Transformative Testing: Addressing Patient Safety and Cybersecurity

An ever-evolving regulatory landscape, combined with increasingly complex and diverse medical devices, has challenged the testing protocols for many medical device manufacturers (MDMs). More companies want improved validation and accreditation processes, especially for pre-clinical device safety testing. Validation of cleaning, disinfection, and sterilization processes for many medical devices is already an ongoing improvement process. In addition, biocompatibility requirements are updated so frequently that it is hard for MDMs and their contract manufacturers (CMs) to keep up.

Both ISO and the FDA have emphasized risk management in developing testing protocols for medical devices. In 2018, ISO guideline 10993-1 was updated and continues to emphasize risk management. With these and other regulatory changes, it has never been more critical for MDMs and CMs to stay informed. For example, the upcoming Medical Device Regulation (MDR) in Europe has reclassified many products, “making it necessary to look at performing testing to keep these products on the market,” said Audrey Turley, senior biocompatibility expert for Nelson Labs, a Salt Lake City, Utah-based provider of laboratory testing and advisory services for the medical device industry. “Outside Europe, we are seeing more open dialogue between manufacturers and regulatory agencies. This leads to more scientific discussion of unique strategies to get innovative medical devices to market.”

As devices become more innovative, so must the tests that validate them. Although medical device testing still requires testing using traditional test standards, non-standardized customized protocols for testing are being developed to address specific features or components in new devices. For example, sophisticated equipment has been developed to assess nanostructures and nanomechanics, which are designed to evaluate mechanotransduction occurring at the cellular level.

Medical device security testing is another emerging field that is guided by regulatory mandates and an evolving awareness by the medical device industry of the risks (and liabilities) associated with unsecured devices. “In the past, security testing for medical devices was an optional component both in the U.S. and Europe,” said Sean Walls, vice president of Eurofins Cyber Security North America, a Lancaster, Pa.-based provider of cybersecurity services, including security testing for medical devices. “However, these regulations are stiffening and will soon be changing, requiring vulnerability testing on all new medical device applications.”

New Trends in Testing
The advent of new biomaterials, surface technologies, smart materials, and smart devices, with structures that can be as small as the nanoscale, impact the development of test strategies for such advanced products, which may require new equipment and services. MDMs are highly focused on risk assessment and its use in selecting validation tests and developing testing methods. This is especially true with the new version of ISO 10993:2018, which now starts with chemical risk assessment and finishes with toxicity risk assessment.

Until recently, MDMs and their testing providers relied mostly on biocompatibility testing; however, with ISO 10993-1’s increased emphasis on chemical characterization, biocompatibility testing alone cannot be relied on to support device safety. Robust chemistry testing and toxicological risk assessments are also needed to provide more specific information about chemicals at minute levels that could be harmful to patients.

For optimal results and adherence to ISO 10993-1 and MDR, the testing plan for a medical device should start with chemical characterization to understand the full range of chemical constituents, especially those that are not anticipated and could be harmful to patients. This testing is then followed by toxicological risk assessment and biocompatibility testing. Regulators expect all chemicals to be identified—reporting “unknowns” could trigger a submission rejection or demands for additional information. Not only do unknowns waste valuable time, they are expensive—repeat testing can cost as much as $100,000 and take up to six months to complete.

A continuing trend in the industry is more stringent risk assessment for reusable devices, including validations for cleaning, disinfection, and sterilization. Increased emphasis on these validations gained momentum after two deaths occurred in 2015 at UCLA, the result of an improperly sterilized duodenoscope. In response, the FDA finalized a guidance document that outlines its expectations regarding reusable device validations.

“Over the last several years we have seen a large number of requests for reusable device validations,” said Ryan Harper, business development director for Pacific BioLabs, a Hercules, Calif.-based provider of biocompatibility testing, cytotoxicity testing, and chemical characterization. “We have also seen continued improvement on the part of manufacturers in designing reusable devices that are easier to clean and disinfect. This could be as simple as allowing the user to open the device in areas that might accumulate organic soil, or by creating a smooth surface on devices that minimizes crevices or junctions that could complicate the reprocessing procedure.”

Meanwhile, upcoming changes in the FDA 510(k) process and the EU MDR are expected to make cybersecurity testing a requirement, rather than an optional component, in their accreditation processes. New cybersecurity requirements will likely call for the standardization of security testing for medical devices.

“This will force manufactures to rethink their system development lifecycle methodologies to incorporate security testing at a much earlier stage in the process,” said Walls. “Most of this work will likely be outsourced to third-party testing providers that have expertise in this area.”

What OEMs Want
The basics never change—OEMs want high quality, low cost, and speed. They want accuracy and efficiency in their pre-clinical device safety testing programs, including the identification of all chemicals derived from the analytical equipment itself.

OEMs are increasingly fixated on speed. Testing labs are often asked to do the impossible when it comes to completing testing in an unrealistic time period or speeding up accelerated testing. Sometimes, OEMs ask for multiple machines or assessments to be conducted in parallel with short turnaround times and low cost.

“Because validation testing comes at the end of the project, the time pressures on the tester can be enormous,” said Mark Turner, president of Medical Engineering Technologies, a Dover, U.K.-based provider of medical device validation testing.

However, as important as speed to market is for OEMs, “they must also ensure all of the required regulatory information is in a recognized format and presented in the correct manner for the global regulatory bodies,” said Melissa Cadaret, director of analytical services for NAMSA, a Northwood, Ohio-based provider of testing services for the medical device industry.

This requires the careful development of a testing plan that minimizes obstacles, optimizes efficiency, and streamlines time to market.

“OEMs could spend two to three times their expected costs if the test strategy is not established prior to testing, if the potential risks have not been discussed, and if feasibility or pilot studies are not conducted for first-time products that have not been previously assessed by the OEM,” said Lisa Ferrara, CEO of OrthoKinetic Technologies, a Shallotte, N.C.-based regulatory consulting firm that also provides accredited medical device and tissue testing.

Innovative test strategies and creative test set-up designs, with an understanding of the capabilities of the measurement equipment, are key factors in developing customized protocols for newer products, such as devices made using additive manufacturing (AM) methods.

“We are continuing to see an increase in requests for testing additive-manufactured devices, low-force testing of extremity specific devices, and an increase in instrument testing, specifically impact and torsion,” said Dawn Lissy, president of Empirical Testing Corporation, a Colorado Springs, Colo.-based provider of mechanical testing for medical devices. “There are also more requests for testing instruments that interface with the surgical robots.”

OEMs also seek experienced testing partners that can expertly navigate the rapidly evolving regulatory process. As international standards grow more challenging, MDMs want to partner with testing providers that can develop a comprehensive and efficient testing process that complies with those standards.

“OEMs are asking for guidance and justification on the interpretation of the current regulatory guidance documents and standards,” said Emily Mitzel, senior technical consulting expert and manager for Nelson Labs. “It is important to be able to perform a risk assessment of all validation parameters and how they meet current regulatory guidance documents and standards.”

One of the top OEM requests is for testing that supports regulatory submissions for both the FDA and foreign regulatory agencies. “With the changes in the EU and the MDR going into practice in 2020, an increasing number of international companies are requesting mechanical testing that was not required previously outside the U.S.,” said Lissy.

MDMs often prefer to carry out all their testing under one roof and under one contract. This is driving some laboratories to diversify the range of tests they provide, sometimes through consolidation with other labs. “Increasing device complexity can sometimes make it challenging to provide comprehensive services,” said Turner. “For example, very few labs can offer electromagnetic compatibility [EMC] testing along with performance evaluation, toxicity studies, and packaging validation.”

New Technologies and Approaches
The ISO and FDA emphasis on risk management has led to more OEM requests for gap analysis and chemical characterization. Chemical characterization (also called extractable leachable testing, or E&L) is a series of analytical tests that quantitates the chemicals that can leach out, or be extracted, from the device. Fortunately, the analytical equipment and instrumentation used for the chemical characterization continues to improve.

“For example,” said Harper, “time-of-flight mass spectrophotometers have been the most useful instrument for these types of studies because of their high resolution and sensitivity, as well as the ability to match spectra of unknown compounds with a library of known compounds. This is very useful in helping to identify some of the chemical found in extractable/leachable studies.”

In a typical chemical characterization study, an extract can be analyzed by several analytical methods, which may include gas chromatography-mass spectrometry (GC-MS), liquid chromatography-mass spectrometry (LC-MS), inductively coupled plasma mass spectrometry (ICP-MS), and headspace-gas chromatography mass spectrometry (HS-GC-MS).

This analytical testing equipment is becoming more advanced, resulting in increased sensitivity/quantitation limits. The increased sensitivity can then discover a greater number of materials or compounds that need to be shown to be biologically safe. “This is creating an increased need for analytical labs to have more robust databases of compounds to identify them correctly, which is a challenge for the industry,” said Joe Carraway, scientific director for NAMSA. “However, it is a positive move because it ensures biological safety of devices that are used to save and/or improve human lives.”

For the inspection of transcatheter heart valves, packaged catheters, biopsy needles, and similar devices, Glenbrook Technologies, a Randolph, N.J.-based manufacturer of high-resolution, X-ray inspection systems for medical device manufacturers, has developed a product that allows continuous X-ray inspection while the device moves through the X-ray field. Called the Cath-X, the device utilizes a micro-fluoroscopic X-ray imaging technology developed by the company.

“These detectors can resolve detail down to 10 microns—a magnification of 500 times or more—at low radiation levels,” said Gil Zweig, CEO of Glenbrook Technologies.

The device can also be customized for individual OEM needs. For example, transcatheter devices such as stents and heart valves, which are introduced through the femoral artery, “are often too long to be positioned for X-ray inspection with conventional cabinet X-ray equipment,” added Zweig. “We have developed various versions of Cath-X for these and other applications.”

Interconnectivity and Internet of Things
The Internet of Things (IoT) is starting to take hold in the medical device industry. Sensor technology, machine-to-machine communication, and real-time data collection and analysis are key functions in “smart” medical devices, including implants, wearables, and point-of-care devices. Interconnectivity also enables remote medical diagnosis and treatment.

“Telemedicine is the buzz word of the moment,” said Turner. “It is producing huge numbers of potential development avenues for diagnostics and devices—all of which come with data integrity and software validation worries. The European MDR published in 2017 requires evaluation of cybersecurity and software. It is very likely there will be a shortage of suppliers who can offer validated test services in these areas.”

Cybersecurity testing requests fall into two main categories:

• General security testing, such as vulnerability testing, application assessments, and penetration testing
• FIPS (federal information processing standards) and CC (common criteria) testing for government acceptance

“The challenge is that there is no regulatory oversight currently in place to ensure that adequate security controls are installed in medical devices, or that known vulnerabilities are identified and addressed,” said Walls. “Some manufacturers are being proactive by testing and securing their devices as part of their own system development lifecycle program; however, there is no consistency across the industry.”

Unless the government adds regulatory requirements, the market will eventually dictate the rules for IoT security testing. For certain types of devices, being “secure” adds a competitive advantage and improves its value proposition, while in other cases, it may just add unnecessary costs and delay the time it takes to get to market—which can mean everything in such a highly competitive industry.

IoT also adds value to the manufacturing side (faster and smoother operations) by making the equipment run as efficiently as possible—especially through predictive maintenance and other lean applications. “New and enhanced software better captures and reports data, which helps to increase the accuracy of testing,” said Amy Peterson, lab manager at DDL, an Eden Prairie, Minn.-based provider of medical device packaging and product and material testing. “In addition, web cameras are often used to record testing, which can be played back to review particular points of interest frame by frame. Videos can also be stored and sent electronically for use in reporting.”

Additive Manufacturing and 3D Printing
Additive manufacturing has increased the need for analytical testing on both the AM materials used and on the final product. As a newer technology, AM generally requires more testing to address potential risk concerns by regulatory bodies and clinical end-users.

“As most of these devices are relatively new, regulatory bodies have difficulty assessing them based upon intended use, final finished device, and sterility,” said Carraway. “Most current medical devices are manufactured first and then evaluated in their final finished form. With 3D-printed devices, the customization, remote manufacturing, characterization of residuals in the polymerization process, and quality control can be a cause for concern for regulatory bodies accustomed to more typical production methods.”

A common misconception by manufacturers is that if they start with a biocompatible material, then the final finished device is considered biocompatible. “This is not the case, as processing and sterilization can have a great impact on the state of the material,” said Turley. “While the material/device maintains its function, the leachability profile may have changed or there may be some additional risks from residual manufacturing debris that cannot be easily removed.”

In order to accurately test devices manufactured using AM methods, test blocks (how the device being tested is held to the test frame) often must be modified to account for the tolerances in AM devices, which are different from subtractive devices. “This is also true in accommodating different finishing surfaces with AM devices—for example, textured to promote bony in-growth,” said Lissy.

Cleaning additive manufactured products is also a significant challenge to medical device designers.

“Although the often complex AM structures enable their unique capabilities, these structures are also difficult to clean, and to prove they have been cleaned,” said Thor Rollins, director of toxicology and extractables and leachables (E&L) consulting for Nelson Labs. “We have worked with additive manufacturing companies to set up detailed cleaning procedures that can help them validate that their devices are clean.”

Standards and Regulations
Regulators are intensely focused on validation of test methods and quality of data, including repeatability and reproducibility. Challenges include how to apply these higher standards to legacy products that have been on the market for years, or even decades. For example, the new European MDR will require many devices to be re-examined, with many older devices likely to be newly tested for performance and toxicity [there are no “grandfather” rights for certification under the MDR]. Enforcement starts May 2020; any devices that are only certified under the old system (MDD) cannot be distributed or sold after May 2025. The MDR replaces the ER Checklist with General Safety and Performance Requirements.

The new MDR also impacts packaging. With required compliance by May 2020, a majority of the governing standards for packaging regulations are being updated. The ISO 11607 document has recently finished balloting and will move toward publication in the next few months.

“The ASTM International committees are also working hard and many of the standards are currently going through collaboration,” said Wendy Mach, consulting manager for Nelson Labs. “Some interesting items in the queue include a complete rewrite of ASTM F2475 and possibly new work on developing a standard test for microbial testing of a whole package.”

The FDA is performing an increasing amount of its own testing to answer questions about different aspects of medical devices. For instance, one study (presented at the ASTM Symposium for Additive Manufacturing in November 2018) is looking at the mechanical properties between direct metal laser sintering (DMLS) and E-Beam manufacturing methods for AM devices, hoping to identify substantial equivalence parameters between these methods. “Other research is being performed around utilizing finite element analysis [FEA] more optimally for submissions,” said Lissy. “In short, the FDA is attempting to answer relevant questions about analysis of devices to ensure safe and effective devices being marketed.”

Lissy noted that more MDMs are using FEA to minimize the amount of mechanical testing needed by evaluating what size/geometry combination represents worst case for the family of products being tested. The key is following the guidance document from the FDA about utilizing FEA and validating the model. “We have worked with a number of folks to perform this and it is a fantastic tool, once it has been validated,” she added.

Regulatory requirements for security testing have traditionally been considered optional. However, the FDA announced in a recent draft guidance it will make security testing mandatory for all medical device premarket submissions containing software. The biggest challenge for MDMs will be with addressing the vulnerabilities found in older, already approved devices that may have antiquated underlying software and operating systems.

“Since it can take years to go from initial design to a certified approved medical device, by the time the device makes it to market, the embedded software and operating systems are often no longer supported, and riddled with known vulnerabilities,” said Walls. “Furthermore, patching or fixing these security flaws may require a complete overhaul of the device and retesting of its functionality and safeguards. The current solution is for manufacturers to publish an MDS2 [Manufacturer Disclosure Statement for Medical Device Security], which discloses any known vulnerabilities and provides detailed recommendations for work around the problem.”

Moving Forward
Advanced medical devices—especially combination products that combine drugs, devices, and/or biological products—will continue to challenge testing methodologies. Many new innovative biomaterials are also being incorporated into medical devices. For example, non-linear, strain-rate dependent materials and hybrid materials with different regions of stiffness may require testing beyond the conventional standards that require customized or specialized equipment or advanced software.

Organizations such as ISO and ASTM continue to update and refine the standards to improve testing methodologies. “As changes happen with the way products are manufactured, shipped, or delivered, testing standards must also be adjusted to meet these changes,” said Peterson. “And, as innovation in product development continues, new test methods must be developed to keep pace with these technologies.”

Laboratories are especially excited about the possibility of a large reduction in animal testing, thanks to an in-vitro irritation test method for medical devices. The test method is being reviewed through the FDA’s Medical Device Development Tools (MDDT) program, which is a tool to push new technology through the FDA for an official approval. ISO standards are also being updated.

“Previously, irritation and sensitization testing were included in one standard, ISO 10993-10,” said Turley. “Irritation testing is one of the most used tests in the medical device testing realm. A new standard is being written for irritation testing, ISO 10993-23, while sensitization will remain in 10993-10.

Medical devices will continue to become smaller and more complex, with innovative combinations of metals, polymers, pharmaceuticals, and processing that will challenge current testing abilities and limits.

“Determining how to assess these products through alternative, in-vitro methods will be a challenge,” added Turley. “It will require significant investment in time and materials from all parties involved and cross-collaboration between scientific disciplines such as chemistry, biology, and toxicology.” 

---

Mark Crawford is a full-time freelance business and marketing/communications writer based in Madison, Wis. His clients range from startups to global manufacturing leaders. He also writes a variety of feature articles for regional and national publications and is the author of five books.