Understanding Medical Device QMS Requirements For Combo Products: Pharma Company Edition

By David Amor, MSBE, CQA, Medgineering

This two-part article focuses on 21 CFR Part 4 requirements for drug-device combination product manufacturers. This article will examine what drug companies with a QMS-compliant to 21 CFR 210/211 need to comply with from the 21 CFR 820 (medical device) side. The follow-up article reviews the opposite case. Note that ICH Q10 Guidance is not included in the scope of this article, but will be reviewed in a separate feature.

When 21 CFR 4 — the CFR section that covers regulation of combo products — was released in July 2013, one of the most notable provisions in the text was Section 4.4, which clarifies compliance to current good manufacturing practices (cGMPs) for drug-device single entity and co-packaged combo products. In a nutshell, the section indicates:

• If you’re a drug company with a QMS compliant to 21 CFR 210/211 (drug cGMPs) in place, you only have to implement certain sections of 21 CFR 820 (device cGMPs).
• If you’re a device company with a QMS compliant to 21 CFR 820, you only have to implement certain sections of 21 CFR 210/211.

In the spirit of reducing the QMS burden on companies exploring the combination product waters, FDA acknowledged that there is no need for redundant cGMP requirements that are analogous between drug and device regs. That said, drug companies should understand the implications of the required 21 CFR 820 subparts, and why they were deemed critical enough to consider for implementation.

What Does 21 CFR 4 Say About Constituent QMS Requirements?

It’s made clear by 21 CFR 4 that redundant QMS’ aren’t a requirement for combination product manufacturers, which is fantastic news! For pharmaceutical companies, only the following subparts of the medical device QMS cGMPs need to be added to your QMS scope:

• 820.20 Management Responsibility
• 820.30 Design Controls
• 820.50 Purchasing Controls
• 820.100 Corrective and Preventive Action
• 820.170 Installation
• 820.200 Servicing

Let’s examine these additional requirements and why FDA wants you to address them.

820.20 Management Responsibility

Closest equivalent in 21 CFR 210/211: Subpart B – Organization & Personnel (some sections)

Medical device management’s role is much more prescriptive in the device cGMPs, even being defined early in the general requirements (Subpart A) by identifying “management with executive responsibility” as having authority to establish or make changes to the manufacturer's quality policy and quality system.

In 21 CFR 210/211, Subpart B – Organization and Personnel, management’s various critical roles in drug companies are identified. However, note that the pharma cGMPs are more concerned with defining quality control and manufacturing supervisors (“management”) versus defining executive management. This is due to the stringent nature of pharma’s QC inspections and release, compared to device quality processes. In a practical sense, the more prescriptive nature of personnel qualifications in the drug world speaks to the more detailed science and technical backgrounds necessary to deal with drug product formulation, safety, and performance.

Unique aspects of management responsibility in the device cGMPs include:

1. Establish key quality policies and plans — 21 CFR 820.20 requires establishment of a policy describing a company’s commitment to quality and quality objectives. Practically, the quality policy is a short, descriptive statement that is prominently displayed throughout the manufacturer’s facilities; In fact, some medical device companies imprint the quality policy on identification cards for ready access! Combo product quality policies and plans should include metrics for both drug and device, and reflect joint goals.
2. Create an “org chart” — 820.20 mandates that the responsibility, authority, and interrelation of all personnel who manage, perform, and assess work affecting quality is well-established. Companies can use an organizational to visually depict and describe these roles. Such a chart is an effective way to describe where drug quality and manufacturing activities occur, versus device quality and manufacturing activities. Ideally, the organizational structure should reflect expertise in both areas, but consolidate at a management level, consistent with 820.20.
3. Appoint a “management representative” — It is important for a combination product manufacturer to establish a management representative responsible for periodically reviewing the effectiveness of the quality system, and for reporting the results to the rest of management. These reviews are performed against the objectives established in the quality policies and plans. Usually, the management representative is also the lead representative to U.S. and O.U.S. regulators in inspections and audits, and has responsibility for the review and evaluation of the QMS. Practically speaking, this may be a director or VP of quality/ regulatory.
4. Conduct management review — The management representative who is consistently reviewing the QMS, as well as other members of the management team, should hold a recurring review to ensure that the QMS is effective. Management review may take place quarterly, yearly, or at another time commensurate with the company’s QMS, product maturity, or overall product risks.

 

820.30 Design Controls

Closest equivalent in 21 CFR 210/211: N/A

Using design controls to develop a design history file (DHF) for a combination product is a fairly new paradigm for drug companies. Whereas device companies are required to fully document the design and development process, including multiple design reviews, the focus for pharma companies centers more on process development and production equipment design. Understandably, ensuring that drug formulation and drug product is homogenously and consistently produced is a primary concern for drug companies, but adoption of a design control process for the whole product also is required. Design controls are so important that even cGMP-exempt investigational devices still must follow 21 CFR 820.30.

Subpart 820.30 principally requires a company to consider how interactions between the drug and the device are considered during design and development. Using a drug injection pen as an example, the main questions to be answered within the design history file are:

• Will the device design compromise the performance characteristics of the product’s main function (i.e., drug delivery)?

First, identify the product’s main functions and performance characteristics. In the case of a drug injection pen, many of the performance requirements — which include flow rate, injection time, injection depth, and needle dwell time — come from ISO 11608-1 and the FDA guidance on injectors. When design planning and crafting design input requirements, the choice of materials, specifications, and other design features should be assessed against how they will impact the overall combo product’s performance criteria. For example, if an engineering team is considering shrinking the syringe gauge (size), characterization of how that change would impact drug flow rate should be performed.

• How do the device and drug components interact?

Biocompatibility of the device constituent is important, but interaction of the device materials with the drugs is also critical. Extractable and leachable by-products should be characterized, and material interaction should be assessed for adverse reactions and compromised drug efficacy prior to finalization of co-development. I’ve seen many examples of device materials having deleterious adhesion effects, which can bind drug product, either lowering drug potency or resulting in a toxic interaction.

Below are some other considerations for drug companies implementing a design control process specific to combination products:

Design planning — Combination product manufacturers must identify the different vendors and suppliers contributing to a new product, particularly if provision of constituent products (devices and drugs) is coming from different contract manufacturers (CMOs). Applicability of 21 CFR 4 depends on whether a facility is manufacturing just a drug, just a device, or both constituents.

Defining the supply chain and identifying key vendors helps to define which facilities require 21 CFR 820, 21 CFR 210/211, or a combination of both. The result is a design plan that should identify the aforementioned supply chain, as well as describe the key design control deliverables.

Design inputs — Combo product design inputs should clearly delineate between user and stakeholder needs versus technical requirements. For example, a delivery device user need may read, “Device plunger must be easy to push to deliver drug,” whereas a technical requirement may read “Plunger shall move from its pre-set position when a force of 10 +/- N is applied along the longitudinal access of the barrel/ plunger assembly.” Determining applicability of design inputs to the constituent device versus the overall product is critical.

Design verification/validation — Design verification, per 21 CFR 820.30, is the confirmation that the design output (drawings, specifications, test methods, etc.) meets the design input requirements. Conversely, design validation ensures devices conform to user needs and intended uses. While developing a verification and validation (V&V) strategy for combo products,  ensure that both constituent products are characterized.

For example, with drug delivery patches, the patch itself must be verified and validated, as must be the overall drug-and-device system. Such testing may include mechanical testing of the patch to ensure it does not tear or deploy prematurely, or biocompatibility testing of patch materials, per ISO 10993-1. Testing as a product “whole,” on the other hand, would involve testing elements like flow delivery rate, residual volumes after delivery, extractables and leachables characterization, stability and shelf life, and packaging distribution testing.

When determining the testing approach, ask yourself, “does the constituent element alone represent an adequate test case for this specific design input requirement?” Applying this query the patch example, “does the drug’s presence in the patch’s reservoir compromise the tensile strength of the patch?” Since the tensile strength of the patch is primarily dependent on the materials that comprise the patch, it is unlikely that testing with the drug would impact the results. On the contrary, stability and shelf life testing require that both constituent products are tested together to account for potential adverse interactions that may arise as the materials interact, degrade, and are subject to environmental conditions over time.

Design review — Design review involves the systematic tracking of a product’s design progress at pre-determined time points in order to prevent quality issues attributed to design. Many combination product manufacturers outsource constituent development or manufacturing to other organizations — or buy existing drugs or devices to add onto their novel product platforms.

It is critical to also “bring in” representatives and team members — defined within your design and development plan — to an overall product’s design review. If both constituents are innovative, each constituent’s design progress should be reviewed. However, because of the disparate development timelines of drugs and devices, it is more likely that a device is only developed after a drug has been demonstrated safe and effective. In either case, the decision to move forward in clinical trials or with the overall product development project should be a joint decision, documented and decided with a design review, with an independent reviewer providing unbiased feedback, as required per 21 CFR 820.30.

Design history file — The results of design and development efforts, including records and data, represent the design history file (DHF). The scale and complexity of a drug delivery device’s DHF depends on several factors, which we defined in a previous article in this series.

Design changes — Any design changes made after final approval or clearance of a combination product should take into account the impact on the product as a whole. For instance, one of Medgineering’s clients recently changed, within a drug delivery device, a material that comes into contact with the product’s drug reservoir, and hence the drug product. This change required a documented analysis of the material change to determine whether it reacted adversely with the drug, causing degradation, reduced drug potency, or any other negative impact.

Another common scenario is a change in sterilization modality. For example, if a company decides to use gamma irradiation versus ethylene oxide (EO) sterilization, the impact of the energy source must be assessed against the overall product. There have been many instances of gamma irradiation crosslinking with polymers or drug APIs, causing an unwanted product transformation.

820.50 Purchasing Controls

Closest equivalent in 21 CFR 210/211: 211.84 discusses testing of supplier provided components, but no direct equivalent exists.

Purchasing controls, under 820.50, describe manufacturers’ requirements to evaluate, qualify, continuously monitor, and control suppliers of components, materials, and other products. In the drug world, evaluation of drug components and containers is typically performed using a sample of raw materials, and is performed by the quality control unit (defined in 211.22). However, medical device regulations require that an equal emphasis is placed on the companies (suppliers) providing the components in the first place. From a quality management system perspective, a process to qualify and control suppliers results in better expectations for their components’ and supplies’ performance. Combo product manufacturers must assess their materials and service suppliers by considering, at a minimum:

• Risk of the material and service being provided — Some components in a drug product are more critical than others (e.g., API vs. excipients), and some device components aren’t as critical as others to the product’s intended design or use. For instance, in a drug injection pen, a gasket is a lower risk component than a needle, since a damaged needle may compromise drug delivery efficacy or cause pain to a patient. Usually, companies use a risk assessment compliant to EN ISO 14971:2012.
• Application of risk management to medical devices — Medgineering has undertaken several remediation projects with combo product manufacturers who never previously considered a systematic approach to risk identification and control as mandated by the standard.
• Supplier business “status” — Suppliers who are well known, established, and have a track record of providing high-quality commodities to medtech companies are less “risky” than fly-by-night manufacturers with a poor history or lack of experience in regulated industries.
• Component customization — Off-the-shelf components available from multiple sources usually carry less risk than customized components available through only one provider. The supplier control program should include backup options for customized components, or a manufacturer is at risk of triggering a design change to the overall combo product, which may in turn trigger a regulatory approval update or re-submission.
• Supplier history — Internal suppliers already doing business with a company should be assessed according to their track record, including nonconforming products, on-time delivery, and other performance metrics.

Once a supplier has been evaluated and approved to provide services or materials to a company, continuous monitoring is necessary to ensure their performance remains satisfactory. Through audits, continuous assessments, and rigorous receiving inspection programs, supplier performance should always be a critical input to management review.

Service providers are no exception to purchasing controls, either, especially with drug / device combo product manufacturers. Consultant qualification is specifically described in 21 CFR 211.34. Other service providers, like contract test labs, are equally important, particularly if a company is outsourcing critical product testing. Medgineering recently supported a dry powder inhaler product that outsourced aerosol testing to a third-party vendor. Aerosol testing is considered a “mission critical” test regimen per the FDA’s guidance on inhalers, so vendor qualification was rigorous: It required review of the site’s quality system and confirmation that the various environmental conditions required for testing were implemented.

820.100 Corrective And Preventive Action

Closest equivalent in 21 CFR 210/211: 211.192 Production Record Review, to some extent

One of my favorite statements about corrective and preventive action (CAPA)  is that it is an “agency’s window into your organization.” A thorough CAPA program provides a company with a “warning siren” to track, correct, and prevent nonconformances that pose a prospective threat to patients or business. The rationale for non-inclusion of a CAPA mandate in 21 CFR 210/211 is unclear, but may be related to the importance placed on the quality control unit within pharma companies; this focus allows the unit to be intimately involved in finding nonconformances and implementing process controls to correct or prevent recurrences.

Expanding the work of the quality control unit is a great place for drug companies to start refining their CAPA process. Several years back, Medgineering was working with a pharmaceutical company that acquired a small medical device start-up. The stat-up already had a CAPA process implemented into its QMS, and the drug company eventually rolled the CAPA process into its own quality control unit in an effective attempt to not just reactively address nonconformances, but proactively implement controls and deeper investigations into the underlying root causes. Knowing which functional group to target within a drug company for implementing a CAPA process is a key task for smooth integration.

Within a combo product’s CAPA system, it is important to differentiate which constituent product leads to the event that precipitates the finding. CAPA inputs include field actions, product or process non-conformances, audit findings, and other quality events that require further investigation. As a general rule, not every event or nonconformance will require an in-depth root cause analysis or a rigorous response; however, companies should implement a CAPA process that has a clear escalation process and allows scalability of the CAPA activities.

For instance, if a defect is systemic and continually occurs, a company should most likely perform deep-root cause analysis to understand and address the deficiency. Likewise, even if a defect is a “first” offense but a significant patient risk, it should be escalated for in-depth analysis. This escalation process allows a company to focus its resources where they are really needed.

820.170 Installation And 820.200 Servicing

Closest equivalent in 21 CFR 210/211: N/A

Installation and servicing need to be added onto a company’s drug cGMPs because they set provisions exclusive to medical devices that are considered capital equipment, or they require installation or servicing. However, even the FDA notes “…devices will rarely be constituent parts of such combination products.” Devices that require installation and servicing — such as large capital products  — are more likely to be manufactured separately, and/ or marketed alone to be used in a cross-labeled combination product situation.

Summary

Implementing cGMPs within a combination product manufacturer per 21 CFR 4 should consider the streamlined approach consistent with FDA’s recommendations. As a drug manufacturer looking at medical devices for the first time, addressing the six QSR regulations recommended by the agency (and described above) ensures that your quality system is capable of handling combination product development and manufacturing.

About The Author

David Amor, MSBE, CQA is a medtech/ biotech consultant and mobile health entrepreneur who founded Medgineering, a company focused on remote compliance, regulatory & quality systems consulting for larger companies and start-ups alike. A graduate of the prestigious Innovation Fellows program at the University of Minnesota’s Medical Device Center, Amor was named a Top 40 Under 40 Medical Device Innovator in 2012 and a 35 Under 35 Entrepreneur in 2015 by MN Biz Magazine. He co-founded and helped launch Remind Technologies, a Texas-based mobile health company developing a smartphone-based remote medication management system. He is also co-inventor on several issued utility patents and co-pioneered a disruptive e-consulting platform for the medtech and pharma industries called QuickConsult. Amor serves as an adjunct professor at St. Cloud State University (Maple Grove, MN) where he teaches courses on risk management and design control. The current focal points of his consulting practice are specializing in risk management, design controls, combination products and mHealth. He can be reached at david@medgineering.com or at 786-546-1806.