The QSR/ISO 13485 Maze: How FDA's Satellite Device Rules Will Complicate A Quality System Regulation Rewrite

Kim Trautman, who authored the Quality System Regulation in the 1990s, says US FDA officials tasked with retooling the QSR will have to consider an array of other device-related rules that address complaints, product recalls and traceability – just to name a few – to make sure those requirements will still be met by manufacturers.

When US FDA begins the long-overdue revision of its Quality System Regulation, it won't be retooling the decades-old rule in a silo. Instead, agency officials tasked with the QSR redo will have to consider satellite device regulations that address complaints, product recalls and traceability – just to name a few – to make sure those requirements will still be met by device-makers.

That's according to former FDAer Kim Trautman, author of the QSR in the 1990s, who is now executive VP of medical device international services for consulting firm NSF International.

FDA "will have to take into account other regulations. They're known as 'concurrent amendments,' and there are quite a handful of them," Trautman said in an interview. "There are a lot of aspects that [the agency will] have to look at: Unique Device Identification, and clearly Part 803, and Part 806 and Part 821," Trautman said.

21 CFR, Part 803 is FDA's Medical Device Reporting rule and 21 CFR, Part 806 is the Corrections and Removals regulation. 21 CFR, Part 821 is the rule for tracking products.

"These are some things that some people might not consider intuitively" as the QSR – the bedrock rule for manufacturing safe and effective devices in the United States since 1996 – is combined with international quality systems standard ISO 13485.

FDA announced in May that it will merge the Quality System Regulation with the International Organization for Standardization's ISO 13485. The standard is used by device firms to ensure quality systems compliance with regulators in a variety of countries, including Canada, Japan, Australia and the 28 member states of the European Union.

"When Melissa and the team at FDA take this project on, it's not going to be just about looking at Part 820 [the QSR] by itself. A lot of other regulations will also have to be considered, because there are ties – there are ties in the actual words," said Trautman, noting that a QSR rewrite could take as long as five years. "There are definite linkages within 820 that tie to other regulations that FDA has that will have to be thought through."

She pointed out that, while ISO 13485:2016 has complaint handling requirements that closely mirror those already in Part 820.198, any new quality systems rule from FDA will have to include Part 803 MDR obligations – something that isn't found in the ISO standard.

Specifically, QSR Sec. 820.198(d) directs firms to investigate complaints and report them as appropriate to the agency under its MDR system. "And there are specific requirements in the QSR's complaint handling section that go above and beyond ISO 13485 to provide the basis for what’s necessary in the Part 803 requirements of MDR filing," Trautman added.

When FDA rewrites the complaint handling portion of the QSR, it's quite possible that it will "harmonize the general requirements to be identical to 13485, and then add a section that would include the particular requirements that tie to Part 803," Trautman said in a recent Medtech Insight article wherein she predicted some outcomes of a combined QSR and ISO 13485. (Also see "QSR Author Kim Trautman Predicts What A Mash-Up Of FDA's Quality System Regulation And ISO 13485 Might Look Like" - Medtech Insight, 15 Aug, 2018.)

"There are differences between the Quality System Regulation and ISO 13485, and those differences aren't going to be able to be wished away," NSF International's Kim Trautman says.

Trautman further pointed out that FDA's tracking regulation plays a prominent role in QSR Sec. 820.65 for device identification and traceability.

"The words in 820.65, when I wrote them, had to be tied to the tracking regulation, Part 821," she said. "That's why the beginning of 820.65 talks about devices that are intended for surgical implant that are life-sustaining, et cetera – because I had to tie it to the definition for 'tracking' in 821."

She noted that ISO 13485 says little about tracking and tracing.

"ISO 13485 is very innocuous [about that]. It hardly says anything, and it basically says to look to country-specific requirements," Trautman said. "It just says [under Sec. 7.5.9.1] that the organization shall document procedures for traceability, and that they should define the extent of traceability in accordance with applicable regulatory requirements, and to keep records."

However, "there are some particular requirements for implantables that line up a little closer to the intent of 820.65" under ISO 13485 Sec. 7.5.9.2, she said.

"There are differences between the Quality System Regulation and ISO 13485, and those differences aren't going to be able to be wished away, especially when those differences are other FDA rules," Trautman said. "So, for traceability, for complaint handling – some of those differences are going to have to remain."