Combination Product Industry News & Guidance
Sharing device-related information and wisdom
that will help you succeed
Risk Management Assessment for Combination Products
As a developer of combination products, it is your job – per ISO 14971:2019 and the EU MDR – to identify and document known and foreseeable hazards associated with the medical device constituent of your product.
This requirement goes beyond hazard identification, because what regulatory bodies really care about is the risk of harm that could come to people, property, or the environment due to hazardous situations. For each hazard you must consider the reasonably foreseeable sequences or combinations of events that can result in a hazardous situation AND estimate the probability of the occurrence of harm. Since a hazardous situation does not always lead to harm, you need to calculate the probability of harm occurring for each identified hazardous situation .
Now it all seems rather convoluted, doesn’t it? Don’t worry – we can simplify it for you. In this article, we will break it down to the basics to help you easily map out your own risk probabilities.
Let’s start with some definitions of the key components involved in assessing risk…
Hazard: A potential source of harm, independent of whether the user is actually exposed to harm.
Hazardous situation: A circumstance in which one is exposed to a hazard, creating direct potential for harm.
Harm: Anything, intentional and unintentional, that impairs or adversely effects the user/patient, property, or the environment.
Risk: Combination of the probability of occurrence of harm and the severity of that harm
How, exactly, are these above-defined elements related?
Put simply, a Hazard does not pose a potential for Harm (Risk) unless a Hazardous Situation occurs. For example:
A shark is a hazard that can cause harm to a person. However, if a person is on the shore or in a boat, a hazardous situation does not exist because the person is not EXPOSED to the shark hazard. Therefore there is no risk associated with the shark.
If the person is in the water near the shark, a hazardous situation exists and there is a risk of harm to the person.
Similarly, a used needle is a hazard that can cause harm to a person. However, if the needle is shielded then a hazardous situation does not exist because the person is not EXPOSED to the used needle. Therefore, the risk associated with a used needle has been mitigated by the needle shielding feature.
If the device does not have a needle shield feature, then the person will always be exposed to a used needle hazard after use and there is a risk of harm to the person.
How do we perform risk analysis for a hazard, hazardous situation, and harm?
Risk is evaluated based on severity and probability of occurrence of harm. We can point out some common misconceptions of risk analysis just based on that simple definition:
- Anything which is unrelated to harm is out of scope for risk analysis. Business risk should be handled at the project or management level.
- Detection is not part of the primary risk evaluation. We still commonly see the use of severity, occurrence, AND detection when evaluating risk. This is an outdated risk approach that is not aligned with ISO 14971. However, detection can be incorporated into the probability of occurrence of harm, ie, if a failure is obvious then it may reduce the likelihood of harm.
When it comes to estimating severity and occurrence of harm, severity is fairly straightforward. That is, as long as severity is being assessed by persons with appropriate medical knowledge. In other words, the engineering team shouldn’t be deciding if sterility failure would cause a minor infection or sepsis.
Estimating occurrence of harm is where things can get thorny. The simplest approach is to use a single overall probability which assumes if a failure happens then the corresponding harm also happens. For example:
Assume test results show injection stall failure mode occurrence is 0.1%
–>Injection stall failure mode can cause an underdose / disruption to therapy
–>Therefore injection stall failure mode is assigned occurrence of 0.1% for disruption to therapy
Using P1 and P2
While use of a single occurrence score is common due to its simplicity, it is a more conservative assessment of risk than breaking down the probability of a hazardous situation occurring (P1) combined with the probability that the hazardous situation causes harm (P2). This can be especially beneficial for injection devices where the impact of a single missed dose is not critical, as illustrated below.
Assume test results show injection stall failure mode occurrence is 0.1% = P1
–>Injection stall failure mode can cause an underdose / disruption to therapy
–>If an underdose occurs, probability of clinically significant disruption to therapy (harm) is only 1% = P2
–>Overall probability of harm due to injection stall hazardous situation = P1 x P2 = 0.001%
In the above example, which is fairly representative of common products, incorporating P2 reduces the overall occurrence of harm by 2 orders of magnitude! This reflects the true risk of harm due to an injection stall compared to the basic approach which does not account for P2.
Sequences of events: P1 vs Failure Rate
The failure rate of a design or use error rate from a human factors study does not always correlate 1:1 to a hazardous situation. In many cases, after a failure or use error occurs, an additional sequence of events must occur for a hazardous situation to exist.
To use a common example that many of you may have encountered, if a user fails to follow the IFU instruction to wash their hands, they may get an infection at the injection site. If you do a study of 10 users and 2 of them don’t wash their hands, you have a use error rate of 20%! However, this does not translate to an infection of 20%, or even a P1 hazardous situation rate of 20%.
Observed use error rate for failing to wash hands is 20%
–>Failing to wash hands does not directly lead to infection, the actual hazardous situation is a contaminated device or injection site. Therefore P1 is not 20%.
–>Possible sequence of events leading to hazardous situation:
>User fails to wash hands 20%
>Contamination on hands 50%
>Contaminated surface contacts device needle 10%
–>Probability of hazardous situation: Contaminated device P1 = 0.20 x 0.50 x 0.10 = 1%
–>This P1 (probability of a contaminated device) is then combined with P2 (probability that a contaminated device actually causes an infection) yielding an overall probability of harm due to not washing hands at less than 1%. This matches the observed experience that users not washing their hands isn’t leading to widespread infections.
In Conclusion…
If the results of your risk analysis process don’t seem to be matching real-world risk, there’s a good chance your approach is too simplistic, and you may not be accounting for P1, P2, or sequences of events. Without the in-depth probability approach we have outlined, you may be spinning your wheels unnecessarily seeking solutions to risks that, in actuality, fall well within acceptable tolerance levels. P1, P2, and sequences of events arm you with more accurate Risk Management Hazard Analysis and Failure Mode and Effect Analysis (FMEA) calculations, allowing you to assess realistic potential hazards of a combination product and the resulting potential harm that can be caused to users, and also better answer these next two questions: What risks of harm are higher than acceptable risk levels per regulatory and our own corporate standards? For these identified risks, what reasonable risk controls can be put in place to mitigate that risk down to acceptable levels?
The answers to these two questions, and the subsequent solutions outlined, tested, and adopted, will lead you toward both a Risk Management File (RMF) that will satisfy regulatory reviewers and an approvable combination product.