Medical Device Risk Assessment
Diligence across 510(k), De Novo and PMA pathways: predicate integrity, cybersecurity, quality systems and reimbursement. An automated Quick Screen within 24 hours; full reports in 48, reviewed by a physician and a biomedical engineer.
The Problem
Predicates carry recall histories. Cybersecurity documentation can block a submission. Inspections surface CAPAs that never reached the data room. Reimbursement gets assumed instead of checked. Each is worth reading before close.
A predicate removed from the market at FDA's initiative, or found adulterated or misbranded by a court, can't support a new 510(k). FDA's draft predicate-selection guidance also points away from predicates with design-related recalls.
Since October 1, 2023, FDA can refuse to accept a premarket submission for a cyber device that lacks the section 524B information, including a software bill of materials and a plan for postmarket vulnerabilities.
CAPA backlog, unresolved 483 observations, supplier-qualification gaps that may not show up in the data room.
"It's a 510(k), so it's reimbursed" is false. CPT/HCPCS coverage varies by payer, site of service, and procedure bundling.
P&T committee rejection, IDN procurement blocks, physician workflow mismatch — not found in the regulatory file.
MAUDE reports, recalls and warning letters on the target's devices and on its predicates are public records, and belong in the read before close.
Regulatory Pathways We Cover
A 510(k), a De Novo and a PMA carry different evidence bars. A full report reads each pathway against its own.
Most common pathway. Biggest pitfalls: predicate integrity, split predicates, technological characteristics creep, and clinical performance data adequacy.
Used when no valid predicate exists. Risk is acceptance of special controls, post-market requirements, and reclassification implications for future entrants.
Highest-risk Class III devices. Advisory panels, clinical trial integrity, preapproval inspection and post-approval study conditions shape the risk.
What a Device Report Examines
Full reports read the same 20-category framework on every company and summarize it in a composite Vantage Index. For a device, these are the areas that get the closest read. Some inputs, like financials, come from the company or the buyer.
| Domain | What we're looking at |
|---|---|
| Regulatory Pathway Integrity | Predicate validity, pathway choice, FDA correspondence, 510(k) summary quality, indications-for-use drift |
| Clinical Evidence & Adoption | Pivotal trial design, endpoint validity, real-world evidence, P&T committee history, KOL adoption |
| Reimbursement & Coding | CPT/HCPCS coverage, CMS NCD/LCD, payer policies, site-of-service bundling, prior auth burden |
| Manufacturing & QMS | 483 history, CAPA backlog, supplier controls, design history file completeness, QMSR (21 CFR 820) gaps |
| Cybersecurity & Postmarket | SBOM completeness, threat model, postmarket update plan, 524B readiness, recall and MAUDE history |
| IP & Freedom-to-Operate | Patent landscape, existing FTO opinions, design-around risk, trade-secret posture, licensing obligations |
| Commercial & Market Access | IDN contract landscape, GPO alignment, sales model, TAM rigor, competitor launch history |
| Financial & Operational | Burn rate, unit economics, inventory, supply continuity, exit track record — provided by the company or buyer |
Pricing Ladder
Start with an automated Quick Screen, delivered within 24 hours of a complete intake. Move to a full report when the deal moves: 48-hour turnaround, reviewed by Arvind Ravinutala, MD, and Aswini Ravinutala, BME.
Running diligence across a fund or portfolio? See Vantage Licenses →
Want continuous monitoring post-close? Surveillance from $1,500/mo →
Device Intelligence Library
Articles on device-specific risks in diligence. Written by Arvind and Aswini.
What makes a predicate unusable, what FDA's draft predicate guidance adds, and how to check a target's 510(k) chain.
Read → CybersecuritySBOM, threat model, postmarket update plan. What FDA refuses to accept, and how to assess whether your target is ready.
Read → CommercialClearance is the starting line. P&T committees, IDN procurement and reimbursement coding can stall a launch after FDA says yes.
Read → Pathway StrategyDe Novo can take longer, and it creates a new classification that later devices may use as a predicate. How to read the choice in diligence.
Read → RegulatoryDraft guidance on predicates, clinical data and implants, plus eSTAR and cybersecurity requirements, and what they mean for a target's next submission.
Read → QMSSingle-source suppliers, cost-of-goods trajectory, design transfer, quality system maturity and scale-up. What manufacturing diligence looks at.
Read →Buy a Quick Screen and give us the target and a data-room link (or just a 510(k) number) on the intake form. The Quick Screen arrives within 24 hours of a complete intake. Prefer to talk first? Book a free 20-minute call.