The First Steps to Medical Device Risk Management: Selecting Your Team and Identifying Hazards
Risk management is a crucial aspect of medical device development. You need to account for and mitigate the risks associated with your product early on, so it’s safe for users and passes increasingly stringent FDA requirements.
And what happens if you don’t properly account for risk in the early stages of product development? The FDA might send you a letter requesting additional information in response to your submission for approval. Then, you’ll lose valuable time and money going back to address any oversights.
Moreover, risk management doesn’t stop being a concern once your product is on the market. In fact, the FDA keeps a complaint database. If your product is consistently causing problems, the FDA might force you to issue a costly recall.
You probably already know that risk management is extremely important. But actually understanding the risk management process proves difficult. Here are the first steps to conducting a risk assessment for your medical device.
What is Medical Device Risk Management?
There’s inherent risk in using any medical device. It’s your risk management team’s job (more on selecting your team below) to minimize risks as much as possible, and to justify remaining risks.
Your risk management bible and explainer is ISO 14971:2019 Medical Devices — Application of risk management to medical devices.
The document describes risk management as a four-tiered process to:
Identify the hazards associated with a medical device,
Estimate and evaluate the associated risks,
Control these risks, and
- Monitor the effectiveness of these controls.
The entirety of the process is then laid out in the ISO standard, which ultimately “…provides the framework within which experience, insight, and judgement are applied systematically to manage the risks associated with the use of medical devices.”
The Importance of a Risk Management Plan
The first step to successful risk management begins before analyzing your actual device. It starts with a risk management plan.
Your organization should have a standard operating procedure addressing your risk management process. This company-wide plan should apply to every product you develop.
Additionally, you’ll need to produce a risk management plan specific to each medical device. This is where you’ll dive deep, considering every possible risk associated with that particular product.
You need to enact your risk management plan early in development so you’re not scrambling to get your FDA submission across the finish line and missing potential safety concerns. Creating these plans early provides you with a detailed roadmap for risk management. It also encourages objectivity since the process is already spelled out — not subject to the whims of a certain project.
Selecting Your Risk Management Panel
Part of risk management planning includes choosing a team of people to carry out the risk evaluation. As mentioned, these are the people who will actually assess your medical device’s potential risks and decide on risk control measures.
This is a vital job you should reserve for competent individuals trained in risk management techniques. The FDA doesn’t list particular job titles of people you must include, but you’ll want representatives from varied disciplines who understand each aspect of your medical device — from how it’s constructed to its proper usage scenario.
This might include a mix of representatives from:
Your regulatory department
If you can’t compile a robust risk management team from within your organization, you may need outside input, too.
Determining the Application or Area of Hazards
Before we can get into identifying hazards, let’s define hazards and hazardous situations.
A hazard is simply defined as a potential source of harm, and harm is injury or damage to people, property, or the environment. A hazardous situation is the scenario that exposes users or the environment to one or more hazards. Think of the hazard as the noun and the hazardous situation as the verb — the action, state, or occurrence.
With this understanding in mind, the first thing your risk management panel will do is refer to the application or area of hazards as listed in the first Annex of ISO 14971:2019.
This is a great place to start exploring all of the areas where hazards originate. It’s crucial for you to understand that multiple hazards can come from just one of these listed areas.
At MPE (Formerly Mindflow Design) , we take each item in this list and add it to our hazard analysis table — a document that goes through each potential hazard.
Our risk management process and hazard analysis table always includes:
Every item in the list of application or area of hazards. As mentioned, we add all of the items in Annex 1 to our own table. Why? Because even if a certain item isn’t applicable to your medical device, you must note why it’s not applicable. That way, your team has a record of your rationale.
A hazard identification number. In our table, every hazard is assigned its applicable hazard ID number so that hazard can be traced through the entire risk management process. These hazards will be referenced in many other documents, including Failure Mode & Effects Analyses (FMEAs), usability test protocols, and more. Hence why tracking is vital.
The standard or clause where each hazard originates. Many hazards come from standards or guidance documents. We always name each hazard’s origin in our documentation. That way, you have the standard or clause handy during your verification and validation process — and specifically while you’re using outside test facilities.
The Final Steps of Identifying the Hazards Associated with Your Medical Device
As a part of determining the application or area of hazards, your team should also review the group of potential hazards in table C.1 in Annex C of ISO 14971:2019. Lastly, you’ll want to review IEC 60601 to identify additional hazards and hazardous situations. These items should align with the items in table C.1.
Again, every hazard should be listed in your hazard analysis table. And an explanation should be given whether you decide a particular hazard is relevant to your medical device or not.
Hazard Identification Examples
To help you understand how you’ll assess some of the risks, consider two examples included in table C.1:
1. Sound Pressure
Sound pressure is an acoustic energy hazard that refers to variations in surrounding pressure as a result of sound or noise.
A potential hazard could be excessive noise from medical device operation. Then, the hazardous situation would be continuous noise above a tolerable limit. Finally, the harm could be hearing damage or loss.
During the course of your risk management process, your team would review this possible hazard as it applies to your medical device. If it’s relevant to your product, you’d proceed by brainstorming mitigation tactics. If it’s irrelevant, you’d explain why.
Applicability: sound pressure
Rationale if nonapplicable: (leave blank) Hazard ID#: H1.0
Standard/clause of origin: 60601-1, 126.96.36.199
Hazard: excessive noise
Hazardous situation: continuous noise above a tolerable limit
2. Falling Objects
Another easy-to-understand potential hazard is falling objects. Falling objects, a mechanical and kinetic energy hazard in the ISO standard, is exactly as it sounds — the potential for an object to fall.
Say your medical device is mounted on an inclined surface, that’s the hazard. The hazardous situation would occur if the device falls from its mount. The resulting harm could be many things, including trauma to patients if the product falls on them.
Again, your team would need to decide if there’s a chance your medical device could fall, and then either mitigate that risk (perhaps adjust the mount, for instance) or explain its inapplicability.
Here are some of the details we add to our hazard analysis table:
Applicability: falling objects, instability
Rationale if nonapplicable: (leave blank)
Hazard ID#: H2.0
Standard/clause or origin: 60601-1, 188.8.131.52
Hazard: mounted on an inclined surface
Hazardous situation: product falls over
What’s Next for Your Risk Management Process?
Planning and selecting your risk management team and then identifying hazards is where you’ll begin on your risk management journey — but that’s just the beginning.
It’s a long and complex path to FDA approval, and your risk management job isn’t done once your product is to market. Still, knowing where to start will save you time and money, and set you up for success in the FDA approval process.
Need help to assess the risks associated with your newest medical device? Consider enlisting an outside partner to guide your risk management process from start to finish.