In several posts on this blog I have discussed the severe impact that the IVDR will have on the IVD industry selling in the EU (just click on IVDR in the tag cloud on the bottom right of the page).

My firm has organised multiple seminars and I have spoken about this on more conferences and occasions than I can remember.

Yet, at the Molecular Diagnostics Europe conference this last week it turned out that at this stage still really only the big IVD companies really know something about the IVDR. Small and mid-size companies and the investors in these companies mostly have no idea whatsoever how to approach the IVDR (if they have heard about it at all), if they know about its existence in the first place. Health institutions are generally not aware that the IVDR will have enormous consequences for their in-house produced diagnostics installed base and going forward.

Here is my presentation at that conference, which raised a lot of eyebrows in surprise:

The IVDR stands to be an even bigger bottleneck I think than the MDR, for several reasons:

• the regulatory paradigm shift is bigger than for the MDR – because of the reclassification of IVDs most IVDs will need a CE certificate issued by a notified body and they will need it by the date of application if they did not have a CE certificate under the IVDD (the vast majority of IVDs)
• While the IVDR is projected to lead to an increase in notified body capacity needed of 780% (says MedTech Europe) there certainly is no increase of 780% in notified body capacity available to the market. In fact, not a single notified body as been accredited for the IVDR at this moment and the pipeline of notified bodies under review shows a decrease in notified bodies available to the market (less than under the IVDD).

Needless to say, this will cause a really really disruptive bottleneck that may lead to disruptions in healthcare because tests relied on on a continuous basis may suddenly not be available any more for shorter or longer periods. These tests cannot quickly be replaced by in-house developed tests as the requirements for these tests have also increased a lot (see below). Or the other way around: in-house developed tests are suddenly not available anymore because the health institution has been sitting on its hands and did not do its article 5 (5) IVDR homework and cannot quickly replace the tests by CE marked ones. This will likely be a major issue in my country (the Netherlands) where in-house developed tests form a large part of the health institutions’ portfolio of tests.

Stalling implementation increases IVDR bottleneck too

This bottleneck is only increased by the continued absence of the vast majority of implementing guidance and legislation that is still necessary to make the IVDR and (at a much earlier time) the MDR work. IVD companies should be hard at work on their implementation and should have their first conformity assessment applications in the works to gain experience with it. Except that they can’t because there is no notified body available yet.

MedTech Europe is quite right to keep raising this with the European Commission in the strongest wording possible. COCIR has also been very vocal about the delay in harmonized standards. As I have blogged on occasions: it certainly is not good legislative and administrative practice to deliver an incomplete new regulatory system and then spend the transitional period foreseen for the addressees to implement the rest of it while the addressees remain incapable of knowing what the rules actually are, frustrating their useful implementation the rules for their products. It will not do to tell industry it has to do much better and then fail at providing the necessary rules for industry to do better by. Indeed, we are two years into the transitional periods under the MDR and IVDR with scandalously little to show for it on the part of the authorities.

This situation punishes companies that try to be compliant with the new rules quickly and it leads to calculated prisoners dilemma behaviour in other companies that hope to get away with not implementing unfinished and unclear rules. This is not the kind of orderly transition you would like to see in a regulated space where human lives depending on the products concerned, and the availability of the products concerned depends regulation being available.

GDPR

Implementation of the IVDR, and the possibly enormous amounts of data required for performance evaluation to the new standards, necessitate a precise and thorough understanding of the General Data Protection Regulation (GDPR) in order to be compliant with that regulation as well, as is explained in the presentation above.

The GDPR is woven into the IVDR, and has to be taken into account in dealing with performance data for the purpose of the performance data requirements under the IVDR. The GDPR has its own strict regime for data concerning health (e.g. patient related data about a patient sample that tested positive for syphilis) and genetic data (another category of data very relevant in molecular diagnostics). Compliance by design is therefore not only an IVDR thing, but implementation of the IVDR necessitates co-implementation of the GDPR (which requires privacy by design) if your company is processing plain personal data, personal data concerning health or genetic data. And with the very broad GDPR concept of personal data this is sooner than you think. Not a week passes in which I am not explaining to a (mostly US) company that taking off some identifiers does not (I repeat NOT) render personal data anonymous for EU GDPR purposes when the coding is reversible (and even if the key is held by a third party) so it remains personal data regulated under the GDPR.

Labs, healthcare institutions and home brews

One of the subjects not addressed in the presentation but in my experience a major subject of misunderstanding by healthcare institutions is the non-grandfathering of the existing home brew/lab developed test base currently in use in healthcare institutions and labs. The fact that these tests are currently being used does not automatically mean that nothing needs to happen under the IVDR. Since the IVD Directive currently explicitly excludes them from its scope, they have never been placed on the market for the purposes of EU IVD legislation, and are therefore not subject to the transition regime provided by the IVDR. The IVDR contains a regulatory regime for these products in article 5 (5) that applies as of the date of application of the regulation. Since these devices are subject to national regulation and are excluded from the IVD Directive (IVDD), they are not yet placed on the market or put into service under the IVDD. They become devices regulated under the IVDR as of 26 May 2022 and that means that article 5 (5) IVDR (which applies to devices manufactured and used in health institutions) is fully applicable without transitional regime, and also to the current installed base.

In order to keep using the installed base health institutions need meet the requirements in the IVDR (Annex I technical documentation and article 5 (5) requirements), which will be quite some work. This is a rather strict interpretation of the IVDR, but by the letter of the IVDR in my opinon the only right one, as the Blue Guide logic that a device a product that has been put into service under national law does not automatically count as already put into service for the purposes of the IVDR, as the IVDR did not apply yet and neither did the IVDD.

The only way out of this conundrum is for the member states to clarify that the installed base of in house produced IVDs put into service before the date of application counts as already legally put into service and therefore does not need to meet the article 5 (5) requirements by the date of application. The Commission cannot do this because the LDTs were always excluded from the IVDD. This would be a strange step to have to take  though because you would have expected these devices to have been included in the sell-off provision under article 110 (4) IVDR until 2025 or otherwise addressed in the transitional regime. That provision however only applies to devices placed on the market before the date of application and still in the supply chain, but not to those put into service before that date (because in-house developed tests were never placed on the market).

Recognising the in-house developed installed base as placed on the market already or put into service already would lead to the strange situation that we would be dealing with two groups of in-house developed tests for possibly years and years: the formerly unregulated ones that remain subject to national law and the ones regulated under the IVDR, which would be subject to wildly diverging rules. In addition, every new device put into service of the same type of in-house developed test after the date of application (26 May 2022) would need to meet the article 5 (5) IVDR requirements anyhow (which more or less amount to meeting the IVDR requirements for a self-certified IVD).

In addition and importantly, the health institution needs to prove as of that date that its in-house tests are better than equivalent CE marked tests on the market. This requirement applies throughout the life cycle of the in-house test (like the other article 5 (5) IVDr requirements for in-house developed tests), so the health institution must monitor equivalent CE marked tests in the market on a continuous basis and switch when a better commercial CE marked test becomes available.

At best the transitional regime is – in my view – currently very unclear for in-house developed tests. Better get it clarified with your local competent authority. This competent authority will (or should) be able to also let you know whether it plans to restrict the manufacture and use of any specific in-house developed test as article 5 (5) IVDR allows.

So

Companies in IVDs: do not postpone IVDR transition and do not ignore GDPR. Two years of the transitional period for the IVDR have already passed, and it is 26 May 2022 before you know it, especially if you are on the bottom of the pile at an IVDR accredited notified body or if you need to get your performance data in shape to meet the new requirements. The GDPR is already fully applicable since 25 May 2018, so authorities have no patience whatsoever with companies that start to understand this only now.

Labs in health institutions: the IVDR also applies to you. Clarify the regulatory status of your existing installed base of LDTs (and start working on your article 5 (5) IVDR dossiers and QMS) and prepare to have to continuously justify the use of an in-house developed test against what is available as equivalent CE marked tests on the market, which (I agree) may make investing in LDT development more problematic. Yet, the IVDR is set in stone since more than two years and you won’t change it any more at this stage.

Conferences!

If you are a US company in IVDs or medical devices and w/should like to know more about the MDR and the IVDR, consider visiting the RMD2019 USA conference in New Brunswick NJ on 13 and 14 June. This conference deals both with the MDR and the IVDR and is directed specifically to US companies – and I will be speaking there so you can ask me and the other experts any questions that you have.

Alternatively, join me at the Q1 3rd Annual EU MDR Implementation Conference on 16-17 July 2019 in Alexandria, VA, which is about the MDR only. You can meet me and other experts there in person to have your questions answered.