21 CFR Part 820 is a set of FDA regulations that govern medical device quality systems. Detailed within are current good manufacturing practice (cGMP) requirements ensuring medical devices distributed within the United States are effective, safe, and compliant. The regulations apply to any facility that designs, manufactures, packages, labels, stores, installs, or services finished medical devices intended for human use within the United States. Compliance with the regulations requires manufacturers to develop and maintain a quality system appropriate for the risk of the medical device, the complexity of the manufacturing process, and the size of their organization. Failure to follow these regulations could result in warnings from the FDA that can be extremely costly to remedy.
What does 21 CFR Part 820 Include?
Fifteen subparts comprise 21 CFR Part 820, each addressing a specific part of the medical device production process. Throughout the regulation, each subpart highlights required documentation. Remember that you do not need to document everything but only the processes and procedures necessary to maintain compliance.
Quality system requirements
This section of 21 CFR Part 820 details requirements for the quality system such as executive management responsibility, personnel roles and training, and internal quality audits. After establishing and committing to a quality policy, the manufacturer creates a plan detailing how to meet the quality requirements within that policy. Written policies, procedures, and personnel training support the quality plan. Executive management reviews the quality system, plan, and policy regularly and implements necessary changes. To maintain a compliant quality system, your organization must:
- Establish and commit to a quality policy.
- Make a quality plan that outlines how your organization plans to meet the quality policy.
- Create and maintain an appropriate hierarchy of quality roles within the organization.
- Maintain a quality system and review it at regular intervals.
- Perform regular quality audits and implement corrective action when necessary.
- Ensure that employees have sufficient training and experience to maintain quality compliance.
Design controls
Design controls are predictable and repeatable quality practices and procedures incorporated into the design and development process. They prove to the FDA that you used a controlled iterative process to develop your medical device. Control of the design happens through the entire process, both premarket and postmarket, assuring that completed devices meet intended use and user needs. These controls apply to specific Class I, Class II, and Class III devices outlined in the Code of Federal Regulations (CFR). Compliance requires your organization to do the following:
- Create a design and development plan and define who is responsible for implementation.
- Establish design input procedures outlining the design requirements that address intended use and user needs. Design inputs are your early-stage PDS requirements. An example of a design input for a wearable device would be that it must be worn on the patient’s wrist.
- Define and maintain design output procedures. These are specifications identified throughout the design and development process that align with design inputs. An example of a design output for a wearable device would be that the wrist strap must be adjustable and biocompatible.
- Conduct design reviews evaluating whether the design is adequate to meet the intended use and user needs.
- Verify, through measurable means, that the product is manufactured correctly. Verification requires objective data collection, such as test reports, to prove that all design outputs meet design input requirements.
- Validate that the manufacturing process produces the correct product. Validation requires testing finished production units under real-world or simulated use conditions to prove that the finished device meets user needs.
- Make a design transfer plan defining the methodology and approach used to scale production without sacrificing quality.
- Keep all documentation proving the process to manufacture the medical device is according to the design plan in a device history file (DHF).
- Have a plan for identifying, documenting, validating, verifying, reviewing, and approving any design changes before implementation.
Document controls
The document control section requires your organization to have a secure and accessible system for approving and distributing quality regulatory documents. Additionally, you will need an established protocol for handling document changes and updates.
Purchasing controls
Purchasing controls assure the FDA that all products and services related to the finished device conform to the specified requirements. This means evaluating all suppliers, consultants, and contractors to ensure they meet your organization’s quality standards. Your organization must keep all purchasing data referencing quality and specification requirements for each supplier, contractor, and consultant. Additionally, there needs to be documented agreements between your organization and the suppliers, contractors, and consultants stating how they will notify you if the product or service changes in a way that could affect the quality of the finished device.
Production and process controls
Like design controls, production and process controls ensure that the manufacturing process used to produce the finished device is logical, predictable, and repeatable. Process controls are necessary because the manufacturing process needed to scale up production may differ from the development process. As a result, the manufacturing process could cause the device to fall out of specification. Production and process controls prevent this from happening. Package sealing is an example of a controlled production process. The manufacturer needs a process for ensuring that the correct temperature, pressure, and time are maintained regardless of production volume. Here are the requirements for production and process controls:
- Develop and maintain a production process ensuring all devices coming off the line conform to device specifications.
- Establish a procedure for validating, verifying, and approving any changes to the process.
- Document all instructions, SOPs, and methods.
- Control environmental conditions adversely affecting device quality, such as air quality and temperature. Any environmental control systems should be regularly reviewed and verified for proper function and conformance.
- Properly train staff in hygiene, PPE, and product handling preventing the possibility that contact between personnel and product adversely affects quality.
- Have cleaning and sanitation procedures in place that prevent contamination of buildings, equipment, and product.
- Inspect and maintain facilities and equipment regularly. Keep records documenting inspection and equipment calibration dates and results.
- Validate all processes, including software for automated processes, where inspections and testing are insufficient for verification.
Acceptance activities
Manufacturers must inspect, test, or otherwise verify that all product meets acceptable standards and complies with specifications. This includes all individual parts during receiving and in-processing and the finished device for final acceptance. Remember to maintain diligent records of whether products or devices pass or fail and keep these records in the DHR.
Nonconforming product
If a product does not conform to acceptable standards, there needs to be a procedure detailing what to do with it. Manufacturers are required to identify, document, evaluate, remove, and dispose of nonconforming products. Sometimes, the nonconforming product may be able to be reworked. Your organization will also need a documented procedure for identifying and tracing reworked products, ensuring they comply with established specifications after rework.
Corrective and preventative action
Corrective action relates to the elimination of the cause of nonconformity. Corrective and preventative action (CAPA) is where you identify all possible risks and errors in your manufacturing process and establish corrective measures. Your organization will need to keep records identifying the cause of nonconforming and implement preventative measures to stop it from reoccurring. CAPA flow should look like the following:
- Identify the cause for nonconformance.
- Investigate what caused the nonconformance.
- Identify corrective actions to prevent reoccurrence.
- Verify and validate the corrective actions.
- Record procedural changes in your SOPs and instructions.
- Implement corrective actions within your organization.
- Notify responsible parties for supervising and carrying out changes.
- Submit changes for formal review by quality management.
- Document the CAPA process.
Labeling and package control
Labeling refers to the labels on the packaging and the informational inserts within. Defective packaging, mispackaging, and incorrect or missing lot numbers, inserts, or labels, can all lead to the FDA recalling your medical device. Additionally, if your medical device is labeled misleadingly or falsely, the FDA could consider your device misbranded and prevent you from marketing it. Labeling and packaging controls prevent your device from mislabeling and possibly causing user harm. Compliance means your organization will:
- Print and apply labels in a way that they are not easily removable and they are legible.
- Inspect labels for the correct lot number, expiration date, instructions, and other necessary information.
- Store and process labels in a way that prevents confusion with other labels.
- Document label and labeling information within the DHR.
- Packaging needs to be designed and constructed in a way that protects the medical device from damage during processing, storage, handling, and shipping.
Handling, storage, distribution, and installation
This section of the CFR is straightforward and includes controls for preventing contamination, damage, or mixups during the handling, storage, distribution, and installation of the medical device. This includes controlling stock rotation and disposal of the deteriorated product in storage rooms and warehouses. You will also need to implement a procedure for controlling device distribution, assuring that only approved devices are shipped out. Medical devices requiring installation will need installation and inspection instructions. As will the other previous controls, all activities need appropriate documentation.
Records
The FDA requires records to be kept in a way that is easily accessible to them and anyone in your organization involved in quality-related activities. Manufacturers must keep records for the anticipated lifetime of the medical devices or a minimum of two years from the date of first distribution. Records required by the FDA include the Device Master Record, Device History Record, Quality System Record, and Complaint Files.
Servicing
Medical devices requiring servicing need a procedure describing how to perform the service and validate the results. Service reports need to be documented and analyzed and should contain the date of the service and who performed it.
Statistical techniques
Statistical techniques are necessary to ensure manufacturers have reliable data for inspections, analysis, and verification or validation activities. Your organization will need to establish a sampling plan based on valid statistical rationale so that the results can prove the product remains within specification.
It is important to note that the above cGMPs are considered the bare minimum for manufacturers to maintain compliance and produce high-quality and safe medical devices. Class II or Class III medical devices require additional device-specific Special Controls to establish reasonable device safety. Establishing good design and manufacturing controls will help your organization develop good quality habits early and potentially avoid costly mistakes down the line. If you are unsure how to get started or would like some expert advice on establishing a quality management system, contact us and we would be happy to help.
