Key standards
- IEC 60601 (medical electrical equipment safety), ISO 13485 (quality management), ISO 14971 (risk management), 21 CFR 820 (U.S. FDA Quality System Regulation).
Documented issues
An FDA warning letter to Becton, Dickinson and Company noted the firm failed to establish procedures for corrective and preventive action (CAPA) under 21 CFR 820.100. Inspectors found 544 open tickets for software defects (including cybersecurity vulnerabilities) and 256 open server software issues, showing inadequate control of CAPA process. fda.gov.
Typical challenges
- Medical device manufacturers often lack robust CAPA processes for software defects.
- Quality management systems may not integrate risk management (ISO 14971) and design controls (IEC 60601).
- Cybersecurity vulnerabilities are not tracked as part of CAPA.
Best Practice playbook
- Implement CAPA procedures that capture, analyse, and correct defects; verify actions and trend recurring issues. fda.gov.
- Integrate risk management (ISO 14971) and design controls (IEC 60601) into the quality system; document hazard analyses and mitigations.
- Track cybersecurity vulnerabilities as nonconformities; include them in CAPA and risk management.
- Conduct regular management reviews of open CAPA tickets to ensure closure and effectiveness.
- Audit suppliers and software developers for compliance with ISO 13485 and FDA regulations.
References
- FDA warning letter describing BD’s failure to implement CAPA and large number of open software defect tickets. fda.gov.
