International Regulatory Compliance

Holding Registrars And Notified Bodies Accountable In ISO 9001 Lawsuits

Introduction

In several blogs I have mentioned the standard, ISO/IEC 17021: 2006 Conformity assessment – Requirements for bodies providing audit and certification of management systems. In a previous blog, I reviewed working as Legal Expert in a lawsuit where ISO 9001: 2000 became a central focus of litigation between a US plaintiff and defendant. In this particular case, the opposing party stated that they did not have a recall or quarantine procedure for their products, further, they did not have records concerning the product in question.

The law student intern who first contacted me for the law firm said he thought that the opposing party was certified to ISO 9001. I replied that I could find out if they were certified and if they were, what records and documents could be obtained in legal discovery. After filing an Affidavit identifying the opposing party’s certification to ISO 9001 and identifying the records and documents we wanted to examine, their response was, “Oh those records!” The judge was not amused by their duplicity and ordered the company to produce the records and documents requested.

In their response, one of the corporations employees stated that he was the management representative and that he worked with all of the plants in question concerning this product. His statement resulted in a second Affidavit where I noted that his comment was interesting because management representatives usually report to a plant manager. However, since he worked with several plants involved in manufacturing the product in question, this meant that he was a management representative at the corporate level and reported to corporate management. It also meant that in addition to the plants being certified to ISO 9001 there was a corporate ISO 9001 certification.

The immediate response was no, we do not have corporate ISO 9001 certification, however, within a couple of weeks a full corporate Quality Manual, Procedures, Documents and Records were sent to our attorneys and “lo and behold”, there was a formal corporate recall and quarantine policy. By now the judge was approaching livid, not amused and quite angry.

Enter The ISO 9001 Registrar 

The Registrar in this case was well known to me. I was familiar with their work as a notified body for the EU Medical Devices Directive and had recommended them to some clients who wanted to CE Mark their medical devices. They always acted professionally. I also was familiar with their work as a Registrar for ISO 9001 and had visited their US Registrar headquarters. Consequently, I was startled by their behavior vis-á-vis their client in this lawsuit.

ISO/IEC 17021: 2006 Conformity assessment – Requirements for bodies providing audit and certification of management systems

To provide a basis for evaluating the behavior of the Registrar in this case, I wrote a Critique for the law firm to use in deposing the Registrar and consider bringing them into the lawsuit if their behavior could adversely affect the outcome of the lawsuit. The basis for such a move would derive from comparing their behavior with their client (the opposing party in this lawsuit) with the requirements of the International Standard (ISO/IEC 17021: 2006) that governs their behavior as a third party ISO 9001: 2000 Registrar.

In the Critique I stated my opinion that the Registrar violated its role as an impartial third party and instead:

1) chose to act on behalf of their client to deny access to information regarding the ISO 9001 certification status of their client;

2) chose to help their clients obtain a consultant to address the company’s certification to ISO 9001; and

3) chose retroactively to change the long standings certification status (seven years) of a company site during a lawsuit between the company and our client to help their client win their lawsuit.

This Registrar, along with all ISO 9001:2000 Quality Management System certification Registrars must abide by the requirements set forth in ISO/IEC 17021:2006 Conformity assessment – Requirements for bodies providing audit and certification of management systems.  This Critique will draw from the requirements of the standard to substantiate and highlight these points.

1.) When I called the US headquarters of the Registrar, I asked if the opposing party in this lawsuit was a client of theirs, if they had certified several plants and the corporate headquarters to ISO 9001:2000. I was told that they would have to consult with their attorneys to see if they could divulge such information. A few hours later I received a call stating that their attorneys advised them that such information could not be given without their client’s consent. (Basically, US attorneys are clueless about international compliance standards, unless informed of such standards by their clients.)

 ISO/IEC 17021:2006, Clause 4.5 Openness

4.5.1 A certification body needs to provide public access to, or disclosure of, appropriate and timely information about its audit process and certification process, and about the certification status (i.e., the granting, extending, maintaining, renewing, suspending, reducing the scope of, or withdrawing of certification) of any organization, in order to gain confidence in the integrity and credibility of certification. Openness is a principle of access to, or disclosure of, appropriate information.

 

4.5.2 To gain or maintain confidence in certification, a certification body should provide appropriate access to, or disclosure of, non-confidential information about the conclusion of specific audits (e.g. audits in response to complaints) to specific interested parties.

2.) Certification bodies (e.g. Registrars) must maintain impartiality in their operations. Recommending an ISO 9001:2000 consultant to a client violates their duty of impartiality and creates a conflict of interest for the Registrar.

3.) The Registrar retroactively changed the long-standing corporate certification status of their client during the lawsuit to help the client win its case.

5.1 Legal and contractual matters

5.1.1 Legal responsibility

The certification body shall be a legal entity, or a defined part of a legal entity, such that it can be held legally responsible for all of its certification activities. A governmental certification body is deemed to be a legal entity on the basis of its governmental status.

5.2 Management of Impartiality

5.2.1 The certification body shall have top management commitment to impartiality management system certification activities. The certification body shall have a publicly accessible statement that it understands the importance of impartiality in carrying out its management system certification activities, manages conflict of interest and ensures the objectivity of its management system certification activities.

5.2.5  The Certification body and any part of the same legal entity shall not offer or provide management system consultancy. This also applies to that part of government identified as a certification body.

5.2.1.2 All Certification by personnel, either internal or external, or committees, who could influence the certification activities, shall act impartially and shall not allow commercial, financial or other pressures to compromise impartiality.

5.2.13 Certification bodies shall require personnel, internal and external, to reveal any situation known to them that may present them or the certification body with a conflict of interests. Certification bodies shall use this information as input to identifying threats to impartiality raised by the activities of such personnel or by the organizations that employ them, and shall not use such personnel, internal or external, unless they can demonstrate that there is no conflict of interests.

Conclusion

What you have read is an abbreviated portion of my 16 page Critique of the Registrar for a lawsuit. We conducted some preliminary depositions and were preparing to return for more in depth depositions that would be used to bring the Registrar into the lawsuit, however, the opposing party signaled that they would like to settle the case. The results, of course, were sealed.

Most appalling in this case was the either the ignorance and indifference (or both) of the Manager of the Registrar who wanted to please a wealthy client, not realizing the liability exposure for his company. Further, the Registrar would face potential sanctions from ANAB (ANSI-ASQ National Accreditation Board), assuming that ANAB Registrar oversight is rigorous. Unfortunately, this is one of several times that I have watched third parties like Registrars or Notified Bodies demonstrate unethical behavior – the absence of a Moral Compass.   

My focus on International Regulatory Compliance has always included both the requirements of regulatory authorities and the legal implications of compliance, non-compliance, documentation and sloppy attention to detail that could result in a lawsuit in a US Federal Court. I also focus on product safety and the steps necessary to create a safe product. If you have questions regarding ISO 9001 or CE Marking lawsuits you can contact me for a free preliminary consultation at my e-mail address jameskolka@gmail.com. 

IS FDA's 510(k) A Plausible Solution For the EU's CE Marking Problem With Silicon Breast Implants?

 

Introduction

The preceding four blogs discussed some of the problems I have observed with clients concerning private for-profit Notified Bodies and regulatory compliance with the three EU Medical Devices Directives. In the January 31, 2012 blog, I wrote the following paragraph concerning one possible alternative Notified Body approach to Medical Device approvals: 

“Something akin to an FDA 510(k) also should be created with device efficacy built in as major requirement. It isn’t a perfect solution because the 510(k) predicate device requirement doesn’t always avoid device defects in design and materials, but it is overseen by FDA not a private third party.”

The Mutual Recognition Agreement (MRA) signed between the US and EU in 1997, covered four areas, one being medical devices. The MRA provided for the creation of CABs (Conformity Assessment Bodies) approved by FDA to administer 510(k)s for selected Class II Medical Devices. Several of these CABs also are EU Notified Bodies. In this blog I want to return to the statement, “It isn’t a perfect solution because the 510(k) predicate device requirement doesn’t always avoid device defects in design and materials.”

US Politics Today 

Presently, there is a move in the US House of Representatives supported by some Senators to ease medical device regulations for Medical Device Manufacturers, hypothetically to encourage innovation and speed devices to the market. Even though the US has just begun to emerge from the disaster of deregulation of the US economy that allowed financial institutions to run amuck and create the worst financial crisis since the Great Depression, a convoluted ideology continues to appeal, i.e., regulation is bad, deregulation is good! Political ideology is a powerful force, uninformed by scientific knowledge and intelligence. Teddy Roosevelt and Abe Lincoln would have been appalled.  

The regulatory and enforcement problem afflicting CE Marking breast implant manufacturing and enforcement for the EU Medical DEvices Directives is different from the regulatory problem in the US, namely the weakness of the 510(k) approach. On February 1^st my wife received the following correspondence from Jim Guest, the President of Consumer Reports.

“It's a nightmare scenario. The implant that fixed your knee or your heart may actually be a ticking time bomb that could disable or kill you.
This isn't science fiction. Millions of medical devices including artificial hips, contact lens solution, heart stents, and pacemakers are being recalled - 700 different products a year.

And the vast majority of recalled products were never safety tested in humans, because the manufacturers claimed they were "similar" to products already on the market.

Tell Congress we don't want to be guinea pigs anymore!

Every new prescription drug must undergo rigorous testing on humans before it can be sold, even if it is similar to another drug already in use. Not so with medical devices. Because of this loophole in our safety laws, more than 90 percent of medical devices aren't safety tested before being sold nor are they routinely tracked afterwards to identify safety problems.

For example, a metal hip implant marketed by Johnson & Johnson was approved in 2005 without first undergoing clinical safety trials. It was recalled five years later after having a 1 in 8 failure rate in the UK, and releasing potentially toxic metals into the body. Countless patients had to undergo a second, painful 'revision' surgery.

It's time safety standards for medical devices are as strong as those for prescription drugs! E-mail your members now!

The device industry has unleashed an army of lobbyists and they don't want things to change. It will take a wave of consumers weighing in to make sure medical devices are safe and effective. Please take action, then forward this to friends and family. Thank you!

Sincerely,

Jim Guest
President, Consumer Reports

(Note: Consumer Reports is the largest and oldest independent non-profit testing and information organization in the US, serving only consumers since 1936.)

What are some of the problems with the 510(k)? 

Today the 35 year-old 510(k) System is used by FDA to review 90 percent of medical device applications each year. After numerous problems and ongoing billion dollar lawsuits concerning 510(k) approved medical devices, in 2009 FDA commissioned the Institute of Medicine (IOM) to study the problem and report back to FDA, which they did in August 2011.

The IOM report stated, “the process of using existing or “predicate” devices as the basis for evaluating the safety and effectiveness of a new device is “untenable.” The authors recommended that the FDA immediately stop using the protocol for Class III devices – considered to pose the highest potential risk to patients. “As devices have evolved and become more complex, our device-approval system has become incapable of assuring safety and effectiveness,” wrote New England Journal of Medicine executive editor Dr. Gregory Curfman and Dr. Rita Redberg, editor of the Archives of Internal Medicine. The system we use today was created 35 years ago in an era of much simpler and fewer devices and it is now outdated.

The New England Journal of Medicine editorial discussing the IOM report, specifically pointed out the ongoing problems with metal-on-metal hip implants including Johnson & Johnson’s DePuy ASR Acetabular System and DePuy ASR Hip Resurfacing System. The DePuy ASR XL Acetabular System was introduced in the US in 2005.

 The [DePuy] ASR was constructed by borrowing a metal alloy cup from a different hip device known as the [DePuy] ASR Hit Resurfacing System and retrofitting it onto a standard hip implant. The manufacturer successfully made the case that the reengineered implant was “substantially equivalent” to a predicate device. Its marketing clearance was therefore based not on trials or other clinical data but on bench testing in a laboratory, which was inadequate to simulate the stresses that would be placed on it in patients’ bodies. It soon became clear that the device failed at the astonishing rate of at least one in eight. (Brett Emerson, Injury Board.com, October 20, 2011) 

The metal-on-metal hip implants were found to shred minute metal particles into patients’ bloodstreams over time.

What Are The Institute of Medicine Recommendations? 

To begin the IOM, recommended that the agency (FDA) ditch the program entirely and replace it with an “integrated pre-market and post-market regulatory framework. It’s not clear that the 510(k) process is serving the needs of either the industry or patients, and simply modifying again will not help, said David Challoner who chaired the committee that wrote the report. The 510(k) Process cannot achieve its stated goals – to achieve innovation and make safe, effective devices available to patients in a timely manner – because they are fundamentally at odds with statutes that govern how FDA must implement the process.

Other IOM recommendations are:

• Boosting post-market surveillance and strengthening the FDA’s post-market authority;

• Ban all Class III devices, those of the highest risk, from the 510(k) fast-track process;

• Eliminate clearance using multiple predicate devices, by which a new device can be cleared by demonstrating equivalence to device that was also cleared through equivalence, forming a chain of devices that were never clinically tested, and 
• 
  
• Implement a formal post-market surveillance program.

The [IOM] report concluded that it was impossible for 510(k) clearance to assure safety and effectiveness, because it assesses neither, instead establishing only “substantial equivalence” to an existing device. 

 Summary 

As anticipated, the medical device industry rose up to complain about the reforms even though billion-dollar product liability lawsuits are working their way through the courts right now and will cost medical device companies a substantial amount of money. Not to mention that patients who suffer pain from the existing device and need to have the devices explanted and a new device inserted with no clear indication of how the surgical costs will be covered.

To return to the question about whether FDA’s 510(k) might serve as a model for EU regulation of its medical devices directives, the answer is no. The two regulatory systems face different issues:

• In the EU the issue is the competence of Notified Body device experts, the effectiveness of 70 for-profit Notified Bodies overseeing medical device manufacturers’ ISO 13485 Quality Management Systems, and the professional quality of oversight by 27 EU competent bodies.

• In the US the issue is a regulatory process that employs two strategies, (1) clinical trials for new high-risk device medical device, and (2) a 510(k) System focused “substantial equivalence” and expedience that doesn’t assure the safety and effectiveness of medical devices and consequently doesn’t focus on patient safety and product (device) safety.

Both the EU and US will have to work out their respective regulatory systems in the context of what presently exists but is not working. It’s not a simple process and it will take some work but it is essential that it be resolved in both the EU and US. Hopefully, private self-interest, political interference and intrusion won’t create a corrupted process that worsens what exists today.

My focus on International Regulatory Compliance has always included both the requirements of regulatory authorities and the legal implications of compliance, non-compliance, documentation and sloppy attention to detail that could result in compromised product safety and product liability lawsuits. In particular, I focus on product safety, patient safety and the steps necessary to create a safe product. I would be happy to help. If you have questions regarding CE Marking lawsuits you can contact me for a free preliminary consultation at my e-mail address jameskolka@gmail.com. 

Notified Bodies And CE Marking – Potential Legal Issues In US Lawsuits #4

 

Continuation 

In this blog I want to focus specifically on the Silicon Breast Implant controversy involving the breast implant manufacturer Poly Implants Prothèses (PIP) and the EU regulatory structure for CE Marking medical devices. In my preceding three blogs times I have noted several problems concerning medical device product quality. In the first blog I quoted former European Commission Vice President Martin Bangemen.

In his preface to The Guide to the Implementation of Community Harmonization Directives Based on the New Approach and the Global Approach, Brussels, 1995, Vice President of the European Commission, Martin Bangeman stated the following:

The novelty of this new approach resides essentially in the use of community technical rules of “quality instruments” such as European Standardization and conformity assessment procedures (testing, product certification, certification of manufacturers’ quality control procedures, accreditation, etc.). These instruments, drawn up on the basis of consensus of all the economic partners involved, enable manufacturers to affix the CE marking--a real “technical passport”--to their industrial products, which must conform to these community directives.

The idea of separating compliance into product quality and process quality seemed like a good and workable idea at the time. However, looking backward from 2012, the growth of the EU to 27 Member States and a population of 500 million people, the separation into product quality and process quality needs to be readdressed. 

EU Medical Device Oversight Structure 

Medical Device Product Quality

In the EU, device regulations are not conducted by member state Competent National Authorities, instead they are conducted by one of the 70 approved for-profit Notified Bodies that must be approved by one of the EU’s 27 Competent National Authorities (called competent bodies) to act as a Notified Body for one of the three Medical Devices Directives. Consequently, member states are removed from direct legal oversight and legal enforcement of medical device regulations and hampered in their ability to oversee medical device failures.

To reason that 70 for-profit Notified Bodies can employ 70, 60 or 50 device experts for hundreds of different medical devices in multiple offices around the world isn’t credible. Consequently, the dearth of available device experts will continue to negatively affect the quality of medical devices being manufactured. While it might be reasoned that large established Notified Bodies could field multiple device experts, even they struggle to provide adequate product safety oversight. The Notified Body chosen by Poly Implants Prothèses (PIP) was TUV Rheinland, a well-established and respected Notified Body. The inspection however, occurred with advanced warning at the PIP plant in China, which raises a whole set of questions.

I have talked with principals at several Notified Bodies who privately admit that it is difficult for them to hire and retain qualified medical device experts. The number of silicon breast medical device manufacturers approved by the EU Notified Body structure has been estimated in various newspaper accounts at 80 to 120. If this is even remotely true, it is outrageous. In the US FDA has approved 6 medical device manufacturers for silicon breast implants.

While 6 silicon breast implant manufacturers approved for 313 million people in the US might seem small, 80 to 120 silicon breast implant manufacturers for 500 million people in the EU is preposterous and beyond oversight. Further, FDA requires that US manufacturers must be able to continually demonstrate the efficacy of their medical devices. No such requirement exists in the EU. 

Medical Device Product Quality Recommendations

• While several approaches to correct the administrative structure should be explored, one approach that might work would be to draw upon CEN and EU Member State Standards Bodies (DIN, AFNOR, BSI, etc.) to identify and/or provide medical device  experts to evaluate medical devices. Their services could be paid for by Notified Bodies, but they must not be employees of for profit Notified Bodies so that their judgments could be compromised.

• Something akin to an FDA 510(k) also should be created with device efficacy built in as major requirement. It isn’t a perfect solution because the 510(k) predicate device requirement doesn’t always avoid device defects in design and materials, but it is overseen by FDA not a private third party.

Medical Device Process Quality

All in all, Notified Bodies do a better job with process quality oversight, not perfect but better than their oversight of medical device product quality. Unfortunately, in their zeal to obtain business, some Notified Bodies could be accused of providing the best oversight money can buy. 

Medical Device Process Quality Recommendations

• Notified Body process quality oversight must be improved, which means that Member State Competent Body oversight of Notified Bodies must improve. Notified Bodies also must have greater awareness of their liability exposure. Thus far they have dodged the proverbial litigation bullet, but this will change in the US as well as in the EU. Presently there are several US lawsuits involving CE marked PIP breast implants in the US and the number of lawsuits will increase.

• FDA’s QSIT (Quality System Inspection Technique) adopted in 1999 as a guidance tool for FDA inspectors and an instructional tool for medical device manufacturers was a clever move that accompanied the adoption of FDA’s Quality System Regulation (QSR) in 1996. It introduced the use of a quality management system as a Good Manufacturing Practices regulatory approach to medical device manufacturing in the US. It also set a serious tone concerning what to expect when FDA conducts a medical device plant inspection. The Internal Quality Management Audit Checklist (ISO 13485:2003/ISO 9001:2000) is the closest approximation I could find to QSIT for the EU. A formal adoption of such a structure for use by EU Notified Bodies and oversight by Member State Competent Bodies could serve the same purpose. Every US medical device manufacturer conducts QSIT audits before being visited by FDA. The same type of rigor should exist for the EU.

• In addition to Member State Competent Bodies acting as Third Party Registrars overseeing their Notified Bodies, some effort should be made to instruct their Notified Bodies to be conversant with and abiding by the legal requirements of ISO/IEC 17021:2006 Conformity Assessment – Requirements for bodies providing audit and certification of management systems. In 2008, I served as legal expert in a national lawsuit in a US Federal Court in Los Angeles. As we proceeded to collect material in legal discovery, I contacted the Registrar for the opposing company to verify that they were the ISO 9001:2000 Registrar for the company. Since the Registrar was a division of a European Third Party that also was a Notified Body with whom I had worked with for some of my EU medical device clients, I anticipated no problem. Instead, I was informed that their attorneys advised them that they could not share such information, which was in clear violation of ISO/IEC 17021:2006. I know that US attorneys are clueless when it comes to such standards, but it quickly became clear that the Registrar also was clueless about the standard. From that point on, the Registrar proceeded to violate the requirements of ISO/IEC 17021:2006 with impunity, including modifying he scope of their ISO 9001:2000 Certification three years after it had been granted, to accommodate their corporate client. We began preparing expanded depositions and inclusion of the Registrar in the lawsuit when the case was settled. Clearly, the Registrar had no moral compass whatsoever. Also, my opinion of the related Notified Body went downhill.

• Notified bodies also must be made aware of their legal obligations in the event of a product liability lawsuit. For example, litigants in US Federal Courts have a legal right to ask for relevant records and documents in discovery such as the Quality Manual and Quality Procedures, Contract Records, Certification Audits, Surveillance Audits, Management Review Minutes, Non Conformity Records, Corrective and Preventive Action Minutes and records, Internal Audit Minutes, design records, process control records, Technical File records, complaints, etc. It makes no difference if these records and documents describe devices manufactured outside of the US. If they are relevant to devices sold in the US, they must be produced or the company can be held in contempt of court and fined. It doesn’t end there. Additional fines and potential criminal prosecution could follow. I mention this because presently I am working as legal expert on a CE Marking lawsuit in US Federal Court where a German manufacturer has been resisting our requests for discovery of their ISO 9001 records and documents and CE Marking Technical Files, etc. under the mistaken impression that a US Federal Court can not compel discovery from a non US manufacturer, not realizing that any manufacturer that sell products in the US is subject to US law.

Conclusion

There is a lot I like about the EU approach to the administration of its new approach Directives. However after seeing first hand the problems with Notified Bodies attempting to find medical device experts and observing mixed success with their administration of quality management system oversight, something must be done to improve the regulatory administrative approach. Also, consideration must be given to the efficacy of their approach as applied in different countries.

When working with a company in Atlanta three years that owned a manufacturing plant in China, I was asked to review their CE Marking materials from China. They had concluded that their Chinese counterparts didn’t understand CE Marking and decided to shift the administration of CE Marking their products to the US. It was about the same time that a US Manufacturer of Heparin was caught up in a controversy where 80 people died and several others were gravely ill from their Heparin sold in the US. The response from the American manufacturer was that they bought their supplies from Consolidation Laboratories in China. At the same time I was looking at pictures in the New York Times of diseased pig intestines draped over concrete sinks in rural China being rinsed with dirty water and shipped to Consolidation Laboratories. The American manufacturer never checked the full depth of their supply chain.

The use of industrial grade silicon instead of medical grade silicon and the resulting problems it has caused thousands of women in the EU and throughout the world is appalling. It is encouraging that the French police have detained the founder of the company. I trust that he might also spend a substantial amount of his remaining time in a French prison.

Clearly it is time to revaluate the effectiveness of the approach for the manufacture of medical devices. I hope that some of my suggestions prove to be useful. As mentioned in my previous blog I would be happy to help. My focus on International Regulatory Compliance has always included both the requirements of regulatory authorities and the legal implications of compliance, non-compliance, documentation and sloppy attention to detail that could result in a lawsuit in a US Federal courtroom. I also focus on product safety and the steps necessary to create a safe product. If you have questions regarding CE Marking lawsuits or medical device regulatory oversight you can contact me for a free preliminary consultation at my e-mail address jameskolka@gmail.com.  

Notified Bodies And CE Marking – Potential Legal Issues In US Lawsuits #3

Continuation

I want to return to the issue of Notified Bodies and the problem with silicon breast implants in the EU. As noted in my two previous blogs, I have observed various problems with Notified Bodies and CE Marking clients over time. Medical devices present a more complex regulatory dimension for CE Marking. In the US, FDA regulates medical devices using its Quality System Regulation (QSR) for medical device design and manufacturing. While FDA employs a quality management system similar to the EU’s ISO 13485, FDA oversight is far more rigorous and intensive with an ability to impose a range of legal sanctions from Warning Letters to Civil and Criminal penalties. Further, FDA can issue a Federal Consent Decree and fines, (e.g. $100 million, $60 million and extended oversight follow up) for the most egregious cases. The key issue is public health and safety.

In the EU, device regulations are not conducted by member state Competent National Authorities, instead they are conducted by one of the 70 approved for-profit Notified Bodies that must be approved by one of the EU’s 27 Competent National Authorities (called competent bodies) to act as a Notified Body for one of the three Medical Devices Directives. Consequently, member states are removed from direct legal enforcement of medical device regulations and hampered in their ability to oversee medical device failures. There is no comparable enforcement structure to FDA.

In the US all medical device manufacturers must have a FDA compliant QSR quality management system. Unless a company wants to manufacture a Class I medical devices not requiring CFR 820.30 design controls it generally must submit a 510(k) to receive FDA approval before manufacturing a medical device or seek Pre Market Approval from FDA and conduct a Clinical Trial to obtain FDA approval before manufacturing a new type of (generally Class III) medical device. FDA has the legal authority to enforce its regulations.

Problems With Notified Body Governmental Oversight

As mentioned in my previous blog, Notified Bodies perform two oversight functions, evaluating and approving medical devices (product safety) and ongoing evaluation of manufacturers’ ISO 13485 Quality Management Systems (process quality). Of the two functions, product quality is the most difficult because of the lack of device experts. To reason that 70 for-profit Notified Bodies can employ 70, 60 or 50 device experts for hundreds of different medical devices in multiple offices around the world isn’t credible. Consequently, the dearth of available device experts will continue to negatively affect the quality of medical devices being manufactured.

As a result, most Notified Bodies focus on the quality management system, ISO 13485 and process quality. The certification audit and surveillance audits operate much like ISO 9001 certification and surveillance audits except that the requirements of the relevant Medical Device Directive are incorporated into the ISO 13485 Quality Management System. Likewise the type of Medical Device(s) will be central to the QMS.

As noted in my previous blog, the quality of Notified Body QMS oversight isn’t always as rigorous as it should be, certainly not as rigorous as an FDA plant inspection. No Notified Body has issued anything comparable to FDA’s QSIT (Quality System Inspection Technique) setting forth the procedure and questions a manufacturer should expect and be able to answer when FDA conducts an on-site inspection of a manufacturing plant. AdvaMed – Advanced Technology Association has developed papers, Different Points to Consider When Preparing For An FDA Inspection for different QSIT Subsystems. There is no comparable preparation for an audit by a Notified Body.

This is not to say that audits by Notified Bodies are treated lightly by medical device manufacturers rather it speaks to the legal authority of an FDA audit when compared to the legal authority of Notified Body audits. In addition to the audit example described in my previous blog where a Notified Body wrote good observations for a Class III medical device manufacturer but failed to issue non-conformities, did not serve their client well. Whether this was done to placate a client to retain their business isn’t clear. What it did accomplish was to prompt their client to ask me if I thought they would survive an FDA site inspection, to which I said no. 

In contrast, FDA at the very least would have issued a Warning Letter and might even have shut down the facility until major changes were implemented. This is not the only case where I have observed a Notified Body conduct an “audit-lite.” A few other examples are listed below:

• A colleague and I spent two days at a medical device manufacturer’s only US CE Marking plant in Arizona while conducting a GAP Analysis for the manufacturer. They wanted to extend CE Marking capability to all of their US manufacturing plants and asked if we could evaluate their Arizona operation. When we arrived at the plant we asked to examine their Technical Files for medical devices being manufactured at the Arizona plant. To which the plant manager responded, “What’s a Technical File?” Following this exchange we proceeded to conduct our audit. We found storage of medical devices in a warehouse lacking heating and cooling was having a serious adverse effect on device quality. We also found boxes containing devices that were marked with the corporate address 1000 miles away, but not the address of the plant in Arizona that was CE Marking the devices. Several more problems were found. We recommended that they identify the unique features of each QMS, but integrate their QSR and ISO 13485 Quality Management Systems for greater control in the future.

• I recently received a call from a Medical Device Manufacturer in Atlanta asking if I could meet them at their corporate office for consultation. They had just been told by their Notified Body that they received two major non-conformances on their most recent surveillance audit and had one month to make the necessary correction or they could no longer CE Mark their medical devices. The quality and regulatory managers flew in from the manufacturing plant in question with the surveillance audit report. The managers were shocked because this was their fifth surveillance audit report and previously they had not received any non-conformances. Nothing had changed in their manufacturing operation. The Notified Body informed them that their Competent National Authority (competent body) had just completed a review of all of their audits and found problems with their findings. The Notified Body was informed that they had to meet with all of their clients and inform of these changes and the reason for the changes or the Notified Body would be stripped of its CE Marking authority. Fortunately, my client was able to make the necessary corrections and continue CE Marking their medical devices.

• In another case I visited another manufacturing client in California at the request of their medical device insurance company to examine their Quality Management System and complaint handling system. The manufacturer had experienced some difficulties and wanted a legal perspective on corrective steps that might be taken. The quality manager mentioned that they had a recent surveillance audit from their Notified Body. (The manufacturer made radioactive plates for Magnetic Resonance Imaging machines.) They were surprised that the Notified Body device expert seemed to be afraid of entering the manufacturing area for fear of exposure to radiation. They weren’t convinced that he was much of an expert. The company has dealt with many experts in radioactive devices throughout their operation.

These are not idiosyncratic observations. While I have worked with several exceptional Notified Bodies administering CE Marking regulatory oversight for the EU Medical Devices Directives, they too have experienced glitches and these have been corrected when discovered. Clearly, strong Competent Body oversight is vital to the process. 

As mentioned previously there also are Notified Bodies more motivated by making money than quality medical device regulatory oversight. A colleague of mine encountered one such Notified Body a few years ago when working with a company that manufactured active implantable medical devices. He helped the manufacturer meet with the FDA regional office and review their quality management system. He was then asked by the manufacturer if he would review their most recent Notified Body surveillance audit, which he did. They asked his opinion and he said it was inadequate, which angered the Notified Body.

He subsequently learned that the company, however, was not fully candid with him, the FDA and the Notified Body. Not only were there manufacturing problems, four people had died from their implants and several others were experiencing serious problems with the device. FDA took action and several product liability lawsuits followed.

Had plaintiffs’ attorneys realized the role of the Notified Body in CE Marking these devices they could have sought Technical Files, ISO 13485 records, documents and notified body Certification Audits and Surveillance Audits in discovery to see what additional useful information could be obtained for use in the lawsuits. Notified Bodies are not exempt from US lawsuits. Further, the Notified Bodies could have been sued directly if their regulatory behavior could be partially attributed to device failures. The irony here is that the notified Body never realized how close they came to becoming a part of the lawsuits.

Observation – Privatized Oversight

The concept of privatized regulatory oversight is not unique. However, fragmented regulatory oversight involving 27 different Competent National Authorities (Competent Bodies) of different size, expertise and financial capability overseeing 70 Notified Bodies operating on their behalf is unique and extremely cumbersome. Until the structure is corrected, problems will continue to arise. The Friday January 27, 2012 issue of the New York Times contains an article about the breast implant manufacturer Poly Implants Prothèses, the founder Jean-Claude Mas and the apparently undetected use of industrial grade silicon in place of medical grade silicon.

The problem now is the immediate solution and the long-term solution. I understand the desire to create a strong EU structure while preserving national sovereignty. My political science and legal training tells me that it is possible, not easy but possible. I would be happy to help. 

My next blog will conclude this series and specifically address the problem with the silicon breast implants and prospective solutions. My focus on International Regulatory Compliance has always included both the requirements of regulatory authorities and the legal implications of compliance, non-compliance, documentation and sloppy attention to detail that could result in a lawsuit in a US Federal courtroom. I also focus on product safety and the steps necessary to create a safe product. If you have questions regarding CE Marking lawsuits you can contact me for a free preliminary consultation at my e-mail address jameskolka@gmail.com. 

Notified Bodies And CE Marking – Potential Legal Issues In US Lawsuits #2

Introduction 

The preceding Blog reviewed the Minimum criteria to be taken into account by Member States for the notification bodies set forth in Annex XI of the 2006/42/EC Machinery Directive. I want to revisit the criteria to consider how they might come into play in a lawsuit. Several issues need to be kept in mind when dealing with notified bodies in lawsuits. To begin, notification varies for each directive. Therefore, it is critical to know what notification means for the Directive or Directives relative to a particular lawsuit and the role of notified bodies vis-à-vis your client.

Not All Notified Bodies Play According To The Rules

You must be aware that not all notified bodies behave ethically concerning their notified status. I have encountered notified bodies implying that their services are officially sanctioned (i.e., notified) by a Member State Competent National Authority to the European Commission for a Directive, such as the Machinery Directive, when in fact they are acting as consultants. This has been especially true for the Machinery Directive, where notification is confined to Annex IV of the Directive. Everything outside of Annex IV, is consulting with no official sanction by a Member State Competent National Authority. 

I mentioned previously an instance in 2003 where a Dutch Notified Body issued two EC Type Examination Certificates for machines a manufacturer wanted to CE Mark for the EU. They also issued a paper stating that other machines couldn’t be CE marked until certain steps were taken. Since none of these machines were listed in Annex IV, the issuance of the CE Type Examination Certificates was outside the legal authority of the notified body. The statements on the other machines were not identified as comments by a consulting body. Instead they were presented as the authoritative judgments of a governmentally recognized notified body. To accomplish these tasks the Dutch notified body sent a team to the US to conduct their work at great expense to my client.

Clearly, the notified body was aware that their American Clients didn’t understand CE Marking or the legal requirements of the Machinery Directive. I informed my client that their two EC Type Examination Certificates were worthless and had no standing in EU law or US law, however, if something happened where the certificates would be important in a lawsuit, the notified body could be sued for fraud. 

Since I had been working with representatives in the UK’s Department of Trade and Industry DTI (now the Department for Business, Enterprise and Skills BIS) on other projects, I asked them for help in contacting the Dutch Competent National Authority to complain about the behavior of the Dutch notified body. DTI tried for several months to contact the Dutch Competent National Authority and received no response.

They suggested that I should try to make contact directly and see if I fared any better. I wrote e-mails for several months to the Dutch Competent National Authority and even wrote directly to the head of the Dutch Competent National Authority and received no response. Finally, I transmitted my long train of e-mails to DTI & the Dutch to EU Commissioner Liikanen chief administrator of the EU Directorate General responsible for Machinery explaining what had transpired. Three weeks later I received a letter on March 23, 2004 from Mr. Fabrizio Sachetti of the Committee on Machinery affirming that our position was correct. They copied the Dutch Competent National Authority and the Dutch notified body of their statement. 

What Is The Operating Structure For Notified Bodies?

• Given the fact that notification varies with each Directive, it is essential that the precise legal authorization for notified bodies be known. It varies widely from Directive to Directive. The most stringent oversight was created for the Medical Devices Directives, however, recently the quality of notified body oversight of the Medical Devices Directive has been called into question concerning failed silicon breast implants in the EU and the French medical device manufacturer PIP (Poly Implant Prothèse). I will return to this case in my next blog.

• Every third party that wants to become a notified body for a new approach Directive must submit their credentials to the Competent National Authority of the country in which they are located. Presumably, each Competent National Authority has the technical expertise to evaluate the ability of the notified body to approve a CE Mark for a medical device and conduct effective continuous oversight of their notified bodies. Clearly, however, not all EU Member State Competent Authorities are equal. France, Germany, the UK, Italy, the Netherlands, Denmark, Ireland, Sweden and Finland have well developed oversight Competent National Authorities and are capable of being effective oversight bodies. Some of the smaller countries will not take on this task. A critical follow-up question is how effective is the oversight of the Member State Competent Authorities by the European Commission?

• Recall the discussion in my previous blog of January 9, 2012 regarding the dual function of many notified bodies concerning product safety and process quality. The dual function is particularly important to the oversight of medical device manufacturers. I have found, however, that some notified bodies address their dual function very well and others have been sloppy. This can be a problem when it comes to medical devices.

• Process Quality: Depending on the device classification, process quality refers to the type of Quality Management System, e.g. ISO 13485 used to assure that the medical devices are manufactured at a consistent quality level. The notified body conducts the certification audit and the surveillance audits to assure that process quality is being maintained. Basically, a medical device manufacturer contracts with a notified body as its "private FDA" for manufacturing medical devices for the EU, whereas in the US medical device manufacturers must follow FDA’s Quality System Regulation (QSR) and are subject to FDA oversight.

• Product safety: Medical device safety in the EU is governed by the classification of a device set forth in the Active Implantable, Medical Devices or In Vitro Diagnostic Directives. Once the classification has been determined, it is necessary to identify which Essential Requirements apply to a device, which EN Standards will allow a manufacturer to demonstrate conformity to the Essential Requirements and finally determine which Conformity Assessment Procedure applies to the manufacturing of a particular medical device.

• A medical device manufacturer in the EU, US, Canada, China, etc. can choose to contract with the notified body of their choice for a particular product, which means that manufacturers can shop around for price, service and convenience. While notified bodies are headquartered in the country where they have been approved, they have offices throughout the world. A fair question is the competence of the notified bodies in a country like China to carry on day-to-day functions as opposed to their US counterparts. I have worked with manufacturers who were not happy with the CE Marking abilities Chinese notified bodies and moved it to the US or EU.

What Are Some Of The Concerns Regarding Notified Bodies?

• Notified bodies must operate in accordance with the rules set forth in the particular Directive for which they have been approved by their Competent National Authority. While it might be obvious, it should be noted that each notification is different for each Directive. Notification for one Directive has nothing to do with another Directive.

• In spite of sincere pledges to create a firewall to prevent a conflict of interest between their official status as a notified body for a Directive and consulting for the same Directive, notified bodies are aware that Americans do not understand these subtleties and believe that consulting by a notified body is officially sanctioned by an EU Member State. A few years ago when I was working on a project with the California Manufacturing Technology Center in Fresno, we submitted a bid to a California packaging machine manufacturer. When we lost the bid, I asked my colleague in Fresno, if we were too high and he said no, the notified body quote was four times higher than ours. The manufacturer was under the impression the notified body was officially sanctioned by the German Government.

• Notified bodies are private for profit organizations. While most conduct themselves in a respectful manner, I am aware from a few former colleagues who have worked on a contract basis that a few notified bodies are rather mercenary with their employees violating criteria number two on the list, The body and its staff shall carry out the verification tests with the highest degree of professional integrity and technical competence and shall be free from all pressures and inducements, particularly financial… Some notified bodies essentially drive their employees to produce quotas or be dismissed, especially when conducting Quality Management System Certification and Surveillance Audits.

• Medical devices pose a special problem when it comes to device expertise. Often it is difficult for them to find and hold onto experts who can evaluate devices because medical device manufacturers will offer better pay to these persons. It speaks well to the quality of their expertise, but it creates a serious device quality and potential safety problem nonetheless.

• Medical Device Quality System oversight is another area where potential problems can arise. A few years ago I worked with a medical device manufacturer of a Class 3 Medical in California who had just completed a surveillance audit from their notified body. They asked if I would review the audit and write an Executive Summary. Their biggest concern was how I thought they would fare when FDA conducted an on site inspection. While it was a good audit, it had no teeth. It made some excellent observations, but it issued no non-conformities. I told my client that I thought they would not survive an FDA and could be shut down. They asked if I would highlight the areas for improvement in my executive summary. I did so and they called six months later to say they passed their FDA inspection with no write up in a FDA 483 Warning Letter.

Conclusion

The preceding are just a few experiences I have encountered working with notified bodies. It isn’t all negative, I have had excellent experience with several notified bodies and enthusiastically recommend their services to my clients. The recent experience with the French silicon breast manufacturer, however, points to areas where improvements are critically necessary. I also want to spend some time discussing notified bodies and potential US Federal Lawsuits since this area is beginning to heat up. Information provided in Technical Files could become fair game for CE Marked medical devices in legal discovery. Finally, I want to compare the European approach to medical device regulation with FDA’s medical device regulatory approach.

My focus on International Regulatory Compliance has always included both the requirements of regulatory authorities and the legal implications of compliance, non-compliance, documentation and sloppy attention to detail that could result in a lawsuit in a US Federal courtroom. I also focus on product safety and the steps necessary to create a safe product. If you have questions regarding CE Marking lawsuits you can contact me for a free preliminary consultation at my e-mail address jameskolka@gmail.com. 

Notified Bodies And CE Marking – Potential Legal Issues In US CE Marking Lawsuits #1

Introduction

I received an e-mail this week asking this question, “Are you aware whether or not the notified bodies in Europe are expected to possess professional indemnity insurance, to cover them in cases of a poor opinion of compliance or failure of post Market surveillance, with thanks for your advice.”

I answered, “Yes, in every new approach Directive there is an Annex that spells out the criteria for notified bodies. For Example, in the 2006/42/EC Machinery Directive, Annex XI sets forth, "Minimum criteria to be taken into account by Member States for the notification of bodies" Paragraph 6 states, "The body shall take out liability insurance unless its liability is assumed by the State in accordance with national law or the Member State itself is directly responsible for the tests."

Notified Body Requirements

The question about notified body “indemnity insurance” raises a number of questions that should be explored concerning the EU legal requirements for notified bodies and their potential legal implications in US courts. The full list is stated below:

Minimum criteria to be taken into account by Member States for the notification bodies 

1. The body, its director and staff responsible for carrying out the verification tests shall not be the designer, manufacturer, supplier, or installer of machines which they inspect, nor the authorized representative of any of these parties. They shall not become involved, either directly or as authorized representatives, in the design, construction, marketing or maintenance of the machines. This does not preclude the possibility of exchanges of technical information between the manufacturer and the body.

2. The body and its staff shall carry out the verification tests with the highest degree of professional integrity and technical competence and shall be free from all pressures and inducements, particularly financial, which might influence their judgments on the results of their inspection, especially from persons or groups with an interest in the result in result of verifications.

3. For each category of machinery for which it is notified, the body must possess personnel with technical knowledge and sufficient and appropriate experience to perform a conformity assessment. It must have the means necessary to complete the technical and administrative tasks connected with the implementation of the checks in an appropriate manner, it must also have access to the equipment necessary for the exceptional checks.

4. The staff responsible for inspection shall have:

-- sound technical knowledge and vocational training,

-- satisfactory knowledge of the requirements of the tests they carry out and adequate experience of such tests,

-- the ability to draw up the certificates, records and reports required to authenticate the performance of the tests.

5. The impartiality of inspection staff shall be guaranteed. The remuneration shall not depend on the number of tests carry out or on the results of such tests.

6. The Body shall take liability insurance unless its liability is assumed by the State in accordance with national law, or the Member State itself is directly responsible for the tests.

7. The staff of the body shall be bound to observe professional secrecy with regard to all information obtained in carrying out its tasks (except vis-à-vis the competent administrative authorities of the State  in which its activities are carried out) under this Directive or any provision of national law giving effect to it.

8. Notified bodies shall participate in coordination activities. They shall also take part directly or be represented in European standardization, or ensure that they know the situation in respect of relevant standards.

9. Member states may take all necessary measures they regard as necessary in order to ensure that, in the event of cessation of the activities of a notified body, the files of its customers are sent to another body or are made available to the Member State which has notified it.

Notified Bodies 

Notified bodies are created by each New Approach Directive.  The criteria are established by each Directive.  Notification may be to a specific clause, such as Annex IV of the Machinery Directive dealing with dangerous machines, which is the only clause to which a body may be notified for that Directive. Notification also may be confined to those clauses for which it has technical competence or it may extend to all of the clauses of a directive.  The decision belongs to Competent National Authorities who use the EN 45000 series to evaluate notified bodies. When a Competent National Authority approves one of their third parties for a Directive, they “notify” the European Commission. The Commission periodically publishes the list of notified bodies in The Official Journal of the European Communities.

Product Safety and Process Quality--Two Elements of CE Marking A Product 

In his preface to The Guide to the Implementation of Community Harmonization Directives Based on the New Approach and the Global Approach, Brussels, 1995, Vice President of the European Commission, Martin Bangeman stated the following:

The novelty of this new approach resides essentially in the use of community technical rules of “quality instruments” such as European Standardization and conformity assessment procedures (testing, product certification, certification of manufacturers’ quality control procedures, accreditation, etc.).  These instruments, drawn up on the basis of consensus of all the economic partners involved, enable manufacturers to affix the CE marking--a real “technical passport”--to their industrial products, which must conform to these community directives.

Considered one of the architects of the new approach, vice president Bangeman’s quote deserves some attention.  To begin, when he talks about a “consensus of all the economic partners involved” he is referring to the fact that the CEN, CENELEC and ETSI working groups that draft EN safety standards are comprised of manufacturer representatives, representatives of Member State standards organizations (e.g., BSI, DIN, AFNOR, etc.), testing laboratories, academic faculty and in some cases consumer representatives.  While Member State standards organizations direct working group schedules, there is a conviction that the affected parties are participating in writing the standards.

The reference to “quality instruments” such as European standardization and conformity assessment procedures points to two aspects of virtually all new approach directives.  One aspect is the element of product safety. The technical file referred to in most directives contains a checklist of the directive’s essential safety requirements and the EN harmonized safety standards and/or the tests performed and approvals granted which a manufacturer has used to demonstrate conformity to the Directive’s essential safety requirements.  Generally, among those tests will be an application of the principles of safety integration applied to the product in question and a risk assessment. The technical file should demonstrate and record the companies’ efforts to achieve an acceptable level of product safety.

The second aspect is the element of process quality. Once an acceptable level of product safety has been built into a product, the manufacturing process must be able to assure consistent quality so that products number 5, 905, and 20,005 are of consistent and dependable quality. This dual objective of achieving acceptable product safety and consistent process quality will be familiar to manufacturers of regulated products such as medical devices using ISO 13485, and ISO 9001 for manufacturers of products covered by other Directives.

Conclusion

Notified bodies play an integral role in New Approach Directives such as the Medical Devices Directives and variable role in other New Approach Directives, e.g. except for Annex IV of the Machinery Directive where notified body involvement is required, manufacturers self-certify to the requirements of the Directive.

The areas where third parties are “notified” varies for each Directive. Since Notified Bodies (along with ISO 9001 Registrars) will increasingly become involved in CE Marking lawsuits in US Federal Courts, I want to examine notified body involvement and behavior since the beginning of CE Marking products and identify areas where notified body involvement in US lawsuits should be anticipated.

My focus on International Regulatory Compliance has always included both the requirements of regulatory authorities and the legal implications of compliance, non-compliance, documentation and sloppy attention to detail that could result in a lawsuit in a US Federal courtroom. I also focus on product safety and the steps necessary to create a safe product. If you have questions regarding CE Marking lawsuits you can contact me for a free preliminary consultation at my e-mail address jameskolka@gmail.com.  

CE Marking Lawsuits – Applying Forensic Law To Evidence & Discovery

Introduction

As I mentioned in my previous Blog, US Federal Courts – The New Venue For CE Marking Lawsuits, posted on November 30, 2011, we can expect to see an increasing number of CE Marking lawsuits in US Federal Courts. The rationale for the increased number of lawsuits is spelled out in the Blog. I have previously mentioned that I am serving as legal expert in three such lawsuits in US Federal Courts. The earliest lawsuit is nearing completion and appears to have met with success in translating European EN Safety Standards and EU Directive Essential Safety Requirements in a US courtroom. The other two lawsuits are still underway. I also mentioned having served as legal expert in lawsuits involving ISO 9001. These have been settled out of court, however, based on some recent inquiries I anticipate more such lawsuits in the future.

The purpose of today’s Blog is to revisit a few of the previous observations and amplify the points being made. I noted previously that US litigation attorneys often proceed in a somewhat routine fashion not fully understanding the different product safety requirements of EU New Approach Safety Directives and EN safety standards. Also as noted, I have seen botched discovery requests and frustrated Judges regarding ISO 9001 records and document requests in discovery. 

New Territory

This area, CE Marking New Approach Safety Directives, often intermingled with a quality management system, such as ISO 9001 is new territory that requires competent legal understanding if litigation attorneys and defense counsel hope to succeed on behalf of their respective clients.

To begin there are 27 New Approach Safety Directives, drafted at different times. Several are in various states of revision and new Directive combinations. These Directives affect approximately 65% of products entering the EU. They range from Directives addressing Machinery Safety, Medical Devices (General, Active Implantable, In Vitro Diagnostic), Toy Safety, Low Voltage, Electromagnetic Compatibility, Pressure Equipment, Equipment and Protective Systems in Potentially Explosive Atmospheres (ATEX), Construction Products, Personal Protective Equipment, Radio and Telecommunications Terminal Equipment to mention some of the more prominent Directives. 

Each Directive also has Essential Safety Requirements and EN standards that allow for demonstration of conformity to the Directive’s essential safety requirements. There are thousands of standards that are reviewed every 5 to 7 years to consider whether they should be maintained in their present state, revised or eliminated. As noted in the prior Blog, the revision of these standards is now coordinated between the EU Standards Bodies, CEN, CENELEC and ETSI and ISO and IEC to improve the revision process and invite EU standards expertise into these considerations. Also participating in ISO and IEC deliberations on behalf of United States is the American National Standards Institute (ANSI). Consequently, these revised standards will become both American and EU standards. Therefore, the time when a product is manufactured could determine if a standard in question was also an American Standard, if that issue is relevant to a lawsuit.

Also, depending on the Directive or Directives in question and the nature and safety of a product, a company might have chosen what the Europeans call a Conformity Assessment Procedure to assure that the product is manufactured at a consistent quality level. In these cases, third parties which the Europeans call “Notified Bodies” will be involved in the product compliance process. Therefore, notified body records, often including ISO 9001 Quality Management System documents and records could be involved.

It is critical for litigation attorneys and defense counsel to understand how these safety standards are applied and how this information could critically impact a lawsuit affecting their clients. Sophomoric American assumptions could adversely affect the outcome of a lawsuit. 

Timing

As noted in my previous Blog, timing is critical to understanding the relevant facts concerning a lawsuit. It is important to know when a product is manufactured in order to determine the legal status of a Directive, e.g. whether or not it had been revised at the time of design and manufacture, and it is important to know which standards apply to a product. If a Conformity Assessment Procedure was involved and a Notified Body also was involved, certification audits and surveillance audits could become important to the disposition of a lawsuit. Likewise, it is important to know how many Directives might be involved in the manufacture of a product.

For example, I have worked with machinery manufacturers whose machines had to comply with the Machinery Directive, Low Voltage Directive, Electromagnetic Compatibility Directive, Pressure Equipment Directive and the Explosive Atmospheres Directive. Therefore the requirements of each directive and the standards necessary to comply with the requirements of each directive need to be examined. Likewise, it is critical to know what requirements were in place when the product was manufactured. Of course, attorneys will want to know how this all might be litigated in a US Federal Court. 

Observation

In previous Blogs where the topic was a malfunctioning product such as machine, specific compliance with the requirements of these New Approach Safety Directives can be examined to see if the company actually attempted to satisfy the requirements of the Directives and the relevant standards. In one case presently being litigated in a US Federal Court, it was clear that the company, a US machinery manufacturer, did not create a Technical File containing all of the steps required by the manufacturer to comply with the Directive. The file also contained no risk assessment standard and risk assessment judgments.  Further, after two accidents that killed one worker in the EU and maimed another worker in the US who will require 24 medical care for the rest of his life, it was clear that the company did not comply with the safety requirements of the directive and this failure caused both accidents. 

Forensic Law   

In order to address these cases and effectively use this information in a US Federal Court, it is necessary how these Directives and their Standards interplay and the status of each at the time the machine in question was designed and manufactured. Simple assumptions will not work. Knowing when critical components were manufactured also is important as well as the date that the product itself is manufactured. Knowing how the EU directives and standards work is different, but it can be successfully tackled and lawsuits can be won.

I first encountered the term “forensic” when I received a call several years ago from young man was working with a law firm applying the requirements of ISO 9001 and ISO 9004 to some product failure cases in Atlanta. I asked what his background was and he said he was a forensic engineer. 

Since then, and in a totally different application in California involving a product that was causing a medical device manufacturer to experience manufacturing difficulties with diabetic test trips, I was asked to determine if a supplier had failed to follow requirements of its ISO 9001 Quality Management System and if that failure caused the test strip difficulties. It did. I also was working with a forensic accounting firm who were determining if the financial loss calculated by the manufacturer was accurate. It was. 

The term forensic applies equally to the law and litigation. Attorneys continually attempt to dissect products and events to understand what happened and apply this knowledge on behalf of their clients. In the case of the 27 EU New Approach Safety Directives and thousands of EN harmonized safety standards the forensic analysis is complex, but doable. The biggest problem I have observed are US attorneys who transmogrify an EU legal issue into a more familiar American setting thereby mutilating the critical issues and facts affecting their clients.  

Conclusion

To successfully tackle a CE Marking lawsuit, it is necessary to apply forensic analysis to the Directives and Standards that apply to a case. As noted in my prior Blog, while it can be hard breaking litigation and defense attorneys of some bad habits and reining in their egos, it is to their advantage to approach a lawsuit having all of their facts in order and achieving the best possible result for their client. Fortunately, I’ve worked with several attorneys who have achieved this objective and prevailed on behalf of their clients.

My focus on International Regulatory Compliance has always included both the requirements of regulatory authorities and the legal implications of compliance, non-compliance, documentation and sloppy attention to detail that could result in a lawsuit in a Federal or State courtroom. I also focus on product safety and the steps necessary to create a safe product. If you have questions concerning EU Directives and Standards and product liability litigation, you can contact me for a free preliminary consultation at my new e-mail address jameskolka@gmail.com.

ISO 9001& ISO 9004: A Framework for Disaster Preparedness Revisited #4

Before Disaster Planning – Vesuvius, Pompeii & Herculaneum 79 AD  

On August 24, 79 AD, the Roman Historian, Pliny the Younger was awakened by his mother to look at a huge cloud in the sky. “A cloud was forming over Vesuvius which looked very-much like a pine-tree. In fact it stretched upward like the trunk of a tall tree and then branched out wide.”(The picture above is such a pine-tree on the Amalfi Coast overlooking the Mediterranean, 40 miles South of Vesuvius.)   

Political and Cultural Problems with Disaster Planning  

I was raised in Eau Claire, Wisconsin where the Eau Claire River flows into the Chippewa, River. It is a former lumber town founded in 1856. By1885 the town contained 32 lumber mills and sawed 800 million board feet of lumber, the largest lumber town in the world at that time. The mills were fed by logs brought by train from as far away as Lake Superior, 250 miles distant. By 1917 the last log was sawed and the last lumber mill was shut down. The lumber industry moved West.

A by product of the two rivers merging and low lying areas of the town around the original mill sites was frequent flooding that occurred in the Spring when the snow melt swelled the rivers beyond their banks.   My father, Henry W. Kolka, who was a Professor of Geography and Chair of the Geography Department at the State University in Eau Claire, recommended that the city consider relocating houses from low lying areas to higher ground and clearing the flood prone areas to create City Parkland which would be relatively unaffected by periodic flooding. The city fathers were appalled at such a suggestion. In their minds it bordered on socialism. My father countered that spending money to constantly clean up flooded homes was a wasteful use of public funds. Many years later, however, the recommendation was adopted.  

Several years later, when I was a new faculty member at the University of Wisconsin-Green Bay and a member of an interdisciplinary research team studying a lake watershed in Northeastern Wisconsin, we made a similar recommendation about the County swapping high land for marshland and met with a similar response. (This example will be addressed at length in future environmental blogs.)

Both of these incidents are minor disasters and both underscore a critical problem in disaster planning – political structures and cultural perceptions. The political entity (City, County, State, Federal Government) has to be large enough to effectively address a problem and cultural perceptions have to be able to grasp potential solutions to a problem. The shopworn phrase, “Think Outside the Box.” runs up against another shopworn phrase, “If it ain’t broke, don’t fix it.” Neither phrase is useful when confronting a potential disaster.

Political, Ideological and Geographic Problems with Disaster Planning

While political boundaries are artificial human constructs, they are real boundaries when it comes to disaster planning. In addition to political systems planning for a potential disaster, these artificial human constructs are not well prepared to handle diverse geographic issues such as a River like the Mississippi which flows through several Cities and States to the Gulf of Mexico. As a navigable river it also is subject to the jurisdiction of the federal government. The Mississippi River has flooded several times throughout its history of human habitation.  

Therefore, a disaster preparedness solution must include these different political entities in the planning process. Add to the mix, the Army Corps of Engineers that regulates the flow of the river for barge navigation via a complex system of locks and you have a diverse political stew attempting to solve a common problem from very different political and geographic perspectives. 

The most recent Great Flood on the Mississippi occurred in 1993 causing $15+ billion dollars of damage in 10 States. Prior great Floods occurred in 1844, 1927, 1951 and 1973. As in the example of Eau Claire, cities along the Mississippi were settled when transportation was by water. Consequently, low-lying cities on the waters edge have flooded numerous times. Finally, after the 1993 flood several cities opted to move to higher ground in Illinois and avoid another flood in the future.

Hurricane Katrina  

The most striking example of a failure in disaster planning and disaster preparedness in the United States was Hurricane Katrina in August 2005. No political entity – the City of New Orleans, the States of Louisiana, Mississippi, Alabama, Florida and the Cities, Parishes and Counties along the Gulf Coast were prepared for the catastrophe, least of all the US Government which kept calling it a State or City problem.

It was a pathetic breakdown in any kind of planning and an absence of a useful emergency response plan. FEMA (Federal Emergency Management Authority) proved to be inept and slow, preferring to blame the States and City of New Orleans. Once the President focused he did not intervene to address the situation in a timely fashion. There were 1,836 persons confirmed dead and 705 missing. The damage has been calculated at $90.9 billion (2009) dollars, the worst natural catastrophe in US history.  

On November 18, 2009, US District Court Judge Stanwood Duval ruled that the Army Corps of Engineers failure to properly maintain the Mississippi River Canal Outlet (MRGO), linking New Orleans, Louisiana to the Gulf of Mexico led to catastrophic flooding during Hurricane Katrina.

“   It is the court’s opinion that the negligence of the Corps, in this instance by failing to maintain the MRGO property, was not policy, but insouciance, myopia and short-sightedness.” “For over 40 years the Corps was aware that the Reach II levee protecting Chalmette and the Lower Ninth Ward was going to be comprised by the continued deterioration of the MRGO…The Corps had an opportunity to take a myriad of actions to alleviate this deterioration or rehabilitate the deterioration and failed to do so. Clearly, the expression ‘talk is cheap’ applies here.”   

Who Is Responsible For Disaster Preparedness?  

Unfortunately, this is the key question, amplified by the inept political response to Hurricane Katrina – no one appeared to be in charge and fingers pointed in all directions while a city and its people were in desperate condition. The world looked on and couldn’t believe that such a calamity could happen in America. It looked more like a developing country that lacked the political structure and resources to address such a crisis. There were even debates about the proper role of government.  

Since the Federal Government is the only political entity that governs the entire region and is responsible (via the Army Corps of Engineers) for maintaining the Mississippi River Canal Outlet, it should take the lead in working with the states and cities in addressing the crisis so that it isn’t repeated in the future, but isn’t clear if disaster preparedness planning is happening now in any coherent way. I am quite certain that the EU would be far more aggressive in disaster preparedness planning if faced with a similar crisis. Infrastructure development is far more advanced in he EU and its member states than in the US.  

Blog number #5 will address other types of disasters and what is being done to address disaster preparedness in those areas. It also will draw upon ISO 9001 & ISO 9004 to provide an enhanced framework for disaster preparedness. If you have disaster preparedness concerns, you can contact me for a free preliminary discussion at theguide1@comcast.net.  

Ostomy Appliances & FDA’s QSR – A Case Study

 

Shortly after FDA’s Quality System Regulation went into affect, I received a call from a medical device manufacturer in Central Connecticut that manufactured rubber Ostomy appliances. They were aware of FDA’s QSR and wanted help in preparing to meet the new requirements. The first step was to conduct a GAP Analysis to determine where they were and what would need to be done to bring the company into compliance.

The company was started by the owner’s father in his garage in Brooklyn, New York and subsequently moved to a building they constructed in rural Connecticut. It was a nice facility with ample space for expansion. The particular type of Ostomy appliances they manufactured were made from rubber, rather than latex or plastic and were made to physicians’ specifications for their patients.

The GAP Analysis revealed not only that they had no quality system in place, but that the manufacturing operation was casual to say the least. For example, I asked what type of system they had for determining the size of the ostomy appliance. The owner said that Margaret was responsible for assembling the pieces of the appliance. When asked how this was done she walked over to a wall on which hung multiple flat wooden forms in multiple shapes and took one down for me to inspect. The form was then placed on a rubber sheet onto which a pattern was drawn that would be used to cut both sides of the bag.

The owner said that Margaret worked four days a week cutting out forms. I asked if there was a written procedure for receiving orders, determining the size, drawing the pattern and cutting the sides of the bags. He said no, it was entirely within Margaret’s hands and she was the only employee with that responsibility. I said, I don’t mean to be impolite, but what would happen if Margaret was hit by a Mack Truck and incapacitated, what would you do? He seemed alarmed at the question. I then asked if we could have Margaret write down each step of her operation so that we could create a procedure for their new quality management system. First, it would be necessary to create a standard operating procedure SOP to satisfy FDA’s Quality System Regulation and follow that procedure. Margaret said she would be glad to write down the steps and did an excellent job of writing a standard operating procedure for her operation.

I asked what happened next in the manufacturing operation and the owner walked over to a bank of autoclaves into which the assembled Ostomy appliances were placed and heated to temper the rubber and achieve a solid seal. He identified how long the appliances were heated in the autoclaves. I asked about the calibration cycle for the autoclaves and he looked puzzled. I asked how do you know if they are performing according to their manufacturer’s requirements? He said we don’t calibrate the autoclaves, should we? To which I responded yes and suggested that he contact the autoclave manufacturer to ask for calibration instructions and then create SOPs for both the calibration of and use of the autoclaves.

The rest of the visit to the plant continued in a similar fashion. There was no order to their operation and clearly no system in place. I was amazed that they had not been inspected by FDA for 20 years, since their move to Connecticut. Meanwhile, the owner’s father had died and he was now the sole source of management. It took some time for them to create a functioning quality management system that would satisfy FDA’s QSR requirements. I suggested that they also consider certifying to ISO 9001 to develop some rigor in their system and use internal audits and registrar audits as a check on their compliance (this was before ISO 13485). Otherwise, an FDA plant inspection could be a rude awakening resulting in multiple write-ups on a 483 letter from FDA. Over time their quality management system was put into place.

Observation

This wasn’t the first time that I visited a medical device company where news of FDA’s Quality System Regulation was a surprise. I have discussed other visits in earlier blogs. Quite often, these manufacturers had grown accustomed to the prior cGMPs and did not understand the quality management system structure and rigor of the QSR. In most cases these were small companies that were not certified to ISO 9001. Consequently, the new structure came as a surprise, if not a shock.

Another anomaly are those companies that manufacture a non-measuring, non-sterile Class I medical device and are able to self certify to the EU Medical Devices Directive. Since these manufacturers will not be visited by an EU notified body, they don't need an ISO 9001 (now ISO 13485) QMS. When told, however, that they will need a QMS to satisfy FDA's Quality System regulation, they are surprised

If you have any product liability and risk assessment concerns regarding FDA and EU regulation of medical devices, you can contact me for a free preliminary consultation at theguide1@comcast.net

CE Marking Training and Consulting for the Machinery & Medical Devices Directives

In previous blogs I have mentioned working with the California Manufacturing Technology Center (CMTC) during its start up phase. My role was to train their people on CE Marking for the Machinery & Medical Devices Directives and work with various field offices and their clients. Initially, I met with managers in their Hawthorne Headquarters in Los Angeles and then met with interested manufacturers in Long Beach and Ventura. Next I conducted a two-day training session on the EU Machinery and Medical Devices Directives at Loyola Marymount University in West Los Angeles.

Shortly after the preliminary visit I returned to California in March after first working with a Machinery Manufacturer in Buffalo, NY (where it was warm) via Chicago to meet with National Marine Manufacturers Association on a project (where it was chilly) to California (where it was pouring rain) in Ontario, Burbank and Fresno to meet with CMTC staff and interested manufacturers. I only mention the weather because it was a striking contrast to what one would normally find in New York and California at that time of year. The people were interested in CE Marking at all three sites, which resulted in follow-up meetings described in previous blogs.

It was an interesting approach to CE Marking that was being replicated in others states such as New York, where I had given an earlier presentation on CE Marking in Poughkeepsie. Because California and New York did not have a public technical assistance program, they created their own programs using some federal money, state money and charges for services rendered to create a non-profit technical effort to help businesses develop technical capabilities, including the ability to export their goods. CMTC offered assistance for ISO 9001 Quality Management Systems, ISO 14001 Environmental Management Systems, compliance with FDA’s Quality System Regulation and CE Marking products for EU new approach directives such as Machinery, Medical Devices, EMC, Low Voltage and Toy Safety. Working with various CMTC Centers we put together proposals for manufacturers wanting to ship products into the EU. Today, CMTC is known as California Manufacturing Technology Consulting.

The technical delivery system in Georgia is older and more established. Georgia Tech was created by the legislature in 1885 with a desire to build a manufacturing base in the State. The idea of creating Engineering Experiment Stations (EES) was initiated in1919, anticipating federal funding that never materialized. In 1934 EES (now the Georgia Research Institute) opened at Tech with a budget of $5,000 using no federal funds. In 1946 EES used matching state funds for regional economic analysis to identify opportunities for new industry. In 1956, the Industrial Development Branch (IDB) of EES was formed – the first time there was a specific budget for industrial development research at EES. In 1960 the Georgia Assembly passed a bill replacing the 1919 EES legislation and creating an Industrial Extension Service (IES) providing technical assistance to industries.

In 1985 EES became the Georgia Tech Research Institute (GTRI) In 1994, with funding from the Georgia General Assembly to support consortia, academia and government and federal funding, the Georgia Manufacturing Extension Alliance (GMEA) was created and expanded to 18 offices statewide. Georgia is one of 14 states with an Industrial Extension Program. Conceptually, the programs operate similar to the Agricultural Extension Programs created by Federal Morrrill Acts of 1862 and 1890 for Land Grant Universities.

In Georgia as in other states that aspired to improve their industrial base, the effort to create an Industrial Extension Program was considered essential to growth. Historically, Georgia Tech has had a profound effect on the economy of the state. Healthdyne and Scientific Atlanta (now a division of Cisco Systems) are just a few of the industries that started either in a lab at Georgia Tech and/or by a Georgia Tech grad. I first began to teach CE Marking for the Machinery and Medical Devices Directives at Georgia Tech in 1992

In recent years Georgia Tech has nurtured one of the more successful federally funded Centers for Business, Education and Research (CIBER) in their College of Management and in 2008 was awarded a European Union Center of Excellence (EUCE) by the European Commission. I continues to serve on the advisory committee for CIBER, give guest lectures on campus and work with the new European Union Center of Excellence.

 

If you have questions regarding CE Marking to the Medical Devices Directive, Machinery directive and related Directives, you can contact me for a free preliminary consultation at theguide1@comcast.net

 

EU Machinery Directive – EU Regulatory Enforcement vs US Market Enforcement

This may seem to be an odd title for a blog, but it is a topic I have discussed in articles, papers and presentations for a number of years. It is a topic that should be of concern to all companies placing CE Marked machinery on the EU market, and all companies placing CE Marked and non CE Marked machinery on the US market.

EU Enforcement

The term “regulatory enforcement” is not the preferred term in the EU, instead they use “market surveillance” to describe their process of enforcement. Whatever the preferred term, my own experience with Machinery Directive enforcement has been mixed. As mentioned in an earlier blog, a few years ago I worked with a manufacturer of machinery that had been visited by a notified body that flew in from the Netherlands to issue EC Type Examination Certificates to two machines that were not classified dangerous under Annex IV (dangerous machines) of the Directive and therefore could not receive such certificates. Further, they issued pronouncements on several other machines declaring that they could not be CE Marked without additional changes.

While the Dutch notified body stated that the company’s two Technical Files were satisfactory and therefore a CE Mark could be affixed to the machines, there was no Risk Assessment in either file. Further, these were machines subject to self-certification. The notified body had no authority to grant CE Marking to the company. Their notification was confined to Annex IV.  Naturally, the notified body collected a good amount of money and depended on the ignorance of Americans and American companies about the new EU CE Marking legislation.

It wasn’t the first time I encountered this sort of shell game. Shortly after completing my second book on the Machinery Directive, I received a telephone call from a machinery manufacturer in South Georgia who asked for a quote from an English EMC test lab in the Atlanta area and was told it would cost $16,000 to CE Mark his machine. When I asked him to review the quote, except for EMC testing, the remainder of the quote covered work that he could have done himself. Further, the EMC testing appeared to be open-ended. I gave him the name of a Chicago EMC lab and they gave him instructions on how to go about testing his existing machinery for electromagnetic compatibility. Following their instructions, he discovered that his existing motor would never satisfy EMC testing. He also realized that the Atlanta lab was going to test him several times before informing him that he would need a new motor. Needless to say, he self certified and found a CE marked motor that would satisfy EMC requirements.

A few years later when working with the California Manufacturing Technology Center (CMTC) in Fresno, we received word from a company that had requested a quote that they were going to sign with a German notified body. When I asked if our quote was high, the CMTC representative said no, in fact their quote was 75% higher than our quote. The owner, however, was led to believe that the German notified body had some official status in regard to the Machinery Directive when in fact they were simply acting as a consultant, but implying they had official sanction from the German government to do this work.

I have recited this rather long description of three notified bodies because it illustrates one aspect of the EU regulatory process in regard to CE marking. Each directive is different and the notification of third parties and their official status is different for each directive. Consequently, unless the American company knows this they are ripe for whatever chicanery or sleight-of-hand is used to obtain their business. Further, the outside of EU behavior of “notified bodies” is not scrutinized well, if at all, by their government competent authorities.

Since each of the 27 EU member states oversees their own 3rd parties and notifies the commission of the approved 3rd parties, it is a big task and a major enforcement failure of the EU regulatory process. Further, while “notified bodies” are approved by a governmental authority they are “for-profit” entities and often quite mercenary in pushing their employees to bring in money quickly and firing those who don’t perform. Not a model of quasi-government integrity.

To return to the Dutch notified body discussed earlier, I contacted the UK Department of Trade and Industry (DTI) and ask for their assistance. After three months, the representative from DTI said he received no response from the Dutch competent authority and suggested that I try to contact them myself. After three months of no response, I contacted the European Commissioner in charge of this area and received a response within three weeks copying both the Dutch government and the Dutch third party stating that I was correct and that the certificates were not legitimate.

The problem for the American machinery company was the assumption that the certificates had some legal status that could be used in an American court of law should it be necessary. In fact, they were bogus. Whether the Dutch notified body knew or cared I can’t say, but they chose to issue paper to an American company and therefore could have found themselves liable in a US Court of Law.

In the EU, “market surveillance” of the Machinery Directive is handled by Member State’s Customs Authority and Member State’s Competent Authority. Customs clearly is overwhelmed by the magnitude of products, such as machinery, entering the country. Only if the proper papers don’t accompany the machinery on entry will it likely be caught if it is improperly CE marked. Likewise, Member State Competent Authorities also have a formidable task policing compliance with the Machinery Directive. A few years ago, when I was touring a winery in Italy, I saw a Japanese manufactured fork-lift that wasn’t CE Marked. It seems that a machine likely won’t get attention, unless an accident occurs and the machine does not comply with the requirements of the Machinery Directive and related Directives.

US Market Enforcement

The US enforcement mechanism is indirect, but it can be very effective. Machinery, like any other product on the US market, is subject to product liability lawsuits. If a person is injured by machine and a court determines in a product liability civil lawsuit that the machine was unsafe, the manufacturer can be held liable in a  US court of law. The EU Machinery Directive adds a new equation to product liability. In a blog posted in February, I recounted a 2002 Minnesota trial where an employee was injured by a box-stacking machine that crushed his skull requiring 24-hour care for the rest of his life. When the jury discovered that the same company made a safer version of the same machine with a laser light curtain that would have stopped the machine’s operation if it detected the presence of a person, it awarded the plaintiff $35.5 million dollars in punitive damages. Clearly, the manufacturer knew how to make a safer machine, but chose to make a less safe machine for the US market because there was no government requirement.

The product liability implications of the EU Machinery Directive are significant for all manufacturers:

•    If a US, EU, Japanese, etc. company manufactures a CE Marked machine for sale in the EU and non-CE Marked less safe machine for sale in the US, they risk losing a product liability lawsuit with a Minnesota punitive damages result. Expect trial attorneys to determine if a company makes a CE Marked machine and seek the Technical File and related documents in discovery.

•    If any company places a machine on the US market, all documents related to that machine are discoverable in a US Court of Law. This includes any third party assessments, certification and surveillance audits.

•    Expect plaintiffs’ attorneys to hire a legal expert, such as myself, to determine if a company did a poor job in self-certification and didn’t fully comply with the safety requirements of the Machinery Directive, thereby creating a less safe or unsafe machine, resulting in an injury.

•    Expect that the safety requirements of the EU Machinery Directive, which your competition is meeting to CE Mark its machines, will become state-of-the-art for safety for manufacturing machinery in the US and therefore will become the standard against which your company will be measured in future product liability lawsuits whether or not you CE Mark your machines.

As noted frequently by economists, scientists and in previous blogs, we live in a global marketplace. Perhaps one unanticipated consequence of this market place is the assimilation of safety standards from outside the US into deliberations within the American legal system. It is here and it is real. In addition to design engineers, CEOs, Corporate Counsel and CFOs need to be aware of these global implications.

If you have product liability and risk assessment concerns regarding the Machinery Safety Directive and related Directives, you can contact me for a free preliminary consultation at theguide1@comcast.net

ISO 9001 Product Liability Lawsuits – Production

Following Pre-production/Product design (which attracts the greatest number of product liability lawsuits) and Post-production/Post-sales surveillance (which attracts the second greatest number of lawsuits), Production attracts the lowest number of lawsuits. This doesn’t mean this area is insignificant; it isn’t. And, it often becomes difficult to clearly state that a product liability lawsuit can be confined to a single area.

For example, one of the earliest companies I worked with on CE Marking Machinery was a small company in the Atlanta area that made machinery for recycling plastic and plastic extrusion. All of these machines were made to order for individual customers. I met them with a colleague from Georgia Tech so that we could talk about CE Marking and ISO 9001 certification.

The company had just settled a product liability lawsuit where a production worker put his arm into a hopper that was grinding up plastic so that it could be heated, purified, pelletized and used in their plastic extrusion machines. His arm was so badly damaged that it had to be amputated. One of the plaintiff’s claims was that “the software did it!” While the claim seemed absurd to the engineers who designed and modified the machines to customer’ specifications, they couldn’t disprove the claim. The engineers worked closely with marketing and sales modifying the machines for specific applications and then would adjust their software to satisfy customer needs. Unfortunately, they kept no records of what went out the door and consequently couldn’t prove or disprove the attorney’s allegations.

Certifying to ISO 9001 would provide the impetus to better control contracts and create records that would tie the specific software created to fulfill each contract to the contract so that it could be retrieved to answer any future questions and defend the company in the event of a product liability lawsuit. While the creation of specific software might be seem to be a design function, and to a degree it was, it really was a component of contract review and delivery.

For those who read the ISO 9001 lawsuit Pre-production blog, you will recall that one of the key issues that was pursued in depositions in the UK was the failure of the manufacturer to follow their 4 Contract review (ISO 9001:1994) and 7.2 Customer related processes (ISO 9001:2000) procedures. (Each manufacturing facility had its own ISO 9001:2000 Certification, one used the 1994 language and the other used the 2000 Language). Clearly this portion of the lawsuit dealt with production issues.

Government Agencies such as FDA and DOJ (Department of Justice) often pursue production issues. In FDA’s Quality System Regulation (closely patterned after ISO 9001:1994 with some modifications) process validation, corrective and preventive action and production and process controls breakdowns were judged to be adversely affecting in-vitro diagnostic products being placed on the market by Abbott Laboratories. They received the largest fine in FDA history at that time, $100 million dollars – the Consent Decree agreed to by FDA and Abbott Laboratories. Altogether the Abbott fines amounted to $168 million dollars for noncompliance with FDA QSR requirements. The focus of the fines was failure to provide adequate “process validation, corrective and preventive action and production and process validation.” In addition to the requirements of the consent decree, the manufacturer, its sales staff, distributors and professional users of their in-vitro diagnostic products had a “duty to warn” their customers and prospective patients about FDA’s consent decree.

Shortly after the consent decree, using information from the US Freedom of Information Act (FOIA), a Seattle law firm alleged in a product liability class action lawsuit that an Abbott in-vitro diagnostic test caused the misdiagnosis of a disease that led thousands of women to undergo an expensive but unnecessary treatment.  

The US Department of Justice (DOJ) also pursues production issues on behalf of the US Department of Defense. If a company is ISO certified, DOJ doesn’t care how a company obtained its certification, what they will hold a company to is the ISO 9001 standard and prosecute vigorously if fraud and false claims are present. Generally, they will prosecute according to the standard and not according to the company’s own ISO manual, which may be more or less adequate, depending on the registrar. If a defense contractor takes the easy way to certification, it is only cheating itself. And if they lose control of their processes, they pay dearly.                                               

It will be recalled that the Bridgestone/Firestone litigation involved broken processes in their quality management systems. These constituted “manufacturers’ defects.” “A manufacturers defect exists when a product does not conform to the manufacturer’s design standards and blueprints and the flaw makes the product more dangerous and therefore more unfit for its intended or reasonably foreseeable uses.” (Ford Motor Co. v Pool, Texas Court of Appeals, 6th Appellate District, 688 S.W. 2nd. 879, 881, 1985)

Another example of a manufacturer’s defect can be found in Harley-Davidson Motor Co., Inc. v Wisniewski, Maryland Appellate Court, 50 Md. App. 339, 1981, where the direct evidence supported the plaintiffs claim. In that case, Harley-Davidson was liable for serious leg injuries sustained by the rider in an accident that occurred when the throttle slipped off the handlebars causing the rider to lose control. The throttle clamp screw had been cross-threaded during assembly, causing the screw to bind in the clamp. As the screw was driven downward it began to fracture, with a final break occurring just before the accident.

While these court cases precede The adoption of ISO 9001 by many companies, they represent manufacturing defects resulting from failed production processes. The worlds of quality management systems and product liability law are now intersecting. It would behoove manufacturers to adopt a formal safety policy and create a safety committee. To this could be added product liability audits to determine areas of product liability exposure and reduce the exposure. In production, the focus should be on safety critical parts (for products), safety critical operations (for services) and safety-critical processes in production. The safety critical processes could range from purchasing (materials, component parts and subcontracting) to inspection by highly trained personnel, to assembly, services delivery, inspection and testing, packaging (especially critical for medical devices and high performance equipment) to storage, handling and distribution. 

What is safety critical will vary for each organization and may require a production risk analysis to refine the focus. This task becomes all the more important with outsourcing occurring on a global basis. With an ISO 9001 quality management system it is possible to address these tasks and create an intelligent paper trail that increases the focus on safety and helps defend a company in a product liability lawsuit. Without such a system, a company will be at the mercy of the winds.

If you have product liability concerns with ISO 9001, you can contact me for a free preliminary consultation at theguide1@comcast.net

Registrars & Notified Bodies – Ethics & Liability #3

About nine years ago, a colleague of mine was asked by one of his clients to visit their medical device manufacturing facility in California. They wanted help in their meeting with the FDA in San Francisco. After returning to the plant they asked if he would review the most recent surveillance audit by their notified body and give his opinion on the quality of the audit. He said that he thought the audit was weak and potentially harmful to the company. At their request he prepared a report for their files.

The issue was significant because the company manufactured a Class III medical device for the US & EU. One of the reasons they met with the FDA concerned shortcomings in their quality management system vis-à-vis FDA’s Quality System Regulation. The company assumed that their notified body would hold them to a high level of performance close to what was expected by FDA. My colleague’s report stated clearly that their notified body had failed to do so. 

The company shared the report with their notified body who in turn shared the report with their corporate parent in Germany. The managers of the corporate office in Germany promptly called the UK office of the consulting company we worked for at the time and complained. The UK office called my colleague and asked him what he was doing. He responded that the medical device company was a longstanding client of his. They asked him a question as their consultant and he was ethically bound to give them his honest opinion, which he did.

Fast forward to the future. A few years later the Wall Street Journal reported that the company in question was going to be acquired by a large medical device manufacturer in the Midwest for $550 million dollars. A few months later, the Wall Street Journal reported that the acquisition price had been dropped to $350 million dollars because several deaths had been reported from malfunctions in the company’s medical devices attributed to the devices design and manufacturing processes. FDA sanctions and product liability lawsuits were anticipated. I’m not certain that the notified body ever followed these events and understood that they could be drawn into these lawsuits.

Returning to my colleague’s negative critique of the notified body’s surveillance audit, he indeed found problems and reported them to the company. The heated exchange of words between the notified body corporate office in Germany and the UK office of our consulting company didn’t factor in that we were dealing with a regulated medical device where the paramount concern was and is patient safety, not wounded corporate pride.

A few years after this event I was in California in the Los Angeles area working with a Class III medical manufacturer on CE Marking and FDA’s Quality System Regulation. During my visit I was asked to review a recent notified body surveillance audit and asked if the audit adequately prepared the company for an FDA site inspection. As fate would have it, it was the very same notified body critiqued by my college. 

The company asked if the surveillance audit prepared them for an FDA site inspection. After reviewing the audit, I told them that their quality system would not pass an FDA site inspection. As noted in an earlier blog, I submitted an Executive Summary identifying the weaknesses in the audit and identified the steps necessary to prepare the company for an FDA site inspection.

It appears that several notified bodies do not want to burden their clients unnecessarily and therefore conduct light surveillance audits hoping to retain them as clients. Whatever the rationale, it does no favors for medical device manufacturers where product safety and patient safety is paramount and device failure can lead to regulatory sanctions and product liability lawsuits.

I work with several clients conducting product safety and product liability audits so that they can minimize potential problems. I also work with them conducting risk analyses/hazards analyses to make certain that potential problem areas are identified and addressed in their quality management systems. It is an application of forensic and preventive law.

Registrars & Notified Bodies – Ethics & Liability #2

To continue with the observations made in the first part of this blog, ISO/IEC 17021:2006 has very specific information requirements; 8 Information requirements, 8.1 Publicly accessible information, 8.1.1 “The certification body shall maintain and make publicly accessible, or provide upon request, information describing its audit processes and certification processes… 

8.3 Directory of certified clients “The certification bodies shall maintain and make publicly accessible, or provide upon request, by any means it chooses, a directory of valid certifications that as a minimum shall show the name, relevant normative document, scope and geographical location (e.g. city and country) for each certified client (or the geographic location of the headquarters and any sites within the scope of a multi-site certification).

In the discovery phase of this lawsuit, this information would have been invaluable to my clients. Lacking the information, we had to sort through disinformation provided by the opposing party in the lawsuit, their counsel and their Registrar which cost time and money.

An ISO 9001 expert for the opposing party disclosed that he had been recommended by the opposing party’s Registrar. While this isn’t as critical a misstep as their unwillingness to provide certification information, it does violate the requirement of impartiality. ISO/IEC 17021:2006, 4.2 Impartiality, 4.2.1 “Being impartial, and being perceived to be impartial, is necessary for a certification body to deliver certification that provides confidence."  4.2.2 “It is recognized that the source of revenue for a certification body is its client paying for certification, and that this is a potential threat to impartiality."

4.2.4 “ Threats to impartiality include the following. a) “Self-interest threats: threats arise from a person or body acting in their own self-interest. A concern related to certification, as a threat to impartiality, is financial self-interest." 5.2.5 “The certification body shall not offer or provide management system consultancy.” Clearly, the Registrar in this case did not act in an impartial manner with their client. Further the Registrar did provide a form of consultancy by recommending an ISO 9001 expert.

Finally, the interim director for the Registrar retroactively changed the scope of ISO 9001:2000 certification for one of the opposing party’s key sites after the lawsuit had been underway for over 1½ years. The site in question had been at the center of a debate between opposing counsel. Further, the ISO 9001:2000 site certification was granted initially for 2003 to 2006 and recertified for 2007 to 2009. To change the scope of the ongoing six-year certification in year five, “2008” violated ISO/IEC 17021:2006 requirements for “impartiality”, “ not providing consultancy” and “ not allowing commercial, financial or other pressures to influence impartiality”.

ISO/IEC 17021:2006, 6.2.1 “The structure of the certification body shall safeguard the impartiality of the activities of the certification body and shall provide for a committee

a)    to assist in developing policies related to the impartiality of certification activities,

b)     to counteract any tendency on the part of the certification body to allow commercial or other considerations prevent the consistent object of provision of certification activities

c)      to advise on matters affecting confidence and certification, including openness and public perception

In this particular case no evidence was provided to indicate that the requirements of ISO/IEC 17021:2006 had been followed. Indeed, it seemed that the interim director was eager to please a multibillion-dollar company with sites around the world certified by this Registrar.  Naturally, these are fair questions to ask at trial.

To return to the discussion at the end of blog #1, of whether there have been any cases won against a Registrar. The preceding review of Registrar behavior in this case illustrates how the Impartiality Certification Requirements of ISO/IEC 17021:2006 the International Standard governing ISO 9001 Registrars were ignored. If the Registrar’s behavior negatively affects the outcome of this lawsuit, they could be held liable for damages. (Part #3 of this blog will address notified bodies.) 

Registrars & Notified Bodies – Ethics & Liability #1

A friend sent me an e-mail last week asking if the US has any civil penalties related to misrepresentation (e.g. consulting vs. auditing) comparable to the UK through its Department of Trade and Industry (DTI. It is a good question, which we are going to explore at greater depth in an article. Also, last week another friend who is an administrator for a notified body in the US asked if there have been any cases won against a Registrar or do they just go after a manufacturer?

These are questions that I spent some time exploring last summer in regard to a lawsuit that is heading to trial this summer. It is the most recent instance of my encounters with questionable behavior by a third party. While I know of no instance where a Registrar or Notified Body has lost a case in civil court, that doesn’t mean it hasn’t happened, especially if the outcome was settled out of court and sealed.

Concerning the first question asking if the US has civil penalties related to misrepresentation comparable to the UK, the answer is no. UK’s DTI is a governmental agency that can levy civil penalties. In the US, ANAB is a private entity that can impose penalties on its members for failing to abide by its rules and regulations, but civil penalties can only be levied by a governmental entity.

Concerning the impending lawsuit, the Registrar in question is the registrar for all of the opposing party’s plants around the world and its corporate office. When I first agreed to serve as legal expert on issues involving ISO 9001, I said I would contact the registrar to confirm that they are in fact the Registrar that certified the sites in question in this litigation. I contacted an acquaintance at their US headquarters and was told that they would have to first consult with their attorneys. Later in the day I received a call from the Registrar stating that they were not allowed to share this information. (It was, however, a sharp contrast from the assistance I had received in another lawsuit in the previous year from BSI when working on depositions in the UK.) Fortunately, I was able to obtain the necessary information on the web from QSU.      

I then reviewed ISO/IEC 17021:2006 Conformity assessment – Requirements for bodies providing audit and certification of management systems. In 1 Scope it says, “This International Standard contains principles and requirements for the competence, consistency and impartiality of the audit and certification of management systems of all types (e.g. quality management systems or environmental management systems) and for bodies providing these activities.”

In 4.5 Openness, 4.5.1 “A certification body needs to provide public access to, or disclosure of, appropriate and timely information about its audit process and certification process, and about the certification status (i.e., the granting, extending, maintaining, renewing, suspending, reducing the scope of, or withdrawing of certification) of any organization, In order to gain confidence in the integrity and credibility of certification. Openness is a principle of access to, or disclosure of, appropriate information.”

 4.5.2 “To gain or maintain confidence in certification, a certification body should provide appropriate access to, or disclosure of, non-confidential information about the conclusion of specific audits (e.g. audits in response to complaints) to specific interested parties."

Quite clearly, the Registrar did not abide, as required, by the requirements of ISO/IEC 17021:2006 in response to my question about the certification status of the Registrar even though this is the international standard that governs their behavior as a Registrar. While I am not surprised that their attorneys are clueless about the professional and legal responsibilities of the Registrar, I am surprised that the Registrar’s management and personnel failed to read the requirements of Certification Bodies and share that information with their attorneys.

To return to the question of whether there have been any cases won against a Registrar, the answer is, there will be such cases if Registrar behavior violates their Impartiality Certification Requirements in a manner that could influence the outcome of a lawsuit. More about this issue in the second half of this blog.