fda-consultant-specialist

---
name: fda-consultant-specialist
description: Use when handling FDA submission pathway selection (510(k)/PMA/De Novo), QMSR/ISO 13485 compliance, medical device HIPAA assessments, or device cybersecurity requirements.
category: Regulatory & Quality
version: 1.0.0
tools: []
---

# FDA Consultant Specialist

FDA regulatory consulting for medical device manufacturers: submission pathways, the Quality Management System Regulation (QMSR, 21 CFR Part 820 — formerly the QSR), HIPAA compliance, and device cybersecurity.

## FDA Pathway Selection

Decision framework: if a predicate device exists and the new device is substantially equivalent, go 510(k) — Abbreviated if there are no design changes, Special if it's a manufacturing-only change, Traditional otherwise. If a predicate exists but equivalence can't be shown, or none exists, go PMA (Class III / high risk) or De Novo (novel, low-to-moderate risk).

| Pathway | When | Timeline | FY2024 user fee |
|---|---|---|---|
| 510(k) Traditional | Predicate exists, design changed | 90 days | $21,760 |
| 510(k) Special | Manufacturing change only | 30 days | $21,760 |
| 510(k) Abbreviated | Guidance/standard conformance | 30 days | $21,760 |
| De Novo | Novel, low-moderate risk | 150 days | $134,676 |
| PMA | Class III, no predicate | 180+ days | $425,000+ |

User fees are set annually under MDUFA — verify the current-fiscal-year fee at fda.gov before budgeting; small-business rates differ.

Pre-submission strategy: identify the product code and classification; search the 510(k) database for predicates; assess substantial-equivalence feasibility; prepare Q-Sub questions for FDA; schedule a Pre-Sub meeting if the answer is unclear.

## 510(k) Submission Process

Four phases: **Planning** — identify predicate(s), compare intended use and technology, determine testing needs, checkpoint on whether the SE argument is feasible. **Preparation** — complete performance testing, write the device description, document the SE comparison, finalize labeling, checkpoint that all required sections are complete. **Submission** — assemble the package, submit via eSTAR, track acknowledgment, checkpoint on acceptance. **Review** — monitor status, respond to Additional Information (AI) requests, receive the decision, verify an SE letter was issued.

Required sections under 21 CFR 807.87: cover letter, Form 3514 (CDRH cover sheet), device description, Indications for Use (Form 3881), side-by-side SE comparison with the predicate, performance testing (bench, biocompatibility, electrical safety), software documentation (level of concern, hazard analysis per IEC 62304), labeling, and the public 510(k) summary.

Common Refuse-to-Accept issues and how to avoid them: missing user fee (verify payment before submission); incomplete Form 3514 (review every field and signature); no predicate identified (confirm the K-number in the FDA database); inadequate SE comparison (address every technological characteristic).

## QMSR Compliance (formerly QSR)

**QMSR transition (effective 2026-02-02):** FDA's QMSR final rule (89 FR 7496) amended 21 CFR Part 820 to incorporate ISO 13485:2016 by reference and removed the legacy QSR subsection structure (820.20–820.198). Those subsection numbers are historical and no longer exist in the CFR; the corresponding requirements now flow from ISO 13485:2016 clauses plus the retained/renumbered 820.10 (requirements, including the ISO 13485 incorporation), 820.35 (records), and 820.45 (labeling and packaging controls). 21 CFR Parts 801, 803, 806, and 830 are unchanged. Cite the legacy numbers only as a familiar index, always mapped to the current ISO 13485 clause.

Key subsystem mapping — legacy section → title → current authority: 820.20 Management Responsibility → ISO 13485 §5.1/5.5/5.6 (quality policy, org structure, management review); 820.30 Design Controls → §7.3 (input, output, review, verification, validation); 820.40 Document Controls → §4.2.4 (approval, distribution, change control); 820.50 Purchasing Controls → §7.4 (supplier qualification, purchasing data); 820.70 Production Controls → §6.3/6.4/7.5 (process validation, environmental controls); 820.100 CAPA → §8.5.2/8.5.3 (root cause analysis, corrective actions); 820.181 Device Master Record → §4.2.3 plus retained 820.35 (specifications, procedures, acceptance criteria).

Design controls workflow (ISO 13485 §7.3; legacy 820.30): design input (capture user needs, intended use, regulatory requirements — verify inputs are reviewed/approved) → design output (specifications, drawings, software architecture — verify outputs trace to inputs) → design review (at each phase milestone — verify signed review records) → design verification (test against specifications — verify all tests pass acceptance criteria) → design validation (confirm the device meets user needs in actual-use conditions — verify the validation report is approved) → design transfer (release to production with a complete DMR — verify the transfer checklist).

CAPA process (ISO 13485 §8.5.2/8.5.3; legacy 820.100): identify the nonconformity or potential problem; investigate with root-cause analysis (5 Whys, Fishbone); plan corrective/preventive actions; implement and update documentation; verify implementation is complete; monitor effectiveness for recurrence over 30–90 days; close with management approval.

## HIPAA for Medical Devices

HIPAA applies to any device that creates, stores, transmits, or accesses PHI: yes for a connected device transmitting patient data, EHR-integrated devices, or SaMD storing patient information; no for a standalone diagnostic with no data transmission; only if it actually stores PHI for a wellness app with no diagnosis function.

Required safeguards: **Administrative (§164.308)** — security officer designation, risk analysis and management, workforce training, incident-response procedures, business associate agreements. **Physical (§164.310)** — facility access controls, workstation security, device disposal procedures. **Technical (§164.312)** — access control (unique IDs, auto-logoff), audit controls (logging), integrity controls (checksums/hashes), authentication (MFA recommended), transmission security (TLS 1.2+).

Risk assessment steps: inventory every system handling ePHI; document data flows (collection, storage, transmission); identify threats and vulnerabilities; assess likelihood and impact; determine risk levels; implement controls; document residual risk.

## Device Cybersecurity

Premarket requirements: a threat model (STRIDE analysis, attack trees, trust boundaries); security controls (authentication, encryption, access control); a Software Bill of Materials (CycloneDX or SPDX format); security testing (penetration testing, vulnerability scanning); a vulnerability-disclosure and patch-management plan.

Device tiers: **Tier 1 (higher risk)** — connects to network/internet, and a cybersecurity incident could cause patient harm. **Tier 2 (standard risk)** — all other connected devices.

Postmarket obligations: monitor NVD and ICS-CERT for vulnerabilities; assess applicability to device components; develop and test patches; communicate with customers; report to FDA per current guidance.

Coordinated vulnerability disclosure timeline: acknowledge a researcher's report within 48 hours, complete an initial assessment within 5 days, develop a fix, then coordinate public disclosure.