All Device Manufacturers Must Report!
July 14, 2013At long last, 16 years after the most recent version, FDA has issued a new draft guidance about medical device reporting for manufacturers. Companies have long complained about the ambiguities in the regulation. In a typical case of “be careful what you wish for,” the draft MDR guidance leaves industry with more concern than clarity.
Much of the 47 page draft guidance simply repeats the requirements put forth in the regulations at 21 C.F.R. Part 803, and mirrors the 1997 guidance. However, there are some important distinctions that have the potential to substantially alter the landscape of MDR reporting requirements. We discuss some of the highlights (or, rather, lowlights) below.
Let’s begin with the “presumption” that once a malfunction has caused or contributed to a death or serious injury, the malfunction is “likely” to do so again if the malfunction were to recur. In the 1997 guidance, FDA stated: “This presumption will continue until the malfunction has caused or contributed to no further deaths or serious injuries for two years, or the manufacturer can show, through valid data, that the likelihood of another death or serious injury as a result of the malfunction is remote.” The two-year time limit is gone from the recently issued draft guidance. Rather than the passage of time, FDA states that “once a malfunction causes or contributes to a death or serious injury, you have an obligation to file MDRs for additional reports of that malfunction. . . . Documentation that a malfunction has not caused or contributed to any additional deaths or serious injuries can be used to support a request for an exemption from further reporting of this malfunction . . . .” Draft Guidance, at 12. (We wrote about a Warning Letter portending FDA's new position here.) Therefore, unless and until a manufacturer seeks and is granted an exemption, it must continue to file MDRs for a malfunction that previously caused or contributed to death or serious injury. It is not clear how long after the initial malfunction that led to the death or serious injury a manufacturer could reasonably seek and expect to be granted an exemption. Nor does FDA explain why the two-year presumption has been abolished, or why two years without an event shouldn’t automatically be sufficient. What is clear is that substituting exemption requests for presumptions will increase the workload for FDA and industry.
Next up, there are several instances in the draft guidance where FDA encourages duplicate reporting. For example, traditionally, a contract manufacturer and specification developer/distributor would enter into an agreement assigning regulatory responsibilities, including reporting of MDRs. Usually this task would fall on the specification developer, whose name is on the label and generally is responsible for other regulatory obligations. It has not been common for the contract manufacturer to seek an exemption from the MDR reporting requirements.
In July 2011, FDA issued a Warning Letter to Laboratorios B. Braun ("LLB") based on an inspection. During the inspection, FDA noted that the company did not have in place policies and procedures for filing MDRs. LLB had responded stating that it had a quality agreement with B. Braun Medical USA ("BBMU") that established BBMU as the entity responsible for reporting, since LLB was a contract manufacturer. Prior to receipt of the Warning Letter, LLB requested, and FDA granted, an exemption from the MDR reporting requirements. It was only due to the granting of this exemption that FDA found LLB’s response satisfactory. This appears to be the first time that FDA indicated contract manufacturers must seek an exemption from reporting MDRs, even if those responsibilities are assigned in an agreement.
The draft guidance affirms this position, stating that both the firm that manufactured the device (the contract manufacturer) and the firm that initiated the specifications and distributed the device are manufacturers who are required to report. Draft Guidance, at 13. If the firms decide that only one should be responsible for reporting, they should “submit a joint request specifying which firm will submit the reports,” and the exemption request “should provide a description of any agreement between the firms pertaining to MDR reporting for events involving the device.” Most significantly, FDA states that it “may condition [its] approval of such an exemption on agreement by the firm requesting the exemption from reporting to be responsible for ensuring that the required reports are, in fact, submitted to FDA. If Firm A is designated to submit the MDR reports, but failed to do so, [FDA] would consider such a failure to report to be sufficient grounds to revoke Firm B’s exemption from reporting. If revoked, both Firms A and B would be required to report MDR reportable events in compliance with all applicable MDR regulations.” Draft Guidance, at 14. The net effect of this action would be to compel duplicative reports.
This is a surprising position for FDA to take, essentially a “sins of the father shall be visited upon the sons.” A contract manufacturer generally has little ability to control or monitor the regulatory activities of the specification developer for which it is performing the manufacturing, and blaming the contract manufacturer for the specification developer’s failures is not necessary to assure compliance. FDA could simply take enforcement action against the specification developer for failure to report, if necessary. If a specification developer makes a decision in good faith not to report an MDR and FDA disagrees with that decision, FDA is saying it can revoke the exemption of the contract manufacturer on the grounds of its disagreement with the specification developer. This is unprecedented and not necessary to assure compliance with the MDR requirements.
FDA extends this same line of thinking to a foreign manufacturer who seeks an exemption from filing MDR reports when the initial importer agrees to do so: “If the importer is to submit the MDRs, the foreign manufacturer still bears responsibility for ensuring that the importer submits the MDR reports in compliance with all applicable MDR requirements. We would consider such a failure to report to be sufficient grounds to revoke the manufacturer’s exemption from reporting.” Draft Guidance, at 23.
Also in the vein of duplicate reporting, FDA addresses reporting under the IDE requirements versus the MDR requirements. The understanding historically was that an adverse event was either reportable as an MDR or an IDE, depending on the nature of the event, but would not be reported as both. In the draft guidance, FDA states there may be circumstances in which reporting under both schemes would be appropriate: “If a device is legally marketed in the US and is also under IDE, any adverse events that involve the investigational use of the marketed device are subject to reporting under both the IDE regulation and the MDR regulation.” Draft Guidance, at 32. This is inconsistent with prior practice and the regulatory requirements, in which an event would be reported under the IDE regulation only if it arose in the context of the investigation. An event that arose during commercial, non-investigational use would be reported as an MDR, not under the IDE regulation.
The outcome of these changes would be more MDRs. Given the huge volume of MDRs already being submitted and FDA’s difficulties in processing them, it is not clear why the agency wants to encourage duplicate submissions.
In a section titled “Specific Issues and Situations,” FDA attempts to address issues that arise in the reporting of MDRs. The responses to some of the questions posed are so vague and non-specific that they provide no actual guidance, while others take an approach seemingly inconsistent with the regulatory requirements. For example, the first question asks whether MDRs must always be filed for any situation in which a surgery is delayed. FDA begins by repeating the reportability standard, which is not specific to this question and does not provide any useful guidance. FDA then states: “An event should not be considered to be an MDR reportable event solely on the basis of a delay in surgery. For example, a delay of surgery due to the surgical team setting up the wrong size device and requiring time to obtain the correct size device for the patient would not be a reportable event if the patient remains stable with no adverse consequences.” Draft Guidance, at 28. This example is not relevant to the question being addressed. More important, even if the patient did not remain stable, this would not be a reportable malfunction since the device did not actually malfunction—the team simply selected the wrong device, an act which can hardly be attributed to the manufacturer. The implication that a surgical team’s error in choosing a device could be an MDR is startling.
The last example we will address here (though certainly not the last one in the draft guidance that raises questions) is whether an event is reportable if a health care provider intervenes before the malfunctioning device can harm the patient. The draft guidance states: “If the device malfunctions but an alarm alerts the user to intervene before there is any harm to the patient, the event should be reported as a malfunction because of the potential to cause or contribute to a death or serious injury if the malfunction recurred and either the alarm did not work or there was no one to respond.” Draft Guidance, at 35. This may be the most disturbing of all of FDA’s new positions in this draft guidance. First, the draft guidance states this “malfunction” should be reported because of the “potential” to cause or contribute to a death or serious injury. That is not the legal standard for reporting malfunctions. The legal standard is that a manufacturer must report a malfunction only if the malfunction “would be likely” to cause or contribute to death or serious injury if the malfunction were to recur. Although there was a malfunction, because of the alarm functioning properly, the malfunction is not “likely” to meet this standard. (Also, the question assumes that an alarm is automatically associated with a potentially dangerous event.) Second, the example is asking the manufacturer to assume a malfunction that has not occurred, e.g., to assume the alarm will fail in the future. And third, asking a manufacturer to report a malfunction because of the possibility that no one might be present to respond to the alarm is not, by any stretch of the imagination, consistent with the regulatory requirement. The manufacturer cannot be responsible for hospital or clinic staffing of devices with alarms. All the manufacturer is responsible for is assuring its devices work as intended, including that the alarm operates when it is supposed to. If the device has an alarm to alert the user to a potential problem, and the alarm operates as intended, there is no reportable malfunction.
This draft guidance is troubling in the number of new positions FDA stakes out, the potential increase in duplicate reporting, and the “big brother” nature of the relationship FDA is attempting to impose between parties working together by requiring one to assure the regulatory compliance of the other. There is no recognition of the burdens that will be imposed either on FDA or industry. These perspectives are inconsistent with historical understanding of MDR reporting requirements, and some of them are inconsistent with the statutory and regulatory requirements (see the alarm and IDE reporting examples). Try as it might, FDA cannot change regulatory requirements via a guidance.