FDA post-market obligations for medical devices

Three sets of federal duties attach to a device once it is in commercial distribution in the United States. Part 803 requires medical device reports of deaths, serious injuries and certain malfunctions, Part 806 requires reports and records of corrections and removals, and Part 822 governs surveillance that FDA orders under section 522 of the Federal Food, Drug, and Cosmetic Act. Each carries its own clock, its own record retention period and its own set of persons who bear the obligation.

Who reports under Part 803

Part 803 sets the medical device reporting requirements for device user facilities, manufacturers, importers and distributors. A user facility must report deaths and serious injuries that a device has or may have caused or contributed to, must establish and maintain adverse event files and must submit summary annual reports. A manufacturer or importer must report deaths and serious injuries and certain device malfunctions and must establish and maintain adverse event files. A manufacturer must also submit specified followup. A distributor must maintain records of incidents, and a distributor is not required to report those incidents. Part 803 supplements other provisions of the chapter, including Part 820.¹

The reporting clock runs from the point at which the entity becomes aware of a reportable event. For a user facility, awareness arises when medical personnel employed by or otherwise formally affiliated with the facility obtain information about a reportable event. For a manufacturer, awareness arises when any employee becomes aware of an event reportable within 30 calendar days or within 5 work days following a request under § 803.53(b). Becoming aware means that an employee has acquired information that reasonably suggests a reportable adverse event has occurred.¹

Reporting deadlines

A user facility submits reports of individual adverse events no later than 10 work days after the day it becomes aware of the event. Device-related deaths go to FDA and to the manufacturer, if known. Device-related serious injuries go to the manufacturer, or to FDA where the manufacturer is unknown. The user facility also submits an annual report to FDA on Form FDA 3419 by 1 January of each year. A facility that submitted no medical device reports during the period does not need to submit an annual report.¹

An importer submits reports of deaths and serious injuries to FDA and to the manufacturer no later than 30 calendar days after becoming aware of the event. Reports of malfunctions go to the manufacturer within the same 30 calendar days. The malfunction trigger is information reasonably suggesting that the device has malfunctioned and that the device or a similar device the importer markets would be likely to cause or contribute to a death or serious injury if the malfunction recurred.¹

A manufacturer submits reports of individual adverse events to FDA no later than 30 calendar days after becoming aware of a reportable death, serious injury or malfunction. A 5-work-day report is required under § 803.53 where an MDR reportable event necessitates remedial action to prevent an unreasonable risk of substantial harm to the public health, or where FDA has made a written request for a 5-day report. After such a written request, the manufacturer must submit 5-day reports for all subsequent events of the same nature involving substantially similar devices for the period specified. Supplemental or followup reports under § 803.56 are due within 30 calendar days of the day the manufacturer receives information it did not provide in the initial report.¹

Forms, formats and report content

Manufacturers and importers must submit individual adverse event reports to FDA in an electronic format that FDA can process, review and archive, unless granted an exemption under § 803.19. Importer reports sent to device manufacturers may be paper or electronic, provided all required data fields are included. A user facility submitting on paper uses Form FDA 3500A. The form is addressed to Medical Device Reporting at CDRH, FDA. The postal address is P.O. Box 3002, Rockville, MD 20847-3002. Form FDA 3500 is the voluntary form used by health professionals, consumers and other entities.¹

An electronic mandatory report must carry the information from the applicable blocks of Form FDA 3500A, covering the patient, the event, the device and the initial reporter. Submissions from a user facility or importer include block F. Submissions from a manufacturer include blocks G and H. A manufacturer that receives a report from a user facility or importer must incorporate that information and supply any corrected or missing information. Required device information includes the brand name, product code, manufacturer identity, model or lot identifiers and the unique device identifier that appears on the device label or package.¹

Manufacturers bear an investigation duty. Information reasonably known to a manufacturer includes anything obtainable by contacting the user facility, importer or other initial reporter, anything in the manufacturer’s possession and anything obtainable by analysis, testing or other evaluation of the device. The manufacturer must investigate each event and evaluate its cause. Where complete information cannot be submitted, the report must carry a statement explaining why the information is incomplete and what steps were taken to obtain it.¹

Procedures, files and exemptions

User facilities, importers and manufacturers must develop, maintain and implement written MDR procedures. The procedures must cover timely identification, communication and evaluation of events, a standardized review process for deciding when an event meets the reporting criteria and timely transmission of complete reports. They must also cover documentation and recordkeeping for the information evaluated, the reports submitted, the information used to prepare annual reports and the systems that give access for followup and FDA inspection.¹

MDR event files must be clearly identified and maintained for timely access. They must hold the information related to the adverse event, all documentation of the deliberations and decision making used to determine reportability, copies of all reports submitted and copies of all electronic acknowledgments FDA sends. A user facility retains a file for 2 years from the date of the event. A manufacturer or importer retains it for 2 years from the date of the event or for a period equivalent to the expected life of the device, whichever is greater. The retention period continues after the device is no longer distributed.¹

Licensed practitioners who manufacture or import devices solely for their own patients are exempt from the adverse event reporting requirements, as are individuals manufacturing devices solely for their own research or teaching and dental and optical laboratories. A manufacturer, importer or user facility may request an exemption, variance or alternative reporting arrangement in writing to CDRH at MDRPolicy@fda.hhs.gov. No report is required where the entity determines that the information received was erroneous and no device-related adverse event occurred, with documentation retained in the MDR files. A manufacturer or importer that receives reportable event information about a device it did not manufacture or import must forward the information to FDA with a cover letter.¹

Corrections and removals

Part 806 implements section 519(g) of the act. A device manufacturer or importer must submit a written report to FDA of any correction or removal it initiates to reduce a risk to health posed by the device, or to remedy a violation of the act caused by the device that may present a risk to health. The report is due within 10 working days of initiating the correction or removal. A correction is any of the following without physical removal from the point of use.

• repair
• modification
• adjustment
• relabeling
• destruction
• inspection

A removal is the physical movement of the device to another location for those purposes.²

Four categories of action are exempt from the reporting requirement: actions that improve performance or quality without reducing a risk to health or remedying a violation, market withdrawal, routine servicing and stock recovery. A report is also not required where the same correction or removal has already been reported under Part 803 or Part 1004.²

The report content is specified in § 806.10(c) and includes the following.

• the correction or removal report number in the prescribed format
• the responsible representative
• the device identity and marketing status
• the UDI
• a description of the events and actions
• associated illnesses or injuries
• the quantities involved
• consignee details
• copies of all communications

Where a required item is not immediately available, the report must state why and when it will be submitted. If the manufacturer or importer later extends the same action to additional lots or batches, it must amend the report within 10 working days of initiating the extension.²

Corrections and removals that are not reportable still generate records. Those records must identify the device, carry the UDI or other identifiers, describe the events and the action, and include a justification for not reporting that has been reviewed and evaluated by a designated person. Copies of all communications regarding the action form part of the record. These records are retained for 2 years beyond the expected life of the device, even if the firm has ceased to manufacture or import it, and must be transferred to a new manufacturer or importer.²

Postmarket surveillance ordered under section 522

Part 822 applies to a manufacturer that FDA has ordered to conduct postmarket surveillance of a class II or class III device. FDA may issue an order where failure of the device would be reasonably likely to have serious adverse health consequences or where the device is intended to be implanted for more than one year. An order may also issue where the device is intended to support or sustain life and be used outside a user facility, or where it is expected to have significant use in pediatric populations. Notification comes as a letter identifying the devices covered and the reason for the order. The order may issue during review of a marketing application, as the device goes to market or after a period of marketing.³

The manufacturer must submit its surveillance plan within 30 days of receiving the order. Surveillance must commence not later than 15 months after the day the order was issued. FDA reviews the submission within 60 days and responds with an approval order, an approvable letter or a disapproval letter identifying the reasons. Prospective surveillance may be ordered for a period of up to 36 months, and longer prospective periods require the manufacturer’s agreement. The 36-month period refers to the surveillance period rather than the time from issuance of the order.³

The submission must contain administrative information, the surveillance plan and the designated person’s identity, experience and qualifications. The plan itself must discuss:

• the plan objectives addressing the surveillance question in the order
• the subject of the study and the variables and endpoints used
• the surveillance approach or methodology, sample size and units of observation
• the investigator agreement, consent document and Institutional Review Board information, where applicable
• sources of data, the data collection plan and forms, and the patient followup plan
• procedures for monitoring conduct and progress and an estimate of the duration
• all planned data analyses and statistical tests, and the content and timing of reports.

FDA guidance on preparing a submission and designing a plan is available from CDRH. That guidance does not establish legally enforceable rights or responsibilities, and an alternative approach may be used where it complies with the statute and regulations.³

Duties once surveillance is approved

After approval, the manufacturer must conduct the surveillance in accordance with the approved plan. That means initiating surveillance in a timely manner, conducting it with due diligence and collecting the data identified in the plan. It also means submitting required reports on time and providing any information FDA requests. Interim and final reports are submitted as specified in the approved plan.³

Changes that affect the nature or validity of the data collected require FDA’s written approval in advance, sought by a supplement citing the unique document number assigned to the original submission. Changes that do not affect the nature or validity of the data are reported in the next interim report. A change in company ownership must be notified within 30 days, and a decision to close the business must be notified within 30 days. Surveillance continues under the approved plan even after the device is no longer marketed, unless FDA notifies the manufacturer that the study may stop.³

Records kept by the manufacturer include correspondence with investigators and FDA, signed investigator agreements, the approved plan with documentation of any deviation and all data collected and analyses conducted. Investigators keep their own corresponding records. All records are retained for 2 years after FDA accepts the final report, unless FDA specifies otherwise. A change of sponsor or investigator requires transfer of all records and notification to FDA within 10 working days of the effective date. Records required by the regulation must be produced within 72 hours of the initiation of an inspection.³

Failure to have an approved plan or to conduct surveillance in accordance with it is a failure to comply with section 522. It is a prohibited act under section 301(q)(1)(C), and the device is misbranded under section 502(t)(3).³

Questions people also ask

How long does a manufacturer have to file a medical device report?

A manufacturer has 30 calendar days from the day it becomes aware of information reasonably suggesting that its marketed device may have caused or contributed to a death or serious injury, or has malfunctioned in a way likely to cause or contribute to a death or serious injury if the malfunction recurred. A 5-work-day report applies where the event necessitates remedial action to prevent an unreasonable risk of substantial harm to the public health, and where FDA has made a written request for a 5-day report. Supplemental information is due within 30 calendar days of receipt.¹

When does a field action have to be reported to FDA as a correction or removal?

A written report is due within 10 working days of initiating a correction or removal that was begun to reduce a risk to health posed by the device, or to remedy a violation of the act caused by the device that may present a risk to health. Actions that only improve performance or quality without reducing a risk to health are exempt, as are market withdrawal, routine servicing and stock recovery. A correction or removal already reported under Part 803 or Part 1004 does not require a separate Part 806 report.²

How long must medical device reporting records be kept?

A user facility keeps an MDR event file for 2 years from the date of the event. A manufacturer or importer keeps the file for 2 years from the date of the event or for a period equal to the expected life of the device, whichever is longer. The obligation continues after the device is no longer distributed. Records of corrections and removals that were not reported to FDA are kept for 2 years beyond the expected life of the device.¹²

Does submitting a report mean admitting the device caused the harm?

For corrections and removals, § 806.10(e) states that a report submitted by a manufacturer or importer does not necessarily reflect a conclusion by that firm or by FDA that the information constitutes an admission that the device caused or contributed to a death or serious injury. The firm need not admit, and may deny, that the submission constitutes such an admission.²

What happens when FDA issues a section 522 postmarket surveillance order?

FDA sends a letter identifying the devices covered and the surveillance question. The manufacturer submits a plan within 30 days of receiving the order, and surveillance must commence no later than 15 months after the order was issued. FDA reviews the submission within 60 days and issues an approval order, an approvable letter or a disapproval letter. A manufacturer that disagrees with the order may request a meeting with the Office Director who issued it, internal review under § 10.75, an informal hearing under Part 16 or review by the Medical Devices Dispute Resolution Panel.³

Footnotes

1. 21 CFR Part 803, Medical Device Reporting. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-803 ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹² ↩¹³

2. 21 CFR Part 806, Medical Devices; Reports of Corrections and Removals. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-806 ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷

3. 21 CFR Part 822, Postmarket Surveillance. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-822 ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸