FDA Tones Down MDR Reporting Recommendations in its Final Guidance

By Jennifer D. Newberger –

Though we are certain it was not only our blog post on the draft Medical Device Reporting ("MDR") guidance that persuaded FDA not to adopt some of the positions it proposed in its Draft Guidance, Medical Device Reporting for Manufacturers (July 2013), we were pleased to see that some of the issues we considered to be most egregious in the draft are absent from the final guidance, issued on November 8, 2016.

One such example pertains to the issue of duplicate reporting between contract manufacturers and specification developers. In the draft guidance, FDA stated,

For devices manufactured under contract, both the firm that actually manufactured the device (“Firm A”) and the firm that initiated the specifications and distributed the device (“Firm B”) are considered a “manufacturer” based on the definition of that term in 21 CFR 803.3. Under 21 CFR 803.3, both the firm that manufactures the device and the firm that initiates the specifications for the device are manufacturers who are required to report. Under 21 CFR 803.10(c), a manufacturer is required to submit reports. Thus, both Firms A and B are responsible for filing reports on MDR reportable events involving their device.

The final guidance takes a position directly in contrast to that above, stating:

The MDR regulation at 21 CFR 803.3 defines a “manufacturer” to include a firm that initiates specifications for devices that are manufactured by a second party for subsequent distribution by the person initiating the specifications. A contract manufacturer who does not distribute or market the devices it manufactures for a specifications developer would not have an MDR reporting obligation under 21 CFR 803.50 and would not require an exemption. However, if the contract manufacturer (Firm A) distributes or markets the devices that it manufactures for the specifications developer (Firm B), then both would have an MDR reporting obligation.

Final Guidance, at 14 (emphasis added).

We should note at the outset that we are pleased with the outcome of this position, as it means that contract manufacturers and specifications developers can continue doing what has been done for year—describe their reporting obligations via contract. While the outcome is a positive one, we do remain puzzled by how FDA reached its conclusion. The bolded language is not only inconsistent with the position put forth by FDA in the draft guidance, but it appears to be inconsistent with the literal language of the regulation, as well as the position FDA has taken in Warning Letters issued prior to the draft guidance. As we noted in our blog post on the draft guidance, in 2011, FDA issued a Warning Letter to Laboratorios B. Braun (LBB), stating that LBB, as a contract manufacturer, had failed to comply with the MDR requirements, even though LBB had a contract with B. Braun Medical US (BBMUS) stating that BBMUS was responsible for reporting. The letter does not specify whether LBB or BBMUS distributed the product in question; FDA’s conclusion was based solely on the fact that LBB “is a contract manufacturer and is required to have established procedures addressing the evaluation of complaints and filing of MDRs.”

Given FDA’s prior positions regarding the reporting obligations of contract manufacturers, and the notable absence of an exemption from the reporting requirements for an entity that contract manufactures, but does not distribute the device, the basis for FDA’s conclusion that such facilities are not required to report is unclear. Nevertheless, as noted, the language in the final guidance represents a good outcome for industry: contract manufacturers do not need to report, and do not need to seek an exemption to avoid doing so.

Next up, the two year presumption. The MDR regulation presumes that once a malfunction has caused or contributed to a death or serious injury, the malfunction is “likely” to do so again if the malfunction were to recur. In its 1997 guidance, FDA stated that the “presumption will continue until the malfunction has caused or contributed to no further deaths or serious injuries for two years, or the manufacturer can show, through valid data, that the likelihood of another death or serious injury as a result of the malfunction is remote.” The draft guidance did away with this two year presumption, and instead proposed that companies submit requests for exemptions from further reporting of the malfunction. The two year presumption has been reintroduced—with some caveats—in the final, which states: “FDA recommends that you submit a notification to FDA with a summary of the data and the rationale for your decision to cease reporting at the end of two years.” Final Guidance, at 13. Such notification has never before been “recommended,” and is not part of the regulations. We would expect that companies will not follow this recommendation moving forward, but will instead continue to operate as they did under the 1997 guidance, and will stop reporting a malfunction when the malfunction has caused or contributed to no further deaths or serious injuries for two years.

FDA also walked back on its position about devices that alarm prior to a malfunction, thereby allowing a clinician to intervene before the occurrence of an adverse event. In the draft guidance, FDA stated that “[i]f the device malfunctions but an alarm alerts the user to intervene before there is any harm to the patient, the event should be reported as a malfunction because of the potential to cause or contribute to a death or serious injury if the malfunction recurred and either the alarm did not work or there was no one to respond.” We found this example to be one of the most egregious in the draft guidance. It has been modified in the final to remove any mention of alarms, and instead merely repeats the regulatory standard to report the event if the malfunction is likely to cause or contribute to a death or serious injury if the malfunction recurred. Final Guidance, at 34. We hope that this modification means FDA agrees that an alarm sounding with no one to respond does not constitute a device malfunction.

One good thing thrown into the final guidance is the relationship between user error and the obligation to report user error as an MDR. Both the draft and the final guidances state that user error could “reflect problems with device labeling, the user interface, or other aspects of device design,” and should therefore “be reported in the same way as other adverse events which are caused or contributed to by the device.” A question that companies often grapple with is whether user error should be considered a “malfunction” such that they are required to assess whether a recurrence of that user error would be likely to cause or contribute to death or serious injury, and therefore report the error. The final guidance includes one sentence that was not in the draft, and that seems to answer this question: “If you determine that an event is solely the result of user error with no other performance issue, and there has been no device-related death or serious injury, you are not required to submit an MDR report, but you should retain the supporting information in your complaint files.” This implies that user error that results in a malfunction is not, on its own, likely to require MDR reporting, which is good news for device manufacturers.

Overall, the final guidance is an improvement over the draft. To the extent there are still some areas in which FDA seems to be recommending more reporting than prior policy or guidance (e.g., two year presumption), manufacturers—and FDA—must keep in mind that guidance documents are not the law, and a manufacturer’s failure to follow the suggestions put forth in the final guidance do not equate to a failure to properly file MDR reports, or otherwise comply with the regulation.