Current FDA's Warning Letters on IT Topics - Part 1: Medical Devices

Recommendation

23-26 April 2024
Berlin, Germany

Computerised System Validation - Introduction to Risk Management + GAMP 5 Approach
Learn How to Plan, Implement and Document Effectively Computer Validation Activities

In a first stage of escalation - when serious GMP deviations are identified during inspections, or in case of insufficient corrective measures - the FDA issues a Warning Letter to the company concerned. Within 15 working days, the company in question has to redress the deviations with concrete action plans. If the Agency evaluates these action plans as insufficient, further escalation levels may follow.

Some Warning Letters from 2014 also list GMP deficiencies with regard to IT topics. Not a single Warning Letter has been exclusively issued just because of IT issues though. But taken together, all the GMP deviations in a company were so serious that the Agency issued a Warning Letter which also included deviations related to IT.

All in all, 7 Warning Letters from 2014 contain topics with regard to IT. Four Warning Letters have been issued to manufacturers of medical devices, 2 Warning Letters to manufacturers of medicinal products and 1 Warning Letter to an API manufacturer.

IT-related Warning Letter regarding medical devices

IT-related Warning Letters to manufacturers of medical devices always refer to 21 CFR 820.70 (i) "Failure to validate computer software for its intended use according to an established protocol when computers or automated data processing systems are used as part of production or the quality system, as required by 21 CFR 820.70 (i)".

The Warning Letter issued for the company Cotton High Tech generally noticed that the company wasn't able any more to show that the (not further specified) system had been validated for the intended use. The Warning Letter for Instrumend referred to a Software Operating System used to log, evaluate, and investigate complaints, incoming, in process, and finished non-conformances. It has be found that the validation didn't exclude the fact that records could be deleted by employees. The company's response was insufficient: the response did not include a validation report for the Sofware Operation System for restricting the deletion of complaints to the Heads of Quality. In addition, the Agency had been missing training records on revised procedures. The Warning Letter for the company HeartWare showed failures to maintain the own requirements for validation. A new test was implemented in July before the modified software was validated in September.

The company Steris Isomedix sterilises medical devices. It failed to take specific measures to ensure that computer errors do not generate the loss of dosimetric data. Over two years 2,900 records were missing and their (planned) loss couldn't be clearly identified. Although the company's response to the Warning Letter announced corrective actions to be taken, no documentation was included with the responses to verify these actions.

Sources:
Warning Letter for Cotten High Tech S.L

Warning Letter for Instrumend GmbH

Warning Letter for Steris Isomedix Services

Warning Letter for HeartWare

FDA's Warning Letters webpage