The MDR Reporting System Badly Needs Reform: As A First Step, Malfunction MDRs Should Be Eliminated

By Jeffrey K. Shapiro –

In October 2009, the Department of Health and Human Services Office of Inspector General (“OIG”) issued a report entitled, “Adverse Event Reporting for Medical Devices” (“OIG Report”).  The OIG’s Report has not received the attention it deserves.  The OIG report demonstrates that the current system of medical device adverse event reporting is broken and in dire need of reform.

Under FDA’s medical device reporting (“MDR”) regulation (21 C.F.R. Part 803), manufacturers must report a serious injury or death to which their device has or may have caused or contributed.  Manufacturers also must report a device malfunction that would be likely to cause a serious injury or death if it were to recur.  These MDR report typically must be filed within 30 calendar days, except in cases where remedial action is necessary to prevent an unreasonable risk of substantial harm to the public health.  The latter reports must be filed within 5 working days.

The OIG examined manufacturer reporting from 2003 through 2007 (OIG Report, pp. 9 13).  The OIG found that the number of 30 day reports doubled from 64,784 in 2003 to 140,698 in 2007.  The five-day reports were relatively fewer, declining in the same time period from 432 in 2003 to 54 in 2007 (the OIG could not determine the reason for the decline).

The OIG took a careful look at how FDA used this data, and reached a startling conclusion.  The OIG found that FDA: “does not use adverse event reports in a systematic manner to detect and address safety concerns about medical devices.” (OIG Report, p. 13)  There was no qualification or mitigation offered to soften this conclusion.  Simply put, the OIG found that between 2003 and 2007, FDA did not make use of the MDR data to improve device safety.

As the OIG notes, the MDR regulation is intended to enable FDA “to take corrective action on problem devices and to prevent injury and death by alerting the public when potentially hazardous devices are discovered” and “to detect unanticipated events and user errors” (OIG Report, p. 1).  Thus, the OIG’s finding essentially means that FDA’s implementation of the MDR regulation failed to meet the basic purpose of the regulation.

Some of the OIG’s subsidiary findings were equally disheartening.  For instance, the OIG found that FDA’s review of MDR reports was generally untimely.  Of the malfunction reports assigned to an FDA analyst for review, the OIG Report found fewer than 1/3 were read within 30 days, and less than half were read within 60 days.  Even the relatively small numbers of 5 day reports were not read in a timely manner.  From 2003 to 2006, FDA analysts read fewer than 1% of these reports within 5 days of receipt.  In 2007, that figure rose to only 6%.  Yet, the 5 day reports are those that likely represent the most serious risk to public health.  These reports can include what FDA calls “Code Blue” reports of pediatric deaths, multiple deaths, exsanguinations, explosion, fire, burns, electrocutions, and anaphylaxis (OIG Report, pp. 15 16.)

The metrics just noted apply only to reports actually assigned to an FDA analyst for review.  Buried within the OIG report is the astonishing fact that FDA “assigns only 10% of malfunction reports to FDA’s analysts for review.”  (OIG Report, p. 15.)  Thus, it appears that FDA routinely does not review 90% of all malfunction reports received each year.

From all this, it is difficult to escape the conclusion that manufacturers have spent billions of dollars over the years to collect, analyze and report adverse event data for little purpose.  Likewise, Congress has appropriated substantial sums of tax dollars for FDA to review, analyze and manage the data without a measurable public health benefit.  The system seems to have operated on autopilot.

For this reason, it may further be said that the MDR reporting system cannot be credited with the substantial improvement in medical device safety that has taken place during the past 26 years.  These improvements have taken place in the absence of meaningful FDA oversight based upon MDR reporting.  One wonders why we needed an expensive system of mandatory reporting to populate a data warehouse that FDA has rarely visited, much less used in the manner envisioned by proponents of mandatory reporting.

The OIG investigation was limited to the period from 2003 to 2007.  It seems unlikely, however, that FDA operated more effectively prior to 2003 or achieved a sudden radical improvement after 2007.  FDA did not publicly dispute the OIG’s findings or suggest that they are already obsolete, even though the OIG Report was not issued until October 2009.

The OIG carefully notes that the conclusion about FDA’s use of adverse event reports rested upon lack of documentation.  So, it is theoretically possible that FDA actually has made effective use of the data.  But there is no evidence that the agency has done so.  Sound public policy is not built on mere speculation and anecdote.  It is FDA’s responsibility to demonstrate that it systematically uses MDR reports to benefit the public health.  According to the OIG, the proof is completely lacking.

It would be a wasted opportunity if the OIG's examination of the problems with the MDR reporting system does not result in useful reform.  There can be no justification for continuing to operate an expensive and time consuming mandatory reporting system on the basis of good intentions rather than actual results.

The OIG does make some recommendations, primarily that FDA should document follow up on adverse events and should ensure and document that CDRH does a better job of meeting its existing guidelines for reviewing 5‑day and Code Blue adverse event reports.  But these recommendations do not get to the heart of the matter.

The most useful immediate reform would be to eliminate the requirement for malfunction reporting.  As the OIG found, FDA analysts have read only a tiny percentage of malfunction reports, so no one can argue that these reports provide essential information that has allowed FDA to systematically address safety problems.  Rather, the evidence is that FDA has not been reviewing most of them in a timely fashion or making systematic use of them to improve device safety.  In addition, because complaints about medical devices can allege all kinds of malfunctions, it is these reports that make up the largest volume of MDR reports that manufacturers must file.  Many of these reports constitute “noise” that, if FDA were actually to analyze them, would obscure more than they illuminate about the safety of medical devices in use today.  Thus, it seems unlikely that malfunction reports could ever be made useful to the agency.

Malfunction reports also create complexities for manufacturers, who must wrestle with determining if a complaint is a malfunction (not all are), and whether a malfunction is reportable because it would be “likely” to cause injury or death if it were to recur.  This latter determination in many cases involves making a difficult and subjective probability prediction.  On the other side of the coin, FDA uses valuable inspectional resources in determining whether malfunction MDRs should have been submitted.  There is something peculiar about a system in which FDA spends compliance resources to inspect files for non-submission of malfunction MDRs which are then submitted, at great cost and effort, and not used by FDA in any meaningful or systematic fashion.

Thus, malfunction reports have generated much of the expensive and complexity of the current system, but have provided little or no benefit.  By contrast, an MDR reporting system that focused on the possible contribution of devices to actual serious injuries or deaths would be easier for FDA to administer, and would more reliably alert FDA to true safety problems.  The smaller resulting data set might also improve the odds that FDA could actually review all of the reports it receives in a timely manner and take action when appropriate. 

In theory it might have been a good idea for FDA to be given malfunction information to help it anticipate device safety problems. But in reality there is no evidence that the system actually operates according to this theory, and the OIG Report provides substantial evidence that it does not. Those who would defend the current malfunction reporting requirement bear the burden of proving that these reports can actually be used to improve medical device safety. If they cannot meet this burden, it is time to try a new approach.