Hazard Analysis

Hazard analysis is a systematic process for identifying potential hazards associated with a product, process, or system, estimating the severity and probability of harm from each hazard, and determining appropriate risk control measures. For medical devices, identifying and analyzing hazards is a regulatory requirement (in the EU under the Medical Device Regulation's general safety and performance requirements; in the US through the risk management that FDA's Quality Management System Regulation requires by incorporating ISO 13485:2016), and it helps protect patients by addressing risks before they cause harm. Pharmaceutical quality risk management (ICH Q9(R1)) and clinical trial risk management (ICH E6(R3)) apply a similar proactive approach. The name is also used in food safety (Hazard Analysis and Critical Control Points, HACCP) and in industrial process safety; this entry covers health care products and procedures, and the term is unrelated to the hazard function and hazard ratio of survival analysis.

Medical devices, drugs, and clinical procedures can cause harm through design flaws, manufacturing defects, use errors, or unforeseen interactions with the patient or environment. Hazard analysis is the foundational step in risk management, identifying what could go wrong before it does. Standards and guidelines build hazard analysis into product development: ISO 14971:2019 (risk management for medical devices, recognized by FDA as a consensus standard and harmonized under the EU Medical Device Regulation) and IEC 62366-1 (usability engineering for medical devices, which addresses use related hazards) set out how device manufacturers identify hazards, and ICH Q9(R1) (quality risk management for pharmaceuticals) describes hazard analysis tools for medicines. These are standards and guidelines rather than laws, but regulators use them to judge whether a manufacturer has met its legal risk management obligations. Without systematic hazard analysis, risks may go unrecognized until they result in patient injury, product recalls, or regulatory action. The process also informs clinical trial safety monitoring, post market surveillance, and quality improvement initiatives.

Hazard analysis follows a structured sequence. The first step is to define the scope: what product, process, or system is being analyzed, and what is its intended use? The second step is hazard identification: systematically cataloging all potential sources of harm. This uses techniques such as brainstorming, review of complaint and incident databases, analysis of predicate devices, preliminary hazard analysis (PHA), failure mode and effects analysis (FMEA), fault tree analysis (FTA), and hazard and operability studies (HAZOP). These tools look from different directions: PHA lists hazards early, from the concept; FMEA works upward from the ways each component or step can fail; and FTA works downward from a harmful event to its possible causes. FMEA alone can therefore miss hazards that arise when nothing fails, such as hazards in normal use.

For each hazard, the analyst then works out the foreseeable sequences of events that can turn it into a hazardous situation, a circumstance in which people, property or the environment are exposed to the hazard. ISO 14971:2019 keeps four terms apart: a hazard is a potential source of harm, a hazardous situation is the exposure, harm is injury or damage to the health of people (or damage to property or the environment), and risk is the combination of the probability of occurrence of harm and the severity of that harm. Each hazardous situation is therefore characterized by two dimensions: severity (how serious the resulting harm could be, rated on a scale from negligible to catastrophic) and probability (how likely the harm is to occur, considering both the probability that the hazardous situation arises and the probability that the hazardous situation leads to harm). The combination of severity and probability determines the risk level, which is often displayed in a risk matrix.

For each unacceptable risk, the analyst identifies risk control measures. The hierarchy of controls prioritizes inherently safe design (eliminating the hazard), followed by protective measures in the device or system (guards, alarms), and finally information for safety (labeling, instructions). The effectiveness of each control measure is verified, and the residual risk (risk remaining after controls are implemented) is evaluated.

The hazard analysis is a living document that is updated throughout the product lifecycle as new hazards are identified through clinical use, post market surveillance, or design changes.

Hazard analysis should be conducted during the design and development of any medical device, pharmaceutical product, or clinical procedure. For medical devices, it forms part of the risk management file that regulators and Notified Bodies review, and it should be updated whenever the product design changes, new hazards are identified through post market surveillance, or complaint and incident data reveal previously unrecognized risks. It is also appropriate for evaluating research equipment, laboratory procedures, and clinical trial protocols for participant safety.

A common error is conducting hazard analysis too late in the development process, when design changes are costly and difficult. Hazard analysis should begin in the earliest stages of concept development. Another mistake is failing to consider use related hazards (errors that users, such as clinicians or patients, might make when interacting with the product), which can cause medical device adverse events and are the focus of IEC 62366-1 (usability engineering). Underestimating the severity or probability of a hazard based on optimistic assumptions rather than evidence is another pitfall. Mixing up the terms is also common: listing a harm such as a skin infection as a hazard, or scoring a hazard without describing the hazardous situation that would expose someone to it. Some teams conduct the analysis once and never update it, even as the product evolves or new safety data emerge. Finally, treating the risk matrix as a precise quantitative tool (rather than a structured judgment aid) can lead to false precision and inappropriate decisions about risk acceptability.

A medical device company develops a portable insulin pump. The hazard analysis identifies 45 potential hazards, each traced through a hazardous situation to a harm. Three examples: over delivery of insulin, which exposes the patient to an excessive dose and can cause severe hypoglycemia (severity: critical; probability: remote); under delivery after battery failure, which leaves the patient without insulin and can cause hyperglycemia (severity: serious; probability: occasional); and microbial contamination at the infusion site, which can cause a skin infection (severity: moderate; probability: probable). For over delivery, the team implements a redundant flow sensor and a maximum dose limit in the software (reducing probability from remote to improbable). For battery failure, they add a low battery alarm with a 4 hour advance warning. For skin infection, they include instructions for site rotation and sterile technique. After risk controls are implemented, the risks from 42 of the 45 hazards are judged acceptable. The remaining 3 undergo benefit risk analysis, and residual risks are communicated in the product labeling.