FDA Consultant Specialist

FDA regulatory consulting for medical device manufacturers covering submission pathways, Quality System Regulation (QSR), HIPAA compliance, and device cybersecurity requirements.

Table of Contents

• FDA Pathway Selection
• 510(k) Submission Process
• QSR Compliance
• HIPAA for Medical Devices
• Device Cybersecurity
• Resources

---

FDA Pathway Selection

Determine the appropriate FDA regulatory pathway based on device classification and predicate availability.

Decision Framework

Predicate device exists?
├── YES → Substantially equivalent?
│   ├── YES → 510(k) Pathway
│   │   ├── No design changes → Abbreviated 510(k)
│   │   ├── Manufacturing only → Special 510(k)
│   │   └── Design/performance → Traditional 510(k)
│   └── NO → PMA or De Novo
└── NO → Novel device?
    ├── Low-to-moderate risk → De Novo
    └── High risk (Class III) → PMA

Pathway Comparison

| Pathway | When to Use | Timeline | Cost |

|---------|-------------|----------|------|

| 510(k) Traditional | Predicate exists, design changes | 90 days | $21,760 |

| 510(k) Special | Manufacturing changes only | 30 days | $21,760 |

| 510(k) Abbreviated | Guidance/standard conformance | 30 days | $21,760 |

| De Novo | Novel, low-moderate risk | 150 days | $134,676 |

| PMA | Class III, no predicate | 180+ days | $425,000+ |

Pre-Submission Strategy

• Identify product code and classification
• Search 510(k) database for predicates
• Assess substantial equivalence feasibility
• Prepare Q-Sub questions for FDA
• Schedule Pre-Sub meeting if needed

Reference: See fda_submission_guide.md for pathway decision matrices and submission requirements.

---

510(k) Submission Process

Workflow

Phase 1: Planning
├── Step 1: Identify predicate device(s)
├── Step 2: Compare intended use and technology
├── Step 3: Determine testing requirements
└── Checkpoint: SE argument feasible?

Phase 2: Preparation
├── Step 4: Complete performance testing
├── Step 5: Prepare device description
├── Step 6: Document SE comparison
├── Step 7: Finalize labeling
└── Checkpoint: All required sections complete?

Phase 3: Submission
├── Step 8: Assemble submission package
├── Step 9: Submit via eSTAR
├── Step 10: Track acknowledgment
└── Checkpoint: Submission accepted?

Phase 4: Review
├── Step 11: Monitor review status
├── Step 12: Respond to AI requests
├── Step 13: Receive decision
└── Verification: SE letter received?

Required Sections (21 CFR 807.87)

| Section | Content |

|---------|---------|

| Cover Letter | Submission type, device ID, contact info |

| Form 3514 | CDRH premarket review cover sheet |

| Device Description | Physical description, principles of operation |

| Indications for Use | Form 3881, patient population, use environment |

| SE Comparison | Side-by-side comparison with predicate |

| Performance Testing | Bench, biocompatibility, electrical safety |

| Software Documentation | Level of concern, hazard analysis (IEC 62304) |

| Labeling | IFU, package labels, warnings |

| 510(k) Summary | Public summary of submission |

Common RTA Issues

| Issue | Prevention |

|-------|------------|

| Missing user fee | Verify payment before submission |

| Incomplete Form 3514 | Review all fields, ensure signature |

| No predicate identified | Confirm K-number in FDA database |

| Inadequate SE comparison | Address all technological characteristics |

---

QSR Compliance

Quality System Regulation (21 CFR Part 820) requirements for medical device manufacturers.

Key Subsystems

| Section | Title | Focus |

|---------|-------|-------|

| 820.20 | Management Responsibility | Quality policy, org structure, management review |

| 820.30 | Design Controls | Input, output, review, verification, validation |

| 820.40 | Document Controls | Approval, distribution, change control |

| 820.50 | Purchasing Controls | Supplier qualification, purchasing data |

| 820.70 | Production Controls | Process validation, environmental controls |

| 820.100 | CAPA | Root cause analysis, corrective actions |

| 820.181 | Device Master Record | Specifications, procedures, acceptance criteria |

Design Controls Workflow (820.30)

Step 1: Design Input
└── Capture user needs, intended use, regulatory requirements
    Verification: Inputs reviewed and approved?

Step 2: Design Output
└── Create specifications, drawings, software architecture
    Verification: Outputs traceable to inputs?

Step 3: Design Review
└── Conduct reviews at each phase milestone
    Verification: Review records with signatures?

Step 4: Design Verification
└── Perform testing against specifications
    Verification: All tests pass acceptance criteria?

Step 5: Design Validation
└── Confirm device meets user needs in actual use conditions
    Verification: Validation report approved?

Step 6: Design Transfer
└── Release to production with DMR complete
    Verification: Transfer checklist complete?

CAPA Process (820.100)

• Identify: Document nonconformity or potential problem
• Investigate: Perform root cause analysis (5 Whys, Fishbone)
• Plan: Define corrective/preventive actions
• Implement: Execute actions, update documentation
• Verify: Confirm implementation complete
• Effectiveness: Monitor for recurrence (30-90 days)
• Close: Management approval and closure

Reference: See qsr_compliance_requirements.md for detailed QSR implementation guidance.

---

HIPAA for Medical Devices

HIPAA requirements for devices that create, store, transmit, or access Protected Health Information (PHI).

Applicability

| Device Type | HIPAA Applies |

|-------------|---------------|

| Standalone diagnostic (no data transmission) | No |

| Connected device transmitting patient data | Yes |

| Device with EHR integration | Yes |

| SaMD storing patient information | Yes |

| Wellness app (no diagnosis) | Only if stores PHI |

Required Safeguards

Administrative (§164.308)
├── Security officer designation
├── Risk analysis and management
├── Workforce training
├── Incident response procedures
└── Business associate agreements

Physical (§164.310)
├── Facility access controls
├── Workstation security
└── Device disposal procedures

Technical (§164.312)
├── Access control (unique IDs, auto-logoff)
├── Audit controls (logging)
├── Integrity controls (checksums, hashes)
├── Authentication (MFA recommended)
└── Transmission security (TLS 1.2+)

Risk Assessment Steps

• Inventory all systems handling ePHI
• Document data flows (collection, storage, transmission)
• Identify threats and vulnerabilities
• Assess likelihood and impact
• Determine risk levels
• Implement controls
• Document residual risk

Reference: See hipaa_compliance_framework.md for implementation checklists and BAA templates.

---

Device Cybersecurity

FDA cybersecurity requirements for connected medical devices.

Premarket Requirements

| Element | Description |

|---------|-------------|

| Threat Model | STRIDE analysis, attack trees, trust boundaries |

| Security Controls | Authentication, encryption, access control |

| SBOM | Software Bill of Materials (CycloneDX or SPDX) |

| Security Testing | Penetration testing, vulnerability scanning |

| Vulnerability Plan | Disclosure process, patch management |

Device Tier Classification

Tier 1 (Higher Risk):

• Connects to network/internet
• Cybersecurity incident could cause patient harm

Tier 2 (Standard Risk):

• All other connected devices

Postmarket Obligations

• Monitor NVD and ICS-CERT for vulnerabilities
• Assess applicability to device components
• Develop and test patches
• Communicate with customers
• Report to FDA per guidance

Coordinated Vulnerability Disclosure

Researcher Report
    ↓
Acknowledgment (48 hours)
    ↓
Initial Assessment (5 days)
    ↓
Fix Development
    ↓
Coordinated Public Disclosure

Reference: See device_cybersecurity_guidance.md for SBOM format examples and threat modeling templates.

---

Resources

scripts/

| Script | Purpose |

|--------|---------|

| fda_submission_tracker.py | Track 510(k)/PMA/De Novo submission milestones and timelines |

| qsr_compliance_checker.py | Assess 21 CFR 820 compliance against project documentation |

| hipaa_risk_assessment.py | Evaluate HIPAA safeguards in medical device software |

references/

| File | Content |

|------|---------|

| fda_submission_guide.md | 510(k), De Novo, PMA submission requirements and checklists |

| qsr_compliance_requirements.md | 21 CFR 820 implementation guide with templates |

| hipaa_compliance_framework.md | HIPAA Security Rule safeguards and BAA requirements |

| device_cybersecurity_guidance.md | FDA cybersecurity requirements, SBOM, threat modeling |

| fda_capa_requirements.md | CAPA process, root cause analysis, effectiveness verification |

Usage Examples

# Track FDA submission status
python scripts/fda_submission_tracker.py /path/to/project --type 510k

Assess QSR compliance
python scripts/qsr_compliance_checker.py /path/to/project --section 820.30

Run HIPAA risk assessment
python scripts/hipaa_risk_assessment.py /path/to/project --category technical