Author: Brandon Miller

How Quality Culture Is Changing

Posted on by Brandon Miller

 

Among the emerging topics of interest to the life science industry, quality culture, quality metrics, and data integrity are in the spotlight due to changes from the COVID-19 pandemic. Regulatory authorities strive to stay on top of the latest challenges in quality assurance and compliance facing medical device and pharmaceutical firms.

 

Regulatory Compliance Associates® understands that data integrity is important for keeping and maintaining accurate data to protect your data’s trustworthiness. This ensures everything else built on that data is trustworthy as well. We’ll explore why quality culture and data integrity are important and what permanent changes have occurred in the wake of the pandemic.

 

Need help improving your Quality Culture? Contact Us Now →

 

How Quality Culture Is Linked to Data Integrity 

 

It’s essential to understand the ways quality culture is linked to data integrity. Regulators have delineated a clear link between the veracity of data generated by a company and its culture. Future regulatory audits to determine an organization’s health may focus on obtaining information about the company’s quality culture and subsequent data. It’s vital to for companies to acknowledge this relationship so they can identify vulnerabilities, perform necessary risk assessments and remediate risks before an inspection. 

 

An Increased Emphasis on Data Integrity

 

It’s easier to keep a vigilant eye on data when everyone works from the same locations. However, with more people working from home, maintaining quality culture practices to control data integrity is imperative and challenging.  The Food and Drug Administration (FDA) is  drawing parallels between compliance with data integrity regulations and an organization’s overall culture.

 

 The FDA wants companies to maintain a quality culture that is integrated throughout the organization. The more developed and established an organization’s quality culture, the more reliable the data.

 

Ensuring data integrity compliance can benefit a company in the following ways:

 

  • Fewer supply chain interruptions
  • Less rework needed
  • Reduced financial risk
  • Increased compliance
  • Improved operational performance and productivity

 

Transitions to Electronic Systems

 

As a result of the pandemic, more companies are switching from paper-based to electronic systems. This migration to electronic data systems poses certain challenges to any organization.

 

Companies need to have the necessary resources and technical expertise to make sure the electronic systems maintain data integrity concepts. Organizations must be able to provide proof of their compliance supported by an audit trail of their work.

 

Auditing Process Changes Resulting from the COVID-19 Pandemic 

 

The auditing process may change in many ways as a result of the pandemic:

 

  • Virtual audits are likely to become more common.
  • Companies will need to ensure systems are secure and files are organized.
  • Companies will have to maintain data integrity in their electronic systems so they can use those systems to transfer data to regulatory auditors.

 

To begin the Regulatory Compliance Associates scoping process today, please enter your information in the blue form below and click the submit button at the bottom of the webpage. You may also email us at [email protected].

FDA Guidance: GASK

Posted on by Brandon Miller

fda guidanceThe pharmaceutical and biologics industry recently received updated FDA guidance on the use of Generally Accepted Scientific Knowledge (GASK) in regulatory submissions.

 

The FDA guidance provides new examples of when it is applicable to leverage GASK data to meet safety requirements required in a new drug application. Clinical information in the drug discovery data that supports the nonclinical safety of a drug can contain GASK citations. Additionally, the citations would be based on existing clinical studies that have been validated by FDA in approved products on the market.

 

What is GASK?

 

Generally Accepted Scientific Knowledge refers to information and methods widely considered as accepted by life science industry experts. It can include established scientific principles, published papers, and best practices that have passed the regulatory scrutiny of drug development. GASK is most often utilized during the evaluation of safety and efficacy data of regulated products.

 

FDA Approval

 

The FDA guidance elaborates on the process of FDA regulators and how new drug applications are evaluated. Further, the FDA often requires life science companies to provide a significant amount of regulatory data to support safety and efficacy claims.

 

This regulatory clinical research often comes from clinical trials, preclinical studies, and other types of scientific data sources. However, in scenarios where there may be limited clinical trial data conducted, GASK can be used to provide supporting documentation for regulatory compliance. 

 

Drug Development

 

Life science companies are required to offer nonclinical information to support regulatory approval of a New Drug Application (NDA) or Biologics License Application (BLA). Additionally, the FDA guidance elaborates on how nonclinical information helps the Agency focus on important matters, such as:

 

  • Identifying pharmacological effects, including the mechanism of action of the drug in vitro and/or in vivo
  • Identifying absorption, distribution, metabolism, and excretion of the drug in vitro and/or in animals
  • Identifying possible consequences of exposure duration (e.g., chronic)
  • Identifying risks for special populations (e.g., pediatrics)

 

Regulation Examples

 

The FDA guidance goes on to describe unique conditions in which sponsors have successfully used GASK in their product development program. Each sponsor cited these GASK resources to meet FDA’s regulatory approval requirements instead of conducting certain nonclinical studies:

 

  • Products containing a substance that naturally occurs in the body. Sponsors submitted GASK regarding that substance and the known effects on biological processes.
  • Demonstrated drug impact on a particular biological pathway. Sponsors submitted GASK regarding the impact and FDA regulators concluded specific nonclinical studies were not necessary to support drug approval and drug labeling.

 

Active Ingredient

 

The FDA guidance continues by listing examples of substances that are typically present in a healthy human body. For example, endogenous substances where the drug replaces a substance that should naturally be present but, for pathological reasons, a patient may lack sufficient amounts. The FDA approved drug may enable and help accelerate the proper functioning of the human body.

 

Pharmacological

 

Additionally, a key driver of using GASK for FDA approval is the patient who has been prescribed a drug & the pharmacological impact experienced. Existing human pharmacokinetic studies and toxicology studies are recommended and may support the approval of the regulatory application. Specifically, regulators wil look to examine if the drug helps increase the level of the endogenous substance to the level of a healthy individual.  

 

Diet

 

Further, exogenous substances that are already present in a patient’s diet may help expedite U.S. Food and Drug Administration approval. This scenario includes a patient’s exposure to an unmodified food substance that doesn’t exceed typical levels of dietary exposure when the drug is taken orally. The FDA guidance also states that certain nonclinical studies may be unnecessary based on the relevance of the exogenous substance to the clinical research submitted. 

 

New Drug Application

 

If an FDA sponsor utilizes GASK information in their new product application, they must submit justification in the appropriate regulatory submission filing (e.g. BLA submission, 510(k) submission, etc.). The FDA guidance recommends as early as possible in product development to the assigned FDA regulator.

 

Finally, food and drug regulation feedback would be provided to the sponsor for the proposed regulatory strategy for approval. The FDA submission should incorporate evidence for the use of GASK, including textbook excerpts and/or non-product-specific published literature.

 

 

To begin the Regulatory Compliance Associates scoping process today, please enter your information in the blue form below and click the submit button at the bottom of the webpage. You may also email us at [email protected].

Cytotoxicity Testing

Posted on by Brandon Miller

 

In this soundbite from RCA Radio, Dr. Helin Raagel and Dr. Matthew Jorgensen from Nelson Labs explain why the Cytotoxicity test during a biocompatibility evaluation is the most important test you will run.

 

cytotoxicity

What is Cytotoxicity? – Cytotoxicity is the degree to which a substance can cause damage to a cell. A substance or process that causes cell damage or death is referred to as cytotoxic, “cyto” meaning cell and “toxic” meaning poison. (Will the device kill or harm the cells it comes in contact with?)

 

There are three reasons why the cytotoxicity test is the most important test you run during a biocompatibility evaluation.

  1. The test can be run quickly.
  2. It is the most cost-effective test in an evaluation.
  3. Most evaluation concerns come from the cytotoxicity results.

 

Listen to the full episode “What is Cytotoxicity?” now!

 

To begin the Regulatory Compliance Associates scoping process today, please enter your information in the blue form below and click the submit button at the bottom of the webpage. You may also email us at [email protected].

Cyber Awareness for Consumers

Posted on by Brandon Miller

Click now to listen to RCA’s Susan Schniepp and Steven Lynn, in this RCA Radio audio update:

 

Personalized Medicine

 

Software as medical device (SaMD) continues to emerge in consumer products, including diabetes and sleep management. When it comes to FDA cybersecurity, every device developer knows the ecosystem is more likely to be wifi-connected than ever before. Cyber awareness involves using design controls to consider a variety of consumer SaMD applications & how they connect to smartphone operating systems and open network solutions. By scaling efficacy technology, or personalized medicine, developers are addressing a rapidly growing segment of healthcare treatment.  

 

FDA Cybersecurity

 

How can regulatory compliance help protect consumers from hackers when forwarding patient info between sources is involved? During a risk assessment, a SaMD consultant might end up looking at every step between the health system provider and convenience of not visiting a clinical environment. Further, as industry leaders who understand how technology can increase the speed of personalized medicine to market, what types of cyber awareness becomes more critical to protecting patients?

 

Home Dialysis

 

One SaMD cybersecurity focus Schniepp has already identified is in the Home Dialysis industry. Medical device manufacturers are continuing to evolve with the demand for smaller prototype devices in general, which may enhance cyber convenience becoming a competitive advantage. However, the commercial cyber threat is permanent and even the largest organizations in the dialysis industry can be a target. 

 

Combination Products

 

Lynn agrees & understands that an FDA combination product strategy will continue innovation by means of software and drug delivery. This fundamental mindset change requires extending the definition of “users” of these connected medical devices. It includes patients and HCPs — but also FDA inspection roles needed during during regulatory compliance (e.g. biomedical engineers, IT engineers).

 

Fixed Dose Combination

 

Any combination device would include cyber awareness practices between medical devices & connected facilities that demonstrate and prove trust. Do the relationships between healthcare infrastructure increase or decrease exposure to disruption? Further, where could any attack surface breach trust and cause harm to the patent (e.g. disrupting a patient dosing device). Cyber awareness understands that intended use of the device must also address the perspective of an unwanted attacker.

 

Regulatory Compliance

 

Lynn & Schniepp both agree on one topic: patient compliance. Any type of medical device software that increases patient adherence during a healthcare routine will be applauded by FDA consultants. FDA SaMD guidance lists the ISO standards and QMS regulations needed for the submission. Accelerating the intended use through increased compliance is a regulatory strategy that can be presented via clinical evidence.   

Medical Device Cybersecurity Guidance

Posted on by Brandon Miller

The International Medical Device Regulation Forum (IMDRF) recently published updated cybersecurity guidance for the medical device industry. The medical device cybersecurity working groups at IMDRF have been busy lately, publishing multiple final documents about medical devices & software as medical device (SaMD). 

 

Regulatory Compliance

 

IMDRF’s medical device guidance provides steering assumptions for both regulatory compliance & medical device cybersecurity, which are appropriate for sponsors developing medical devices. Further, a primary objective of the guidance is simultaneously increasing patient safety & reducing external threats for providers and HCPs.

 

Global Harmonization

 

The guidance begins with harmonization concepts that could affect multiple departments inside a medical device manufacturer. Additionally, key areas for harmonization programs highlighted by the cybersecurity guidance include:

 

  • Product design
  • Risk management activities
  • Device labelling
  • Regulatory submission
  • Information sharing
  • Post-market activities

 

Product Life Cycle (PLC)

 

IMDRF’s cybersecurity guidance continues on with a deeper evaluation of risks associated across the product life cycle. It is recommended for potential vulnerabilities to be considered for any product life cycle stage, especially considering legacy devices that may be vulnerable to strategic risk. 

 

 

Product Design

 

Product design considerations include the initial phases of medical device development and continues until the end of support (EOS) once a product is discontinued. The four product design stages the cybersecurity guidance refers to when it comes to total product life cycle:

 

  • Development Stage
  • Support Stage
  • Limited Stage
  • End of Support

 

Development Stage (Stage 1)

 

The Development Stage occurs during the pre-commercialization phase before a medical device is approved by a regulatory body. This is when medical device manufacturers begin to incorporate security into the product concepts being designed. Design controls are critical in this stage for medical device manufacturers to leverage when considering how to mitigate risks.

 

Finally, an important deliverable of the Development Stage is product-related security documentation. The documentation is designed to help unfamiliar users to understand how to securely operate the medical device. 

 

Support Stage (Stage 2)

 

The Support stage is during the initial post-launch phase and may continue for many years. Medical devices in this stage are:

 

  • Currently used for providing patient care
  • Available for purchase on the open market
  • Contain major software, firmware, or programmable hardware components
  • Support for software, firmware or components is provided by the medical device manufacturer

 

Additionally, medical devices in the Support stage should receive full cybersecurity support. This support often includes software patches, software updates, hardware updates, and incremental support the manufacturer considers appropriate.

 

Limited Support Stage (Stage 3)

 

Medical device manufacturers continue to provide cybersecurity support during Stage 3. However, as product development transitions to a more current medical device design, different constraints are involved with the transition. Medical devices in Stage 3 often require additional network controls compared to medical devices in Stage 2:

 

  • Third-party components or software may be used more frequently than internally developed updates or patches
  • Cybersecurity best practices integration is often governed by the ease of following support practices outlined in the Stage 2
  • Medical device manufacturers must explain to users the existing limitations that are now recognized in the devices and services affected
  • Healthcare providers using the medical device should begin to take more of an active role in unmitigated features of security defense.

 

End of Support Stage (Stage 4)

 

Medical devices in Stage 4 are considered more vulnerable than any of the other stages. They may still be in use for providing patient care, but they have been publicly identified as no longer being supported by the medical device manufacturer. Each of these scenarios result in a medical device that cannot be consistently defended against modern cybersecurity dangers.

 

Critical facets healthcare information technology departments should look for include:

 

  • Medical devices that have been declared EOS by the medical device manufacturer
  • Medical devices that are not actively marketed or sold by the medical device manufacturer
  • Medical devices that contain software, firmware, or programmable hardware components no longer supported by software developers
  • Medical devices with known risks to device safety and effectiveness that are unmitigated

 

Risk Management

 

risk managementFurther, the guidance calls for a risk management approach to product lifecycle management featuring:

 

  • Security risk analysis
  • Security risk evaluation
  • Security risk control
  • Security risk acceptability

 

The cybersecurity guidance expands on product design and how security is incorporated and maintained through the product life cycle. This can be accomplished through using risk control and a secure development framework.

 

Risk mitigation recommendations for medical device manufacturers include:

 

  • Security design and controls based on intended use of the medical device
  • Security risk assessments across the risk management process
  • Threat modelling to help determine operational risk

 

Security testing and communication for medical device manufacturers include:

 

  • Customer facing product security documentation & communication
  • Post-market monitoring of cybersecurity vulnerabilities
  • Identification of vulnerabilities in third party risk management
  • Vulnerability risk identification based on the device security design, controls, and mitigations

 

Ensuring availability of security patches & mitigations based on device risk:

 

  • Coordinated and clear communication to all affected users
  • Description related to the vulnerability and its corresponding mitigations
  • Identification of other mitigation options when a security patch is unavailable

 

Data Integrity

 

One of the core principles the guidance stresses is cybersecurity information, data integrity and the importance of information sharing. IMDRF encourages medical device industry stakeholders to implement a proactive pre- and post-market approach to cybersecurity information sharing.

 

Moreover, timely information can help the industry recognize threats, evaluate associated risks, and react quickly as needed. An increase in industry transparency could directly benefit healthcare providers, medical device users and medical device companies.

 

Security Updates

 

An important section of the medical device cybersecurity guidance details stakeholder responsibilities related communications, risk management, and transfer of responsibility. Specifically, it is important that medical device manufacturer communications are comprehensive & identify types of documentation needed and when the medical device user may need it. 

 

Product Security Documentation

 

Medical device manufacturers should ideally provide PLC documentation about security or support changes early in the Support stage. This helps HCP risk management during both the procurement & deployment of medical devices. Types of life cycle support for product security documentation includes:

 

  • Manufacturer disclosure statement for medical device security
  • Software Bill of Materials (SBOM)
  • Security test report summaries
  • Third-party security certifications
  • Customer security documentation

 

Product Life Cycle Documentation

 

Medical device companies should communicate the strategic life cycle milestones to their customers. Further, these interactions would include cybersecurity EOL and EOS dates if available. This helps to support HCPs during both the procurement & installation process.

 

Additionally, medical device manufacturers should provide this information as far in advance as possible. The goal is at least 2 years in advance to best support healthcare professionals with the following information:

 

  • Affected medical devices
  • Medical device operating system(s)
  • Version of medical device deployed
  • Medical device software components
  • Expected date of medical device service changes
  • Extent of medical device maintenance after a service change occurs
  • Additional design controls that help all involves parties

 

Vulnerability & Patching Information

 

If a vulnerability is uncovered, medical device companies should provide related vulnerability information. Further, the guidance specifically mentions the importance of both the appropriate mitigation or available software patch. Additionally, the guidance stresses an elevated priority be placed on high-risk vulnerabilities where timely communication is required. This communication is designed to help prevent both patient injury or device interruption.

 

Finally, the mitigation method and implementation instructions should be provided to the medical device operators. These security updates include both an over-air update or deployment of service personnel to help install the remedy.

 

Proactive Communications for Third-Party Components

 

Medical device software and other digital components within a medical device will reach EOL/EOS before the product itself does. In these cases, risk can increase based on the lack of support for these elements. To help compensate for these security risks, the cybersecurity guidance suggests medical device companies should:

 

  • Validate the list of third-party components used in medical devices
  • Track support status updates of third-party components used within their device
  • Assess the risks that exist when third-party components become unsupported
  • Communicate new risks and available risk mitigations to healthcare providers

 

To begin the Regulatory Compliance Associates scoping process today, please enter your information in the blue form below and click the submit button at the bottom of the webpage. You may also email us at [email protected].

 

Brownfield vs. Greenfield Facilities: Key Considerations for Onshoring Manufacturing

Posted on by Brandon Miller

brownfield greenfield

The global pandemic and continued supply chain disruptions have prompted many U.S. pharmaceutical and medical device manufacturers to reassess their reliance on offshore production. As organizations place greater emphasis on quality assurance, regulatory compliance, and supply chain resilience, onshoring manufacturing has become a strategic priority. Bringing operations back to the United States allows companies to strengthen oversight, enhance manufacturing reliability, and establish greater control over GMP processes.

 

One of the most important early decisions in this process is choosing between a brownfield facility or a greenfield manufacturing site. This choice influences implementation timelines, operational efficiency, regulatory readiness, and long-term scalability.

 

What Is a Brownfield Facility?

 

A brownfield manufacturing facility is an existing structure that can be repurposed to support new or expanded operations. Companies may lease or purchase the facility and complete the modifications required to support production. In many cases, the site already includes established utilities, cleanroom environments, operational workflows, and experienced personnel.

 

Some organizations may even have suitable brownfield options within their own corporate network. During evaluation, many rely on GMP facility design review to ensure the site meets modern standards.

 

Advantages of Brownfield Sites

 

Brownfield facilities are often preferred for their speed and efficiency. Since construction is not required, manufacturers can begin operations much sooner. This shortens transition timelines, reduces downtime, and supports faster technology transfer. Existing quality systems such as QMS, ERP platforms, CAPA management systems, and electronic documentation tools can also be integrated into the new operational framework. Organizations often turn to quality management system optimization to ensure alignment.

 

Challenges of Brownfield Sites

 

Older buildings may have structural or layout limitations that restrict scalability. Aging equipment may introduce inefficiencies or require significant upgrades to meet current expectations under FDA and EU guidance. Before transitioning, manufacturers should assess the site’s validation status and consider FDA inspection readiness services to identify potential compliance gaps.

 

What Is a Greenfield Facility?

 

A greenfield manufacturing site involves constructing a new facility from the ground up. This approach gives pharmaceutical and medical device companies complete freedom to design a building aligned with modern GMP compliance standards and advanced technologies.

 

Greenfield sites also allow companies to incorporate optimized cleanroom layouts and contamination control strategies that support sterile manufacturing and are consistent with EU Annex 1–style risk management.

 

Advantages of Greenfield Sites

 

A new build allows manufacturers to design workflows that reduce contamination risk, integrate advanced utilities, and install state-of-the-art equipment. A greenfield project also enables scalable infrastructure planning for future growth and long-term efficiency. Many companies leverage regulatory compliance support early in the design phase to ensure alignment with FDA and global expectations.

 

Challenges of Greenfield Sites

 

Greenfield facilities have longer timelines, higher upfront costs, and expanded staffing requirements. Construction delays, permitting schedules, and supply chain challenges can further extend project timelines. Organizations frequently use process validation support and technology transfer services to ensure smooth startup once the facility becomes operational.

 

Choosing the Right Onshoring Strategy

 

Selecting between a brownfield and a greenfield strategy requires a comprehensive assessment of:

  • The complexity of your manufacturing process
  • Speed-to-market requirements and timelines
  • Long-term capacity and scalability needs
  • Regulatory risk and inspection risk (FDA, global)
  • Maturity of your quality system and digital infrastructure
  • Total cost of ownership (capex, opex, validation)

 

Get Expert Support From Regulatory Compliance Associates®

 

Whether you are planning a brownfield retrofit or building a greenfield facility, establishing a strong compliance foundation from the very beginning is essential. Regulatory Compliance Associates® (RCA) delivers full-lifecycle support for life science companies, including:

  • GMP facility design reviews
  • Quality system implementation and remediation (QMS)
  • Inspection readiness and training, including mock FDA inspections, pre-inspection coaching, and audit preparation
  • Regulatory consulting for FDA submissions, global strategy, and agency communications
  • Process validation, technology transfer, and risk management to ensure robust, compliant operations
  • Supplier quality assurance to support stable raw materials and component sourcing

 

Partnering with RCA helps you align your onshoring strategy with regulatory needs, reduce compliance risk, and accelerate operational readiness. Our deep bench of industry and former-FDA experts will translate complex requirements into practical, actionable plans tailored to your organization.

 

Contact Regulatory Compliance Associates® today to connect with a subject matter expert and begin building a compliant, efficient, and future-ready manufacturing operation.