Hospitals as medical device manufacturers: keeping to the Medical Device Regulation (MDR) in the EU (2024)

Abstract

In the European Union, the introduction of the Medical Device Regulation (MDR) 2017/745 in 2021 increased the regulatory requirements for ‘in-hospital’ manufacture of medical devices. Depending on the exact scenario, a hospital manufacturing devices will need to consider applying one of three sets of regulatory requirements defined in the MDR: a reduced set of rules called the ‘health institution exemption’, which can be availed of under certain conditions; rules that apply for the manufacture of custom-made devices; or, exceptionally and most onerously, the same ‘full’ set of rules that apply to commercial medical device manufacturers. The purpose of this discussion is to provide an introductory guide to compliance with the MDR for in-hospital manufacture, highlighting the main regulatory requirements and the factors which determine which of the three ‘routes’ is the most appropriate.

http://creativecommons.org/licenses/by-nc/4.0/

This is an open access article distributed in accordance with the Creative Commons Attribution Non Commercial (CC BY-NC 4.0) license, which permits others to distribute, remix, adapt, build upon this work non-commercially, and license their derivative works on different terms, provided the original work is properly cited, appropriate credit is given, any changes made indicated, and the use is non-commercial. See:http://creativecommons.org/licenses/by-nc/4.0/.

Introduction

In many hospitals, medical device design and manufacturing is part of general service provision. Device types routinely made in hospitals include custom-made maxillofacial prosthetics,1 orthotics2 and surgical cutting guides.3 From time to time hospitals also design and manufacture medical devices to meet needs that cannot be met with commercially available devices.4 Traditionally, devices developed ‘in-house’ relied heavily on local artisanal and workshop skills, using techniques like casting and machining in the production process. Innovation has been fuelled by the adoption of 3D printing and other accessible development tools, moving design and production to the digital domain5 and enabling the manufacture of increasingly complex devices.6

Most device development is of course industry driven, with market considerations determining development priorities.7 Hospital device development, by contrast, is clinically driven and focused on the needs of specific patients. There is value in preserving a regulated space for this activity as it fulfils a specific function and has distinctive characteristics.

While in the past, doctors would have had relatively unhindered scope to design and build devices (eg, in the USA, decades of research policies deliberately ‘tiptoed lightly so as not to disturb genius at work’8), regulatory control of all forms of medical device manufacture has deepened to help address instances of patient harm arising from underestimation of risk.9 But as long as clinicians understand how and where to apply the rules, innovative clinicians can still explore directly developing device-based solutions for their patients.

In the European Union (EU), the introduction of the Medical Device Regulation 2017/745 (MDR10) in 2021 has implications for the manufacture of medical devices in hospitals and other healthcare settings.11 Under the previous EU regulatory framework, the Medical Devices Directive 93/42/EC, there were no detailed rules set for in-house manufacture, other than a requirement for a prescription and statement for custom-made devices. In the MDR, however, a regulatory ‘exemption’ is defined which sets rules for health institutions manufacturing under certain conditions. The exemption rules and the custom-made device rules are less onerous than the ‘full’ MDR application required for a general medical device intended for the market.

The purpose of this paper is to provide a navigable, introductory guide to the MDR targeted at the specific needs of health institution developers, makers and innovators and designed to be accessible to a general scientific readership. For those in non-EU jurisdictions, it is hoped that some of the regulatory elements described may be of value for voluntary application in their own institutions, or simply allow comparison with the benefits/limitations of their local regulatory frameworks. Of course, not all details or nuance can be captured here, and the MDR text should be consulted directly as needed. Regulation is not a static field, and readers should be alert to changes in the substance or interpretation of national/international regulations. Publications from the European Commission’s Medical Device Coordination Group (MDCG), the statutory body tasked with the creation of guidance for the MDR in Europe, are particularly useful for staying up to date.12

Broader MDR regulations relevant to hospitals but unrelated to our focus on in-hospital manufacture (eg, unique device identifier recording, reuse, refurbishment) are not discussed.

Medical device definition

The MDR has a specific, detailed definition of what constitutes a ‘medical device’ (MDR, Article 2 (1)). If a device manufactured by a health institution falls outside this definition, then the MDR is not applicable. Broadly, if the manufactured device is used in diagnosing, treating, monitoring or alleviating a disease, disability or injury, and it is not a drug or biochemical,13 then it is likely a medical device. For example, in-house manufacture of walking frames is within the scope of the MDR, whereas a patient call bell is outside the scope, as only the former fits the definition of a medical device. Locally written code for estimating early warning scores would be in scope, as devices for preventing, predicting or providing a prognosis are included and software/apps, not just physical devices, can meet the definition. Devices built to sterilise, clean or disinfect other medical devices are also considered medical devices in themselves.

In vitro diagnostic medical devices are a specific device type that provides information through ‘in vitro examination of specimens derived from the human body, including organ, blood and tissue donations’. In the EU, in vitro devices are regulated through the In Vitro Diagnostic Medical Device Regulation 746/2017, not the MDR. While there are similarities in how each set of regulations deals with in-house manufacture, the focus here will be on the MDR.

The intended purpose of a medical device

The use case or ‘intended purpose’ for the device is defined by the manufacturer and described in the instructions for use for the device. A locally built EEG (electroencephalogram) hardware/software platform used solely to assess responses to sensory stimulation in a research project is a ‘Research Use Only’ device, not a medical device, as it does not meet the medical purpose part of the definition of a medical device. As such, it falls outside the definition of a medical device and the MDR is not relevant. Of course, appropriate risk management, local research ethics approvals and any national requirements still need to be met. If the same device was used for a medical purpose, for example, for neurological assessment, it becomes a medical device, and the MDR does apply.

Medical devices can be used in a different way from the intended purpose described by the manufacturer, this is known as ‘off-label’ use and in this case, regulatory and legal responsibility can pass from the manufacturer to the healthcare practitioner and/or the health institution. The MDR does not apply any requirements to healthcare practitioners planning off-label use. There are requirements for manufacturers to examine their postmarket evidence to detect ‘systematic’ off-label use. In addition to using a device in a different way from the intended purpose, physical alterations or further manufacturing type activity could be undertaken which could bring off-label use into the domain of in-house manufacturing. For example, deploying a stent in a different anatomical location is off-label, cutting the stent in half prior to deployment may constitute in-house manufacture.

Risk classification

Once it is established that the device in question is genuinely a medical device, it can be categorised under the MDR in terms of increasing risk as class I, IIa, IIb or III by considering the device’s intended purpose and characteristics against defined mapping rules. The rules are available as flow charts for physical devices and software.14 15 The risk classification is used in the MDR to navigate the regulations for custom-made and ‘full’ applications; for the exemption the classification may be useful as a general metric of risk.

Regulatory routes for in-house manufacture

In practice, nearly all ‘in-house’ manufacture is likely to fall under the MDR regulations for exemption or custom-made devices. Straying beyond the defined scope of these two scenarios could attract full application of the MDR.

An institution which can benefit from the exemption must be ‘an organisation, the primary purpose of which is the care or treatment of patients or the promotion of public health’, engaged in manufacture of devices on a non-industrial scale. Qualifying institutions include hospitals, laboratories, and other organisations ‘supporting the healthcare system and/or addressing patient needs’ but exclude those focused solely on wellness/lifestyle issues.

The exemption may be appropriate where, for example, a device is built to support an emerging therapy,4 clinical decision software is written locally16 or adaptors are built for existing equipment.17 The exemption can only be applied if the institution can justify that no other suitable device is available on the market which meets the specific need. Manufacturing a device in-house solely to save money is not sufficient justification. The exemption is also limited to devices ‘used within the health institution’, the exact meaning of which may not be immediately obvious. According to the MDCG, a device is no longer ‘within’ a health institution if it is moved to another legal entity.18 Depending on the local context, physically moving a device between locations may or may not involve crossing such a legal governance boundary. For example, an individual hospital may be just one of many institutions operating under a single legal umbrella at different locations, or could itself consist of many different legal entities operating in one location. The MDCG suggests consulting the national competent authority for their opinion on how the legal entity concept applies to healthcare in each member state.

Academic departments/labs which are part of the same legal entity as a hospital or which qualify as health institutions themselves, could also apply the exemption. Otherwise, a hospital manufacturing a device under exemption should consider treating an academic collaborator as an ‘external supplier’ to be monitored through its Quality Management System (QMS).16

Examples provided in MDCG guidance also appear to suggest that the exemption does not extend to devices used beyond the physical bounds of the hospital, although this is not stated explicitly. This is potentially quite limiting, as it implies a hospital-built device provided to a patient for home use (eg, wearables) would require ‘full’ MDR application (unless the device is custom-made). However, pending further MDCG or competent authority updates, this appears to be the current, conservative interpretation of ‘used within’.

A custom-made device is a device made in accordance with a written prescription by an authorised person, where the prescribed design is intended to meet the needs of an individual patient. Examples include an artificial ear designed to match a missing ear, an orthosis incorporating a patient-specific design characteristic,19 and a cervical disc replacement designed for an individual patient.20

A hospital or other health institution can, of course, just prescribe and buy in a custom-made device, in which case the regulatory burden lies with the external manufacturer. Where a hospital chooses to manufacture a custom-made device itself, the question arises whether it should apply the exemption rules or the rules for custom-made devices.16 MDCG guidance states that custom-made devices are ‘out of scope’ of the exemption.19 Although ambiguous, it is likely this was intended to emphasise that commercial custom-made devices cannot access the exemption route. Certainly, nothing in the MDR text suggests that a device developed in a hospital for an individual patient needs to be treated differently than any other exemption device. Of course, if the device is not ‘used within’ the institution, exemption requirements are not met and the custom-made rules apply.

Custom-made devices need to be distinguished from personalised ‘adaptable medical devices’ and ‘patient-matched devices’ (figure 1).21 If a supposed ‘custom-made’ device is made in-house at high volumes using the same process, then the device may well fall into one of these categories, which attract the full regulatory burden.

Requirements by route

In figure 2, the main regulatory requirements for the exemption, custom-made and ‘full’ MDR routes are shown, highlighting the differences between them.

1. QMS: There are identical, specific QMS requirements for general devices and custom-made devices. In practice, commercial manufacturers will use ISO 13485 as an overarching QMS standard to address the MDR requirements. Under the exemption, there is a less prescriptive requirement for an ‘appropriate’ QMS. Some guidance is provided by MDCG on determining ‘appropriate’, for example, by including processes for justifying the exemption, for risk management, for documenting manufacture and by considering national legislation and ISO standards.16

2. Compliance with general safety and performance requirements (GSPR): The GSPR applies to all devices and mandates risk management in design/manufacture, provision of information to users and general controls on specific risks (eg, biological, mechanical, radiation) as prescribed in associated International Electrotechnical Commission (IEC)/ISO standards.

3. Maintenance of technical documents: For a full MDR application, detailed requirements are set for technical documents describing the device and its design, manufacture and validation/verification. In the exemption and custom-made cases, documentation must include sufficient evidence that a competent authority, should it choose, could confirm GSPR has been met.

4. Other documentation: For devices made under an exemption a ‘declaration’ must be drawn up and made publicly available identifying the device and manufacturing institution, and stating that GSPR has been met or justifying any exclusions. The health institution also needs to justify the use of the exemption. For custom-made devices a ‘statement’ must be drawn up which includes identifiers for the prescriber, patient, manufacturer and device and confirms that the GSPR has been met or, again, justifies any exclusions.

5. Responsible person: Unless the exemption applies, manufacturers must designate (or in smaller organisations, have access to) a competent person responsible for regulatory compliance. For custom-made devices appropriate manufacturing experience is sufficient qualification. While not mandated for the exemption, some EU hospitals have in practice designated role(s) to ensure GSPR are met.

6. Clinical evaluation: Clinical evaluation is a formal, planned process of proving a device achieves its required clinical performance and safety, and an appropriate benefit–risk. Depending on the device, the evaluation may include a review of data from similar devices, from the scientific literature or from clinical investigations.

7. Postmarket surveillance (PMS): If the device is made under exemption, it is sufficient to review experience gained when using the device and to implement corrective actions where needed. Otherwise, a planned PMS is required to monitor and confirm the continued safety, performance and benefit–risk of the device over its lifetime. The manufacturer updates the results of the PMS as needed in a ‘PMS Report’ for class I or in periodic safety update reports for class II/III.

8. Declaration of conformity: In the EU, a medical device placed on the market must be CE marked, unless it is a custom-made, exemption device or an investigational device. To use the mark, a manufacturer makes a formal ‘declaration of conformity’, which generally requires a ‘certificate of conformity’ issued by a notified body. Class I devices that are not re-useable surgical instruments, are not sterile and have no measuring function can be ‘self-declared’ without notified body input. For all other classes, the notified body will audit conformity through one of several pathways, determined by the device risk classification and intended use. Other than custom-made class III implantable devices, exemption and custom-made devices can generally avoid the involvement of a notified body, but member states can require manufacturers to provide a list of custom-made devices to the competent authority.

Clinical investigation

The MDR does not directly mandate clinical investigation in the exemption case, although one may be considered through risk management under an ‘appropriate QMS’.

If not under exemption, clinical investigations are explicitly required for class III and implantable devices, with some exceptions. For all other devices, the manufacturer will need to demonstrate whether a clinical investigation is required as part of the clinical evaluation.

The MDR sets out three possible routes for clinical investigation.22 Article 62 is the route used when the purpose of the investigation is to demonstrate regulatory conformity, that is, to lead to CE marking, while Article 74 is employed for postmarket clinical follow-up (PMCF) investigations. These routes require approval from a research ethics committee set up in national law. Article 62 studies must be authorised by a competent authority while PMCF investigations must be notified to a competent authority. Article 82 is the ‘other’ route, which has been identified in some national guidelines as a route for clinical investigations of custom-made and exemption devices.23 Under Article 82, member states may define their own requirements in national law. Where a hospital develops a prototype device as part of early-stage development (eg, for possible future spin-out), a related clinical investigation may trigger Article 62 or Article 82. When preparing a submission, it may be helpful to engage with national authorities to confirm the submission type and to use European or national templates.24 25

Discussion

While some enforcement discretion may be applied to in-house manufacture as the MDR becomes established, institutions must prepare for implementation. As a starting point, existing in-house development and manufacturing activities should be identified. The relevant expertise from clinical engineering, biomedical engineering, medical physics, software developers, risk management, clinicians and hospital executives should then be drawn together for review. A workshop format may be valuable in building awareness of the regulations and planning a local response.26

There may be some comfort in the fact that most devices built in-house are likely to be lower risk. While the regulatory burden for exemption and custom-made devices does not strictly track risk classification, there is likely some room for proportional application through a risk-based approach (eg, in the complexity of the QMS, or the level of clinical evaluation required). That said, calibrating ‘acceptable proportionality’ for both physical devices and software may be difficult without regulator-tested examples in the public domain. For some higher-risk devices, summaries of safety and clinical performance of existing devices are available online and, in the future will be accessible via EUDAMED27 and may provide pointers for in-house development. Similar data on low-risk devices is less readily available. Hospitals might consider working with a medical company for higher-risk devices.

Developing medical devices in a hospital setting or in collaboration with academic partners in the EU now requires an awareness of relevant parts of the MDR. The essential balance that the MDR is trying to achieve is ‘a high level of safety while supporting innovation’ and it needs to be recognised that regulations are ultimately intended for the public good. It is with that perspective that hospitals should interpret and apply the rules, always considering patient safety and benefit, but not using the regulations as a reason to block innovation. With the right professional local input, health institution manufacturing can remain a reality, and with teamwork, collaboration and open communication a healthy, innovative hospital manufacturing community can be maintained.

Ethics statements

References

1. ↵
   1. Slijepcevic AA,
   2. Afshari A,
   3. Vitale AE, et al

   . A contemporary review of the role of facial prostheses in complex facial reconstruction. Plast Reconstr Surg 2023;151:288e–98e. doi:10.1097/PRS.0000000000009856

   OpenUrl

2. ↵
   1. Nouri A,
   2. Wang LJ,
   3. Li YC, et al

   . Materials and manufacturing for ankle-foot orthoses: a review. Adv Eng Mater 2023;25:20. doi:10.1002/adem.202300238

3. ↵
   1. Ostaș D,
   2. Almășan O,
   3. Ileșan RR, et al

   . Point-of-care virtual surgical planning and 3d printing in oral and cranio-maxillofacial surgery: a narrative review. J Clin Med 2022;11:6625. doi:10.3390/jcm11226625

4. ↵
   1. de Moura DTH,
   2. Hirsch BS,
   3. McCarty TR, et al

   . Homemade endoscopic vacuum therapy device for the management of transmural gastrointestinal defects. Dig Endosc 2023;35:745–56. doi:10.1111/den.14518

   OpenUrl

5. ↵
   1. Hellman S,
   2. Frisch P,
   3. Platzman A, et al

   . 3D printing in a hospital: centralized clinical implementation and applications for comprehensive care. Digit Health 2023;9:20552076231221899. doi:10.1177/20552076231221899

6. ↵
   1. Mavrodontis II,
   2. Trikoupis IG,
   3. Kontogeorgakos VA, et al

   . Point-of-care orthopedic oncology device development. Current Oncology 2024;31:211–28. doi:10.3390/curroncol31010014

   OpenUrl

7. ↵
   1. Zenios S,
   2. Makower J,
   3. Yock P, et al

   . Biodesign: The Process of Innovating Medical Technologies. Cambridge University Press, 2009.

8. ↵
   1. Bartlett Foote S

   . Managing the Medical Arms Race: Innovation and Public Policy in the Medical Device Industry. Berkeley: University of California Press, 1992.

9. ↵
   1. Kachalia A,
   2. Mello MM,
   3. Nallamothu BK, et al

   . Legal and policy interventions to improve patient safety. Circulation 2016;133:661–71. doi:10.1161/CIRCULATIONAHA.115.015880

   OpenUrlFREE Full Text

10. ↵
    1. Regulation (EU) 2017/745

    . Regulation (EU) 2017/745 of the European parliament and of the Council of 5 April 2017 on medical devices, amending directive 2001/83/EC, regulation (EC) no 178/2002 and regulation (EC) No1223/2009 and repealing Council directives 90/385/EEC and 93/42/EEC. 2017.

11. ↵
    1. Melvin T

    . The European medical device regulation-what biomedical engineers need to know. IEEE J Transl Eng Health Med 2022;10:4800105. doi:10.1109/JTEHM.2022.3194415

12. ↵

    Medical device coordination group working groups: European Commission. n.d. Available: https://health.ec.europa.eu/medical-devices-dialogue-between-interested-parties/medical-device-coordination-group-working-groups_en

13. ↵

    Manual on borderline and classification under regulations (EU) 2017/745 and 2017/746. Medical Device Coordination Group (MDCG); 2022.

14. ↵

    MDCG 2019-11 guidance on qualification and classification of software in regulation (EU) 2017/745 MDR and regulat ion (EU) 2017/746 IVDR. Medical Device Coordination Group (MDCG); 2019.

15. ↵

    MDCG 2021-24 guidance on classification of medical devices. Medical Device Coordination Group (MDCG); 2021.

16. ↵

    MHRA guidance on the health institution exemption (HIE) – IVDR and MDR (Northern Ireland). UK. Medicines and Health Regulatory Authority; 2021.

17. ↵
    1. Perez-Mañanes R,
    2. José SGS,
    3. Desco-Menéndez M, et al

    . Application of 3d printing and distributed manufacturing during the first-wave of COVID-19 pandemic. Our experience at a third-level University hospital. 3D Print Med 2021;7:7. doi:10.1186/s41205-021-00097-6

18. ↵

    MDCG 2023-1 guidance on the health institution exemption under article 5(5) of regulation (EU) 2017/745 and regulation (EU) 2017/746. Medical Device Coordination Group (MDCG); 2023.

19. ↵

    MDCG 2021-3 questions and answers on custom made devices. Medical Device Coordination Group (MDCG); 2021.

20. ↵
    1. Willemsen K,
    2. Nizak R,
    3. Noordmans HJ, et al

    . Challenges in the design and regulatory approval of 3d-printed surgical implants: a two-case series. Lancet Digit Health 2019;1:e163–71. doi:10.1016/S2589-7500(19)30067-6

    OpenUrl

21. ↵

    Personalized medical devices - regulatory pathways International medical device regulators forum (IMDRF). 2020.

22. ↵

    MDCG 2021-6 regulation (EU) 2017/745 – questions & answers regarding clinical investigation. Medical Device Coordination Group (MDCG); 2021.

23. ↵

    Review of a clinical investigation with a medical device. Netherlands. Centrale Commissie Mensgebonden Onderzoek (CCMO); 2021.

24. ↵

    MDCG 2021-08 clinical investigation application/notification documents medical device coordination group (MDCG). 2021.

25. ↵

    For example, central Commissie Mensgebonden Onderzoek (CCMO), Netherlands IMDD (investigational medical device Dossier) template Netherlands: central Commissie Mensgebonden Onderzoek (CCMO). n.d. Available: https://english.ccmo.nl/investigators/publications/forms/2020/12/14/d2-imdd-template

26. ↵
    1. de Jong IJ,
    2. Lexis MAS,
    3. Slegers K, et al

    . Medical device regulation: requirements for occupational therapists in the Netherlands who prescribe and manufacture custom-made devices. Disabil Rehabil Assist Technol 2024;19:1415–23. doi:10.1080/17483107.2023.2187889

    OpenUrl

27. ↵

    EUDAMED - European database on medical devices: European Commission. n.d. Available: https://ec.europa.eu/tools/eudamed/#/screen/home