MEDICAL DEVICE REPORTING

Medical Device & Diagnostic Industry Magazine | MDDI Article Index

Originally published May 1996

Wallis Weiler Cady and Debbie Iampietro

Medical device reporting regulations (MDR) in both the United States and the European Union (EU) require that adverse events relating to medical devices be reported and tracked. These regulations ultimately ensure patient safety.

Beginning December 13, 1984, all domestic medical device manufacturers, initial distributors of imported devices (importers), and domestic medical device manufacturers of exported medical devices that were required to register with FDA had to comply with the U.S. MDR regulations. The requirements were published in Title 21, part 803 of the Code of Federal Regulations (CFR). FDA then published a document to provide answers to industry's questions about these regulations.¹

On November 26, 1991, user facilities (such as hospitals, ambulatory surgical facilities, nursing homes, and outpatient diagnostic or outpatient treatment facilities not part of a physician's office) were notified that they must begin reporting MDR-type incidents. FDA expanded reporting responsibilities in October 1993 to include medical device distributors (including importers), outlining the requirements in 21 CFR 804. FDA addressed the medical device manufacturing industry in a video teleconference on September 27, 1994, detailing and clarifying these MDR requirements.

On December 11, 1995, FDA published a revised final rule pertaining to medical device user facility and manufacturer reporting, which becomes effective July 31, 1996.

LEGAL REQUIREMENTS

Currently, types of reports required by FDA include incidents of death, serious injury or serious illness, or malfunction of a particular device likely to cause or contribute to a death or serious injury if the malfunction were to recur. Manufacturers, distributors, and user facilities each have specific reporting requirements. The upcoming final rule requires reporting by manufacturers that receive or otherwise become aware of information from any source that reasonably suggests that a device marketed by the manufacturer "may have caused or contributed to a death or serious injury; or has malfunctioned and such device or similar device marketed by the manufacturer would be likely to cause or contribute to a death or serious injury, if the malfunction were to recur."

Noncompliance with these requirements, including failure or refusal to report, can result in FDA taking regulatory action, which may include warning letters, product seizure, injunction, or civil penalties. Normally, FDA's first communication to a company not complying with MDR requirements has been a warning letter putting the company and responsible individual on notice.

The language FDA uses in a warning letter typically includes: "Additionally, the above-stated inspection revealed that your devices are misbranded within the meaning of section 502(t)(2) of the Federal Food, Drug, and Cosmetic Act, in that your firm failed to submit information to the Food and Drug Administration as required by the Medical Device Reporting (MDR) Regulation, as specified in 21 CFR Part 803. Specifically, you failed to submit an MDR report to FDA after receiving information which reasonably suggested that one of your commercially distributed devices may have caused or contributed to a death. The (date) incident report from (name of hospital and description of event) should have been reported as a death."²

PREVENTIVE MEASURES

Manufacturers should determine potential problems or situations involving their devices through such means as hazard analysis. Manufacturers should analyze their product's actual or intended usage to determine actual or projected problems, including misuse of the device. Both outside medical consultants knowledgeable about a company's products or actual users of a company's products could help identify such problems.

Manufacturers are responsible for establishing what they consider potential or real MDR criteria. Each product is unique, and the manufacturer is the responsible party. An in-depth review of competitors' MDRs using Freedom of Information Act searches and professional journals can also help determine what is reportable. It is important to note that this information is often not released in a timely manner.

Monitoring and trend-analysis programs should be in place that review potential product or process improvements and identify potential MDR reductions or eliminations based on 21 CFR 803.24(d)(3) and (4). Analysis can show a statistically significant upward or downward trend in the number or severity of events, thereby assisting in determining expected frequency. One trend-analysis method often used is control charting of MDR-attribute data. P or NP charts (both fraction, nonconforming charts) of MDR frequency rates with moving control limits have detected variations in the normal MDR frequency rates for certain families of devices or defect types. It is possible, though, that it may be impractical for a company that does not have a large number of incidents to track MDR events.

SOURCES FOR REPORTABLE EVENTS

It is essential that manufacturers de- termine all possible sources for MDR- reportable events. Sources could include:

*The company's product complaint-handling system. Procedures should be in place for capturing any written or oral complaints that relate to the identity, quality, durability, reliability, safety, effectiveness, or performance of a marketed device.

*Legal files. Communications and discussions with attorneys will indicate potential or real action by individuals contemplating device-related lawsuits.

*Service or repair records (including those of authorized servicing representatives). These may indicate problems with a device, even if it is within warranty, such as failing or being replaced prior to its anticipated life.

*Sales representative and technical service customer contacts (including information obtained during trade shows and sales visits).

*Medical and scientific literature (published and unpublished).

*In-house research, testing, evaluation, servicing, or maintenance records.

*User and distributor reports.

*FDA and foreign agencies. It is possible that FDA may have received an MDR report from a distributor or user of a device, but that the event was not properly communicated to the manufacturer.

Company employees who have contact with users of a company's device should be aware of proper communication channels to follow if they are notified of a potential MDR incident.

FINE TUNING

A manufacturer must report to FDA each time it becomes aware of a reportable event, even if a similar event has been reported previously or the company believes the event is the result of user error, faulty service, or poor maintenance.

For some events, FDA has notified manufacturers in writing that MDR reports are no longer required or that the company can make alternative reporting arrangements, such as reporting on a known adverse event on a quarterly basis or determining whether a report is required for a device undergoing remedial action.³

If a company determines that an incident is not reportable, it should justify its decision in writing. Written documentation can be beneficial if FDA questions months or years later why the event was not reported. This enables a company to defend its decision, even though FDA may persevere and require subsequent reporting.

In cases where a company reexamines an event and determines that it should have been reported, such reexamination should be reported to FDA as soon as the event is discovered, even though required time frames were not met initially. When reporting such events, a cover letter should explain why the company failed to report the incident initially.

Additionally, a company should place a standard disclaimer on its medical device reports. This ensures that the act of reporting an incident is not to be construed as an admission of liability. Recommendations for an appropriate disclaimer should be obtained from legal counsel.

GLOBAL ASPECTS

The EU Directive for Active Implantable Medical Devices (AIMD) and Medical Devices Directive (MDD) state that information on incidents involving CE-marked devices must be reported to a "competent authority."⁴ EN 46001 specifically states, "If a European standard is used for compliance with regulatory requirements, the supplier shall establish, document, and maintain procedures to notify the regulatory authority of those incidents which meet the reporting criteria."⁵

The European Commission has set forth guidelines that define the reporting criteria and time frames within which companies must file reports in the EU.⁶ Compliance with the guidelines is voluntary, but manufacturers marketing a device in the EU are bound by the appropriate directive to report serious incidents and recalls involving CE-marked devices. These guidelines should be applied to devices placed on the market in accordance with the AIMD starting January 1, 1993, and the MDD starting January 1, 1995.

The guidelines define the responsibilities of manufacturers, competent authorities, notified bodies, users, and the European Commission. They provide information on applicable devices, types of incidents, reporting time frames, authorities to which incidents should be reported, device investigation, details to be included in the initial and final reports (with sample forms), actions authorities may take, coordination among authorities, dissemination of information, and the safeguard clause.

Reportable incidents include any malfunction or deterioration in the characteristics or performance of a device, as well as any inadequacy in the labeling or instructions for use that led to a death of a patient or user, that led to a serious deterioration in the health of a patient or user, or might have led to the death or serious deterioration of a patient or user. A serious deterioration can include life-threatening illness or injury, permanent impairment of body function or permanent damage to body structure, or a condition necessitating medical intervention to prevent permanent impairment of body function or permanent damage to body structure.

Manufacturers must report the events cited above. The first two items are defined as incidents, the third as a near incident. Additionally, if events occurring outside the European Economic Area (EEA) lead to outcomes relevant to CE-marked products in use within EEA, the manufacturer should notify the relevant EEA authorities.

If a competent authority is not satisfied with a manufacturer's investigation of an incident, it may trigger the safeguard clause and impose appropriate measures. The MDD defines these measures, which may involve withdrawing such devices from the market or prohibiting or restricting their entry into the market.

A vigilance report conveys information on CE-marked products involving incidents or near incidents to competent EU authorities. FDA's MDR report and the European vigilance report require that companies set up similar systems to establish, document, and maintain procedures to notify them of incidents that meet the reporting criteria. In the United States, the regulatory authority is FDA; in the EU, it is the competent authority in the country of incident occurrence.

U.S. and EU reporting formats now require different forms. The vigilance system, however, requires that the manufacturer issue a final report (including the outcome of the investigation and any action) to the competent authority, which monitors the progress of the manufacturer's investigation. The competent authority may monitor the course, conduct, progress, and outcome of the investigation, including whether the results are satisfactory. A manufacturer's outcomes may include no action, additional surveillance or follow-up, dissemination of information to users (advisory notice), corrective action on future production, corrective action on devices in use, or product recall.

Some EU nations require that manufacturers based outside the EEA designate someone in the EEA to be responsible for vigilance. Global companies with a European presence may find it easier to have an EU-located responsible authority perform the reporting; however, it is essential that companies maintain communication between the European responsible authority and the U.S. manufacturer's representative. Although responsible authority is not defined in the guidance, he or she should be someone familiar with the MDD and vigilance reporting system.

The time frames in which reports must be filed, along with differing information and follow-up requirements, can become confusing and therefore result in a potential for multiple reporting requirements. The current reporting requirement for an MDR report for death or serious injury is 5 calendar days; for malfunction, 15 working days from initial receipt of information. For a vigilance report, the time frame for incidents is 10 days; for near incidents, 30.

STILL TO COME

The MDR regulations in 21 CFR 803 were tentatively revised and published December 11, 1995. These revisions have not yet taken effect, but a company would be prudent to review them and begin setting up systems to comply. Proposed revisions include more-detailed reporting required of each incident and more analysis and trending of similar-type occurrences.

As FDA learns more about MDR events, it may be publishing more MDR guidance documents and revising regulations further. Revisions to date have included changing the serious injury definition, which became effective June 16, 1993.⁷ As the receiver of MDR reports from all sources (users, manufacturers, and distributors), FDA may determine, after analyzing the information, that a serious product or user issue exists with a device. It may subsequently inform companies and users about the issue.

REFERENCES

1."Medical Device Reporting Questions and Answers," Rockville, MD, FDA, Center for Devices and Radiological Health (CDRH), February 1988.

2."Inspectional Guidance for Performing a Review of the Firm's Compliance with the MDR Regulation," Program 7382.830, Rockville, MD, FDA, CDRH, Compliance Program, pp 3­5, 1987.

3."MDR Guidance Document," No. 2, Remedial Action Exception, Rockville, MD, FDA, CDRH, Office of Surveillance and Biometrics (OSB), June 1995.

4.Official J Eur Commun, 36(7):6, 7, 1993.

5."Quality System--Medical Devices--Particular Requirements for the Application of EN 29001," EN 46001, sect 4.14, Brussels, Belgium, European Committee for Standardization, p 12, 1993.

6."The Medical Devices Vigilance System," European Commission guidelines, Brussels, Belgium, European Commission, 1995.

7.Letter to All Medical Device Manufacturers on Medical Device Reporting Regulation--Change in Serious Injury Definition, Rockville, MD, FDA, CDRH, OSB, Division of Surveillance Systems, February 21, 1995.

Wallis Weiler Cady is regulatory affairs manager for St. Jude Medical, Cardiac Assist Division, and is a member of MD&DI's Editorial Advisory Board. Debbie Iampietro is director, regulatory affairs/quality assurance at the same company. *