Medical Device Standards, Regulation and Quality Systems: ISO 13485, ISO 14971, IEC 60601 and HK MDACS
This domain tests whether you can place a device on the market and keep it there legally, and how standards convert into design controls. Hong Kong content is specific: the Medical Device Division (MDD) of the Department of Health operates the Medical Device Administrative Control System (MDACS), a voluntary listing system rather than a statutory pre-market approval regime.
Quality management and design control
- ISO 13485 is a QMS standard for the device lifecycle: management responsibility, design and development control, purchasing, production, traceability, CAPA, complaints and post-market surveillance. It is not a product performance standard.
- Design controls require documented inputs, outputs, verification (does it meet spec?) and validation (does it meet user needs?), plus design transfer and change control.
- IEC 62304 governs medical device software lifecycle; IEC 62366 covers usability engineering; ISO 10993 covers biological evaluation.
Risk management: ISO 14971
- The chain is hazard → foreseeable sequence of events → hazardous situation → harm, with severity and probability of harm scored to yield risk.
- Controls follow a hierarchy: inherently safe design, then protective measures, then information for safety. Residual risk is evaluated against a documented acceptability policy and disclosed in labelling.
Electrical and system standards
- IEC 60601-1 is the general safety standard, with collateral and particular standards (60601-1-2 EMC, 60601-1-6 usability, 60601-1-11 home healthcare). IEC 80001-1 addresses risk management when devices join an IT network.
Hong Kong specifics
- MDACS classifies devices into Class I to IV using rules aligned with the IMDRF/GHTF framework: invasiveness, duration of use, and whether the device contacts the heart, central circulatory or central nervous system.
- Listing is voluntary and covers manufacturers, importers, distributors and traders; the MDD also administers the Medical Device Incident Reporting System and regulates irradiating apparatus under separate legislation.
- A CE or FDA clearance supports but does not substitute for MDACS listing requirements.
Worked example
A long-term surgically invasive infusion catheter sits in contact with the heart. Rule path: surgically invasive, long-term (over 30 days), contact with heart and central circulatory system, so Class IV, the highest risk class, with full QMS and technical documentation expected.
Traps that cost marks
- Describing ISO 13485 as a product safety standard.
- Confusing hazard with harm, or skipping the sequence of events.
- Assuming MDACS is mandatory statutory registration.
- Assuming verification equals validation.