Less than Meets the Eye: LDT Small Entity Compliance Guide Adds Little Insight

In its final rule on laboratory developed tests (LDTs) (see our prior blog here), FDA acknowledged that “some laboratories may lack familiarity, experience, or existing infrastructure for complying with FDA requirements” and made multiple references to a “small entity compliance guidance” that the agency intended to publish to “provide additional guidance to small businesses.”  Laboratories struggling to understand the myriad implications of being regulated as device “manufacturers” were hopeful that additional guidance would shed light on how to apply FDA’s existing medical device regulatory framework to their operations.

Unfortunately, the guidance for small entities recently published by FDA is little more than a summary digest of the multi-hundred-page final rule. The guidance restates the central premise of the final rule, i.e., that LDTs are medical devices and the clinical laboratories that design, manufacture and use them to test patient specimens are manufacturers.  It then reiterates the process and timeframe for phaseout of generalized enforcement discretion for LDTs, lists the categories of LDTs that will, to varying degrees, continue to be subject to enforcement discretion, and repeats that “certain tests” that were historically excluded from enforcement discretion —those offered directly to consumers, those used in blood and tissue donor screening, and those intended for use in public health emergencies — will continue to be ineligible for enforcement discretion.   The guidance also reminds readers of the somewhat illusory protection offered by enforcement discretion, noting that “FDA retains discretion to pursue enforcement action for violations of the FD&C Act at any time and intends to do so when appropriate.”

To be sure, Table 2 provides a handy visual of the categories of LDTs, the timeline for phaseout, and the scope of enforcement discretion for each test category.  However, the guidance provides no new information on how FDA expects laboratories to implement these new requirements.  Section IV, Additional Resources, provides links to previously-issued guidance documents and other educational materials geared to traditional device manufacturers, with no additional commentary on how to apply these requirements to the very different clinical laboratory environment.

The first phaseout milestone is less than a year away; by May 6, 2025 most laboratories will need to demonstrate compliance with Medical Device Reporting (21 C.F.R. § 803), Reporting of Corrections and Removals (21 C.F.R. § 806) and Complaint Files (21 C.F.R. § 820.198).  Below we describe the specific requirements that clinical laboratories will need to meet and identify interpretive questions that may pose challenges to implementation.

Complaint Handling

CLIA regulations, with which all clinical laboratories must already comply, state that a clinical laboratory must “have a system in place to ensure that it documents all complaints and problems reported to the laboratory,” and must “conduct investigations of complaints, when appropriate”.[1] However, the focus of CLIA requirements is on laboratory processes, not specific assays. Furthermore, CLIA regulations are more general and provide more opportunity for customization of complaint handling processes provided the underlying objectives are met.  The CLIA State Operations Manual (SOM) which provides interpretive guidance to investigators conducting laboratory surveys, states that an inspector should “[v]erify that the laboratory documents all complaints and problems reported to the laboratory, and that it has a mechanism to determine which complaints require investigation.” The SOM includes three “probes” to guide evaluation, which focus on (1) the mechanism used by the laboratory to enable individuals to report complaints or problems to the laboratory; (2) the laboratory’s process for informing laboratory personnel of the ability to anonymously report laboratory quality complaints to outside agencies; and (3) the laboratory’s mechanism for referring complaints or problems to its reference laboratory(s), or other offices or agencies, when appropriate, as well as whether the such activity is documented.

Like CLIA, FDA requires device manufacturers to have written procedures that define the complaint handling process and to maintain the complaint files in accordance with their own developed procedures.  However, FDA’s complaint handling requirements for device manufacturers are more detailed and prescriptive in nature, and it is not clear whether they will in practice align with laboratories’ existing complaint handling procedures; FDA may find laboratories’ existing processes insufficient or may impose different or conflicting requirements that increase administrative burdens.

FDA regulations define a complaint expansively, to include “any written, electronic, or oral communication that alleges deficiencies related to the identity, quality, durability, reliability, safety, effectiveness, or performance of a device after it is released for distribution.”[2]  The regulations require manufacturers to establish a “formally designated [complaint handling] unit,”[3] which can be accomplished by describing the unit in a procedure and/or including a diagram that identifies individuals, activities, and departments that are charged with “…receiving, reviewing, and evaluating” complaints.[4] Manufacturers maintain complaint files for a “period of time equivalent to the design and expected life of the device, but in no case less than 2 years from the date of release for commercial distribution”  consistent with regulatory requirements for record retention.[5]  In contrast to traditional medical device manufacturers, laboratories do not “commercially release” an IVD device but instead report results based on the performance of the LDT.  It is therefore unclear what the “life expectancy” of an LDT is or when the “commercial distribution” of an LDT begins for the purpose of maintaining complaint files.

As discussed below, complaint handling is closely tied to FDA’s medical device reporting (MDR) and corrective and preventive action (CAPA) requirements.  Laboratories should therefore expect that FDA auditors will, in addition to reviewing complaint handling, also evaluate MDR processes and decisions and consider whether a complaint should have triggered a CAPA.  If a laboratory determines that a complaint does not require further investigation, it will need to document the “reason no investigation was made and the name of the individual responsible for the decision” in the complaint file.[6]  If the laboratory determines that investigation is required, the record of the investigation “shall be maintained by the formally designated unit.”[7]

FDA regulations require specific information to be recorded in complaint files, including, at a minimum: the name of the device, date of the complaint, unique device identifier (UDI), name, address, phone number of the complainant, nature and details of the complaint, dates and results of the investigation, any corrective action taken, and any reply to the complainant. Laboratories will need to ensure the complaints are processed in a “uniform and timely manner.”[8]  Laboratories will need to develop written procedures for complaint handling.  Failure to handle complaints in a consistent and timely manner can be cited as a nonconformance during an FDA inspection. Laboratories will therefore need to describe what does, and does not, constitute a complaint about the LDT. Training of personnel in the “designated complaint handling unit” on FDA requirements for complaint handling will be critical to ensure consistent complaint evaluations.  Timeliness is critical not only for developing appropriate corrective actions but also for evaluating and, when necessary, submitting reportable events to FDA as discussed below.

Medical Device Reporting

In the preamble to the final LDT rule, FDA stated it intends to develop additional education resources for MDR reporting to assist laboratories in coming into compliance with these requirements.  Merely providing links to existing MDR training materials for traditional device manufacturers, as the new compliance guide does, fails to meet FDA’s stated objective.  As stated above, while CLIA requires to have processes for detecting problems, these processes focus on detecting and addressing errors by the laboratory, and not on a specific test in isolation.

The MDR regulations require device manufacturers to “report deaths and serious injuries that your device has or may have caused or contributed to . . .  report certain device malfunctions, and . . . establish and maintain adverse event files.”[9]  The regulations define a “malfunction” as a “failure of a device to meet its performance specifications or otherwise perform as intended.”[10]  Performance specifications “include all claims made in the labeling for the device,” and “the intended performance of a device refers to the intended use for which the device is labeled or marketed.”[11]

In the context of an LDT, it is unclear what FDA will include within the scope of “labeling” and what types of communications will be considered “claims.”  At a minimum, the laboratory report, which typically includes patient information, specimen type, test results, reference ranges, and test interpretation, would foreseeably be considered test labeling, and statements made therein, or by laboratory personnel about the test report, could be considered evidence of the LDT’s intended use.  Treating the test report as labeling could, however, interfere with the laboratory director’s duty to ensure that “consultation is available to the laboratory’s clients on matters relating to the quality of the test results reported and their interpretation concerning specific patient conditions” and could have a chilling effect on the laboratory director’s ability to provide meaningful guidance to healthcare providers about their patients’ test results.[12]

Reporting under the MDR regulation is required within 30 calendar days of “becoming aware” of such an event, unless remedial action is necessary to prevent unreasonable risk of substantial harm to the public health, in which case reporting must occur within 5 work days.[13]   A manufacturer is considered to “become aware” of an event when any of its employees become aware of a reportable event.  It will therefore be imperative that any laboratory employees who receive complaint information notify the group responsible for evaluating such reports as soon as possible.  Given the short timeframe for submitting an MDR, some of the facts surrounding an event may not be known at the time of the initial report, in which case laboratories will need to file supplemental MDR reports.

Laboratories will be responsible for developing MDR procedures, training employees on MDR requirements, training the complaint-handling employees on recognizing and evaluating MDR reportable events, and developing MDR event files.  The learning curve for laboratories will presumably be steep; even seasoned device manufacturers can find themselves at odds with FDA about whether an MDR should have been filed with the agency following an event, so revisions to policies and further training of personnel should be expected.

MDRs must be reported to FDA in electronic format.  Laboratories will need to develop an electronic means of submitting said reports to FDA well in advance of the reporting requirements to ensure they are ready to report as of May 6, 2025.  Laboratories will also need to become familiar with the various codes used in MDR reports.   FDA has seven categories of MDR adverse event codes, and laboratories will need to become familiar with the codes and how to apply them to any adverse events or malfunctions of the device. The codes are organized in a “tree-like hierarchical structure, where higher-level codes are more generic, while lower-level codes are more specific.”[14]

Reports of Corrections and Removals

The final rule also requires most clinical laboratories to begin submitting reports of corrections and removals, and to maintain records of all corrections and removals, whether or not reported, beginning May 6, 2025.  A “correction” means “the repair, modification, adjustment, relabeling, destruction, or inspection (including patient monitoring) of a device without its physical removal from its point of use to some other location.”[15]  A “removal” means the “physical removal of a device from its point of use to some other location for repair, modification, adjustment, relabeling, destruction, or inspection.”[16]  A correction or removal must be reported to FDA within 10 working days of its initiation, if it was initiated, to “reduce a risk to health posed by the device” or to “remedy a violation of the act caused by the device which may present a risk to health . . . .”.[17]   A “risk to health” means a “reasonable probability that use of, or exposure to, the product will cause serious adverse health consequences or death”; or that “use of, or exposure to, the product may cause temporary or medically reversible adverse health consequences, or an outcome where the probability of serious adverse health consequences is remote.”[18]

Attempting to apply these regulations to LDTs seems, at least on first consideration, an exercise in fitting a square peg in a round hole.  It is by no means obvious what terms such as “repair,” “destruction,” “inspection,” or “physical removal” means in the context of an LDT, which is not a discrete physical object and which does not ever leave the confines of the laboratory.

Even where a correction or removal does not meet the threshold for reporting, a manufacturer must maintain records that include information about the brand name, common or usual name, classification, name and product code if known, and the intended use of the device; the UDI or other identifier used for the device; a description of the event(s) giving rise to the information reported and the corrective or removal action taken; the justification for not reporting the correction or removal action to FDA; and a copy of all communications regarding the correction or removal.  LDTs, however, many do not have a brand name, common or usual name, applicable product code, or a unique identifier.

In addition to the FDA, manufacturers must communicate corrections and removals to the consignees, i.e., the customers to whom a device was distributed.  For corrections and removals reported to the FDA, device manufacturers also must provide FDA a copy of the communication that sent to the consignees that describes the actions they need to take (e.g., return of the device) and when corrections will be implemented.  In the case of LDTs, however, it is unclear who the “consignee” is, since, as noted above, the LDT does not leave the laboratory.  If the consignee is the laboratory performing the LDT, then the laboratory would be required to, essentially, notify itself of the correction or removal and provide FDA a copy of the communication it sends to itself.

Records of corrections and removals must be retained for a “period of 2 years beyond the expected life of the device.”[19] It is unclear how the “expected life” of an LDT would be established; the life of an LDT performed on a specific specimen arguably ceases when the assay is completed, but the LDT test protocol used to perform the specific assay arguably continues to exist as long as the laboratory continues to perform it.

Labeling

We note that while labeling requirements are not being phased in until stage 2 (May 6, 2026), the regulatory requirements in stage 1 appear to assume that at least some labeling requirements – such as UDI, which must be included in complaint files –  will already be implemented). With respect to the UDI requirement, FDA regulations require them to be placed on the device “label.”  But, similar to the challenges noted above regarding interpretation of the term “labeling” for MDR purposes, it is not clear what would constitute the “label” of an LDT, since it comprises multiple elements used in combination by the laboratory, not a discrete finished product sold to third parties. Moreover, to the extent a UDI is intended to facilitate identification of a device throughout its journey from manufacturer through distribution to the end user, it is not clear what purpose it would serve for an LDT, which has no physical existence outside the laboratory.

Conclusion

Laboratories that were hoping for substantive guidance from FDA on how to navigate the unfamiliar, and by no means self-executing, complaint handling, medical device reporting and correction and removal regulations, will need to look elsewhere for advice or use their best judgment and hope for FDA’s understanding if such judgments fail to meet FDA’s unarticulated expectations.

[1] 42 C.F.R. § 493.1233.

[2] 21 C.F.R. § 820.3(b).

[3] Id. § 820.198(a).

[4] Id.

[5] Id. § 820.180(b).

[6] Id. § 820.198(b).

[7] Id. § 820.198(e).

[8] Id. § 820.198(a).

[9] Id. § 803.1.

[10] Id.

[11] Id.

[12] 42 § 493.1407; id. § 493.1445.

[13] 21 C.F.R. § 803.3.

[14] FDA, MDR Adverse Event Codes, at https://www.fda.gov/medical-devices/mandatory-reporting-requirements-manufacturers-importers-and-device-user-facilities/mdr-adverse-event-codes.

[15] Id. § 806.2.

[16] Id.

[17] Id. § 806.10.

[18] Id. § 806.2.

[19] Id. § 806.20.