Severity of harm according to ISO 14971

Medical device manufacturers must determine the severity of possible harm to assess the risks posed by their devices.

What sounds simple is very challenging in practice. This article assists in determining and documenting the severity of harm in accordance with ISO 14971.

Basics: The term harm

Refer to the article on harm to use the term precisely and avoid typical mistakes.

1. Basics

a) Definition

ISO 14971, the standard for risk management of medical devices, defines the term severity (of harm):

Definition: Severity

“Measure of the possible consequences of a hazard”

DIN ISO 14971:2022, Chapter 3.27 with reference to ISO/IEC Guide 63:2019, 3.3

b) Regulatory background

Manufacturers must identify and assess the risks. They usually use a risk acceptance matrix for the assessment (see Fig. 1).

Fig. 1: Example of a risk acceptance matrix

This risk acceptance matrix assumes that manufacturers define classes for the probabilities and severities. This means that they must define classification criteria for the severity classes.

2. Typical challenge in defining severity classes

The assessment of severity proves to be difficult:

What is more harmful to a patient: if his knee becomes permanently stiff due to the failure of a medical device, or if he was, for a short time, in a life-threatening situation that was resolved without lasting harm thanks to the intensive care physician?
Are two months of life taken from a terminally ill person who has only six months to live to be valued differently from two months of missing life for a person who still has ten years to live?

3. Existing solutions

a) Definition of MPAIMV

The MPAIMV defines the term “severe incident” in §2 as an incident with the following potential consequences:

the death of a patient, user, or other person,

the temporary or permanent severe deterioration in the state of health of a patient, user, or other person, or

a severe public health threat.

However, the regulation does not define the terms used, such as “severe.”

b) Definition of MEDDEV

MEDDEV-2.12. contains a definition of the term “serious harm”:

However, even this definition does not use defined terms and only allows a distinction between severe and non-severe harm.

c) NACA score

A classification for categorizing (short-term) harm can be found on Wikipedia (NACA score). This classification initially came from the National Advisory Committee for Aeronautics, originally developed for the classification of aviation accidents.

The problem with this score is that it only considers the “amplitude” of the harm, not its progression over time.

d) Tables of the German VersMedV

The tables of the German Versorgungsmedizin-Verordnung – VersMedV (Ordinance on Medical Care) help classify long-term harm, i.e., disabilities. For example, this table contains the following entries:

Disease	Degree of disability
Brain damage with cognitive impairment (e.g., aphasia, apraxia, agnosia) – mild (e.g., residual aphasia) 30-40 – moderate (e.g., aphasia with obvious to major communication disorder) – severe (e.g., global aphasia)	30-40 % 50-80 % 90-100 %
Lens loss in one eye: visual acuity 0.1 to less than 0.4	20 %
Shortness of breath even with the slightest exertion or at rest; static and dynamic measured values of the lung function test more than 2/3 lower than the target values	80-100 %
Loss of a thumb	25 %

Tab. 1: Diseases and injuries with associated degree of disability

Tip

If you are interested in further values, refer to the VersMedV mentioned above or google the terms “degree of disability” and “degree of the consequences of injury.”

An article on the “International Classification of Functioning, Disability and Health” (ICF) also provides suggestions for classifying the severity of harm.

e) Interim conclusion

Many scores only consider the severity of acute harm. Harm that is not life-threatening and at the same time not reversible, such as permanent disability, does not fit well into this scheme.

It also does not help in the ethical discussion about whether in the case of harm

the maximum short-term effect (“the height of the damage curve”), or
the duration of the effect, or
the “integral” of this curve should be used.

4. New approach to quantifying the severity of harm

Step 1: Determine relevant classification features

To classify the severity of harm, manufacturers need classification features.

Examples of classification features for harm

Death (y/n)
Duration of hospitalization > n days (y/n)
Degree of disability > x % (y/n)
Intensive care treatment (of a non-intensive care patient) necessary (y/n)
Medical intervention necessary (y/n)
Reversible (y/n)
Shortening of life expectancy > n months (y/n)
Reduction in life expectancy > x % compared to life expectancy with “correct treatment” (y/n)
Pain level > X (y/n)
Quality of life, psychological stress according to “quality of life” criteria

Step 2: Use these criteria to define severity classes

In the second step, manufacturers can use the selected classification features to define the severity classes.

Examples for the definition of severity classes

Severity class	Classification features
Catastrophic	Death of one or more patients
Critical	Intensive medical treatment necessary or/and irreversible harm with at least n % disability.
…

Tab. 2: Binary classification criteria are assigned to the severity classes

Step 3: Add examples

As a manufacturer, supplement the definition of severity classes with specific examples for your medical device. This will make it easier to estimate the severity of harm caused by your medical device during the risk analysis (in accordance with ISO 14971).

Step 4: Check your definitions

Use the tips above to define severity. It is not enough to simply mention attributes such as “light,” “serious,” “severe,” and “catastrophic.” Instead, it is necessary to have a written definition of what constitutes “severe” harm.
Do not confuse severities of harm with probabilities. Therefore, severity classes such as “potentially fatal” or “poses a risk of life-threatening injury” are incorrect. The probability axis is independent of this, primarily as risks are already defined as the combination of probability and severity.
Avoid ethically debatable sequences in the severity of harm: Are two injured people worse than one dead person?
Make sure that you define the severity of harm completely. For example, several “serious irreversible injuries” or “for several people.”

Support

The Johner Institute’s risk management team will help you to create and review risk management files so that audits and approvals can be passed easily and safely. These files also include the risk policy and risk management plan, which should contain the risk acceptance criteria and, thus, the definition of the severity classes.

The seminar “Risk Management & ISO 14971” gives you a quick introduction. You will also learn how to define risk acceptance criteria.

5. Conclusion and summary

a) The determination of the severity classes of harm is the basis

One of the most important legal requirements is that of risk management. Legally compliant risk management requires precise risk acceptance criteria. These require a precise definition of severity.

b) Classification criteria enable reproducibility

Manufacturers must assign harms to severity classes in a reproducible manner – i.e., for a large number of people and over long periods of time. Otherwise, the entire risk management and, thus, the success of audits and approvals will be on a shaky foundation.

The definition of severity classes on the basis of clear, preferably binary classification characteristics enables this reproducibility.

c) The competence of the risk management team is crucial

Without a competent risk management team, defining severity levels and classifying harms into severity classes will not succeed, because the challenges are huge:

Which harm in the chain of harm should be entered in the risk table?
This decision also affects the associated probabilities of the selected harms.
How should the severity of this harm be assessed with regard to the attributes and, thus, classified?
How to deal with the ethical assessments mentioned above?

In addition to risk managers, the risk management team should also include physicians and contextual experts such as healthcare professionals.