The Medical Devices Directive (93/42/EEC) has been mandatory since 1997 and stipulates that manufacturers have the legal obligation to report adverse events (Incidents). However, according to European Competent Authorities, medical device incident reporting is on the rise but is still at a level where underreporting is assumed to be widespread.
The issue of medical device Incident Reporting remains a confusing subject for many manufacturers. What to report, what not to report, how to report - none have simple answers. This article will explain what types of medical device Incidents need to be reported to the European Competent Authorities and which do not. While this article will focus on regulations as they pertain to Europe, many of the same principles also apply to the medical device incident reporting rules set forth by the FDA in 21 CFR Part 803 and 804.
Many manufacturers are reluctant to file Incident reports with Competent Authorities, as they may feel doing so is an implicit admission of guilt. But, in fact, the contrary is true. Filing an Incident Report is not a conclusion that the device caused or contributed to the Incident. In fact, your report should make a disclaimer noting this.
The overall purpose of the medical device Incident Reporting process in Europe is not to allocate blame; it is to safeguard the public and prevent problems from (re-)occurring in the future. In Europe, companies are respected for reporting incidents, and this can be perceived as the mark of a responsible corporate citizen. Likewise, competent Authorities are more likely to take the viewpoint of trying to help the manufacturer fix a worrisome situation rather than ostracizing the company for perceived failure. The European system encourages manufacturers to take a more pro-active, rather than reactive, approach.
Of these issues, user errors account for the vast majority of Reports. They, in turn, MIGHT have been caused by improper or poorly translated Labeling and Instructions for Use, but many users do not take the time to read the labeling enclosed, especially if they are repeat users. Therefore, it is crucial for the manufacturer to explicitly state the proper way to use the device as intended, as well as any precautions, warnings, etc.
Aside from the exceptions listed below, any medical device Incident that leads to (or could have caused - that is, Near Incident) death or serious injury must be reported. It should also be noted that Incidents can include omissions of information. For example, if the manufacturer omits a critical step in the Instructions for Use, and failure to perform this step could lead to death or serious injury (even if it has not yet), that is considered a Near Incident and must be reported. One cannot simply reprint the IFU and hope nothing happens with those items already placed on the market.
Sometimes, not enough information will immediately be available to decide whether an event is reportable. For example, perhaps a distributor calls you, the manufacturer, and says a hospital called to report a patient injury related to the use of your product. It is the manufacturer's (or its Authorized Representative, depending on the contract!) responsibility to find out from the hospital the nature of the injury, how it occurred and so on.
The Competent Authority will not accept the argument that the manufacturer was unable to determine if the medical device Incident was reportable because you could not reach an English-speaking person at the hospital in Greece, where the product was used. Enlist the support of your distributor or European Authorized Representative, if needed! You must make a reasonable effort to obtain additional information and do everything possible to retrieve the device.
In any case, you need to take into account the opinion of any healthcare provider that may have been involved, evidence of previous similar incidents and, of course, the results of your own preliminary assessment of the situation in determining whether reporting is needed.
The following occasions do not require you to report the problem to Competent Authorities:
In Europe, the general rule of thumb is that you have 10 calendar days to file an Initial Report to the Competent Authority for an Incident that involves death or serious injury. Near Incidents need to be filed within 30 calendar days.
After you submit an Initial Report to the CA, the authority should acknowledge receipt and classify your report by date, outcome, device type and other factors. Most important, it will provide a date by which your next action is due.
When a CA receives an initial report, it usually doesn't disseminate it to other CAs. If the CA does circulate it, the CA will inform you prior to doing so-but this is unusual. If incidents have occurred in more than one country, normally the CA that received the first initial report will monitor the investigation and communicate with you on behalf of the other CAs. In some cases, the CA in the country where your AR is located may play this role.
The coordinating CA will be in charge of monitoring your investigation, tapping the expertise of your Notified Body, if needed, discussing what correction actions may need to be taken and disseminating details of incidents to other CAs. Keep in mind, however, that this understanding between the CAs in Europe does not preclude any of them from conducting their own monitoring or investigation, and some may choose to do so.
The clock starts ticking the day the manufacturer or his AR (not the distributor) receives notice of the Incident or Near Incident, even if that happens to be on Friday afternoon at 2 p.m. By Monday morning, you're already on Day 4 and it's 4 p.m. in Europe. Act fast.
But let's not forget: If the product caused death or serious injury, it becomes a moral obligation to report it IMMEDIATELY, so no further harm comes to others, if possible. You are also required to submit a final report to the Competent Authority within 30 days of the initial report submission. If a product is privately labeled by an OEM, the manufacturer is considered the manufacturer and responsible for Incident reporting.
Member States of the European Union have different criminal regimens in place for manufacturers that violate the reporting time limits, or intentionally under-report. Contrary to the United States, financial penalties are severe, and France, Germany and the United Kingdom have given jail sentences to repeat or serious first time offenders.
If you are already selling in Europe, you likely have procedures in place for Incident Reporting. The European Union has a guidance document (MEDDEV 2.12-1 rev 6) on developing a Vigilance system, and you should read this carefully to make sure your vigilance system is up to date.
One aspect of your procedures that deserves extra attention is the section that addresses the responsibility of the distributors, AR and outsourced manufacturer (if applicable). Incidents often get reported directly to a Competent Authority (CA) by a user or hospital, or directly reported to the distributor or company. In the case of distributors, they need to be informed about the urgency of passing along these reports to you and to whom within the company they should be directed.
The MEDDEV 2.12-1 rev. 6 provides some guidance for device manufacturers regarding to whom they should report incidents. As a general rule, Incidents should be reported to the Competent Authority of the country in which the incident occurred (unless an implant is involved, in which case the CA in the country where the implant was performed needs to be copied). If a distributor is the AR, it has the same responsibility as an independent, professional AR-including the reporting requirements spelled out in the distribution or AR agreement. If an agreement does not exist, the distributor may get into trouble because the responsibilities are different, if not at odds.
There is a common misconception that if the incident happens outside the European Union, it does not need to be reported to an European CA there. This is an incorrect assumption. If the incident occurs in the United States, for example, and the device (or a similar CE Marked device) is sold in the European Union, the manufacturer is obliged to report to the European CAs. It is possible that the FDA and a European CA may require different courses of action, but neither the FDA nor the CA will defer to each other if recommending a course of action.
If the Incident involves an implant, you should also notify the CA in the country where the implant was performed (if known). You can find an up-to-date list of all CA contacts on the official Europa.eu website.
After the report is filed, the CA is going to want some quantitative data such as the number of devices involved, how long they have been on the market and details of any design changes. The CA also will monitor the direction your investigation is taking, how quickly you are getting things resolved and the outcome.
Your Final Report to the CA will include the outcome of your investigation and how you plan to proceed. That may include initiating a recall, performing additional surveillance on devices in use, disseminating information such as Advisory Notices or nothing at all. Fortunately, Reports can be submitted in English.
Competent Authorities want to work with you to fix problems and prevent them from happening again. As such, they will often consult with you to determine which of the preceding courses of action best suits the situation. If a Corrective Action will be taken or there is a serious risk of injury to a user, the CA will likely disseminate the final report to other CAs. The Final Report will not be made public unless there is an overriding concern for public health that exceeds the obligation of confidentiality.
Your Final Report should be maintained as part of your quality system records and kept on file for the expected life of the device or two years, whichever is greater. Eventually, all of these data will be put on the much anticipated EUDAMED database, which may be operational sometime in 2006/2007.
If you outsource manufacturing, you will need to work quickly and collectively with the contract manufacturer to investigate what may have caused the incident. Regardless of whether the manufacturer owns the design, the manufacturer is responsible for the device you place on the market. If you do not own the design and simply private label the device, things may get tricky if your investigation points to a need for a design change. Remember, you only have 10 calendar days to file an Initial Report to the CA, if death or serious injury has been reported (regardless of whether this turns out to be true). Otherwise, 30 days is the time limit.
Although we are a long way from a harmonized (let alone uniform) global reporting system, the requirements for reporting are rapidly converging. In addition, the upcoming MDD update will legalize or even mandate the rapid exchange of information that could be relevant to public health between, effectively, all OECD countries (30 total to date) and a few more, such as Brazil and Argentina. The idea is to disseminate information among global health authorities faster so if something happens to a patient in Bangkok, it might be prevented more quickly in Berlin or Boston. This is the global village that any company's incident reporting system will have to cope with.
The goal of a medical device vigilance system seems obvious but bears repeating. It is the moral and legal responsibility of the manufacturer to make sure the devices placed on the market are safe. In the long run, trying to hide or downplay incidents will not serve your interests. Be open and communicative with the Competent Authorities, your customers, distributors and your Authorized Representative.
Originally published in June and July 2006, revised in September 2010