Introduction

Medical devices are an important part of health care service delivery and developments in new technologies can improve their ability to diagnose and treat illness. The medical device industry produces a wide range of products—from bandages to ventilators to pacemakers—that pose varying amounts of risk to the consumer. The FDA regulates more than 190,000 distinct devices.¹ Given the large number of devices, and the potential risks associated with them, the regulation of medical devices is complex and differs from regulation of other medical products (e.g., drugs).

The Food and Drug Administration (FDA), an agency within the Department of Health and Human Services (HHS), is responsible for regulating the safety and effectiveness of medical devices. FDA's Center for Devices and Radiological Health (CDRH), established in 1982, is primarily responsible for medical device regulation. Medical device manufacturers—and, in some cases, user facilities, device labelers, and importers—are subject to a number of requirements to ensure that devices are not adulterated or misbranded and to otherwise assure their safety and effectiveness. These requirements include, for example, device tracking and reports of removals and corrections.

Congress has historically been interested in allowing consumers to have access, as quickly as possible, to new and improved medical devices while at the same time preventing unsafe and ineffective devices from entering or remaining on the market. These contrasting goals may exert opposite pulls, with implications for consumers, the health care system, and the economy.

Manufacturers decide to develop new devices based in part on the cost of doing so. Additional regulatory requirements may escalate these costs, while other incentives, such as tax breaks, may diminish them. If a device development cost is too high, that device or product may be not developed or brought to market, and consumers are denied access to its potential benefits. This lack of access has led to proposals for, and the enactment of, incentives to develop medical devices for rare diseases and pediatric populations. However, if the regulation and oversight of device development are not adequate, unsafe or ineffective products may reach the market and harm consumers.

This report describes (1) FDA's authority to regulate medical devices; (2) medical device classification and regulatory controls, including premarket review requirements; (3) postmarket surveillance systems; and (4) compliance and enforcement. This report is intended to provide a broad overview of FDA medical device regulation, and as such, it may not describe every applicable device requirement.

FDA's Authority to Regulate Medical Devices

Under its authorities in the Federal Food, Drug, and Cosmetic Act (FFDCA), FDA regulates the safety and effectiveness of medical devices, which are a type of medical product. A medical device (or "device") is defined in the FFDCA as "an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article, including any component, part, or accessory, which is ... intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man or other animals."² All FDA-regulated medical products conceptually meet the definition of a drug as defined in the FFDCA.³ However, unlike a drug, a device "does not achieve its primary purpose through chemical action within or on the body ... and is not dependent on being metabolized for the achievement of its primary intended purposes."⁴ Certain products are considered combination products—therapeutic or diagnostic products that combine drugs and devices—and may be assigned to FDA's CDRH, Center for Drug Evaluation and Research (CDER), or to the Center for Biologics Evaluation and Research (CBER), depending on the primary mode of action, among other factors.⁵

Medical devices are regulated based on the risk posed to the consumer. All devices are subject to general controls (e.g., registration and listing), which are intended to ensure that the devices are safe and effective once marketed. Certain devices, because of the risk they pose to consumers, must undergo FDA premarket review to determine whether they provide reasonable assurance of safety and effectiveness prior to marketing. Additionally, some devices are subject to special controls—for example, requirements for special labelling or postmarket studies.

FDA can take corrective action against a device manufacturer, importer, distributor, or other registrant if the agency finds that such registrant is in violation of FFDCA requirements or FDA regulations. Such corrective actions include warning letters, seizures, injunctions, and criminal prosecution (with the Department of Justice).⁶

Medical Device Classification Panels and Regulatory Classes

Medical devices are classified both by medical specialty (i.e., classification panels) and by the risk posed to the consumer (i.e., regulatory classes). A manufacturer unsure of the classification panel and regulatory class in which its device belongs may submit to FDA a formal request for clarification.⁷

Classification Panels

FDA has developed classifications for over 1,700 generic device types—groups of devices that do not have differing features regarding safety and effectiveness and require similar regulatory controls⁸—and grouped them into 16 medical specialties (e.g., cardiovascular, orthopedic).⁹ These 16 medical specialties are referred to as classification panels, which are listed in Title 21 of the Code of Federal Regulations (C.F.R.).¹⁰ For each generic device type listed in a respective classification regulation within a broader classification panel, the C.F.R. gives a general description of the intended use of the device, information about the marketing requirements, and the regulatory class (i.e., class I, class II, or class III) in which the device belongs. Device manufacturers may try to locate the type of device they are intending to market by looking through the classification panels and associated classification regulations for more information on likely regulatory controls for their specific device. This process in part supports the regulatory framework the FDA uses for some devices, specifically those subject to 510(k) notification, which is based on determinations of substantial equivalence with a predicate device (discussed below in the "Premarket Notification (510(k))" section.

Genetic Health Risk (GHR) tests, a type of genetic test pioneered by 23andMe, exemplify the device classification process. Specifically, GHR tests are "intended to provide information on an individual's genetic risk for certain medical diseases or conditions."¹¹ Generally, consumers can use the results from these tests in discussions with health care providers, or to help guide lifestyle choices. The GHR test classification panel is "Immunology," and the generic device type is "Genetic health risk assessment system."¹² The classification regulation (21 C.F.R. §866.5950) classifies these devices as class II, as exempt from 510(k) notification in certain cases, and includes extensive labelling special controls. An example of a specific GHR test within the generic device type is 23andMe's Personal Genome Service (PGS) Genetic Health Risk Test for Hereditary Thrombophilia.¹³

Regulatory Classes

As established by the Medical Device Amendments (MDA) of 1976 (P.L. 94-295), medical devices are classified and regulated based on risk posed to the consumer. Each regulatory class comprises different regulatory controls (i.e., general controls, special controls, and premarket approval [PMA]), which is described below (see the "Medical Device Regulatory Controls" section).

Class I medical devices are considered low risk. As such, general controls are considered sufficient to provide reasonable assurance of safety and effectiveness.¹⁴

Class II medical devices are considered moderate risk; therefore, general and special controls are considered to provide reasonable assurance of safety and effectiveness.¹⁵

Class III medical devices are considered high risk; therefore, they are subject to general controls and the PMA process to provide reasonable assurance of safety and effectiveness.¹⁶

Reclassification

As information about a particular medical device changes, it may be subject to reclassification. Two reclassification processes can be used to change a medical device's regulatory class (i.e., class I, class II, and class III), as outlined in the FFDCA.

Reclassification Request (FFDCA §513(e))

Upon receipt of new information regarding a device type, FDA may initiate or respond to a petition for reclassification.¹⁷ Through an administrative order process,¹⁸ FDA may reclassify a device from any regulatory class to another class (e.g., class III to class II, class I to class III). Before finalizing the administrative order, FDA is required to (1) publish a proposed order in the Federal Register that includes the proposed reclassification and a summary of evidence supporting the proposal, (2) hold a device classification panel meeting, and (3) take into account comments received through the applicable public docket.¹⁹

De Novo Classification Request

Any devices that were not on the market before the passage of the MDA—known as postamendments devices—are automatically placed in class III, regardless of the risk they pose to consumers (unless the device is substantially equivalent to one within a preamendments device type, or to a type that has since been classified as class I or class II).²⁰ The De Novo pathway—first established in 1997 by the FDA Modernization Act (FDAMA, P.L. 105-115) and amended in 2012 by the FDA Safety and Innovation Act (FDASIA, P.L. 112-144)—allows certain devices automatically classified, by statute, as class III devices to be reclassified.²¹ Specifically, through this pathway, FDA can reclassify a novel low- to moderate-risk device as class I or II from its statutorily mandated class III status. A device granted de novo classification creates a new device type and may serve as a predicate device for new devices of the same type going forward.

Within this pathway, manufacturers have two options when submitting a De Novo reclassification request. Under the first option, a manufacturer submits a De Novo request after receiving a not substantially equivalent (NSE) determination in response to a 510(k) submission. Because this option was deemed burdensome and time intensive, FDASIA (P.L. 112-144) created a second option that allows FDA to classify certain novel devices without first issuing an NSE determination after reviewing a 510(k) submission.

Under this second option, a manufacturer submits a request for initial classification of a device, noting that no legally marketed device can be relied upon for a substantial equivalence determination.²² The request can recommended a classification for the novel device. If the manufacturer recommends class II, the request would need to include a draft proposal for general controls and special controls needed to provide reasonable assurance of safety and effectiveness, including a description of how the special controls provide such assurance.²³ Upon review of the request, FDA can reclassify the device based on certain risk classification criteria within 120 days,²⁴ thereby granting marketing authorization of the device and allowing the device to be used as a predicate device for future novel class II device submissions.

FDA can decline a De Novo classification request for various reasons. For example, FDA could determine that there is a legally marketed device that could be used as a predicate device in a 510(k) submission, or that the novel device should be a class III (high risk) device, or that general controls would be inadequate to control risks, and that special controls to mitigate the risks cannot be developed.²⁵

FDA has issued guidance to assist manufacturers with the De Novo classification process. Among other things, the guidance outlines the review process and includes scenarios under which a De Novo request could and could not be submitted, and when an optional presubmission prior to the De Novo request may be warranted.²⁶ In December 2018, FDA issued a proposed rule that would have established regulatory requirements for the De Novo classification process.²⁷ The final De Novo rule outlining procedures and criteria for De Novo requests and a pathway to marketing authorization was published in the Federal Register on October 5, 2021.²⁸

Medical Device Regulatory Controls

As required by the Medical Device Amendments (MDA), all medical devices are subject to basic regulatory requirements—general controls—intended to provide reasonable assurance of a device's safety and effectiveness. As the risk of the use of a device to a patient increases, corresponding regulatory requirements are put in place to assure the device is safe and effective—special controls and premarket approval (PMA). These regulatory controls are described in greater detail below.

General Controls

General controls are the regulatory requirements that all medical devices are subject to and, taken together, are intended to ensure that all devices meet the standard of reasonable assurance of safety and effectiveness. General controls include a range of premarket and postmarket requirements.

Some class I and II devices are exempt from certain general controls—specifically, premarket notification (i.e., a 510(k) submission) and current good-manufacturing practices (i.e., Quality System [QS] regulation). Each general control, as well these exceptions, is described in further detail below.

Establishment Registration

Domestic and foreign establishments that manufacture devices must register with FDA. Domestic establishments are those located in a state or territory of the United States, the District of Columbia, and the Commonwealth of Puerto Rico. Foreign establishments are those located in foreign countries and that import or offer for import devices into the United States.²⁹ Generally, facilities that manufacture the raw materials used in the manufacturing of devices (e.g., valve in a ventilator) are not required to register with FDA.³⁰

A person who owns or operates a domestic establishment that manufactures devices must register with FDA and submit specified information. The registration requirement applies regardless of whether the manufactured device is intended for U.S. commercial distribution.³¹ A person must register an establishment upon first engaging in the manufacture of a device, and the establishment must be registered annually thereafter between October 1 and December 31.³² Registrants must immediately register any additional establishments they own in which a device is initially manufactured.³³ The registration must include the name, place of business, specified contact information, and all such establishments that engage in the manufacture of a device or devices.³⁴ FDA regulations specify that registrants must initially register each domestic (and foreign) establishment no later than 30 days after beginning any process of device manufacturing.

As with domestic facilities, a person who owns or operates an establishment in a foreign country that manufactures devices for import into the United States must register with FDA upon engaging in the manufacture of a drug or device, and the establishment must be registered annually thereafter between October 1 and December 31.³⁵ Such registrants generally must submit to FDA the same information required for domestic facilities. However, the registration must also include the name and place of business of the establishment, the name of the U.S. agent for the establishment, the name of each importer of the device in the United States known to the establishment, and the name of each person who imports or offers for import the device to the United States.³⁶ Foreign establishments are required to update their registration information to reflect any changes in a U.S. agent's name, address, or phone number within 10 business days.

FDA regulations include additional requirements that apply to both domestic and foreign establishments. For example, per agency regulations, if covered operations are conducted at more than one establishment under common ownership and control, the parent, subsidiary, or affiliate company may submit registration information for all establishments. In addition, registrants are required to update their registration no later than 30 calendar days after changing the name, mailing address, or website address (if any) of the device establishment; the name, address, phone number, fax number, and email address of the owner or operator; the name, address, phone number, fax number, and email address of the establishment's official correspondent; or all trade names used by the establishment.³⁷

Certain entities are exempt from the registration requirements, including pharmacies; licensed health care practitioners; persons who manufacture devices not for sale but solely for research, teaching, or chemical analysis; wholesale distributors of devices; and other classes of persons exempted by FDA by regulation.³⁸

Device Listing

Every person who registers with FDA must, at the time of registration, file with FDA a list of devices—by their established and proprietary names—being manufactured for commercial distribution. Device listing generally occurs at two times: (1) at initial registration and listing, which must occur within 30 days of commencing device manufacturing, and (2) at annual registration and listing, which occurs between October 1 and December 31 of each year. A registrant may—but is not required—to make changes to modify the listing information at other times, such as when a device is first introduced into commercial distribution.³⁹

Specified information is required at the time of initial listing. Each device in the list must be accompanied by a brief explanation about why it is not being listed as a drug. In addition, a reference to the authority under which certain devices are being marketed (e.g., an FDA-assigned premarket application number), including the reason for not marketing them under certain authorities, is required.⁴⁰ A description of each activity or process that contributes to the device (e.g., manufacturing, sterilization) must be provided, including which part of the process occurred at which establishment under the owner or operator's control.⁴¹ Regarding labeling and advertising information, listings for restricted devices—those that can be sold only under authorization from a licensed health care provider or under conditions specified in regulation—must include a copy of all labeling and a representative sampling of advertisements. ⁴² If requested by FDA for a good cause, a copy of all advertisements for the restricted device must be submitted. For all other devices, the label and package insert for a device and a representative sampling of any other labeling must be submitted.⁴³

Each registrant must review and submit additional device listing information on an annual basis between October 1 and December 31. Registrants must (1) provide a list of devices introduced for commercial distribution that were not included on any previously submitted list; (2) report if the manufacture of any previously listed device has been discontinued since the last report (or resumed if previously discontinued); and (3) report any material change to previously submitted information.⁴⁴ Registrants must maintain in a historical file any material changes to labeling or advertisements made after the initial listing, and must maintain this file in a secure location, with additional storage requirements as specified in regulation.⁴⁵

Premarket Notification (510(k))

The Premarket Notification pathway (510(k)) is the most commonly used device premarket review pathway. In 2017, CDRH cleared 3,173 devices through the 510(k) pathway, representing 82% of the total devices cleared or approved that year.⁴⁶ Unless subject to a PMA or otherwise exempt, device manufacturers are required to submit a premarket notification—often referred to as a traditional 510(k) or 510(k)—at least 90 days prior to marketing the device.⁴⁷ In general, most class I devices are exempt from the 510(k) notification requirement (except for "reserved devices"),⁴⁸ whereas the majority of, but not all, class II devices are required to have a 510(k) clearance. A 510(k) submission must demonstrate that the device proposed to be marketed is substantially equivalent to a device already on the market (i.e., predicate device)—in other words, the new device must be as safe and effective as the predicate device. Substantial equivalence, as defined in statute, means that the proposed device has the same intended use as the predicate device. In addition, the proposed device also must have either the same technological characteristics—generally materials, design, or energy source—as the predicate device, or must have different technological characteristics that do not raise different questions of safety and effectiveness as demonstrated through performance data submitted to FDA showing comparable safety and effectiveness to the predicate device.⁴⁹ In other words, substantial equivalence does not mean that the new device is necessarily identical to the predicate device, and the amount and type of information required to demonstrate substantial equivalence vary based on the device.⁵⁰ In determining substantial equivalence, FDA may consider, as applicable, "intended use, design, energy used or delivered, materials, chemical composition, manufacturing process, performance, safety, effectiveness, labeling, biocompatibility, standards, and other characteristics."⁵¹ The type of data required by FDA to determine substantial equivalence varies by device, particularly when there are differences between the proposed device and the predicate device (with more differences likely to require more evidence).⁵²

Once FDA determines that the device to be marketed is substantially equivalent to the predicate device, the agency provides 510(k) clearance for the device to be marketed and classifies it to the same class and subsequent regulatory controls as its predicate. Although devices recently cleared under a 510(k) are commonly used as predicate devices, any legally marketed devices can be used as predicates. A legally marketed device is (1) a device that was legally marketed prior to May 28, 1976 (preamendments device); (2) a device that has been reclassified from class III to class II or I through administrative order or De Novo classification (and not exempt from premarket notification); or (3) a device that has been cleared through the 510(k) process.⁵³ If a manufacturer makes a significant change to a legally marketed device, the manufacturer may need to submit a new 510(k) if such a change would affect the safety or effectiveness of the device (e.g., changes in sterilization, cleaning, or disinfection).⁵⁴

There is no standardized 510(k) form or application, but submission format and requirements are described in regulation⁶⁰ and guidance.⁶¹ Among other things, a 510(k) submission must include the device name, establishment registration number (if applicable), proposed labeling, a statement of how the device is similar to and/or different from the predicate device (i.e., a 510(k) summary), and any other information that FDA deems relevant to make a substantial equivalence determination.⁶²

Special 510(k) and Abbreviated 510(k)

In 1998, FDA developed the optional Special and Abbreviated 510(k) programs to create more efficient review processes for certain changes to devices that are subject to 510(k) requirements. These programs were first described together in a single guidance document,⁶³ but in 2019, FDA split the programs into two distinct guidance documents.⁶⁴ Although both pathways are similar to the traditional 510(k) in that they require demonstration of substantial equivalence by comparing a new device to a predicate device, they allow for different (and streamlined) methods for demonstrating substantial equivalence.

The Special 510(k) pathway is intended for manufacturers that modify their own legally marketed devices when such a modification would warrant a new 510(k) submission. However, to be eligible for a Special 510(k) pathway, the modification must meet specified conditions. Among other things, FDA needs to be able to evaluate such modifications based on well-established methods (e.g., methods found in an FDA guidance document), and performance data must be sufficiently reviewable in a summary or risk analysis format.⁶⁵ FDA typically reviews such submissions within 30 days of receipt. If the agency determines that the submission is not appropriate for a Special 510(k), the submission is converted to a traditional 510(k) and the submitter is notified.⁶⁶

The Abbreviated 510(k) is intended for new applicants of devices who can use FDA guidance documents, special controls (described below in the "Special Controls" section), or voluntary consensus standards to demonstrate substantial equivalence.⁶⁷ Voluntary consensus standards are established by national or international organizations; they are subsequently recognized by FDA and permissible for use in premarket submissions in accordance with processes specified in statute and guidance.⁶⁸ An Abbreviated 510(k) is subject to a 90-day review period by FDA. As with a Special 510(k), if FDA determines that the submission is not appropriate for an Abbreviated 510(k), the submission is converted to a traditional 510(k) and the submitter is notified.⁶⁹

In February 2019, FDA expanded the concept of the Abbreviated 510(k) to include the Safety and Performance Based Pathway for certain devices that are well understood. Similar to an Abbreviated 510(k)'s reliance on FDA guidance, special controls, or voluntary consensus standards to support substantial equivalence, the Safety and Performance Based Pathway relies on FDA-identified performance criteria to demonstrate substantial equivalence to a predicate device. Performance criteria are established by FDA in guidance and are specific to a device type. In other words, a device is eligible for this pathway only if FDA has finalized a guidance document specifying performance criteria for that device.⁷⁰ As of late 2022, FDA has issued nine such final guidance documents and one such draft guidance.⁷¹

Accredited Persons

FDA is required to accredit individuals to review 510(k) submissions and make recommendations to FDA regarding how a device should be classified.⁷² Pursuant to this statutory requirement, FDA has established the 510(k) Third Party Review Program to allow accredited third-party review organizations to review certain low- to moderate-risk medical devices. The voluntary program is intended to speed up the 510(k) review process, while allowing FDA to focus resources on reviewing higher-risk devices.⁷³ FDA estimates that about half of 510(k) applications are eligible for this program. An overview of the 510(k) Third Party Review process is provided in Figure 1.

Figure 1. The 510(k) Third Party Review Program Process

Source: FDA, "510(k) Third Party Review Program," https://www.fda.gov/medical-devices/premarket-submissions/510k-third-party-review-program. Notes: The sole program payment is made between the 510(k) submitter and the review organization (i.e., a user fee payment to FDA is not required). FDA generally makes a decision within 30 days after receiving a recommendation from a review organization.

Accredited organizations must meet certain requirements specified in statute. Among other things, accredited persons may not be federal government employees, must be independent organizations not affiliated with device manufacturers, and cannot engage in the manufacture, design, sale, or promotion of devices.⁷⁴ FDA keeps an up-to-date list of accredited review organizations on its website.⁷⁵

Current Good Manufacturing Practices (Quality System Regulation)

Device manufacturers must comply with current good manufacturing practices (CGMPs) to assure that their products are safe, effective, and otherwise in compliance with the FFDCA. FDA may promulgate regulations requiring that, among other things, the manufacture, packaging, and storage of a device conform to CGMPs.⁷⁶ FDA first promulgated CGMP regulations in 1978. In 1990, to address provisions in the SMDA and conform CGMPs to international medical device quality system standards, FDA reissued regulations for devices as the quality system (QS) regulation. The revised regulation went into effect in 1997.⁷⁷ Among other things, the regulation includes requirements for design controls, production and process controls, corrective and preventive action, labeling and packaging controls, storage, and records.⁷⁸ More recently, the agency published a proposed rule in February of 2022 to update the QS regulation so it will "align more closely with the international consensus standard for devices by converging with the quality management system (QMS) requirements used by other regulatory authorities from other jurisdictions (i.e., other countries)."⁷⁹

Because the QS regulation applies to many different device types, it is intended to be broad and flexible. Rather than prescribing specific CGMPs for each device type, the regulation requires that manufacturers develop and follow procedures for designing, manufacturing, and distributing their specific devices. Based on the device type, the manufacturer determine the necessity of adhering to certain details within the QS regulation framework. Further, some devices are exempt from most CGMPs, as specified in their respective classification regulation. However, devices that are exempt from CGMP requirements are still subject to complaint file requirements⁸⁰ and general requirements concerning records,⁸¹ as specified in the QS regulation.

Records required to be kept to be in compliance with the device QS regulation do not, in general, need to be proactively reported by manufacturers; however, documentation of CGMPs must be included in a PMA or PMA supplement application.⁸² Under most circumstances, compliance with the QS regulation is assessed during FDA facility inspections. These inspections could include preapproval inspections for devices subject to a PMA or PMA supplement, risk-based surveillance inspections intended to assess compliance with CGMPs, or for-cause inspections if there have been consumer complaints or previous violations regarding CGMPs.

Adulterated and Misbranded Devices

The FFDCA prohibits the adulteration and misbranding of devices, as well as the introduction, receipt, and delivery of adulterated and misbranded devices into interstate commerce.⁸³

Adulterated Devices

In general, a device is deemed adulterated if

• it consists, in whole or in part, of any filthy, putrid, or decomposed substance;
• it has been prepared, packed, or held in insanitary conditions where it may have been contaminated or otherwise made injurious to health;
• its container is composed, in whole or in part, of any poisonous or deleterious substance;
• it contains, for coloring purposes only, an unsafe color additive; or
• its strength differs from, or its purity or quality falls below, what it claims to represent.⁸⁴

The MDA amended Section 501 of the FFDCA by adding device-specific adulteration provisions related to other aspects of FDA regulation of devices, including other general controls, special controls, and PMA requirements.⁸⁵ Pursuant to changes made by the MDA, a device is also deemed adulterated if

• it is subject to a performance standard and does not comply with all aspects of that standard;
• it is a class III device that does not conform with specified PMA application procedures;
• it is a banned device (discussed below);
• it is in violation of CGMPs; or
• it fails to comply with applicable IDE requirements.⁸⁶

Misbranded Devices

Many of the misbranding provisions for devices also apply to drugs. In general, a device (or drug) is misbranded if

• it was manufactured in an establishment that was not properly registered or was not listed as required;
• its labeling is false or misleading;
• its packaging does not bear a label containing the name and place of business of the manufacturer, packer, or distributor and an accurate statement of the content quantities by weight, measure, or numerical count;
• any word, statement, or other required information is not prominently placed on the labeling or not clearly stated so that it can be read and understood by an individual under customary conditions of purchase and use;
• its label does not bear adequate directions for use, including warnings against use in certain pathological conditions or by children, when applicable;
• it is dangerous to health when used in the dosage or manner, or with the frequency or duration, prescribed, recommended, or suggested in the labeling; or
• it is a color additive used for the purpose of coloring only and does not comply with relevant packaging and labeling requirements.⁸⁷

Similar to the adulteration provisions, the MDA amended Section 502 of the FFDCA by adding device-specific misbranding provisions. In general, a device is considered misbranded if

• its name (established or otherwise) is not prominently printed in type at least half as large as the proprietary name or designation (exemptions may be granted in certain cases);
• it is marketed without a 510(k) clearance (when applicable);
• a restricted device uses false or misleading advertising or is sold, distributed, or used in violation of FDA regulations;
• a restricted device manufacturer fails to include specified information in all advertisements or other descriptive materials;
• it is subject to a performance standard and the labeling does not comply with the requirements of that standard; or
• it does not comply with other specified requirements of the FFDCA.⁸⁸

Records and Medical Device Reporting

Medical device manufacturers and importers are required to establish and maintain records and make reports to assure that medical devices are not adulterated or misbranded and are otherwise safe and effective.⁸⁹ Through regulation, FDA can require medical device manufacturers and importers to report if a medical device may have caused or contributed to death or serious injury, or malfunctioned in a way that the device would likely cause death or serious injury.⁹⁰ Required reports cannot be overly burdensome and cannot disclose the identity of a patient, except under certain circumstances, among other things.

FDA has promulgated Medical Device Reporting (MDR) regulations that further specify reporting requirements for device manufacturers, importers, and user facilities. A medical device manufacturer or importer is required to report device-related deaths, serious injuries, and malfunctions to FDA, within 30 days of becoming aware of them.⁹¹ In addition, an importer is required to report device-related malfunctions to a manufacturer within 30 days of becoming aware of them, and a manufacturer is required to submit a report (i.e., a five-day report) to FDA within five work days of becoming aware of an event that requires "remedial action to prevent an unreasonable risk of substantial harm to the public health" or a reportable event for which FDA made a written request.⁹² A device user facility—a hospital, ambulatory surgical facility, nursing home, outpatient diagnostic facility, or outpatient treatment facility that is not a physician's office—is required to report to FDA and the manufacturer, if known, device-related deaths as soon as practicable but no later than 10 work days after becoming aware of them. Device-related serious injuries must be reported to the manufacturer, or FDA if the manufacturer is unknown, within 10 work days of becoming aware of them.⁹³ If any of these events are reported by a user facility, the facility is also required to submit an annual report documenting the total number of reports attached within that time period, among other things.⁹⁴

A required report can be submitted in writing or electronically using FDA Form 3500A, with other information required—as specified in regulation—depending on the type of event and whether it is the device manufacturer, importer, or user facility reporting the event. All MDR files are required to be retained by the manufacturer or importer for a period of two years or the shelf life of the device, whichever is greater. A user facility or distributor is required to retain MDR files for two years.⁹⁵ While a device distributor is not subject to reporting requirements, it is subject to record maintenance requirements.⁹⁶

In addition to these mandatory reporting (and recordkeeping) requirements, certain entities are encouraged to voluntarily report adverse events to FDA, as a complement to mandatory reporting requirements. Although user facilities are required to report device-related deaths, they are not required to report device malfunctions to FDA or manufacturers, but instead, are encouraged to do so. Health care professionals may use FDA Form 3500 to submit voluntary reports of significant adverse events. Patients, caregivers, and consumers may make voluntary reports using Form 3500B.⁹⁷ Such voluntary reports are submitted to MedWatch: The FDA Safety Information and Adverse Event Reporting Program for medical products, and may include instances of unexpected side effects or adverse events, product quality problems, product use errors, and therapeutic failures.⁹⁸

The Manufacturer and User Facility Device Experience (MAUDE) houses both mandatory and voluntary reports from specified time periods: "voluntary reports since June 1993, user facility reports since 1991, distributor reports since 1993, and manufacturer reports since August 1996."⁹⁹ FDA notes that "MAUDE data is not intended to be used either to evaluate rates of adverse events or to compare adverse event occurrence rates across devices."¹⁰⁰

Banned Devices

FDA may, by regulation, ban a device if the agency finds that the device presents substantial deception to users or unreasonable and substantial risk of illness or injury that cannot be corrected by a labeling change.¹⁰¹ When the agency makes such a determination and subsequently completes procedures for banning the device,¹⁰² the device is subject to a prohibition on current and future sales, distribution, and manufacture.

FDA rarely acts on this authority. As of early 2022, FDA regulations ban prosthetic hair fibers, powdered surgeon's gloves, powdered patient examination gloves, and absorbable powder for lubricating a surgeon's glove.¹⁰³ FDA used this authority most recently in March 2020, when the agency published a final rule banning electrical stimulation devices used for self-injurious or aggressive behavior (and did not ban its use for other purposes, for example, smoking cessation).¹⁰⁴ However, for the first time in the history of the use of this authority, the ban was overturned by the D.C. Circuit Court of Appeals in July 2021. The court found that FDA could ban the marketing of a device but could not prohibit only specific uses of a given device that continues to be marketed, because doing so would stray into the territory of the practice of medicine, in which the agency is prohibited from interfering.¹⁰⁵

Notification and Recall

To protect the public from faulty or fraudulent devices, FDA has the authority to notify certain individuals and take other actions to ensure that such devices are repaired, replaced, or refunded.¹⁰⁶ A recall—one of these actions—is a method of removing or correcting products that FDA considers to be in violation of the law. Recall does not include market withdrawal, routine servicing, or a stock recovery. A market withdrawal is a firm's removal or correction of a distributed product for a minor violation that does not violate the law and would not be subject to legal action by FDA (normal stock rotation practices, routine equipment adjustments and repairs, etc.). Stock recovery involves correcting a problem before a product is shipped (i.e., is still in the manufacturer's control).¹⁰⁷

Medical device recalls are almost always conducted voluntarily by a manufacturer after negotiation with FDA.¹⁰⁸ Manufacturers (including refurbishers and reconditioners) and importers are required to report to FDA any correction or removal of a medical device that is undertaken to reduce a health risk posed by the device.¹⁰⁹ However, a report is not required if one was already made under the MDR regulations. Additionally, manufacturers and importers must keep records of those corrections and removals that are not required to be reported to FDA.¹¹⁰ A recall may involve the removal of all or a portion of the product on the market (such as a single lot). In rare instances, if a manufacturer or importer does not voluntarily recall a device that poses a risk to public health, FDA can issue a mandatory recall order to the manufacturer upon determining that there is a "reasonable probability that a device intended for human use would cause serious, adverse health consequences or death."¹¹¹

When a recall is initiated voluntarily, FDA evaluates the health hazard presented, taking into account the following factors, among others:¹¹²

• Whether any disease or injuries have occurred from the use of the product.
• Whether any existing conditions could contribute to a clinical situation that could expose humans or animals to a health hazard.
• Assessment of hazard to various populations (e.g., children, surgical patients, pets, livestock) that would be exposed to the product.
• Assessment of the degree of seriousness of the health hazard to which the populations at risk would be exposed.
• Assessment of the likelihood of occurrence of the hazard.
• Assessment of the consequences (immediate or long-range) of the hazard.

Following the health hazard assessment, FDA classifies the recall according to the relative degree of health hazard. This action can sometimes create some confusion because devices are classified as class I, II or III as well, but this is an entirely distinct classification process with no relation to the risk classification of the device. Class I recalls are the most serious, reserved for situations where there is a reasonable probability that the use of, or exposure to, a product will cause serious adverse health consequences or death. Class II recalls are for situations where the use of, or exposure to, a product may cause temporary or medically reversible adverse health consequences, or where the probability of serious adverse health consequences is remote. In a Class III recall situation, the use of, or exposure to, a product is not likely to cause adverse health consequences. A recalling firm must develop a recall strategy that is reviewed and approved by FDA, and that addresses the depth of the recall, public notification, and effectiveness checks.¹¹³ In addition, a recalling firm must promptly notify all affected parties about the recall, and FDA must "promptly make available to the public in the weekly FDA Enforcement Report a descriptive listing of each new recall according to its classification, whether it was Food and Drug Administration-requested or firm-initiated, and the specific action being taken by the recalling firm."¹¹⁴

Labeling

All medical devices are required to be labeled in a way that informs a user of how to use the device. The FFDCA defines a "label" as a "display of written, printed, or graphic matter upon the immediate container of any article."¹¹⁵ "Labeling" is defined as "all labels and other written, printed, or graphic matter upon any article or any of its containers or wrappers, or accompanying such article" at any time while a device is held for sale after shipment or delivery for shipment in interstate commerce.¹¹⁶ The term "accompanying" is interpreted to mean more than physical association with the product; it extends to posters, tags, pamphlets, circulars, booklets, brochures, instruction books, direction sheets, fillers, and web pages, among other things.¹¹⁷ Accompanying can also include labeling that is connected with the device after shipment or delivery for shipment in interstate commerce.

All devices must conform to the general labeling requirements.¹¹⁸ Minimum requirements for the label include name and place of business, intended use, and adequate directions for use (e.g., route or method of application, quantity of dose, route of administration), among others. Some categories of devices are required to comply with additional or modified requirements (e.g., in vitro diagnostics and over-the-counter [OTC] devices). Additionally, some specific devices (e.g., hearing aids) require special labeling, which may include not only package labeling, but informational literature, patient release forms, performance testing, and/or specific tolerances or prohibitions on certain ingredients.¹¹⁹ Various exemptions to the labeling requirements (e.g., for prescription devices) are outlined in regulation.

Certain sections of the QS regulation also relate to different aspects of labeling.¹²⁰ For example, the QS regulation requires that labels remain legible and affixed to the product under normal conditions of use over the expected life of the device. In addition, the QS regulation addresses inspection, handling, storage, and distribution of labeling. These requirements, however, do not generally apply to the adequacy of labeling content, although failure to comply with CGMP requirements, such as proofreading, may result in labeling content errors.

Unique Device Identification (UDI)

To enhance postmarket surveillance of devices, the FDA Amendments Act of 2007 (FDAAA) and FDASIA required FDA to issue regulations establishing a unique device identification (UDI) system for devices.¹²¹ This system requires devices to bear a unique identifier to identify the device through both distribution and use. The UDI system enables rapid identification of a device and its attributes, especially those that could affect its safety and effectiveness. Among other things, the UDI system is intended to reduce medical error, simplify integration of device use information into data systems, and rapidly identify devices with associated adverse events.¹²²

In September 2013, FDA published the final UDI Rule.¹²³ Device labelers (usually, but not always, the device manufacturer) are required to include a UDI on device labels and packages (except where specified exceptions apply). In cases where a device is intended for more than one use and intended to be reprocessed before each use, the device labeler must also place the UDI directly on the device. A UDI is a unique numeric or alphanumeric code, including both a device and a production identifier, and it must be placed on labels and packages in both plain text and in a machine-readable format. A device labeler (or its designated contact) is required to provide FDA with certain information, which is then entered into the publically available Global Unique Device Identification Database (GUDID).¹²⁴

Special Controls

Special controls are the additional regulatory requirements put in place for moderate-risk (class II) devices because general controls do not provide reasonable assurance of safety and effectiveness. A special control is generally device-specific, and there must be sufficient information to establish the special control to provide an assurance of safety and effectiveness. Such requirements can include, among other things, performance standards, postmarket surveillance, patient registries, and development and dissemination of guidelines.¹²⁵

FDA has developed numerous guidance and guideline documents for individual generic device types (e.g., Antimicrobial Susceptibility Test [AST] systems, bone sonometers) to address the required special controls. These documents identify specific risks associated with the device type that are not addressed through general controls and outline FDA's suggested approaches for mitigating the identified risks. FDA notes that although manufacturers do not have to follow the agency's specific recommendations for mitigating a risk as outlined in a given guidance document, they must still address the identified risks "by some other means that provides equivalent assurances of safety and effectiveness."¹²⁶

Premarket Approval (PMA)

A PMA is the most stringent device marketing application required by FDA, and it is reserved for evaluating the safety and effectiveness of a class III medical device prior to marketing. PMA approval is based on a determination by FDA that the application contains sufficient valid scientific evidence to provide reasonable assurance that the device is safe and effective for its intended use(s).¹²⁷ FDA defines valid scientific evidence as "evidence from well-controlled investigations, partially controlled studies, studies and objective trials without matched controls, well-documented case histories conducted by qualified experts, and reports of significant human experience with a marketed device, from which it can fairly and responsibly be concluded by qualified experts that there is reasonable assurance of the safety and effectiveness of a device under its conditions of use."¹²⁸ Approval is based not only on the strength of the scientific data, but also on inspection of the manufacturing facility to ensure that the facility and the manufacturing process are in compliance with the QS regulation, among other things.¹²⁹

A PMA application must include, among other things, indications for use of the device, a device description, foreign and U.S. marketing history, summary of clinical and nonclinical studies, conclusions drawn from such studies, proposed labeling, and references to any required performance or voluntary standards.¹³⁰ Although the FDA does not provide a preprinted form for a PMA application, the agency suggests ways to format the application to expedite its processing.¹³¹ To facilitate the submission of required application sections in a serial fashion as data become available, manufacturers may use a PMA pathway known as the "modular PMA."¹³²

PMA review is a four-step process involving (1) an acceptance and filing review, (2) a substantive review, (3) a panel review, and (4) notification of FDA's final decision. During the first step, FDA notifies the PMA applicant within 45 days after the application has been received whether the application has been filed. An application is suitable for filing if it contains all information required by statute and regulation.¹³³ FDA will refuse to file an application if, among other things, it contains a false statement or if the data presented in the application are presented unclearly or incompletely. If such a refusal occurs, an applicant may resubmit the PMA with additional information or request an informal conference with the Director of the associated Office of Health Technology to review the decision not to file the PMA.¹³⁴

Once an application is determined suitable for filing, FDA generally has 180 days to issue an order approving or denying the application.¹³⁵ During substantive review, the second step in the process, FDA may notify the applicant of any major/minor deficiencies and the applicant may request to meet with FDA within 100 days of filing to discuss the application.¹³⁶ Following substantive review, FDA may refer the PMA to an advisory committee (panel review). In general, all "first-of-a-kind" devices are taken before the appropriate advisory panel for review and recommendation.

Advisory committees may be convened to make recommendations on any scientific or policy matter before FDA.¹³⁷ The committees are composed of scientific, medical, and statistical experts, and industry and consumer representatives. An advisory committee meeting allows interested persons to present information and views at a public hearing.¹³⁸ FDA typically accepts advisory committee recommendations for an application (approvable, approvable with conditions, or nonapprovable). However, there have been cases where FDA's decision has not been consistent with the committee's recommendation. When necessary, CDRH holds joint advisory committee meetings with other FDA centers. Though FDA regulations allow 180 days to review the PMA and make a determination, total review time may be longer due to agreement between the applicant and FDA or specific review times agreed to in a user fee agreement.¹³⁹

PMA Amendments and Supplements

If changes need to be made to an original PMA submission, either after its approval or pending its approval, an applicant can submit a PMA supplement or PMA amendment, respectively. If an applicant already has an approved PMA, a PMA supplement is required for a change that affects a device's safety or effectiveness.¹⁴⁵ Such changes include, among other things, new indications for use of the device, labeling changes, use of a different facility to manufacture the device, and changes in sterilization procedures.¹⁴⁶ Based on the change proposed, different types of PMA supplements can be submitted, as listed in Table 2.

Devices approved via a PMA supplement have smaller fees, shorter review times, and do not always require the collection of premarket clinical data. Clinical data refers to data obtained during a clinical trial involving human subjects, whereas preclinical data refers to nonhuman studies, such as mechanical engineering tests and animal studies. According to some observers, the features of the PMA supplement "encourage manufacturers to implement evolving technologies to create new models of devices that are incrementally different from previously approved additions. This helps facilitate rapid improvement in device technology, but also means that high-risk medical devices can gain PMA approval as supplements without any direct clinical study of the specific change made to the device."¹⁴⁷

A PMA amendment is a revision or addition to a PMA or PMA supplement submitted to FDA before its approval (i.e., to a pending PMA or PMA supplement). An amendment may be submitted at the initiative of the applicant or FDA, and it includes any additional correspondence after PMA or PMA supplement approval.¹⁴⁸ FDA may extend the review period up to an additional 180 days with the submission of an amendment by the applicant.¹⁴⁹

Investigational Device Exemption (IDE)

An investigational device exemption (IDE) allows a significant-risk device that has not been authorized for marketing to be used in a clinical study to collect safety and effectiveness data, which are most commonly used to support a PMA application. ¹⁵⁰ A significant-risk device, among other things, has the potential for serious risk to the health, safety, or welfare of a subject.¹⁵¹ The IDE also permits these devices to be shipped lawfully for investigation without requiring the manufacturer to comply with other requirements of the FFDCA requirements, such as registration and listing.¹⁵²

As the FFDCA requires,¹⁵³ FDA has promulgated regulations specifying the procedures and conditions under which an IDE may be granted.¹⁵⁴ An IDE application must include, among other things, the name and address of the sponsor, a complete report of prior investigations of the device, and the list of the name, address, and chairperson of each Institutional Review Board (IRB) that has been or will be asked to review the investigation.¹⁵⁵ Once FDA receives the original application, an IDE number is assigned and the application is considered approved 30 days after it has been received by FDA.¹⁵⁶ A sponsor must have received an IDE before initiating the clinical study and must comply with additional requirements while conducting the study, including specified labeling of the investigational device, obtaining informed consent for study participants, and distribution restrictions of the device, among others.¹⁵⁷

Certain categories of significant-risk devices are exempt from IDE requirements, such as a device undergoing consumer preference testing.¹⁵⁸ Moreover, nonsignificant-risk devices are those that do not pose a significant risk to human subjects and, as such, do not require submission of a full IDE application to proceed with a clinical evaluation.¹⁵⁹ However, these devices are required to comply with abbreviated IDE requirements, such as certain labeling requirements and IRB approval.¹⁶⁰

Facilitating Access to Medical Devices

Congress has authorized in statute certain pathways to allow for timely access to devices needed most by vulnerable populations. For example, Congress created the Humanitarian Device Exemption (HDE) to encourage the development of devices intended to treat and diagnose rare diseases and conditions. To expand access to innovative devices, Congress subsequently established the Breakthrough Device Pathway, which led to FDA creating the Breakthrough Devices Program. These efforts are described further below.

Humanitarian Device Exemption

For diseases that occur in a small number of patients, device manufacturers may find it difficult to provide sufficient data typically needed for device marketing applications. In response, Congress first authorized the HDE in the Safe Medical Devices Act of 1990 (P.L. 101-629). An HDE is an exemption from the effectiveness requirements of a PMA for a humanitarian use device (HUD) intended to treat or diagnose a condition affecting fewer than 4,000 individuals in the United States.¹⁶¹ Subsequent legislation (i.e., FDAMA, FDAAA, the 21^st Century Cures Act, and FDARA) made changes to the HDE program. For example, perhaps most significantly, the 21^st Century Cures Act (P.L. 114-255), among other things, expanded the scope of the HDE by allowing it to apply to conditions affecting fewer than 8,000 (rather than 4,000) individuals.¹⁶²

FDA may approve an HDE application for use of a HUD in clinical care under specified circumstances. Such circumstances include if (1) the device (as mentioned above) is designed to treat or diagnose a disease or condition affecting less than 8,000 individuals in the United States, (2) the device would not be available unless the exemption is otherwise granted and there is no comparable device to treat the disease or condition, and (3) the benefits of the device outweigh the risks.¹⁶³ FDA is required to approve or deny HDE requests no later than 75 days after it receives them. If an HDE is granted, the HUD may be used only under specified circumstances,¹⁶⁴ including that it must be used only in a health care facility with Institutional Review Board (IRB) oversight. In addition, the HDE holder may need to demonstrate continued compliance with certain requirements to maintain the HDE.¹⁶⁵

With the exception of certain, mostly pediatric, devices, a HUD may not be sold for an amount that exceeds the cost of the research, development, fabrication, and distribution of the device.¹⁶⁶ If a HUD is eligible to be sold for profit, the number of devices that may be sold is limited to the number of devices needed to treat 8,000 individuals, otherwise known as the annual distribution number (ADN). FDA provides the ADN number to the requestor upon HDE approval, but the requestor may petition FDA to modify the ADN in an HDE supplement.¹⁶⁷

Breakthrough Device Designation

Pursuant to FFDCA Section 515B—added by the 21^st Century Cures Act and amended by the FDA Reauthorization Act of 2017 (FDARA; P.L. 115-52)—FDA can expedite development and prioritize review of certain devices and device-led combination products designated as a "breakthrough device." Such devices would (1) provide more effective diagnosis or treatment of a life-threatening or irreversibly debilitating condition, and (2) represent breakthrough technologies for which no approved alternatives exist, offer significant advantages over existing alternatives, or are in the best interest of patients.¹⁶⁸ The Breakthrough Device Program includes two phases: (1) the Designation Request phase, in which a sponsor formally requests that a device receive a "breakthrough" designation, and (2) "actions to expedite development of the device and the prioritized review of subsequent regulatory submissions."¹⁶⁹

This program supersedes the former Priority Review Program and the Expedited Access Pathway (EAP) that together provided priority review for certain PMA applications, as well as support for development and review of breakthrough technologies. Devices designated under the EAP are now part of the Breakthrough Device Program, given similarities in the two programs.

The sponsor of a device or device-led combination product may request "breakthrough device" designation any time prior to review of a 510(k), PMA, or De Novo application. FDA's senior staff and managers must review the request, and the agency is required to make a decision within 60 calendar days.¹⁷⁰ If a request is approved, a team of FDA staff with relevant expertise are assigned to oversee the expedited development and premarket review of a device. As required by the 21^st Century Cures Act, FDA issued guidance regarding implementation of the Breakthrough Device Program in December of 2018.¹⁷¹ The guidance outlines overall program principles, including, for example, timely and interactive communication, efficient and flexible clinical study design, senior management engagement, and manufacturing considerations for PMA submissions.¹⁷²

Postmarket Surveillance

FDA's premarket review process is not designed to completely ensure the safety of all medical devices before they enter the market. Therefore, it is necessary to have a strong surveillance system that monitors device safety once they enter the market and clinical use. When a problem is identified, various corrective actions may be implemented, such as removing the device from the market, changing the device labeling and instructions for use, or improving user training. FDA's postmarket surveillance activities currently include mandated studies; adverse event reporting, or passive surveillance; and, more recently, efforts to develop active surveillance of medical devices in real-world settings.

Active surveillance "involves proactively obtaining and rapidly analyzing information occurring in millions of individuals recorded in large healthcare data systems to verify safety signals identified through passive surveillance or to detect additional safety signals that may not have been reported as adverse events to passive surveillance systems."¹⁷³ Passive surveillance which may be voluntary or mandatory, relies on unsolicited reports of adverse events that are sent to a central database or health authority. By definition, passive surveillance relies on outside entities (e.g., manufacturers, users, or importers).¹⁷⁴ In general, more robust passive surveillance relies on a combination of voluntary and mandatory systems or mechanisms, as is the case with FDA's postmarket surveillance systems for medical devices.

Relying on only passive mechanisms for the postmarket surveillance of medical devices such as traditional adverse event reporting systems—and to identify potential issues with devices for further investigation—may provide incomplete information. Moreover, passive surveillance may flag a possible issue or overemphasize certain safety signals, while missing others. Active surveillance, on the other hand, may decrease the burden on regulated entities, provide information in real-time, and provide more complete information about a device's overall safety and effectiveness profile. The use of both active and passive surveillance systems—in concert with targeted mandated studies based on findings from these systems—likely provides the most robust system of postmarket surveillance for devices.

Mandatory Postmarket Studies

Postmarket studies can help fill gaps in premarket data about a given device, and can help manufacturers respond to safety concerns identified through either active or passive surveillance systems (e.g., MDR or NEST). FDA can order two primary types of mandatory postmarket studies: so-called "522 studies" (also referred to as postmarket surveillance studies) and Post-Approval Studies (PAS). These studies differ in some respects, but both are an important component of the agency's overall medical device postmarketing surveillance activities.

Researchers have found that mandatory postmarket studies "have often been difficult to implement and complete reliably."¹⁷⁵ For example, a "key challenge in conducting these studies is a lack of incentives for clinicians and patients to participate, because they represent already marketed devices and an additional reporting burden and other requirements on top of their usual practice."¹⁷⁶ A September 2015 GAO study described "(1) the types of devices for which FDA has ordered a postapproval study and the status of these studies, and (2) the types of devices for which FDA has ordered a postmarket surveillance study and the status of these studies."¹⁷⁷ GAO analyzed FDA data on 313 postapproval studies that FDA ordered between January 1, 2007, and February 23, 2015. Of the 313 postapproval studies, GAO found that 225 (72%) were ongoing, 62 (20%) were completed, and 26 (8%) were inactive.¹⁷⁸ Of the 225 ongoing studies, 81% were making adequate progress and 19% were delayed due to, for example, limited patient enrollment.¹⁷⁹ GAO also analyzed FDA data on 392 postmarket surveillance studies that FDA ordered between May 1, 2008, and February 24, 2015. GAO found that 88% of the 392 postmarket surveillance studies were inactive, 10% were ongoing, and 2% were completed.¹⁸⁰

Partially prompted by the GAO study's findings, FDA released updated draft guidance documents for both 522 studies and PAS in May 2021. The draft guidance on 522 studies aims to increase transparency, as well as to provide information on how to fulfill Section 522 obligations.¹⁸¹ The draft guidance on PAS includes recommendations concerning the format, content, and review of PAS-related submissions, along with modified review-time goals for PAS-related submissions, among other things.¹⁸² These guidance documents were finalized in October 2022.¹⁸³

522 Studies

FDA has the authority to require, by order, manufacturers to conduct mandatory post-market studies to evaluate specific aspects of or overall device performance after device marketing—also called a 522 study, after the relevant section in the FFDCA. The order may be issued either at the time of a device's approval or clearance, or at any other time thereafter. FDA can determine the need for a 522 study based on many different reasons, including "analysis of adverse event reports, a recall or corrective action, post-approval data, review of premarket data, reports from other governmental authorities, or review of scientific literature."¹⁸⁴

Specifically, for certain class II and class III devices, FDA may order a manufacturer to conduct a postmarket surveillance study for an approved or cleared device in order to gather additional safety and effectiveness data.¹⁸⁵ A postmarket surveillance study may be ordered for class II or class III devices if

• device failure would be reasonably likely to have serious adverse health consequences;
• the device is expected to have significant use in pediatric populations;
• the device is intended to be implanted in the body for more than one year; or
• the device is intended to be a life-sustaining or life-supporting device used outside a device user facility.¹⁸⁶

A specific class II or class III device may be the subject of one or more requirements under a 522 order. Mandated 522 studies are not a condition of clearance or approval for most medical devices; however, FDA may require a 522 study as a condition of clearance or approval for a device with significant use in pediatric populations.¹⁸⁷ This is in contrast with Post-Approval Studies (described in the next section), which are a condition of an approval pursuant to a PMA or HDE.

Generally, manufacturers are required to submit a plan for postmarket surveillance to FDA for approval within 30 days of receiving a 522 order, and must begin any required postmarket surveillance not later than 15 months after being so ordered.¹⁸⁸ Manufacturers are required to provide certain reports during a 522 study, including interim reports to provide status updates, as well as a final postmarket surveillance report. FDA generally responds to the final report within 60 days, indicating either that the obligations under the order have been fulfilled, or that additional actions may be required (e.g., labeling change).¹⁸⁹

Post-Approval Studies

As a condition of approval for a PMA or an HDE, FDA may include a requirement for a post-approval study to obtain additional information on device safety, effectiveness, and/or reliability over long-term use of the device in real world populations.¹⁹⁰ Specifically, FDA can impose these requirements either in a PMA approval order, in regulation at the time of a PMA approval order, or through regulation after the PMA approval order.¹⁹¹ Specifically, regulation notes that the agency may require "continuing evaluation and periodic reporting on the safety, effectiveness, and reliability of the device for its intended use" and "such other requirements as FDA determines are necessary to provide reasonable assurance, and continuing reasonable assurance, of the safety and effectiveness of the device."¹⁹² A device may be the subject of one or more required post-approval studies imposed by an approval order. If a manufacturer fails to comply with these post-approval study requirements, as imposed through a PMA or HDE order, the agency is authorized to withdraw the approval.¹⁹³

Adverse Event Reporting

To date, FDA has relied on passive surveillance mechanisms to identify safety and other concerns with medical devices on the market. These mechanisms, which may be mandatory or voluntary, rely on a number of different entities, including device manufacturers, hospitals, health care providers, and patients themselves. FDA has taken steps to make reporting easier, for example by developing different reporting forms for different entities, establishing electronic Medical Device Reporting, and establishing a voluntary quarterly summary reporting option in certain cases for MDR reports.

Adverse event reporting requirements began with passage of the Safe Medical Devices Act of 1990 (SMDA, P.L. 101-629), which required FDA to establish a system for monitoring and tracking serious adverse events that resulted from the use or misuse of medical devices.¹⁹⁴ As noted above, MDR is one mechanism that FDA uses to identify and monitor significant adverse events involving medical devices,¹⁹⁵ and which involves variable reporting requirements for device manufacturers, user facilities, and importers.¹⁹⁶

In August 2009, FDA published notice of a proposed rule, as well as a related draft guidance document, that would require manufacturers to submit MDRs to the agency in an electronic format.¹⁹⁷ According to FDA, the proposed regulatory changes would provide the agency with an efficient data entry process that would facilitate timely access to adverse event information for medical devices and identification of emerging public health issues. The device industry requested a longer time frame to implement the changes. In February 2014, FDA published a final rule on Electronic Medical Device Reporting (eMDR) requiring manufacturers and importers to submit MDRs to the agency in an electronic format.¹⁹⁸ User facilities may also submit eMDR reports, but the final rule allows user facilities to continue to submit paper MDR reports.¹⁹⁹

In August 2018, FDA finalized an alternative format for reporting MDRs. The Voluntary Malfunction Summary Reporting Program was developed in response to goals outlined in the MDUFA IV commitment letter for streamlining malfunction reporting.²⁰⁰ This option allows certain groups of reports to be summarized and submitted on a quarterly basis. There are many exceptions to this alternative form of reporting, including, for example, that reports of death or serious injury still must be made separately.²⁰¹

National Evaluation System for Health Technology (NEST) and Real-World Evidence (RWE)

Although mandated studies and passive surveillance methods provide useful information to monitor the safety and effectiveness of devices postmarket, they have limitations; for example, the data on medical devices come from "disparate data sources with variable data elements, data definitions, data quality, and frequently from only limited subsets of patient exposures."²⁰² In light of these and similar concerns, a 2011 Institute of Medicine (now called the National Academies of Medicine) report recommended that FDA "develop and implement a comprehensive strategy to collect, analyze, and act on medical-device postmarket performance information."²⁰³

In response, FDA released a report in September 2012 outlining the parameters of a new national system for all stakeholders involved in the use of medical devices—patients, physicians, hospitals, payers, manufacturers, and regulators—that would rely on Real-World Data (RWD).²⁰⁴ The September 2012 report described "FDA's vision" for the creation of a national system focused on medical devices that "would augment, not replace, other mechanisms of surveillance such as FDA's MDR and MedSun."²⁰⁵ The new national system would conduct "active surveillance in near real-time using routinely collected electronic health information containing unique device identifiers," quickly identify "poorly performing devices," accurately characterize the "real-world clinical benefits and risks of marketed devices," and facilitate the "development of new devices and new uses of existing devices through evidence generation, synthesis and appraisal."²⁰⁶

FDA's September 2012 report proposed four specific actions to strengthen the U.S. medical device postmarket surveillance system:

• establish a UDI system and promote its incorporation into electronic health information;
• promote the development of national and international device registries for selected products;
• modernize adverse event reporting and analysis; and
• develop and use new methods for evidence generation, synthesis, and appraisal.²⁰⁷

In subsequent reports, FDA and its partners have further refined this vision and provided updates on efforts to create a new system for medical device surveillance and evaluation. The reports discuss ways to implement the system as a whole, including the role of a coordinating center, a seven-year implementation plan, and several pilot programs.²⁰⁸ These ideas and early steps have helped establish the National Evaluation System for Health Technology (NEST) Coordinating Center (NESTcc) and of many of its current activities.

FDA continues to work with relevant stakeholders to support NEST, a collaborative database intended to "link and synthesize data from different sources across the medical device landscape, including clinical registries, electronic health records, and medical billing claims."²¹² Although the system builds upon requirements authorized in statute (e.g., unique device identification),²¹³ this effort appears to be FDA-initiated. The development of NEST was included in CDRH's 2016-2017 Strategic Priorities,²¹⁴ and in 2016 FDA awarded funding to the Medical Device Innovation Consortium (MDIC) to establish NESTcc.²¹⁵ NESTcc "provides governance for the NEST ecosystem, oversees infrastructure building, promotes standards, and monitors progress."²¹⁶ FDA has noted that NESTcc is working to "develop the infrastructure needed to establish an active surveillance system that can be utilized by FDA and other stakeholders."²¹⁷ This work has included evaluations of more than 20 test cases in various areas, including (1) exploring the feasibility of device manufacturers using RWD and Real-World Evidence (RWE)²¹⁸ for various pre- and postmarket regulatory activities, (2) publishing Data Quality and Methods Frameworks, and (3) accepting proposals for the development of active surveillance cloud infrastructure.²¹⁹

The information generated through NEST may be used not only for purposes of postmarket surveillance, but it may also be used to support premarket regulatory decision-making and expanded indications for use after clearance or approval, among other things. On July 27, 2016, FDA released draft guidance—and final guidance in August 2017—explaining how manufacturers may use RWD to support development of RWE to meet regulatory requirements and supporting regulatory decisions across the total product life cycle (TPLC) of a device.²²⁰ FDA defines RWD as "data relating to patient health status and/or the delivery of health care routinely collected from a variety of sources,"²²¹ and notes that such sources may include, for example, "administrative and healthcare claims, electronic health records, data obtained as part of a public health investigation or routine public health surveillance, and registries."²²² The guidance outlines the characteristics of RWD that are important to the agency, and identifies several examples of regulatory decision-making where RWE derived from such data may be used. In addition, in March 2021, CDRH published an analysis of the use of RWE in regulatory decisions for medical devices from 2012 to 2019 using 90 different device examples.²²³ The "examples come from the full continuum of clinical and device areas throughout CDRH and across the medical device total product life cycle but do not comprise an exhaustive list of all submissions that have relied on RWE."²²⁴

Appendix A. History of Laws Governing Medical Device Regulation

The Federal Food, Drug and Cosmetic Act of 1938 (FFDCA)

The first general federal food and drug law, the Food and Drugs Act of 1906 (P.L. 59-384), did not contain any provisions to regulate medical device safety or claims made regarding such devices. Strong support for reform developed during the 1930s due to "false therapeutic claims for medical devices [that] were being presented to the public through radio and newspaper advertising."²²⁵ Medical devices came under federal scrutiny when Congress passed the Federal Food, Drug and Cosmetic Act (FFDCA) of 1938 (P.L. 75-717). The regulatory authority provided to FDA by the 1938 law was "limited to action after a medical device has been offered for introduction into interstate commerce" and only when the device was deemed to be "adulterated or misbranded."²²⁶

Most of the legitimate devices on the market at the time the 1938 act became law "were relatively simple items which applied basic science concepts such that experts using them could readily recognize whether the device was functioning properly; the major concern with respect to these devices was assuring truthful labeling."²²⁷ During the first 20 years following enactment of the 1938 law, FDA's activity with respect to medical devices involved protecting the American public from fraudulent devices; FDA began to turn its attention to the hazards from legitimate devices around 1960.²²⁸

Congress amended the FFDCA in 1962 to require FDA approval of a new drug application prior to marketing and to require that a new drug be shown to be effective as well as safe. Following these changes, FDA began "to impose rigorous premarket approval of some products that today would be deemed devices." Court decisions in the late 1960s upheld FDA's authority to regulate some medical devices as drugs due in part to the overlapping definitions of drug and device in the 1938 law. FDA classified a number of devices as drugs (contact lenses, injectable silicone, pregnancy-test kits, bone cement), and only such devices were subject to premarket review (prior to 1976). However, the approach of classifying devices as a drug was unsuccessful in other court decisions, and the need for more comprehensive authority to regulate devices was recognized by the Kennedy, Johnson, and Nixon Administrations.²²⁹

The Medical Device Amendments of 1976

The Medical Device Amendments of 1976 (MDA; P.L. 94-295) was the first major legislation passed to address the review of medical devices. The MDA provided a definition for the term device.²³⁰ It established a number of requirements referred to as general controls that applied to all devices.²³¹ Examples include provisions on adulteration and misbranding, prohibitions on false or misleading advertising, and a requirement to register all medical device manufacturers with FDA. One such provision required manufacturers to notify FDA 90 days prior to the marketing of any new device; if the agency failed to act, marketing could begin. Because this provision is outlined in Section 510(k) of the FFDCA, it is often referred to as a "510(k) notification."

The MDA directed FDA to classify, into one of three classes, all medical devices that were on the market at the time of enactment; these are the preamendment devices.²³² Congress provided definitions for the three classes—class I, class II, class III—based on the risks to patients posed by the devices. In contrast to the approach taken with pharmaceuticals (all, except generic agents, undergo rigorous premarket review and approval), Congress limited premarket approval to only a small number of devices. "Only the highest-risk category [class III] would require agency review and approval as a precondition for commercial sale and routine medical use. The other two categories would be subject not to a rigorous review but merely a requirement [510(k)] that the manufacturer of a device notify FDA, at least 90 days before commencing marketing, of its intent to distribute the product commercially."²³³ For class I devices, no additional review was needed once that status was confirmed; general controls were considered to be sufficient to protect public health. For class II devices, limited supplemental review was needed to verify conformity with performance standards if such standards had been established by the agency.²³⁴

Under MDA, all devices coming to market after enactment were automatically placed in class III until reclassified; these are the postamendment devices. As stated above, class III medical devices receive more intense scrutiny and require an application for premarket approval (PMA) before they can be marketed. However, the MDA allowed for the reclassification of a device from one class to another.

The MDA did not provide a definition for the term substantially equivalent. Nor did the MDA itemize the required contents of a 510(k). Such a notification "need only set forth its proposed intended use or indications for use, the device to which substantial equivalence is claimed, and evidence demonstrating that equivalence."²³⁵

The Safe Medical Devices Act of 1990

The Safe Medical Devices Act of 1990 (SMDA; P.L. 101-629) made a number of changes to the law, such as providing a definition for the term substantial equivalence and revising the definition for class II devices. FDA had not promulgated performance standards for most class II devices. The new law authorized the use of alternative restrictions, called special controls, at the agency's discretion and simplified the process of establishing performance standards for class II devices. Examples of special controls include special labeling requirements, mandatory performance standards, patient registries, and postmarket surveillance.

FDA also had experienced difficulty in promulgating regulations needed to require submission of PMA applications for class III devices. SMDA authorized FDA to reconsider all the preamendment devices that had been placed in class III and to reclassify some of these devices into class I or class II.²³⁶ The purpose was "to reduce the number of device types that needed PMA review."²³⁷ For those devices remaining in class III, the agency was directed to establish a schedule for promulgation of regulations calling for PMAs of devices that still used the 510(k) notification as an entry to the marketplace.

SMDA established postmarket requirements for medical devices. It required facilities that use medical devices to report to FDA any incident that suggested that a medical device could have caused or contributed to the death, serious illness, or injury of a patient. Manufacturers of certain permanently implanted devices were required to establish methods for tracking the patients who received them and to conduct postmarket surveillance to identify adverse events. The act authorized FDA to carry out certain enforcement actions, such as device product recalls, for products that did not comply with the law.

The FDA Modernization Act of 1997

The Food and Drug Administration Modernization Act of 1997 (FDAMA; P.L. 105-115) mandated wide-ranging reforms in the regulation of foods, drugs, and medical devices by FDA. In general, provisions involving medical devices "were designed to reduce FDA's workload and permit concentration of resources on devices that presented greater potential for harm" and "to limit the FDA's discretion and authority in regulating the device industry" in order to "accelerate the pace of technology transfer."²³⁸

FDAMA eliminated the 510(k) notification requirement for most class I devices and some class II devices. It authorized the creation of a third-party review system of 510(k) submissions for class I and most class II devices that still required 510(k) review. It allowed certain new devices (those not substantially equivalent to another device and automatically placed in class III) to be evaluated for immediate placement in class I or class II.

For substantial equivalence determinations in which a new device has a different technological characteristic, FDAMA requires that FDA "consider the least burdensome means of demonstrating substantial equivalence and request information accordingly."²³⁹ For a medical device using an important breakthrough technology, or that does not have an approved alternative device, priority review of the PMA must be provided by FDA.²⁴⁰

FDAMA limited the use of some postmarket controls (device tracking and postmarket surveillance) to class II and class III devices, eased reporting requirements of adverse events for device user facilities, eliminated mandatory reporting of adverse events by medical device distributors, and directed FDA to establish a sentinel reporting system to collect information on deaths and serious injuries or illnesses associated with the use of a medical device.²⁴¹

Medical Device User Fee Acts of 2002

The Medical Device User Fee and Modernization Act of 2002 (MDUFMA; P.L. 107-250) established a user fee program for specified premarket activities (e.g., review of premarket submissions); user fees may not be used for other FDA or CDRH activities. MDUFMA also made targeted changes that reduced regulatory burden and agency workload, such as allowing establishment inspections to be conducted by accredited persons (third parties). MDUFMA was amended and clarified by two laws—the Medical Device Technical Corrections Act of 2004 (MDTCA, P.L. 108-214) and the Medical Device User Fee Stabilization Act of 2005 (MDUFSA, P.L. 109-43). MDUFSA made substantive changes to the MDUFA small business fee waiver/reduction, specifically, expanding the applicability of the reduction in certain fees to more businesses by modifying the definition of small business from those with gross receipts totaling less than $30 million to those with gross receipts totaling less than $100 million (see Section 2(a)(3) and (4) of P.L. 109-43). The medical device user fee program established by MDUFMA was subsequently reauthorized in 2007, 2012, 2017 and most recently in 2022.

FDA Amendments Act of 2007

The Food and Drug Administration Amendments Act of 2007 (FDAAA; P.L. 110-85) amended the FFDCA and the PHSA to reauthorize the prescription drug and medical device user fee programs and to make agency-wide changes, several of which had implications for the regulation of medical devices. FDAAA created incentives, as well as reporting and safety requirements, for manufacturers of medical devices for children; required that certain clinical trials for medical devices and some other products be publicly registered and have their results posted; created requirements to reduce conflicts of interest in advisory committees for medical devices and other products;²⁴² and made certain other amendments to the regulation of devices.

FDA Safety and Innovation Act of 2012

The Food and Drug Administration Safety and Innovation Act of 2012 (FDASIA, P.L. 112-144) amended the FFDCA and the PHSA to reauthorize the prescription drug and medical device user fee programs, create new user fee programs for generic and biosimilar drug approvals, and modify FDA authority to regulate medical products. Several provisions in FDASIA modified aspects of premarket and postmarket medical device regulation. Examples of premarket changes include those that affect the efficiency, transparency, and data requirements of the 510(k) and PMA processes, and alter or make clarifications to certain types of exempt devices; for example, custom devices and humanitarian use devices. Provisions affecting postmarket regulation include those that focus on expanding active postmarket surveillance, altering requirements related to postmarket studies for devices, and strengthening both device recall and tracking capabilities through a recall program and the unique device identifier system. FDASIA also required the Secretary to establish a program to improve the device recall system.²⁴³

Miscellaneous reforms include those aimed at increasing transparency of FDA's approval and clearance decisions and processes for issuing industry guidance documents, improving health information technology for the agency, and harmonizing device regulation with FDA's international counterparts.

21^st Century Cures Act

The 21^st Century Cures Act (P.L. 114-255) was signed into law on December 13, 2016. Division A of the law provides funding for biomedical research—including the Precision Medicine Initiative (PMI) and the Cancer Moonshot Initiative—and for the opioid crisis response; modifies FDA pathways for the approval of regulated medical products; and makes a number of reforms to the National Institutes of Health (NIH). Certain provisions made changes to the regulation of medical devices to enhance access to innovative devices and to streamline aspects of the medical device review process.

Specifically, the law established the Breakthrough Device Designation to codify certain existing agency efforts and to help speed access to innovative devices that "provide more effective diagnosis or treatment of a life-threatening or irreversibly debilitating condition" and that "represent breakthrough technologies for which no approved alternatives exist" without compromising or altering the standards of review for the devices. In addition, the law expanded the applicability of the HDE, ensuring that this exemption would apply to more devices affecting more people.

Other changes included establishing a formal mechanism for requesting recognition of standards that may be used for purposes of premarket review; requiring FDA to clarify class I and class II devices that are exempt from 510(k) notification requirements; and ensuring that there is "adequate expertise" on device classification panels. In addition, it provided flexibility for Institutional Review Board (IRB) requirements related to Investigational Device Exemptions (IDEs); ensured that each FDA employee involved in the review of premarket submissions, including supervisors, receives training on the "meaning and implementation of the least burdensome requirements," and clarified that least burdensome principles should include the effect of postmarket activities on premarket decisions; and modified the definition of medical device to exclude certain types of health software, including products that provide a variety of administrative and health management functions, electronic health record technology, and software that interprets and analyzes patient data to help make clinical diagnosis or treatment decisions.

FDA Reauthorization Act of 2017

The Food and Drug Administration Reauthorization Act of 2017 (FDARA, P.L. 115-52) Title II, the Medical Device User Fee Amendments of 2017, reauthorized the medical device user fee program through FY2022. FDARA also made certain changes relevant to regulation of pediatric devices specifically, including adding additional elements to the required annual report on pediatric medical devices; reauthorizing funding for an FDA demonstration grant program for improving pediatric medical devices, and requiring a nonprofit consortium that receives a demonstration grant to provide regulatory consultation to device sponsors in support of a pediatric device application; and requiring the Secretary to convene a public meeting on the development, approval or clearance, and labeling of pediatric medical devices not later than one year after enactment.

FDARA made a number of changes to improve the inspection process for device manufacturing facilities. These included, among others, changing the inspection schedule of establishments engaged in the manufacture or processing of a device from biennial to a risk-based approach; requiring the Secretary to identify and adopt uniform standards and processes for the conduct of device establishment inspections, other than for-cause inspections; adding that a device may be considered to be adulterated if a device establishment delays, denies, or limits an inspection, or refuses to permit entry or inspection; and allowing the Secretary to recognize a wider range of auditing organizations to facilitate international device establishment inspections. In addition, FDARA made changes to the classification of accessories that are used with medical devices; directed the Secretary to initiate one or more voluntary postmarket pilot projects to generate timely and reliable information on the safety and effectiveness of approved or cleared medical devices (the pilot projects will use electronic health data and will prioritize certain specified devices and device types); and required the Secretary, acting through the FDA Commissioner, to conduct a review through an independent third-party contract to determine whether such pilot projects generate reliable and timely evidence about the safety and effectiveness of medical devices. Finally, FDARA made changes to the regulation of over-the-counter hearing aids and required a report on medical device servicing.

Appendix B. Acronyms Used in This Report