AMA #2: Is using "no injury" for severity level 1 inconsistent with ISO 14971?
A common practice in the medical industry to use severity level 1 as a catch-all category to include all product issues that may not directly cause injury. Is this practice consistent with ISO 14971?
Dear colleagues, hello! 👋
I am super excited to launch a new AMA series to invite questions from you about medical device risk management.
Click on this button to submit your question. If your question is really unique, I will grant you 30-day complimentary access to premium content on Let's Talk Risk!
Recently, I received the following question:
When I looked closer at example definitions of the lowest severity Harm (e.g. negligible), I noticed several instances (including table 2 in ISO24971:2020) where the description of the Harm says "No Injury". I find this conflicting with the definition of the Harm where "Injury" seems to be a prerequisite. Taking it one step further, I would think a harm with no injury should not even be considered as a safety "Risk".
This is a valid concern because the concept of harm in ISO 14971 is generally understood in the medical device industry as physical harm to patients and/or users.
However, the latest revision of ISO 14971:2019 does not include the qualifier “physical” for injury in the definition of the term harm, now defined as1:
injury or damage to the health of people, or damage to property or the environment.
As a result, the scope of the term harm in the current revision of ISO 14971 is broader than physical injury. It can also include, for example, reputational harm or loss of personally sensitive information. Therefore, risk practitioners have to consider all potential ways in which a patient or user may experience harm from the use of a medical device.
Terms such as injury or damage imply some kind of loss which may or may not be measurable. The term severity is used as a way to estimate the level of injury or damage; however, it is not generally a quantitative measure. ISO 14971:2019 defines the term severity as2:
measure of the possible consequence of a hazard (3.4)
ISO/TR 24971:2020 - Medical devices - Guidance on the application of ISO 14971 does not provide additional commentary on the scope of the harm term, in the context of ISO 14971. However, as shown below, Tables 2 and 4 provides illustrative examples of common terms and possible description for each to define different severity levels for the purpose of risk estimation:
Although not mandatory, it is a common practice in the medical device industry to utilize one of these tables, especially the 5-level harm severity table shown in Figure 2 above. Therefore, the extent of harm is generally specified as a severity level on a discrete scale.
The lowest severity level (S=1) is generally specified as “Negligible” which could include no injury or slight injury (Figure 2), or something that results in inconvenience or temporary discomfort (Figure 3).
Is this practice consistent with the intent of ISO 14971? Should we even consider a harm with “no injury” as a safety risk during risk analysis according to ISO 14971?
A related question is what level of a probability of occurrence of a severity level 1 harm (e.g. no injury, slight injury, inconvenience or temporary discomfort) would be considered acceptable?
Another common practice in the industry is to define 1-5 levels of probability of occurrence, with the highest level 5 defined as Frequent3. Does it mean that if a severity level 1 harm may be considered unacceptable if it were to occur frequently, say at a rate more than 1 in 1000? If so, would that affect the overall residual risk of a medical device to an extent that the benefits of its intended use can no longer be considered to outweigh that residual risk?
There is no clear guidance on this question. Common sense would tell us that even if it were a minor inconvenience, it would not be prudent to leave it uncontrolled because it would affect customer satisfaction. Yet, ISO 14971 is generally perceived to be not concerned about quality risk otherwise within the scope of ISO 134854. In the context of the upcoming QMSR, risk practitioners need to adopt a broader view of risk to appropriately consider the impact of all product-related issues, not just those that pertain to safety.
We will set aside the risk acceptability question for now. However, we should emphasize the importance of clearly describing the qualitative levels used for assigning severity to potential harms associated with the use of a medical device. In our ISO 14971 training course on ACHIEVE, we offer the following more detailed description of severity levels as shown in the figure below for risk analysis under ISO 14971:
As shown above, harm severity levels should be carefully assessed in the context of following factors:
Whether there is a health consequence or not. Here we should consider impact on both physical and mental health.
Whether symptoms are of minor concern and/or reversible.
Whether symptoms can be alleviated by readily available over the counter products.
Whether the health condition arising from the use of a medical device needs professional medical intervention, including surgical intervention, and whether without such intervention the condition would rapidly deteriorate.
Whether the medical condition, even when treated, would lead to permanent impairment and/or other long term effects that would adversely affect the normal daily function and quality of life.
Whether the medical condition is so serious, and potentially life-threatening, that it requires urgent medical intervention and that death could be a likely outcome.
Finally, it is important to emphasize that descriptors of severity levels should be developed in consultation with clinical experts having significant experience in the specific medical condition(s) within the scope of the intended use or intended purpose of a device. Further, there is no reason to have a single harm severity level table for all medical devices in a portfolio of diverse products with varying levels of risk.
Returning to the original question of whether using “no injury” in the description for the lowest severity level is inconsistent with ISO 14971, the short answer is that it is not. What matters more is how we view severity levels and how clearly we describe them to minimize confusion and inconsistent application. It is also important to note that quality and regulatory risks are also worthy of careful consideration even though they seem to be outside the scope of ISO 14971. Clearly, safety is important but not the only objective or risk management.
I hope you find value in the AMA feature and consider submitting your own questions!
See Clause 3.3 in ISO 14971:2019
See Clause 3.27 in ISO 14971:2019
See Table 5 in ISO/TR 24971:2020
ISO 13485:2016 - Medical devices - Quality management systems - Requirements for regulatory purposes, considers the term risk in a broader context than ISO 14971. In Clause 0.2, it specifies that the application of the term “risk” within the scope of this International Standard pertains to safety or performance requirements of the medical device or meeting applicable regulatory requirements.
If a sequence of events leads to a hazardous situation and the hazardous situation does not lead to a harm then it's simply "No Risk".
If a hazardous situation is assessed to be not having a substantial magnitude of severity then I would identify those at PHA phase and explain why I won't consider those hazardous situations in my risk analysis instead of simply estimating them as insignificant severity (s1) and not increasing my rmf with lots of such SoE's.
I wonder whether, perhaps, the question was asked solely from the perspective of risk evaluation, rather than from the perspective of the risk management process as a whole. For the sake of keeping consistency with the question's reference to ISO/TR 24971:2020, EXAMPLE 1 at subclause 7.1.1 is perhaps useful:
'EXAMPLE 1 Eliminating the hazard of sharp edges that can cause injury by designing the surfaces with rounded edges. Eliminating the hazard of electric shock by using a manually operated pump instead of an electrical pump.'
Taking the example of the hazard of electric shock, it would result in a number of probabilistic hazardous situations, which, in turn would result in a number of associated probabilistic harms. The severities of those harms would span through those of Table 2 or Table 4 of ISO/TR 24971:2020. At this point, the risk - the combination of the probability of occurrence of harm and the severity of that harm - is entirely uncontrolled; an unmitigated risk.
The risk control is applied: no electricity.
At residual risk evaluation the hazard has been eliminated, meaning severity must tend to the lowest level; zero, in fact. Per NOTE 2, subclause 7.1, ISO 14971:2019:
'NOTE 2 Risk control measures can reduce the severity of the harm or reduce the probability of occurrence of the harm, or both.'
You simply cannot cut yourself with a jelly. Well, not unless it is frozen or moving at high speed.
The risk control in the ISO/TR 24971:2020 example patently introduces a new set of hazards and resultant hazardous situations, which is why subclause 7.5 of ISO 14971:2019 is not merely a tick box exercise.
As a final observation, neither Table 2 nor Table 4 contain an exclusive 'no injury' entry.