Originally Published MDDI January 2003

REGULATORY OUTLOOK

Common sense and care should guide the MDR filing process.

Jeffrey K. Shapiro
Hogan & Hartson LLP

Filing medical device reports (MDRs) is undesirable and presents a certain amount of risk to the manufacturer. Fortunately, this risk can be ameliorated by approaching event reporting mindfully and carefully. Most importantly, device makers must not underestimate the risk involved in choosing not to file.

The medical device reporting regulation requires manufacturers to report significant adverse events in which their medical devices are involved to FDA.¹ All domestic and foreign manufacturers of finished medical devices and ready-for-use device components commercially distributed in the United States must comply with these requirements.

Many companies are reluctant to file MDRs with FDA. While these companies comply with the regulation, they do so with a bias against filing a report unless it is clear that one is absolutely required.

This reluctance is understandable. MDRs are public documents that do not exactly add luster to the company name. Competitors may use them to talk down the company with customers. Plaintiffs' lawyers may wave them in front of juries to bolster the case for exorbitant punitive damages. Worse, companies never know when an MDR document will trigger an extensive FDA investigation. After all, the purpose of event reporting is to alert FDA to potential product problems. In short, there are significant risks in filing MDRs.

On the other hand, it is important not to underestimate the risk of failing to file. The criminal and civil penalties for MDR violations can be severe. They comprise the full range of FDA's enforcement powers, including seizure, injunction, and criminal fines and imprisonment. Civil penalties may be imposed if a violation of MDR requirements is a significant or knowing departure, or a risk to public health.²

More than a few companies have learned the hard way that the short-term benefits of not reporting can soon be eclipsed by an intrusive federal investigation—not to mention very bad publicity when a settlement is announced or the case goes to trial. Several firms are currently under criminal investigation for failing to properly report.

Basic Filing Requirements

Deciding whether adverse events require an MDR filing involves some fairly subjective judgments. Under the MDR regulation, manufacturers must file an MDR within 30 calendar days of becoming aware of information that reasonably suggests a reportable death, serious injury, or device malfunction has occurred. Manufacturers must file an MDR within five working days if the reportable event requires remedial action to prevent an unreasonable risk of harm to the public health and for certain other types of events designated by FDA.³

An event is reportable if one of the manufacturer's marketed devices has caused or may have caused or contributed to a death or serious injury, or if it has malfunctioned and the device or a similar one would likely cause or contribute to a death or serious injury should the malfunction recur.⁴ The regulation states that a device has or may have "caused or contributed to" the event if the device was a factor, or may have been a factor because of its failure; malfunction; improper or inadequate design, manufacture, or labeling; or user error.⁵ Serious injury is defined as an injury that is life-threatening, results in permanent impairment of a body function or permanent damage to a body structure, or necessitates medical or surgical intervention to preclude permanent impairment or damage.⁶

Interpretation Is Everything

Of course, this brief summary of the MDR regulation barely scratches the surface of its complexities. (For a wealth of FDA guidance and information, visit www.cdrh.gov and click on "medical device reporting" under "Industry Assistance.") It does, however, begin to suggest the subjective nature of reportability determinations. What facts are needed to conclude that information "reasonably suggests" that a device "may have caused or contributed to" a serious injury or death? What is an "unreasonable risk of harm"? How can one predict whether it is "likely" that death or serious injury will occur "if the malfunction were to recur in the same or similar device"? What constitutes a "similar device"? What actions rise to the level of an "intervention" to "preclude permanent impairment or damage"?

In some cases, the application of these questions to the facts at hand will yield straightforward answers. In other cases, however, there will be ample room for disagreement. The question about whether a malfunction would likely cause death or serious injury were it to recur is especially tricky—it requires not only subjective judgment but a prediction about the future, which is always a hazardous undertaking.

The subjective nature of event reporting can lead a company into trouble. Consider this hypothetical scenario: Over an 18-month period, a company receives two dozen similar complaints of malfunction for a particular device. The company conscientiously examines the evidence each time a complaint is received but concludes that the malfunction is not likely to cause serious injury or death should it recur. On this basis, then, the company does not report any of these complaints. Now suppose that the malfunction later recurs and may have contributed to an actual patient death. At that point, the company must submit a report. It also may decide that a recall or other field action is needed. All of this activity will have the effect of alerting FDA (and the public) to the problem. In this context, it will look bad if the company has two dozen unreported complaints for the same malfunction in its files. FDA could allege that the company willfully chose not to report. In this hypothetical situation, the company may have acted in perfectly good faith but finds itself under investigation (and at risk of sanctions) for making the wrong call.

One way the company might have protected itself would have been to consult a medical expert qualified to evaluate the complaints and make a judgment about their reportability. If the expert had reasonably concluded that the device malfunction in question would be unlikely to cause or contribute to a death or serious injury should it recur, the complaints would not be reportable under the MDR regulation.⁷ Of course, it would be very helpful to have this expert's memorandum in the company files prior to the subsequent patient death. (This same approach can be employed when evaluating the reportability of an adverse event involving actual serious injury or death.)

If it is not feasible to obtain such an expert opinion, the only other way to eliminate the regulatory risk inherent in event-reporting decisions is to adopt a systematic bias toward reporting if there is any ambiguity whatsoever. Although the sanctions for failing to report can be severe, there are no sanctions for reporting unnecessarily.

This fact leads to an interesting question: Given the cloudiness of MDR requirements, the severe potential penalties for failing to report, and the absence of sanctions for submitting too many reports, wouldn't the best policy be to set a very low internal threshold for reporting, perhaps even lower than required by the MDR regulation, to provide a margin of safety? Yet, the opposite is often true. Many in industry have a bias against reporting unless it is very clear that they must.

Managing the Risks

This incongruity brings us back to the negatives associated with event reporting mentioned earlier. Companies are concerned about their reputation with customers, and what competitors might do with public MDRs. They are also anxious about the product liability implications of reports and the potential for an unwanted FDA investigation.

These concerns are valid but can be ameliorated. The principal product liability concern is that the MDR will be treated as an admission of device fault. The regulation, however, expressly states that a report is not necessarily an admission that a device caused or contributed to an injury. FDA itself adds this disclaimer to the front page of the reporting form, Form 3500A. Also, the MDR regulation permits the submitting party to include its own disclaimer and even deny in the report that there is any such admission.⁸

Thus, companies can protect themselves by carefully drafting the narrative to accurately state the known facts while avoiding any statement that could be construed as an admission if taken out of context. Companies also can add an explicit disclaimer of causation at the end of the narrative.

When competitors use MDRs to disparage products, companies need to address such publicity as they would any other unfair sales tactic. One way is to explain to customers that MDR requirements are very broad and a report does not necessarily mean there is a problem. Another approach is to research the competitor's own MDR filings to see if it has clean hands. If the competitor does not have the number or type of MDR filings that would be expected, perhaps it is not fully complying with the regulation. Ultimately, a good sales force should be able to negate or minimize any detriment from event reporting. Finally, there is the risk that an event report will trigger an FDA investigation. Fortunately, the chances of that occurring are not great. Given the sheer volume of reports and the limitations of FDA's resources, the agency is most likely to involve itself with only the most unusual or widespread incidents involving deaths or serious injuries.

Investigation-triggering reports are likely to involve the types of cases for which a recall will be in progress or under consideration, so FDA would likely find out about the incidents anyway. Also, user facilities and importers have reporting obligations that could lead them to alert FDA to a death or serious injury even if the manufacturer did not. In rare cases where FDA follows up with an investigation, the manufacturer will be in a better position if it has filed appropriate MDRs.

Conclusion

The bottom line is that filing MDRs is unpleasant, but the negative effects can usually be ameliorated. On the other hand, a major reporting violation can lead to severe negative fallout. To minimize the likelihood of an MDR violation fiasco, companies should take the following measures:

If companies are careful and exercise common sense when determining whether to file MDRs, they are likely to survive unscathed.

REFERENCES

1. Code of Federal Regulations, 21 CFR 803.

2. United States Code, 21 USC 331–334.

3. Code of Federal Regulations, 21 CFR 803.50, 803.53.

4. Code of Federal Regulations, 21 CFR 803.1(a).

5. Code of Federal Regulations, 21 CFR 803.3(d).

6. Code of Federal Regulations, 21 CFR 803.3(aa)(1).

7. Code of Federal Regulations, 21 CFR 803.20(c)(2).

8. Code of Federal Regulations, 21 CFR 803.16.

Copyright ©2003 Medical Device & Diagnostic Industry