21 CFR Part 803; Medical Device Reporting (MDR) for LDTs

Overview of 21 CFR Part 803

This regulation describes rules for reporting adverse events to the FDA and states how these reports may be shared with the public. Adverse events include, but are not limited to, patient harm due to incorrect results as a result of IVD malfunctions, or faulty user instructions or labelling.

Future Applicability to LDTs in Stage 1

If the FDA gets its way, Laboratory Developed Tests (LDTs) will soon become FDA-regulated in vitro diagnostic (IVD) medical devices.  In the recently proposed rule, Stage 1 of the transition of LDTs to IVDs would require LDTs to follow medical device reporting rules in 21 CFR Part 803.  Labs with LDTs will need to brush up on 21 CFR Part 803, Medical Device Reporting (MDR).

CLIA labs are already user facilities & must report adverse events for medical devices… …but LDTs are not currently medical devices

The MDR regulation requires manufacturers, importers, and user facilities to report certain adverse events and product problems involving medical devices to the FDA.   If you are a clinical diagnostic laboratory under CLIA, you may be surprised to learn that you are already obligated to report adverse events for medical devices. This is because user facilities include outpatient diagnostic facilities that conduct medical diagnostic tests on patients using in vitro testing (i.e. CLIA labs). See 21 CFR 803.3(r) for more info.

But the key words is adverse events for medical devices.  Because a LDT is not a ‘medical device’ or at least the regulation hasn’t ever been enforced), adverse events for LDTs do not need to be reported to the FDA. Yet.

Once LDTs become IVDs, CLIA labs will be both manufacturers and user facilities of IVDs

It’s a dummy whammy.  Once LDTs are no more, CLIA labs will now be both making and using an IVD.

• They will need to start reporting adverse events to the IVD manufacturer as a user facility. AND
• They will need to start reporting adverse events to the FDA as an IVD manufacturer.

Still confused? Look at it this way. In a traditional Manufacturer-CLIA lab relationship, this how adverse events would play out:

You might think the LDT model is simpler; after all, it cuts out the middle-man in deciding if something is an adverse event.  But this does raise some questions and issues.

When the CLIA Lab is the User Facility & Manufacturer, what is the timeline for reporting? Can each function report separately?

According to 21 CFR 803.3(b), you ‘become aware’ of an event when an employee of the reporting entity has information that reasonably suggests that a reportable adverse event occurred.

This means that a CLIA lab may be a ‘reporting entity’ that has employees both responsible for reporting adverse events as a user facility, and an employees responsible for reporting adverse events as a manufacturer.   The manufacturer therefore may ‘become aware’ as soon as the user facility does.

Unless you allow the definition of ‘reporting entity’ to split the internal functions within a single organization into ‘manufacturer’ and ‘user’ this significantly compresses the time for external reporting to the FDA.

30 days (Manufacturer) – up to 10 days (User Facility)  = 20-30 days for Manufacturer

versus

30 days (Manufacturer) + 10 days (User Facility) = 30 days for Manufacturer

Essentially, any time it takes for the user facility to report the adverse event to the manufacturer is now subtracted (up to ten days) from the manufacturer’s time, giving 20 days to evaluate and report to the FDA.

And what about when the adverse event is death?  The User facility is obligated to report that to the manufacturer AND the FDA within 10 days.  Is the assumption then that the manufacturer follows up with more information about the device within 30 days AFTER that?

But does that mean the user and the manufacturer file separate reports, even though they are the same entity? Maybe, the FDA would seem to allow separate reports, but hypothetically, you could also combine into a single report. The regulations and guidance do not address a scenario where a single entity has these dual roles.

Are Adverse Events Reportable if they are ‘caused or contributed’ by User Errors?

According to 21 CFR 803.3(c) a device has ‘caused or contributed’ to an event if a death or serious injury was or may have been attributed to the device, or if the device was or may have been a factor in a death or serious injury, including events occurring as a result of: (1) Failure, (2) Malfunction, (3) Improper or inadequate design, (4) Manufacture, (5) Labeling, or (6) User error.

Laboratory errors are mistakes or inaccuracies that occur during the process of testing, analyzing, or reporting medical samples in a laboratory setting. These errors include examples such as errors in sample receipt or handling, adding the wrong reagent, reagent storage errors, selecting an incorrect instrument program, sample swaps, or QC errors.  Laboratory errors can have serious consequences for patients, such as misdiagnosis, delayed treatment, or inappropriate interventions.   Are these ‘user errors”?

Per the FDA “A use error refers to a situation in which the outcome of device use was different than intended, but not due to malfunction of the device. The error may have been due to a poorly designed device, or it may have been used in a situation that promoted incorrect usage. Other users may make the same use error with similar or worse consequences.”

Thus, one interpretation of the requirement to address adverse events that are a result of ‘user error’ would be limit this to laboratory errors due to using the IVD in a way that clearly different than the manufacturer intended, but inherent to the design of the IVD.  Examples might be where the IVD reagents or software have inherent flaws that are likely to lead the CLIA lab staff to improper use.   This is likely to be a small subset of all laboratory errors, and not any or all mistakes made by lab staff when performing a testing procedure.

However, I have seen labs take the view that all lab errors are ‘user errors’ of an IVD.  If this is your interpretation, I strongly recommend you involve a Legal representative in that decision. There is currently a lack of incentives and protections for reporting laboratory errors, such as confidentiality, anonymity, immunity, or feedback, and the issue of legal liability, professional sanctions, or reputational damage will be points for discussion.

Complaint Files and Medical Device Reporting

It is impossible to discuss Medical Device Reporting, without also discussing complaints.  Complaint files are linked to MDR event files because a complaint must be evaluated to determine if it is a reportable adverse event. A complaint is:

“any written, electronic, or oral communication that alleges deficiencies related to the identity, quality, durability, reliability, safety, effectiveness, or performance of a device after it is released for distribution”.

Manufacturers are required to maintain complaint files and establish and maintain procedures for receiving, reviewing, and evaluating complaints. Complaint files that are found to be reportable MDR events should be maintained in a separate portion of the complaint file or otherwise clearly identified.

It should be noted that CLIA laboratories are also required “have a system in place to ensure that it documents all complaints and problems reported to the laboratory. The laboratory must conduct investigations of complaints, when appropriate.” See §493.1233 Standard: Complaint investigations

If the CLIA lab is also the IVD manufacturer, are they required to evaluate ANY issues identified in laboratory records, or in discussion with laboratory staff?

This is a problematic question for both adverse events, and complaints in general.  As a single entity, the manufacturer may now have access to quality records of the laboratory, including all complaints from laboratory customers.  The development or manufacturing team may also be in direct contact with laboratory staff using the test on a routine basis.  As such, the manufacturer could ‘become aware’ of a wide variety of customer and internal lab user issues that could constitute a complaint.

After ‘becoming aware’ they may now think they need to assess each issue for whether it could be related to the labeling or user error as a complaint, and then as a potential malfunction or adverse events.

This is problematic in three ways.

• A) potentially every lab event or corrected report could be a candidate for evaluation by the ‘manufacturer’.
• B) the design and manufacturing team generally does not have the same experience and understanding of laboratory workflows to evaluate lab errors.
• C) Even if the design and manufacturing team could evaluate all issues, the authority and responsibility to do so is designated to the Clinical Laboratory Director (CLD), under 42 CFR Part 493 (CLIA), not to the manufacturer under 21 CFR Part 820 or 803.

A solution to this conundrum is proposed below.

Separation of User and Manufacture in the Adverse Event Reporting Process

My recommendation from experience is to not make the ‘manufacturing’ part of the organization directly responsible for evaluation of all laboratory issues, but instead to clearly separate the responsibilities within the organization as ‘manufacturer’ versus ‘user facility’ (i.e. the CLIA laboratory).

This would in practice mean to appoint a function (a person or group) within the CLIA laboratory as a separate complaint and adverse event evaluation team for the CLIA laboratory.  Their purpose would be to record all complaints (and possible adverse events) to a smaller list of complaints and adverse events that are about the device as opposed to the laboratory service.  Complaints would include feedback from their own laboratory users about device issues.  This filtered set of would then be sent forward to a separate device ‘manufacturer’ team for evaluation.

The manufacturing team would be a separately appointed function that would then evaluate this pared down list of ‘device’ complaints for adverse events and to complete the more formal steps required by 21 CFR Part 820 (Quality System Requirement) for complaint investigation and reporting.

If the same team must be is used for both functions, there should be a clear division of he these steps of evaluation, to not confuse evaluation of ‘use’ with evaluation of ‘design’ or ‘manufacturing’.

This approach is further described below.

Step 1: The User Facility Determines if there is an Adverse Event

If the complaint / adverse event is being reported to the CLIA laboratory that tested a sample, it is being reported to the user facility.  The user facility is then responsible for a first pass of the evaluation.  The user facility responsible person (for instance the Clinical Laboratory Director, or their designee) then should determine if an adverse event has occurred due to a medical device.  They may do this by asking if there is a reasonable possibility that;

• a device failure
• a device design defect , or
• the device labeling

was a direct or indirect factor in a death or significant injury?

Its important to note that not just anyone can make this decision.  It needs to be made by “a person who is qualified to make a medical judgment (e.g., a physician, nurse, risk manager, or biomedical engineer) to reach a reasonable conclusion.”  It should also be noted, that the FDA rejected a suggestion that MDR reports be required only if the device is a significant factor in causing an adverse event.  This is an important distinction in the case of an IVD, where the patient results is almost certainly and indirect rather than direct cause of an event.

If the answer is ‘No’, under CLIA they must still investigate and evaluate whether the lab needs to take corrective action. If the complaint or adverse event was due to laboratory error, they must investigate and correct the error per 42 CFR §493.1233 and 493.1239.  But no adverse event reporting is required. The Information which leads the qualified person to determine that a device-related event is or is not reportable must be contained in the MDR event files, even if the event is not reported.

Step 2: The User Facility Reports the Adverse event to the Manufacturer, and FDA (in case of death)

If the event is a reportable adverse event in Step 1, under 21 CFR Part 803, they must report, within 10 days to the internal team within their company responsible for the ‘manufacturer’ role.  A good choice for this is the Complaint Handling Unit (CHU) that the manufacturer will need to designate anyway per 21 CFR Part 802.198.  It is strongly recommended that team is a different than the team in step #1, to prevent a misunderstanding of the role of each team.

Step 3: The Manufacturer Determines if there is an Adverse Event

Next, the group responsible for manufacturing will need to evaluate the adverse event.  Again, they will ask the question if there is a reasonable possibility that;

• a device failure,
• a device design defect , or
• the device labeling

was a direct or indirect factor in a death or significant injury?

Hypothetically, this might be a different answer than that decided by the CLIA laboratory,  for instance because the CLIA laboratory may be more conservative about whether a laboratory error may be a ‘user error’ due to an inherent design flaw.

If the answer is ‘No’, as a manufacturer, this may still be considered a complaint, and require investigation and evaluation of whether the manufacturer needs to take corrective action. But no adverse event reporting is required.

Again, a qualified person must make the determinations and provide the information evaluated in the MDR event files, even if the event is not reported.

Step 4: The Manufacturer Reports the Adverse event to the FDA

If the answer is ‘Yes’, under 21 CFR Part 803, the manufacturer must report, within 30 days to the FDA. The steps for Electronic Medical Device Reporting (eMDR) and detailed FDA Guidance are on the FDA’s website.

Reporting Malfunctions

The user facility (the CLIA lab) may also decide to report to the group responsible for manufacturing that there was a device malfunction, even if it did not result in death or serious injury. Under 21 CFR Part 830, a user facility is not obligated to do so, but in the case a laboratory using the device is the same ‘reporting entity’ as the manufacturer they may be obligated as a ‘reporting entity’ to do so.

If the lab does report a device malfunction meeting this criteria, the manufacturer would then have 30 days to evaluate for themselves if it met the criteria for a device malfunction, and then report that malfunction to the FDA.