FDA Issues Report on Medical Device Servicing, Declining to Impose New Regulatory Requirements For Now

On May 15, FDA issued a Report on the Quality, Safety, and Effectiveness of Servicing of Medical Devices in which FDA concludes that it will not impose additional or different regulatory requirements on the third-party servicers of medical devices at this time.

FDA issued this Report in response to a call from Congress in the Food and Drug Administration Reauthorization Act of 2017 (FDARA). Section 710 of FDARA required FDA to issue a report on the continued quality, safety, and effectiveness of medical device servicing.

The Report begins by stating that “[t]he availability of timely, cost effective, quality maintenance and repair of medical devices is critical” to the U.S. healthcare system. However, the Report explains, some have “expressed concerns about the quality of servicing provided by some third party entities,” such as allegations regarding use of poor quality replacement parts, inadequate training, and failure to restore devices to specifications.

The Report then describes existing authorities and regulations regarding device servicing and FDA’s findings from a 2016 request for public comment and public workshop on this topic. In March 2016, FDA published a Federal Register notice requesting public comment on the topic of refurbishing, reconditioning, rebuilding, remarketing, remanufacturing, and servicing of medical devices performed by third-party entities and original equipment manufacturers (OEMs) (see previous blog post here). The notice did not announce any proposed regulatory scheme; rather, it listed questions designed to gather information from stakeholders on the possible burdens and public health issues related to maintaining or restoring devices to their original or current specifications.  Several months later, FDA announced a public workshop on this topic, which was held in October 2016.

In response to the request for public comment, the Report summarizes, stakeholders identified common elements that influence the quality of activities by medical device service providers, such as the presence of a quality management system, training of the service providers, availability and use of quality replacement parts, and access to device-specific information. At the public workshop, stakeholders provided differing opinions about the servicing performed by OEMs and third-party entities.  OEM stakeholders emphasized the need for mandatory regulatory requirements on third-party entities that provide device servicing, while third-party entities cited a lack of evidence that the current voluntary implementation of quality systems by third-party entities resulted in improper servicing.

The Report also describes FDA’s review of additional evidence regarding medical device servicing from other sources, such as peer-reviewed literature, Medical Device Reports, and complaints and allegations of regulatory misconduct.

The Report states that “[t]he currently available objective information is not sufficient to conclude whether or not there is a widespread public health concern related to servicing, included by third party servicers, of medical devices that would justify imposing additional/different, burdensome regulatory requirements at this time.”

Despite the conclusion not to impose new regulatory requirements related to device servicing, the Report does include plans for some proactive measures by the Agency. In particular, FDA intends to pursue the following actions:

1. Promote the adoption of quality management principles by medical device servicers;
2. Clarify the difference between servicing and remanufacturing;
3. Strengthen cybersecurity practices associated with servicing of medical devices; and
4. Foster evidence development to assess the quality, safety, and effectiveness of medical device servicing.

On the first action, promotion of quality management principles, the Report states that FDA intends to “work with entities performing medical device servicing to identify the essential elements of a voluntary medical device servicing quality framework.” The Report clarifies that FDA does not view this as a “formal regulatory approach mandating adoption” of the Quality System Regulation (QSR).  Though, the Report does not describe how FDA intends to work with entities or whether FDA plans to issue guidance on this issue.

Regarding the second action, clarifying the difference between servicing and remanufacturing, the Report explains that a significant portion of the comments and complaints that FDA received about inadequate device servicing pertain to activities that are more accurately described as device remanufacturing. Because remanufacturing activities, unlike servicing activities, must comply with the QSR, FDA determined that it needs to clarify the difference between servicing and remanufacturing.  FDA intends to publish draft guidance on this topic for public comment.

On the third action, strengthening cybersecurity practices, the Report explains that servicing of devices by third-party entities raises specific cybersecurity challenges related to the third-party entities’ need for privileged access to perform diagnostic, maintenance, and repair functions. The Report states that OEMs, healthcare establishments, and third-party servicers lack the necessary cybersecurity expertise to ensure the “appropriate level of cybersecurity resilience associated with the servicing of medical devices.”  The Report states that the development of standards and best practices could help mitigate cybersecurity risks.  However, the Report does not state how FDA intends to be involved in development of such standards or best practices.

Finally, the fourth action, regarding fostering evidence development to assess medical device servicing, is a response to FDA’s conclusion that the currently available objective evidence is insufficient to conclude whether or not there is a public health concern related to device servicing. The Report states that, because entities engaged in servicing activities have access to relevant information about the quality, safety, and effectiveness of medical device servicing, “any concerted data collection and analysis effort should be a multi-stakeholder enterprise.”  The Report does not contain any concrete plans for a concerted data collection and analysis effort.

The Report concludes by stating that there may be value in creating a public-private forum to address the challenges with delivering quality, safe, and effective servicing of medical devices. FDA states that, if there is sufficient interest and willingness to participate from stakeholders, FDA would facilitate the creation of such a forum.  Considering the active participation by stakeholders in all opportunities to provide public comment to FDA so far, it is likely that stakeholders will pursue FDA’s invitation to shape future regulatory action related to device servicing.

* Law Clerk