Is ISO 13485:2016 applicable to distributors of medical devices?

A question I have been asked is: To what extent is ISO 13485:2016 applicable to distributors of medical devices? They import devices and sell them locally as is.

The answer to this question depends on answers to the following questions.

- Are you marketing the medical devices that you sell? What claims do you make in your marketing and can you show verifiable evidence from the manufacturer/supplier that the medical device actually satisfies those claims?
- Are you providing any training regarding installation, set up and configuration, operation or maintenance of the device?
- Are you providing after-sales support of any kind?

- How do you handle and track customer complaints?
- How do you track and handle recalls?
- Do you do any kind of inspection or sampling to ensure that the devices you receive function correctly before shipment or collection of the device?
- Are the medical devices approved for import and sale by you in the country in which you operate?
- What is the medical device classification in your country of operation?
- Are you registered with a healthcare regulator as an importer/distributor? What healthcare laws and regulations are you subject to? How do you demonstrate compliance?

- What due diligence have you conducted to qualify and approve the manufacturer and supplier of your medical devices?
- What technical or professional competence is required or expected of your staff? Do they actually have the required training or experience?

Then...
- To the extent that any of the above apply to you, what processes do you have in place to ensure quality and compliance?
- What records can you show as evidence of quality, consistent conformity with the above answers or compliance with healthcare regulations?

These questions and their answers are all relevant to ISO 13485:2016. I am sure other people in the industry could think of still more questions.

Quality is about time...

by Philip Scalise, an online colleague and acquaintance whom I have met and interacted with on LinkedIn. Philip does Quality System Administration and Development based in Utica in the New York area.

Re-posted with his permission from his LinkedIn post.


People who find QUALITY to be an abstract concept contribute to why it is so. The lack of “common” understanding regarding quality is self-perpetuating. Just as oxygen fuels life it also fuels the flames of confusion. While I am neither a professor nor writer I do have a diverse background in quality and I am one to see things for what they are. Quality is about time, my time and your time. While I understand the traditional definitions of product & process quality and the methodologies utilized to achieve the condition, I need to stress this is not some high minded lofty diatribe, nor do I seek to solicit clientele in its offering. In fact, this is nothing more than a straightforward logical perspective on quality from the common of man. As such I will use every possible practical minded real world example at my disposal to substantiate this point. In the spirit of simplicity I have decided to use time as our least “common” denominator. I will be as direct as possible and not waste any of “our” time.

First let’s understand something. Those who appear not to understand every possible nuance or gradation of quality, in fact do have their own understandings they are just not the same as yours. When an honest person does not understand something we ask questions. Asking questions of people that lack the knowledge or the integrity to admit it is at the very root of this self-perpetuating cycle of misunderstanding. As a result, even more questions come up providing fog and even cover for the smoke and mirrors folks. These are people who use their time to play a shell game with your time. Questions and concerns multiply and grow into a giant sized mass of industry feeding confusion. Once upon a time smart minded business women asked me if I could define quality for her. When I told her I could not, she asked me why not? I explained “if you do not know what quality means to you how can I possibly define it for you?” There are far more people who cannot explain quality than there are those capable of doing so, but make no mistake about it, many of them are doing business just the same. Quality (good quality) is properly defined when things work. Conversely poor quality is defined when things do not work. For example I am writing this right now because of the time I have available while not edging my lawn and waiting for a refrigerator repair person to enter through the front door.

Why not edge the lawn?

Well, it’s about time. You see my WORKS (spelled with an x) lawn and garden tool does not work at the moment. It is a quality tool but it appears the replacement spools sold at area retailers are not. The quality condition of the spools that come with the unit are good quality and worked just fine, however, understanding quality, manufacturing and supply chains as I do, I was not in the least bit surprised to find the replacement spools are not of this same quality condition. It seems, this time, the private labeling business may have been “outsourced” to another organization other than the OEM (original equipment manufacturer). These replacement spools come in a two pack which one might expect to last a few years, but, when I put the first one in it continued to unwind until I lost my patience and threw it away. Trust me Mother Teresa would have done it sooner. When I tried to install the second one I had no chance at all, but this time for far different reason. After spending close to 20 minutes studying the spool with my needle nose in hand, I simply could not find the end of the line to install the damn thing, so I just gave up and came in for lunch when I remembered “do not to open the refrigerator.”

Why am I waiting for a refrigerator repair man?

Well, it’s about time, the refrigerator (a samsung) purchased through best buy and whose geek squad has been here multiple times now, is in the “process” of spoiling our food. Unfortunately for us and not for the folks at best buy or samsung, this time, there is no time for them to return for a third time. So this time at an unknown time they will send yet another repair agency because we are short on time. Surely it will be this person’s first time spending time on my time repairing the refrigerator for the third time, so I trust it will not be a good time.

Why will the repair person need to come through the front door?

Well, it’s about time, you see my kitchen is directly off the garage so this time when I opened the door for the repair man so he could roll his tool box into the house to dismantle the unit yet again, well, this time my garage door opener broke. This door opener is only a matter of years old, but here is the thing, you need only hit a button and the door opens along a threaded screw about 10 feet long. Well, as it turns out (yes pun intended) this ten foot long screw is not 10 ft. long? It actually comes in three sections so it can be easily packaged and home shipped as opposed to store bought. This allows the OEM to reach a greater customer base which is great for them, but surely not me! So this time I will need the coupling that is worn down from the multiple times the door has gone up and down wearing down this all important part that the genie door people no long provide. This time I will need more time to invest in the repair or replacement of the unit. Seems this could take some time, but hey, exactly whose time is it anyway…

All that said and in closing allow me to say this about that, when and if you struggle with your understanding of “quality” just recognize that no business on this planet has any such dilemma. They do not struggle with their definition of quality they struggle with yours. If we all woke up in the morning with the very same definition of quality in mind, well, to that my one and only response would be…well, it certainly is about time!

Risk Based Thinking (RBT) in ISO 9001:2015

What is risk based thinking as required in ISO 9001:2015? How do you implement it?

This 17 minute presentation expands on the guidance provided by TC 176.

Six Steps to Creating Your Project Budget

- article by Helena Lui in Quality Digest

Disguised as simple but by no means simplistic, this is a practical, high-view "Project Budgeting For Dummies." The author is a consultant at IBM and an instructor at examspm with a master’s degree in business/commerce from Queen’s University.

Her six steps are:
1. Look through lessons-learned documents
2. Know your cost
3. Roll up individual activity costs (where Lui makes a very important point!)
4. Add contingencies
5. Monitor your progress and resources (where the author makes the point that, "Project budgeting is not a set-and-forget activity, but rather a continuous activity that requires your daily attention.")
6. Communicate changes to stakeholders

It's a quick read which novice and less experienced project managers can refer back to periodically with regard to project finances. Some stakeholders will also find this helpful.

Read the full article here.

Simplify Clarify Control

The banner maxim for my company, tcmc Quality Management Services, is Simplify Clarify Control. This is not just meant to look good as a catchy slogan: it is what I really try to help my clients achieve and the way I operate and do what I do.

Simplify

You simplify by having a standard process for each of the value-adding steps of your core operations, ensuring that these integrate into one system that provides defined products and services.If you can identify busy work that does not add value for your customers, try to eliminate it or minimize the impact on your organization's resources.
As importantly, simplify the work environment and resources by applying 5S:
Sort: sort everything into one of Retain, Return, Rid
Straighten:  a place for everything and everything is in its place.
Scrub: clean everything regularly.
Systematize: have maintenance schedules and systems to keep it this way.
Standardize: create a culture with new habits for keeping things simple.

Clarify

You clarify by ensuring that every value-adding process has assigned roles and responsibilities and that everyone in the organization clearly understands and takes pride in their own roles and responsibilities: who their customers are, who their suppliers are, why they do what they do and why that is important.
Customers and suppliers are not just external to the organization; in fact, for most employees, their customers and suppliers are within the organization itself: who is the first recipient of my work output? That is my customer. Who gives me raw material/components to assemble - whatever I have to add value to by transforming into something for my customer? That is my supplier. How do I get along with my own customers and suppliers? Is there good rapport and mutual respect?

Control

Senior management controls by measuring and monitoring the performance of key, value-adding operational processes, setting SMART objectives that align with the strategic direction of the organization and its stated policies and mission.
SMART objectives are: Specific, Measurable, Attainable, Relevant and Time-bound.

Reap the reward - Quality

If you do the above for your organization - simplify, clarify and control - you should find greater predictability and quality in your products and services, less waste, improved morale and, most importantly, happier customers.

ISO 14001 - What is it? An Overview

My latest training video on YouTube (just 9 minutes long) gives a high level overview of all the requirements in this well-reputed international standard for environmental management systems.

ISO 14001 - What is it?

What is ISO 13485 for Medical Devices?

An eight-and-a-half minute, high-level overview of this international standard for organizations involved anywhere in the supply or service chain for medical devices.

What are the benefits to ISO 14001?

What is ISO 14001?

In a nutshell, ISO 14001 specifies the requirements for any organization to be able to claim that they have an environmental management system that conforms to a globally recognized international standard. The 2015 revision of the standard has a high level structure almost identical to ISO 9001 which makes it easy and desirable to integrate environmental and quality policies, objectives and processes into one management system.

What are the benefits to conformance or certification to the ISO 14001 standard?

• An organization can increase its control over its impact on the environment though responsible corporate stewardship.
• Corporate image and credibility as a green organization is enhanced by publishing an assertion of conformance to ISO 14001 or, better, certification of conformance by an accredited third party certification body.
• Customer satisfaction within the supply chain is increased through greater confidence in the organization's environmental management system
• Legal & regulatory awareness and compliance is enhanced throughout the organization
• Risk of noncompliance with environmental laws and regulations is reduced
• By developing a green and lean culture an organization regularly seeks to identify new opportunities for cost savings through green efficiencies, e.g. energy & water, raw material and waste disposal
• Formal risk management enhances the organization's physical & financial protection against environmental mishaps
• By combining with ISO 9001 there is increased management control through a single integrated & holistic quality and environmental management system
• There is increased staff awareness and involvement in care of the environment
• Last, but definitely not least, the organization contributes to a better environment locally, regionally and globally

If you would like to know more, I would love to hear from you. CONTACT ME HERE.

Regulatory Compliance is Not an Alternative to a Culture of Caring

This article appeared in today's Toronto Star:

Watchdog raises alarm over restraints used on children in care.

The article is on  a new report by Ontario’s Advocate for Children and Youth into the province’s (troubled) system of residential care with the subline: Confused, incomplete reporting of serious incidents makes it hard to know if guidelines on restraints followed, children’s advocate says.

Many people, both inside and outside regulated care organizations such as those for foster and group homes for youth, for people with mental health challenges and for seniors, confuse regulatory compliance with quality care. There is an assumption by outsiders, including governments, that enforcing regulations with inspections and a big stick will achieve the standard of care needed for vulnerable populations. Such people, and many inside these organizations - management and staff - who should know better, insufficiently grasp the important role of organizational culture for achieving a quality standard of care. Many managers and staff don't know or have forgotten why they're there and so, not being mindful of why they should do what they have to do, they take short cuts for convenience, defeating the purpose of the regulation or quality standard.

On top of it all, they are under-staffed and misunderstood which exacerbates everything.

Yes, we absolutely need adequate inspections for regulatory compliance, and getting further certification and accreditation to standards can also help, but we also need senior organizational leaders with vision who understand what Peter Drucker meant with his now famous quote, "Culture eats strategy for breakfast." If changing the culture is not part of the strategy, the strategy is doomed.

Why do I do what I do?

People ask me, what do you do?

When I wake up in the morning, what I want to do is make the world a better place. Most of us, if not all of us, walk around with problems, some personal, but also many business or professional. What fires me up professionally is to help leaders in small and medium size organizations approach their problems as challenges, as fish to be caught, and then help those organizations fashion fishing rods or fish nets for themselves to catch these fish and turn them into opportunities; opportunities to make their organization, including their staff, more successful in achieving their vision and objectives, more successful in meeting and exceeding customer and client expectations and, as a consequence, more profitable.

How do I do this?

Credit: advisera.com

I am a big believer in process; namely, a consistent way of taking things as input, and turning them into some valued output, whether as a product or service. When you break it down, any enterprise uses a system of processes to do what it has to do - whether those processes are formal and written, or informal and intuitive. I have yet to find a production or service problem that cannot be tied back to a process. What I do is help organizations improve their system of processes to be more effective and efficient, and to eliminate or mitigate problems, especially problems that lead to client or customer complaints.

Beyond the short term, the cost of improving process effectiveness is a lot less than the cost of perpetuating a process that keeps spawning problems. It's a bit like the leaky tap or faucet: at some point the cost of water wastage exceeds the cost of repair and, at that point, the total cost is the cost of repair plus the cost of all the water that had been wasted in the meantime.


So that's what I do, and why I do it. If you would like to see whether and how your processes can be more effective and less wasteful, please talk to me. Let's continue the conversation and make the world a little bit better, together.
Leave a comment below or CONTACT ME.

Risk-based thinking: new in ISO 9001:2015

A significant innovation with the 2015 revision of ISO 9001 is the new emphasis on risk-based thinking which has acquired the acronym, RBT, in quality circles.
It is a sad fact that many organizations only considered the risks associated with failure when there was, in fact, already a failure or product nonconformity of some kind and they were engaged In corrective and preventive action. To counter this, the new Standard no longer has a requirement for a distinct preventive action process associated with corrective action but rather calls for RBT to be applied at various stages in the planning, design, development and release of products and services. Your third party auditor will be asking to see evidence that this is being done and you, yourselves, will want to be looking for this in your own internal audits.

There is nothing stopping you from continuing to follow a preventive action process after corrective action - and a lot to recommend that you do continue, but that will not be sufficient to satisfy the requirement for risk-based thinking.

By risks we are talking not only about potential hazards to health and safety but also the risk of damage to property and/or financial loss whether for the customer, a third party, or the organization itself. The presumption is that one important purpose of a quality management system is precisely to prevent bad things happening. Thus Risk based thinking will weigh risks against the benefits of proceeding or not proceeding with a course of action, and decide on implementing mitigations or not.

RBT: Middle road - out of the weeds to left and right?

By introducing the concept of risk-based thinking into ISO 9001, the technical committee that produced the 2015 revision tried to walk the middle road between an insufficient consideration of risks and benefits on the one hand, and the more formal risk analysis and management required in, say, the medical device or aerospace standards. RBT has become one of the most discussed and hotly debated ISO 9001 topics in quality circles and forums. Some people welcome RBT, others consider it 'fuzzy thinking'.

ISO 9001:2015 - FAQ's in support of Annex SL in ISO Standards

I came across this document while I was looking for something else and got distracted by it: JTCG Frequently Asked Questions in support of Annex SL. It is put out by an esoteric group who call themselves, "ISO/TMB/JTCG Joint technical Coordination Group on MSS (TAG 13)". Who are they? If you have to ask the question then you probably won't find the answer terribly interesting. Let's just say they are something to do with ISO, the international organization for standards that develops management system standards (MSS) among other kinds of standards.

Logo of the ISO organization

I found some of the FAQ's interesting and relevant to some discussions I have followed on Linked, especially with regard to the newly released ISO 9001. Anyone needing to transition from ISO 9001:2008 to ISO 9001:2015 may find this of interest.

4. What was the Vision behind Annex SL ? 

All ISO management system “requirements” standards will be aligned and ISO will seek to enhance the compatibility of these standards, through the promotion of identical:
• Clause titles
• Sequence of clause titles
• Text, and
• Terms and definitions that are permitted to diverge only where necessitated by specific differences in managing their individual fields of application.

7. What benefit is there to harmonization ? 

Where organizations are implementing and operating several Management Systems they are often confronted with different and sometime contradicting requirements, terms and definitions. Annex SL will be particularly useful for those organizations that choose to operate a single (sometimes called “integrated”) management system that can meet the requirements of two or more management system standards simultaneously.

10. Why does the common text not include a specific clause on “Preventive Action” ? 

The high level structure and identical text does not include a clause giving specific requirements for “preventive action”. This is because one of the key purposes of a formal management system is to act as a preventive tool. Consequently, a MSS requires an assessment of the organization’s “external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcome(s)” in clause 4.1, and to “determine the risks and opportunities that need to be addressed to: assure the XXX management system can achieve its intended outcome(s); prevent, or reduce, undesired effects; achieve continual improvement.” in clause 6.1. These two sets of requirements are considered to cover the concept of “preventive action”, and also to take a wider view that looks at risks and opportunities

15. What is the difference between the terms "determine" and "identify" ? 

The terms are used interchangeably in general English but "identify" can have translational problems, as it can be mistaken for e.g. putting a label on something to identify it.
"Determination" is an indication of an assessment rather than "identify" which indicates that something has been noted.
Dictionary definitions give:
Determine = establish or find out with certainty by research, examination or calculation
Identify = establish the identity of something or somebody

16. Why is there explicit distinction between requirements for "top management " and "the organization" ? 

The success of the management system depends on the leadership and commitment of top management; however it would be unreasonable for top management to perform all activities within the management system, therefore it is necessary for such tasks to be assigned to other roles within "the organization"

19. What does “issues” mean ? 

An "issue" is "an important topic for the organization, problems for debate and discussion, or changing circumstances".
This term was used in Annex SL identical text after referring to dictionary definitions (e.g. the Oxford English Dictionary).

20. What is the difference between “stakeholder” and “interested party” ? 

Traditionally management systems standards used the term "interested party" because "stakeholder" created translation problems for a number of languages. The term "stakeholder" has gained wider acceptance even in translation, and some MSS now have chosen to use the term. The two terms are defined as being interchangeable, but with "interested party" as the preferred term.

22. What is the difference between “as applicable” vs. “as appropriate” ? 

Dictionary definitions give:
Applicable = relevant; appropriate; possible to apply
Appropriate = suitable (for, to)

In most cases appropriate implies some degree of freedom, whereas applicable implies that if it can be done it shall be done.

Implementing ISO 9001:2015 – The Process Approach

Paul Simpson

In his excellent post, Implementing ISO 9001:2015 – The Process Approach, blogger Paul Simpson focuses on the ‘deep dive’ required to really understand our processes in order to capture them accurately.

"We’ve probably all seen the extremes – on the one hand perhaps a wall full of mind sapping detail, on the other a series of banal boxes neither helping staff and leaders.  So this quote, ‘Everything should be made simple as possible, but no simpler‘ attributed to Albert Einstein, is a useful stimulus in thinking about making process analysis useful, and to help ISO 9001:2015 registration.

"The point of analysing our processes is to ensure we understand how each process works and what we need to do as individuals, leaders and organisations to ensure the process operates efficiently and delivers effectively."

"We have to break each process down into as few simple steps as possible based on our experience of how they work in real life. And we must ensure that we understand their relationships and contribution to the other processes in the overall system in generating outputs for the customer."

Read the full post here: Implementing ISO 9001:2015 – The Process Approach

ISO 9001:2015 - What are the BIG CHANGES?

What are the big changes in ISO 9001 2015? Don't get trapped in the weeds as you transition from ISO 9001:2008 to ISO 9001:2015.

The "Gemba Walk" Pope surprises an Italian family with a Christmastime call

According to an article in the LA Times, when Pope Francis was still an archbishop in Argentina some years ago the archdiocese had a limo that that he could have driven around in. Parishioners of Our Lady of Caacupe tell how, instead of taking the limo to get to the church, he would take the bus and then walk half a mile to the church operating out of a converted warehouse. People knew him and would walk with him. "Once I met him at the bus stop and offered to carry his briefcase the rest of the way, but he wouldn't hear of it," said Monica Morales, a church volunteer and mother of six.

Fast forward to December, 2015. The Pope, who sometimes eats in the staff canteen and who already has a reputation for occasionally picking up the phone and calling ordinary people, repeats the surprise, calling a family whose little boy had written him out of concern for his ailing aunt. He is reported to have had a 15 minute chat with the boy's mother, putting her at ease and enquiring about the family.

The Pope has probably never heard of 'gemba' or 'genchi genbutsu', but he sure knows how to practice it. Cynics might argue that this is just a PR stunt. I cannot prove that it is not. However, in none of these events has the publicity come from the papal marketing department; it is the people that he touched who went public, directly or indirectly. Vatican comment has always been very muted about these incidents. In my opinion the Pope sees this as a two-way street the value of which he learnt long ago in the barrios of Argentina. Sure, he is being a pastor and setting example, and so on. But he is also observing, engaging and learning. He learnt to deal compassionately with pastoral and moral problems not so much out of text books but by being close to the people who were suffering. He encountered the problems by engaging with the people who have the problems, listening to them, learning from them, empathizing with them.

Without going to gemba a manager is operating in an ivory tower. Who would have thought that the Pope has something to teach managers and CEO's?  Genchi Genbutsu. "Go, Look, See". Then you will discover opportunities for kaizen improvements.

(With material from Religion News Service and Los Angeles Times.)