Medical Device Incident Reporting in Europe

The Medical Devices Directive (93/42/EEC) has been mandatory since 1997 and stipulates that manufacturers have the legal obligation to report adverse events (Incidents). However, according to European Competent Authorities, medical device incident reporting is on the rise but is still at a level where underreporting is assumed to be widespread.

The issue of medical device Incident Reporting remains a confusing subject for many manufacturers. What to report, what not to report, how to report - none have simple answers. This article will explain what types of medical device Incidents need to be reported to the European Competent Authorities and which do not. While this article will focus on regulations as they pertain to Europe, many of the same principles also apply to the medical device incident reporting rules set forth by the FDA in 21 CFR Part 803 and 804.

To Report or Not to Report

Many manufacturers are reluctant to file Incident reports with Competent Authorities, as they may feel doing so is an implicit admission of guilt. But, in fact, the contrary is true. Filing an Incident Report is not a conclusion that the device caused or contributed to the Incident. In fact, your report should make a disclaimer noting this.

The overall purpose of the medical device Incident Reporting process in Europe is not to allocate blame; it is to safeguard the public and prevent problems from (re-)occurring in the future. In Europe, companies are respected for reporting incidents, and this can be perceived as the mark of a responsible corporate citizen. Likewise, competent Authorities are more likely to take the viewpoint of trying to help the manufacturer fix a worrisome situation rather than ostracizing the company for perceived failure. The European system encourages manufacturers to take a more pro-active, rather than reactive, approach.

Following are some triggers of medical device incident reports:

  1. Failure of a device to perform its intended purpose, even though the manufacturer's instructions were followed
  2. A poor or inadequate design, or manufacturing of the device
  3. Labeling or Instructions for Use that are unclear, poorly written or omit vital information needed to operate the device
  4. A public health issue that becomes a large scale public concern (eg, AIDS, H5N1 bird flu)
  5. New information that becomes available from testing, scientific research, etc
  6. User error
     

Of these issues, user errors account for the vast majority of Reports. They, in turn, MIGHT have been caused by improper or poorly translated Labeling and Instructions for Use, but many users do not take the time to read the labeling enclosed, especially if they are repeat users. Therefore, it is crucial for the manufacturer to explicitly state the proper way to use the device as intended, as well as any precautions, warnings, etc.

What Needs to Be Reported?

Aside from the exceptions listed below, any medical device Incident that leads to (or could have caused - that is, Near Incident) death or serious injury must be reported. It should also be noted that Incidents can include omissions of information. For example, if the manufacturer omits a critical step in the Instructions for Use, and failure to perform this step could lead to death or serious injury (even if it has not yet), that is considered a Near Incident and must be reported. One cannot simply reprint the IFU and hope nothing happens with those items already placed on the market.

Sometimes, not enough information will immediately be available to decide whether an event is reportable. For example, perhaps a distributor calls you, the manufacturer, and says a hospital called to report a patient injury related to the use of your product. It is the manufacturer's (or its Authorized Representative, depending on the contract!) responsibility to find out from the hospital the nature of the injury, how it occurred and so on.

The Competent Authority will not accept the argument that the manufacturer was unable to determine if the medical device Incident was reportable because you could not reach an English-speaking person at the hospital in Greece, where the product was used. Enlist the support of your distributor or European Authorized Representative, if needed! You must make a reasonable effort to obtain additional information and do everything possible to retrieve the device.

In any case, you need to take into account the opinion of any healthcare provider that may have been involved, evidence of previous similar incidents and, of course, the results of your own preliminary assessment of the situation in determining whether reporting is needed.

What Does NOT Need to Be Reported?

The following occasions do not require you to report the problem to Competent Authorities:

  1. Problems found by a user before the device is used on a patient, except if failure to make such an observation could have led to damage to the patient. This also means deficiencies that would always be detected by a user prior to use - for example, a missing connector on a catheter that would prevent its use.
  2. Incidents caused by a patient or user. However, you must be able to prove that the device operated as intended and therefore did not cause the Incident or Near Incident (user error). However, if too many similar user errors happen, this should lead to a reappraisal of the risk analysis and perhaps to a reformulation of the label contents.
  3. Expired shelf life or service life. If the Incident was caused because the device exceeded its serviceable life or shelf life, and that limit was clearly specified, there is no need to report.
  4. Malfunction protection worked as planned. If your device has a built-in design feature that prevents a malfunction from becoming a hazard, and no death or serious inquiry resulted, you don't need to report it (this is known as "single fault").
  5. Expected side effects stated in the labeling text. If your device may lead to expected and foreseen side effects and they are clearly noted to the user, you do not need to report incidents resulting from those side effects as long as the device functioned properly.
  6. You have already issued an Advisory Notice. In most cases, you do not need to file individual reports but only need to provide summary reports as determined by the Competent Authority.

How Much Time Do You Have to Report?

In Europe, the general rule of thumb is that you have 10 calendar days to file an Initial Report to the Competent Authority for an Incident that involves death or serious injury. Near Incidents need to be filed within 30 calendar days.

After you submit an Initial Report to the CA, the authority should acknowledge receipt and classify your report by date, outcome, device type and other factors. Most important, it will provide a date by which your next action is due.

When a CA receives an initial report, it usually doesn't disseminate it to other CAs. If the CA does circulate it, the CA will inform you prior to doing so-but this is unusual. If incidents have occurred in more than one country, normally the CA that received the first initial report will monitor the investigation and communicate with you on behalf of the other CAs. In some cases, the CA in the country where your AR is located may play this role.

The coordinating CA will be in charge of monitoring your investigation, tapping the expertise of your Notified Body, if needed, discussing what correction actions may need to be taken and disseminating details of incidents to other CAs. Keep in mind, however, that this understanding between the CAs in Europe does not preclude any of them from conducting their own monitoring or investigation, and some may choose to do so.

The clock starts ticking the day the manufacturer or his AR (not the distributor) receives notice of the Incident or Near Incident, even if that happens to be on Friday afternoon at 2 p.m. By Monday morning, you're already on Day 4 and it's 4 p.m. in Europe. Act fast.

But let's not forget: If the product caused death or serious injury, it becomes a moral obligation to report it IMMEDIATELY, so no further harm comes to others, if possible. You are also required to submit a final report to the Competent Authority within 30 days of the initial report submission. If a product is privately labeled by an OEM, the manufacturer is considered the manufacturer and responsible for Incident reporting.

What Happens If You Do Not Report?

Member States of the European Union have different criminal regimens in place for manufacturers that violate the reporting time limits, or intentionally under-report. Contrary to the United States, financial penalties are severe, and France, Germany and the United Kingdom have given jail sentences to repeat or serious first time offenders.

Guidance for Reporting

If you are already selling in Europe, you likely have procedures in place for Incident Reporting. The European Union has a guidance document (MEDDEV 2.12-1 rev 6) on developing a Vigilance system, and you should read this carefully to make sure your vigilance system is up to date.

One aspect of your procedures that deserves extra attention is the section that addresses the responsibility of the distributors, AR and outsourced manufacturer (if applicable). Incidents often get reported directly to a Competent Authority (CA) by a user or hospital, or directly reported to the distributor or company. In the case of distributors, they need to be informed about the urgency of passing along these reports to you and to whom within the company they should be directed.

Communicating the News

The MEDDEV 2.12-1 rev. 6 provides some guidance for device manufacturers regarding to whom they should report incidents. As a general rule, Incidents should be reported to the Competent Authority of the country in which the incident occurred (unless an implant is involved, in which case the CA in the country where the implant was performed needs to be copied). If a distributor is the AR, it has the same responsibility as an independent, professional AR-including the reporting requirements spelled out in the distribution or AR agreement. If an agreement does not exist, the distributor may get into trouble because the responsibilities are different, if not at odds.

There is a common misconception that if the incident happens outside the European Union, it does not need to be reported to an European CA there. This is an incorrect assumption. If the incident occurs in the United States, for example, and the device (or a similar CE Marked device) is sold in the European Union, the manufacturer is obliged to report to the European CAs. It is possible that the FDA and a European CA may require different courses of action, but neither the FDA nor the CA will defer to each other if recommending a course of action.

If the Incident involves an implant, you should also notify the CA in the country where the implant was performed (if known). You can find an up-to-date list of all CA contacts on the official Europa.eu website.

What Happens Next?

After the report is filed, the CA is going to want some quantitative data such as the number of devices involved, how long they have been on the market and details of any design changes. The CA also will monitor the direction your investigation is taking, how quickly you are getting things resolved and the outcome.

Your Final Report to the CA will include the outcome of your investigation and how you plan to proceed. That may include initiating a recall, performing additional surveillance on devices in use, disseminating information such as Advisory Notices or nothing at all. Fortunately, Reports can be submitted in English.

Competent Authorities want to work with you to fix problems and prevent them from happening again. As such, they will often consult with you to determine which of the preceding courses of action best suits the situation. If a Corrective Action will be taken or there is a serious risk of injury to a user, the CA will likely disseminate the final report to other CAs. The Final Report will not be made public unless there is an overriding concern for public health that exceeds the obligation of confidentiality.

Your Final Report should be maintained as part of your quality system records and kept on file for the expected life of the device or two years, whichever is greater. Eventually, all of these data will be put on the much anticipated EUDAMED database, which may be operational sometime in 2006/2007.

Involvement of Outsourced Manufacturers

If you outsource manufacturing, you will need to work quickly and collectively with the contract manufacturer to investigate what may have caused the incident. Regardless of whether the manufacturer owns the design, the manufacturer is responsible for the device you place on the market. If you do not own the design and simply private label the device, things may get tricky if your investigation points to a need for a design change. Remember, you only have 10 calendar days to file an Initial Report to the CA, if death or serious injury has been reported (regardless of whether this turns out to be true). Otherwise, 30 days is the time limit.

Towards a Global Reporting System?

Although we are a long way from a harmonized (let alone uniform) global reporting system, the requirements for reporting are rapidly converging. In addition, the upcoming MDD update will legalize or even mandate the rapid exchange of information that could be relevant to public health between, effectively, all OECD countries (30 total to date) and a few more, such as Brazil and Argentina. The idea is to disseminate information among global health authorities faster so if something happens to a patient in Bangkok, it might be prevented more quickly in Berlin or Boston. This is the global village that any company's incident reporting system will have to cope with.

Preventing Future Incidents

The goal of a medical device vigilance system seems obvious but bears repeating. It is the moral and legal responsibility of the manufacturer to make sure the devices placed on the market are safe. In the long run, trying to hide or downplay incidents will not serve your interests. Be open and communicative with the Competent Authorities, your customers, distributors and your Authorized Representative.

Originally published in June and July 2006, revised in September 2010