Medical Devices - Application of Risk Management to Medical Devices
1 Scope
This document specifies terminology, principles and a process for risk management of medical devices, including software as a medical device and in vitro diagnostic medical devices. The process described in this document intends to assist manufacturers of medical devices to identify the hazards associated with the medical device, to estimate and evaluate the associated risks, to control these risks, and to monitor the effectiveness of the controls.
The requirements of this document are applicable to all phases of the life cycle of a medical device. The process described in this document applies to risks associated with a medical device, such as risks related to biocompatibility, data and systems security, electricity, moving parts, radiation, and usability.
The process described in this document can also be applied to products that are not necessarily medical devices in some jurisdictions and can also be used by others involved in the medical device life cycle.
This document is not applicable to:
——decisions on the use of a medical device in the context of any particular clinical procedure; or
——business risk management.
This document requires manufacturers to establish objective criteria for risk acceptability but does not specify acceptable risk levels.
Risk management is an integral part of a quality management system. However, this document does not require the manufacturer to have a quality management system in place.
Note: Guidance on the application of this document can be found in YY/T 14370[10].
2 Normative references
There are no normative references in this document.
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
——ISO Online browsing platform: available at http://www.iso.org/obp
——IEC Electropedia: available at http://www.electropedia.org/
3.1
accompanying documentation
materials accompanying a medical device (3.10) and containing information for the user or those accountable for the installation, use, maintenance, decommissioning and disposal of the medical device (3.10), particularly regarding safe use
Note 1: The accompanying documentation can consist of the instructions for use, technical description, installation manual, quick reference guide, etc.
Note 2: Accompanying documentation is not necessarily a written or printed document but could involve auditory, visual, or tactile materials and multiple media types.
3.2
benefit
positive impact or desirable outcome of the use of a medical device (3.10) on the health of an individual, or a positive impact on patient management or public health
Note: Benefits can include positive impact on clinical outcome, the patient’s quality of life, outcomes related to diagnosis, positive impact from diagnostic devices on clinical outcomes, or positive impact on public health.
3.3
harm
injury or damage to the health of people, or damage to property or the environment
[Source: ISO/IEC Guide 63:2019, 3.1]
3.4
hazard
potential source of harm (3.3)
[Source: ISO/IEC Guide 63:2019, 3.2]
3.5
hazardous situation
circumstance in which people, property or the environment is/are exposed to one or more hazards (3.4)
Note: See Annex C for an explanation of the relationship between hazard and hazardous situation.
[Source: ISO/IEC Guide 63:2019, 3.3, modified]
3.6
intended use
intended purpose
use for which a product, process (3.14) or service is intended according to the specifications, instructions and information provided by the manufacturer (3.9)
Note: The intended medical indication, patient population, part of the body or type of tissue interacted with the medical device, user profile, use environment, and operating principle are typical elements of the intended use.
[Source: ISO/IEC Guide 63:2019, 3.4]
3.7
in vitro diagnostic medical device
IVD medical device
device, whether used alone or in combination, intended by the manufacturer (3.9) for the in vitro examination of specimens derived from the human body solely or principally to provide information for diagnostic, monitoring or compatibility purposes and including reagents, calibrators, control materials, specimen receptacles, software, and related instruments or apparatus or other articles
[Source: GB/T 29791.1-2013, 3.27, modified]
3.8
life cycle
series of all phases in the life of a medical device (3.10), from the initial conception to final decommissioning and disposal
[Source: ISO/IEC Guide 63:2019, 3.5]
3.9
manufacturer
natural or legal person with responsibility for the design and/or manufacture of a medical device (3.10) with the intention of making the medical device (3.10) available for use, under his name, whether or not such a medical device (3.10) is designed and/or manufactured by that person himself or on his behalf by another person(s)
Note 1: The natural or legal person has ultimate legal responsibility for ensuring compliance with all applicable regulatory requirements for the medical device in the countries or jurisdictions where it is intended to be made available or sold, unless this responsibility is specifically imposed on another person by the regulatory authority (RA) within that jurisdiction.
Note 2: The manufacturer’s responsibilities are described in other GHTF guidance documents. These responsibilities include meeting both pre-market requirements and post-market requirements, such as adverse event reporting and notification of corrective actions.
Note 3: “Design and/or manufacture” include specification development, production, fabrication, assembly, processing, packaging, repackaging, labelling, relabelling, sterilization, installation, or remanufacturing of a medical device; or putting a collection of devices, and possibly other products, together for a medical purpose.
Note 4: Any person who assembles or adapts a medical device that has already been supplied by another person for an individual patient, in accordance with the instructions for use, is not the manufacturer, provided the assembly or adaptation does not change the intended use of the medical device.
Note 5: Any person who changes the intended use of, or modifies, a medical device without acting on behalf of the original manufacturer and who makes it available for use under his own name, should be considered the manufacturer of the modified medical device.
Note 6: An authorised representative, distributor or importer who only adds its own address and contact details to the medical device or the packaging, without covering or changing the existing labelling, is not considered a manufacturer.
Note 7: To the extent that an accessory is subject to the regulatory requirements of a medical device, the person responsible for the design and/or manufacture of that accessory is considered to be a manufacturer.
[Source: GHTF/SG1/N055:2009, 5.1]
3.10
medical device
instrument, apparatus, implement, machine, appliance, implant, reagent for in vitro use, software, material or other similar or related article, intended by the manufacturer (3.9) to be used, alone or in combination, for human beings, for one or more of the specific medical purpose(s) of:
——diagnosis, prevention, monitoring, treatment or alleviation of disease;
——diagnosis, monitoring, treatment, alleviation of or compensation for an injury;
——investigation, replacement, modification, or support of the anatomy or of a physiological process,
——supporting or sustaining life;
——control of conception;
——disinfection of medical devices;
——providing information by means of in vitro examination of specimens derived from the human body,
and which does not achieve its primary intended action by pharmacological, immunological or metabolic means, in or on the human body, but which can be assisted in its function by such means
Note 1: Products which can be considered to be medical devices in
Foreword i
Introduction ii
1 Scope
2 Normative references
3 Terms and definitions
4 General requirements for risk management system
4.1 Risk management process
4.2 Management responsibilities
4.3 Competence of personnel
4.4 Risk management plan
4.5 Risk management file
5 Risk analysis
5.1 Risk analysis process
5.2 Intended use and reasonably foreseeable misuse
5.3 Identification of characteristics related to safety
5.4 Identification of hazards and hazardous situations
5.5 Risk estimation
6 Risk evaluation
7 Risk control
7.1 Risk control option analysis
7.2 Implementation of risk control measures
7.3 Residual risk evaluation
7.4 Benefit-risk analysis
7.5 Risks arising from risk control measures
7.6 Completeness of risk control
8 Evaluation of overall residual risk
9 Risk management review
10 Production and post-production activities
10.1 General
10.2 Information collection
10.3 Information review
10.4 Actions
Annex A (Informative) Rationale for requirements
Annex B (Informative) Risk management process for medical devices
Annex C (Informative) Fundamental risk concepts
Bibliography
Medical Devices - Application of Risk Management to Medical Devices
1 Scope
This document specifies terminology, principles and a process for risk management of medical devices, including software as a medical device and in vitro diagnostic medical devices. The process described in this document intends to assist manufacturers of medical devices to identify the hazards associated with the medical device, to estimate and evaluate the associated risks, to control these risks, and to monitor the effectiveness of the controls.
The requirements of this document are applicable to all phases of the life cycle of a medical device. The process described in this document applies to risks associated with a medical device, such as risks related to biocompatibility, data and systems security, electricity, moving parts, radiation, and usability.
The process described in this document can also be applied to products that are not necessarily medical devices in some jurisdictions and can also be used by others involved in the medical device life cycle.
This document is not applicable to:
——decisions on the use of a medical device in the context of any particular clinical procedure; or
——business risk management.
This document requires manufacturers to establish objective criteria for risk acceptability but does not specify acceptable risk levels.
Risk management is an integral part of a quality management system. However, this document does not require the manufacturer to have a quality management system in place.
Note: Guidance on the application of this document can be found in YY/T 14370[10].
2 Normative references
There are no normative references in this document.
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
——ISO Online browsing platform: available at http://www.iso.org/obp
——IEC Electropedia: available at http://www.electropedia.org/
3.1
accompanying documentation
materials accompanying a medical device (3.10) and containing information for the user or those accountable for the installation, use, maintenance, decommissioning and disposal of the medical device (3.10), particularly regarding safe use
Note 1: The accompanying documentation can consist of the instructions for use, technical description, installation manual, quick reference guide, etc.
Note 2: Accompanying documentation is not necessarily a written or printed document but could involve auditory, visual, or tactile materials and multiple media types.
3.2
benefit
positive impact or desirable outcome of the use of a medical device (3.10) on the health of an individual, or a positive impact on patient management or public health
Note: Benefits can include positive impact on clinical outcome, the patient’s quality of life, outcomes related to diagnosis, positive impact from diagnostic devices on clinical outcomes, or positive impact on public health.
3.3
harm
injury or damage to the health of people, or damage to property or the environment
[Source: ISO/IEC Guide 63:2019, 3.1]
3.4
hazard
potential source of harm (3.3)
[Source: ISO/IEC Guide 63:2019, 3.2]
3.5
hazardous situation
circumstance in which people, property or the environment is/are exposed to one or more hazards (3.4)
Note: See Annex C for an explanation of the relationship between hazard and hazardous situation.
[Source: ISO/IEC Guide 63:2019, 3.3, modified]
3.6
intended use
intended purpose
use for which a product, process (3.14) or service is intended according to the specifications, instructions and information provided by the manufacturer (3.9)
Note: The intended medical indication, patient population, part of the body or type of tissue interacted with the medical device, user profile, use environment, and operating principle are typical elements of the intended use.
[Source: ISO/IEC Guide 63:2019, 3.4]
3.7
in vitro diagnostic medical device
IVD medical device
device, whether used alone or in combination, intended by the manufacturer (3.9) for the in vitro examination of specimens derived from the human body solely or principally to provide information for diagnostic, monitoring or compatibility purposes and including reagents, calibrators, control materials, specimen receptacles, software, and related instruments or apparatus or other articles
[Source: GB/T 29791.1-2013, 3.27, modified]
3.8
life cycle
series of all phases in the life of a medical device (3.10), from the initial conception to final decommissioning and disposal
[Source: ISO/IEC Guide 63:2019, 3.5]
3.9
manufacturer
natural or legal person with responsibility for the design and/or manufacture of a medical device (3.10) with the intention of making the medical device (3.10) available for use, under his name, whether or not such a medical device (3.10) is designed and/or manufactured by that person himself or on his behalf by another person(s)
Note 1: The natural or legal person has ultimate legal responsibility for ensuring compliance with all applicable regulatory requirements for the medical device in the countries or jurisdictions where it is intended to be made available or sold, unless this responsibility is specifically imposed on another person by the regulatory authority (RA) within that jurisdiction.
Note 2: The manufacturer’s responsibilities are described in other GHTF guidance documents. These responsibilities include meeting both pre-market requirements and post-market requirements, such as adverse event reporting and notification of corrective actions.
Note 3: “Design and/or manufacture” include specification development, production, fabrication, assembly, processing, packaging, repackaging, labelling, relabelling, sterilization, installation, or remanufacturing of a medical device; or putting a collection of devices, and possibly other products, together for a medical purpose.
Note 4: Any person who assembles or adapts a medical device that has already been supplied by another person for an individual patient, in accordance with the instructions for use, is not the manufacturer, provided the assembly or adaptation does not change the intended use of the medical device.
Note 5: Any person who changes the intended use of, or modifies, a medical device without acting on behalf of the original manufacturer and who makes it available for use under his own name, should be considered the manufacturer of the modified medical device.
Note 6: An authorised representative, distributor or importer who only adds its own address and contact details to the medical device or the packaging, without covering or changing the existing labelling, is not considered a manufacturer.
Note 7: To the extent that an accessory is subject to the regulatory requirements of a medical device, the person responsible for the design and/or manufacture of that accessory is considered to be a manufacturer.
[Source: GHTF/SG1/N055:2009, 5.1]
3.10
medical device
instrument, apparatus, implement, machine, appliance, implant, reagent for in vitro use, software, material or other similar or related article, intended by the manufacturer (3.9) to be used, alone or in combination, for human beings, for one or more of the specific medical purpose(s) of:
——diagnosis, prevention, monitoring, treatment or alleviation of disease;
——diagnosis, monitoring, treatment, alleviation of or compensation for an injury;
——investigation, replacement, modification, or support of the anatomy or of a physiological process,
——supporting or sustaining life;
——control of conception;
——disinfection of medical devices;
——providing information by means of in vitro examination of specimens derived from the human body,
and which does not achieve its primary intended action by pharmacological, immunological or metabolic means, in or on the human body, but which can be assisted in its function by such means
Note 1: Products which can be considered to be medical devices in
Contents of GB/T 42062-2022
Foreword i
Introduction ii
1 Scope
2 Normative references
3 Terms and definitions
4 General requirements for risk management system
4.1 Risk management process
4.2 Management responsibilities
4.3 Competence of personnel
4.4 Risk management plan
4.5 Risk management file
5 Risk analysis
5.1 Risk analysis process
5.2 Intended use and reasonably foreseeable misuse
5.3 Identification of characteristics related to safety
5.4 Identification of hazards and hazardous situations
5.5 Risk estimation
6 Risk evaluation
7 Risk control
7.1 Risk control option analysis
7.2 Implementation of risk control measures
7.3 Residual risk evaluation
7.4 Benefit-risk analysis
7.5 Risks arising from risk control measures
7.6 Completeness of risk control
8 Evaluation of overall residual risk
9 Risk management review
10 Production and post-production activities
10.1 General
10.2 Information collection
10.3 Information review
10.4 Actions
Annex A (Informative) Rationale for requirements
Annex B (Informative) Risk management process for medical devices
Annex C (Informative) Fundamental risk concepts
Bibliography
