The First Steps to Medical Device Risk Management: Selecting Your Team and Identifying Hazards
Risk management is a crucial aspect of medical device development. You need to account for and mitigate the risks associated with your product early on, so it’s safe for users and passes increasingly stringent FDA requirements.
And what happens if you don’t properly account for risk in the early stages of product development? The FDA might send you a letter requesting additional information in response to your submission for approval. Then, you’ll lose valuable time and money going back to address any oversights.
Moreover, risk management doesn’t stop being a concern once your product is on the market. In fact, the FDA keeps a complaint database. If your product is consistently causing problems, the FDA might force you to issue a costly recall.
You probably already know that risk management is extremely important. But actually understanding the risk management process proves difficult. Here are the first steps to conducting a risk assessment for your medical device.
What is Medical Device Risk Management?
There’s inherent risk in using any medical device. It’s your risk management team’s job (more on selecting your team below) to minimize risks as much as possible, and to justify remaining risks.
Your risk management bible and explainer is ISO 14971:2019 Medical Devices — Application of risk management to medical devices.
The document describes risk management as a four-tiered process to:
Identify the hazards associated with a medical device,
Estimate and evaluate the associated risks,
Control these risks, and
- Monitor the effectiveness of these controls.
The entirety of the process is then laid out in the ISO standard, which ultimately “…provides the framework within which experience, insight, and judgement are applied systematically to manage the risks associated with the use of medical devices.”
In simpler terms, ISO 14971:2019 is a guide you can use to develop and maintain your own risk management process.
The Importance of a Risk Management Plan
The first step to successful risk management begins before analyzing your actual device. It starts with a risk management plan.
Your organization should have a standard operating procedure addressing your risk management process. This company-wide plan should apply to every product you develop.
Additionally, you’ll need to produce a risk management plan specific to each medical device. This is where you’ll dive deep, considering every possible risk associated with that particular product.
You need to enact your risk management plan early in development so you’re not scrambling to get your FDA submission across the finish line and missing potential safety concerns. Creating these plans early provides you with a detailed roadmap for risk management. It also encourages objectivity since the process is already spelled out — not subject to the whims of a certain project.
Selecting Your Risk Management Panel
Part of risk management planning includes choosing a team of people to carry out the risk evaluation. As mentioned, these are the people who will actually assess your medical device’s potential risks and decide on risk control measures.
This is a vital job you should reserve for competent individuals trained in risk management techniques. The FDA doesn’t list particular job titles of people you must include, but you’ll want representatives from varied disciplines who understand each aspect of your medical device — from how it’s constructed to its proper usage scenario.
This might include a mix of representatives from:
Your regulatory department
If you can’t compile a robust risk management team from within your organization, you may need outside input, too.
Identifying the Hazards Associated with Your Medical Device
The very first thing your risk management panel will do is review the group of potential hazards in table C.1 in Annex C of ISO 14971:2019. You’ll also want to review IEC 60601 to identify additional hazards and hazardous situations. These items should align with the items in table C.1.
A hazard is simply defined as a potential source of harm, and harm is injury or damage to people, property, or the environment. A hazardous situation is the scenario that exposes users or the environment to one or more hazards.
Your team should create a document — what we call a hazard analysis table — that lists each potential hazard. Then, analyze each hazard to decide if it’s relevant or applicable to your medical device. Note that, if a hazard is not relevant to your particular product, your team will still need to work to prove why.
It’s a good idea to assign each hazard a number you’ll use throughout all of your risk management paperwork. That way, there are no traceability issues as you’re working through development.
Hazard Identification Examples
To help you understand how you’ll assess some of the risks, consider two examples included in table C.1:
1. Sound Pressure
Sound pressure is an acoustic energy hazard that refers to variations in surrounding pressure as a result of sound or noise.
A potential hazard could be excessive noise from medical device operation. Then, the hazardous situation would be continuous noise above a tolerable limit. Finally, the harm could be hearing damage or loss.
During the course of your risk management process, your team would review this possible hazard as it applies to your medical device. If it’s relevant to your product, you’d proceed by brainstorming mitigation tactics. If it’s irrelevant, you’d explain why (the device does not produce sound pressure above the defined tolerable limit, for instance).
2. Falling Objects
Another easy-to-understand potential hazard is falling objects. Falling objects, a mechanical and kinetic energy hazard in the ISO standard, is exactly as it sounds — the potential for an object to fall.
Say your medical device is mounted on an inclined surface, that’s the hazard. The hazardous situation would occur if the device falls from its mount. The resulting harm could be many things, including trauma to patients if the product falls on them.
Again, your team would need to decide if there’s a chance your medical device could fall, and then either mitigate that risk (perhaps adjust the mount, for instance) or explain its inapplicability.
Planning and selecting your risk management team and then identifying hazards is where you’ll begin on your risk management journey — but that’s just the beginning. It’s a long and complex path to FDA approval, and your risk management job isn’t done once your product is to market. Still, knowing where to start will save you time and money, and set you up for success in the FDA approval process.
Need help to assess the risks associated with your newest medical device? Consider enlisting an outside partner to guide your risk management process from start to finish.