EU postmarket surveillance plans for medical devices

Abstract Purpose Recent public health safety issues involving medical devices have led to a growing demand to improve the current passive‐reactive postmarket surveillance (PMS) system. Various European Union (EU) national competent authorities have started to focus on strengthening the postmarket risk evaluation. As a consequence, the new EU medical device regulation was published; it includes the concept of a PMS Plan. Methods This publication reviewed Annex III Technical Documentation on PMS and Annex XIV Part B: Postmarket clinical follow‐up from the new Regulation (EU) 2017/745 of the European Parliament and of the Council on medical devices. Results The results of the PMS activities will be described in the PMS plan and will be used to update other related documents. A modular approach to structure the contents of the PMS plan will help to consistently update other PMS information. It is our suggestion that the PMS plan should consist of a PMS plan Core and a PMS plan Supplement. The PMS plan Core document will describe the PMS system, and the PMS plan Supplement will outline the specific activities performed by the manufacturer for a particular medical device. Conclusions The PMS plan may serve as a thorough tool for the benefit‐risk evaluation of medical devices. If properly developed and implemented, it will function as a key player in the establishment of a new framework for proactive safety evaluation of medical devices.

Recent public health safety issues involving medical devices have highlighted the need to update the European Union (EU) medical device regulation (MDR). The Poly Implant Prothèse (PIP) breast implant scandal in 2012 affected thousands of women and damaged the confidence of the different stakeholders involved in postmarket surveillance (PMS) of medical devices. 2 More than 400 000 women around the world received PIP implants that were made of industrial-grade silicone gel, prone to rupture, leading to inflammation and irritation. Another incident in 2012 involving hip implants raised a public health concern: metal-on-metal total hip replacements were successfully implanted, but metal abrading against metal caused erosion and leaching of metal particles into soft tissue. 3 Such metal debris weakens tissue and bone around the implant, leading to implant failure, requiring additional surgery. The manufacturers did not provide an adequate response to the competent authorities with regard to these adverse events and there was always the belief that they could have been avoided. 4 As a consequence, various national competent authorities (NCAs) and other health organizations started focusing on strengthening postmarket risk evaluation of medical devices. One of the important novelties in the new regulation on medical devices (EU) 2017/745, published May 5, 2017 is the concept of a PMS Plan for each medical device family. 5 A regulation is a legal act of the EU that becomes immediately enforceable as law in all member states simultaneously.
Regulations can be distinguished from directives which, at least in principle, need to be transposed into national law. 6 The current Medical Device Directive (MDD) 93/42/EEC states that "The manufacturer shall institute and keep up to date a systematic procedure to review experience gained from devices in the post-production phase, including the provisions referred in Annex X, and to implement appropriate means to apply any necessary corrective action." Annex X says that "The clinical evaluation and its documentation must be actively updated with data obtained from the PMS. Where a postmarketing clinical follow-up as part of the PMS plan for the device is not deemed necessary, this may be duly justified and documented." 7 Contrary to what happens with the new regulation, there are no instructions or guidance on the contents of the PMS plan and on how to implement this requirement in the current MDD 93/42/EEC although the concept of a PMS plan is mentioned.
According to the new regulation, the PMS Plan will have to define the process for collecting, recording, and investigating complaints and reports from healthcare professionals, patients, and users on events suspected to be related to a medical device. A PMS system that is correctly designed should allow for early detection of possible malfunctions and/or complications of medical devices that may occur only after years or even decades of usage and implement appropriate risk minimization measures.
Today, many medical device manufacturers have a "reactive" PMS system that is based on the collection of postmarket data received from spontaneous reporting of complaints and incidents. Unfortunately, there are few proactive PMS processes designed to actively gain knowledge on the safety and performance of the medical device through external sources like registries, electronic healthcare records, safety evaluation sites, claim databases, social networks, and literature. 8 The new EU Regulation aims to reinforce key elements of the existing regulatory approach, including vigilance and market surveillance, at the same time ensuring transparency and traceability, to improve health and safety. 5 [10][11][12] The EU-RMP describes the important risks and areas of missing information, the activities intended to further characterize the safety profile, and the measures to minimize the risks. 13,14 The EU-RMP is updated throughout the product life cycle as studies are completed or new information becomes available that may change the benefit-risk balance. 15  • If properly developed and implemented, the EU PMS plan will function as a key player in the establishment of a new framework for proactive safety evaluation of medical devices.
(PASS) and additional risk minimization measures. [16][17][18][19] This is partly because the EU-RMP is product-specific and strategies are tailored to be risk-proportionate (i.e. taking into account variables such as seriousness and severity of the risk, target population, and healthcare setting of use of the product). 20 However, some variation is also due to marketing authorization holders: there is no gold standard for an optimal risk management organizational structure, and it depends on the magnitude and complexity of the company's pipeline, economic and staffing limitations, and organizational commitment to patient-centeredness. 21 Cross-functional review of the risk minimization programs is recommendable and inclusion of senior management in final approval. The Pharmacovigilance Risk Assessment Committee (PRAC), an EMA scientific committee responsible for the review of all aspects of risk management planning, has been instrumental to overseeing postapproval commitments, and has played a key role in centralizing all the efforts to design and evaluate PASS . 22 Table 1 describes some of the lessons learned from the pharmaceutical world and provides recommendations for implementation of the PMS plan for medical devices.

| Medical devices
NCAs, notified bodies (NBs), and manufacturers are all involved in the European Conformity (CE) marking process that allows marketing of a medical device in the EU. The NB is an entity that has been accredited by an EU member state to assess whether a manufacturer's quality management system procedures and product technical documentation meets certain standards described in the EU MDD. Documentation, monitoring, and enforceability of postapproval commitments Implementation of the EU-RMP template triggered more proactive approaches and the documentation of many additional risk minimization activities. Enforceability of these postapproval commitments came from making these commitments conditions to the marketing authorization of the medicinal product.
Implementation of an actual PMS plan template is also important to document the postapproval commitments (e.g. postmarket studies and risk minimization activities). Enforceability of these postapproval commitments will come from making these commitments conditions to the marketing authorization of the medical device and verification during the annual PMS audits performed by the notified body.

Inclusion of risks in the PMS documents
Only important risks (risks that have an impact on the benefit-risk balance) from the safety specification should be included into the PV plan.
Regulator-led initiative to develop risk based approach guidances to recommend the inclusion of only important risks (risks that have an impact on the benefit-risk balance) in the PMS documents (based on ISO 14971). Due to the wide range of medical devices and the different levels of complexity, these documents should be product-specific.

Manufacturer's organizational adaptation
Cross-functional review of the risk minimization programs and inclusion of senior management in final approval is recommended.
Cross-functional review of the PMS plan is recommendable. The final approval of the PMS plan should be made by the PRRC within the company.  With the NB's certificate, the manufacturer can then issue the declaration of conformity, and apply the CE Mark, which is required for sale in the EU. The conformity assessment can include inspection and examination of a product, its design, and the manufacturing environment and processes associated with it, including the safety evaluation of the medical device.
NCA's exist in each European member state and are nominated by each government to monitor and ensure compliance with its  The manufacturer shall prove in a postmarket surveillance plan that it complies with the obligation referred to in Article 83 (a) The postmarket surveillance plan shall address the collection and utilization of available information, in particular: -Information concerning serious incidents, including information from PSURs, and FSCAs; -Records referring to non-serious incidents and data on any undesirable side-effects; -Information from trend reporting; -Relevant specialist or technical literature, database and/or registers; -Information, including feedbacks and complaints, provided by users, distributors, and importers; and -Publicly available information about similar medical devices; (b) The postmarket surveillance plan shall include at least: -A proactive and systematic process to collect any information referred to in point (a). The process shall allow a correct characterization of the performance of the devices and shall also allow a comparison to be made between the device and similar products available on the market; -Effective and appropriate methods and processes to assess the collected data; -Suitable indicators and threshold values that shall be used in the continuous reassessment of the risk benefit analysis and of the risk management as referred to in Section 3 of Annex I; -Effective and appropriate methods and tools to investigate complaints or market experiences collected in the field; -Methods and protocols to manage the events subject to trend report as provided for in Article 88, including the methods and protocols to be used to establish any statistically significant increase in the frequency or severity of incidents as well as the observation period; -Methods and protocols to communicate effectively with competent authorities, notified bodies, economic operators, and users; -Reference to procedures to fulfil the manufacturers obligations laid down in Articles 83, 84, and 86; -Systematic procedures to identify and initiate appropriate measures including corrective actions; -Effective tools to trace and identify devices for which corrective actions might be necessary; and -A PMCF plan according to in Part B of Annex XIV, or a justification why a PMCF is not applicable.
Abbreviations: FSCA, field safety corrective action; PMCF, postmarket clinical follow-up; PSUR, periodic safety update report.  There are different aspects that are being taken into consideration for classification: grade of invasiveness, duration of contact with the body, and local versus systemic effect. 7,23 In order to obtain the CE mark that allows marketing of a medical device in the EU, 24 the manufacturer is obliged to identify and describe the risks detected during the pre-market phase. 1,5 The risk management file (RMF) of the medical device or its family should contain clear definitions of the hazardous situations associated with use of the medical device. In addition, it should also describe the potential harms associated with these situations as well as the applicable risk minimization measures to avoid or mitigate these harms in both patients and healthcare users.
According to the new EU MDR for medical devices, a comprehensive RMF demonstrating a positive benefit/risk profile is conditional to marketing and required to be monitored postmarketing in a timely

manner. The new EU MDR has additional requirements in PMS and
Vigilance compared with the current MDD (Tables 2 and 3). The new EU MDR states that the PMS plan "shall be suited to the actively and systematically gathering, recording and analysing relevant data on the quality, performance and safety of a device throughout its entire lifetime, and to drawing the necessary conclusions and to determining, implementing and monitoring any preventive and corrective actions". 5 Table 4 specifies the main technical requirements of the PMS plan.
The final approval of the PMS plan should be made by the person responsible for regulatory compliance (PRRC) within the company.
To understand the key differences between the flow of risk management documents for a medical device and a medicinal product, it is important to understand the main differences between medical devices and medicines during new product development ( Figure 1) and the main differences during the development pathway ( Figure 2). 8 Figure 3 describes the flow of risk management documents that are required for a medical device and a medicinal product.
One of the key differences between the two products is the filtering performed for medicinal products: only important risks (risks that have an impact on the benefit-risk balance) from the safety specification should be included into the pharmacovigilance (PV) plan. For medical devices, there are no regulatory documents that provide guidance on filtering the risks from the RMF into the PMS plan.
The RMF of a medical device includes the risk analysis, the risk evaluation, the implementation and verification of the risk control measures, and the assessment of the acceptability of any residual risk. Another difference with regard to medical devices is that the RMP of a medicinal product needs to be reviewed and approved by regulatory authorities, whereas the RMF or the PMS plan of a  (Tables 2 and 3).
Based on the requirements described in the new regulation and the lessons learned from medicinal products, we would like to propose the following recommendations for implementation of the new legislation.
We have designed a template for the PMS plan content (see Tables 5   and 6). The PMS plan becomes a master file and consists of a PMS plan Core (Table 5) and a PMS plan Supplement (Table 6)   and Periodic Safety Update Reports). This will be ensured by the use of the suggested modular approach (see Table 6) for the PMS plan They can offer valuable data on long-term effectiveness and safety of devices or on the impact of factors such as surgical method, physician, hospital, and patient conditions. 27 It is important to take into consideration that data from these studies and registries need to be used for continuous evaluation of the benefit-risk profile as well as for discovery of new indications of use.
When the PMCF study is completed, there should be a final report with clear conclusions that will be included in the periodic safety update report (PSUR).
The results of PMS activities will have an impact on the PMS process To measure the effectiveness of the PMS plan, it is important to have adequate tools in place for each of the processes. KPIs must be identified a priori when building the processes. Moreover, together with the KPIs, it is essential to identify a threshold for each of the indicators to take action if this threshold is reached. Therefore, the key processes that need to be measured should be identified, and the significant points of measurement that define the performance of the systems should be described in the PMS plan. These measures will help to identify areas of improvement. In Table 7, we propose different KPIs to monitor the performance of the PMS system, there should be KPIs for case processing, safety communications, PSURs, risk management, early detection of signals, and implementation of corrective actions.

| DISCUSSION
This paper tries to provide implementation guidance to the medical device EU-regulation based on lessons learned from the medical product area. We have seen how vital it is to identify the risks in a timely manner for all stakeholders to be aware of the risks associated with medical devices. Stakeholders need to take appropriate corrective and preventive measures to improve patient outcome 3 resulting in a device that is safe and performs well.
We conclude that the PMS plan needs to include the identified risks, potential risks, and missing information from the RMF. Next, safety evaluation tools (CER, PSUR, RMF) to find responses to unanswered questions and find more information regarding missing information should be implemented. The PMS plan should have clear objectives, a robust structure with specifications on data integrity, periodicity, and defined responsibilities. We recommend a modular approach to structure the contents of the PMS plan that will facilitate consistent updating of other PMS information. The PMS plan should consist of a PMS plan Core and a PMS plan Supplement. The PMS plan Core document will describe the manufacturer's general PMS system, and the PMS plan Supplement will describe the specific PMS activities performed by the manufacturer for a particular medical device or family/group of medical devices. Since we learned from the medicinal products area that a template is important, we proposed one. In addition to the template, another important aspect learned from the experience with medicinal products is the methodology used to include customer feedback and the organizational structure within the company. To deliver high-quality PMS plans, companies need to implement a system that includes cross-functional review and takes into account the patient feedback received during the postmarket phase. A difference with medicinal products is the fact that no filtering is implemented: we would recommend that the regulatory bodies develop product-specific guiding documents outlining how to perform the filtering of risks from the RMF to the PMS plan and also provide guidance on the stakeholder responsibility in reviewing and approving the PMS plan.
Moreover, to ensure the success of the PMS plans, the manufacturers should first identify the key processes of the plan and define KPIs as well as the associated thresholds to take action. These indicators will help to measure the effectiveness of the plan.
In conclusion, the new EU MDR may positively impact medical device safety evaluations and calls for a more hands-on approach, which does not only consist of spontaneous reporting, but also includes proactive methods to manage product-related risks with new safety evaluation tools such as the PMS plan. There are several questions regarding the implementation of the new EU medical device guideline and differences with medicinal products. This paper tries to review them and provide some guidance.

ETHICS STATEMENT
The authors state that no ethical approval was needed.

DISCLAIMER
The views expressed in this article are the personal views of the author(s) and may not be understood or quoted as being made on behalf of or reflecting the position of Alcon, Novartis, Erasmus Medical Center or University Medical Center Utrecht, HCL Technologies, or one of its committees or working parties.

FUNDING INFORMATION
No sources of funding were used to assist in the preparation of this study.