Incidents - an acid test for risk management

No medical device is free of risks. Dealing with fatalities and serious effects on the health of patients presents companies with ever greater challenges at a time of great political and social pressure on medical technology. This development places the highest demands on domestic and international communication with authorities, distributors and users and requires well thought-out crisis management that focuses on the manufacturer's risk management system. An overview of existing and upcoming obligations and liability risks was provided at the Medical Devices 2016 mini-symposium on June 29 in Reutlingen.

User error as an incident

Prof. Dr. med. Marc O. Schurr from Novineon Healthcare Technology Partners GmbH moderated the event and first raised the question of whether a user error could be an incident. Some authorities take this view, he said, although this is hardly consistent with the wording of the definition of an incident in the MPG. This already shows that the BfArM is anticipating the upcoming Medical Devices Regulation (MDR, i.e. the European Medical Device Regulation). According to the MDR, a mere user error could also constitute an incident.

Principle of personal responsibility

Dr. Ulrike Brucklacher, specialist lawyer for medical law at VOELKER & Partner mbB, presented the basics of medical device law and pointed out one principle in particular that every medical device manufacturer must internalize: the principle of personal responsibility. Many medical device manufacturers have an ongoing correspondence with the BfArM and therefore believe that the BfArM must actively point out if they have to do something as a medical device manufacturer. "Unfortunately, this is wrong," says Brucklacher. The manufacturer alone is responsible. At most, the BfArM provides information to the state authority as the responsible supervisory authority, but is not obliged to give the manufacturer instructions for action. If an incident occurs, many manufacturers only think about the products that will leave the company in the future. What happens to products that are already on the market is often forgotten. Simply changing the instructions for use, for example, is therefore not enough.

With knowledge you are responsible

Dipl.-Ing. Michael Schrack from Schrack & Partner explained how manufacturers can prepare for incidents in the QM system. A quick reaction is central to this. Because time starts to run from the moment knowledge is gained. "And knowledge already exists when an employee in a remote branch becomes aware of anomalies. If it then takes a week for this information to reach the company headquarters, it may already be too late," explains Schrack. This is because there is an obligation to report immediately and within 30 days at the latest. The company organization must be prepared for this. Qualified feedback must be provided within this period and the investigation must not just be started. "It is important to create a complete file on the process that combines all relevant documents and information in one place," Schrack continues. According to Schrack, the regulations in the QM system consist of three parts: the definition of responsibilities, the definition of the process landscape and the description of the processes and the interface regulation to third parties.

Interface to third parties only via contracts

In the event of incidents, the supply of information from third parties is particularly important. The law only stipulates that the manufacturer must also obtain information from third parties, but does not give the manufacturer itself the right to do so. The manufacturer must regulate such rights in its contracts to meet its exact requirements. "There are no standard contracts," says Schrack. Looking ahead to the upcoming MDR, Schrack welcomed the fact that many of the current MEDDEVs have been incorporated directly into the MDR, so that there is now greater clarity about their binding nature. According to the MDR, it is important to create a cross-reference matrix, i.e. a document that clearly shows that each individual legal requirement has been implemented in the company's own QM system. This requires an extremely high level of detail, but also serves to check whether everything has been considered. A presentation in tabular form is recommended, which is subdivided according to the MDR standard, the reference in the QM system and the manufacturer's specific document. The independent obligation for importers, distributors and authorized representatives to report incidents will have far-reaching practical effects. Schrack illustrates this: "If a Spanish distributor has an anomaly, they must report it to the Spanish authorities. At the same time, the QM system must provide for feedback to the manufacturer. This is because the manufacturer is also obliged to report independently. In this respect, the various QM systems must be interlinked."

Managing directors and senior executives can be personally liable

Dr. Christian Lindemann, LL.M., specialist lawyer for international commercial law and specialist lawyer for intellectual property law at VOELKER & Partner mbB, shed light on the various legal relationships in the event of an incident and the very different levels of information that must be reported. In terms of medical device law, the incident should be described in as much detail as possible. The insurance company must be able to provide an exhaustive account of the incident within the reporting period of usually one week, but also not incorrectly assume its own responsibility, which will not have been clarified by then. For reasons of commercial law, a supplier must be notified immediately of a defect in the delivery, otherwise recourse for damages may fail. In contrast, no information on the matter should initially be provided to law enforcement authorities. In addition, product warnings may need to be published or even recalls initiated - again with the right level of information. All of these issues need to be considered and dealt with within a very short period of time in addition to the incident report under medical device law and should therefore also be included in the QM system. Failure to do so could result in personal liability on the part of the managing director and senior executives. Lindemann gives a practical tip: "If a recall is necessary, the costs for the return transport of all delivered products are often higher than the actual costs of remedying the defect, especially if explantation is required first. The usual public liability insurance with extended product liability insurance does not usually cover these costs. Other provisions should therefore be made for such costs, e.g. contractually or at least through recall cost insurance."

Pick up the phone immediately

Dr. Rainer Boenigk, Managing Director of Boenigk Consulting GmbH, concluded with an international perspective. The time component is essential and requires "active complaint handling": "After a complaint, the phone must be picked up immediately." This is the only way, for example, to ensure that the defective medical device can still be examined before it is disposed of by a customer.

Malfunction reporting is the No. 1 issue

Boenigk particularly emphasizes the problem of incidents being dismissed as mere user error. "There is an investigation of a device log which shows that a nurse manually switched off the device alarm twenty times in one night, causing the device to continue operating. Is that still user error?" asks Boenigk. In the USA, the answer is clear: "Every single user error in connection with an incident is reportable because it may indicate a design flaw." Within the EU, the situation is different and not necessarily reportable - at least so far. "Many manufacturers don't realize that they have to report a user error. The competition with the same device does not have to report because no fault has occurred with the device. But that doesn't matter in the USA," Boenigk clarifies and emphasizes: "Most Europeans stumble across this issue in the USA. Malfunction reporting is the No. 1 topic that must be adhered to. Once there has been a malfunction incident, the same malfunction must be reported every time, even if there has not been a serious injury." Schurr summed up the symposium by saying that the international reference should not be a deterrent. The actions of the FDA as the only competent authority in the USA are in many ways more predictable and predictable than those of the various competent European authorities of the individual EU member states - in Germany, the BfArM, the state authority and the Notified Body. However, the US system in particular also has a weakness: the currency of knowledge. This offers opportunities for the European market that should not be wasted.

Status: 28.07.2016