Regulatory Challenges for Software as Medical Device or ... · must be validated according to the state of the art taking ... (MEDDEV-Guideline 2.12-1 rev 8, January 2013) European

Regulatory Challenges for Software as Medical

Device or Component of Medical Devices–

Market Surveillance and Product Liability: What if

Software Fails?

Summer Academy on Medical Technology

Lübeck, 12 September 2013

Overview

Basic principles for product liability

Market surveillance – why?

Responsibilities of the medical device manufacturer

and developer

Liability for material and immaterial damages

Practical examples and experiences

WACHENHAUSEN RECHTSANWÄLTE | © 2013 | Slides: 3 von 11



Aims of Directive 93/42/EEC (MDD)

Recitals: „Whereas the national provisions for the safety and

health protection of patients, users and, where appropriate,

other persons, with regard to the use of medical devices

should be harmonized in order to guarantee the free

movement of such devices within the internal market”

Art. 2 MDD: “Member States shall take all necessary steps

to ensure that devices may be placed on the market and/or

put into service only if they comply with the requirements

laid down in this Directive when duly supplied and properly

installed, maintained and used in accordance with their

intended purpose.“

4 Summer Academy Modul 4 - Software


Software as Medical Device

Definition according to Art. 2 (1) MDD

Medical device means any instrument, apparatus,

appliance, software, material or other article, whether used

alone or in combination, including the software intended by

its manufacturer to be used specifically for diagnostic and/or

therapeutic purposes and necessary for its proper

application, intended by the manufacturer to be used for

human beings for the purpose of …..[a medicinal purpose]

Accessory means an article which whilst not being a device

is intended specifically by its manufacturer to be used

together with a device to enable it to be used in accordance

with the use of the device intended by the manufacturer of

the device




Software as medical device

Standalone-Software (software which is not incorporated in a medical device at the time of its placing on the market or its availability) = CE-mark + conformity assessment

Software as accessory of a medical device = CE-mark + conformity assessment



Software as component or integral part of a medical device

Software is covered by the CE-mark and conformity assessment of the medical device ≠ no separate CE-mark required for the software

Annex I (12.1 a): “For devices which incorporate software or which are medical software in themselves, the software must be validated according to the state of the art taking into account the principles of development lifecycle, risk management, validation and verification.“


Liability for medical devices – does the MDD

cover product liability?

Harmonization of rules for placing medical

devices on the market

Ensure safety and health of patients and users

Compliance with technical and scientific „state of

the art“

Free movement of medical devices in the EU

market

Product liability is not covered by MDD!



MDD has to be implemented into national

laws

But: MDD is independent from any criminal and

civil law and corresponding liabilities

No special liability regulation has to be

implemented

Different from liability of the marketing

authorization holder for medicinal products in

Germany (see § 84 German Drug Act)



Strict Liability Council Directive of 25 July 1985 on the approximation of

the laws, regulations and administrative provisions of the

Member States concerning liability for defective products

(85/374/EEC)

Art. 1: “The producer shall be liable for damage caused by

a defect in his product. “

Product liability is independent from fault-based

(negligence or willful act) liability



Strict Liability Art. 2: “Product means all movables, with the exception of

primary agricultural products and game, even though

incorporated into another movable or into an immovable.

[…] Product includes electricity. “

Can software be qualified as ”product”?


Medical Device as such (+)

Software as component or integral part of

a medical device (+)

Standalone Software? Movable?



Fault-based liability (tort law)

Applicable independently from product definition

Pre-condition: damage has been caused by

negligence or willful act

(1) The plaintiff must establish that the defendant was

under a legal duty to act in a particular fashion

(2) The plaintiff must demonstrate that the defendant

breached this duty by failing to conform his or her

behavior accordingly

(3) The plaintiff must prove that he suffered injury or loss

as a direct result of the defendant's breach



Contractual liability

Research and development agreements

Clinical investigation agreements

Service agreements (installation,

maintenance)

Supply agreements

Lease or rental

agreements

Purchase agreements

Agreements on hospital

accommo-dation and

medical treatment





Medical Devices Vigilance System

(MEDDEV-Guideline 2.12-1 rev 8, January

2013)

European system for the notification and

evaluation of incidents and field safety corrective

actions (FSCA) involving medical devices

Applicable for manufacturers, competent

authorities, the European Commission, Notified

Bodies, users and others concerned with the

continuing safety of medical devices




Prevention of any material and immaterial

damages or injuries caused by medical

devices for

patients

users

other involved individuals

Market surveillance by the responsible

manufacturer




Reporting an incident to a competent authority is

not to be construed as an admission of liability for

the incident and its consequences

However, sufficient market surveillance and active

implementation of necessary measures is a legal

duty of the manufacturer and is linked with

product liability

Manufacturer is responsible for market

surveillance and implementation of measures

independent from authorities




Prevention Implementation of

measures

Market surveillance + Liability of the manufacturer

Control by competent authority

(Notification duties, reports,

inspections, etc.)


Responsibilities of the medical

device manufacturer and

developer

Responsibilities of the medical device

manufacturer and developer


Definition of the medical device manufacturer

„Manufacturer means the natural or legal

person with responsibility for the design,

manufacture, packaging and labelling of a

device before it is placed on the market

under his own name, regardless of whether

these operations are carried out by that

person himself or on his behalf by a third

party.“ (Art. 1 (2) (f) MDD)





manufacturer Medical device must meet the Essential Requirements

Classification of the medical device

Clinical evaluation and clinical data

CE-marking based on a conformity assessment procedure

(involvement of Notified Body)

Compliance with applicable technical standards

Declaration of conformity

Medical device vigilance system and reporting




Definition of producer (Art. 3 Product Liability

Directive)

„Producer means the manufacturer of a

finished product, the producer of any raw

material or the manufacturer of a component

part and any person who, by putting his

name, trade mark or other distinguishing

feature on the product presents himself as its

producer.“




Definition of producer (Art. 3 Product Liability

Directive)

„Without prejudice to the liability of the

producer, any person who imports into the

Community a product for sale, hire, leasing or

any form of distribution in the course of his

business shall be deemed to be a producer

within the meaning of this Directive and shall

be responsible as a producer.“




Producer (re product liability)

De facto manufacturer

Quasi-manufacturer (name on the product)

Importer

In exceptional cases: supplier

Manufacturer (re medical devices)

De facto manufacturer

Quasi-manufacturer

Name on the medical device




Responsibilities of the producer

shall be liable for damages caused by a defect in

his product

shall not be liable if he proves, e.g.,

that, having regard to the circumstances, it is probable

that the defect which caused the damage did not exist at

the time when the product was put into circulation by him

or that this defect came into being afterwards or

that the state of scientific and technical knowledge at the

time when he put the product into circulation was not

such as to enable the existence of the defect to be

discovered


Liability for material and

immaterial damages

Liability for material and immaterial

damages


Product defect, when the product does not

provide the safety which a person is entitled

to expect with regard to

the presentation of the product

the use to which it could reasonably be expected

that the product would be put

the time when the product was put into circulation


damages


Product defect – categories

Construction defect Defects concerning the development and programming of the software

Manufacturing defect Defective data medium (DVD other media)

Instruction defect Incomplete instructions for use; missing warnings and precautions


damages


High impact of instructions for use on

intended purpose

expected presentation of the product

compatibility with other medical devices/products

professional user and/or layperson


damages


Material damages

Hospital treatment costs

Travel costs

Loss of profit

Pension payments

Household support

Immaterial damages

Compensation for pain and suffering


Practical examples and

experiences



URGENT FIELD SAFETY NOTICE by Agfa

HealthCare (4 September 2013) MPAX 5.2 DB Server: In general, the intended use of a

Picture Archiving and Communication System (PACS)

device such as IMPAX, is to provide one or more

capabilities relating to the acceptance, transfer, display,

storage, and digital processing of medical images. Its

hardware components may include workstations,

communications devices, computers, video monitors,

magnetic, optical disk, or other digital data storage devices,

and hardcopy devices. The software components may

provide functions for performing operations related to image

manipulation, enhancement, compression, or quantification.

Various PACS devices can be classified as clients or

servers




HealthCare (4 September 2013) MPAX 5.2 DB Server:

Problem: System downtime and/or slow performance may result if

software in use is not at supported levels. To be specific, it has

been identified that Oracle version 10.1.0.4.0 or older in use with

IMPAX 5.2 DB Server can cause Oracle blocking sessions due to

defect 360595 with fix available in Oracle 10.2.0.2. and

subsequent versions. Please see Oracle’s website detailing this

defect.




HealthCare (4 September 2013) MPAX 5.2 DB Server:

Action: IMPAX 5.2 is End of Service Life. In order for Agfa

HealthCare to continue to provide support it is critical that sites

upgrade to the latest version of IMPAX. In the interim period until

your system is upgraded Agfa HealthCare strongly recommends

installing the latest Oracle CPU's.



URGENT FIELD SAFETY NOTICE by

CARESTREAM DRX-Evolution (1 July 2013) Device modification (software upgrade)

CARESTREAM DRX-Evolution equipments using V5.5.410.33

MR2 software

Description of the problem: Carestream Health has identified a

potential for exposure techniques preset by the user to change

under particular circumstances. The root cause is a software issue

which causes the X- ray techniques set for the previous view (last

view of the same patient or of the previous patient) to be applied to

the current active view. This condition may occur when the user

selects a study that contains multiple views and uses multiple

detectors for the same patient. If there is a technique setting which

is too high or too low, it could result in the need to take another X-

ray exposure as the image quality may not be acceptable.



URGENT FIELD SAFETY NOTICE by

CARESTREAM DRX-Evolution (1 July 2013) Advices to users: Carestream recommend that the user always

verify the technique data displayed on the user interface prior to

making the X-ray exposure. This will minimize the probability of

incorrect techniques being applied to patient exposures.

Action taken by the manufacturer: Carestream is performing a

field safety corrective action to upgrade the software of all affected

DRX-Evolution units. Your local service representative will upgrade

the software at the next routine maintenance visit. CARESTREAM

DRX-Evolution units can continue to be used until this is done.


Dr. Heike Wachenhausen

An der Untertrave 16

23522 Lubeck

+49 (0) 451. 31 70 26 00

[email protected]

Thank you for your kind attention!

Dr. Heike Wachenhausen

Heike provides advice across the full range of regulatory matters

relating to medicinal products and medical devices on German and

European level with particular focus on development, marketing

authorisation and product safety (vigilance).

Heike has been working as a regulatory lawyer for 13 years. She

started her career in the practice group “Healthcare, Life Sciences and

Chemicals” in the Dusseldorf office of Clifford Chance and for six years

she worked with law firm Sträter in Bonn before she became Head

Legal Regulatory & Development in the legal department of Novartis

AG based in Basel, Switzerland. Following her involvement as a partner

in a regional law partnership based in Lübeck, she has further

intensified her Lübeck-based activities since June 2013 as founder of

the law firm Wachenhausen Rechtsanwälte. Heike holds a PhD in law.

Her doctoral thesis deals with clinical trials with persons incapable of

giving informed con sent.

Heike is co-editor of the German Medical Device Journal. She has

widely published on matters relating to development and authorisation

of medicinal products and medical devices. Heike regularly holds

seminars and presents papers at symposia.

Languages: German, English

+49 451 3170260-0

h.wachenhausen@

wachenhausen-law.com

CONTACT

Documents

Regulatory Challenges for Software as Medical Device or ... · must be validated according to the state of the art taking ... (MEDDEV-Guideline 2.12-1 rev 8, January 2013) European