Effects of the MDR and IVDR on health institutions such as clinics and other operators.

14 January 2020

The MDR and IVDR contain hundreds of requirements for the manufacturers of medical devices. But these requirements also affect the so-called health care institutions, such as operators of clinics or hospitals.

The understanding of these requirements helps the operators to avoid regulatory problems, and the manufacturers to act more successfully on the market. Because regulatory requirements for the operators also affect the manufacturers.

1. Definition: Operators, health care institutions, clinics, hospitals, infirmaries

A free checklist for health care institutions can be downloaded at the end of the article. It helps operators to quickly estimate how good they are prepared for the requirements of the MDR and IVDR.

The MDR and IVDR do not differentiate between clinics, hospitals, labs and infirmaries. These are “health care institutions” under the EU directive. Booth define this literally as follows:

2. Requirements of the MDR/IVDR that affect the operators

a) Evidence of implementation

The article 18 of the MDR obligates health care institutions, meaning operators such as hospitals and clinics to provide evidence of implementation to patients who received an implanted product.

b) Internal manufacture

The EU directives (MDR, IVDR) limit the freedom of health care institutions, in particular hospitals, clinics and labs, in developing medical devices themselves. This internal manufacturing is permitted if no comparable medical device is available on the market with CE-symbol.

If no adequate alternatives are available, the operators or labs must fulfil the requirements of article 5 (5). This also requires a QM system. Naturally, internally produced devices must also fulfil the fundamental safety and performance requirements of Annex I (MDR, IVDR).

Software

The MDR has expanded the definition of the term medical device to include the intended uses “prediction and prognosis”. This includes software-based products, e.g. for calculation of scores.

As soon as these products are designated as medical devices, the conditions previously named for internal production apply:

1. No comparable medical device must exist on the market.
2. The health care institution must establish a QM system and fulfil the fundamental safety and performance requirements.

d) UDI

The article 27 of the MDR and article 24 of the IVDR formulate requirements for Unique Device Identification (UDI), that also affect health care institutions.

Health care institutions, operators such as hospitals, must save the UDI of the devices in class III, refer to them and provide them. This has significant effects on the IT systems and processes of the clinics.

Details will be regulated by national directives in the future, as already set forth in §88 (“Power to issue statutory instruments”) of the MPDG in paragraph 1 point 1..

Our checklist (see below) helps to estimate how good the relevant health care institution is prepared for these regulations.

e) Clinical trials

At least indirectly, the clinics are affected by the concrete requirements of the EU directives for clinical trials. The clinics are considered trial locations, the physicians there as investigators. The MDR an IVDR obligate the investigators and trial locations to ensure, for example that

• they have access to the technical and clinical data of the product,
• that the trial is performed pursuant to the trial protocol,
• all data are recorded,
• data protection is ensured,
• the necessary qualifications are present,
• the sponsor of the trial is immediately informed of all severe adverse events,
• the desires of the study subjects are honoured and relevant consent forms and statements are present, and
• there is sufficient insurance coverage.

f) Reprocessing of single-use products

Article 17 of the MDR defines natural or legal persons who process single-use products as “manufacturers of the processed product (who) therefore are subject to all obligations manufacturers are subject to pursuant to this directive”. However, the MDR allows member states to set deviating provisions.

Section 4 of the MPDG also states:

“[...] health care institutions that process single-use products or have them processed under article 17 )3) of the directive (EU) 2017/745, must report this before starting activities with the address of the responsible authorities via the central data collection system at the German Institute for Medical Documentation and Information, if they are obligated to register under article 31 of the directive (EU) 2017/745.”

Section 4 MPDG

All other requirements will be set by national ordinances in the future. Particularly relevant is section 88 (“Power to issue statutory instruments) of the MPDG.

g) IT Security

The MDR and IVDR obligate the manufacturer to provide clear information to the operators on which contribution they must guarantee for IT security. Examples of obligations that the operators must assume are:

• Training users, e.g. creating “awareness” of IT security risks.
• Provide firewalls
• Install and update malware protection
• Guarantee physical access protection
• Define roles and regulate access to systems and data
• Configure devices, e.g. manage authorizations

3. Requirements of the MDR/IVDR for operators that affect the manufacturer

a) Evidence of implementation

Article 18 of the MDR on evidence of implementation affects the manufacturer directly and indirectly. These may consider providing a system to hospitals and clinics. With this system, one can document provision of evidence of implementation and give patients access to additional information on the implanted product such as instructions for use.

b) Internal manufacture

On the one hand, manufacturers profit from the prohibition of internal manufacture by health care institutions. This is the case if they (or competitors) provide adequately CE marked medical devices.

On the other hand, some manufacturers, such as those of clinical information systems try to label their products with an intended use so that the products are no longer qualified as medical devices.

In these cases, the intended use must be clearly formulated and the health care institutions supported if they want to “configure” the product as a medical device.

c) UDI

The health care institutions must document the class III products they receive and provide. If the IT of the hospital cannot do this, manufacturers offer the option of marketing relevant systems. This could occur, for example, in the form of an extended medical device book.

d) Clinical trials

The majority of regulatory requirements for clinical trials affect the manufacturer. These should also support clinics in meeting the requirements.

Acquiring authorizations is included in this, as well as tailored training sessions for the investigators, provision of technical and clinical data and comprehensible documentation for investigators and study subjects as well as close-knit monitoring.

e) IT Security

IT security will only be successful if manufacturers and health care institutions work hand in hand. This includes both setting forth the relevant requirements in writing. Manufacturers should formulate recommendations for this, because they can best assess the risks associated with their products.

4. Conclusion / Summary

a) MDR and IVDR contain provisions for manufacturers and operators

Even if the EU directive requirements are targeted toward the manufacturers. They do contain many requirements for health care institutions such as labs, hospitals, clinics, infirmaries or other operators.

b) Challenges of internal manufacture and LDTs

These requirements not only, but also affect health care institutions if they become internal manufacturers. The latter should be taken into consideration for Lab Develop Tests.

The operators and labs are recommended to create a rapid overview of the products that apply as internally manufactured medical devices now or in the future. They should provide evidence that these are better than products with CE symbols. This evidence will be challenging and must be continually updated. Even if this occurs, comprehensive requirements must be fulfilled.

c) Linking MDR/IVDR with GDPR

On the one hand, these requirements are those of the MDR and IVDR. On the other hand, the requirements for data protection and thus the GDPR must be met. Article 57 of the IVDR states:

“The performance studies, including performance studies in which residual samples are used, are performed under the valid data protection regulation.”

IVDR, article 57

d) Outstanding national regulations

The EU member states have the task of closing "regulatory loopholes” and using the degree of freedom offered by the EU directives. So specific regulations are required for the reprocessing of single-use products.

It would also be good if the countries define that the previously used internal manufactured products (“Inhouse IVDs”) may be considered legal in operation. Because for products that enter operation before the effective date, article 5 (5) of the IVDR only takes effect after the transition period. The problem would otherwise be that these “Lab Developed Tests” do not profit from transition periods, because there were previously excluded from the IVDD or were not IVDs at all.

For years there will be two groups of LDTs: Those regulated and unregulated under the IVDR. Here it will be decisive for the health care institution which change to the LDTs is allowed to keep up the grandfathering during the transition period.

e) Further support

The Johner Institute not only supports manufacturers, but also hospitals and other health care institutions such as labs in “legalising” their own manufactured products, meaning to establish processes in accordance with the law and creating product files.