Why Focus on the Probability of Harm Rather Than the Probability of Defects?

In medical device risk management, risk is defined as:

Risk = Probability of occurrence of harm × Severity of that harm

What requires careful attention here is that this refers to the probability of harm occurring, not the probability of a defect occurring. At first glance, one might think that if there is a defect, it should simply be corrected. However, actual risk assessment is not that straightforward.

This article explores this question by examining the fundamental concepts of risk management based on ISO 14971, the international standard for medical device risk management.

What Is the Definition of Risk?

The Essence of “Risk” as Indicated by International Standards

ISO 14971:2019, the international standard for medical device risk management, defines risk as follows:

Risk = Combination of the probability of occurrence of harm and the severity of that harm

What is important here is that it focuses on the “probability of occurrence of harm” rather than simply the “probability of defect occurrence.”

Why Focus on “Harm”?

This definition has profound meaning. What matters most for medical devices is “patient safety.” Even if a product has some malfunction, if it does not actually cause harm to patients or users, it is evaluated as low risk.

For example, if a thermometer has a defect that causes its display to deviate by 0.1°C, but this is within a range that does not affect patient treatment, it does not lead to harm. On the other hand, even a slight malfunction in a pacemaker can lead directly to life-threatening harm.

Components of the Probability of Occurrence of Harm

In ISO 14971 and FDA (U.S. Food and Drug Administration) guidance, it is common to express the probability of occurrence of harm as the product of two elements:

Probability of occurrence of harm = P1 (Probability of defect occurrence) × P2 (Probability that the defect leads to harm)

P1: Probability of Defect Occurrence

This refers to the probability that some malfunction or failure will occur in the product. For example:

• Catheter breakage (1 in 1,000 units)
• Electronic device malfunction (once in 100,000 uses)
• Sterile packaging tear (1 in 10,000 units)

P2: Probability That the Defect Leads to Harm

This is the probability that when a defect occurs, it will actually cause harm to people (patients, healthcare professionals, etc.). P2 includes the following factors:

• Use conditions: In what environment is it used?
• Protective measures: Will safety mechanisms function?
• Exposure time: How long will individuals be exposed to the risk?

Why Defects Alone Are Insufficient: Understanding Through Real Examples

Reason 1: Differences in Impact Based on Use Environment

Even with the same medical device, such as a catheter, the risk varies greatly depending on the site of use. This is a typical example frequently used in actual risk assessments.

Case of Cerebrovascular Catheter

• Probability of defect occurrence (P1): 0.1% (1 in 1,000 units breaks)
• Probability of leading to harm (P2): Over 90% (fragments cause cerebral infarction)
• Probability of occurrence of harm = 0.1% × 90% = 0.09%

Case of Colon Catheter

• Probability of defect occurrence (P1): 0.1% (same breakage rate)
• Probability of leading to harm (P2): 5% (most are naturally expelled)
• Probability of occurrence of harm = 0.1% × 5% = 0.005%

Even with the same 0.1% breakage rate, the actual probability of occurrence of harm differs by a factor of 18. This is why we focus on the probability of occurrence of harm rather than simply the defect rate.

Reason 2: Existence of Protective Measures

Many medical devices incorporate protective measures that prevent harm even when defects occur. These significantly reduce P2.

Example of Infusion Pump

• Alarm function: Detects flow rate abnormalities and issues warning sounds
• Automatic stop function: Automatically stops when exceeding set ranges
• Air bubble detection sensor: Interrupts administration when air is detected

Even if a defect occurs in flow rate control (P1), these protective measures significantly reduce the probability that actual harm will reach the patient (P2).

Reason 3: Consideration of Frequency of Use and Exposure Time

The frequency of use and patient exposure time of medical devices are also important factors that greatly affect P2.

Continuously Worn Devices (Pacemaker)

• Exposure time: 24 hours a day, 365 days a year
• Probability that defect leads to harm (P2): High

Diagnostic Equipment (X-ray Device)

• Exposure time: Only a few minutes during examination
• Probability that defect leads to harm (P2): Relatively low

Practical Risk Assessment Examples

In actual risk assessments, systematic evaluation is conducted.

Example 1: Flow Rate Accuracy Failure in Infusion Pump

Suppose there is a defect that causes a ±10% flow rate error in an infusion pump.

Case of Insulin Administration

• P1 (Probability of flow rate error occurrence): 0.01%
• P2 (Probability of leading to harm): 80% (risk of hypoglycemia/hyperglycemia)
• Severity: High (possibility of impaired consciousness, coma)
• Risk level: High

Case of Saline Administration

• P1 (Probability of flow rate error occurrence): 0.01% (same)
• P2 (Probability of leading to harm): 1% (clinical impact is limited)
• Severity: Low (temporary edema at most)
• Risk level: Low

We can see that even with the same defect, the risk level differs greatly depending on the intended use.

Example 2: Blade Chipping in Surgical Scalpel

Use in Neurosurgery

• P1 (Probability of blade chipping): 0.01%
• P2 (Probability of leading to nerve damage): 70%
• Severity: Extremely high (permanent neurological impairment)
• Risk level: High

Use in Skin Incision

• P1 (Probability of blade chipping): 0.01% (same)
• P2 (Probability of leading to serious harm): 5%
• Severity: Low (irregular incision line at most)
• Risk level: Low

Application to Risk Management: Practice Based on ISO 14971

1. Prioritization Using Risk Matrix

To effectively reduce risk with limited resources, prioritization using a risk matrix is essential.

Probability of Harm Occurrence	Severity: Low	Severity: Medium	Severity: High
High (>1%)	Medium Risk	High Risk	Unacceptable
Medium (0.01-1%)	Low Risk	Medium Risk	High Risk
Low (<0.01%)	Acceptable	Low Risk	Medium Risk

2. Multi-layered Risk Reduction Measures

ISO 14971 and GHTF (Global Harmonization Task Force) guidelines recommend the following approaches.

Reduction of P1 (Probability of Defect Occurrence)

• Design improvement: Adoption of more reliable components
• Enhanced quality control: Improved manufacturing process management
• Regular maintenance: Implementation of preventive maintenance

Reduction of P2 (Probability of Leading to Harm)

• Addition of protective measures: Implementation of multiple safety mechanisms
• Setting usage restrictions: Clarification of scope of application
• Enhanced training: Education on proper usage methods

Reduction of Severity

• Early detection system: Early detection of abnormalities
• Damage mitigation function: Design to minimize harm
• Emergency response procedures: Establishment of rapid response methods

3. Evaluation of Residual Risk and Determination of Acceptability

It is not realistic to reduce all risks to zero. The foundation of medical device risk management is to evaluate residual risk and determine whether it is acceptable.

Criteria for Determining Acceptability

• Benefit-risk ratio: Does the medical benefit outweigh the risk?
• Comparison with existing alternatives: Is the risk reasonable compared to other treatment methods?
• Societal acceptance level: Is it at a level accepted for similar medical devices?

Summary: Risk Assessment Prioritizing Patient Safety

The reason medical device risk management focuses on the probability of occurrence of harm rather than simply the probability of defect occurrence is that what ultimately matters is “patient safety.”

This approach enables us to:

• Identify truly important risks
• Effectively allocate limited resources
• Ensure reasonable safety

This approach based on ISO 14971 is adopted in medical device regulations worldwide and serves as the foundation for providing safer medical devices to patients. The essence of risk management is not to pursue perfection, but to pursue reasonable and effective safety based on scientific evidence.

When all those involved in the development and manufacture of medical devices adopt this perspective of “probability of occurrence of harm,” they can contribute to the realization of safer healthcare.