Regulatory agencies such as the Food and Drug Administration continue to aggressively modernize regulations and increase expectations for tangible quality controls in the medical-device industry. The FDA has developed increasingly stronger mandates to ensure that medical device manufacturers are accountable for properly investigating and resolving complaints. Manufacturers must have stringent processes and procedures in place to investigate, report, and resolve the complaints.

In addition, solving pre and post-market device problems with piecemeal fixes is no longer a viable option with today's quality system regulations (QSR). It is not sufficient to just fix a problem, it is critical for firms to examine their entire system to find the root cause of the problem, and refine system controls to proactively prevent the problem from happening again. The issue escalates when it involves devices that are life supporting or those referred to as Class II and Class III.

The discovery of a public health risk by the FDA will result in recalls, negative publicity, and threat of wider actions. Such problems can threaten the viability of any device manufacturer.

Definitions for quality, such as ensuring consistency and product safety, require that device companies use dependable data-management systems with capabilities for data validation, process automation, integrated reporting, and elaborate security. A centralized, electronic system gives organizations a single tool to handle all quality and compliance related events. Hence, they are often called quality-management systems or QMS.

While many companies are implementing electronic methods for managing data, more foresightful medical-device companies recognize that a QMS program should include some way to automate manual and error-prone processes. The good news is that today's state-of-the-art QMS does more than record data. It can actually enforce a company's standard operating procedures (SOPs), identify problem areas, and proactively monitor and manage trends. This introduction to QMS tells what some device companies are doing to transform their tracking systems into proactive quality management systems.

What can a QMS do?

Over the past few years, medical-device companies along with pharmaceutical and biotech firms have been specifying management systems that more completely manage all quality events and actions. Legacy systems have been paper-based or a mix of electronic tools such as word-processing documents, spreadsheets, disparate databases, and customized homegrown solutions. But these just generated islands of information. A centralized system, however, provides advantages such as consolidation of data, business processes that work together, simplified reporting, and reduced maintenance costs.

Such an enterprise, a web-based QMS supported by a centralized IT infrastructure, gives users — regardless of location —access to relevant and up-to-date quality information. Quality information represents, as a whole, any supporting data that relates to the detection, investigation, analysis, reporting, and resolution of a compliance-related problem.

The system lets users conduct narrow to broad searches across sites and inspection processes based on their permissions. The system enables users to conduct free-text searches across all data fields, including attached files. Automated workflows are more likely than a busy line operator to perform actions and SOPs (for instance, an inspection that records a fluid level) that influence perceptions of quality.

In addition, an enterprise QMS lets users search information related to quality issues. Examples include integrated reporting tools that organize fetched information into a variety of report formats, such as graphs, charts, tabular, and drill-down lists. Furthermore, reports may be e-mailed, printed, and exported to Microsoft-Office formats, as well as PDF, RTF, and CSV files.

Tracking, searching, and reporting on events of interest are a few basic requirements of a QMS. Since adopting the concept, companies have been demanding more from their systems, pushing their operations envelope so they become proactive instead of simply reactive. Common questions regarding the technology include how can a QMS:

• Proactively enforce our business rules?

• Eliminate errors in data entry?

• Ensure meeting timelines?

• Proactively deliver critical information to end-users?

• Proactively detect and report trends?

Answers indicate that a QM system cannot rely solely on user input. A business-rules engine is needed to enforce consistency, ensure compliance with SOPs, and achieve timely results. A dynamic and configurable business-rules engine performs actions to enforce SOPs on an ongoing basis. The three accompanying scenarios come from real companies to show what an always-on or 24/7 business-rules engine can do and how its action influences perceptions of quality.

Think proactively

The complexity of medical devices and the influence of international organizations that write standards make a 24/7 business-rules engine a necessity. Asking busy line workers to accurately enter data that can influence the course of company is asking a lot. Their data entry operations should be performed automatically. Furthermore, letting the rules engine make decisions is the only secure way to comply with sometimes complex SOPs and reduce regulatory risk. Finally, implementing SOPs in an automated fashion reduces costs by reducing the required amount of employee training, as well as by reducing manual labor and missed opportunities resulting from error-correction efforts.

Scenario 1: Enforcing business rules

A company manages product complaints using its QMS. Its SOPs dictate that complaints classified as normal must be closed within 30 days, and those classified as serious in 14 days. In addition, complaints for a particular product must be assigned to a particular QA manager. And if a decision tree (implemented as part of the QMS) determines that the event is adverse, a Vigilance Report must be generated and submitted to various health authorities based on where the product was manufactured and where the event occurred.

The business-rules engine in the QMS will perform the following actions to address such requirements:

• Automatically set the due-date to either 30 or 14 days based on severity

• Set the assigned-to person based on the selected product

• Generate a vigilance-report record after identifying an adverse event, advance the workflow for approval, and email a PDF copy to a distribution list in the product-safety group.

The advantage of the scenario is that it requires little human intervention. The business-rules engine ensures compliance with SOPs and initiates immediate action on serious matters.

Scenario 2: Notifications and escalations

A company manages nonconformance records (NCRs) and related CAPAs using its QMS. Company procedures state that at least one corrective action is required for each NCR. These are classified as serious and expect a 14-day response. The quality manager must also be notified if not completed on time. Furthermore, notify the plant manager if a corrective action is not completed within ten days after the 14.

To address these requirements, the business-rules engine will:

• Create a corrective-action file if the severity is set to “serious”

• Assign the corrective action to the appropriate person

• Issue a notification to the quality manager if the NCR has not been closed within 14 days

• In the event the corrective action is not completed by the given due-date, issue a notification, or generate a past-due report to the quality manager, or do both.

• Should an additional ten days pass and the corrective action is still not complete, issue a notification, or generate a past-due report to the plant manager, or do both.

The business-rules engine enforces SOPs by creating the corrective action when required and ensuring visibility of all important dates.

Scenario 3: Track trends, then generate and distribute reports

A device manufacturer has ten manufacturing and service centers around the world. Its QMS manages CAPAs resulting from complaints, NCRs, and audits. As expected, several groups in the organization have different business needs.

This company's rules say that members of the quality-assurance department must be informed of particular events due in the coming week. Quality managers are interested in biweekly trends for workload distribution among their team members, while site managers are interested in monthly distribution of CAPAs originating from various sources from within their sites. In addition, corporate leaders are interested in quarterly CAPA trends and statistical comparisons across sites in their organization. Quality managers must be notified when more than ten NCRs have been created at their site for a given product or component within a 30-day period. Moreover, if there have been more than 20 NCRs for a given component or part across all sites, the corporate QA department must be notified, and initiate an investigation to study this trend.

The business-rules engine automates these needs by performing the following actions:

• E-mail a tabular report in PDF format each Monday morning to QA members, detailing complaints assigned to them that must be completed by week's end.

• E-mail biweekly reports to quality managers detailing workload distribution among their team members, thereby letting them address potential bottlenecks or foreseeable delays.

• E-mail monthly reports to site managers to help identify problem areas and preempt deterioration in such cases.

• E-mail quarterly reports that compare quality issues across sites to corporate quality managers, thereby ensuring that effective quality improvement is shared on a global level.

• After entering the tenth NCR for a given product within a 30-day period, send notification to quality managers with a report detailing the NCRs.

• When the twentieth NCR for a given product is entered for any site, notify corporate QA and create and assign an investigation record to track and identify the trend's root cause.

The engine executing these business rules ensures proactive monitoring, detection of trends, and distribution of critical information across the organization.