Guest Biography:
Our guest today is Bijan Elahi, where we talk about risk management for clinical investigators conducting medical device clinical trials.
In this episode, you’ll be introduced to ISO 14971 Application of risk management to medical devices and learn about its relationship to ISO 14155 Clinical investigation of medical devices for human subjects — Good Clinical Practice.
You’ll also understand key terminology around risks, how to define risk, what’s special about clinical studies with respect to risk management, and much more.
Bijan has worked in risk management for medical devices for over 29 years at the largest medical device companies in the world, as well as small startups.
He is a technical fellow and Medtronic corporate advisor on safety risk management of medical devices. In this capacity, he offers education and consulting on risk management to all Medtronic business units, worldwide.
Bijan is a lecturer at Eindhoven University of Technology (Netherlands), where he teaches risk management to doctoral students in engineering. At the invitation of the FDA, he also teaches a graduate course on medical device risk management at Drexel University in Philadelphia.
Bijan is the founder of MedTech Safety, Inc., an education and advisory company. He has educated over 6,500 individuals worldwide. Bijan is a frequently invited speaker at international professional conferences, and is also a contributor to ISO 14971, the international standard on the application of risk management to medical devices.
Last but not least, he is the author of Safety Risk Management for Medical Devices, published by Elsevier publishing.
Enjoy!
Sponsors:
This podcast is brought to you by Slope. Slope drives operational excellence for highly complex, sample-intensive, early-phase clinical trials. The platform transforms chaotic clinical trial supply chains into protocol-specific operational workflows for sponsors, CROs, clinical research sites and labs. Slope is trusted by industry leaders in complex early-phase clinical trials from top 50 pharma and CROs to emerging biotechs, and a global site network including NCI cancer centers and AMCs. Learn more at https://www.slopeclinical.com/
Resource List:
US Food and Drug Administration (FDA)
European Union Medical Device Regulation (EU MDR)
CE Mark
In Vitro Diagnostic Regulation (IVDR) (EU)
International Organization for Standardization (ISO)
ISO 14971:2019 – Medical devices — Application of risk management to medical devices
ISO 13485:2016 – Medical devices — Quality management systems — Requirements for regulatory purposes
Periodic Safety Update Reports
Eindhoven University of Technology in Netherlands
Drexel University in Philadelphia
Quality Management Systems (QMS)
Standard Operating Procedures (SOPs)
US Medical Device Classification System
Let’s Talk Risk with Dr. Naveen Agarwal
Books and Literature Mentioned:
Thank You for Arguing – Jay Heinrichs (Amazon, Barnes & Noble)
Safety and Risk Management for Medical Devices – Bijan Elahi (Amazon, Barnes & Noble, Elsevier)
Show Notes:
[0:20] Kunal Intro and Background on Bijan Elahi and Risk Management for Medical Devices
- Episode focuses on ISO 14971 (Application of Risk Management) and ISO 14155 (Clinical Investigation of Medical Devices)
- Bijan has 29 years of risk management in medical device experience
- Technical Fellow and Medtronic Corporate advisor
- Lecturer at Eindhoven University of Technology in Netherlands
- Teaches medical device risk management at Drexel University in Philadelphia
- Founder of Medtech Safety Inc
[3:00] Safety and Risk Management book by Bijan Elahi
- Medical Devices are approved by regulatory agencies for commercialization in every country
- Risk Management identifies and evaluates risks and determines how to control them against their benefits
- Book helps to demystify the discipline of risk management
[2:17] Prompts for Risk Management and Clinical Studies
- Intention of studying some kind of medical device for its risk and benefits
- ISO 14155 requires that the principles of risk management be applied during planning and conduct of the study
- ISO 14155 and ISO 14971 are very intertwined
[6:04] Law, Regulations, and Harmonized Standard in US and EU
Our obligation to regulatory agencies is to comply with the law. In the United States, that means following 21 CFR Part 820, the FDA’s quality system regulation for medical devices. In Europe, compliance is governed by the Medical Device Regulation (MDR) and the In Vitro Diagnostic Regulation (IVDR).
To meet these requirements, manufacturers must demonstrate that —
- In the U.S., devices are safe and effective, and
- In Europe, devices meet the General Safety and Performance Requirements (GSPRs).
The most efficient way to do this is by conforming to recognized or harmonized standards.
- In the U.S., the FDA recognizes the standard ISO 14971:2019 (third edition) for risk management.
- In Europe, the harmonized version is EN ISO 14971:2019 + A11:2021, which aligns with European regulatory requirements.
Conforming to ISO 14971 in both regions provides a presumption of conformity — meaning regulators accept that your risk management process meets the key safety and performance obligations under both U.S. and EU law.
[9:43] Advice for Investigators Thinking About Risk Management
- ISO 14155 has specific requirements for risk management
- Makes normative reference to ISO 14971
- Many clinical investigators rely on experts in medical device risk management to make sure they are in compliance
- All investigators should take a basic training on ISO 14971
- Helpful to empower investigators to be able to speak the same language as their risk management team members/associates
[14:35] Top Risks Clinical Investigators Face
- Two Types of Risks for Subjects on Trial
- Risk from the Device
- If device is commercially available, the device should have a risk management file and risk management report developed by the manufacturer
- When using devices outside of their commercial indication you are introducing new risks that may not have been previously anticipated
- Risk from the Study
- Comes from the study procedures, execution, and data handling
- Not as much risk to body as risk of faulty data that could cause faulty conclusions
- Risk from the Device
[17:56] How can Investigators Keep Up and Educate Themselves
- Fundamental training helps investigators ask the right questions
- Books like the one from Bijan are also a great resource for keeping up and understanding the landscape
- Special lectures are helpful for better understanding specific aspects of risk management
[19:54] ICF and its Relationship to Risk Management
- Informed Consent is a required part of risk management
- Risk management helps to provide what information should go in the ICF
- If no prior information of risks is available, that should be stated
[22:07] Risk Management Processes or Tools for Clinics
- Labeling information for safety and how to use a device, and what conditions to look out for are outputs of risk management that are helpful for clinics
- General consensus is there is no “Zero-Risk” medical device
- Some medical products can have “no benefit” like cosmetics
- For “No Benefit” products sometimes you don’t look at benefit to patients but instead benefit to society
[27:07] Sponsor Message: Slope Clinical (https://www.slopeclinical.com/)
[28:03] Can Regulations and Standards be Different?
- A regulation is a law that expects certain things
- Showing the risk benefits of a product are accurate and verified is done through adhering to the ISO Standards
[29:25] When is Compliance with ISO Standards Required?
- In most cases, risk management is required whenever a clinical investigation involves direct interaction with patients — for example, when a device is being used on or implanted into a patient. That’s because the study is actively evaluating the device’s safety and performance in a clinical setting
- However, there are some exceptions. If you’re conducting a post-market clinical follow-up (PMCF) on a device that’s already approved and being used as intended, and you’re simply collecting or analyzing data — for instance, reviewing registry data, confirming that the instructions for use (IFU) are accurate, or studying cost-effectiveness or health outcomes — then risk management may not be required
- In these cases, no new risks are introduced to patients because the device use remains unchanged. You’re essentially performing data analysis, not intervention
[31:04] Review of Terminology
- EU MDR requires post market surveillance and outputs of the post market surveillance
- Output is a Periodic Safety Update Report (PSUR)
- Another output is a Post Market Surveillance Reports (PMS)
- Lack of clarity in language of risk management creates barriers in understanding
- These terms are explicitly defined in ISO 14971
[33:56] Where does Bijan’s Book Fit into a Product Life Cycle
- Applicable for the entire product lifecycle
- Concept > Design and Development > Deployment > Maintenance > Decommission and Disposal
- Most educational programs for Biomedical or Electrical Engineering do not cover risk management extensively
- Resources like this book are helpful for people who want to self educate
[37:00] Relationship between Quality Management Systems and Risk Management
- Quality Management System includes: Standard Operation Procedures (SOPs) for doing risk management and that comes as part of a Quality Management System (QMS)
- Governed by ISO 3485
[37:53] Day to Day Work for BIjan
- Used to be a product developer – system engineer working on Class III devices.
- Implantable pulse generators, cardiac pacemakers, defibrillators, and deep brain stimulators
- Moved from development work to teaching – 3 universities: 2 in EU and one in USA
- Some teachings are skills courses that cover risk management techniques like: Failure Modes and Effect Analysis or Fault Tree Analysis
[40:13] Advice for People Trying to Be Successful in Risk Management
- Field requires some level of personal preset curiosity and perseverance
- Helps to motivate you and keep you going when things are difficult
- Constantly learning is key to keeping up and finding success
- Broadening your area of interest helps you to understand what new areas may eventually need robust risk management
- Example of Cybersecurity not being a major issue 20 years ago but now it is its own field of study
- Soft skills matter just as much as technical knowledge
[44:57] Books and Resources Bijan has Found Helpful
- Thank You for Arguing
- Want to pursue courses that develop your critical thinking skills, management skills, decision making abilities and also your sense of humility
[47:44] Is Death Harm?
- In English the answer is typically “Yes”
- In risk management that is not a “harm” but instead a “consequence”
- Example of a stroke from a product defect: the stroke is the “harm” the death from the stroke is the “consequence”
[50:08] Improving One’s Understanding of Risk Management Language
- Practicing the language of risk management is key to understanding these concepts
- Quizzes and games can help with this practice
- Incorrect use of language wastes time and wastes resources
- MedTechSafety.com – Bijan’s website
- Workshop practices to work through the analysis techniques you are learning are very helpful
[56:39] Cyber Security and Risk Management
- Many programs coming up teaching about cybersecurity
- Much of risk management is about preventing harm but with Cybersecurity you are typically trying to make systems resilient to security breaches
- Protecting private health information
- Some medical devices are now entirely software
[59:50] Bijan’s Advice for Keeping Up
- Try to understand what resources are available: Lectures, Podcasts, Books
- Let’s Talk Risk with Dr. Naveen Agarwal
[1:02:06] Bijan’s Closing Thoughts
- Clinical investigators should know that risk management is necessary and from the standard ISO 14155
- Communicate with your risk managers or become one if needed
- Take trainings to understand the language of risk management and know what is required of you and your project
[1:03:27] Sponsor Message: Slope (https://www.slopeclinical.com/)
Major Themes:
- Risk management is a constantly evolving field that involves identifying and evaluating risks and determining how to control them against their benefits. Risk management requirements are guided by both international and local regulations and impact all levels of medical product life cycles.
- Being proficient at risk management requires strong critical thinking skills and an ability to understand the specialized language and terminology of risk management.
- Keeping up with the changing landscape and requirements of risk management is a constant effort and experts in this field are expected to be lifelong learners.
Quotes:
- “The discipline of risk management identifies the risk and evaluates them and controls them and then compares them against the benefits.”
- “An investigator who has at least some fundamental training and risk management, will be able to at the least ask the right questions.”
- For a person to be successful in risk management, I think they should have some personal characteristics, preset curiosity and perseverance. Curiosity, so that you can feel a motivation to continue to learn, perseverance basically keeps you going when it gets hard.”
Audience Question:
Have you had your work impacted by risk management requirements? What are some current developments in technology that you believe will impact the future of risk management?
