Case study — Risk management for medical devices (based on ISO 14971)

Medical device manufacturers are responsible for ensuring that their medical products are safe. However, safe does not mean zero risk. A safe product is one that has reasonable risks, given the magnitude of the benefit expected an d the alternatives available. Medical device manufacturers, the Food and Drug Administration (FDA) and medical device users have an important role to play in maintaining this risk-benefit balance, by making sure that products are developed, tested, manufactured, labeled, prescribed, dispensed, and used in a way that maximizes benefit and minimizes risk. The FDA approved ISO14971 standard specifies a risk management process by which a manufacturer can identify the hazards associated with their medical device, estimate and evaluate the risks, control these risks, and monitor effectiveness of the controls, through-out the lifecycle of the product. The main elements of the risk management process, i.e. risk analysis, risk evaluation, risk control and postproduction information, are generally documented in a risk management file. This risk management file is required to get FDA approval to market a medical device (prior to product launch). It is also useful after product launch to perform post-market risk assessments and make decisions on whether field action is needed in case of the occurrence of an adverse event. This paper describes a risk management process, an overview of risk management activities (13 steps) outlined in ISO14971, and an example of a risk management program for a Continuous Positive Airway Pressure (CPAP) medical device used to treat Obstructive Sleep Apnea (OSA).