Thursday, 22 February 2018

Validation of computerized systems in medical devices

Computerized systems used in the manufacture of medical devices are vital tools in the life cycle of a product, so its validation is essential to ensure the reliability and quality of the process validation of computerized systems in medical devices

Validation of computerized systems in medical devices
Organizations linked to health must comply with rigorous regulations that ensure the quality and reliability of their products. Computerized systems that are used throughout the life cycle of the product (manufacturing, distribution, etc.) are no exception. In the same way that happens with any other critical element in the life cycle of the product, the computerized systems must be validated .

Currently, one of the main regulations affecting the medical devices sector is Regulation (EU) 2017/745 . The standard expresses the following:

"(32) All manufacturers must have a quality management system and a post -market monitoring system , which must be proportionate to the type of risk and the type of medical device in question, in order to ensure that the products manufactured in series continue to be in accordance with the requirements of this Regulation and that the experience gained in the use of the products they manufacture is taken into account for the production process. In addition, in order to minimize risks and prevent incidents related to products, manufacturers must establish a system for risk management and a system to report incidents and corrective safety actions . "

This paragraph defines the aspects that must be taken into account when considering the characteristics and impact of the computerized systems used in the organization.

Regulatory framework for the validation of computerized systems in medical devices
Quality management system
This requirement implies that the organization must comply with the harmonized standard ISO 13485: 2016 . For this, the "validation of the application of computer programs used in the QMS (Quality Management System) " should be pursued .

The organization must document the procedures for the validation of the application of the computer programs used in the QMS . These computer applications must be validated before their initial use, and on each occasion that is appropriate (after any change or update that must be made in said software, for example). The specific focus and initial or subsequent software validation activities must be proportionate to the risk associated with the use of the software or the impact it has on the process, including the effect on the product's ability to meet the specifications.

The same criteria should be used to validate the application of computer programs used in the production and provision of the service.

Post-marketing tracking system
This requirement indicates that the organization must comply with GMPV (Good Pharmacovigilance Practices), which states in Article 6 paragraph h : "Computerized data management systems must be validated ..." . The article establishes a series of requirements that the system must meet, namely:

Have physical security measures to prevent unauthorized access to computer systems.
Arrange logical security measures to prevent unauthorized access to data.
Perform regular backup copies of the data.
Document and validate any migration process to another system.
Detailed records should be stored with respect to each operation (date, time, author, etc.), which enables any subsequent audit task.
A mechanism must be established to control changes in the systems, in such a way that the updates are controlled and this does not affect their validation.
There must be an alternative system that allows data management in case of temporary failure of the main system. This alternative system must guarantee compliance with the legal obligations of pharmacovigilance.
There must be a disaster recovery plan or permanent system failure .
Adequate training should be guaranteed to personnel using computerized systems.
There should be a NTP (standard work procedure) that describes all activities related to computerized systems.
System for risk management
In this case, mechanisms proposed by the ICH Q9 guide can be adopted . Although these guidelines do not establish anything specific in relation to computerized systems, in any way they establish that the scope of the validation depends on the results of a risk analysis.

The risk analysis proposed by ICH Q9 should serve as a guide for:

Evaluate the impact and risks generator if the computerized system works incorrectly.
Define the controls that the computerized system should include.
Improve the operation of the system to avoid the occurrence of such failures, whenever necessary.
System to report incidents and corrective safety actions
As in the case of post-marketing monitoring systems, the "Good Pharmacovigilance Practices" should be used .

General considerations for a correct validation of computerized systems in medical devices
The Regulation (EU) 2017/745 explicitly indicates that the validation of computerized systems is necessary if these systems are critical in a quality management system according to ISO 13485 , or any other process (either design, manufacture or conditioning).

In addition, in Annex I of the regulation ( "General requirements for safety and operation" ), article 3 states that "Manufacturers shall establish, apply, document and maintain a risk management system" . Its clauses define the requirements necessary to establish and document an analysis of risks and control measures during the entire life cycle of the product, in such a way that these risks can be minimized or directly eliminated.

If the manufacturer determines that the computerized system or software that is used is a critical point or a potential risk that compromises the safety of the product or patient , the validation to minimize or eliminate the risk associated with that element is fundamental.

Computer validation in clinical trials

In the pharmaceutical industry, the launch of new drugs that provide benefits for patients and long-term profitability for manufacturers is crucial. And for the medicines to reach the market, clinical trials with people are essential.

Currently, Spain is a world power in conducting clinical trials of innovative medicines . According to figures offered by pharma industry , investment in pharmaceutical R & D grew by 8% in Spain in 2016 , which represented the largest increase since 2008. The resources allocated to research and development reached 1,085 million euros , the historical maximum of the sector.

And most of the investment in R & D is for research projects developed in collaboration with hospitals and research centers . That is, the investment of pharmaceutical companies in clinical trials does not stop growing and the success of each clinical trial also depends on their profitability ( Tufts University estimated in 2014 that the investment for each drug that reaches the market can reach 2,120 million of euros).

Despite the investment figures, only a small percentage of clinical trials progress towards commercialization after passing all phases of the project , which includes the inspection of the manufacturer's facilities and the assurance that the quality system complies with the GMP ( Good Manufacturing practices).

Therefore, it is essential for the sector to maintain correct clinical practices in clinical trial studies. These good practices include the validation of the computerized systems used and the integrity of the data .

Computer validation in clinical trials
The Guideline for Good Clinical Practice (GCP) is a guide to good practices for clinical trials based on standards for the design, conduct, performance, monitoring, auditing, recording, analysis and reporting of clinical trials that provide assurance that data and the results reported are credible and accurate, and that the rights, integrity and confidentiality of the test subjects are protected.

In December 2016, the European Medicines Agency (EMA) published the new version of the GCP: ICH guide E6 (R2). In this version of the GCP, which aims to provide a unified standard for the European Union (EU), Japan and the United States to facilitate mutual acceptance of clinical data by regulatory authorities in these jurisdictions, sections are included that They refer to the integrity of data and the validation of computerized systems as good practices to follow in clinical trials.

Particularly, in section 5.5 " Trial Management, data handling and record keeping " we can highlight the following recommendations:

The sponsor must use appropriately qualified people to supervise the overall conduct of the trial, manage and verify the data, perform statistical analyzes and prepare the trial reports.
The sponsor may consider establishing an independent data monitoring committee (IDMC) to evaluate the progress of a clinical trial, including safety data and critical criteria of efficacy at intervals. The IDMC should recommend to the sponsor if a trial should be continued, modified or stopped.
When using electronic systems for data management, the sponsor should:
Ensure and document that electronic data processing systems meet the established requirements of the sponsor in terms of integrity, accuracy, reliability and expected performance (ie, computer validation in clinical trials).
The sponsor should base computer validation on clinical trials of such systems in a risk assessment that takes into account the intended use of the system and the potential of the system to affect the protection of the human subject and the reliability of the test results.
The standard operating procedures (SOP) must cover the installation, configuration and use of the system, as well as describe the computer validation in clinical trials of the system and functionality testing, data collection and management, system maintenance, security measures of the system, change control, data backup, recovery, contingency planning and dismantling. The responsibilities of the sponsor, researcher and other parties with respect to the use of these computerized systems must be clear, and users must receive training in their use.
Make sure that the systems are designed to allow changes in the data in such a way that the modifications made to the data are documented and that the information entered is not eliminated (that is, keeping an audit trail).
Maintain a security system that prevents unauthorized access to data, as well as maintain a list of people who are authorized to make changes to the data.
Maintain an adequate backup of the data.
Ensure the integrity of the data, including data that describes the context, content and structure. This is particularly important when changes are made to computerized systems, such as software updates or data migration.
If the data is transformed during processing, it should always be possible to compare the original data and the observations with the processed data.
The sponsor must use an unambiguous subject identification code that allows the identification of all the data reported by each subject.
The sponsor or other owners of the data must keep all essential documents specific to the sponsor belonging to the trial.
The sponsor must retain all specific essential documents in accordance with the applicable regulatory requirements of the countries where the product is approved and / or when the sponsor intends to request approval.
If the sponsor interrupts the clinical development of an investigational product (ie, for any or all indications, routes of administration or dosage forms), the sponsor must maintain all specific essential documents for at least 2 years after the interruption. formally or in accordance with regulatory requirements.
If the sponsor interrupts the clinical development of a product under investigation, the sponsor must notify all investigators / institutions participating in the trial and all regulatory authorities.
Any transfer of ownership of the data must be reported to the appropriate authorities, as required by the applicable regulatory requirements.
The essential documents specific to the sponsor must be kept until at least 2 years after the last approval of a marketing application in an ICH region and until there are no pending or contemplated marketing applications in an ICH region or at least 2 years have elapsed since the formal suspension of the clinical development of the product under investigation. However, these documents must be retained for a longer period if required by the applicable regulatory requirements or if the sponsor needs it.
The sponsor must inform researchers / institutions in writing of the need to retain records and when records related to trials are no longer needed.