Abstract
In recent times, there has been an unprecedented level of public interest and active debate regarding the regulation of medical devices. This is in light of the topical, rather dissimilar, incidents involving poly-implant-prothèse (PIP) breast and metal-on-metal hip implants. Although medicines and devices are regulated under European Union (EU) law, the regulatory regimes are very different and some have argued that features of the pharmaceutical regime should be applied to medical devices in the current review of the medical devices directives. Both medicines and certain devices need to have an assessment of their risks and benefits before being used in patients, and undergo subsequent monitoring for adverse events. However, there are significant differences between these two groups in terms of the number of products, the pattern of innovation and development, and the types of adverse events that arise from their use. This review will summarise the key issues through a comparison of how both are regulated and monitored.
Introduction
Medicines and medical devices have their own unique regulatory processes, which are not widely understood. Due to the recent concerns over poly implant prothèse (PIP) breast implants and metal-on-metal hip prostheses, the process for medical devices has come under particular scrutiny.1–3 Although pharmaceutical products and medical devices are both regulated under European Union (EU) legislation, the regulatory processes have evolved differently and some have argued that features of the pharmaceutical process should be applied to medical devices in the current revision of the medical devices directives.4
A key theme in the debate has been the regulatory requirements for clinical data on medicines and medical devices. The randomised, placebo-controlled, clinical trial (RCT) designs used for all pharmaceutical products have evolved over many years. In comparison, clinical data are only a legal requirement for ‘higher risk’ medical devices such as implants (eg pacemakers or joint prostheses) and seldom are derived from RCTs. Trials of medical devices present distinct problems – for example, how to achieve ‘blinding’ of treatments and to control for operator effects such as skill and experience. This review examines how and why the two regulatory processes differ, the information required to assess the risks and benefits of medical devices, and current proposals to strengthen their evaluation.
Medicines
The Medicines Act 1968 laid down the foundation for pharmaceutical regulation in the UK and has been extensively amended by EU law since the UK's accession to the European community in 1973. Medicines are defined in the relevant EU directive (Box 1).5 About 15,000 medicinal products are currently licensed in the UK, with some 3,500 of these being active pharmaceutical ingredients (APIs).
Human studies of candidate molecules are conducted sequentially, generally as described in Table 1. For medicines that receive marketing authorisation, our understanding of benefit–risk is further refined through pharmacovigilance and post-licensing studies.
Different phases of preauthorisation of clinical trials. Trials may span more than one phase – for example, a trial looking at a new inhaler in healthy volunteers and those with mild asthma can be described as a phase I/IIa trial.
Regulation
All aspects of clinical trials of pharmaceuticals have, since 2004, been regulated under the Clinical Trials Directive 2001/20/EC.6 Much criticised as over-burdensome, it is currently under revision. In contrast, clinical studies of medical devices are subject only to ethical review.
Market authorisation (‘licensing’) of medicines in the UK was formalised in the Medicines Act 1968, after the thalidomide disaster to ensure that the safety, quality and efficacy of new medicines are properly explored. In August 2012, the Human Medicines Regulations (SI 2012/1916) came into force, consolidating the Medicines Act and subsequent (mainly EU) -legislation.7 This sets out a comprehensive process for the authorisation of medicinal products for human use; their manufacture, import, distribution, sale and supply; their labelling and advertising; and pharmacovigilance, all of which are overseen by the Medicines and Healthcare products Regulatory Agency (MHRA).
Medicines have four routes to marketing authorisation (Table 2), the choice of which will depend on the nature of the product and, to some degree, the preferences of the manufacturer.8 A centralised authorisation procedure is usually sought for innovative products and those intended for marketing across all EU member states. The decentralised procedure (DCP) allows simultaneous application in several countries, which is generally the preferred route for generic products. As such there are a larger number of DCP applications; for example in 2008 there were 1,400 compared with 100 applications made through the centralised route.9
Routes to gain a licence or marketing authorisation for medicines in the European Union.8
Vigilance systems
Some adverse drug reactions (ADRs) will be identified through clinical trials before licensing. However, less common adverse reactions may not be seen until a drug is used in large numbers of people – for example, because of uncommon genetic variations in susceptibility, the use of concomitant medications or the presence of comorbidities.
For marketed medicines, suspected ADRs should be reported through the yellow card scheme, which is for the use of both health professionals and patients. Fig 1 shows the number of reports of suspected ADRs in the UK received by the MHRA since 2004.
Number of yellow card reports received by the MHRA over time. ADR = adverse drug reaction; MHRA = Medicines Healthcare and -Regulatory Products Authority.
Reporting routes now include electronic submission online via the MHRA's website, directly through some general practice's information technology (IT) systems and, currently in a pilot phase, through links to hospital prescribing and drug information software. On receipt, a report is classified for seriousness and assessed before being committed to the MHRA's database. Useful knowledge is generated from data on ADRs, using statistical algorithms in a process known as data mining to detect associations between drug exposures and outcomes (‘signals’). Hypothesis testing is then carried out using additional sources of evidence, such as clinical trials, epidemiological studies and worldwide regulatory experience, to confirm, characterise and assess the frequency of the reported adverse outcomes. Regulatory action may then be taken to inform practitioners and patients of new benefit–risk information and to amend or even revoke the marketing authorisation.
Some major recent changes to the EU pharmacovigilance legislation (EU/520/2012), transposed into UK law in the Human Medicines Regulations 2012, are set out in Box 2.7,10
Medical devices
Medical devices (Box 3) encompass an extremely wide range of products used in a variety of settings for the diagnosis, prevention, monitoring or treatment of illness or disability. This diversity is exemplified by tongue depressors, plasters, spectacles, cannulae, heart valves, anaesthetic machines and blood-glucose monitors.
Developments in medical devices are driven rapidly by technological advances in diverse fields such as materials science, bioengineering, electronics, software and IT. More than 500,000 different types of medical devices are estimated to be produced globally. These are classified according to the medical devices directive as class I (low risk), class IIa/IIb (medium risk) or class III (high risk). As a general rule, any device that is intended to be totally introduced into the human body or to replace an epithelial surface or the surface of the eye by surgical intervention, and that is intended to remain in place after the procedure for at least 30 days, is classed as an implantable device (class IIb or III) – for example, an intraocular lens for cataract surgery is class IIb, while a heart valve is class III. An active implantable device intended to have a biological effect, to be wholly or mainly absorbed, or to undergo chemical change in the body – for example, a pacemaker – would be a class III product.
Regulation
The MHRA is the UK's national competent authority and is the authority legally delegated by the European Commission to regulate medical devices. These are currently regulated under three separate EU directives on medical devices (93/42/EEC), active implantable medical devices (90/385/EEC) and in vitro diagnostic medical devices (98/79/EEC), all of which are undergoing revision as regulations.4
National competent authorities do not themselves carry out the pre-market assessment of medical devices, which is in contrast to the case with pharmaceuticals. The competent authority's main roles concerning medical devices are to designate and audit notified bodies (organisations accredited by member states to assess medical devices), ensure that manufacturers comply with the regulations, issue guidance on particular medical devices, evaluate adverse incident reports, and approve clinical investigations of marked devices not marked with the ‘Conformité Européenne’ (CE) mark.
As described earlier, the regulation of pharmaceuticals was fundamentally shaped by the thalidomide disaster in the 1960s. In contrast, regulation of medical devices has developed more slowly, principally under the ‘new approach’ model of EU regulation. The first directive, which covered active implantable medical devices, came fully into effect in 1995, with most other medical devices being regulated from mid-1998.11 The EU legislation seeks to ensure that standards are applied uniformly across all member states to support the single European market.
Medical devices are granted conformity approval through notified bodies – commercial organisations that are overseen by the competent authorities. The EU currently has 76 notified bodies. They charge fees to manufacturers to assess conformity of their devices. Each national competent authority has the legal responsibility to designate and audit the performance of the notified bodies within its national territory. This can mean differences in how notified bodies behave, which will be addressed by a revision of the EU regulations to remedy this inconsistency.
The CE marking of a device in any member state is automatically mutually recognised across all other EU member states. For example, if a manufacturer gets CE marking approved for a new intraocular lens from a notified body in France, this medical device can be marketed legally in all EU member states. Under the EU system, the pre-market assessment is conducted by notified bodies and not by the competent authorities. However, clinical investigation protocols for non-CE-marked devices must be submitted to the relevant competent authority, which then has 30 days in which to object, otherwise the investigation can proceed.
Manufacturers usually self-certificate the conformity of class I (low-risk) devices without the involvement of a notified body. However, assessment of higher risk devices by the notified body will encompass the design and manufacturing quality system of the manufacturer, the arrangements in place for post-marketing vigilance, and a review of clinical investigation studies. For class III (highest risk) devices, the notified body will review the product design dossier for each product before issuing a certificate of conformity.
The current process for medical device regulation is summarised in Fig 2. The directives are currently being revised as regulations, which will take effect across the EU without the need for transposition into national law in each member state. Negotiations are likely to be completed in 2014 at the earliest, with the new legislation taking effect around 2017.13
European medical device regulation based on Directive 93/42/EEC: key stages in the process.12 CE = conformité européenne; EU = European Union; MHRA = Medicines Healthcare and Regulatory Products Authority.
The changes that have been proposed by the European Commission in their published draft regulations, which are now under negotiation, include better post-marketing surveillance and tracing of medical devices. The main features of the proposals are included in Table 3.
Main changes in the draft proposal for the EU medical device directive published in September 2012.14
Clinical investigations
To support an application for the CE mark, manufacturers may need to provide clinical data; this is always the case for class III devices. It is the responsibility of the manufacturer to notify the national competent authority of the intended clinical investigation and to submit the required documentation.
The design of randomised clinical trials for medical devices poses specific challenges (Box 4) that do not arise with trials concerning pharmaceutical products. Instead, clinical studies commonly use observational study designs. Nevertheless, randomised controlled trials of higher risk devices, such as implantable cardioverter defibrillators (ICDs), aortic stent grafts and coronary artery stents, have been achieved successfully.14–16
Box 4. Some challenges concerning the design of randomised clinical trials for medical devices.
Risks posed by medical devices are, in general, different to those posed by medicines, which influences both the pre-market evaluation and the post-marketing vigilance required. Performance can be sporadically affected by manufacturing failures and by the pattern of wear in long-term use (for implantable devices in particular). Neither of these are likely to be detected in pre-market studies of feasible size and duration. Effective post-marketing vigilance, therefore, is important.
Vigilance systems
Clinicians have a key role in reporting adverse incidents with medical devices. Overall, there is an upward trend of reporting adverse events, but there is a notable decline in the number of reports of adverse incidents received by the MHRA from healthcare professionals working in the NHS (Fig 3). Such reporting has a key role in improving patient safety and is a professional obligation for doctors; current guidance from the General Medical Council (GMC) states, ‘You must inform the MHRA about adverse incidents involving medical devices, including those caused by human error that put, or have the potential to put, the safety of patients, healthcare professionals or others at risk’.17 This can most easily be done though the MHRA's website (www.mhra.gov.uk).
Number of adverse incident reports received by the MHRA relating to medical devices from the NHS, manufacturers and other sources (including private healthcare, other government departments, competent authorities in other countries and members of the public). MHRA = Medicines and Healthcare Products Regulatory Agency; NHS = National Health Service.
The nature of adverse events relating to medical devices often differs from those associated with pharmaceutical products. Contributory factors can include (singly or in combination) defects in the design of the device or in its instructions for use; failure of quality control during manufacture; inadequate processing, repair or maintenance; degradation of the device due to long-term wear or inappropriate storage; and user error.
Manufacturers are required to report any known serious or potentially serious adverse incidents to the MHRA. After assessing the seriousness and likely mechanism of reported adverse incidents, MHRA device specialists will work with the manufacturer to ensure that appropriate investigations and corrective actions are carried out. Information will be passed by the MHRA to other national competent authorities if an adverse incident requires a recall of the device due to a risk of serious injury or death through the device's continued use. The MHRA issues electronic medical device alerts to healthcare and social care providers, with details of adverse incidents and the -recommended course of action.
The MHRA draws extensively on external experts from a wide range of disciplines and uses its strong links with the royal colleges and specialist societies when developing guidance for clinicians on the use of medical devices. The Committee on Safety of Medical Devices (CSD), which was set up in 2001, advises the agency and provides a valuable link to the user community.18
Discussion
The differences in the systems for regulation of medicines and medical devices are not solely historical in origin. There are substantially different challenges in defining the safety and efficacy of medicines, defining the safety and performance of devices, and monitoring these under conditions of use. The number of types of medical device in use is at least fivefold greater than the number of medicinal products; innovation of a medical device is typically by incremental steps every 1–2 years; and the main causes of adverse incidents are sporadic manufacturing faults, long-term wear (particularly in the case of implants) and operator factors. For pharmaceuticals, the corresponding list would be pharmacokinetic factors, off-target pharmacological effects and individual variations in response. The strategies for pre-marketing evaluation and post-marketing vigilance should be shaped by these differences.
Market access for medical devices in the EU is achieved through the CE mark, for which there is full mutual recognition across all member states. Assessment of conformity by notified bodies (for all except class I devices, which are self-certified) gives a key role for these organisations, which are accredited and audited by the relevant national competent authority. An important element of the proposed revision of the legislation is that oversight of notified bodies should be the joint responsibility of several national competent authorities and the European Commission in view of the EU-wide validity of the CE mark. An alternative proposal is that higher-risk devices should be assessed by a central regulatory body such as the European Medicines Agency (EMA), in an analogous way to the centralised process for pharmaceuticals. This is the system operated by the US Food and Drug Administration for higher-risk devices, which adds an estimated 1–2-year delay with no clear evidence that post-marketing safety issues are less frequent.19 The ability of pre-marketing assessment to predict sporadic manufacturing defects or long-term performance is limited.20
Effective post-marketing vigilance thus becomes even more important. Reporting of adverse incidents can be further improved by the joint efforts of regulators and clinicians and by better data sharing between national competent authorities. The legislative proposal for a unique device identifier (UDI) for all medical devices, which can be captured within an electronic health record, opens the way for much stronger analysis of long-term clinical outcomes in cohorts of patients with implanted devices and for recall of patients should a safety issue emerge (‘tracking and tracing’).
The current revision of the medical devices directives represents a valuable opportunity to improve regulatory oversight in this area. The objective must be to provide the highest possible level of patient protection while maximising the health gains from innovation. The existing regimen has performed well but can be improved further in the light of experience gained in both this and other areas of product regulation. Furthermore, there is an important need to improve the collection of observational data on medical devices to maximise patient safety, which can be achieved through better reporting of adverse incident by clinicians.
Acknowledgements
We thank Andrew Crosbie, unit manager biosciences and implants, Mick Foy, group manager vigilance and risk management of -medicines, Elaine Godfrey, clinical trials unit and Graeme Tunbridge, head of medical devices EU policy, MHRA.
- © 2014 Royal College of Physicians
