Quality Innovations: A Software Prescription for FDA Compliance

For medical device manufacturers, a new SPC program maybe just what the doctor ordered.

New electronic signature requirements for medical device manufacturers have led to the release of a number of new software packages, including the release of a statistical process control (SPC) package that meets the standard while offering statistical analysis and enhanced lot geneology.

Medical device manufacturers are working to comply with the Food and Drug Administration's (FDA) standard, 21 CFR Part 11. Part 11 applies to records in electronic form that are created, modified, maintained, archived, retrieved or transmitted, and it also applies to electronic records submitted to the FDA.

InfinityQS SPC 2004 from InfinityQS International (Fairfax, VA), an upgrade of its 2002 version, is meant to satisfy the 21 CFR Part 11 regulation while giving users more analytical power. Electronic signature functions range from password aging to encryption, key parameters for any Part 11-compliant software, but SPC 2004 also features several new enhancements including complete lot traceability and statistical reporting.

The software's Lot Genealogy Track-ing and Reporting module provides traceability of all component and final finished-goods lot numbers and combines this information with complete lot summary statistical analysis. Reporting includes bottom-up reports for component lots and top-down reports for finished goods lots. For example, users may wish to determine what materials were used to produce a particular lot of finished dialysis machines (top-down) or investigate the finished lots that were created from a particular lot of incoming material (bottom-up).

Steve Wise, director of sales and marketing for InfinityQS, says the software goes beyond lot tracking, which typically tracks work-in-process as a piece goes through various operational steps.

"Component lots are consumed to produce other lots of products," Wise says. "A simple example is a chocolate chip cookie. Sugar is brought in and tested. After we know that the sugar is good, then we can release that sugar lot to the floor for component use.

"As the lots are being consumed and closed, Infinity will generate summary statistics of all the test characters associated with those lots and component lots," Wise adds. "Not only can you get the genealogy from the top down, where you have the finished component that you ship to the market and can then find all of the component lots that went into that chocolate chip cookie, but you can get information from the bottom up and get all the summary statistics about each component that went into the product."

The ability to pinpoint the individual components that went into a value-added part, be it a chocolate chip cookie or a heart valve, could potentially save vast amounts of money by allowing the manufacturer to do a targeted recall if one were necessary.

While the software has functionality that is meant to appeal to medical device manufacturers, Wise says an automaker touring a trade show was also impressed. "If the automaker had 155 bad components, they would have to recall 2,500 cars because they wouldn't be able to pinpoint which car the bad part went into," he says. "With this system, they can go right to the VIN (vehicle identification number) and recall just those cars that they need to."

Controlling Access

The software can control access to data and track changes.

The Strict Access Control feature supports all the requirements of 21 CFR Part 11 including Password Aging, Recycling, Lockouts, Length and Encryption.

The Automatic Security Violation Logs track and report security violations by individual users and their location.

Automatic Access Logs track individual user access into and out of applications.

The software features Automatic Audit Trail Logging that provides a history of all changes made to any database item including sample data, limits and alarm rules. It also features Special Reporting Options that include Change History, Metadata, Specification and Control Limit outputs.

The module, Change History and Reason for Change Tracking and Reporting, supports FDA's 21 CFR Part 11 regulatory requirements and is based on security and traceability principles that must be part of all compliant quality systems. This module asks the who, what, when, where and why to any change within the quality system database.

"When someone logs into Infinity," Wise says, "everything that occurs within the system, any changes that are made to the data, any new data or database items that are added to the system is noted. Whoever is logged into the system is tagged to those transactions."

Wise adds that users can set authorization and sign in requirements as needed. "Not only can you force people to sign in when they log in, but you can dictate when certain sign-ins are required. For example, beginning at every new data add, we can force someone to sign in and we force a sign in before any changes are saved.

"Also, the person who is doing the assembly of the medical device may not have authority to make a change, and so they have to have a lead person come by and review the values in the data-entry window and approve the change. The supervisor's name also gets tagged to the subgroups," Wise adds.

The software also allows users to track why a change was made. "There are two ways of doing this," Wise says. "There is a dropdown list with reasons for change that they can pick from and these can then be sorted, analyzed and Pareto charts run. Also, they are forced to type in their own free-form notes, which is part of Part 11 compliance."

These applications led one of the five biggest manufacturers of medical instruments to purchase 1,500 licenses of InfinityQS's SPC solutions suite.

The company, whose identity was not released, has implemented the software at several plants in the United States and corporate-wide implementation of the software is planned.

The manufacturer will deploy InfinityQS on its shop floors to collect data on its medical devices, troubleshoot problems on those devices, and identify causes and corrective actions.