Let's Talk Risk! with Dr. Naveen Agarwal

Patient preference is no longer a soft qualitative afterthought.What if a device carries significant risks, but patients are willing to accept them for a meaningful clinical benefit?This Deep Dive examines how FDA’s evolving approach to Patient Preference Information (PPI) can turn those tradeoffs into quantitative evidence for regulatory benefit-risk decisions.Key highlights covered in the audio:* PPI is not the same as a patient-reported outcome. PROs describe what patients experience. PPI asks what risks patients are willing to accept to obtain a particular benefit.* Risk tolerance can be quantified. Methods such as discrete choice experiments and threshold techniques can establish measures such as Maximum Acceptable Risk (MAR) and help define the level of benefit patients consider meaningful.* Study design matters enormously. Patient comprehension, health numeracy, neutral presentation of risk, attribute selection, statistical analysis plans, and appropriate visual communication can determine whether preference data are credible.* FDA engagement needs to happen early. The discussion highlights the importance of using the Q-Submission process to align on attributes, ranges, methodology, and statistical analysis before the study is conducted.* PPI can extend beyond premarket approval. Preference information may inform labeling, shared decision-making, post-market benefit-risk assessments, and other decisions across the total product lifecycle.Keywords: Patient Preference Information, FDA Guidance, Benefit-Risk Assessment, Risk Tolerance, Medical Devices, Discrete Choice Experiment, Maximum Acceptable Risk, Q-Submission, Total Product Lifecycle, Risk Management🎧 Listen to the Deep Dive for a closer look at how patient preference is becoming part of the quantitative language of medical-device risk management.Thanks for reading Let's Talk Risk!. If you liked this post, share with others.Note:The audio summary was prepared using Google NotebookLM, an AI-enabled research tool. Here are a few key resources used for this analysis:* FDA (2026, March 30). Incorporating Voluntary Patient Preference Information over the Total Product Life Cycle, FDA Guidance Document, U.S. Food and Drug AdministrationPure Global (2026, April 8). FDA 2026 Guidance on Voluntary Patient Preference Information, Strategic Industry Report, Pure Global This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit naveenagarwalphd.substack.com/subscribe

Summary“I don't think it's as easy to outsource risk as it used to be. Risk is pervasive now.”In this episode of the Let’s Talk Risk! conversation, host Naveen Agarwal speaks with Allyson Mullen, Director at Hyman, Phelps & McNamara, P.C., about what FDA’s early enforcement activity under the Quality Management System Regulation (QMSR) may tell medical device manufacturers about the agency’s evolving expectations.Using the first warning letter discussed in the episode as a starting point, Allyson examines how FDA is citing risk management under ISO 13485 Clause 7.1 and, increasingly, looking at the broader requirement to apply risk-based thinking across QMS processes under Clause 4.1.2.The conversation explores why companies already certified to ISO 13485 should not assume they are fully prepared for an FDA inspection, how FDA inspections may differ from notified-body audits, and why post-market information must feed back into risk management.Naveen and Allyson also discuss the legal and contractual implications of the transition, particularly the importance of reviewing quality agreements and clearly defining responsibilities when activities are outsourced.Finally, Allyson offers practical perspective on responding to FDA 483 observations and warning letters during a period when both regulators and industry are adapting to a new inspection framework.Listen to the full 25-minute podcast or jump to a section of interest listed below. Chapters01:17 – Introduction and Allyson Mullen’s Regulatory and Legal Background02:17 – FDA’s First QMSR Warning Letter and Its Risk Management Findings03:46 – How FDA’s Language Around Risk Is Changing Under QMSR05:10 – Risk Beyond Design Control: ISO 13485 Clause 4.1.207:42 – When FDA May Look Beyond Product Realization12:48 – Why ISO 13485 Certification May Not Be Enough14:59 – Legal Risks and the Importance of Updating Quality Agreements17:19 – What to Do When FDA May Have Gotten an Observation Wrong21:21 – Warning Letters and the Challenges of the QMSR Transition23:40 – Allyson’s Journey from Regulatory Affairs to Law26:10 – Key Takeaways: Risk, Outsourcing, and Quality AgreementsIf you enjoyed this podcast, consider subscribing to the Let’s Talk Risk! newsletter.Suggested links:FDA Law Blog: FDA’s First QMSR Warning Letters.LTR Deep Dive: First FDA Warning Letter Under QMSR.LTR: LTR Risk Coach - AI-Powered Decision Support Tool.Key Takeaways* Risk is becoming more pervasive under QMSR. FDA now has clearer regulatory pathways for examining risk beyond traditional design-control activities.* Clause 7.1 may only be the beginning. Product realization provides an obvious entry point, while ISO 13485 Clause 4.1.2 allows FDA to examine whether risk-based thinking is embedded throughout the QMS.* Post-market feedback must close the loop. Complaints, adverse events, recalls, and other post-market information need a defined pathway back into risk management.* ISO 13485 certification does not guarantee an easy FDA inspection. FDA may challenge the methods and reasoning behind risk-based decisions more deeply than organizations have experienced in traditional notified-body audits.* Risk cannot simply be outsourced. Manufacturers remain responsible for understanding and managing risk even when product-realization activities are performed by suppliers or contract manufacturers.* Review quality agreements now. Older agreements may assign responsibilities using the former QSR structure and may not adequately address obligations under ISO 13485 and QMSR.* A 483 is not necessarily the final word. Companies should carefully evaluate FDA observations, provide missing context, correct the record where appropriate, and respond with a complete factual narrative.* The transition creates challenges for both FDA and industry. Early warning letters and inspection observations will be important signals for understanding how FDA applies QMSR in practice.KeywordsQMSR, FDA, ISO 13485, Risk Management, Quality Systems, FDA Inspections, Warning Letters, Quality Agreements, Post-Market Surveillance, Medical DevicesAbout Allyson MullenAllyson Mullen is a Director at Hyman, Phelps & McNamara, P.C., where her work brings together deep experience in FDA regulatory matters and law.Before joining the firm, she served as a Corporate Attorney and Principal Regulatory Affairs Specialist at Waters Corporation, a Senior Regulatory Affairs Specialist at Boston Scientific, and a Regulatory Affairs Associate at DePuy Mitek.She earned her J.D. from New England Law | Boston and began her career in regulatory affairs before transitioning into legal practice—giving her experience on both sides of regulatory and legal decision-making. Let’s Talk Risk! with Dr. Naveen Agarwal is a bi-weekly live audio event on LinkedIn, where we talk about risk management related topics in a casual, informal way. Join us at 11:00 am EST every other Friday on LinkedIn.DisclaimerInformation and insights presented in this podcast are for educational purposes only, and not as legal advice. Views expressed by all speakers are their own and do not reflect those of their respective organizations.Parts of this article were created using AI-generated content, which was subsequently reviewed, edited, and fact-checked by the author to ensure accuracy and alignment with our standards. This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit naveenagarwalphd.substack.com/subscribe

Summary“When done well, HHE evolves from a procedural requirement into a strategic tool that reflects how your organization makes risk-based decisions.”In this episode of the Let’s Talk Risk! conversation, host Naveen Agarwal speaks with Kerry Flecknoe, Senior Manager, Global Quality – HHE at Getinge, about the role of Health Hazard Evaluations in postmarket risk management.Kerry explains that although organizations may use terms such as HHE, HHA, or HRA, the terminology is less important than having a structured and documented process for evaluating health risk. In the QMSR era, organizations must be able to demonstrate that risk-based decisions are made consistently and intentionally—not only within formal risk management activities, but across the quality management system.The conversation explores how ISO 14971 can provide a defensible framework for HHEs, why field actions should themselves be evaluated as risk control measures, and how teams can make responsible decisions when complaint data, probability estimates, or other evidence are incomplete. Kerry also shares practical guidance for smaller manufacturers, cross-functional teams, and distributors of third-party products.Listen to the full 25-minute podcast or jump to a section of interest listed below. Chapters00:00 – Introduction and Why HHE Matters in the QMSR Era01:24 – What HHE Is, FDA Terminology, and the Need for Documentation05:04 – Building an HHE Process Around ISO 1497106:18 – HHE as Postmarket Risk Management and Field Action as a Risk Control08:41 – Evaluating Probability When Postmarket Data Are Limited14:08 – Cross-Functional Roles and the Mechanics of an HHE16:49 – Feeding Postmarket Evidence Back into the Risk Management File18:42 – Building a Lean HHE Process and Defining Clear Triggers21:11 – Responsibilities of Legal Manufacturers and Distributors23:39 – Career Development and Final TakeawaysIf you enjoyed this podcast, consider subscribing to the Let’s Talk Risk! newsletter.Suggested links:LTR: Risk-Based Assurance, FDA Expectations Under QMSR.LTR: The Missing Step in Risk Decisions.LTR: TR Risk Coach - AI-Powered Decision Support Tool.Key Takeaways* An HHE is a structured, risk-based assessment used to evaluate a known or potential issue affecting products in the market.* Organizations do not have to use a particular name or standardized format. What matters is demonstrating a systematic and documented conclusion about health risk.* ISO 14971 provides a strong framework for defining the problem, identifying hazards and hazardous situations, estimating and evaluating risk, and considering risk control options.* A field correction, product removal, recall, or decision to leave a product in the market should be treated as a risk-based decision. The action itself may introduce additional risks, including product shortages or reduced access to alternative therapies.* Complaint history alone may not provide an adequate probability estimate. Teams should also consider service records, bench testing, production data, inspection results, scrap, nonconformances, and the possibility of underreporting.* When reliable probability data are unavailable, organizations may need conservative estimates, statistical models, cross-functional judgment, or greater emphasis on the potential severity of harm.* Quality, R&D, Medical, Regulatory, Legal, and senior management should be involved early enough to provide appropriate expertise and oversight. Medical personnel should retain independence when making the clinical assessment.* HHE severity and probability classifications should remain consistent with the organization’s risk management system and product-specific risk acceptability criteria.* Postmarket evidence identified through an HHE should feed back into the Risk Management File so that assumptions, failure modes, controls, and benefit-risk conclusions remain aligned with actual device performance.* Every HHE should end with a clear, documented decision for or against field action. Regulators need to understand how the organization reached its conclusion—not simply what it decided.KeywordsAI governance, responsible AI, digital health, systems engineering, risk-based decision-making, quality management systems, third-party AI, model drift, regulatory compliance, critical thinkingAbout Kerry FlecknoeKerry Flecknoe is Senior Manager, Global Quality – HHE at Getinge, where she provides strategic leadership and end-to-end process ownership for the company’s enterprise-wide Health Hazard Evaluation program. Her work includes HHE governance, methods, digital tools, audit readiness, metrics, process improvement, and support of correction and removal decisions across Getinge's global network of medical device manufacturing sites.Kerry is a quality and regulatory compliance leader and Board Certified Medical Affairs Specialist with more than 20 years of medical device experience spanning quality, medical affairs, clinical support, postmarket surveillance, risk management, and product development. Before her current role, she held senior medical affairs positions at Getinge and spent more than a decade supporting cardiac rhythm management products at Boston Scientific. She holds bachelor’s degrees in Biomedical Engineering and Electrical Engineering from Duke University.Let’s Talk Risk! with Dr. Naveen Agarwal is a bi-weekly live audio event on LinkedIn, where we talk about risk management related topics in a casual, informal way. Join us at 11:00 am EST every other Friday on LinkedIn.DisclaimerInformation and insights presented in this podcast are for educational purposes only, and not as legal advice. Views expressed by all speakers are their own and do not reflect those of their respective organizations.Parts of this article were created using AI-generated content, which was subsequently reviewed, edited, and fact-checked by the author to ensure accuracy and alignment with our standards. This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit naveenagarwalphd.substack.com/subscribe