‘We Were A Victim’: How An FDA Remote Regulatory Assessment Took One Device Maker By Surprise
Executive Summary
A manufacturer approached by the US FDA to participate in its voluntary Remote Regulatory Assessment program quickly discovered it bit off more than it could chew. It also didn’t help that the investigator running the firm’s RRA seemed to skirt agency protocol around the assessments. RRAs have taken the place of on-site facility inspections during the COVID-19 pandemic.
[Editor’s note: To ensure its privacy, Medtech Insight will not name the manufacturer that’s the subject of this story.]
Consultant Korina Akhondzadeh was enjoying a quiet March vacation when she was interrupted by a frantic phone call from a client, a class II medical device manufacturer who was smack-dab in the middle of a Remote Regulatory Assessment (RRA) conducted by an investigator with the US Food and Drug Administration.
It was day three of the company’s RRA – a voluntary regulatory compliance program the agency established a few months ago for device makers to take the place of on-site facility inspections during the COVID-19 pandemic – and Akhondzadeh’s client couldn’t locate a document requested by the investigator.
“That’s when [the client] called me, and I say, ‘What's going on?’ And he says, ‘I have this FDA request,’ and I ask, ‘Are you in an inspection?’ And he says, ‘No, it’s not an inspection.’ So I ask, ‘Then what kind of visit is this?’ because I had no idea that this [RRA program] was going on. But by then it was too late for him to say, ‘I’ve changed my mind,’” said Akhondzadeh, who’s with Carlsbad, CA-based KARA & Associates.
The FDA investigator “caught them off guard, to be honest with you,” she told Medtech Insight.
That’s because the RRA began on the same day it was requested by the investigator, giving the manufacturer no time to prepare.
“This is a two-person company. This is a small company that makes a [moderate-risk] class II product. So they really don’t understand the FDA,” Akhondzadeh said. The investigator “told them this was not an inspection; it was just some kind of an assessment that the FDA was doing, and asked if they would want to be part of it. And so, because [the client] was afraid that there would be some repercussions, he said yes, which was his first mistake, instead of saying, ‘Can I get back to you, and let me see what this program about.’”
“Once you share your underwear with the FDA, it's going to be kind of hard to say, ‘I don't want you to see my underwear anymore.’” – Korina Akhondzadeh
Once the company accepted, the investigator began the RRA right then and there, surprising the firm – and apparently skirting FDA protocol around the assessments. (The agency told Medtech Insight that a typical RRA begins roughly five days after a manufacturer agrees to take part: “We will work with a firm once the formal invitation is accepted to schedule a virtual meeting that works for the establishment and the Investigator – an average of five days from announcement to start.”)
But Akhondzadeh said the investigator “immediately started the questioning. She would ask them questions, and then they would have to submit all of their documents via email to her. She said, ‘OK, since you’ve agreed [to the RRA], I need you to send me the following documents.’ So [the company] just started sending her stuff. They didn't think about redacting them, they just started grabbing from their computer and sending her the documents, because she's telling them, ‘This is not an inspection.’”
And that’s true – RRAs are not considered by the FDA to be official surveillance inspections, and manufacturers “may decline to participate in [an] RRA at any time, and non-participation will not result in regulatory action,” says an agency document on the assessments obtained last month by Medtech Insight. (See sidebar story below.)
Still, an RRA does paint a portrait of a company’s general compliance with FDA rules and expectations – and declining to participate in one could put a firm on the agency’s radar for an in-person inspection down the road, industry experts have said.
During her client’s RRA, Akhondzadeh said the investigator asked for “procedures for internal audits and risk analysis, procedures for validations, the UDI [Unique Device Identifier] information, and … design history file inputs. She also wanted the supplier controls procedure … and a list of change orders.”
The investigator “sent them an email with all of these [requests]. Then she says, ‘Based on this change order, I want to see these other following change orders.’ Then [the company] sent her those change orders without redacting, unfortunately,” Akhondzadeh said.
It’s when the manufacturer couldn’t find requested validation documentation on the third day of the RRA that Akhondzadeh received that panic-stricken call from the firm.
“I asked, ‘What are you doing?’ And that’s when they said, ‘Please, Korina, can you help us with this list [of requested documents]? We’re getting really nervous. [The investigator] wants all of these things,'” Akhondzadeh said. “So by this time they’re on day three of giving … her stuff, and obviously she wanted more.”
And in one of her email requests for documents that was shared with Medtech Insight, the FDA investigator used the word “audit” to describe the RRA – not “assessment.”
“I told my client, ‘You need to call her back and ask her if this is an audit or an inspection, because she's telling you that [it’s an audit] in writing,’” Akhondzadeh said. “So they called [the investigator] and she says, ‘No, no, no, no, it’s not an audit. Again, it's just an assessment. You're not going to get an FDA-483 [inspectional observation form]. You shouldn't be concerned.’
“So what are we talking about here? You have to be clear about all of this, Mr. FDA.”
While the agency told Medtech Insight it does not comment on specific Remote Regulatory Assessments that have taken place, it did stress that RRAs “are not inspections, and they are not audits.” Nevertheless, an investigator using the word “audit” while conducting a type of voluntary assessment that’s wholly unfamiliar to most device makers undoubtedly adds a layer of uncertainty and anxiety for manufacturers around RRAs.
No Virtual Facility Walkthroughs – Yet
While there were face-to-face calls between her client and the FDA investigator, Akhondzadeh said a virtual walkthrough of the facility didn’t take place.
The agency explained to Medtech Insight that “the RRA process was designed to be interactive, and we are using video-audio platforms such as Zoom, Teams and WebEx to engage with regulated establishments.”
However, the FDA added: “Virtual tours may be included in future developments and expansion of this [RRA] effort.”
Chasing The RRA Report
Akhondzadeh said the RRA lasted for five days, with roughly 30 to 40 emails exchanged between company and FDA investigator.
The firm’s close-out meeting with the investigator happened a few days later, during which the device maker was told of five found deficiencies.
The investigator also verbally told the company to respond to the official report of the assessment within six months – although the FDA assured Medtech Insight that submitting a response is strictly voluntary for manufacturers. “There is no consequence if a firm does not want to participate in an RRA or respond to RRA deficiencies noted,” the agency stressed.
During the close-out, Akhondzadeh’s client was given a reference number for its RRA report and was told to request a copy of it via the Freedom of Information Act (FOIA).
Because an RRA is not an inspection in the eyes of the FDA, rules around FMD-145 don’t apply, and a copy of the report isn’t automatically provided to manufacturers. FMD-145 outlines the criteria and instructions for releasing an Establishment Inspection Report to a company following an on-site inspection.
“Again, my concern was that [the client] didn't have the opportunity to redact any documents,” Akhondzadeh said. After all, “once you share your underwear with the FDA, it's going to be kind of hard to say, ‘I don't want you to see my underwear anymore.’”
“When I saw [the] article, it talked about, ‘This is what the FDA’s planning on doing.’ I'm like, ‘Wait a minute. We were a victim of this.’” – Korina Akhondzadeh
She also believes it’s unreasonable to ask companies – particularly small ones whose workers are likely unfamiliar with government bureaucracy – to submit a FOIA request to obtain a copy of its report.
“To be honest with you, typical [people], they don’t even know what the Freedom of Information Act is, OK?” Akhondzadeh said. “And now [the client’s] confidential, unredacted documents can be obtained by anyone who requests that RRA report through FOIA.”
The FDA told Medtech Insight that reports obtained via FOIA are “reviewed and released with any necessary redaction per the FOIA process by FDA’s government information specialists.” The agency further explained that its specialists are “trained and are considered subject matter experts in medical device company procedures, device quality systems documents [and] trade secret requirements, and regularly interact with the agency device subject matter experts as needed.”
In the end, Akhondzadeh’s client received its RRA report 10 days after filing a FOIA, which is incredibly fast for such a request. Notably, nothing in the company’s report was redacted – but it’s unclear whether that’s because the FDA’s specialists chose not to, knowing the report was being sent to the company itself. (Medtech Insight submitted a FOIA request for the device maker’s report but had not received it by the time this story posted.)
And while the manufacturer is committed to fixing the deficiencies noted by the investigator, Akhondzadeh said, it’s still weighing whether to reply to the RRA report – despite being (incorrectly) told to have a response ready within a six-month time frame.
‘We Were A Victim Of This’
With specifics about the FDA’s RRA program coming out in dribs and drabs, Akhondzadeh said the FDA would be wise to be more transparent about the process and improve its messaging.
After all, she was coming from a standing start on that March day when she got that panicked call from her client. Despite working consistently with a variety of device makers and being up to speed with what’s going on at the FDA, she hadn’t heard of a Remote Regulatory Assessment before, or even that the agency had launched a new program for determining manufacturer compliance.
So after her client’s RRA was complete, Akhondzadeh began “reaching out to industry to find out, ‘Has anyone else experienced this?’” she said. But none of her other clients – including some larger medtech firms – knew anything about the assessments.
She eventually put two and two together after an internet search turned up an April Medtech Insight article on RRAs.
“When I saw [the] article, it talked about, ‘This is what the FDA’s planning on doing.’ I'm like, ‘Wait a minute. We were a victim of this,’” Akhondzadeh said.
Since then, she’s discussed the RRAs with two other device firms that have been approached by the FDA for assessments.
“One did accept – I really tried to talk them out of it, but they were afraid [of the FDA] – and the other one agreed [with me] and declined” the RRA, Akhondzadeh said.