Risk Analysis of a Medical Device Accessory

[FoGia]

Hello,

I'm struggling to come up with a good and consistent approach related to risk analysis for devices that are accessories to unspecified broader systems(and which are registered as separate medical devices). Example: treatment planning software which can interface with different treatment modalities.
I'm facing two problematic scenarios:

• Accessory with no specific medical indication
• Accessory intended for a specific medical indication

In the former case no harm can be identified, the best we can come up with is a failure mode. Is is acceptable to leave the harms column empty then? Or is it better to the mention the aspect of the failure mode that comes closest to a possible risk? In that case, how to motive the acceptable risk/benefit balance?

In the later case the frequency and in some cases the severity of the risk is impacted by the other components of the system. Again is it possible to stick then to the failure mode and better not mention harms?

I'm looking forward your thoughts on this.

Best regards

 

[Marcelo]

The. main problem here seems to be that risk management for medical devices using ISO 14971 is risk management (including risk analysis) for medical devices, not medical devices accessories. For example, risk/benefit analysis is for benefit of the device for patients, not accessories.

If you are talking about the risk of patient harm, there's no way to perform a risk analysis without the device itself, because the hazardous situation is the exposure of the patient to potential harm from the device (not device accessories).

One thing that you could do (if you are manufacturing accessories only) is to focus on a worst case scenario with a mock device (or more than one) and perform a full risk management based on those assumptions. This would be the best (but not easiest) way to do it in my opinion.

 

[FoGia]

Thank you for your answer.

If 14971 isn't the right standard for this situation, which method could be used to tackle the "failure mode" management when dealing with accessories? And I would extend the question even further since risk management is so central to a number of other parameters: how to make the link with labelling, with PMS, etc...?

Another aspect of the problem has to do with CE marking. I just checked in the MDD, accessories are following the same requirements as 'full' medical devices, which means that compliance with ER needs to be demonstrated for these devices as well, including ER1 on risks and benefit/risk profile.

To make the situation even more complex, there are some cases where harms could indeed be identified. An example of such a risk would be, using the same example as above, where a treatment planning software through a problem in data display induces an error of interpretation by the clinician which leads to harm to the patient. In that case the 'risk analysis' could represent a mix a risks and failure modes.

In the example you provide, testing the scenario with a mock device, only a subset of risks will be identified. I am in the situation where some of the accessories I'm dealing with could be used in an unknown(but large) number of applications. If through PMS a new risk is identified for one of these applications does it necessarily require an update of the risk assessment? This sounds odd to me, it would be difficult to maintain and not very relevant.

 

[yodon]

One thing that you could do (if you are manufacturing accessories only) is to focus on a worst case scenario with a mock device (or more than one) and perform a full risk management based on those assumptions. This would be the best (but not easiest) way to do it in my opinion.

I'm not sure I would agree with this approach.

The risk analysis, to me, has to be done in the context of the device since you can't really establish what the risks are. The risks of a power supply failing differ greatly between, say, providing power to an infusion pump -v- powering a laptop hosting some support software application.

Without fully understanding the situation and what's hoped to be accomplished, one thing that came to mind was something more along the lines of a fault tree analysis. Show the possible paths for failure to meet specific functionality and how those were mitigated (if they were). The device manufacturer could use that to support the device risk analysis.

 

[Marcelo]

Well, in fact I was thinking about one specific situation when I mentioned that, the situation in which you do not have access, or do not know all devices the accessory is going to be used with (unfortunately this happens a lot) and still have to create something to show to an auditor.

I agree that this is not the best "correct" solution.

Problem, as pointed out, is there's no way you can do a full risk management if you do not know all the uses, the best you could to is use the part of the analysis of the accessory I(and yes, you can do a fault tree, a separate failure analysis, or anything like that) to complete the analysis of the device.

I'm not sure I would agree with this approach.

The risk analysis, to me, has to be done in the context of the device since you can't really establish what the risks are. The risks of a power supply failing differ greatly between, say, providing power to an infusion pump -v- powering a laptop hosting some support software application.

Without fully understanding the situation and what's hoped to be accomplished, one thing that came to mind was something more along the lines of a fault tree analysis. Show the possible paths for failure to meet specific functionality and how those were mitigated (if they were). The device manufacturer could use that to support the device risk analysis.