Regulatory Open Forum

 View Only
  • 1.  Record Retention period for software devices

    Posted 16-Jan-2015 13:14

    I am trying to determine the record retention period of a device for QMS record retention purposes, including MDR Files.  The device in question is a Class II software device (in the US) to be used with a Class I hardware component. It does not have an EOL date.  The following is what I have been able to find but it doesn't help for a device that does not have an EOL date.  Any insight would be greatly appreciated. 

    -------------------

    Both ISO 13485 and QSR say something similar in that records shall be retained for a period of time at least equivalent to the lifetime/expected life of the medical device but not less than two years from the date of product release.

    FDA's draft guidance on Medical Device Reporting says:

    "MDR files should be maintained for two years from the date of the event or a period equivalent to the expected life of the device, whichever is greater [see 21 CFR 803.18(c)]. 

    The "expected life of a device" is the time that a device is expected to remain functional after it is placed into use [21 CFR 803.3]. Certain implanted devices have specified "end of life" (EOL) dates. Other devices are not labeled with EOL dates, but are expected to remain operational through activities such as maintenance, repairs, or upgrades.

    Thanks in advance,


    -------------------------------------------
    Maham Ansari, MS, RAC
    Senior Manager, Regulatory Affairs & Quality
    Focal Healthcare, Inc
    Toronto ON
    Canada
    -------------------------------------------


  • 2.  RE: Record Retention period for software devices

    Posted 17-Jan-2015 08:16
    Since the record retention period is based on the end of life, the first step is to define the end of life of the software component.

    Typically, hardware component's end of life is tied to reliability testing and/or to warranty period.

    Software components are tricky - however, there are various ways to ensure that you retain your QMS records correctly.
    1. Look at your software support lifetime and define that as the software EOL - i.e. how long will your company support the software will be the EOL of the software.
    - Typically, this is 10 years for commercial software running on a PC/Mac platform (e.g. Windows XP was supported for 15 years with updates, patches, etc.).
    - For software running on mobile devices, it is much shorter due to the faster evolution of the mobile OS and the resulting incompatibility issues (e.g. Typical software support for Android is 2 years after which you need to upgrade the software to match the current Android version).
    - For a medical device that is software running on a custom OS, it is entirely upto you to define the lifetime/end of life.

    2. The other way to do it would be to retain QMS records indefinitely till you are ready to retire the software.

    Whichever option you take, define the record retention period.

    Hope that helps.

    -------------------------------------------
    Raajdeep Venkatesan MS, RAC - US, EU
    Regulatory Affairs and Quality Assurance Director
    Cambridge MA
    United States
    -------------------------------------------




  • 3.  RE: Record Retention period for software devices

    Posted 17-Jan-2015 10:29

    In determining device record retention periods, there are four different requirements that apply to all manufacturers of devices marketed in the US. (Other parts have additional record keeping requirements, such as tracked devices, but don't apply broadly.)

     

    QSR (820.180(b)) - The retention period is the design and expected life of the device or the date of release for commercial distribution, whichever is longer. Notice that the record retention period does not depend on the device class.

     

    MDRs (803.18(c)) - The retention period is the expected life of the device or 2 years from the event, which ever is longer.

     

    C&R (806.20(c)) - The retention period is 2 years beyond the expected life of the device.

     

    UDI (830.360(a)) - Three years from the date you stop marketing the version or model.

     

    In record retention you need two pieces of data - when the clock starts and how long it runs.

     

    Three of these require setting the expected life. If the device doesn't have an End of Life date, then the easiest way is to determine how long you expect to support it.

     

    ISO 13485:2003 will not provide any help, because it is an International Standard; it doesn't "know" the regulatory system in which it operates. For example, the record retention requirements for the EU MDD, under Annex II, is 5 years in general and 15 years for implantable devices after the last product has been manufactured.

     

    -------------------------------------------
    Dan O'Leary
    Swanzey NH
    United States
    -------------------------------------------




  • 4.  RE: Record Retention period for software devices

    Posted 18-Jan-2015 11:52
    Raajdeep mentioned "warranty period" as a consideration for record retention/end of life.  "Warranty period" is a business consideration and is not part of FDA's consideration for record retention.  Warranty period is only an issue for companies to reimburse customers due to a device failure/issue, and not related to the life of the product.  Often the warranty period is a small fraction of the product life, such as 90 days to two years for a product.  The product may, in fact, have a lifetime of many years.

    -------------------------------------------
    Edwin Bills MA
    Principal Consultant
    ELB Consulting
    Highland Heights KY
    United States
    -------------------------------------------




  • 5.  RE: Record Retention period for software devices

    Posted 19-Jan-2015 06:37
    I generally agree with the comments others have made.

    When I worked on a similar product, we defined record retention as:

    until the end of sales and marketing for commercial distribution, [how long you sell it];
    plus fifteen years, [how long you can support it in the field = product life (for us, at that time)];
    plus two years, [806.20 (c)];
    rounded up to December 31st [safety margin, simplified records retention procedures].

    -------------------------------------------
    Griffin Jones
    Consultant - Regulatory Issues and SW Testing
    Congruent Compliance
    Rochester NY
    United States
    -------------------------------------------