WARNING LETTER
Xoran Technologies, LLC
MARCS-CMS 694229 —
December 09, 2024
Delivery Method:
VIA Electronic Mail
Product:
Medical Devices
Recipient:
Recipient Name
Robert P. Bryan
Recipient Title
Chief Executive Officer (CEO)
Xoran Technologies, LLC
5210 S State Rd
Ann Arbor
,
MI
48108
United States
Issuing Office:
Center for Devices and Radiological Health
United States
WARNING LETTER
CMS # 694229
December 9, 2024
Dear Mr. Bryan:
During an inspection of your firm located in Ann Arbor, MI on June 25, 2024 through July 11, 2024, an investigator from the United States Food and Drug Administration (FDA) determined that your firm manufactures computed tomography (CT) systems and supporting software to include (but not limited to) the MiniCAT 2020, MiniCAT IQ, xCAT IQ, and xCAT XL devices and XoranConnect image processing software. Under section 201(h) of the Federal Food, Drug, and Cosmetic Act (the Act), 21 U.S.C. § 321(h), these products are devices because they are intended for use in the diagnosis of disease or other conditions or in the cure, mitigation, treatment, or prevention of disease, or to affect the structure or any function of the body.
This inspection revealed that these devices are adulterated within the meaning of section 501(h) of the Act, 21 U.S.C. § 351(h), in that the methods used in, or the facilities or controls used for, their manufacture, packing, storage, or installation are not in conformity with the current good manufacturing practice requirements of the Quality System regulation found at Title 21, Code of Federal Regulations (CFR), Part 820.
We received responses from Mr. Zeke Church, Director of Quality & Regulatory, dated July 29, 2024, August 30, 2024, and September 30, 2024 concerning our investigator’s observations noted on the Form FDA 483 (FDA 483), List of Inspectional Observations, that was issued to your firm. We address these responses below, in relation to each of the noted violations. These violations include, but are not limited to, the following:
1. Failure to establish and maintain procedures to ensure that all purchased or otherwise received product and services conform to specified requirements, as required by 21 CFR 820.50.
Specifically, you failed to implement section 9.0 of your “Supplier Approval and Removal” procedure (WI 14.5; Rev. 9; 7/21/15) which requires your suppliers to complete the “Supplier Self-Assessment” Form F 14.5.1 to verify they can meet requirements of the Quality Management System (e.g., process validation under production and process controls, corrective action processes, control of nonconforming product, etc.) and the “Supplier Criteria and Setup Request” Form (F 14.5.9) to ensure your firm’s requirements can be met. For example, you did not ensure that your two (2) suppliers of printed circuit boards (PCBs) – Supplier A approved on or around June 3, 2022 and Supplier B approved on or around April 4, 2016 – conducted process validations for the
(b)(4)
soldering processes used in your MiniCAT 2020 and MiniCAT IQ devices.
The
(b)(4)
soldering processes cannot be fully verified by subsequent inspection and test in that your functional, electrical continuity testing, and visual inspections cannot detect voids in the solder joints. Of the two suppliers, Supplier B has been manufacturing 10 of your unvalidated PCBs (
(b)(4)
) used in the devices for the last 8 years. Over the last 2 years, there were at least 4 confirmed complaints of PCB failures which required earlier-than-expected replacement of these boards within 2 years of installation. Recent distribution records covering the last 4 years revealed that 121 MiniCAT 2020 devices and 83 MiniCAT IQ devices were assembled with unvalidated PCBs from at least one or both of these suppliers. Moreover, there are currently 156 MiniCAT 2020 devices and 175 MiniCAT IQ devices installed in the field with unvalidated PCBs from one or both of your suppliers.
We reviewed your firm’s responses and conclude that they are not adequate. Although you opened CAPA 294 (not provided) to determine why your supplier files are incomplete; are no longer using Supplier B effective August 28, 2024; plan to obtain the required completed forms; will require component qualification on all PCBs received; and plan to establish a written agreement from Supplier A, your responses do not address reviewing all supplier files for completeness, including whether any additional process validations are required. Furthermore, you did not provide any details on whether you assessed the risk of using PCBs in existing inventory from unvalidated
(b)(4)
soldering processes as well as in the field.
2. Failure to adequately establish and maintain procedures for validating the device design to include an adequate software validation, as required by 21 CFR 820.30(g).
Specifically, your firm’s XoranCAT software used to control MiniCAT diagnostic CT x-ray systems has not been adequately validated. For example, your “Testing” procedure (SOP 40; Rev. 5; Effective: 7/31/15) defines four levels of testing, including component testing, integration testing, system testing, and acceptance testing. The XoranCAT software release v5.17.3, dated February 19, 2024, introduced features (e.g., supporting the detector panels) and fixed anomalies (e.g., 64-bit Region of Interest (ROI) tool, which “[did] not work properly”). However, the test cases and results indicate that the software was validated at the software system level, utilizing only functional testing (i.e., black-box) techniques. The validation documentation does not include component testing and integration testing. Since January 2020, your firm has logged approximately 460 complaints which include “Software Issue > XoranCAT” in the complaint categorization code. These complaints allege problems such as freezing/crashing software, image reconstruction issues, and corrupted files.
We reviewed your firm’s responses dated July 29, 2024, August 30, 2024, and September 30, 2024, and conclude that they are not adequate. Your firm’s responses state
(b)(4)
. However, your responses do not yet include the documentation for our evaluation. Furthermore, your responses do not include a retrospective review of previously completed software changes to evaluate whether they have been validated adequately, in accordance with the SOP. It is unclear whether regression analysis was conducted to determine the need to re-execute unit, integration, and software-system level testing and if level of code coverage was commensurate with risk. Your response should include procedures for regression analysis and testing as well as procedures to ensure adequate code coverage during software testing, in accordance with the guidance document,
General Principles of Software Validation.
3. Failure to adequately establish and maintain procedures for receiving, reviewing, and evaluating complaints by a formally designated unit to ensure that all complaints are processed in a uniform and timely manner, as required by 21 CFR 820.198(a).
Specifically, you failed to implement section 9.0 of your “Complaint Management” procedure (SOP 6; Rev. 31-33; Effective: 2/21/19; 5/30/23; 12/15/23) to categorize customer calls as complaints instead of inquiries when they meet the definition of complaints as defined by 21 CFR 820.3(b). A cursory review of inquiries logged between January 1, 2022 and June 25, 2024 revealed that at least three (3) customer calls were incorrectly logged as inquiries instead of complaints. For example, you logged the following customer calls as inquiries and not complaints although they allege deficiencies related to the identity, quality, durability, reliability, safety, effectiveness, or performance:

Case ID # 00047929 (3/28/24):
“
Customer called due to gantry not returning to home position. I was able to zero the gantry in CTDT. This is the 2nd time this year this issue has occurred. Customer is due for PM and requests an onsite visit […]
”

Case ID # 00045482 (2/14/23):
“
Receiving shutter errors when attempting patient scans. ACQ must be rebooted to remove error and complete scans. Error has occured [sic] multiple times
.”

Case ID # 00045056 (12/14/22):
Customer is unable to select protocol and reccived [sic] ‘unable to initialize panel’ message. Restarted ACQ, performed gain calibration message did not return and able to select protocol and continue with scan
”
We reviewed your firm’s responses and conclude that they are not adequate. Although you opened CAPA 296 (not provided) to determine why your complaint procedures were inadequate; plan to create a process to ensure inquiries are evaluated prior to closure to ensure complaints are not misidentified as inquiries; and conduct retraining, there were no corrective actions identified to retrospectively review inquiries, for a reasonable time frame, to determine if any meet the definition of complaints, and there were no corrections to process the inquiries in the observation as complaints.
4. Failure to establish and maintain procedures for validating the device design to include an adequate risk analysis, as required by 21 CFR 820.30(g).
Specifically:
(a) You failed to implement section 9.3 of your “Risk Management” procedure (SOP 39; Rev. 3 and 10; Effective: 5/23/11 and 12/15/23) which requires use of a hazard analysis to identify foreseeable hazards in both normal and fault conditions and estimate the risk for each hazard by determining the probability of occurrence of harm and severity of the possible consequences of that harm as a part of your risk analysis. For example, you have not calculated risks under normal use of your MiniCAT devices since your hazard analysis titled “Device Hazards and Harms Matrix” (01-2.5; Rev. 1; 6/9/11) only documents the severity of harms associated with hazards and not the probability of occurrence.
(b) Your “FMEA Work Instruction” (WI 39.2; Rev. 8; Effective: 12/15/23) states that “***a post-mitigation RP [Risk Priority] of ‘B’ should always prompt consideration of further control measures***”; however, it does not define how to document this assessment. Your “MiniCAT DFMEA” includes approximately 29 line items with a post-mitigation Risk Priority of “B” with a blank under the “Recommended Action” field for which your firm was unable to provide evidence that additional control measures were considered.
(c) You failed to implement section 9.8 of your current revision of your “Risk Management” procedure (SOP 39; Rev. 10; Effective: 12/15/23) which requires evaluation of the overall residual risk acceptability. For example, your firm has not re-evaluated and documented the overall residual risk acceptability of your MiniCAT devices despite the “MiniCAT DFMEA” (01-2.3) being revised
(b)(4)
since approval of the “MiniCATTM Risk Management Report” (Rev. 2.0) on August 5, 2011 which determined that “***the benefits of the MiniCATTM CT scanner outweigh the inherent and residual risks***.”
(d) You failed to implement section 9.10 of your “Risk Management” procedure (SOP 39; Rev. 10; Effective; 12/15/23) and “Production and Post-Production Information” section of your “MiniCATTM Risk Management Report” (Rev. 2.0; Approved 8/5/11) which require you to monitor customer complaints and other quality data sources to identify new risks and failure modes and update the risk management file. In particular, you do not assess the need to update your risk management file for your complaints unless they are investigated under a Failure Investigation Analysis (FIA) such that complaints without FIAs are excluded from this assessment. For example, a risk assessment was not conducted for Complaint # 47856 to determine whether the FMEA needed to be updated because it lacked an FIA.
The adequacy of your firm’s responses cannot be determined at this time. You opened CAPA 297 (not provided) to determine why risk analysis is not adequate and stated you plan to add probability of occurrence to your harms analysis; update the FMEAs with a column for risk priority justification; update your management review work instruction (WI 1.1) to require review of the risk management report at a minimum yearly to determine if an update is needed; and review and revise the current risk management report. Please provide updates on the progress of these corrective actions and corrections, including CAPA 297, and any supporting evidence. Also, please respond with how you plan to address the finding that your risk management file is not updated with complaints without FIAs.
Our inspection also revealed that the MiniCAT 2020, MiniCAT IQ, xCAT IQ, and xCAT XL devices are adulterated under section 501(f)(1)(B) of the Act, 21 U.S.C. § 351(f)(1)(B), because your firm does not have an approved application for premarket approval (PMA) in effect pursuant to section 515(a) of the Act, 21 U.S.C. § 360e(a), or an approved application for an investigational device exemption under section 520(g) of the Act, 21 U.S.C. § 360j(g). The devices are also misbranded under section 502(o) of the Act, 21 U.S.C. § 352(o), because your firm did not notify the agency of its intent to introduce the devices into commercial distribution, as required by section 510(k) of the Act, 21 U.S.C. § 360(k). For a device requiring premarket approval, the notification required by section 510(k) is deemed satisfied when a PMA is pending before the agency [21 CFR 807.81(b)]. The kind of information that your firm needs to submit in order to obtain approval or clearance for the device is described on the Internet at http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/HowtoMarketYourDevice/default.htm. The FDA will evaluate the information that your firm submits and decide whether the product may be legally marketed.
Specifically, the MiniCAT 2020, MiniCAT IQ, xCAT IQ, and xCAT XL devices do not have 510(k) clearance. While a previous version of the MiniCAT device does have a 510(k) clearance (K113421) and while a previous version of the xCAT device does have a 510(k) clearance (K061834), the following design modifications – as documented in your firm’s US Regulatory Assessment of Product or Process Design Changes for 510(k) Cleared Medical Device – require the imaging performance and/or software to be evaluated in order to ascertain their impact to safety and effectiveness. These changes may be accepted in a Special 510(k) submission.
The following changes could significantly affect the safety or effectiveness of these devices:
MiniCAT2020:
 New model of Varex x-ray receptor panel: Varex 2121DXV. Technology and principle of operation of the 2121DXV are the same as current MiniCAT panels Varex 2520DX and 2520XI. The panel is just smaller in overall dimensions and cost.
 Changes to the position of the receptor panel in the gantry (offset) to maintain a field of view (FOV) size similar to MiniCAT/IQ while scanning with the smaller size panel (21x21cm vs. 25x20cm)
 Removal of Beam Limiter board and corresponding revision to PLC firmware; use of fixed collimation
 Software changes to add support for the new receptor panel and reconstruction algorithm
MiniCAT IQ:
 Software changes causing increased number of post-processing viewing filter levels
xCAT IQ:
 New model of x-ray source
 Change in hardware components requiring new firmware and software controls
 New type of receptor panel mode that requires a new acquisition method
 New patient head holder that introduces biocompatibility concerns
 Revised XoranCAT software with a new construction protocol to accommodate soft tissue reconstruction, new soft tissue protocol and new receptor panel acquisition modes
xCAT XL:
 Dimensional changes in system geometry that may affect imaging, including a reduction of the FoV
 Possible change in scattered radiation due to removal of gantry shields
 Change in filters that may affect scattered or leakage radiation
 Software uses new imaging protocols, the safety of which is unclear without more information
Your firm should take prompt action to address any violations identified in this letter. Failure to adequately address this matter may result in regulatory action being initiated by the FDA without further notice. These actions include, but are not limited to, seizure, injunction, and civil money penalties.
Other federal agencies may take your compliance with the FD&C Act and its implementing regulations into account when considering the award of federal contracts. Additionally, should FDA determine that you have Quality System regulation violations that are reasonably related to premarket approval applications for Class III devices, such devices will not be approved until the violations have been addressed. Should FDA determine that your devices or facilities do not meet the requirements of the Act, requests for Certificates to Foreign Governments (CFG) may not be granted.
Please notify this office in writing within fifteen business days from the date you receive this letter of the specific steps your firm has taken to address the noted violations, as well as an explanation of how your firm plans to prevent these violations, or similar violations, from occurring again. Include documentation of the corrections and/or corrective actions (which must address systemic problems) that your firm has taken. If your firm’s planned corrections and/or corrective actions will occur over time, please include a timetable for implementation of those activities. If corrections and/or corrective actions cannot be completed within fifteen business days, state the reason for the delay and the time within which these activities will be completed. Your firm’s response should be comprehensive and address any violations included in this Warning Letter. If you believe that your products are not in violation of the FD&C Act, include your reasoning and any supporting information for our consideration as part of your response.
Your firm’s response should be sent by email to CDRHWarningLetterResponses@fda.hhs.gov. Refer to CMS case # 694229 when replying. If you have any questions about the contents of this letter, please contact: Sargum C. Morgan, Compliance Offer at (313) 393-8253 or sargum.morgan@fda.hhs.gov.
Finally, you should know that this letter is not intended to be an all-inclusive list of the violations at your firm’s facility. It is your firm’s responsibility to ensure compliance with applicable laws and regulations administered by FDA. The specific violations noted in this letter and in the Inspectional Observations, FDA 483, issued at the close of the inspection may be symptomatic of serious problems in your firm’s manufacturing and quality management systems. Your firm should investigate and determine the causes of any violations and take prompt actions to address any violations and bring the products into compliance.
Sincerely yours,
/S/
RDML Sean M. Boyd, MPH, USPHS
Director
Office of Regulatory Programs
Office of Product Evaluation and Quality
Center for Devices and Radiological Health
Content current as of:
01/14/2025
Regulated Product(s)
Medical Devices