The Ultimate Guide to the MDR at Point-of-Care

Why this guide exists

A lot has been written about the MDR in hospitals, often in long and complicated pieces. That is understandable: the MDR is a dense regulation, and it was not written with hospital labs in mind. But the effect is that a fairly clear set of requirements has been made to look much harder than it is.

Part of that complexity comes from sources we tend to trust. Peer-reviewed journals publish on point-of-care manufacturing, and some of those papers include MDR interpretations. Peer review is a good check on the science, but it is not always a check on the legal reading, and not every paper has been reviewed by someone with deep MDR knowledge. A statement in a journal is easily taken as settled, but publication is no guarantee that the MDR reading is correct. Some of these interpretations are simply wrong, and they sound plausible and get cited and repeated partly because they were published.

Consultants can add to the complexity too, for an understandable reason. Nobody wants to carry the responsibility if something turns out to be missing afterwards, so the safe advice is to do everything, just in case. For a hospital lab, that means far more work than the law asks for, and far more to maintain.

In the end, it is about the patient. Medical devices must be safe and effective, and the MDR exists to make sure of that.

I have worked on personalized devices my whole career, and I firmly believe that every patient deserves a device made for them. Fortunately, we see that happening: more and more surgeons recognise the value of personalized devices. But it has to be done well and safely.

Together with a law firm, we worked through the MDR requirements for custom-made devices and point-of-care manufacturing. If anyone knows how to read a law, it is lawyers. For a lawyer, the law is much more black and white: the work is not interpretation but translation, turning what the text says into something you can apply in practice. The starting point of this guide is therefore practical: we looked purely at what the law requires, so that you do not do too much, but certainly not too little.

Step 1: Look at the device you make

Everything depends on the kind of devices you make, because the MDR sets different requirements for different kinds of devices.

If you make devices individually for one specific patient, to a written prescription from an authorised professional who specifies the design characteristics, you are making custom-made devices (Article 2(3) MDR). A defined set of requirements applies to those.

Hospitals also make devices for their own patient population or their surgeons, for example a surgical tool that a surgeon likes to use in certain procedures and that is not commercially available. These are in-house devices (Article 5(5) MDR): they are made and used within the same health institution, and a different set of requirements applies to them.

Where the work happens does not decide anything. Making custom-made devices inside the hospital does not change the route. What counts is the type of device, not the location.

Step 2: One route per device

Each type of product leads to its own route: the custom-made route or the Article 5(5) in-house route. The route is decided per device, not per hospital. A hospital can make both custom-made devices and in-house devices, but each device follows one route, and you cannot combine elements of both for the same device. Many 3D labs mainly make custom-made devices. Even if a lab also makes a few in-house devices, that does not mean its custom-made devices may follow the in-house route. In practice, people mix and match all the time, taking a requirement from one route and a convenient exemption from the other, and that does not hold up.

Two pages on this site help you choose:

• Hospital 3D printing: Article 5(5) vs custom-made explains the differences between the routes.
• The MDR roadmap for hospital-based 3D printing is a flowchart that shows which route applies to your device.

“Patient-matched” is not defined in the MDR (yet)

You will also run into the term patient-matched. It is a real category in Australian law, but the MDR itself does not define it. Under the MDR, a device is custom-made, or it is not. If someone tells you their lab makes patient-matched devices and therefore has different obligations, ask which MDR article that comes from.

This may change one day. If patient-matched devices are ever added to the legislation, the requirements will change with it, and that is exactly the kind of development you want to be told about instead of discovering it yourself.

A quality system is required, ISO 13485 certification is not

Both routes ask you to set up a quality management system, and people usually reach for ISO 13485. It is an excellent standard for medical devices. For many small manufacturers and hospital labs, though, implementing and especially maintaining it is a heavy undertaking, and in most cases it is not necessary.

A QMS on its own is also not enough. The MDR sets its own requirements, and a quality system is only one of them. Having a QMS does not mean you comply with the MDR. ISO 13485 itself says as much: one of its first requirements is that you meet the applicable legal requirements.

Certification to ISO 13485 is not required for point-of-care manufacturers. For more detail, see Is ISO 13485 necessary for hospital 3D labs?

It can still become desirable. When your lab grows, or when you start supplying other hospitals, you start to look more like a manufacturer, and ISO 13485 is then a sensible next step.

Start with the law, grow into ISO 13485

The approach that works is to begin with what the law requires, because those are the requirements you must meet, and expand from there only when your situation calls for it.

To make that practical, we built an online compliance management platform together with the law firm. It contains all the MDR requirements for custom-made devices, so you do neither too much nor too little.

Think of it as a cookbook for compliance, with all the recipes in it: fully written-out policies, but also the actions you have to carry out. More information is on the MDR Management System page.

• You can use it as a stand-alone QMS, or inside a quality system you already have.
• It is kept up to date. The lawyers follow changes in the legislation for you, and if something changes, such as patient-matched devices ever being added to the law, the platform is adapted and you are informed.
• You can send MDR-specific questions to the lawyers through the platform, and they answer briefly and to the point.
• It can be extended, as an optional add-on, to cover other legislation you have to comply with, such as the GDPR. That way all your legal requirements sit in one place and you avoid doing double work.

In effect, it is like having your own lawyer in your team, without the high hourly rates.

That matters if an inspection ever comes and you have to account for your choices. Would you rather rely on a law firm’s reading of the law, a consultant’s advice, or published interpretations?

If your lab grows and you want ISO 13485 certification, you build on that foundation. A second platform extends the same system into a full ISO 13485 quality system, so the work you did first is not wasted.

The order is the point: first the legal requirements, then ISO 13485 when it makes sense.

That is also why I do this work. I want every patient who needs a personalized device to get one, made well and safely. My mission is to assist with the quality system and the legal side, with clear information and practical, user-friendly help, so that you can focus on what matters: good, safe and effective patient-specific products.

The MDR is complex enough already. Let’s not make it more complicated than it needs to be.

Want to see how it works in practice? Have a look at the MDR Management System page, or get in touch.