FDA Consultant Specialist

FDA regulatory consulting for medical device manufacturers covering submission pathways, Quality System Regulation (QSR), HIPAA compliance, and device cybersecurity requirements.

Table of Contents

• - FDA Pathway Selection
• 510(k) Submission Process
• QSR Compliance
• HIPAA for Medical Devices
• Device Cybersecurity
• Resources

---

FDA Pathway Selection

Determine the appropriate FDA regulatory pathway based on device classification and predicate availability.

Decision Framework

CODEBLOCK0

Pathway Comparison

Pathway	When to Use	Timeline	Cost
510(k) Traditional	Predicate exists, design changes	90 days	$21,760
510(k) Special

Manufacturing changes only | 30 days | $21,760 | | 510(k) Abbreviated | Guidance/standard conformance | 30 days | $21,760 | | De Novo | Novel, low-moderate risk | 150 days | $134,676 | | PMA | Class III, no predicate | 180+ days | $425,000+ |

Pre-Submission Strategy

1. 1. Identify product code and classification
2. Search 510(k) database for predicates
3. Assess substantial equivalence feasibility
4. Prepare Q-Sub questions for FDA
5. Schedule Pre-Sub meeting if needed

Reference: See fdasubmission_guide.md for pathway decision matrices and submission requirements.

---

510(k) Submission Process

Workflow

CODEBLOCK1

Required Sections (21 CFR 807.87)

Section	Content
Cover Letter	Submission type, device ID, contact info
Form 3514

CDRH premarket review cover sheet | | Device Description | Physical description, principles of operation | | Indications for Use | Form 3881, patient population, use environment | | SE Comparison | Side-by-side comparison with predicate | | Performance Testing | Bench, biocompatibility, electrical safety | | Software Documentation | Level of concern, hazard analysis (IEC 62304) | | Labeling | IFU, package labels, warnings | | 510(k) Summary | Public summary of submission |

Common RTA Issues

Issue	Prevention
Missing user fee	Verify payment before submission
Incomplete Form 3514

Review all fields, ensure signature | | No predicate identified | Confirm K-number in FDA database | | Inadequate SE comparison | Address all technological characteristics |

---

QSR Compliance

Quality System Regulation (21 CFR Part 820) requirements for medical device manufacturers.

Key Subsystems

Section	Title	Focus
820.20	Management Responsibility	Quality policy, org structure, management review
820.30

Design Controls | Input, output, review, verification, validation | | 820.40 | Document Controls | Approval, distribution, change control | | 820.50 | Purchasing Controls | Supplier qualification, purchasing data | | 820.70 | Production Controls | Process validation, environmental controls | | 820.100 | CAPA | Root cause analysis, corrective actions | | 820.181 | Device Master Record | Specifications, procedures, acceptance criteria |

Design Controls Workflow (820.30)

CODEBLOCK2

CAPA Process (820.100)

1. 1. Identify: Document nonconformity or potential problem
2. Investigate: Perform root cause analysis (5 Whys, Fishbone)
3. Plan: Define corrective/preventive actions
4. Implement: Execute actions, update documentation
5. Verify: Confirm implementation complete
6. Effectiveness: Monitor for recurrence (30-90 days)
7. Close: Management approval and closure

Reference: See qsrcompliance_requirements.md for detailed QSR implementation guidance.

---

HIPAA for Medical Devices

HIPAA requirements for devices that create, store, transmit, or access Protected Health Information (PHI).

Applicability

Device Type	HIPAA Applies
Standalone diagnostic (no data transmission)	No
Connected device transmitting patient data

Yes | | Device with EHR integration | Yes | | SaMD storing patient information | Yes | | Wellness app (no diagnosis) | Only if stores PHI |

Required Safeguards

CODEBLOCK3

Risk Assessment Steps

1. 1. Inventory all systems handling ePHI
2. Document data flows (collection, storage, transmission)
3. Identify threats and vulnerabilities
4. Assess likelihood and impact
5. Determine risk levels
6. Implement controls
7. Document residual risk

Reference: See hipaacompliance_framework.md for implementation checklists and BAA templates.

---

Device Cybersecurity

FDA cybersecurity requirements for connected medical devices.

Premarket Requirements

Element	Description
Threat Model	STRIDE analysis, attack trees, trust boundaries
Security Controls

Authentication, encryption, access control | | SBOM | Software Bill of Materials (CycloneDX or SPDX) | | Security Testing | Penetration testing, vulnerability scanning | | Vulnerability Plan | Disclosure process, patch management |

Device Tier Classification

Tier 1 (Higher Risk):

• - Connects to network/internet
• Cybersecurity incident could cause patient harm

Tier 2 (Standard Risk):

• - All other connected devices

Postmarket Obligations

1. 1. Monitor NVD and ICS-CERT for vulnerabilities
2. Assess applicability to device components
3. Develop and test patches
4. Communicate with customers
5. Report to FDA per guidance

Coordinated Vulnerability Disclosure

CODEBLOCK4

Reference: See devicecybersecurity_guidance.md for SBOM format examples and threat modeling templates.

---

Resources

scripts/

Script	Purpose
INLINECODE0	Track 510(k)/PMA/De Novo submission milestones and timelines
INLINECODE1

Assess 21 CFR 820 compliance against project documentation | | hipaa_risk_assessment.py | Evaluate HIPAA safeguards in medical device software |

references/

File	Content
INLINECODE3	510(k), De Novo, PMA submission requirements and checklists
INLINECODE4

21 CFR 820 implementation guide with templates | | hipaa_compliance_framework.md | HIPAA Security Rule safeguards and BAA requirements | | device_cybersecurity_guidance.md | FDA cybersecurity requirements, SBOM, threat modeling | | fda_capa_requirements.md | CAPA process, root cause analysis, effectiveness verification |

Usage Examples

CODEBLOCK5