W
welshery
Thank you Al, that was really helpful.
ISO 13485 Records Retention Requirements
- Thread starter amjadrana
- Start date
R
rose24m03
Who's responsible?
In real life, Recipient business does not have the luxury to refuse responsibility using "we didn't own the business yet at that time" excuse. If warranted, regulatory agencies would still take actions against the Recipient business organization. So would lawyers, patients and family of deceased/injured patients. (Example: (broken link removed) "Guidant pleaded guilty to federal charges in June 2003 that EndoVascular Technologies, a company it acquired in 1997 that made abdominal aortic grafts, covered up device malfunctions. Guidant paid a $92 million fine to the Justice Department to settle the case and shut down EndoVascular.")
Record Retention requirements would not go away simply because there's a change of business ownership. We even go so far to require our outsourcing manufacturers to inform us and to forward us all device history records should they one day decides to go belly up or sell their business.
Besides, with implantable, there's that Traceability requirement required by the regulations. For example, FDA's Preamble states, "FDA believes that the extent of traceability for both active and inactive implantable devices should include all components and materials used when such products could cause the medical device not to satisfy its specified requirements." (pg 52627) In combination with Record Retention and Vigilance Reporting (including recalls) requirements, Recipient business is still bound to ensure public safety.
As for archiving records via electronic medium, with the ever-changing technology, medium console will need to be maintained, in addition to the electronic records. For example, in the old days, people archived records via microfiche. In order to view these archived records, you'll need to have at least one working microfiche equipment. If you archive via CD-ROM, then you need a drive that will allow you to view the files you stored on the CD-ROM. (NOTE: CD-RW is not acceptable, because you can alter or accidentally delete the original electronic copy.) If you archive via network backup, then you definitely need to have a good and working disaster recovery plan that would allow you to safely and efficiently retrieve records. Plus, you'll need to worry about the possibility of file corruption. (NOTE the "reasonably accessible" and "readily available for review and copying" in the QSR 820.180 clause.) Please see 21 CFR Part 11 for electronic record requirements.
In real life, Recipient business does not have the luxury to refuse responsibility using "we didn't own the business yet at that time" excuse. If warranted, regulatory agencies would still take actions against the Recipient business organization. So would lawyers, patients and family of deceased/injured patients. (Example: (broken link removed) "Guidant pleaded guilty to federal charges in June 2003 that EndoVascular Technologies, a company it acquired in 1997 that made abdominal aortic grafts, covered up device malfunctions. Guidant paid a $92 million fine to the Justice Department to settle the case and shut down EndoVascular.")
Record Retention requirements would not go away simply because there's a change of business ownership. We even go so far to require our outsourcing manufacturers to inform us and to forward us all device history records should they one day decides to go belly up or sell their business.
Besides, with implantable, there's that Traceability requirement required by the regulations. For example, FDA's Preamble states, "FDA believes that the extent of traceability for both active and inactive implantable devices should include all components and materials used when such products could cause the medical device not to satisfy its specified requirements." (pg 52627) In combination with Record Retention and Vigilance Reporting (including recalls) requirements, Recipient business is still bound to ensure public safety.
As for archiving records via electronic medium, with the ever-changing technology, medium console will need to be maintained, in addition to the electronic records. For example, in the old days, people archived records via microfiche. In order to view these archived records, you'll need to have at least one working microfiche equipment. If you archive via CD-ROM, then you need a drive that will allow you to view the files you stored on the CD-ROM. (NOTE: CD-RW is not acceptable, because you can alter or accidentally delete the original electronic copy.) If you archive via network backup, then you definitely need to have a good and working disaster recovery plan that would allow you to safely and efficiently retrieve records. Plus, you'll need to worry about the possibility of file corruption. (NOTE the "reasonably accessible" and "readily available for review and copying" in the QSR 820.180 clause.) Please see 21 CFR Part 11 for electronic record requirements.
Last edited by a moderator:
W
welshery
Many thanks, that just about says it all! and what a thorough answer. I am really grateful and I will certainly take it on board. Big thanks.
R
rose24m03
Re: FDA Implantable - device tracking record, acquisition/out of business
Have not use this site for a long time... here are more info from "Guidance for Industry - Medical Device Tracking; Guidance for Industry and FDA Staff", November 17, 2006 that are related to the record retention and acquisition/out of business topics:
Tracking Records:
Tracking records must be maintained for the useful life of the device, even if a patient is lost to follow up.
Does Tracking Ever End? Tracking is no longer required when documentation shows that the device is returned, destroyed, explanted or the patient dies. Refurbishers or remanufacturers of tracked devices that remain in domestic commercial distribution are subject to tracking requirements and should be able to ensure that the original manufacturer can promptly locate the device(s).
(21 CFR 821.2)
A manufacturer, importer, or distributor may request an exemption or variance from tracking in the form of a petition. Petitions need to be submitted in the format explained in section 10.30 of FDA’s regulations.
For devices with an approved PMA that are also subject to a tracking order, the need for continued tracking may be reassessed, at the sponsor’s request or by the agency’s initiative, 10 years from the date of the original PMA’s approval.
Going Out of Business:
(21 CFR 821.1(e))
A manufacturer or distributor that goes out of business is required to notify FDA at the time that it notifies any government agency, court, or supplier and must provide FDA with a complete set of its tracking records and information.
If a manufacturer or distributor goes out of business and other persons acquire the right to manufacture or distribute the tracked devices, then these other persons become responsible for continuing the tracking responsibilities of the previous manufacturer or distributor.
If a manufacturer or distributor ceases distribution of a tracked device but continues to do other business, then it is still responsible for the tracking of devices that it previously distributed.
Specific Device Issues:
DC Defibrillators Defibrillators are to be tracked to the vehicle, craft or organization that purchased the device. Tracking information does not need to extend to the patient level.
Implants The manufacturer has the responsibility to track the implant through the chain of distribution to the patient and to update the address as necessary. How the manufacturer will update patient information should be specified in its tracking SOP.
Have not use this site for a long time... here are more info from "Guidance for Industry - Medical Device Tracking; Guidance for Industry and FDA Staff", November 17, 2006 that are related to the record retention and acquisition/out of business topics:
Tracking Records:
Tracking records must be maintained for the useful life of the device, even if a patient is lost to follow up.
Does Tracking Ever End? Tracking is no longer required when documentation shows that the device is returned, destroyed, explanted or the patient dies. Refurbishers or remanufacturers of tracked devices that remain in domestic commercial distribution are subject to tracking requirements and should be able to ensure that the original manufacturer can promptly locate the device(s).
(21 CFR 821.2)
A manufacturer, importer, or distributor may request an exemption or variance from tracking in the form of a petition. Petitions need to be submitted in the format explained in section 10.30 of FDA’s regulations.
For devices with an approved PMA that are also subject to a tracking order, the need for continued tracking may be reassessed, at the sponsor’s request or by the agency’s initiative, 10 years from the date of the original PMA’s approval.
Going Out of Business:
(21 CFR 821.1(e))
A manufacturer or distributor that goes out of business is required to notify FDA at the time that it notifies any government agency, court, or supplier and must provide FDA with a complete set of its tracking records and information.
If a manufacturer or distributor goes out of business and other persons acquire the right to manufacture or distribute the tracked devices, then these other persons become responsible for continuing the tracking responsibilities of the previous manufacturer or distributor.
If a manufacturer or distributor ceases distribution of a tracked device but continues to do other business, then it is still responsible for the tracking of devices that it previously distributed.
Specific Device Issues:
DC Defibrillators Defibrillators are to be tracked to the vehicle, craft or organization that purchased the device. Tracking information does not need to extend to the patient level.
Implants The manufacturer has the responsibility to track the implant through the chain of distribution to the patient and to update the address as necessary. How the manufacturer will update patient information should be specified in its tracking SOP.
Q
qmanager2012
We are currently certified to 9001 and 13485. Most of our clients are non-medical clients. My question is can we split our control of records documents for retention? Some clients would only require a minimum of 2 years retention whereas medical clients would require 7 years or the lifetime of the product. I would like to take our existing control of quality records document and for each quality record, identify non-medical and medical. Then be able to list each record requiring retention with 2 retention times, minimum 2 years and then 7 years/lifetime of the product. Has anyone else experienced this? Will we still be compliant if we split these? Any advice would be appreciated. Have a great day!
A
Agochar
Can anyone update this record retention list. I believe EU is 15 years now. Clarification?
M
maaquilino
Found this, which may help; but it's not simply 15 years; it's 15 years after the last product has been manufactured.
(broken link removed)
MDD:
The manufacturer or his
authorised representative must, for a
period ending at least five years, and
in the case of implantable devices at
least 15 years, after the last product
has been manufactured, make
available to the national authorities:
? the declaration of conformity,
? the documentation referred to in
the seventh indent of Section 3.1,
? the changes referred to in Section
3.4,
? the decisions and reports from
the notified body as referred to in the
final indent of Section 3.4 and in
Sections 4.3 and 4.4,
? where appropriate, the certificate
of conformity referred to in Annex III.
AIMD:
Annex 2 section 6.1
For at least 15 years from the last
date of manufacture of the product,
the manufacturer or his authorised
representative shall keep available
for the national authorities:
? the declaration of conformity,
? the documentation referred to in
the second indent of Section 3.1, and
in particular the documentation, data
and records referred to in the second
paragraph of Section 3.2,
? the amendments referred to in
Section 3.4,
? the documentation referred to in
Section 4.2,
? the decisions and reports of the
notified body referred to in Sections
3.4, 4.3, 5.3 and 5.4.
Setting the Medical Device Lifetime
https://www.ombuenterprises.com/LibraryPDFs/Setting_the_Medical_Device_Lifetime.pdf
(broken link removed)
MDD:
The manufacturer or his
authorised representative must, for a
period ending at least five years, and
in the case of implantable devices at
least 15 years, after the last product
has been manufactured, make
available to the national authorities:
? the declaration of conformity,
? the documentation referred to in
the seventh indent of Section 3.1,
? the changes referred to in Section
3.4,
? the decisions and reports from
the notified body as referred to in the
final indent of Section 3.4 and in
Sections 4.3 and 4.4,
? where appropriate, the certificate
of conformity referred to in Annex III.
AIMD:
Annex 2 section 6.1
For at least 15 years from the last
date of manufacture of the product,
the manufacturer or his authorised
representative shall keep available
for the national authorities:
? the declaration of conformity,
? the documentation referred to in
the second indent of Section 3.1, and
in particular the documentation, data
and records referred to in the second
paragraph of Section 3.2,
? the amendments referred to in
Section 3.4,
? the documentation referred to in
Section 4.2,
? the decisions and reports of the
notified body referred to in Sections
3.4, 4.3, 5.3 and 5.4.
Setting the Medical Device Lifetime
https://www.ombuenterprises.com/LibraryPDFs/Setting_the_Medical_Device_Lifetime.pdf
B
biker6977
Re: Lifetime of the Device
I am working on our record retentions times and as I see it- I only need this for RECORDS no work instructions etc. Is this true or do I need it for ALL documents regardless of their nature?
I am working on our record retentions times and as I see it- I only need this for RECORDS no work instructions etc. Is this true or do I need it for ALL documents regardless of their nature?
Jeff Davis
Registered
Re: Lifetime of the Device
It seems that if you follow the references in the MDD referring to the documents types for retention they refer to the documentation relating to the
(6.1) Declaration of conformity
(3.1) Quality System (Quality Manual and SOPs),
(3.2) Technical File (Design Dossier) , DHF, regulatory communications, clinical trials/evaluations, label drafts, IFUs, blood / animal statements, Annex I solutions, etc
(3.4) change notifications,
(4.2) device application to NB,
and other regulatory-type documents.
These need to be kept (from day 1) for the period defined (5 or 15 yrs) after the last manufacturing event of the registered device.
Manufacturing/Operations/Quality records are not part of this requirement and it seems they are covered by the ISO13485 stipulation of longer of 2 years or the expected lifetime of the specific device (or batch).
Anyone else see it this way?
It seems that if you follow the references in the MDD referring to the documents types for retention they refer to the documentation relating to the
(6.1) Declaration of conformity
(3.1) Quality System (Quality Manual and SOPs),
(3.2) Technical File (Design Dossier) , DHF, regulatory communications, clinical trials/evaluations, label drafts, IFUs, blood / animal statements, Annex I solutions, etc
(3.4) change notifications,
(4.2) device application to NB,
and other regulatory-type documents.
These need to be kept (from day 1) for the period defined (5 or 15 yrs) after the last manufacturing event of the registered device.
Manufacturing/Operations/Quality records are not part of this requirement and it seems they are covered by the ISO13485 stipulation of longer of 2 years or the expected lifetime of the specific device (or batch).
Anyone else see it this way?
