| JOURNAL HOME | CME HOME | THIS MONTH | PAST ISSUES | ETOC | COLLECTIONS |
| AUTHORS | REVIEWERS | EDITORIAL BOARD | FEEDBACK | RSS | HELP |
 
|
|
|
||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 |
Abstract |
|---|
 Top Abstract IntroductionMEDICAL DEVICES AND REGULATORY...REGULATORY PROCESS AND STANDARDS...ACCURACY AND CALIBRATIONRESPONSE TIMEPROTECTIVE MEASURES--ALARMS AND...CONCLUSIONSREFERENCES |
|---|
Developing safe and effective medical devices involves understanding the hazardous situations that can arise in clinical practice and implementing appropriate risk control measures. The hazardous situations may have their roots in the design or in the use of the device. Risk control measures may be engineering or clinically based. A multidisciplinary team of engineers and clinicians is needed to fully identify and assess the risks and implement and evaluate the effectiveness of the control measures. In this paper, I use three issues, calibration/accuracy, response time, and protective measures/alarms, to highlight the contributions of these groups. This important information is captured in standards and regulatory tools to control risk for respiratory gas monitors and pulse oximeters. This paper begins with a discussion of the framework of safety, explaining how voluntary standards and regulatory tools work. The discussion is followed by an examination of how engineering and clinical knowledge are used to support the assurance of safety.
|
Introduction |
|---|
|
TopAbstractIntroductionMEDICAL DEVICES AND REGULATORY...REGULATORY PROCESS AND STANDARDS...ACCURACY AND CALIBRATIONRESPONSE TIMEPROTECTIVE MEASURES--ALARMS AND...CONCLUSIONSREFERENCES |
|---|
Effective risk control measures in medical devices should be implemented with an understanding of the underlying hazardous situations gained by an evaluation of the root causes. These situations can best be identified and analyzed by a multidisciplinary team of experts consisting of engineers and clinicians. Engineers are needed to focus on the device implementation from a mechanical, electrical, or software perspective, identifying how the device can fail and what are its performance limitations. Clinicians focus on the impact of using the device on the patient and addressing the adequacy of the use instructions, predict unanticipated situations, and describe the boundaries of appropriate use (foreseeable misuse). When medical device safety standards are written (1,2), the standards development organization must ensure a balanced and diversified working group in order that all these viewpoints are represented. Further, they incorporate past efforts to identify and control risks, so that their efforts are comprehensive and control measures are as effective as possible. Regulators also use a multidisciplinary team to understand a manufacturer's design and assess the risk implications of their design decisions. It should be obvious that manufacturers should have a complimentary multidisciplinary design team in place to assure safety is addressed early and often in the development lifecycle.
This paper demonstrates how the root causes of hazardous situations might be found in the engineering or clinical realms, hence the need for multidisciplinary team participation in the risk management activities. Two device types are examined, respiratory gas monitors (RGMs) and pulse oximeters, with safety issues such as calibration and accuracy, response time, and protective measures to demonstrate the need for both engineers and clinicians to identify and solve the problems. Before examining these hazardous situations and how they were identified and controlled, I will present some background on the regulatory and standards processes, the underlying safety standards framework, and how this framework is used in supporting safety.
|
MEDICAL DEVICES AND REGULATORY PROCESSES FOR ASSURING SAFETY |
|---|
|
TopAbstractIntroductionMEDICAL DEVICES AND REGULATORY...REGULATORY PROCESS AND STANDARDS...ACCURACY AND CALIBRATIONRESPONSE TIMEPROTECTIVE MEASURES--ALARMS AND...CONCLUSIONSREFERENCES |
|---|
Many activities are needed throughout a product's lifecycle to bring a medical device to market. Regulatory and standards processes leverage the existing engineering and clinical knowledge bases to achieve reasonably safe and effective products. Two activities are considered necessary for assuring the safety of the basic design: assessing the device's basic safety and essential performance, and having an adequate design process that can identify hazardous situations and control the risks associated with those hazards. Regulators, manufacturers, and clinicians recognized the need for a general family of standards (1) to address the overall safety of medical electrical (ME) equipment; thus, the International Electrotechnical Commission (IEC) 60601 family was born to establish a minimum set of safety criteria for use by device developers and regulators.
The traditional model for assuring safety of ME equipment, as embodied in the first and second editions of IEC 60601, was to address basic safety, unintended physical hazards such as electric leakage, mechanical pinching, scalding surfaces, and material toxicity. The hazardous situations addressed by the General Standard second edition did not include clinical performance; ME equipment that did not work or function as clinically intended was to be addressed by standards particular to each device. The definition of hazard in the third Edition of IEC 60601 was expanded to include functional safety, protection against malfunctions such as incorrect outputs, abnormal operation, fault conditions, and inaccurate operating data (3).
Regulators and standards writers worldwide understood that adequate risk mitigation could not be defined a priori for every situation, no matter the expertise of the multidisciplinary group working on it. A robust risk management process was identified as an essential element of medical device development. Device-specific standards writers were instructed to address the essential performance necessary to achieve freedom from unacceptable risk. Although basic safety typically has defined acceptance criteria (for e.g., a 41°C safe temperature limit for a sensor intended to contact the patient), essential performance requires a judgment as to what constitutes unacceptable risk. This judgment is made in the context of the risk management process where a multidisciplinary team is needed to comprehensively identify and evaluate risks. As the world makes the transition from the second to the third edition of IEC 60601, those involved in the development of ME equipment should understand that the third edition has provisions for assessing both the adequacy of the design and the design process.
The third edition of IEC 60601 sets up a safety framework by requiring manufacturers to systematically assess, using an International Organization for Standardization (ISO) 14971 (4) compliant risk management process, the reasonably foreseeable risks and develop mitigations that control risk to an acceptable level for the expected life of the ME equipment. The risk control framework consists of an integrated approach in which the manufacturer uses one or more of the following in the priority listed:
- inherent safety by design
- fault-tolerant measures (5)
- protective measures in the equipment
- information for safety (i.e., labeling, for example, warnings and instructions for use, limits on acceptable values of monitored variables).
|
REGULATORY PROCESS AND STANDARDS USE |
|---|
|
TopAbstractIntroductionMEDICAL DEVICES AND REGULATORY...REGULATORY PROCESS AND STANDARDS...ACCURACY AND CALIBRATIONRESPONSE TIMEPROTECTIVE MEASURES--ALARMS AND...CONCLUSIONSREFERENCES |
|---|
The uses of standards differ by the jurisdictional authority under which the medical device is sold. For example, the Food and Drug Administration (FDA) "recognizes" standards that are suitable for use in premarket submissions, a recognized standard is an accepted method of risk control for a particular hazardous situation. The FDA process evaluates risk based on the intended use, the use environment, indications for use, and the functions and performance of the medical device. The evaluation includes protective devices and alarm systems, functional limits and any operational or special features. The evaluation addresses whether reasonable hazards and risk control measures were identified, and evidence that these were successfully implemented and effective. Standards are developed in much the same way and are used extensively in other regulatory systems, such as the European Economic Area.
The process in the European Economic Area relies on a series of Medical Device Directives that contains Essential Requirements, a list of identified hazardous situations, with which equipment is required to comply. Conformance to harmonized standards (standards built to address this list of hazardous situations), in combination with a quality system (as embodied by ISO 13485) (6), for all but the lowest risk medical devices, can be used to demonstrate conformance to the essential requirements. A medical device fully compliant with the relevant harmonized standards is presumed to comply with the essential requirements, and therefore safe for market—as safe and complete as the standards the assessment is built upon.
We are therefore provided with a comprehensive standards framework and a requirement that risk management be performed to assure basic safety and safe clinical operation. How does this translate into actual practice? Devices that monitor respiration and ventilation (oxygen and CO2) whether in expired/inspired gases or in tissue through electrochemical or optical means, are medical devices classified as ME equipment by the IEC, ISO, and by regulatory authorities. The FDA recognizes several standards for use in assuring the safety and performance of RGMs and pulse oximeters:
- ISO 21647 for RGMs
- IEC 60601-2-23: Particular requirements for the safety of transcutaneous partial pressure monitoring equipment, and IEC 60601-3-1: Essential Performance Requirements for Transcutaneous Oxygen and Carbon Dioxide Partial Pressure Monitoring Equipment for transcutaneous monitors
- ISO 9919: Safety of Pulse Oximeters.
Let's see how these safety critical hazardous situations as embodied in these standards were evaluated using a multidisciplinary approach.
|
ACCURACY AND CALIBRATION |
|---|
|
TopAbstractIntroductionMEDICAL DEVICES AND REGULATORY...REGULATORY PROCESS AND STANDARDS...ACCURACY AND CALIBRATIONRESPONSE TIMEPROTECTIVE MEASURES--ALARMS AND...CONCLUSIONSREFERENCES |
|---|
Accuracy, and its assurance through proper calibration, are primary contributors to the safety of ME equipment and are functions on the explicit configuration of the monitor. How much accuracy is needed is a clinical decision; how to deliver this amount of accuracy is an engineering decision; how to assess the delivered performance requires both engineers and clinicians. For example, the FDA's guidance document on pulse oximeters (www.fda.gov) asks the manufacturer to describe the available accessories (sensors, patient cables, etc.), identify the sensor-monitor combinations, and show the validation evidence for each combination. Where an engineering argument can be made that the same electro-optical configuration, materials, and algorithm are used or that there are data to show that the different sensor-monitor combinations perform equivalently, the manufacturer can use one set of data to represent the group of similar construction. As each configuration may have a different use profile, the perspective of the engineer and clinician are needed to understand the configurations and determine if the validation data are applicable.
Accuracy specifications need to be appropriately reported, so that clinicians can understand the performance of the devices they use and assess the relative performance against others monitors. The accuracy specification for clinical purposes for pulse oximeters should be reported using the single statistic, Arms, or root mean square accuracy (defined in ISO 9919). It is meant to convey the performance of the oximeter system to the clinician over the broad range of operation of the device. A large uncertainty (poor accuracy) can mean lower than indicated saturation, which, for some patients, can be a hazardous situation. Both the ISO/IEC standards and FDA guidance documents establish limits on accuracy and contain additional recommendations on clinical performance. ISO 9919 cites a recommended calibration protocol in an informative annex, which is referenced during FDA marketing clearance. Accuracy verification (saturation) requires data from ideal laboratory testing to demonstrate the performance of the oximeter (sensor and monitor combination) from at least 70% to 100% Spo2 in human subjects. These protocols are explained in ISO 9919, Appendix EE, and were developed by engineers and clinicians over time to reliably and safely evaluate the performance of oximeters.
An accuracy specification is not always indicative of performance over the entire clinical range or use population. Low saturation accuracy is typically of higher uncertainty than higher saturation values. Having bias and precision over each decade of operation would provide greater detail on the performance of the device and make objective comparison (which is both an engineering and clinical activity) to other monitors more meaningful than a single statistic. In other instances, it is not possible to get evidence of accuracy over the entire clinical range needed. Oximeters are the standard of care for neonatal monitoring, yet it is recognized that desaturation studies to obtain calibration data cannot be ethically performed. To get an indication of performance in this population, both adult performance and observed performance on neonates should be reported. Observed performance can be samples collected for convenience when a needed procedure is medically indicated.
In contrast to pulse oximeters, RGM performance can be evaluated on the bench. Engineering bench testing is sufficient in many cases to assess accuracy in RGMs, where demonstration of functional performance and proper calibration procedures are essential for assuring safe operation and identifying hazardous clinical situations. Bench testing would identify an inaccurate RGM within an anesthesia machine that has an incompetent inspiratory or expiratory valve, permitting a dangerous accumulation of CO2 within the breathing circuit. The performance of the RGM in the presence of interfering gas and vapors (such as alcohol and water vapor) can be safely considered. The composition of respiratory gases is not just oxygen, nitrogen, and carbon dioxide; many gases and substances could, depending on their concentration and the method of measurement, alter the displayed value. The RGM standard provides a table of known interfering gases and vapors to be tested. Diverting or side-stream RGMs are especially susceptible to interference by water. It is important for the user documentation to clearly indicate which gases and vapors are intended for use. This disclosure is then used to guide the evaluation of the monitor, i.e., with which interfering gases and vapors the monitor needs to be tested.
Accuracy in the field, when the monitor is in actual clinical use, also needs to be maintained. RGMs are almost always provided with a factory calibration. The need for a recalibration depends upon the specifics of the monitor design. RGMs, in particular, capnographs, often recommend a periodic calibration or check that consists of exposing the sensor to room air with an assumed oxygen and carbon dioxide concentration. Care must be taken when performing such a check or calibration, since the failure to remove the sensor from a patient-connected breathing circuit can result in an offset in the gas values reported post-recalibration. Thus, the clinician and engineer must talk to each other to understand what must be done to calibrate and how it can be safely done in the patient environment.
In contrast to the RGM calibration procedure, pulse oximeters rely on the calibration curve developed using previously validated controlled desaturation tests. Oximeters cannot be field calibrated nor can their accuracy be field checked as there is no simulator that has been validated for such a purpose. Yet they can be functionally assessed by placing the probe on a healthy human to make sure all the electronic components work. Accuracy verification for pulse rate in pulse oximeters can rely on a simulator as long as it spans the operating range; it is essentially a functional verification of the waveform detecting algorithm.
Functional simulators are useful to assess engineering performance, as when the harshness of reprocessing activities on single-use sensors adversely affects sensor performance, bringing into question whether the original electromagnetic compatibility and basic safety (e.g., shock, vibration, fire, fluid ingress) evidence is still valid. Other functional aspects of reprocessed devices are best evaluated with a simulator to allow reproducible test conditions to be established and maintained.
|
RESPONSE TIME |
|---|
|
TopAbstractIntroductionMEDICAL DEVICES AND REGULATORY...REGULATORY PROCESS AND STANDARDS...ACCURACY AND CALIBRATIONRESPONSE TIMEPROTECTIVE MEASURES--ALARMS AND...CONCLUSIONSREFERENCES |
|---|
The shrinking of electronic circuitry is enabling greater integration and increased use of wireless communications, leading to an increased need to understand electromagnetic compatibility issues [see IEC 60601-1-2 (7)]. Interference can cause lockup, resulting in conditions where unwanted energy is delivered to the patient or unknown errors occur in the measurement value. In monitors with patient-connected sensors, the ME equipment must be assessed for compatibility and designed in a fault-tolerant way, so that even if lockup or a fault occurs, the amount of energy is limited to safe levels. Being patient-connected, there is a high probability that oximeters and RGMs are used in a stack of other monitors, and therefore not only must they be hardened against interference, they must control their own emissions. Compatibility encompasses not being susceptible to, and not generating interference in, other ME equipment.
Powerful microprocessors have enabled complex software algorithms to see through the physiologic and environmental noise, both for managing alarm systems and for decision making. As the complexity rises, the ability to produce quality software requires integration between the engineer developing the algorithms and the clinicians specifying what physiologic condition the algorithms are meant to detect. Software with this degree of complexity is best developed in an organized, methodical manner that includes a documented development process, and one where the artifacts generated by the process reflect the decisions made. IEC 62304 (8) identifies life cycle processes appropriate for developing software-based medical devices.
Understanding a monitor's response time specification requires an understanding of what that response time represents. As with all physiological systems, the response to changes is not instantaneous but consists of a delay time and a rise time (e.g., as with a change in delivered inspired oxygen concentration and the resulting change in measured Spo2 at a peripheral site such as the finger). Similarly, monitors have their own inherent response time. The response time of a monitor is typically a function of both hardware and software considerations and constraints. In oximeters, an insufficient response time might cause rapid short-lived hypoxic episodes to go undetected. An insufficient response time in a CO2 monitor could result in a value closer to the average exhaled concentration and not the plateau being reported as an end-tidal value.
In a fluid-measurement monitor such as a RGM, delay time (sometimes called "lag" or "transit" time) depends on sampling flow rate, diameter and length of sampling tube, and sample viscosity. Delay time is negligible for nondiverting RGMs, whereas for diverting RGMs, it could be clinically relevant. ISO 21647 creates a single method for defining total system response time, the time from the step function change in gas levels at the sampling site to achieve 90% of a final gas reading, thus allowing performance comparison between monitors.
|
PROTECTIVE MEASURES—ALARMS AND LABELING |
|---|
|
TopAbstractIntroductionMEDICAL DEVICES AND REGULATORY...REGULATORY PROCESS AND STANDARDS...ACCURACY AND CALIBRATIONRESPONSE TIMEPROTECTIVE MEASURES--ALARMS AND...CONCLUSIONSREFERENCES |
|---|
Understanding response time and detection time are essential for safely implementing alarms systems, since the total time to generate alarm signals is a function of both. The pulse oximeter and RGM standards detail methods for assessing response time. Alarm system response, including alarm signal generation, is an important feature for engineers to adequately explain, so that clinicians understand how to operate and interpret the alarm signals, especially as there might be multiple analysis engines operating in parallel. Both groups need to contribute to establish safe alarm limit defaults and alarm condition priorities. Clinicians need to establish clinically relevant alarm limits, and engineers need to insure that the alarm limits are realistic from the perspective of the ME equipment. For example, the default low Spo2 alarm limit for pulse oximeters was decreased from 90% to 85% in the most recent version of ISO 9919 due in part to the trade-off between patient protection, false-positive alarm conditions, and ease of use (see rationale to subclause in AA.201.5.4 of ISO 9919). ISO 21647 notes that for each monitored respiratory gas, the monitor shall provide a means to detect alarm conditions with a minimum priority specified. The only high-priority alarm condition listed is for when the fraction of inspired O2 is <18%. This could be life-threatening and can be caused by a mechanical failure, since this occurrence is usually not the result of a clinical intervention. Alarm systems are a major category of risk control measures and have such importance that an entire standard, IEC 60601-1-8 (9), addresses their safe use.
Where a hazard cannot be designed out or protective measures devised to reduce risk to an acceptable level, the residual risk needs to be conveyed in labeling. Labeling must also explain the proper use of the equipment with an explanation of the accuracy, response time, and alarm. Placement and clarity of labeling is often the last thing to be addressed during development, and therefore may suffer from a lack of human factor considerations (10).
A clinician should know the capabilities of the monitor being used; hence, the important performance characteristics should be reported in clear language and located in a place that is accessible. The accuracy, sensor specifications, patient population, instructions for use, warning, and contraindications are all important elements that must be in the labeling. If oximeter accuracy range could vary by population, selected monitoring site, or skin pigmentation, then this important information must be clearly indicated. If it is determined that there are limitations on the application time or the response time of the monitor, these should be reported in the labeling with sufficient detail that the clinician can understand how to make use of the monitor outside of ideal conditions.
A confusing labeling situation arises for reprocessed single-use sensors where both the original manufacturer and the reprocessor can have visible labels. It is essential that users understand that the performance of reprocessed sensors might be different from that of the original sensor. Reprocessors must demonstrate that they meet their performance specifications after the maximum stated number of cleaning cycles. Hence, there must be a way to track the number of cycles. The only way to do this is through labeling, placing the label where it has a chance of being read.
|
CONCLUSIONS |
|---|
|
TopAbstractIntroductionMEDICAL DEVICES AND REGULATORY...REGULATORY PROCESS AND STANDARDS...ACCURACY AND CALIBRATIONRESPONSE TIMEPROTECTIVE MEASURES--ALARMS AND...CONCLUSIONSREFERENCES |
|---|
ME equipment for monitoring oxygenation, ventilation, or physiologic vital sign indicators of these processes are complex and have great potential for improving health care. However, this equipment must be properly designed from the start to be safe and effective. Manufacturers must pay attention to identifying appropriate hazardous situations and establishing effective risk control measures. This must involve both clinicians and engineers throughout the risk management activities in the product lifecycle. Regulators and standards writers blend the concerns and expertise of both engineers and clinicians to produce more refined, safe, and clinically useful assessment and assurance tools. A multidisciplinary team approach is an essential element of a safe medical device.
|
Footnotes |
|---|
Accepted for publication May 7, 2007.
Address correspondence and reprint request to Sandy Weininger, PhD, Division of Electronics and Software Engineering, Center for Devices and Radiological Health, Food and Drug Administration, 10903 NH Avenue, WO62-4212, Silver Spring, MD 20993-0002. Address e-mail to sandy.weininger{at}fda.hhs.gov.
|
REFERENCES |
|---|
|
TopAbstractIntroductionMEDICAL DEVICES AND REGULATORY...REGULATORY PROCESS AND STANDARDS...ACCURACY AND CALIBRATIONRESPONSE TIMEPROTECTIVE MEASURES--ALARMS AND...CONCLUSIONSREFERENCES |
|---|
- IEC 60513. Fundamental aspects of safety standards for medical electrical equipment, 1994
- ISO/TR 16142. Guidance on the selection of standards in support of recognized essential principles of safety and performance of medical devices, 2006
- Osborn D, Weininger S. IEEE PSES Symposium Proceedings. Santa Clara, CA, August 13–15, 2004
- ISO 14971. Medical device risk management
- Jones PL, Jorgens J III, Taylor AR Jr, Weber M. Risk management in the design of medical device software systems. Biomed Instrum Technol 2002;36:237–66[Medline]
- ISO 13485. Quality management systems—requirements for regulatory purposes, 2003
- IEC 60601-1-2. Medical electrical equipment—Parts 1–2: General requirements for safety—collateral standard: electromagnetic compatibility—requirements and tests
- IEC 62304. Medical device software—Software life cycle processes
- IEC 60601-1-8. Medical electrical equipment—Parts 1–8: General requirements for safety—collateral standard: general requirements, tests and guidance for alarm systems in medical electrical equipment and medical electrical systems
- IEC 60601-1-6. Medical electrical equipment—Parts 1–6: General requirements for safety—collateral standard: usability
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
