Regulatory Open Forum

Hello everyone, I'm fairly new to the regulatory field and work at a small, medical device company.  We recently had a complaint and I was going through past complaints to get a feel for the investigation.  I noticed there was often a real difficulty in getting enough information back from the end-users in order to make much of a determination on what happened.  We are obliged by CFR 820/ISO 13485 to thoroughly follow-up on complaints, right?  I would appreciate your thoughts on what people do to stay compliant even though end-users may not give enough information?  Thanks!

------------------------------
James Einum
QA/RA
Elkhorn WI
United States
------------------------------

Hi James,

Proper complaint handling has historically been difficult for many firms to realize; thus, its perennial place as the number one or number two most often cited issue during FDA medical device GMP inspections and Warning Letters.  Therefore, much can be said about the complaint handling topic.

In a nutshell, FDA and ISO auditors understand that it's often difficult to get information from complainants.  Accordingly, FDA for example maintains the general rule that we must make a "reasonable and good faith" effort to obtain the necessary information.

Specifically, when promulgating the complaint handling regulation, FDA said, "...If there is some reason that the information...cannot be obtained, then the manufacturer should document the situation and explain the efforts made to ascertain the information. This will be considered to be acceptable as long as a reasonable and good faith effort was made. For example, a single phone call to a hospital would not be considered by FDA to be a reasonable, good faith effort to obtain information...".

Similarly, in its closely-related MDR guidance, FDA says that follow-up investigations should involve a "good faith effort" to obtain information and should not focus only on the number of attempts to obtain such information, yet should nonetheless include at least one written (including email) request for information.  FDA requires that a record be kept documenting each attempt to obtain information, and the nature of the response by the reporter.

------------------------------
Kevin Randall, ASQ CQA, RAC (U.S., Europe, Canada)
Principal Consultant
Ridgway, CO
United States
© Copyright 2022 by ComplianceAcuity, Inc. All rights reserved.
------------------------------

Original Message:
Sent: 10-Oct-2022 11:57
From: James Einum
Subject: Complaint investigations

Hello everyone, I'm fairly new to the regulatory field and work at a small, medical device company.  We recently had a complaint and I was going through past complaints to get a feel for the investigation.  I noticed there was often a real difficulty in getting enough information back from the end-users in order to make much of a determination on what happened.  We are obliged by CFR 820/ISO 13485 to thoroughly follow-up on complaints, right?  I would appreciate your thoughts on what people do to stay compliant even though end-users may not give enough information?  Thanks!

------------------------------
James Einum
QA/RA
Elkhorn WI
United States
------------------------------

I forgot to mention that ISO/TC 210 generally agrees with FDA's good faith principle, in fact incorporating some of FDA's wording almost verbatim in ISO 13485 guidance.

A general rule of thumb is that your procedure assure at least three documented attempts have been made, with an appropriate span of time between each attempt (e.g., a few days, a week, etc.).

Ultimately, be sure that your good faith effort is commensurate with the risk of the scenario.  I have been involved with high-risk investigations (e.g., adverse events) where we had to make more attempts than three, and over an extended period of time, to achieve a complete investigation record that was appropriate for the seriousness of the scenario.  An interesting litmus test is for a firm to ask itself if, in the event of litigation against the firm, could you show that your efforts were defensible as a good faith effort to protect public health?  I have seen litigations where the plaintiffs zeroed in on that principle.

------------------------------
Kevin Randall, ASQ CQA, RAC (U.S., Europe, Canada)
Principal Consultant
Ridgway, CO
United States
© Copyright 2022 by ComplianceAcuity, Inc. All rights reserved.
------------------------------

Original Message:
Sent: 10-Oct-2022 12:22
From: Kevin Randall
Subject: Complaint investigations

Hi James,

Proper complaint handling has historically been difficult for many firms to realize; thus, its perennial place as the number one or number two most often cited issue during FDA medical device GMP inspections and Warning Letters.  Therefore, much can be said about the complaint handling topic.

In a nutshell, FDA and ISO auditors understand that it's often difficult to get information from complainants.  Accordingly, FDA for example maintains the general rule that we must make a "reasonable and good faith" effort to obtain the necessary information.

Specifically, when promulgating the complaint handling regulation, FDA said, "...If there is some reason that the information...cannot be obtained, then the manufacturer should document the situation and explain the efforts made to ascertain the information. This will be considered to be acceptable as long as a reasonable and good faith effort was made. For example, a single phone call to a hospital would not be considered by FDA to be a reasonable, good faith effort to obtain information...".

Similarly, in its closely-related MDR guidance, FDA says that follow-up investigations should involve a "good faith effort" to obtain information and should not focus only on the number of attempts to obtain such information, yet should nonetheless include at least one written (including email) request for information.  FDA requires that a record be kept documenting each attempt to obtain information, and the nature of the response by the reporter.

------------------------------
Kevin Randall, ASQ CQA, RAC (U.S., Europe, Canada)
Principal Consultant
Ridgway, CO
United States
© Copyright 2022 by ComplianceAcuity, Inc. All rights reserved.

Original Message:
Sent: 10-Oct-2022 11:57
From: James Einum
Subject: Complaint investigations

Hello everyone, I'm fairly new to the regulatory field and work at a small, medical device company.  We recently had a complaint and I was going through past complaints to get a feel for the investigation.  I noticed there was often a real difficulty in getting enough information back from the end-users in order to make much of a determination on what happened.  We are obliged by CFR 820/ISO 13485 to thoroughly follow-up on complaints, right?  I would appreciate your thoughts on what people do to stay compliant even though end-users may not give enough information?  Thanks!

------------------------------
James Einum
QA/RA
Elkhorn WI
United States
------------------------------

Complaint management is a very important process for a medical device manufacturer. You ship, to the best of your knowledge, only devices that conform to the requirements. You have processes in place to ensure confirmation. One, for example, is reviewed of the DHR before release for distribution.

A complaint is an allegation of the deficiency. Somebody asserts that, despite your QMS controls, you shipped a device that doesn't meet a requirement.

Clearly, you want to obtain as much information from the complainant as possible. In the old days, we would send a certified letter, return receipt requested, to the complainant. The return receipt provides the objective evidence of an attempt to obtain the information. This keeps the regulators happy but doesn't really solve the investigation problem.

Start by classifying the complaint based on the -ilities in a consolidated QSR/13485 definition. The -itilies include reliability, usability, etc.

Because you have a process map, determine where in the process a deficiency in the -ilitie could occur. Look at all the associated documentation.

Review the DHR for any hints. While the initial review may have been OK, you now have more information.

In the end, you want to determine reason for the allegation of a deficiency. The reason may lead to a correction, a corrective action, or both.

The long term goal is to drive the complaint rate to zero. Unfortunately you may not receive all the information desired from the complainant.

------------------------------
Dan O'Leary CQA, CQE
Swanzey NH
United States
------------------------------

Original Message:
Sent: 10-Oct-2022 11:57
From: James Einum
Subject: Complaint investigations

Hello everyone, I'm fairly new to the regulatory field and work at a small, medical device company.  We recently had a complaint and I was going through past complaints to get a feel for the investigation.  I noticed there was often a real difficulty in getting enough information back from the end-users in order to make much of a determination on what happened.  We are obliged by CFR 820/ISO 13485 to thoroughly follow-up on complaints, right?  I would appreciate your thoughts on what people do to stay compliant even though end-users may not give enough information?  Thanks!

------------------------------
James Einum
QA/RA
Elkhorn WI
United States
------------------------------

Thanks everyone, for all of your helpful input.


--
James Einum, PhD
Manager QA/Regulatory Affairs
Preservation Solutions, Inc.
1099 Proctor Dr
Elkhorn, WI 53121
Ph:262-723-6715 email: jeinum@preservationsolutions.com
https://preservationsolutions.com/


Original Message:
Sent: 10/10/2022 5:27:00 PM
From: Dan O'Leary
Subject: RE: Complaint investigations

Complaint management is a very important process for a medical device manufacturer. You ship, to the best of your knowledge, only devices that conform to the requirements. You have processes in place to ensure confirmation. One, for example, is reviewed of the DHR before release for distribution.

A complaint is an allegation of the deficiency. Somebody asserts that, despite your QMS controls, you shipped a device that doesn't meet a requirement.

Clearly, you want to obtain as much information from the complainant as possible. In the old days, we would send a certified letter, return receipt requested, to the complainant. The return receipt provides the objective evidence of an attempt to obtain the information. This keeps the regulators happy but doesn't really solve the investigation problem.

Start by classifying the complaint based on the -ilities in a consolidated QSR/13485 definition. The -itilies include reliability, usability, etc.

Because you have a process map, determine where in the process a deficiency in the -ilitie could occur. Look at all the associated documentation.

Review the DHR for any hints. While the initial review may have been OK, you now have more information.

In the end, you want to determine reason for the allegation of a deficiency. The reason may lead to a correction, a corrective action, or both.

The long term goal is to drive the complaint rate to zero. Unfortunately you may not receive all the information desired from the complainant.

------------------------------
Dan O'Leary CQA, CQE
Swanzey NH
United States
------------------------------

Original Message:
Sent: 10-Oct-2022 11:57
From: James Einum
Subject: Complaint investigations

Hello everyone, I'm fairly new to the regulatory field and work at a small, medical device company.  We recently had a complaint and I was going through past complaints to get a feel for the investigation.  I noticed there was often a real difficulty in getting enough information back from the end-users in order to make much of a determination on what happened.  We are obliged by CFR 820/ISO 13485 to thoroughly follow-up on complaints, right?  I would appreciate your thoughts on what people do to stay compliant even though end-users may not give enough information?  Thanks!

------------------------------
James Einum
QA/RA
Elkhorn WI
United States
------------------------------