Three of my skills in this world include medical device development, teaching, and 1980’s pop culture. This article combines all three, using pop culture to illustrate concepts behind medical device quality system regulations that require a “process-based approach.” It’s starts with this, which will either confuse you or make you chuckle:

Was that a process?

Before I give my answer I’ll share the background of MC Hammer, Vanilla Ice, and the Process Approach to quality control so that everyone can make an informed decision.

Background

1990’s?

MC Hammer was famous in the 80’s, especially for the lyrics, “Stop! Hammer Time!” His video for “Can’t Touch This” has been viewed 500 million times.

Vanilla Ice was famous in the 80’s, especially for the lyrics, “Stop! Collaborate & Listen!” His video for “Ice Ice Baby” has been viewed 250 million times.

If you knew hip-hop music from the late 1980’s and 1990’s, answering questions on the first diagram would make you either Stop! and Hammertime; or Stop! Collaborate, and listen.

International Standards Organization (ISO)

Medical device companies must have an approved quality system to sell their products. The international standards for quality systems is ISO 13485, which was updated to emphasize risk-driven processes. ISO 13485 training videos have, collectively, been viewed a few thousand times, but impact the lives of billions of people.

500,000 million people know about MC Hammer, but only a few understand the process approach to quality control of medical devices, which affects billions of people. 44% of medical device recalls could have been prevented by process controls, and healthcare mistakes lead to 250,000 deaths in the United States each year. The process approach could save more lives and make the world a healthier place.

The process approach

The international standard for quality management, ISO 9001, defines a process in clause 3.4.1 as:

“… a set of interrelated or interacting activities that transforms inputs into outputs.”

Inputs and outputs could be things, such as drawings or parts, or information, such as documents or test results.ISO 13485:2016, which is based on ISO 9001 but focused on medical devices, defines a process as:

“Any activity that receives input and converts it to output can be considered as a process. Often the output from one process directly forms the input to the next process.”

and the process approach as:

“…the identification and interactions of these processes, and their management to produce the desired outcome, can be referred to as the “process approach.”

with a goal of:

“…improving processes based on objective measurement.”

Clause 8.2.5 of the standards adds that all processes:

“…should be monitored and improved for effectiveness.”

In other words, all processes should be controlled by an overall process of continuous improvement. But, that still doesn’t tell us what is and what is not a process.

Is this a process?

The first example leads you through a series of choices that result in a a decision, either to “Hammertime” or “Collaborate – Listen.”

Is this a process as defined by the ISO process approach? Why or why not?

I’ll provide space before my answer with lyrics from MC Hammer’s 1989 hit song, “U Can’t Touch This”:

Every time you see me that Hammer’s just so hype I’m dope on the floor and I’m magic on the mic Now why would I ever stop doing this With others makin’ records that just don’t hit I toured around the world from London to the bank It’s Hammer go Hammer It’s a Hammer yo Hammer and the rest go and play

You can’t touch this (oh-oh oh oh-oh-oh) You can’t touch this (oh-oh oh oh-oh-oh) Can’t touch this (oh-oh oh-oh-oh) Yeah u can’t touch this I told you u can’t touch this (oh-oh oh-oh-oh) Too hype can’t touch this Get me outta here u can’t touch this (Oh-oh-oh-oh-oh-oh-oh-oh-oh-oh-oh-oh)

Here’s my answer: The example is not an ISO process according to the process approach.

It’s a flow chart, and useful way to choose “Hammertime” or “Collaborate and Listen”that could be used within a process to help visualize written instructions, but it’s not a process in the context of ISO 13485 because it doesn’t use inputs to produce outputs.

Someone may perceive that it has implied inputs and outputs, but it’s unclear how implied outputs could be used as inputs for other processes that would be linked in a cycle of continuous improvement.

Let’s look at another example from Devo’s 1980 song, “Whip It.” I encourage you to listen to the video while reading the example. Crank up the volume so that everyone in your office can jam with you.

Is this an ISO process-approach? Why or why not?

I’ll provide space before my answer with lyrics from Devo’s 1980 hit song, “Whip It!”

When a good time turns around You must whip it You will never live it down Unless you whip it No one gets away Until they whip it

I say whip it Whip it good I say whip it Whip it good

Crack that whip

Give the past the slip Step on a crack Break your momma’s back

When a problem comes along You must whip it Before the cream sits out too long You must whip it When something’s going wrong You must whip it

The “Whip It!” chart is not the process approach. It’s elaborate and a lot of work went into it, but it’s not monitored for effectiveness. In other words, the song remains the same.

Another way to view this could be to use a term from Systems Engineering, “closed-loop process.” A closed-loop process is also called a “feedback” process because outputs are fed back into the process so that the process improves. Conversely, an open-loop process does not improve.

The Whip It flow chart would always result in the same song, and The MC Hammer flow chart would continue giving two choices but would not improve, would not stay relevant, and would not maintain effectiveness over time. In other words, neither example was a process in the ISO definition of process approach.

This is a process

Let’s look at what ISO considers a process using the

which is based on the process approach.

In the diagram, arrows show the flow of information between departments, which means that each departments processes are linked, and that “Risk Management” is the basis all processes.

is shown to link to all departments, because to monitor and control supply-chains so that things external to our quality system don’t become a weak link in our processes.

The diagram doesn’t show inputs from the external world that are described in the text of ISO standards, which includes inputs for “Design and Development” that come from real-world feedback based on the needs of customers, users, and patients; and international regulatory requirements. These regulatory requirements are continuously improved based on outputs of all medical device companies, such as products and patient outcomes, creating a closed-loop system of continuous improvement for global healthcare.

As an example of a process within a company linked to other processes within that company, consider “Design and Development” and the FDA design-control guidance:

The written descriptions state that Design Input includes:

user needs (shown in the flow-chart)regulatory requirements

The work of your design team converts design inputs into Design Output, which can include:

part drawingssoftware codesservices to customers

After verification and validation, Design Output becomes input for other departments, such as manufacturing and purchasing. In this way, each company functions as a process of continuous improvement.

A company’s quality system should monitor effectiveness of it’s products and feed that information back into product design in a process of continuous improvement. ISO summarizes the process approach as:

For an organization to function effectively, it needs to identify and manage numerous linked processes. The application of a system of processes within an organization, together with the identification and interactions of these processes, and their management to produce the desired outcome, can be referred to as the “process approach.”

Processes should be linked to form a closed-loop system of inputs and outputs. If an output isn’t used by other processes it could be an unnecessary use of resources. In the words of MC Hammer and Vanilla ice, it’s time to Stop! that process, then Collaborate and Listen! to make team-based decisions on prioritizing value-added steps in a process of continuous improvement.

Process symbols

Process maps aren’t required, but they can help you and your team analyze any part of your quality system to ensure it’s a risk-driven process, or to look for gaps to close. They don’t have to be elaborate; simple process maps can be more effective because a diverse group of people can use them without formal training. Common flowchart symbols are shown here:

Resources

CONSULTING & TRAINING

MaetricsLNE G-MedMDI Consultants

AUDITING ORGANIZATIONS

Summary

Processes receive inputs and creates outputs that become inputs for other processes, creating a continuous flow of information and actions.A company’s quality system coordinates these processes

Please share

If you think this has been entertaining and useful, please link to it or forward it for others who could benefit.

Parting words

Vanilla Ice wrote at age 16.

I listened to “Ice Ice Baby” at my high school prom. It’s a fun song, but my taste and choices have evolved, especially with haircuts.

Today, I help corporation improve by becoming more efficient and innovative while reducing risk to people. I focus on life-work harmony for employees, and keep the perspective that we can help >7.6 Billion people have healthier, happier lives.

Life, like a quality system, is process of continuous improvement. I wish you well with both.

.

4 minute read.

Sitting longer than 30-60 minutes at a time increases your risk of back pain, diabetes, and cardiovascular disease. It also decreases your learning ability and mental alertness.

You can take steps every 30 minutes to increase your physical health and mental clarity; literally, take steps every 30 minutes, at a minimum. For some reason, people aren’t doing this, despite extensive scientific evidence of the risks of sitting and the benefits of moderate motion throughout the day.

This is similar to smoking; for years, people ignored the scientific evidence that proved smoking’s hazards because it was socially acceptable. To help others, we could make sitting all day less socially acceptable, both in the workplace but especially in school classrooms where kids are forming habits that will impact them the rest of their lives.

This article summarizes the science behind getting off your behind, then gives steps anyone could take to improve their health can mental clarity and create a healthier culture for workplaces and classrooms.

Facts

The following statements summarize 18 research studies that, combined, followed 800,000 people for up to 30 years.

People who sit most of the day:

Twice as likely to develop diabetesTwice as likely to have a heart attack2.5 times more cardiovascular diseaseMore back pain

People who alternate sitting and standing:

More energyFewer headaches

Students allowed to move instead of sitting:

Less attention deficit More long-term learning and memory

Exercising once a day does not change the negative effects of sitting all day. Benefit comes from alternating sitting and standing throughout the day, with no more than 20 to 60 consecutive minutes of sitting.

Science

Our bodies and minds are more efficient when in motion because of blood flow, spine biomechanics, and blood sugar levels.

Blood Flow

Sitting puts pressure on our thighs and restricts blood flow, decreasing energy and accumulating toxic wastes. Leg muscles pump blood while walking and, to a lesser extent, while standing. Stand using proper posture, ensuring your knees aren’t locked.

Image from Stepit

Spine biomechanics

Sitting weakens back-muscles and changes orientation of spinal discs. When discs change orientation, nutrients are pumped out, disc height decreases, and pressure on bones increases. Together, this leads to degenerated discs and back pain. Similarly, poor posture leads to abnormal forces in the cervical spine (neck), causing headaches.

The effects of spine degeneration can take years to be felt, and are permanent. When you sit, which should not be for longer than 30 minutes, use the best posture for working on a computer.

Image from The Wave Seat

Blood sugar

Sitting after eating increases blood glucose levels, which can cause diabetes. To reduce your chances of diabetes, eat moderate portions, avoid sugars, and walk after eating.

Mental clarity

Our brains need blood flow and oxygen to be efficient, and throughout history, people have realized that mental clarity comes from standing while working.

Winston Churchill advocated using a stand-up desk.

Earnest Hemingway used a stand-up desk, later in life.

In the 1800’s, inventors and designers recognized the need for stand-up desks.

In the 1700’s, Thomas Jefferson designed his own standing desk.

2,600 years ago, The Buddha described the posture of a person wanting to increase mental clarity, saying [he] “sits down cross legged, holding his back erect…”

Sitting cross legged, with your back erect, negates many harmful effects of sitting. The Buddha also advocated eating moderate amounts and following the middle-way between extremes. The middle-way between sitting all day and standing all day, which is also harmful, is a sit-stand desk.

Sit-stand desks

Sit-stand desks include additions to your existing desk, desks designed to alternate between sitting and standing, and desks with treadmills or other forms of exercise. Examples include:

You can experiment with a standing desk by stacking boxes under your computer.

This improvised standing desk is from a Time magazine article, “How a DIY Standing Desk Changed My Life”

Experts

The risk of sitting all day has been emphasized by almost every major newspaper, scientific journal, and government agency.

Take these steps

To start:

Never sit for more than 30 minutes without moving.Eat moderately, avoid sugar, and walk after eating.

Advanced:

Practice being mindful of your breathing and mental clarity each day

Help others:

Arrange your workplace, classroom, or meeting room to allow both sitting and standing.

If you think this could help others, please share.

This is under revision… please don’t forward this version. For a current version, please see my iteration on Linkedin.

Early in 2018 I underwent surgery surrounded by medical devices that were made by companies for which I had consulted. As the staff connected to a device that would keep me breathing during surgery, I thought about my experiences helping companies become more innovative while reducing risk to patients. I wrote this article while recovering. To keep it fun I use 1980’s pop-culture to illustrate the most important points.

Background

Reducing medical device risk is a law in the United States and a standard internationally. The regulations define risk as the severity of harm and how likely it is to happen.

Risk = Severity X Probability

This is more than just a definition, it’s a systematic method of reducing risk that provides repeatable, inspectable methods known to reduce harm to patients and create new products. Unfortunately, this method is underutilized or misunderstood, which harms people and adds costs to companies. For example, 44% of medical device recalls could have been prevented by design-controls that included risk-reduction, and up to 250,000 people die each year from accidental deaths in the American healthcare system. But, when used properly, risk management creates safer products, opens new markets, and makes quality control more efficient.

Regulatory requirements

Medical device manufacturing is regulated in United States by 21 CFR 820, and internationally by ISO 13485. Both require risk analysis, but neither describes how to do it, so we use methods from from the International Standards Organization, ISO, which describes Risk Management in ISO 14971:2007. Additionally, selling medical devices in the European Union requires a supplemental standard, EN 2012 : ISO 14971. which requires, among other things, that risk be reduced “As Far As Possible” (AFAP), which is a stronger statement than ISO’s, “As Low As Reasonably Practicable” (ALARP), and implies that cost can not be an obstacle to reducing risk to people, property, or the environment. Including property and the environments in risk is unique to ISO; the Food and Drug Administration limits risk to patients and users.

EN 2012 : ISO 14971 satisfies risk requirements for all countries, and using it allows a abbreviated regulatory process in the United States. A FDA 510(k) submission can refer to EN 2012 rather than explain internal processes that may be questioned by the FDA.

Medical device companies must pass country-specific audits before they can sell products in that country. An exception is the Medical Device Single Audit Program, MDSAP, which is currently accepted by five countries, including the United States. The image below, from Australia’s MDSAP policy, illustrates that risk management should be fundamental to all areas of a company’s quality-control system, especially purchasing from suppliers, and that risk management begins with a company’s management team.

Hazardous situations

A key aspect of ISO 14971 is identifying potential hazardous situations that could lead to harm. Hazardous situations are often unforeseen, especially by a small group of people who are likely biased by their experiences, therefore identifying hazardous situations requires diverse team input and constant re-evaluation. A classic example is the 1986 Space Shuttle Challenger explosion, which stemmed from a small O-ring allowing gas to leak in a rare, but catastrophic series of events that led to a hazardous situation of a postponed launch, a cold launch day, and fuel leaking around the O-ring that was not rated to such a cold temperature. Some people knew of the risk, but, in 1986, systems weren’t in place to ensure risk was analyzed for all hazardous situations.

Risk analysis methods

After identifying potential hazardous situations and harms, risk analysis is conducted to quantify the severity and probability of each harm. Risk analysis must be documented in a systematic way so that your work can continue with a product’s life-cycle, and that assumptions can continuously be monitored and updated. The two most common methods for medical devices risk analysis are:

Other risk-analysis methods are less common to medical devices, but all should lead to similar results. Most use a table, or matrix, to illustrate Risk = Severity X Probability for different scenarios.

Probability is initially assumed based on similar products or scientific literature, and should be continuously updated with data from real-world use. For the matrix example shown, “catastrophic” and “high” risks would be unacceptable, and “moderate” risks would need to be reduced As Low as Reasonably Practicable or As Far As Possible. In the case of the space shuttle, an unlikely probability of a sequence of events leading to a hazardous situation would be balanced by the severity of failure.

To apply a risk analysis matrix for medical devices, each harm must be unambiguous. Harm is defined by ISO 14971, section 2.1, as “physical injury or damage to the health of people, or damage to property or the environment,” and must be unambiguous so that a “severity” number can be applied, monitored, and continuously re-evaluated.

Companies are required to maintain their risk analysis in a risk management file so that auditing organizations can see evidence of continuous improvement by constantly re-evaluating risk, which includes re-evaluating potential hazardous situations and harm that could result from those situations.

Risk Control

Both ISO 14971 and the EN 2012 supplement describe systematic methods of risk management. For example, they standardize how risk is solved by providing three priorities:

Improve the design to be risk-tolerantAdd safeguards to reduce exposure to riskLabels or instructions to educate or warn of risk

Most of us don’t read or follow instructions, so ISO doesn’t consider written warnings to be effective risk control. This partially explains the European Union’s supplement that cost can not be an obstacle to reducing risk, i.e. companies can not apply a warning label to justify not improving their product’s design. This concept is summarized by an image used for training companies, provided by Oriel STAT-A-MATRIX, a training and consulting organization:

Other forms of risk control can be included in manufacturing processes, inspections before shipping products, etc., but it’s important to emphasize that ISO standards clearly state that prioritization should be placed on design and safeguards, whichever is the current “state of the art.” State of the art means that if a solution is known, it should be implemented; if not, extensive justification should be documented for audits. And, per the European Union definition of reducing risk “As Far As Possible,” cost can not be justification for not implementing state of the art risk control.

Post-market surveillance

Risk analysis uses assumptions that must be constantly re-evaluated using real-world data. Your company’s post-market surveillance processes must be linked to your risk-management processes, ensuring real-world data is used to adjust assumptions in a closed-loop system of continuous improvement.

Definitions

The following definitions can help you search risk management regulations:

HARM – injury to people or property

HAZARD – something that can cause harm

HAZARDOUS SITUATION – a situation in which a hazard could cause harm

HAZARD ANALYSIS – a process for identifying hazards and hazardous situations

RISK – the severity of harm and the likelihood it will happen

RISK ANALYSIS – a process for estimating risks from hazard analysis

RISK CONTROL – actions taken to reduce risk for a product

RISK MANAGEMENT – a company’s official, systematic process for reducing risk

RISK MANAGEMENT PLAN – a plan before risk activities, required by law and standards

RISK MANAGEMENT FILE – a document tracing the location of all risk documents

RISK MANAGEMENT REPORT – a report summarizing all risk management activities for a product, and how it will be continuously improved.

Safer Products

Needle sticks:

Hospital caregivers were often exposed to used needles, increasing their risk of a skin puncture and exposure to diseases such as HIV and Hepatitis C. The first company to innovate a way to reduce this risk quickly dominated the market, and other companies scrambled to create their own designs. Now, patients all over the world benefit from multiple forms of risk reduction, ranging from different needle designs to user-friendly disposal containers.

New Markets

Automatic Electronic Defibrillators (AED’s):

In the past, a patient with a heart attack had to wait for trained paramedics to arrive with a cardiac defibrillator. Paramedics were trained to ensure a patient had a heart attack, as opposed to an illness with similar effects, because using a defibrillator on someone without a heart attack could harm them. Companies innovated defibrillators that reduced this risk by detecting a patient’s condition before allowing defibrillation, which allowed public defibrillators all over the world. This expanded market size, and improved public safety.

Improved Quality Control

Manufacturing processes:

The Sulzer orthopedic company recalled one of their hip implants because a manufacturing change introduced risks into their product. Their quality system did not have modern risk management methods, resulting in thousands of patients with failed hips, secondary surgeries, and permanent damage to their livelihood. A billion dollars went towards lawsuits, putting the world’s 4th largest implant manufacturer out of business. Modern risk management methods ensure that changes are reviewed by a risk management team, reducing errors before they become harmful and costly problems.

Resources

CONSULTING & TRAINING

MaetricsLNE G-MedMDI ConsultantsGreenlight Guru

AUDITING ORGANIZATIONS

Summary

Risk = Severity X Probability

Common risk-analysis methods are: requires a company’s quality system to be a risk-driven process.

Risky Business

I’m having fun with 80’s pop culture while sharing my belief in ; there’s no new information here.

was a 1983 film that springboarded into fame after he danced in his underwear, just like how my career began. (Just kidding.) In the film, a teenage Tom took risks, resulting in harm to his father’s Porsche sports car and their home. Like most movies in the 80’s, their problems were quickly solved with money and quirky but reliable friends.

Healthcare is Risky Business. In the real-world of medical devices, risk affects people’s lives and well-being, and can rarely be fixed with money. If you if they would rather have insurance money or be able to walk normally the rest of their lives, they would have prefered a less-risky hip replacement. Any heart-attack patient saved by a public defibrillator would be grateful for risk-reduction, and hospital workers all over the world are safer each day thanks to reduced risk of needle-sticks.

Our work can be more fulfilling knowing it makes the world a safer, healthier place. We can do our work more effectively by understanding Risk Management regulations that focus on patient safety.

Take a break from saving lives to watch Tom Cruise dance in his underwear, a risk that paid off.