FDA Consultant Specialist

What This Skill Does

• This skill provides FDA regulatory consulting for medical device manufacturers.
• It covers submission pathways, Quality System Regulation (QSR), HIPAA compliance, and device cybersecurity requirements.
• It is designed for regulatory affairs specialists and medical device manufacturers.

When to Use

• Determine FDA regulatory pathways.
• Prepare 510(k) submissions.
• Ensure QSR compliance.
• Address HIPAA requirements.
• Manage device cybersecurity.
• Plan pre-submission strategies.

Key Features

• FDA pathway selection decision framework.510(k) submission process workflow.
• QSR compliance guidance.
• HIPAA compliance for medical devices.
• Device cybersecurity best practices.
• Resources for FDA submissions.

FDA Consultant Specialist

FDA regulatory consulting for medical device manufacturers covering submission pathways, Quality System Regulation (QSR), HIPAA compliance, and device cybersecurity requirements.

Table of Contents

FDA Pathway Selection

510(k) Submission Process QSR Compliance HIPAA for Medical Devices Device Cybersecurity Resources

FDA Pathway Selection

Determine the appropriate FDA regulatory pathway based on device classification and predicate availability.

Decision Framework

Predicate device exists? ├── YES → Substantially equivalent? │ ├── YES → 510(k) Pathway │ │ ├── No design changes → Abbreviated 510(k) │ │ ├── Manufacturing only → Special 510(k) │ │ └── Design/performance → Traditional 510(k) │ └── NO → PMA or De Novo └── NO → Novel device? ├── Low-to-moderate risk → De Novo └── High risk (Class III) → PMA

Pathway Comparison

Pre-Submission Strategy

Identify product code and classification Assess substantial equivalence feasibility Prepare Q-Sub questions for FDA Schedule Pre-Sub meeting if needed

Reference: See fda_submission_guide.md for pathway decision matrices and submission requirements.

510(k) Submission Process

Workflow

Phase 1: Planning ├── Step 1: Identify predicate device(s) ├── Step 2: Compare intended use and technology ├── Step 3: Determine testing requirements └── Checkpoint: SE argument feasible?

Phase 2: Preparation ├── Step 4: Complete performance testing ├── Step 5: Prepare device description ├── Step 6: Document SE comparison ├── Step 7: Finalize labeling └── Checkpoint: All required sections complete?

Phase 3: Submission ├── Step 8: Assemble submission package ├── Step 9: Submit via eSTAR ├── Step 10: Track acknowledgment └── Checkpoint: Submission accepted?

Phase 4: Review ├── Step 11: Monitor review status ├── Step 12: Respond to AI requests ├── Step 13: Receive decision └── Verification: SE letter received?

Required Sections (21 CFR 807.87)

Common RTA Issues

QSR Compliance

Quality System Regulation (21 CFR Part 820) requirements for medical device manufacturers.

Key Subsystems

Design Controls Workflow (820.30)

Step 1: Design Input └── Capture user needs, intended use, regulatory requirements Verification: Inputs reviewed and approved?

Step 2: Design Output └── Create specifications, drawings, software architecture Verification: Outputs traceable to inputs?

Step 3: Design Review └── Conduct reviews at each phase milestone Verification: Review records with signatures?

Step 4: Design Verification └── Perform testing against specifications Verification: All tests pass acceptance criteria?

Step 5: Design Validation └── Confirm device meets user needs in actual use conditions Verification: Validation report approved?

Step 6: Design Transfer └── Release to production with DMR complete Verification: Transfer checklist complete?

CAPA Process (820.100)

Identify: Document nonconformity or potential problem Investigate: Perform root cause analysis (5 Whys, Fishbone) Plan: Define corrective/preventive actions Implement: Execute actions, update documentation Verify: Confirm implementation complete Effectiveness: Monitor for recurrence (30-90 days) Close: Management approval and closure

Reference: See qsr_compliance_requirements.md for detailed QSR implementation guidance.

HIPAA for Medical Devices

HIPAA requirements for devices that create, store, transmit, or access Protected Health Information (PHI).

Applicability

Required Safeguards

Administrative (§164.308) ├── Security officer designation ├── Risk analysis and management ├── Workforce training ├── Incident response procedures └── Business associate agreements

Physical (§164.310) ├── Facility access controls ├── Workstation security └── Device disposal procedures

Technical (§164.312) ├── Access control (unique IDs, auto-logoff) ├── Audit controls (logging) ├── Integrity controls (checksums, hashes) ├── Authentication (MFA recommended) └── Transmission security (TLS 1.2+)

Risk Assessment Steps

Inventory all systems handling ePHI Document data flows (collection, storage, transmission) Identify threats and vulnerabilities Assess likelihood and impact Determine risk levels Implement controls Document residual risk

Reference: See hipaa_compliance_framework.md for implementation checklists and BAA templates.

Device Cybersecurity

FDA cybersecurity requirements for connected medical devices.

Premarket Requirements