It has long been a requirement under the ISO 14971 standard that as part of risk analysis, IVD manufacturers must identify known and foreseeable hazards associated with their devices in both normal and fault conditions. Despite the existence of guidance on this topic under ISO/TR 24971, we continue to observe IVD manufacturers, in particular, struggle with this risk management requirement.
Identifying known and foreseeable IVD hazards
Here we discuss risk management considerations for IVD manufacturers in the identification of known and reasonably foreseeable hazards for their devices in normal and faulty conditions.
Normal vs. fault conditions
Due to the extensive use of Failure Modes Effect Analysis (FMEA)-related tools in IVD risk analysis, manufacturers typically over-emphasize the identification of hazardous situations in fault conditions, whether they be random faults (e.g., IVD reagent performance deterioration due to contamination) or systematic faults (e.g., inappropriate user instructions that could lead to user injury), as these tools inherently focus on scenarios where a failure has occurred.
A classic example for IVDs is the hazard of an incorrect result (i.e., false positive or false negative test result). Manufacturers tend to focus on fault conditions that could contribute to incorrect results, such as:
-
- Microbial contamination in a lateral flow immunoassay reagent or buffer.
- Inter-lot variability in (polyclonal) antibody performance.
- Formulation errors during device manufacture.
However, incorrect results are an inherent hazard in normal conditions for many IVDs. For example:
-
- There are limits to the extent of potential endogenous and exogenous cross-reactants or interferents that a manufacturer can test as part of analytical specificity testing; therefore untested cross-reactants or interferents could be present in a specimen which could interfere with the test result.
- Clinical sensitivity and clinical specificity are rarely 100% for IVD assays, therefore there will a percentage of the patient population whose test result does not correlate to a specific clinical condition (e.g., fecal immunochemical tests, commonly used in colorectal cancer screening, do not detect any specific marker for colorectal cancer but detect hemoglobin (from blood) present in stool. The source of bleeding may not necessarily be associated with colorectal cancer).
Identification of IVD hazards addressed by risk controls
Another common habit that we have noted in IVD risk management records is manufacturers not identifying hazards that have been addressed by implemented risk controls, particularly where the hazards and risk controls are related to device formulation. Regardless of whether the hazard has or has not been addressed by risk controls, under ISO 14971, the manufacturer must identify all known and reasonably foreseeable hazards. Therefore, it is challenging for a manufacturer to argue that there is no need to document a hazard that it has already addressed.
A good example of such a scenario is with buffers that are used for specimen storage and transport, which are also used for the application of specimens to lateral flow immunoassays and largely responsible for lateral flow across the assay membranes. A known hazard for such buffers is microbial contamination which could result in non-specific binding at the immunoassay test line and subsequently result in a false positive. To address this hazard, manufacturers typically add an anti-microbial agent (e.g., biocide) such as an antibiotic or chemical agent such as sodium azide. The use of the latter however also introduces the potential for other hazards or hazardous situations as sodium azide, if improperly disposed of may:
-
- Cause environmental contamination.
- Build-up in laboratory plumbing, reacting with metals commonly found in plumbing infrastructure (e.g. copper and lead), to form insoluble metallic azides – a highly explosive and shock-sensitive compound (explosion can occur when the metal azides experience friction, heat, or shock; or enter contact with other chemicals).
The above hazards/hazardous situations could be addressed by the manufacturer through the implementation of the following IVD risk management controls:
-
- Inherent safety by design and manufacture (e.g. limit the concentration of sodium azide in accordance with established limits/thresholds)
- Providing information for safety
While the above example, demonstrates how such a known and reasonably foreseeable hazard could be identified and documented in the IVD risk management file, we continue to see a complete absence of such information driven by a lack of the description of device composition.
Sources to identify known and reasonably foreseeable IVD hazards
With the introduction of more robust performance evaluation and post-market surveillance (PMS) requirements under the IVDR, if it was readily apparent under the IVDD, manufacturers should be able to readily identify two robust sources for the identification of known and reasonably foreseeable hazards:
-
- Peer-reviewed scientific literature.
- Publicly available data from regulatory authority vigilance databases, (e.g., FDA’s MAUDE database).
While manufacturers may believe that a literature search may only be required for the purposes of performance evaluation when scientific validity and clinical performance are applicable to their device, this would be an incorrect assumption. Under section 1.2, Annex XIII of the IVDR it is established that as a general methodological principle, the manufacturer “…shall identify through a systematic scientific literature review the available data relevant to the device and its intended purpose and identify any remaining unaddressed issues or gaps in the data.” This would include the identification or any remaining unaddressed clinical-related hazards (e.g. device performance-related hazards or safety-related hazards) related to the use of the device not previously identified by the manufacturer.
We have previously covered best practices for performance evaluation literature searches, and regarding specific literature databases to be searched, we recommend not using Google Scholar unless no articles can be obtained from established scientific literature databases such as Embase, PubMed, PubMed Central (PMC), the Cochrane Library, UK National Institute for Health and Care Excellence (NICE), MEDLINE, and ScienceDirect.
Furthermore, while there is likely widespread under-reporting of serious incidents for IVDs in general, searches of regulatory authority vigilance databases in markets where the device is marketed, particularly for legacy IVDs, can help to identify known and reasonably foreseeable risk management hazards related to the subject, equivalent and/or similar devices. Although, these will largely be focused on fault condition hazards. Of note, are the following databases that manufacturers are recommended to consider:
-
- US FDA MAUDE, Recalls, and TPLC databases
- UK MHRA Device Recalls and Alerts database
- Swissmedic Recalls & FSCA database
- Australian TGA DAEN (adverse events) and SARA (recalls) databases
- While EUDAMED’s PMS module is not operational, EU vigilance databases such as those administered by ANSM (France) and BfArM (Germany)
Learn more about IVD risk management with Medenvoy
If you have any questions regarding risk management or require relevant training/consulting services, get in touch.