Medical Device Document Control

Medical device document management and control is the underpinning of your company’s Quality Management System. The documents and records that you maintain and how you control them will highlight to the world that your products are safe and efficacious to use.

Under regulatory standards like ISO 13485 and the FDA 21 CFR Part 820, you are obliged to maintain and control certain documents. In addition, if your company uses an electronic document control solution, FDA 21 CFR Part 11 will highlight the ways and means of handling electronic records and signatures.

As a medical device QMS software provider, having helped medical device companies of all sizes across the globe switch effortlessly from traditional paper-based QMS systems to digital software solutions, we know a thing or two about document control.

In this article, we will delve into the main requirements for a medical device document control system, the problems that companies face with traditional systems, how you can streamline the entire document control process, as well as the benefits you accrue when you invest in a digital document control solution.

But first, let us understand the basics:

• What is Medical Device Document Control?
• Medical Device Document Control Requirements
• The Challenges of Traditional Medical Device Document Control
• How to Streamline and Simplify Your Medical Device Document Control System
• Streamline Document Control at Your Medical Device Organization

What is Medical Device Document Control?

Medical device document control can be defined as the processes and procedures that organizations operating in the medical device industry will systematically apply to guarantee that the documents pertaining to the lifecycle of a medical device product will be created, re-evaluated, circulated, and disposed of in a provable and organized manner.

Such document control is at the crux of your medical device quality management system. It is also mandated under international regulatory standards, including FDA 21 CFR Part 820, ISO 13485:2016, EU MDR, and FDA 21 CFR Part 11. More on this in a bit.

Let us take the example of the AI-enhanced remote ultrasound system. It is but natural that you will put your best foot forward! Your company will ensure that every minute detail is looked into, as there will be a lot of scrutiny from space agencies, regulatory agencies, the public, and your competitors. One of the best ways to ensure that your product is accepted is with efficient documentation and document control.

Difference Between Document Control and Document Management

The main difference between document control and document management is that document management indicates the systems and procedures that your company will put in place to maintain and manage documentation pertaining to the lifecycle of a medical device product.

This means the “how’s and why’s” of storage, tracking, updating, and sharing of such documents.

Document control is the practices in place to ensure the creation, review, distribution, and disposal of documents of the lifecycle of a product methodically.

For example, during the conceptualization and manufacture of the enhanced remote ultrasound system, you will be generating tonnes of documents. With a document management system, you will store, track, update, and share these documents with relevant personnel and stakeholders. How you create, distribute, and dispose of these documents will fall under the purview of document control.

You can streamline your document control processes with our medical device document control software. It helps you manage and control documents, control changes, and approve documents electronically. Furthermore, the SimplerQMS document control solution is part of the quality management suite, which is a complete end-to-end quality management solution for medical device companies.

Medical Device Document Control Requirements

Effective document control is at the crux of all life sciences companies, including medical device manufacturers. Several international guidelines govern it.

They are as follows:

• FDA 21 CFR Part 820.40
• ISO 13485: 2016
• EU MDR
• FDA 21 CFR Part 11

FDA 21 CFR Part 820.40

FDA 21 CFR Part 820 is the standard from the US Government’s Food and Drugs Administration (FDA) that applies to current good manufacturing practice requirements for all finished medical devices that are intended for human use in the United States.

When we consider document control, we need to refer specifically to section 820.40 of the FDA 21 CFR Part 820, which states the following.

“Each manufacturer shall establish and maintain procedures to control all documents that are required by this part. The procedures shall provide for the following:

(a) Document approval and distribution. Each manufacturer shall designate an individual(s) to review for adequacy and approve before issuance all documents established to meet the requirements of this part. The approval, including the date and signature of the individual(s) approving the document, shall be documented. Documents established to meet the requirements of this part shall be available at all locations for which they are designated, used, or otherwise necessary, and all obsolete documents shall be promptly removed from all points of use or otherwise prevented from unintended use.

(b) Document changes. Changes to documents shall be reviewed and approved by an individual(s) in the same function or organization that performed the original review and approval, unless specifically designated otherwise. Approved changes shall be communicated to the appropriate personnel in a timely manner. Each manufacturer shall maintain records of changes to documents. Change records shall include a description of the change, identification of the affected documents, the signature of the approving individual(s), the approval date, and when the change becomes effective.”

Succinctly, section 820.40 states that medical device companies selling their products in the US market should have protocols and procedures for the control of all pertinent documents as highlighted in the FDA’s Quality Systems Regulations (QSR).

ISO 13485:2016 Section 4.2.4

The International Organization for Standardization (ISO) guidelines provide medical device companies with the standards for their Quality Management Systems.

Section 4.2.4 (Control of Documentation) of ISO 13485:2016 specifically states that:

“Documents required by the quality management system shall be controlled.”

In this section, the magnitude of document control is emphasized for the entirety of a medical device’s lifecycle.

ISO 13485:2016 Section 4.1.6

Furthermore, section 4.1.6 of ISO 13485:2016 highlights a company’s requirements for computer system validation in the following way.

“The organization shall document procedures for the validation of the application of computer software used in the quality management system. Such software applications shall be validated prior to initial use and, as appropriate, after changes to such software or its application.”

This becomes important when we consider the use of an electronic document management system or electronic QMS.

EU MDR

The Medical Device Regulation of the European Union (EU MDR) which came into full effect on the 26th of May, 2021 contains many relevant points when it comes to document control.

The emphasis is on the complete lifecycle of a medical device, including:

• Periodic safety update reports (PSUR)
• Document storage retention
• Post-market surveillance systems

Periodic safety update reports (PSURs) are pharmacovigilance documents that your company will submit to the regulatory agency regularly to disclose the worldwide safety experience of a product.

Post-market surveillance reports are for medical devices that are already on the market. Your company will collect and evaluate the experiences gained from such medical devices and determine if you need to take any further action.

Recommended Reading

• Post-Market Surveillance (PMS) for Medical Devices
• EU MDR Quality Management System [Role of an eQMS]

Summary of Key Requirements for Document Control in Medical Device Companies

International regulations and standards, including FDA 21 CFR Part 820, ISO 13485:2016, and EU MDR have several commonalities that are listed below:

• Document control protocols: Your company requires a dependable and standardized policy for the management of all relevant documents.
• An up-to-date version of the document: The documents in circulation and those present at applicable locations in your company must be available only in the latest up-to-date versions.
• Rules for document control approvals: (1) All document control approvals in your company must compulsorily include the signatures of the person(s) approving the said document, with the date on which the approval was given. (2) Such approved changes in documents need to be communicated with the relevant personnel in all concerned departments. (3) Any changes in a document must be reviewed and approved by the person(s) who was initially involved in the original review and approval.
• Evaluation of procedures: The senior management in your company will identify the most appropriate person(s) who will evaluate all protocols concerning pertinent documents.

FDA 21 CFR Part 11

The US FDA describes 21 CFR Part 11 in the following way:

“The regulations in this part set forth the criteria under which the agency considers electronic records, electronic signatures, and handwritten signatures executed to electronic records to be trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on paper.”

FDA 21 Part 11 applies to your company if you are using any type of electronic document management software. Even if you have a paper-based documentation system, but use email for sending and receiving documents, scan documents electronically, and/or have a server for storing electronic versions of documents, you will have to be compliant with this FDA regulation.

Essential FDA 21 CFR Part 11 Software Requirements

When your medical device company has transitioned into a 21 CFR Part 11 compliant document management system, the following requirements become applicable to you:

• System validation: Your company should authenticate the system software regularly. This is needed to ensure that all components of the system are working as projected.
• Operational controls: The system in your company will utilize a phase-gate process for analyzing and controlling all quality procedures.
• Record generation: The system should effectively and efficiently generate exact copies of records and documents that concern your company’s Quality Management System. In addition to electronic copies it should be able to generate physical printouts, whenever required.
• Audit trails: The audit history file of the system should be able to store all new documents, modified documents, and deleted documents. The audit history file should not be modifiable. These features allow your company to have a secure and trustworthy audit trail of all records and documents generated by the company.
• Training: Any person who needs to access the document control solution must first be properly trained. They should have the requisite education and experience to handle assigned duties.
• Electronic signatures: An important feature of an electronic document control system is the ability to generate electronic signatures of the person(s) reviewing and approving documents. These signatures will also contain the name(s) of the signatory, ownership, date, and time.
• Security controls: You will allow only relevant personnel to access the system with the help of unique login usernames and passwords.

Check out our article on the FDA 21 CFR Part 11 software requirements to learn more about this topic.

You can simplify compliance with document control requirements by investing in a fully validated medical device QMS solution, like SimplerQMS.

SimplerQMS has been purposely built to help medical device companies work more efficiently and meet stringent regulatory requirements such as FDA 21 CFR Part 820, ISO 13485:2016, EU MDR, and FDA 21 CFR Part 11.

We provide QMS software with built-in document controls for medical device companies, which include features like automatic version, revision control, FDA 21 CFR Part 11 compliant digital signatures, and time-stamped audit trails for all document changes. In addition, a centralized, cloud-hosted repository assures both compliance and audit readiness.

The Challenges of Traditional Medical Device Document Control

When medical device companies use traditional paper-based legacy systems, and/or ad-hoc document control systems, or hybrid document control systems, they will face many challenges. This applies equally well to both small and large organizations.

These challenges can be categorized as presented below.

Document Version Control Confusion

With paper-based document control systems, even the best-organized companies can have major issues with document version control.

How will you ensure that all departments within the organization have only the most current versions of relevant documents?

It becomes cumbersome and a waste of precious resources tracking down document activity and keeping track of specific changes in every document.

Imagine this scenario – the manufacturing unit in a medical device company is relying on a document related to third-party selection that is over two years old. They are not aware that this document was superseded by a newer version six months back.

Time Inefficiency

A major challenge that companies using paper-based document control systems face is the waste of valuable time.

• You are likely to put in much effort to:
• Route documents to relevant departments
• Have discussions and make changes
• Get authorized staff to approve and sign these documents
• Hunt for misplaced documents and records
• Etc.

For example, the FDA/ISO auditors have come to audit a medical device company. They ask for certain documents to be submitted during the audit. These documents need to be retrieved from the specific department. This can take the time that should have been utilized more meaningfully.

Ineffective Document Collaboration

Anyone who continues to use physical paper-based systems will know that it is very difficult to make multiple edits and then circulate the latest version of a document to their designated areas.

It takes a lot of time and effort to ensure that everyone has received the same version. And there is also no guarantee that all relevant personnel will receive the updated document on time.

Lack of Security

When documents are manually filed in a retrieval system, the person(s) handling this task may file them under the wrong name or even lose the document.

Also, how will the company ensure that sensitive documents are secured?

Is it not possible for a disgruntled employee or a competitor to break into a physical retrieval system and gain access to proprietary information?

Lack of Accessibility

Accessibility issues are plenty with paper-based document systems.

For example, a key senior staff member is on sick leave when their signature is urgently required on a crucial document.

How will this document be validated in the absence of this person?

Ineffective Communication

Inevitably with traditional documentation systems communications is not efficient.

You need to communicate with multiple stakeholders during the entirety of a medical device lifecycle, including but not limited to:

• Internal departments
• Branches of the company in different locations
• Third-party vendors
• Regulatory agencies
• Product end-users
• And others

Inefficient communication can result in delayed supplies, recalls, and even more serious, and warning letters.

Lack of Oversight

When a company is reliant on paper-based systems, unintentional failures can creep in because of a lack of proper oversight.

Documents may remain unsigned, documents may be stored in multiple locations, and you may be too reliant on multiple people and different tools such as spreadsheets and Google docs.

All of these can result in inaccuracies creeping in.

Difficulty Maintaining Regulatory Compliance

When a company has a paper-based system in place, they are reliant on its personnel to be up-to-date with the latest regulatory standards and guidelines.

What if this person(s) is still unaware of the recent EU MDR guidelines?

And the list of such issues goes on…

Do you find yourself facing any of these challenges?

Well, rather than trying to work around these inefficiencies, medical device organizations are now turning to software solutions for a better way to manage their documents.

The problems with security, document versions, accessibility, editing, and manual processes can all be remedied with the right software solution, like SimplerQMS. At the same time, maintaining compliance with stringent regulatory requirements is made easier.

How to Streamline and Simplify Your Medical Device Document Control System

Documentation and document control are of the utmost essence for a company that deals with products that affect human lives. Having considered what document control is, and the common challenges of traditional paper-based systems, let us check on some of the best practices for streamlining and simplifying medical device document control.

Employ a Document Controller

A document controller, or document control specialist, is a technically proficient person who is in charge of all document control activities in the organization.

Depending on the size of the company, you may employ more than one document controller. Since document control needs technical expertise in several areas, it is prudent to have more than one document control specialist, especially in larger companies.

Have Procedures and Protocols in Place for Document Control

The organization should have a Quality manual for all document control procedures.

The Quality Manual will emphasize a standardized and controlled manner to organize documents and data.

The key aspects of the Quality Manual include:

• Creating documents
• Review and approval
• Revisions to documents
• Publishing documents
• Disposal or archiving of old documents

Employ Standard Naming Conventions for All Your Documents

A standard file naming convention provides your organization with the proper structure for listing all files. This will help describe the contents of each file and their relationship to other files.

Good practices for naming files are:

• Consistent names for files
• Short yet descriptive file names (<25 characters)
• Avoidance of special characters and spaces in the file name
• Inclusion of the version number

An example of a standard file naming convention is given below:

• A numbering system for large files/folders
• The project Lead’s Initials/last name-first name
• The file creator’s initials/last name-first name
• Project title or a suitable acronym for common file types (for example- BD= business documentation)
• The date on which the file was generated or created (either DD/MM/YY or YY/MM/DD depending on which side of the Atlantic Ocean you are located)
• The version number of the file

Your organization can consider following a similar convention. This will go a long way towards streamlining and simplifying your document control procedures.

Leverage the Use of Reusable Document Forms and Templates

Your staff should not waste their time redeveloping document forms and templates for every new project. When you have reusable forms and templates that have withstood the test of time, it makes life much easier for everyone.

Some examples of reusable document forms and templates include:

• Non-conformance Report (NCR) templates
• Corrective Action and Preventive Action (CAPA) form templates
• Change Control forms
• Complaints and Calibration forms
• Training Attestation forms

Utilize Cloud Storage

With cloud storage, you will be storing your files on cloud servers.

Even if a server crashes, your precious data is accessible from other locations, thanks to data backup and recovery services.

For example, in SimplerQMS data backups are executed every 15 minutes, stored in multiple geographical locations, and monitored by professionals 24/7. This ensures that your data is always safe and sound, no matter what happens.

Establish a Single Source of Truth

The documents that your company generates throughout the lifecycle of a medical device product highlight the authenticity of the processes and protocols. These documents will assure your stakeholders that your products are of high quality, safe, and efficacious for human use.

Essentially it means that these documents are a single source of truth. So, document control is imperative for this purpose.

By centralizing all documents in a single repository, ensuring that only the latest version of documents is in use, the history of every document is traceable, and streamlining communication and collaboration between departments and stakeholders, you will have a single source of truth.

Make Continuous Improvements

When your company is expanding or becoming more established, you will need to make improvements to your document control system. The restructuring of the document control system to suit your current needs can be intimidating.

But, by splitting each step into smaller manageable phases, the work becomes easier.

Your organization can start by ensuring that copies of all documents are stored in a secure centralized repository. Make certain that you have proper filing systems for the latest versions vis-à-vis obsolete versions of these documents. Also, schedule reoccurring document review tasks and make it a point to review and update the documents on a regular basis.

Integrate With eQMS and Automate the Core QMS Processes

The steps mentioned so far can all be implemented manually.

But, for document control to work fully and most efficiently, you can consider automating the completed documentation processes and integrating them using an eQMS software solution like SimplerQMS.

By connecting your document control system with an entire QMS, you will be able to automate and streamline core QMS processes. This will enable real-time collaboration between departments and stakeholders, give you full traceability, timely reminders, easier audits and regulatory compliance management, and better management of all your documents, using one central system.

Streamline Document Control at Your Medical Device Organization

Traditional medical device document control using paper-based systems or a mix of paper and electronic files has its inherent challenges. These include the utilization of precious resources including time for such manual processes and the possibility of errors creeping in.

All of these can expose your company to compliance issues with regulatory agencies. This can further compound into product recalls.

SimplerQMS provides you with medical device document control software that is a part of the quality management suite, providing a complete closed-loop quality management solution.

Features like automatic version control, revision control, electronic signature, full audit trails, automated document workflows, and others make it easier for you to manage documents while maintaining compliance with ISO 13485:2016, EU MDR, FDA 21 CFR Part 820, and FDA 21 CFR Part 11.

Cloud deployment also ensures that your data is always accessible, backed up, and secure.

Streamline Your Document Control Processes With Medical Device Document Control Software

Final Thoughts

Document control for a medical device company signifies the strategies and methods that are followed for the management of all the documents generated during the lifecycle of a medical device product.

With document control, you are ensuring that documents are created, reviewed, distributed, archived, and/or disposed of in a verifiable and organized manner.

Traditional document control systems are plagued by many deficiencies, including issues of security, storage, document versions, resource management, accessibility, and compliance.

When you invest in a medical device eQMS solution such as SimplerQMS, your company will streamline and automate documentation processes, eliminate the problems of paper-based systems, and be better prepared for audits and inspections.

If you are keen on streamlining and simplifying your document management processes, book a personalized demo and talk to one of our quality solution experts to see how SimplerQMS can help you in your document control journey.