations or other related procedures.
- Procedure (or Instructions, Actions or Methods): describes the step-by-step actions that need to be taken.
- Documentation: includes the kinds of records associated with the procedure; indicates where these records are filed; indicates the length of time they are retained; record retention time periods may alternatively be stated in general procedures for control of documentation and data and simply referred to in individual procedures.
- Distribution: identifies functions receiving the procedure.
- Revision Sheet or Table: includes the revision level (letter, number or combination), the date of the revision, the effective date of the revision, and a brief description of the change(s); tracking of revisions may alternatively be maintained as part of general documentation control procedures.
- Attachments: includes forms to be used in carrying out the procedure; the procedure should refer to the specific attachment that includes the relevant form; for this procedure a recall reporting form is recommended.
Other recommended good documentation practices include the following:
- involving users in writing, reviewing and modifying procedures;
- printing the names of individuals who prepare and approve procedures;
- signatures and written dates of those approving the procedure;
- numbering of sections, paragraphs and pages to facilitate reading and discussion;
- text that is clear, simple and concise.
Checklist for gathering information on a problem report
Contact information for the reporter
- name and address and phone number of the reporter
Identification of the device, availability of sample
- the name, licence number, model/catalogue number or bar code, the control, serial or lot number and any other means of identification of the device, expiry date or life cycle of the device
- availability of device involved in the incident or sample from same lot
Identification of manufacturer, importer, distributor
- names and addresses of the manufacturer, importer and distributor
Description of the problem
- name and or number of individuals directly involved with the incident
- patient's medical conditions and history if relevant to the problem (this may not be released due to confidentiality concerns)
- injuries, adverse reactions, severity of problem, treatment required
- frequency and duration of occurrence
- experience of the device user
- age of devices and its frequency of use
- determination if product used according to directions for use
- previous problems with the device
- environmental conditions surrounding the reported problem (if applicable)
- parameters or control settings at the time of the reported problem
- other equipment used in conjunction with or in the vicinity of the product
- determination if product modified in any way (e.g. reuse or resterilization of a disposable)
- method used by complainant to sterilize or resterilize the device
- storage and maintenance history of the device
- actions taken by the reporter or healthcare facility involved including any investigation or testing
Guidance on preliminary risk analysis
Factors to consider when estimating the risk:
- death, disease or injury that has already occurred from use of the product;
- hazard to various segments of the population, such as children, surgical patients, the elderly, and users with special needs who are more likely to be exposed to the product;
- degree of seriousness of the risk to individuals exposed to the product;
- benefits from use of the device that may offset the risk of exposure, such as in the treatment of a life-threatening condition;
- probability of hazard occurring during exposure to product;
- consequences (immediate or long-range) of occurrence of the hazard;
- user qualifications (professional, trained user versus untrained, inexperienced user);
- user awareness or anticipation of the hazard (a problem that most users would anticipate, such as backflow of body fluids or electromagnetic interference, or an occurrence that most users would not expect);
- distribution of the product e.g. quantity in stock, total quantity sold, length of time it has been available for sale;
- scientific technical data;
- field data from similar medical devices already in use including published reported problems;
- clinical evidence;
- results of appropriate investigations of other reported medical device problems;
- expert opinion;
- quality assessment (QA) system information;
Additional guidance on risk estimation
Sources of information or data for estimating risks:
- ISO 14971, s.4.4, Note 4: list of sources
- ISO 14971, Appendix E.1, E.2
Health Canada framework for preliminary risk analysis
The level of risk posed by the device problem should be estimated. An example of a risk estimation approach is that used by Health Canada:
- Type I: A situation in which there is a reasonable probability that the use of or exposure to a device has lead to the death or serious deterioration of the state of health of a patient, user or other person, or a reasonable belief that recurring exposure could lead to the death or serious deterioration of the state of health of a patient, user or other person.
- Type II: A situation in which the use of or exposure to a device may cause temporary deterioration of the state of health of a patient, user or other person, or where the probability of serious deterioration of health is remote.
- Type III: A situation in which the use of or exposure to a device is not likely to cause any deterioration of the state of health, of a patient, user or other person.
Checklist of records that may be included in a problem report file
In accordance with sections 57(1)(a) and 57(1)(b) of the Regulations,
- details of the problem report or complaint
- handling of complaint sample
- communications (examples include dated log entries, notes from telephone or face-to-face interviews, e-mails, correspondence) with external parties (examples include complainant, manufacturer, importer, distributor)
- preliminary risk analysis
- mandatory problem reporting: preliminary report (manufacturer and importer)
- root cause investigation (manufacturer)
- conclusions of root cause investigation
- complete risk analysis (manufacturer)
- risk evaluation decisions (manufacturer)
- corrective action and preventive action (CAPA) and correction plan (manufacturer)
- CAPA implementation
- corrections implementation
- evaluation of CAPA and correction (recall) (manufacturer)
- mandatory problem reporting: final report (manufacturer and importer)
- Date modified: