How a fake hip showed up failings in European device regulation

Shopping around

By law companies can apply to only one notified body at a time. But this does not stop manufacturers approaching several of them before deciding which one is most likely to approve their device. As Michal Bauer from Szutest, a notified body based in Brno in the Czech Republic, told us when we met him to see if it would be prepared to assess the implant: “You should ask different notified bodies who is the best for you.” In a later statement, Szutest said Bauer was expressing his opinion and his comments should not be “perceived as the standpoint” of the company.

Some see this “shopping around” as evidence that manufacturers are looking for the notified body that will ask the least demanding questions and provide the easiest route to approval. If so, it also suggests that standards and processes vary widely, as our investigation revealed.

We created a glossy brochure of the Changi TMH and took it to 14 notified bodies in four European Union countries and Turkey, as well as visiting a branch of a Czech notified body in South Korea. We went undercover as Changi representatives to collect evidence. We only went to notified bodies that were able to certify high risk devices and where there were concerns over their practice.

After the initial meetings, we had to submit an application to obtain a quote for CE certification. This required specific details of our Changi hip. We spelt out that it was made from cobalt-chrome and gave the measurements of the implant to show that it was a large diameter total hip replacement (box).

The approval process for a coveted CE certificate to allow the device to be sold in Europe comes in two stages. The first is the submission of a “technical file,” which sets out the purpose and design of the device and the manufacturing process. A second stage, the “audit,” involves a factory visit to see how the design is produced.

Six bodies returned firm quotations, seven are still reviewing them, and none said at the time they wouldn’t be prepared to assess it at all. Costs for processing all the documents to obtain a CE certificate varied from €2750 (£2240; $3590) to €50 000. Some charge 50% upfront and collect the rest on completion. They also charge additional fees for the audit. With around 500 000 medical devices on the market, there are large sums of money to be made.

We chose to submit our full application to EVPU, a notified body based in Nová Dubnica, a small town in Slovakia. It said it would be prepared to “cross the line” and give advice when assessing our submission and that it was “very, very fast.”

Once a contract had been signed and payment made, EVPU emailed its comments.  A document outlining the content of the file noted that some sections of the dossier were missing—largely relating to the manufacturing process and risk assessments.  However, the pages detailing the “product” features “principle features of the device” were described as “OK.”  When we contacted the company to confirm that it was happy with the implant described in the dossier, company employee Lubica Skrovanova said that it was. 

Nonetheless, she went on to say that documents relating to the manufacturing process would be needed before a certificate was issued. A factory inspection would also be necessary before CE approval. These were not related to the design specifications of the product. EVPU refused to respond to any allegations when we told it of the secret shopper exercise.

From the first few contacts it quickly became clear that the notified bodies compete for business based on price, speed, and promised rates of successful certification.

One of the Turkish notified bodies, Alberk, is housed in an office above a garage on the back streets of Istanbul. It became a notified body earlier this year and can approve all implantable devices as well as other medical products. So far it has approved incubators and syringes. One of its employees, Kadir Tarakci, asked us: “What is it you’re looking for, the best or the fastest?” adding: “Normally both is not impossible.”

In a subsequent statement, a spokesperson for Alberk said that Tarakci was no longer with the agency. It also stated that its technical experts had not received a “formal application of client” and it was only after this that a final decision would have been taken whether to approve the application. The spokesman emphasised that Alberk operated in accordance with national and international laws.

Hip prostheses should prompt caution. As a representative of a notified body in Turkey, said when approached by a Changi representative: “There was a discussion on that product, on that specific product at the notified body meetings,” adding: “Those kind of implants are very risky, you know.”

But of the 14 notified bodies we visited, only four raised concerns about the implant being a hip replacement. Others showed little concern. Zavisek from ITC said, for example, that he saw no “obstacles” for these implants. He added they “should not be a problem to understand” as there are “quite concrete” standards for these products. When we later put this to ITC, it did not respond directly to any points raised, but said it complied “in full accordance with the law.”

Varying standards

Despite the claim of concrete standards and guidelines on what is expected from manufacturers seeking approval for their devices, we found that standards vary widely between notified bodies. This was acknowledged by the staff we spoke to. Teoman Alpay who was at the time of speaking an assessor for Kalitest, a notified body in Turkey, told us: “The certification approach from one notified body to another differs.” Kalitest has subsequently told us that Alpay is no longer working for Kalitest and said that it does not accept any liability for any comments made by him in our meeting.

This investigation found variation in the type of premarket evidence asked for, post-marketing surveillance strategies, and how factories are checked.

Bauer, of Szutest, suggests that this variability is open to manipulation. Some manufacturers, he says, may have a poor device dossier and their application gets refused. “So they say okay, you won’t do it for us, and they go to another one. And that’s wrong because . . . they are not correcting their system, they are only looking for someone who will do it,” he says.

Our investigation suggests that few devices fail to obtain approval. We spoke to the Hungarian offices of two of the large “branded” notified bodies, SGS (which also has an office in the UK) and Germany based TUV. They told us their clients rarely, if ever, fail.

When asked why clients may fail, Anna Szabo, from SGS in Budapest, said: “I don’t know. They don’t really fail.”

SGS said in a statement that it is confident that had a full dossier been submitted, the experts conducting the review process would have “highlighted the dangerous nature of the products described and that SGS would have declined to issue proposal.” It added that its staff are aware of the safety concerns about metal-on-metal implants and it has discussed the issue with its orthopaedic specialists on several occassions.

Given the high likelihood of success, notified bodies compete mainly on speed and price. Bence Thurnay from TUV Hungary told us it was more a question of the length of time the company takes to clear the regulatory hurdles than failure to access the market—even though TUV said the hip prosthesis was the “most risk intent, problematic product.”

“I would say [the manufacturers] always obtain the certification. [The] question is time.” When later asked why Changi should choose TUV—the most expensive of the notified bodies we visited—to certify its implant, he said it was because it could give “each product a solution for certification, somehow.” This was one of TUV’s “unique” selling points, he added.

In a later statement, a spokesperson from TUV stated that the ASR XL was never mentioned in prelimary discussions and “our colleagues did not promise that clients always obtain certification.” It also stated a quote for certification was never provided. But they did not respond to our questions about the main issue being the length of time.

Regulators or consultants?

Like any business, it is understandable that the notified bodies should want their clients to succeed in getting their devices onto the market. But while notified bodies are not allowed to act as consultants, it’s a grey area how much help they can give.

EVPU—the notified body that assessed the Changi total metal hip—said that it couldn’t give us “exact advice.” But said: “Sometime[s], we just cross the line and say just do this and it will be okay.”

However, this investigation has found evidence of companies who are prepared to exploit loopholes in the European legislation banning direct consultation.

Czech notified body ITC has an office in South Korea that performs its regulatory duties, which is permitted under EU legislation. Based in an office block in Seoul, three legally separate companies come together under one umbrella organisation to offer manufacturers a “one stop service” that they say can help companies to “increase profit.” One of the companies, ITC Cert, performs notified body duties across Asia and has certified over 1000 products for access to the European market. The other two, GIC Technology and GIC Medical, offer consultation services for manufacturers hoping to gain market access to the European Union, US, South Korea, and other parts of Asia. They also offer help with marketing and product distribution and are prepared to act as a non-European company’s representative within the EU. In what could be described as the ultimate revolving door, employees of ITC Cert also act as consultants to the manufacturers.

When we asked how much it would cost to certify our hip, we were quoted an all inclusive price—$17 000 (£10 600; €13 000) for the CE certificate plus $12 000 for consultancy. This came with a 100% success rate—anyone who failed to get a certificate dropped out of the certifying process themselves, we were told. Dong-In Shin, the general manager, also said that we could pay an extra 20% to speed the process up.

The costs in Seoul are nearly four times those quoted by ITC in the Czech Republic. Nevertheless, we were told to use the South Korean branch.

Employees of ITC Cert see Europe as being kinder to manufacturers than the FDA and other centralised government regulators. Kenneth Lee, a company employee, told us that notified bodies get money from the client and worry about the project—but the FDA uses government officers and they “don’t care.”

In a later statement, a spokesperson for ITC Cert said the discussion with Changi had been a private talk and that it involved “wrong and exaggerated explanation for easier understanding.”.

Our investigation also found further levels of opacity and devolution of accountability in the European system. Manufacturers can conceal the country that the product was made in either through marketing agreements with another company or by setting up a European office. As Peter Luley, an employee of EVPU, told us: “You can make some company in England, and then sell this, product like [it is] produced in England,” adding: “It works and it is normally done by many companies.”

Anna Szabo from SGS Hungary went further. She advised us to create a distribution hub in Europe. “What we suggest is that you make a certification so that the label on the product itself would be from a …European country and therefore the Chinese producer will not be put on the packaging,” she said, adding: “This is better from a marketing point of view.”

As SGS later pointed out this is acceptable under EU laws.

ITC is not the only notified body to have branches in the Far East. Keen to attract business from the burgeoning Asian medical device market—which industry pundits Espicom Business Intelligence estimate to be worth $71bn by 20155—other notified bodies have partner organisations in Asia.

In one such example, the Asian “partner” of Slovakian notified body 3eC is BS Certification Services in Hong Kong. Although technically not a notified body, BS Certification Services advises 3eC whether to grant a CE certificate.

Company owner, Vidyyut Kr Bera told us that up until now he has “a 100% success rate.” Although he stipulated that neither BS Certification Services nor 3eC will enter into any kind of consultation, he said he is “in a position to support the client in many ways.”

Because he reviews the entire set of files before they go to the notified body for final certification, he makes sure everything is in order. “There will be high chances that the file will pass in one attempt rather than bringing the risk of failing audit or failing technical file approval,” he said.

Bera told us that payment was to be made directly to BS Certification Services in Asia, and he would then organise payment with 3eC, which is the actual certifying body. When we asked for more information about what studies Changi would have to do, Bera said that he could formally help out only after we had made an application and paid him. “As a part of our contractual obligation I can answer all these questions then.”

3eC did not respond.

Although not commenting specifically on any one notified body, Turkish assessor Alpay told us that the reason for the difference in approaches was simple. “This is a money making business. If you want to be a little bit further [better] than all your competitors, you should just decrease your requirements, and in this business, decreasing the requirements means not fulfilling the requirements of MDD [Medical Devices Directive].”

In a later statement, Alpay said that it’s true that some notified bodies don’t comply: “All organisations have to earn money. Either it’s non-profit or it’s profit business,” he said adding: “Notified bodies work on the basis of making money to pay the salaries and the operating cost.”

Guidelines open to interpretation

Hip prostheses, along with breast implants and cardiac defibrillators, are classed as the most invasive—class III—devices. So in theory they should be subject to the most rigorous pre-market appraisal.

However, we found wide variation in what type and extent of pre-market evidence was required, and that this was left to the discretion of the individual notified bodies.

According to Alpay, some notified bodies are prepared to omit the biocompatibility tests, which assess how safe the materials are once inserted into the body. “It is the most pricey and the most time consuming test,” he said.

We asked the notified bodies what kind of evidence we would have to submit. Even though guidelines say that class III implants should be subject to a premarket clinical study, and many notified bodies recognise they are “risky” devices, only a small number told us that they would insist on a clinical investigation. Others said that a literature review of the evidence from a similar prosthesis might suffice.

For example, Lubica Skrovanova, from EVPU, told us: “They can even prepare the clinical evaluation report according to [a] literature review. Take some journals, make research and prepare some reports. Make comparative study, read the product used from article, and make comparative study.”

Even when notified bodies suggested obtaining clinical study data, they could not give any specifics about what form this should take. Some gave vague details in terms of the numbers of participants a study would need to include or what might be needed in terms of clinical tests. This is despite guidance from the MHRA and others saying that all patients with a large diameter metal-on-metal total hip replacement should have an annual blood test to check metal ions and, in some instances, ultrasound or magnetic resonance imaging. As one of the employees of the South Korean organisation told us, there are no exact guidelines about what companies have to do in their clinical studies. “It depend[s] on the notified body,” he said.

The Association of British Healthcare Industries has criticised the variable requirements. It stated that the European Commission—which is responsible for the relevant legislation—should be more prescriptive about when manufacturers need to undertake clinical investigations, or to what extent they are able to rely on existing scientific literature claiming equivalence with an existing device. It also said in a submission to a UK parliamentary select committee that some notified bodies are not expert enough in the assessment of clinical data or the likely safety risks in clinical use.4

We found that it wasn’t always clear what expertise notified bodies had in assessing data or how suitable experts were selected. Some agencies used a chemical engineer and a doctor. Others used experts in orthopaedic products and worked closely with the university.

Indeed, EVPU—the notified body we submitted our dossier to—did not pick up on the deliberate major flaws in the design of our hip prosthesis before passing the principal features of the device as “OK.” Nor did they spot that Changi said its product was “substantially equivalent” to three pre-existing products, two of which have been recalled and two subject to legal action in the United States.

Post-marketing surveillance

EVPU also accepted our post-marketing strategy, which was simply to insert contact details of a company employee in case of any problems. But this flies in the face of current thinking. Back in May 2011, the FDA took the unprecedented step of requiring all manufacturers of metal-on-metal hips to study the levels of cobalt and chromium in patients for at least eight years after implantation. The reason for this, a spokesperson for the FDA told Bloomberg News, was that “there is not enough scientific data to specify the concentration of metal ions in a patient’s body necessary to produce adverse systemic effects.”6

Advocates for the European system have said that emphasis should be on post-marketing surveillance to assess safety and effectiveness—rather than on premarket studies. But even for the post-marketing surveillance, the notified bodies are largely left to their own devices. The onus is on them to check the results of the post-marketing surveillance strategies at annual surveillance audits—another source of revenue for the notified body beyond the initial certification fees.

Peter Rose, managing director at High Edge Consulting, which helps manufacturers compile their submissions to notified bodies, says: “One of the main issues I see with notified bodies operating as commercial organisations is the inherent conflict of interest in a regulator being paid directly by the company whom they are regulating. Certainly I have assisted companies to get back to being compliant following threats to suspend approval by their notified body, where in some cases my view is the non-compliance warranted an immediate suspension. I feel that some regulators are reluctant to forge a reputation for being tough.”

As Peter McCulloch puts it in a linked editorial, patient safety and not trade should take centre stage of the system to regulate medical devices.7