Overview of 21 CFR Part 803

This regulation describes rules for reporting adverse events to the FDA and states how these reports may be shared with the public. Adverse events include, but are not limited to, patient harm due to incorrect results as a result of IVD malfunctions, or faulty user instructions or labelling.

Future Applicability to LDTs in Stage 1

If the FDA gets its way, Laboratory Developed Tests (LDTs) will soon become FDA-regulated in vitro diagnostic (IVD) medical devices.  In the recently proposed rule, Stage 1 of the transition of LDTs to IVDs would require LDTs to follow medical device reporting rules in 21 CFR Part 803.  Labs with LDTs will need to brush up on 21 CFR Part 803, Medical Device Reporting (MDR).

CLIA labs are already user facilities & must report adverse events for medical devices… …but LDTs are not currently medical devices

The MDR regulation requires manufacturers, importers, and user facilities to report certain adverse events and product problems involving medical devices to the FDA.   If you are a clinical diagnostic laboratory under CLIA, you may be surprised to learn that you are already obligated to report adverse events for medical devices. This is because user facilities include outpatient diagnostic facilities that conduct medical diagnostic tests on patients using in vitro testing (i.e. CLIA labs). See 21 CFR 803.3(r) for more info.

But the key words is adverse events for medical devices.  Because a LDT is not a ‘medical device’ or at least the regulation hasn’t ever been enforced), adverse events for LDTs do not need to be reported to the FDA. Yet.

Once LDTs become IVDs, CLIA labs will be both manufacturers and user facilities of IVDs

It’s a dummy whammy.  Once LDTs are no more, CLIA labs will now be both making and using an IVD.

• They will need to start reporting adverse events to the IVD manufacturer as a user facility. AND
• They will need to start reporting adverse events to the FDA as an IVD manufacturer.

Still confused? Look at it this way. In a traditional Manufacturer-CLIA lab relationship, this how adverse events would play out:

You might think the LDT model is simpler; after all, it cuts out the middle-man in deciding if something is an adverse event.  But this does raise some questions and issues.

When the CLIA Lab is the User Facility & Manufacturer, what is the timeline for reporting? Can each function report separately?

According to 21 CFR 803.3(b), you ‘become aware’ of an event when an employee of the reporting entity has information that reasonably suggests that a reportable adverse event occurred.

This means that a CLIA lab may be a ‘reporting entity’ that has employees both responsible for reporting adverse events as a user facility, and an employees responsible for reporting adverse events as a manufacturer.   The manufacturer therefore may ‘become aware’ as soon as the user facility does.

Unless you allow the definition of ‘reporting entity’ to split the internal functions within a single organization into ‘manufacturer’ and ‘user’ this significantly compresses the time for external reporting to the FDA.

30 days (Manufacturer) – up to 10 days (User Facility)  = 20-30 days for Manufacturer

versus

30 days (Manufacturer) + 10 days (User Facility) = 30 days for Manufacturer

Essentially, any time it takes for the user facility to report the adverse event to the manufacturer is now subtracted (up to ten days) from the manufacturer’s time, giving 20 days to evaluate and report to the FDA.

And what about when the adverse event is death?  The User facility is obligated to report that to the manufacturer AND the FDA within 10 days.  Is the assumption then that the manufacturer follows up with more information about the device within 30 days AFTER that?

But does that mean the user and the manufacturer file separate reports, even though they are the same entity? Maybe, the FDA would seem to allow separate reports, but hypothetically, you could also combine into a single report. The regulations and guidance do not address a scenario where a single entity has these dual roles.

Are Adverse Events Reportable if they are ‘caused or contributed’ by User Errors?

According to 21 CFR 803.3(c) a device has ‘caused or contributed’ to an event if a death or serious injury was or may have been attributed to the device, or if the device was or may have been a factor in a death or serious injury, including events occurring as a result of: (1) Failure, (2) Malfunction, (3) Improper or inadequate design, (4) Manufacture, (5) Labeling, or (6) User error.

Laboratory errors are mistakes or inaccuracies that occur during the process of testing, analyzing, or reporting medical samples in a laboratory setting. These errors include examples such as errors in sample receipt or handling, adding the wrong reagent, reagent storage errors, selecting an incorrect instrument program, sample swaps, or QC errors.  Laboratory errors can have serious consequences for patients, such as misdiagnosis, delayed treatment, or inappropriate interventions.   Are these ‘user errors”?

Per the FDA “A use error refers to a situation in which the outcome of device use was different than intended, but not due to malfunction of the device. The error may have been due to a poorly designed device, or it may have been used in a situation that promoted incorrect usage. Other users may make the same use error with similar or worse consequences.”

Thus, one interpretation of the requirement to address adverse events that are a result of ‘user error’ would be limit this to laboratory errors due to using the IVD in a way that clearly different than the manufacturer intended, but inherent to the design of the IVD.  Examples might be where the IVD reagents or software have inherent flaws that are likely to lead the CLIA lab staff to improper use.   This is likely to be a small subset of all laboratory errors, and not any or all mistakes made by lab staff when performing a testing procedure.

However, I have seen labs take the view that all lab errors are ‘user errors’ of an IVD.  If this is your interpretation, I strongly recommend you involve a Legal representative in that decision. There is currently a lack of incentives and protections for reporting laboratory errors, such as confidentiality, anonymity, immunity, or feedback, and the issue of legal liability, professional sanctions, or reputational damage will be points for discussion.

Complaint Files and Medical Device Reporting

It is impossible to discuss Medical Device Reporting, without also discussing complaints.  Complaint files are linked to MDR event files because a complaint must be evaluated to determine if it is a reportable adverse event. A complaint is:

“any written, electronic, or oral communication that alleges deficiencies related to the identity, quality, durability, reliability, safety, effectiveness, or performance of a device after it is released for distribution”.

Manufacturers are required to maintain complaint files and establish and maintain procedures for receiving, reviewing, and evaluating complaints. Complaint files that are found to be reportable MDR events should be maintained in a separate portion of the complaint file or otherwise clearly identified.

It should be noted that CLIA laboratories are also required “have a system in place to ensure that it documents all complaints and problems reported to the laboratory. The laboratory must conduct investigations of complaints, when appropriate.” See §493.1233 Standard: Complaint investigations

If the CLIA lab is also the IVD manufacturer, are they required to evaluate ANY issues identified in laboratory records, or in discussion with laboratory staff?

This is a problematic question for both adverse events, and complaints in general.  As a single entity, the manufacturer may now have access to quality records of the laboratory, including all complaints from laboratory customers.  The development or manufacturing team may also be in direct contact with laboratory staff using the test on a routine basis.  As such, the manufacturer could ‘become aware’ of a wide variety of customer and internal lab user issues that could constitute a complaint.

After ‘becoming aware’ they may now think they need to assess each issue for whether it could be related to the labeling or user error as a complaint, and then as a potential malfunction or adverse events.

This is problematic in three ways.

• A) potentially every lab event or corrected report could be a candidate for evaluation by the ‘manufacturer’.
• B) the design and manufacturing team generally does not have the same experience and understanding of laboratory workflows to evaluate lab errors.
• C) Even if the design and manufacturing team could evaluate all issues, the authority and responsibility to do so is designated to the Clinical Laboratory Director (CLD), under 42 CFR Part 493 (CLIA), not to the manufacturer under 21 CFR Part 820 or 803.

A solution to this conundrum is proposed below.

Separation of User and Manufacture in the Adverse Event Reporting Process

My recommendation from experience is to not make the ‘manufacturing’ part of the organization directly responsible for evaluation of all laboratory issues, but instead to clearly separate the responsibilities within the organization as ‘manufacturer’ versus ‘user facility’ (i.e. the CLIA laboratory).

This would in practice mean to appoint a function (a person or group) within the CLIA laboratory as a separate complaint and adverse event evaluation team for the CLIA laboratory.  Their purpose would be to record all complaints (and possible adverse events) to a smaller list of complaints and adverse events that are about the device as opposed to the laboratory service.  Complaints would include feedback from their own laboratory users about device issues.  This filtered set of would then be sent forward to a separate device ‘manufacturer’ team for evaluation.

The manufacturing team would be a separately appointed function that would then evaluate this pared down list of ‘device’ complaints for adverse events and to complete the more formal steps required by 21 CFR Part 820 (Quality System Requirement) for complaint investigation and reporting.

If the same team must be is used for both functions, there should be a clear division of he these steps of evaluation, to not confuse evaluation of ‘use’ with evaluation of ‘design’ or ‘manufacturing’.

This approach is further described below.

Step 1: The User Facility Determines if there is an Adverse Event

If the complaint / adverse event is being reported to the CLIA laboratory that tested a sample, it is being reported to the user facility.  The user facility is then responsible for a first pass of the evaluation.  The user facility responsible person (for instance the Clinical Laboratory Director, or their designee) then should determine if an adverse event has occurred due to a medical device.  They may do this by asking if there is a reasonable possibility that;

• a device failure
• a device design defect , or
• the device labeling

was a direct or indirect factor in a death or significant injury?

Its important to note that not just anyone can make this decision.  It needs to be made by “a person who is qualified to make a medical judgment (e.g., a physician, nurse, risk manager, or biomedical engineer) to reach a reasonable conclusion.”  It should also be noted, that the FDA rejected a suggestion that MDR reports be required only if the device is a significant factor in causing an adverse event.  This is an important distinction in the case of an IVD, where the patient results is almost certainly and indirect rather than direct cause of an event.

If the answer is ‘No’, under CLIA they must still investigate and evaluate whether the lab needs to take corrective action. If the complaint or adverse event was due to laboratory error, they must investigate and correct the error per 42 CFR §493.1233 and 493.1239.  But no adverse event reporting is required. The Information which leads the qualified person to determine that a device-related event is or is not reportable must be contained in the MDR event files, even if the event is not reported.

Step 2: The User Facility Reports the Adverse event to the Manufacturer, and FDA (in case of death)

If the event is a reportable adverse event in Step 1, under 21 CFR Part 803, they must report, within 10 days to the internal team within their company responsible for the ‘manufacturer’ role.  A good choice for this is the Complaint Handling Unit (CHU) that the manufacturer will need to designate anyway per 21 CFR Part 802.198.  It is strongly recommended that team is a different than the team in step #1, to prevent a misunderstanding of the role of each team.

Step 3: The Manufacturer Determines if there is an Adverse Event

Next, the group responsible for manufacturing will need to evaluate the adverse event.  Again, they will ask the question if there is a reasonable possibility that;

• a device failure,
• a device design defect , or
• the device labeling

was a direct or indirect factor in a death or significant injury?

Hypothetically, this might be a different answer than that decided by the CLIA laboratory,  for instance because the CLIA laboratory may be more conservative about whether a laboratory error may be a ‘user error’ due to an inherent design flaw.

If the answer is ‘No’, as a manufacturer, this may still be considered a complaint, and require investigation and evaluation of whether the manufacturer needs to take corrective action. But no adverse event reporting is required.

Again, a qualified person must make the determinations and provide the information evaluated in the MDR event files, even if the event is not reported.

Step 4: The Manufacturer Reports the Adverse event to the FDA

If the answer is ‘Yes’, under 21 CFR Part 803, the manufacturer must report, within 30 days to the FDA. The steps for Electronic Medical Device Reporting (eMDR) and detailed FDA Guidance are on the FDA’s website.

Reporting Malfunctions

The user facility (the CLIA lab) may also decide to report to the group responsible for manufacturing that there was a device malfunction, even if it did not result in death or serious injury. Under 21 CFR Part 830, a user facility is not obligated to do so, but in the case a laboratory using the device is the same ‘reporting entity’ as the manufacturer they may be obligated as a ‘reporting entity’ to do so.

If the lab does report a device malfunction meeting this criteria, the manufacturer would then have 30 days to evaluate for themselves if it met the criteria for a device malfunction, and then report that malfunction to the FDA.

With the latest FDA proposed rule-making for IVDs, laboratory professionals supporting Laboratory Developed Tests (LDTs) may be asking, what does this mean for my LDT test?

In short—the FDA wants to regulate LDTs under the same rules as in vitro diagnostic (IVD) medical devices. Those rules are spelled out in 21 CFR Chapter I, Subchapter H – Medical Devices.   If you are not a Regulatory Affairs or Quality Assurance professional in the traditional medical device industry (and maybe even if you are), even looking at the table of contents may be a little daunting.

The aim of this post is to make it less so.  I do this by describing each part in simple terms, and giving the relevance to a LDT, should LDTs start being regulated as IVDs.  Once you have the high-level overview, you can dive down into each part.  I plan to release more detailed information of each part in future blogs, so stay tuned. Note, I will omit information not applicable to IVDs to cut this information down.

Part 800:  General

Administrative rules for how FDA will prevent selling or using devices they deem unsafe, and how to appeal those decisions.

Part 801:  Labeling

Rules for ‘Labeling’ which includes far more than just physical labels on IVD reagents, but also instructions for the user of reagents, instruments, or software, plus any information provided to customers about what the IVD could or should be used for. This also includes promotional material or information provided in the patient result.  Note that Part 809 provides more specific rules for labeling of IVDs.

Part 803: Medical Device Reporting

Rules for reporting adverse events to the FDA and states how these reports may be shared with the public. Adverse events include, but are not limited to, patient harm due to incorrect results as a result of IVD malfunctions, or faulty user instructions or labelling.

Part 806: Medical Devices; Reports of Corrections and Removals

Rule for reporting of corrections and removals of IVDs to the FDA. This is when a lab releases IVD reagents, instruments, or software to the lab to use in testing, and then later realizes there is something ‘wrong’ with them and needs to do something to ‘fix’ the problem or take the faulty parts of the IVD away from lab users.

Part 807 (A-D): Establishment Registrations & Device Listing

Rules for how and when to register the facilities (i.e. ‘establishment’) that designs and makes the IVD, and providing a list of IVDs (i.e. ‘listing’)  it makes at each facility, to the FDA.  This is public information and must be updated annually.

Part 807 (E): Establishment Registrations & Device Listing

Rules for premarket notification submissions (aka ‘510k’) by which the FDA can agree (i.e. ‘clear’) that a medium risk IVD is like (i.e. ‘substantially equivalent’) to an IVD already being sold.  After looking at analytical and (sometimes clinical) validation data, they can agree it is safe and effective enough to be sold.

Part 808: Exemptions From Federal Preemption of State and Local Medical Device Requirements

Federal preemption means that FDA rules can override state rules if they conflict with each other.  This rule gives States a path to have different rules if they can show their rules are stricter than the FDA’s.

Part 809: In Vitro Diagnostic Products for Human Use

Specific labeling rules for IVDs including call outs for; how to label general and analyte-specific reagents, labeling instruments, what needs to go into IVD lab procedures and over-the-counter instructions, and how to describe IVD performance characteristics (e.g. accuracy, precision).

Part 810: Medical Device Recall Authority

How the FDA has the authority to issue a recall or cease distribution order.  This means they can make IVD manufacturers ask users to send purchased IVD materials back at the manufacture’s expense, or stop manufactures from providing IVD products.

Part 812: Investigational Device Exemptions

If the FDA has not cleared or approved an IVD, it can still be used in a clinical trial, but is considered an ‘investigational device’ and requires an ‘exemption’ to use it.  The Sponsor and manufacturer also need to follow certain rules depending on risk involved in using the IVD in the trial. For the highest risk category, a formal application to the FDA is needed.

Part 814: Premarket Approval of Medical Devices

Rules for premarket approval submissions (aka ‘PMA’) by which the FDA can agree (i.e. ‘approve’) that a high risk IVD is safe and effective enough to be sold. Both analytical and clinical validation data is generally needed, and there may be commitments to monitor the IVD or perform additional studies even after approval (i.e. ‘postapproval requirements’).

Rules for humanitarian IVDs for rare use cases (e.g. rare diseases).

This part explains how to get approval from the FDA for a new medical device that is not substantially equivalent to an existing one. It also describes the types of clinical studies that are required to demonstrate the safety and effectiveness of the device1.

Part 820: Quality System Regulations

Rules for the quality system of IVD manufacturers, which includes procedures for design, production, packaging, labeling, storage, installation, and servicing of their devices. It requires processes for oversight of those activities, such as document and record control, internal audits, management review.  It requires processed to ‘fix’ problems (i.e. ‘corrective actions’) for ‘nonconforming product’, complaints, and adverse events. It also defines the records and reports that must be maintained and can be inspected by the FDA.

Part 821: Medical Device Tracking Requirements

Requires certain medical device manufacturers (mostly implanted devices) to keep records of who is using their device in case they need to recalls or fix issues.   Only applies to IVDs where a failure could have ‘serious adverse health consequences’.

Part 822: Postmarket Surveillance

The FDA may require studies to monitor the performance of a IVD even after it is approved and marketed. These rules describe the plan needed and the responsibilities of the sponsors and investigators of these studies.

Part 830: Unique Device Identification

Rules for a system to identify each IVD through distribution and use. The idea was to help customers and the FDA identify devices and monitor the device markets for safety issues.  Each IVD must have a code (i.e. a ‘unique device identifier’) that identifies the IVD and production lot that can be read or scanned. Multiple agencies can issue the first part of the code, which is also submitted to a Global Unique Device Identification Database (GUDID).

Part 860: Medical Device Classification Procedures

These rules describe how medical devices are categorized and classified by risk (e.g. Class I, II, or III) and how each category of medical device is identified.  This process can include advisory committees and classification panels. Each category may then be given specific regulations for that type of medical device. See section on Parts 862-892 below for more info).  The de novo process allows manufactures of potential Class II IVDs with no similar test on the market to go through a streamlined process for categorization and classification.

Part 861: Procedures for Performance Standards Development

The rules describe how the FDA may create performance standards for class II and III medical devices.  In the case of an IVD, this might include standards for how to perform analytical validation.  These standards can then be referenced and consider mandatory in the sub-regulations specific to each category (type) of medical device.  In this way, the FDA can simply update a standard without updating multiple regulations.

Parts 862-892: [Rules specific to a category or sub-category of devices.]

In these parts, the FDA gets into rules specific to just a subset of devices.  The rules are divided into Parts for high-level categories like ‘Part 866 Immunology and Microbiology Devices’, then subparts like ‘Subpart B Diagnostic Devices’.

Each subpart is then divided into categories of tests like ‘§ 866.1645 Fully automated short-term incubation cycle antimicrobial susceptibility system.’

Lastly, the regulation identifies the category, gives a classification (I, II, or III) and may list additional exemptions or rules (i.e. ‘special controls’) such as labeling, submission information,  testing (i.e. ‘design verification and valdiation’), guidance documents

Part 895: Banned Devices

Lists medical devices the FDA explicitly prohibits.

Part 896: Performance Standard for Electrode Lead Wires and Patients Cables

A performance standard the FDA decided to give its own part.

Other Parts You Need to Know

Part 11: Electronic Records and Signatures

Rules for computer systems.  Electronic records and electronic signatures need to be follow these rules to be considered trustworthy, reliable, and equivalent to paper records. Rules cover the creation, modification, maintenance, archiving, retrieval, and transmission of electronic records under any FDA regulations (including medical device regulations).  It describes computer system testing (‘validation’) audit trail requirements, and record retention for electronic records.