Hazard analysis and risk control

Hazard, hazardous situation, harm

Medical device risk management keeps three ideas apart:

• A hazard is a potential source of harm: heat, mains voltage, bacteria in standing water, a confusing screen.
• A hazardous situation is a circumstance in which a person is exposed to the hazard. A hot heater plate inside a closed housing harms nobody; a patient breathing gas that the plate has overheated is exposed.
• Harm is the injury or damage to health that can follow.

A sequence of events links the hazard to the hazardous situation: a part fails, a user slips, a cleaning step is skipped. Writing the chain out guards against vague entries such as "overheating".

P1, P2 and the probability of harm

The probability of harm is often split in two. P1 is the probability that the sequence of events leads to the hazardous situation. P2 is the probability that the hazardous situation leads to the harm. The probability of harm is P = P1 × P2. The two halves draw on different evidence: P1 on reliability data, tests and use studies; P2 on clinical knowledge. Where no sound estimate exists, as for software faults, many teams assume the worst-case probability and judge on severity.

Risk evaluation

Risk is the combination of the probability of harm and its severity. The manufacturer sets its own criteria for risk acceptability, in its risk management plan, before the analysis starts. The matrix above is that policy in picture form: click a cell to change it. Three regions are common: acceptable; a middle region where risk is reduced as far as practicable and the reason for stopping recorded; and unacceptable.

Risk control, in order of priority

1. Inherent safety by design and manufacture: remove the hazard or reduce its energy, as with a low-voltage supply.
2. Protective measures in the device or the manufacturing process: cutoffs, interlocks, alarms.
3. Information for safety and, where appropriate, training: warnings, instructions for use, labels.

The order matters. A warning works only if someone reads it and acts on it every time, so using it alone on an unacceptable risk needs a written reason why design and protective measures were not practicable. Each control is verified twice: that it was implemented, and that it reduces the risk. Controls can create new hazards, such as a cutoff that stops therapy, so each one is checked for that too.

Residual risk and benefit-risk

Residual risk is what remains after control. If a risk is still not acceptable and no further control is practicable, the manufacturer may go ahead only if a benefit-risk analysis shows that the medical benefit of the intended use outweighs it. Finally the residual risks are judged together, as an overall residual risk, and the significant ones are disclosed to users. Production and post-production information, such as complaints and service data, is fed back into the file; it can show that an estimate was wrong.

Hazard analysis, FMEA or risk register?

An FMEA works bottom up, from each failure mode to its effect, and misses hazards that occur with nothing failing, such as use errors in normal use. A hazard analysis works from the hazards and harms and covers normal use, fault conditions and foreseeable misuse. Many device makers use both. A risk register covers business and project risk; a fault tree can supply P1 for a complex sequence of events.

On the exam

CMDA IV.A.1 asks you to describe risk analysis, evaluation, control, benefit-risk analysis and the use of production and post-production information, and IV.A.2 to judge whether hazards are identified in normal and fault conditions, including use, and whether risk controls are implemented in design and production. CQE III.E.4 lists hazard analysis with FMEA and FMECA, VII.A.1 the risk terms (severity, occurrence), VII.B.2 risk matrices and acceptability criteria, and VII.C.1 documenting risks and controls. Expect to tell a hazard from a hazardous situation, multiply P1 by P2, and put the control options in priority order.

Common questions

What are P1 and P2 in risk management?

P1 is the probability that the hazardous situation occurs; P2 is the probability that the hazardous situation leads to harm. The probability of harm is P1 × P2. Splitting it this way lets you reason separately about how often the situation arises and how often it actually hurts someone.

What is the difference between a hazard, a hazardous situation and harm?

A hazard is a potential source of harm, such as electrical energy. A hazardous situation is a circumstance in which people are exposed to it, such as a user touching an exposed conductor. Harm is the injury or damage that results, such as a burn.

In what order should risk controls be applied?

First inherently safe design and manufacture, then protective measures in the device or the process, then information for safety such as warnings, labeling and training. Information alone is the weakest control and is used for the risk that remains.

Is a hazard analysis the same as an FMEA?

No. A hazard analysis works from hazards and harms, including harm that can happen in normal use with nothing broken. An FMEA works from failure modes upward. Most risk files use both.

Other tools and templates