The Impact of IT on Key Processes In Medical Device Manufacturing
In the first part of this column, we discussed how your IT infrastructure has a significant influence on your medical device development process. In this the second part, we will go into more detail on some of those processes to show how IT can make them more successful.
John Bredesen Minnetronix, Inc. |
• Provide the right information with the right level of detail to the right people at the right time;
• Build team confidence;
• Establish event-based communications;
• Establish clear action-required indicators;
• Create process-driven systems, not vice versa;
• Ensure that the easiest way is the right way.
In this part we will examine how IT systems have an impact on four major tasks in the medical device development effort: risk management, requirements management, issue tracking and project management. The above success list is important to keep in mind when evaluating any system in these areas.
Risk Management
The FDA mandates that risk management be used to reduce the potential of harm of a medical device as low as reasonably possible. A comprehensive approach is to use both a top-down approach (How can this device hurt someone?) and a bottom-up approach (If this fails, what will happen?). Each risk is analyzed on several attributes, including severity and likelihood. Risks considered “bad enough” are mitigated. This results in two potentially large lists of risks that need to be documented, analyzed, reviewed, traced and approved.
A good risk management system allows for grouping of similar risks, copying from standard risk libraries (e.g., if a device has a power cord, then copy the power cord risks) and prioritized viewing of all risks to aid in analysis. In an outsourcing situation, the review process requires a conference call or web conferencing to go through the lists several times.
Second, traceability between the risks and requirements is needed to ensure that mitigations are handled properly. For example, if a hazard is possibly having too much power applied to a disposable, the mitigation might be incorporating redundant sensors and a power limiter. These mitigations need to be mapped into requirements. Effective traceability means that reviewers can quickly see that each risk is mitigated appropriately.
Meeting Requirements
Requirements are the fundamental building blocks for specifying a medical device. System requirements describe functionality at a high level. Subsystem or software requirements describe behavior at a lower level. In an outsourcing situation, the requirements take on a contractual flavor as they are the agreed upon functionality. The better the requirements, the less chance of problems or dispute later on.
The creation of the requirements calls for lots of discussions between the companies involved. The customer brings the expertise on the medical device and the associated business requirements, and the outsourcing company brings in the expertise of having turned ideas into products.
Once the requirements are created, they need to be reviewed. Many companies use formal review meetings to capture the changes and the reasoning behind decisions. While it is best to have these meetings in person, that is not always possible in an outsourcing situation so conference calls or web-based meetings are needed. Having all the requirement information available to both parties, in an editable form can speed the review meeting along.
Tracing requirements is important to the verification testing of the product. There must be clear traceability from each system requirement to test protocols and then to test results. Intermediate traces can include subsystem or software requirements if needed. In addition, as discussed before, all necessary mitigations must be traced to requirements. That allows each required mitigation to trace all the way to test results, proving the mitigation has been designed correctly.
Another factor relating to requirements management is multiple contributors. Rarely will only one person write all the requirements, risks and test protocols. A good requirement management system needs to support multiple people working on it at the same time. Using Microsoft Word documents for requirements can accomplish this inexpensively, but updates during the process, change control and maintenance of the traces can drive the actual cost of the cheaper, manual process higher than with a purchased product.
Issue Tracking
Issue tracking plays an important role during development of a medical device, especially one containing software and electronics. The process of identification, management, tracking and closure of issues can have a profound effect on the quality and timeliness of the device.
An issue tracking system must allow for multiple types of issues. Some that come into play are formal review actions, design issues, risk management issues, verification testing issues and engineering change order (ECO) actions. Note that both issues and actions are captured.
Project managers need to manage the issue list for their projects. Team members (both internal and customer) need to view issues assigned to them, add information as an issue progresses and help reach resolutions. Most issues will require that one or more actions be performed and tracked to the issue.
Resolving and closing issues are two separate events. A resolved issue indicates that the required tasks are complete. A closed issue indicates that a quality assurance representative has checked to make sure that the tasks have been performed correctly. This dual-closure approach is critical to ensuring that the issue has been dealt with safely, effectively and completely.
Actions resulting from formal reviews and ECOs need to be tracked along with the originating issue. These actions are more closely related to issues than scheduled tasks on a project plan. An example is a software issue discovered during verification testing. After root cause analysis (captured as a note in the issue), several actions must be completed: updating requirements, updating software, updating test protocols, re-running tests and documenting test results.
Of particular note for issue tracking is event notification. As the list of issues and actions get longer, it is not always feasible to check regularly to see if anything has been assigned or if a gating action has been completed. Using event notifications to keep team members informed will help make the team more efficient. Of course, given today’s already crowded inboxes, give thought to how the notifications will work to avoid “notification numbness.” Having individuals sign up for their desired notification level and type can help.
Project Management
When multiple companies are involved, managing the overall project and the subproject at each organization can be difficult. Establishing a clear list of milestones, deliverables and schedules is critical. These lists must be visible not only to the internal and customer team members but also the management of all involved companies.
The customer has a product development schedule that its business relies upon. If the product fails to get out in time, a market window could close or venture money could fall through. All team members must know the major milestones so it should be visible on the front page of relevant systems. The customer’s schedule will drive internal schedules and milestones. The internal team needs to see the combined list, and the customer may or may not need to see all internal milestones. Deliverables (not always the same as milestones) should also be visible to all team members.
Comparing up-to-date project costs with estimated costs (including any project changes that have occurred since the original estimate) will reduce the chances of cost surprises down the road. One particularly important cost is that of purchased items not yet arrived. These are committed dollars and can get large quickly during some phases of the project.
Understanding how various development processes work in an outsourcing environment is the first step in creating systems that provide competitive advantages for your company. If any of the above processes are being performed manually, there is room for significant improvement.
John Bredesen (jabredesen@minnetronix.com) is the IT Manager for Minnetronix, Inc. He has more than 15 years of experience in IT and 10 years in software and embedded system product development. He has a B.S. in electrical and computing engineering from University of Wisconsin-Madison and an M.S. in software engineering from University of St. Thomas. Minnetronix is a medical device product company specializing in the design and manufacture of custom embedded software and electronics.
Minnetronix’ information systems have been successfully audited dozens of times by customers and regulatory organizations.