The Biomedical Quality Auditor Handbook Sampler

The Biomedical Quality
Auditor Handbook
Also available from ASQ Quality Press:
Quality Risk Management in the FDA-Regulated Industry, Second Edition

José Rodríguez-Pérez
The Certified Pharmaceutical GMP Professional Handbook, Second Edition

FDC Division and Mark Allen Durivage, editor
Handbook of Investigation and Effective CAPA Systems, Second Edition

The FDA and Worldwide Current Good Manufacturing Practices and

Quality System Requirements Guidebook for Finished Pharmaceuticals
Statistical Process Control for the FDA-Regulated Industry

Manuel E. Peña-Rodríguez
Proactive Supplier Management in the Medical Device Industry

James B. Shore and John A. Freije
The ISO 9001:2015 Implementation Handbook: Using the Process Approach to

Build a Quality Management System
Milton P. Dentch
The Certified Six Sigma Yellow Belt Handbook

Govindarajan Ramu
The Art of Integrating Strategic Planning, Process Metrics, Risk Mitigation, and Auditing
J.B. Smith
Advanced Quality Auditing: An Auditor’s Review of Risk Management, Lean Improvement,

and Data Analysis
Lance B. Coleman
Mastering and Managing the FDA Maze, Second Edition

Gordon Harnack
Development of FDA-Regulated Medical Products, Second Edition

Elaine Whitmore
To request a complimentary catalog of ASQ Quality Press publications, call

800-248-1946, or visit our Web site at http://www.asq.org/quality-press.
The Biomedical Quality
Auditor Handbook
Third Edition
ASQ Biomedical Division

Heather Crawford, Editor
ASQ Quality Press

Milwaukee, Wisconsin
American Society for Quality, Quality Press, Milwaukee, WI 53203
© 2017 by ASQ.
All rights reserved. Published 2017.
Printed in the United States of America.
22 21 20 19 18 17 5 4 3 2 1
Library of Congress Cataloging-in-Publication Data

Name: Crawford, Heather, 1972- editor.
Title: The biomedical quality auditor handbook / ASQ Biomedical Division,
Heather Crawford, editor.
Description: Third edition. | Milwaukee, Wisconsin: ASQ Quality Press, 2017.
Includes bibliographical references and index.
Identifiers: LCCN 2017031721 | ISBN 9780873899628 (hardcover: alk. paper)
Subjects: LCSH: Medical instruments and apparatus—Quality control—Handbooks,
manuals, etc.
Classification: LCC R856.6 .B55 2017 | DDC 610.28/4dc23
LC record available at https://lccn.loc.gov/2017031721
No part of this book may be reproduced in any form or by any means, electronic, mechanical,
photocopying, recording, or otherwise, without the prior written permission of the publisher.
Director, Quality Press and Programs: Ray Zielke

Managing Editor: Paul Daniel O’Mara
Sr. Creative Services Specialist: Randy L. Benson
ASQ Mission: The American Society for Quality advances individual, organizational,
and community excellence worldwide through learning, quality improvement, and
knowledge exchange.
Attention Bookstores, Wholesalers, Schools, and Corporations: ASQ Quality Press books,
video, audio, and software are available at quantity discounts with bulk purchases for
business, educational, or instructional use. For information, please contact ASQ Quality Press
at 800-248-1946, or write to ASQ Quality Press, P.O. Box 3005, Milwaukee, WI 53201-3005.
To place orders or to request ASQ membership information, call 800-248-1946. Visit our
Web site at www.asq.org/quality-press.
Printed on acid-free paper

Table of Contents
List of Figures and Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii
Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv
Part I: Auditing
Chapter 1 Auditing Fundamentals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Types of Audits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Audit Roles, Responsibilities, and Authorities . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Ethical, Legal, and Professional Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Chapter 2 Auditing and Inspection Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Audit Preparation and Planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Audit Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Audit Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Audit Follow-up and Closure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Chapter 3 Audit Procedural References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
ISO 19011 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Quality System Inspection Technique (QSIT) . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
FDA Policy Compliance Guide (CPG) 7832.845 . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Part II: Biomedical Quality Management System Requirements

Chapter 4 US Requirements—Federal Food, Drug, and
Cosmetic Act (FDCA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
FDCA Chapter II: Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
FDCA Chapter III: Prohibited Acts and Penalties . . . . . . . . . . . . . . . . . . . . . . . . 23
FDCA Chapter V: Drugs and Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
FDCA Chapter VII: General Authority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Chapter 5 US FDA Code of Federal Regulations (CFR) Title 21 . . . . . . . . . . . . 43
21 CFR 11 Electronic Records and Signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
21 CFR 801 Labeling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
21 CFR 803 Medical Device Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
21 CFR 806 Corrections and Removals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
21 CFR 807 Establishment Registration and Device Listing for
Manufacturers and Initial Importers of Devices . . . . . . . . . . . . . . . . . . . . . . . 96
21 CFR 820 Quality System Regulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
21 CFR 821 Medical Device Tracking Requirements . . . . . . . . . . . . . . . . . . . . . . 128
v
vi Table of Contents
Chapter 6 The EU Medical Device Directives . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

Purpose of the Medical Device Directives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
Requirements for Compliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
Determining Whether the Product Must Comply with the Directives . . . . . . 141
Classification of Medical Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
Conformity Assessment Route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
Compliance with Essential Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
Risk Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
Technical File/Design Dossier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
Authorized Representative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
CE Marking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Declaration of Conformity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
Chapter 7 Other International Regulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
Canada . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
Japan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
Australia . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
Brazil . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
China . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
Chapter 8 FDA Guidance for Manufacture of In Vitro
Diagnostic (IVD) Products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
FDA-Recognized Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Product Development . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
Chapter 9 International Standards for Quality Systems . . . . . . . . . . . . . . . . . . . 159
ISO 9001 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
ISO 13485 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
EN ISO 13485 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
ISO/IEC 17025 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
GHTF.SG3.N99-10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
Chapter 10 Quality System Regulation (QSR) Requirements . . . . . . . . . . . . . . 164
Preamble . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
General Provisions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
Quality System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173
Design Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
Document Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
Purchasing Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186
Identification and Traceability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
Production and Process Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
Acceptance Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
Nonconforming Product . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197
Corrective and Preventive Action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198
Labeling and Packaging Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
Handling, Storage, Distribution, and Installation . . . . . . . . . . . . . . . . . . . . . . . . 204
Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206
Servicing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
Statistical Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214
Table of Contents vii
Chapter 11 Postmarket Surveillance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216

US Section 522 Postmarket Surveillance Studies . . . . . . . . . . . . . . . . . . . . . . . . . 216
US Product Recalls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216
EU Device Incident Reporting (Vigilance) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226
Part III: Technical Biomedical Knowledge

Chapter 12 Risk Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
ISO 14971 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
IEC 62366 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234
Chapter 13 Sterilization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236
Validation Studies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236
Sterilization Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240
Chapter 14 Biocompatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
ISO 10993 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
FDA Blue Book Memorandum #G95-1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
Chapter 15 Controlled Environments and Utility Systems . . . . . . . . . . . . . . . . 249
Controlled Environments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Utility Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
Facility Qualification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
Chapter 16 Software Development and Maintenance for Products . . . . . . . . 252
Software Development Planning and Process . . . . . . . . . . . . . . . . . . . . . . . . . . . 254
Requirements Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255
Software Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255
Implementation and Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256
Verification and Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256
SOUP and COTS Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258
Design Transfer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258
Design Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258
How to Validate Process Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259
Guidelines for a Successful Software Development Program . . . . . . . . . . . . . . 260
Chapter 17 Laboratory Testing and Failure Analysis . . . . . . . . . . . . . . . . . . . . . . 262
Approved Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
Biological Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
Analytical Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268
Failure Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269
Chapter 18 Sources for New and Evolving Standards . . . . . . . . . . . . . . . . . . . . . 270
FDA Recognized Consensus Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270
Hierarchy of Standards in the EU . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270
EU Harmonized Standards Listing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
Medical Device Guidance (MEDDEV) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272
Notified Body Operations Group (NBOG) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274
viii Table of Contents
Chapter 19 Common Medical Device Directives and Standards . . . . . . . . . . . 276

Directives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276
Regulations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277
Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277
Chapter 20 Packaging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279
ISO 11607 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280
ASTM D4169 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281
ASTM F1980 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282
Chapter 21 Reprocessing/Reuse and Cleaning of Medical Devices . . . . . . . . 283
FDA Draft Guidance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283
Process Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284
Labeling for Reusable Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284
FDA’s Criteria for Reprocessing Instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284
Validation of Reprocessing Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
Validation of Cleaning Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
Validation of Terminal Reprocessing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
Part IV: Quality Tools and Techniques

Chapter 22 Quality Control and Problem-Solving Tools . . . . . . . . . . . . . . . . . . 288
Pareto Charts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288
Cause and Effect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288
Flowcharts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290
Statistical Process Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291
Check Sheets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291
Scatter Plot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291
Histograms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292
Root Cause Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292
Plan-Do-Check-Act . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293
Chapter 23 Process Improvement Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294
Process Capability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294
Six Sigma . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294
Lean Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295
Measurement Systems Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295
Cost of Quality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296
Chapter 24 Data Types and Sampling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297
Qualitative Versus Quantitative Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297
Attribute and Variable Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297
Table of Contents ix
Part V: Appendices
Appendix A: Glossary of Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299
Appendix B: Certified Biomedical Auditor (CBA) Body of
Knowledge (2013) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311
Six Levels of Cognition Based on Bloom’s Taxonomy (Revised 2001) . . . . . . . . 319
Appendix C: Certified Biomedical Auditor (CBA) References (2013) . . . . . . . . . 321
Endnotes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331
List of Figures and Tables
Figure 2.1 Audit process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Table 5.1 Summary table—adverse event reporting requirements . . . . . . 73
Table 6.1 European medical device conformity assessments
(including reference to relationship with EN ISO 13485:2012) . . 144
Table 6.2 European medical device conformity assessment routes
by classification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Table 7.1 Product classification, Japan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
Table 7.2 Australia (TGA) classification levels . . . . . . . . . . . . . . . . . . . . . . . . 154
Figure 9.1 Process validation decision tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
Table 12.1 Severity rating—measure of the possible consequences
of a hazard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
Table 12.2 Probability of occurrence rating . . . . . . . . . . . . . . . . . . . . . . . . . . . 232
Figure 12.1 Evaluation of risk level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232
Table 14.1 ISO 10993-1, initial and supplementary evaluation tests . . . . . . . 247
Table 15.1 Comparison of airborne particulate cleanliness class,
14644-1:1999 and US Federal Standard 209 E . . . . . . . . . . . . . . . . . 250
Figure 16.1 Software development process . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254
Table 16.1 Third-party software validation activities . . . . . . . . . . . . . . . . . . . 260
Figure 22.1 Pareto chart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
Figure 22.2 Cause-and-effect diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
Figure 22.3 Flowchart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290
Figure 22.4 Scatter plot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292
Figure 22.5 Histogram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293
xi
Preface
T
he Biomedical Quality Auditor Handbook was developed by the ASQ
Biomedical Division in support of its mission to promote the awareness
and use of quality principles, concepts, and technologies in the biomedical
community. It principally serves as a resource to candidates preparing for the
Certified Biomedical Auditor (CBA) certification exam. The Biomedical Auditor
Certification was initially introduced as an add-on to the Certified Quality Auditor
(CQA) certification in 2000, and became the stand-alone CBA certification in 2005.
Obtaining the CBA credential establishes the competence of an auditor in the
biomedical industry, with the CBA described as understanding the principles
of standards, regulations, directives, and guidance for auditing a biomedical
system. The CBA certification exam is supported by its Body of Knowledge (BoK)
and reference list that define the exam scope with both elements maintained
concurrently and generally updated every five years.
Regulations and guidance affecting the medical device industry continually
evolve. Although new or updated requirements may be introduced at any time,
revisions to the exam BoK, reference list, and exam maintain their five-year review
cycle. Consequently, contents of this Handbook and CBA certification differ from
the current state of the biomedical industry.
This third edition of The Biomedical Quality Auditor Handbook correlates to the
2013 exam BoK and reference list, which are provided as appendices. This edition
includes updates and corrections to errors and omissions in the second edition.
Most notably, it has been re-organized to align more closely with the BoK.
Topics in this handbook are described in summary fashion, and not intended
as a stand-alone tool for exam preparation. It is suggested that exam candidates
read and understand the reference material in order to have a complete background
in any one topic. The combination of this publication and reference materials is
intended to provide a well-rounded background in biomedical auditing.
The ASQ Biomedical Division believes this handbook will be a useful resource
to those biomedical professionals preparing for the CBA exam.
Heather Crawford
xiii
Acknowledgments
A
cknowledgements for the third edition of this book should be read in
conjunction with the appreciation extended in prior editions. This former
gratitude is clearly still relevant and appears below. Special thanks to
Bruce Haggar, who edited the first and second editions of this book, and to the
ASQ Biomedical Division for its continuing support of this publication.
Thank you to those who have contributed to new and updated content,
specifically to Mary Ellen Delaney for sharing her knowledge of the ISO 19011
standard and audit procedural references and to Steven Walfish for his expertise
in quality tools and techniques.
The following acknowledgements were made for the first and second editions:
A number of individuals helped write this book, and the Biomedical
Division and I appreciate that effort. The participants are division
members who are widely regarded as industry experts in specific areas.
We thank all of them for their participation.
In particular, I want to thank Paul Brooks, British Standards Institute,
for updating the chapters relating to the European Union for the
second edition. And especially I want to thank M. Elizabeth Bierman
of Morgan, Lewis, and Backius LLP for her extensive editing of the
sections related to U.S. Regulation.
Contributing authors for the first edition included:
Elizabeth Blackwood, Johnson and Johnson, who contributed
to sections on the Quality System Regulation and other 21 CFR
regulations.
David Dunn, Celera Diagnostics, who contributed to the sections on
in-vitro diagnostics.
Sue Jacobs, QMS Consulting, Inc., who contributed to the Quality
System Regulation, other 21 CFR regulations, and the quality system
inspection technique.
Don Johnson, Cooltouch, Inc., who contributed to the sections on
sterilization and biocompatibility.
Dan Olivier, Certified Software Solutions, Inc., who contributed to the
sections on risk management and software development.
Susan Reilly, Reilly and Associates, who contributed to the sections on
the Quality System Regulation and international auditing guidelines.
xv
xvi Acknowledgments
Mark Roberts, Roberts Consulting and Engineering, who contributed to

the sections on international quality system guidance and international
quality system standards.
Steve Thompson, Curagen Corporation, who contributed to the section
on laboratory testing.
Jim Wood, Reed Smith Crosby Heafy, who contributed to the section on
base U.S. law.
Bruce Haggar, Med Q Systems, Inc., who contributed to the sections
on the Quality System Regulation, U.S. compliance programs, and
controlled environments and utility systems.
The Biomedical Division would also like to acknowledge Keith Rohrbach, who
headed the Division’s activities to develop the body of knowledge and biomedical
quality auditor certification.
Part I
Auditing
Chapter 1 Auditing Fundamentals
Chapter 2 Auditing and Inspection Processes
Chapter 3 Audit Procedural References
1
Chapter 1
Auditing Fundamentals
G
lobal Harmonization Task Force document GHTF/SG4/N28R4:2008
Guidelines for Regulatory Auditing of Quality Systems of Medical Device
Manufacturers—Part 1: General Requirements was developed by Study
Group 4 of the Global Harmonization Task Force (GHTF). Although auditing
organizations are the target audience for this document, it is a useful guidance for
medical device manufacturers and auditors of these establishments.
Audit Objectives
Quality audits are designed to determine whether the quality system:
• Complies with regulatory and recognized quality standard
requirements
• Meets customers’ contractual requirements
• Achieves its objectives and conforms to internal requirements
• Is effectively implemented
Audits are also used to evaluate whether prior corrective actions have been
adequately and effectively implemented.
TYPES OF AUDITS
Audits can be categorized as initial audit, surveillance audit, special audit, and
unannounced audit.
During an initial audit, all elements of the quality system will be audited. A
surveillance audit is conducted after the initial audit and can include all or some
quality system elements. If the auditing organization performs partial surveillance
audits, all elements of the quality system should generally be reviewed annually.
The time between surveillance audits will depend on the:
• Risk associated with the medical devices
• Number of quality system elements examined
• Nature of the quality system elements examined
2
Chapter 1: Auditing Fundamentals 3
• Scope and results of the previous audits

• Available postmarket surveillance data
Special audits are performed when a possible significant deficiency in the quality
system is indicated, or when the auditing body becomes aware of significant
safety-related information. They can also occur if there are significant changes to
the quality system that could affect the state of compliance. Unannounced audits
are not typical but may be conducted if the auditing organization has significant
compliance concerns.
AUDIT ROLES, RESPONSIBILITIES, AND AUTHORITIES

The roles, responsibilities, authority, and accountability of all organizations and
individuals involved with the audit process, including the auditing organization,
lead auditor, auditor(s), auditee, and manufacturer (if different from the auditee),
should be appropriately identified, defined, and documented. These aspects can
be defined as part of the audit planning process, or a “generic” outline can be part
of the auditing organization’s standard operating procedures (SOPs).
Areas to consider for the auditing organization include:
• Assessment of compliance with relevant standards, regulations,
and guidelines
• Code of ethics
• Management of the audit process
• Functions to be audited
• Scope or any limitations of scope
• Auditee requirements, rights, and expectations
• Audit program key performance indicators and other measures
of performance
• Organizational structure
• Right of access to information, personnel, locations, and systems
relevant to the performance of audits
• Risk assessment to determine audit schedule
• Training, selection, and periodic re-qualification of auditors
• Methods to ensure consistency in the interpretation of the regulatory
requirements
• Audit language for conducting audits and written reports
• Deliverables (e.g., audit reports) and method of safeguarding
confidentiality
• Distribution of deliverables including recipients
• Budgets/fees, if applicable
4 Part I: Auditing
An auditor’s role is to:

• Carry out assigned audit tasks
• Comply with audit requirements
• Respect all confidentiality requirements
• Cooperate with the lead auditor
• Collect evidence about the quality system
• Evaluate the quality system
• Determine whether the quality policy is being applied
• Determine whether quality objectives are being achieved
• Determine whether quality procedures are being followed
• Document audit observations and conclusions
• Safeguard audit documents, records, and reports
• Assist the lead auditor in preparing the audit report
• Help the manufacturer understand the regulatory requirements
• Verify effective corrective actions have been implemented
In addition to the aforementioned responsibilities, the lead auditor must also:

• Assist in selecting audit team members
• Orient the audit team on audit scope
• Identify and assign audit tasks to team members
• Clarify quality audit requirements
• Communicate audit requirements
• Prepare the audit plan and provide to auditee in advance of the audit
• Prepare audit forms and checklists
• Preview quality system documents, if appropriate
• Manage the audit
• Promptly report significant nonconformities to auditee management
• Present findings at the closing meeting
• Prepare and submit audit reports in a timely manner
Chapter 1: Auditing Fundamentals 5
Responsibilities of the manufacturer are:

• Define the audit purpose and scope, as appropriate
• Determine which standards should be used to evaluate compliance
• Describe the nature, purpose, and scope of the audit to relevant
employees
• Appoint responsible employees to accompany and assist the audit team
• Ensure cooperation with the audit team
• Provide the necessary resources for the audit team
• Allow auditors to examine documents, records, and facilities
• Receive and review the audit report
• Inform the auditing organization of significant quality system changes
• Determine corrective actions to be taken and implement in a timely
manner based on risk
ETHICAL, LEGAL, AND PROFESSIONAL ISSUES

The audit process should maintain the confidentiality of information obtained
during the course of the audit unless disclosure is allowed by the auditee or
required by legal authority. Information obtained during the audit process should
not be used for personal benefit.
Due professional care, good judgment, and observance of applicable auditing
standards and requirements should extend to every aspect of the audit and the
audit management process.
Chapter 2
Auditing and Inspection Processes
AUDIT PREPARATION AND PLANNING

Audit Purpose and Scope
During the planning stages of the audit, the auditing organization, the auditor, or
the audit team must define and document the audit purpose and scope. Defining
the objectives and scope enables efficient use of time and resources. The objectives
define what is to be accomplished. The scope establishes boundaries and identifies
what is to be examined. The following should be considered when establishing
the audit scope:
• Medical devices manufactured
• Quality system requirements
• Type of audit (initial, surveillance, special, or unannounced)
• Physical location of activities and documentation
If applicable and appropriate, the audit purpose and scope should be provided
to the auditee for review and approval. It is feasible that during the course of the
audit the objectives and/or scope may change based on audit observations and
nonconformances noted.
Resources
In order to ensure reliable audit results and conclusions, there must be adequate
resources (e.g., competent staff, financial support, time, technical information,
external expertise) dedicated to the audit process and associated auditing activities.
Competence of the Audit Team

A lead auditor with the competence to plan and manage an audit, as well as direct
team members, must be included on the audit team. If the team consists of only
one auditor, then this individual will be the lead.
6
Chapter 2: Auditing and Inspection Processes 7
The audit team must possess the necessary professional and technical
competence, as a whole, to cover the scope of the audit. The team should be
competent with respect to understanding:
• Applicable regulatory, statutory, and safety requirements
• Appropriate device technologies and processes
• Auditing of medical device manufacturers’ quality systems
Other areas to consider in assessing competence include professional qualifications,
education, skills, training, experience, and personal attributes. If the necessary
technical competence is not present within the audit team, additional experts in
processes and technology relevant to the scope of the audit may be included, or
team members may be provided specialized training.
Records to demonstrate the competence of auditors must be maintained by
the auditing organization.
Independence
The audit process should ensure objectivity and impartiality. The auditing
organization and its auditors should perform their duties in an independent,
objective manner and avoid any potential conflict of interest. Auditors should not
audit their own work and must be unbiased and independent of the area being
audited in order to permit objective completion of the audit. Independence should
be regularly assessed. Factors to consider include personal relationships, financial
interests, and prior job assignments and responsibilities.
Written Procedures
In order to ensure consistency of audits, the audit process—including the
responsibilities and requirements for managing, planning, and conducting audits,
reporting results, and maintaining records—should be defined and documented.
These procedures must address applicable regulatory and quality requirements.
Auditing organizations should implement and maintain a quality system to ensure
that the audits conducted are of the highest quality and to facilitate continuous
improvement.
Adequacy of Audit Documentation

The auditor or audit team needs to obtain documented evidence to achieve the
audit objectives effectively. Documentation associated with each audit should
include any information that is required by government regulations or regulatory
authorities. Procedures should be in place to ensure adequate retention of the
documentation for a time sufficient to satisfy legal, professional, and organizational
requirements.
8 Part I: Auditing
Documentation maintained may include a record of the:

• Audit scope and objectives
• Audit program
• Audit process
• Audit evidence gathered
• Audit findings and conclusion
• Audit report and responses to findings, which may include actions to
be taken and due dates
Audit Process
While experts have described the audit process in many ways, it has traditionally
been divided into phases or stages as shown in Figure 2.1.
Notification
QS document review
Audit
Audit plan
preparation
Team assignments
Working documents
Opening meeting
On-site review
Audit
Audit observations
execution
and noncompliances
Closing meeting
Retention of
Audit report
audit records
Report distribution
Audit Corrective action

completion follow-up
Figure 2.1 Audit process.

Stage 1: Audit Preparation

The GHTF guidance subdivides this stage into the following tasks: notification,
preparation, preview of quality system description, audit plan, audit plan changes,
audit team assignments, and working documents. Portions of the audit preparation
process, such as notification and preview of quality system description, are not
applicable to those situations where unannounced audits are deemed necessary
by the auditing organization.
Unless regulatory requirements mandate otherwise, the auditee should be
notified in advance that an audit is to be conducted. Before the on-site examination,
the lead auditor should conduct a desk audit of the quality system to determine
whether the implemented controls meet the regulatory requirements. This can be
accomplished by reviewing the quality manual and, if applicable, top-level SOPs.
Although this preview is done during the preparation stages, it is actually part
of audit execution. If it becomes obvious during the review that the documented
system is inadequate, the on-site audit should be suspended until necessary
corrective actions are made.
The lead auditor must also develop an audit plan. Where permitted by
regulations, the documented plan should be submitted to the manufacturer for
approval before the site visit. The audit plan should:
• Define the objectives and scope of the audit
• Identify the manufacturer’s management team having direct
responsibility for the audit scope and purpose
• Identify the applicable audit standards and other reference documents
to be utilized
• Identify the quality elements that will be audited
• Identify the lead auditor and other team members
• Specify the language of the audit
• Specify when and where the audit will be conducted
• Identify the organizational units and areas that will be audited
• Define the time and duration for each major audit activity
• Schedule meetings to be held with the manufacturer’s management
• Identify who will get the final audit report, and when
It is important to note that audit plans are subject to change and this possibility
should be stated in the audit plan. During the course of the audit, the objectives
and/or scope may change, or become unattainable, based on audit observations
and nonconformances noted. The auditee must be notified of any changes.
It is the lead auditor’s responsibility to assign specific tasks to audit team
members. These tasks should be assigned according to the participants’ qualifica
tions and expertise.
Working documents are required when performing an audit to international
auditing guidelines. Again, it is the lead auditor’s responsibility to prepare the
10 Part I: Auditing
working documents; team members should assist as appropriate. Examples of

working documents include checklists (to evaluate the system elements against
regulatory requirements) and forms (to record observations and collect supporting
evidence).
AUDIT PERFORMANCE
Stage 2: Audit Execution
The audit execution stage should start with an opening meeting with the
manufacturer’s senior management. The purpose of this meeting is to:
• Introduce the audit team
• Restate, and clarify if necessary, the audit scope, objectives, plan,
and schedule
• Review the methods and procedures to be used during the audit
• Confirm that the necessary resources and facilities to support the audit
process are available
• Establish communication links
During the on-site assessment, applicable elements of the quality system are
evaluated. Objective evidence is collected by:
• Interviewing and questioning personnel
• Reviewing records and documents
• Visually observing activities and conditions
Wherever possible, evidence collected through personnel interviews should be
confirmed by other means. Documents or copies of records collected, or any
photographs taken, should be noted by the auditors and acknowledged by the
auditee. Sampling of records and documents should be appropriate to the risks
associated with the device, the complexity of manufacturing technologies, and
available postmarket surveillance data.
Upon evaluation of the objective evidence collected, auditors must document
their quality audit observations (a statement of fact made during a quality audit
and substantiated by objective evidence). Nonconformities (nonfulfillment of
specified requirements within the planned arrangements), and quality audit
observations that have the potential to become nonconformities, should be
reviewed with the manufacturer as they are noted.
Nonconformities must be supported by the evidence collected and must identify
the requirements that have been violated. One or more major nonconformities will
indicate that the manufacturer does not comply with the regulatory requirements.
The following are examples of quality audit observations that may be considered
nonconformities:
• Lack of or failure to implement a quality system requirement
• Product safety or performance is/may be compromised
• Large number of minor nonconformances against a quality system
requirement
• Failure to implement appropriate corrective and preventive actions

• Repeat observations
A closing meeting is held at the completion of the on-site evaluation. The purpose
of this meeting is for the lead auditor to discuss quality audit observations,
nonconformances, severity of the nonconformances, and overall conclusions with
the manufacturer’s senior management, and those individuals responsible for the
areas audited, before a final report is prepared. The audit team presents a list of
audit observations and nonconformities to the management team at this time.
AUDIT REPORTING
Stage 3: Audit Report
The audit report is the method of formally communicating the audit scope and
objectives, audit plan, standards and methodology utilized, objective evidence
collected, and quality audit observations, nonconformities, and conclusions. The
audit findings and conclusions should be consistent, accurate, and supported by
the evidence gathered throughout the audit process.
The lead auditor is responsible for preparing, dating, signing, and submitting
the audit report to the manufacturer. Nonconformities identified in the audit
report should be specific in nature and should include the following:
• Requirements of the internal or external standard
• Severity with respect to the requirements
• Required date for submission of corrective action plans
The audit plan identifies who is to receive the final report, and when. If the report
cannot be made available to the manufacturer within this period, the auditing
organization must notify the manufacturer, provide the reasons for the delay, and
establish a new issue date.
AUDIT FOLLOW-UP AND CLOSURE

Stage 4: Audit Completion
The audit is considered complete upon transmittal of the audit report to the
manufacturer; however, some organizations do not consider an audit complete
until the auditing organization approves the corrective action plans including
timelines. The manufacturer is expected to take actions to correct identified
nonconformities. The auditing organization and the manufacturer should agree
on a plan for completing necessary corrective actions and, if required, re-audits to
verify that corrective actions were taken. Periodic reports may also be requested
by the auditing organization to determine the status of the necessary corrective
actions. Auditing documents should be retained or destroyed by agreement
between the auditing organization and manufacturer, and in accordance with
applicable requirements.
Chapter 3
Audit Procedural References
Standards and guidance are made available by organizations including the

International Organization for Standardization (ISO), US Food and Drug
Administration (FDA), and the Global Harmonization Task Force (GHTF) Study
Group (SG) 4 on Auditing. Refer to Chapter 1 for discussion of the GHTF/SG4/
N28R4:2008 Guidelines for Regulatory Auditing of Quality Systems—Part 1: General
Requirements. The international standard for auditing ISO 19011, FDA Quality
System Inspection Technique (QSIT), and FDA Compliance Policy Guide 7382.845
are discussed in this chapter.
ISO 19011
ISO 19011:2011 Guidelines for auditing management systems was prepared by Technical
Committee ISO/TC 176, Quality management and quality assurance, Subcommittee
SC3, Supporting technologies (ISO/TC 176/SC 3). This standard is applicable to all
organizations that need to conduct internal or external audits of the management
systems or manage an audit program. A management system can include, but is
not limited to, quality management systems, environmental management systems,
and financial management systems.
The scope of the standard includes auditing of any management systems
and the concept of risk to management system auditing. The standard provides
guidance in the management of an audit program, on the planning of an audit of
the management system, and on the competence and evaluation of an auditor and
the audit team. The standard clauses should be reviewed and followed.
Clause 4 Principles of auditing

Principles include:
• Integrity: the foundation of professionalism
• Fair presentation: the obligation to report truthfully and accurately
• Due professional care: the application of diligence and judgment
in auditing
• Confidentiality: security of information
12
Chapter 3: Audit Procedural References 13
• Independence: the basis for the impartiality of the audit and objectivity
of the audit conclusions
• Evidence-based approach: the rational method for reaching reliable and
reproducible audit conclusions in a systemic audit process
The audit should be an effective and reliable tool in support of management
policies and controls. All auditors should adhere to the principles.
Clause 5 Managing an audit program

An audit program needs to include information and resources necessary to organize
and conduct audits within specified time frames. The audit program needs to be
monitored and measured to ensure the objectives have been accomplished and
reviewed to identify any potential continual improvements. The audit program
should be managed following the Plan-Do-Check-Act (PDCA) process.
• Plan: Establishment of the audit program and objectives
• Do: Implementation of the audit program
• Check: Monitoring the audit program
• Act: Review and improvement of the audit program
Identification and evaluation of audit program risk should be assessed throughout
the audit program. Audit program risk can include planning, resources, and
selection of the audit team.
Clause 6 Performing an audit

Typical audit activities include:
• Initiating the audit
• Preparing for the audit
• Conducting the audit (can include checklists)
• Preparing and submitting the audit report
• Completing the audit
• Conducting audit follow-up
Clause 7 Competence and evaluation of auditors

Auditors should have confidence in the audit process, have thorough
understanding of the audit objectives, and have competence in planning and
conducting audits to meet the objective of the audit program. Auditors should
have generic auditing skills and may require industry-specific knowledge and
skills. Auditor competence can be acquired through formal education, training,
and experience. Auditor team leaders should have additional audit experience
and skills to manage the audit process and provide leadership to the audit team.
14 Part I: Auditing
Auditors should be evaluated to determine whether additional training or work

experience is needed to become a more proficient and efficient auditor. All auditors
should be active in obtaining continual professional development to maintain and
improve their auditor competence.
QUALITY SYSTEM INSPECTION TECHNIQUE (QSIT)

When the quality system regulation became effective June 1, 1997, FDA recognized
the need to change their inspection method and considered a “systems approach”
to evaluate a firm’s level of compliance. The August 1999 document titled Guide to
Inspections of Quality Systems was the final output from a two-year reengineering
effort that changed the way FDA conducts inspections of medical device
manufacturers. FDA recognized it was necessary to improve the efficiency and
effectiveness of inspections while at the same time maximize FDA resources and
reduce inspection time by conducting more-focused inspections. This inspection
strategy is called the quality system inspection technique (QSIT). Under the QSIT
approach, an inspection should be completed within four to five days, significantly
less than previous inspection times.
Often referred to as a “top-down” approach that evaluates a firm’s overall
ability to address quality (as opposed to a “bottom-up” approach that begins by
looking at one or more individual problems that may point to a failure in the
quality system), QSIT breaks the quality system regulation into seven subsystems,
of which four subsystems are considered major and three are considered minor.
QSIT directs the inspector to focus on specific elements within each major
subsystem considered to be key indicators that place responsibility on the firm
to self-monitor compliance and to take appropriate and timely action to correct
product, process, and quality system problems. FDA concludes the inspection
with an overall evaluation of the implemented quality system where management
with executive responsibility are accountable to have demonstrated that they
comply with the requirements of the regulation, oversee implementation, provide
adequate resources, and ensure that the quality system is effectively implemented
and maintained.
Applicability
The FDA uses QSIT to conduct medical device quality system/good manufacturing
practice (GMP) inspections for both domestic and foreign manufacturers. While
the Guide to Inspections of Quality Systems provides specific instructions for the
inspector, it is designed for use in conjunction with the following FDA references:
• Compliance Program Guidance for Inspection of Medical Device
Manufacturers (CPG 7382.845)
• Investigations Operations Manual (IOM)
• 21 CFR Parts 820, 803, and 821
• Compliance Policy Guides (CPG) for devices (Subchapter 300)
• Process Validation: General Principles and Practices, FDA, January 2011
QSIT inspections are preannounced inspections where FDA will request

documentation in advance to minimize on-site inspection time. Manufacturers
are under no obligation to provide the documentation; however, in the spirit of
cooperation with the agency, and to minimize the disruption of an extended
on-site inspection, manufacturers are encouraged to provide the documentation
for the inspector to review in advance. Documentation requested in advance will
be returned to the manufacturer when the on-site inspection begins.
While the primary purpose of the QSIT is for use by the FDA inspector, device
manufacturers also use QSIT to conduct internal assessments of their quality
system. QSIT does not evaluate every aspect of a firm’s quality system, and as
a result is not considered a full quality system audit. QSIT can be an excellent
tool to determine a firm’s “inspection readiness” but should not be considered an
alternative to, or substitute for, internal quality system audits.
Subsystems
FDA’s Guide to Inspections of Quality Systems breaks the quality system regulation
into seven subsystems with satellite subsystems under CAPA and production and
process controls as applicable. The seven subsystems are categorized as major and
minor subsystems, as follows:
Major Subsystems
1. Management controls
2. Design controls
3. Corrective and preventive action (CAPA)
a. Medical device reporting
b. Reports of corrections and removals
c. Medical device tracking
4. Production and process controls
a. Sterilization process controls
Minor Subsystems
5. Material controls
6. Records/documents/change controls
7. Facility and equipment controls
Management controls, design controls, CAPA, and production and process
controls are considered the four major subsystems and are recognized as the basic
foundation of the quality system. An evaluation of the four major subsystems will
include the three remaining subsystems (material controls, records/documents/
change controls, and facility and equipment controls) depending on their
relationship to the activity or process being evaluated.
Each subsystem contains inspectional objectives, a decision flowchart, and
narrative discussion for each objective. The narrative states the basic purpose/
16 Part I: Auditing
importance for the subsystem and guides the inspector through each objective in
terms of the type of records to review. Links to related subsystems are noted, as
well as references to specific FDA policies and compliance programs.
A QSIT inspection will begin and end with management controls.
Demonstrating the top-down approach, QSIT directs the inspector to first
interview the management representative (or designee) “to obtain an overall
view of the management controls subsystem as well as a feel for management’s
knowledge and understanding of the subsystem.” This interview will set the tone
for the inspection. Objective 7 under management controls instructs the inspector
to stop the review of the management system until the remaining subsystems have
been evaluated. The order in which the remaining subsystems are reviewed is also
specific: design controls, followed by CAPA, and concluding with production and
process controls. Design controls and CAPA intentionally precede production and
process controls because the records and data reviewed are factors the inspector
will consider when selecting a process to evaluate under the production and
process controls subsystem.
Sampling Tables
The Guide to Inspections of Quality Systems provides information for using binomial
sampling plans included in the document. The inspector is instructed to select a
table from the Guide based on the level of confidence appropriate to the risk of
the device or the records being sampled (i.e., Table 1 for 95 percent confidence,
or Table 2 for 99 percent confidence). While both the bottom-up and the top-
down approaches include a review of records, under QSIT the record review is
conducted in a more controlled manner.
FDA COMPLIANCE POLICY GUIDE (CPG) 7382.845

FDA provides instructions to the field—investigators and compliance officers—
through the use of compliance programs. The particular compliance program for
medical devices is contained in the Compliance Policy Guide in section 7382.845,
Inspection of Medical Device Manufacturers. This particular compliance program
tells the field when to inspect medical manufacturers, what criteria to use in the
inspection, what areas to look into, and what to do if the manufacturer is not
compliant. It is important for industry to understand the program in order to react
properly in the event of an inspection.
The document described in this section is continually being modified. The
following generally describe the contents of each section, but it is very important
to have the most current version and become familiar with its contents. Significant
changes may occur without notification.
Major Sections
This section outlines each major section of the compliance program and discusses
key elements.
Part I gives a general overview of the compliance program. Specifically,
it discusses the Quality System Regulation (QSR), Medical Device Reporting
(MDR) regulation, medical device tracking regulation, corrections and removals
regulation, and the registration and listing regulation. Each of these is described
in detail elsewhere in this book.
Part II is the implementation section. Each of the regulations is further
discussed, objectives of each regulation are outlined, and inspection scheduling
is described. The guidance breaks inspections into priorities, with the priority
given to premarket and pre-clearance inspections, Class III devices manufacturers
previously not inspected, compliance follow-up/for-cause inspections,
manufacturers of devices considered high-risk, and reprocessors of devices
originally labeled for single-use. Highest priority is given to premarket and pre-
clearance inspections as well as to Class III device manufacturers that have never
been inspected. Class I device manufacturers should receive the lowest inspection
priority unless the inspection is for-cause or there is an apparent health hazard.
Part III provides inspectional guidance for determining compliance with
the quality system regulation. Inspections should generally be conducted in
accordance with QSIT. This part also provides inspection levels as referenced to
inspection type and guidance for conducting the inspection. Inspection level 1
describes an abbreviated inspection consisting of two QSIT major subsystems,
i.e., CAPA plus Production and Process Controls or Design Controls. Inspection
level 2 correlates to a comprehensive inspection consisting of all for major QSIT
subsystems. Inspection level 3 for compliance follow-up, special inspections for-
cause, and special inspections per FDA’s risk-based work plan are directed by
QSIT and inspection assignment, as appropriate.
Part IV of the compliance program describes analytical laboratories and
methods to be used. FDA has specialist laboratories across the country, and
laboratories are chosen based on the type of product. This section also outlines
sampling, in particular for sterility.
Part V is the regulatory/administrative follow-up section. It outlines the action
to be taken in the event that the inspection has identified non-compliance. Typical
regulatory actions include warning letters; however, depending on past history,
injunctions, citations, detention of product, and civil penalties are possibilities. In
addition, a manufacturer in this position will have premarket approvals held until
resolution.
Part VI provides references, program contacts, select FDA organizational
charts, and summary requirements for MDR reporting, tracking, and corrections
and removals.
Part II
Biomedical Quality Management
System Requirements
Chapter 4 US Requirements—Federal Food,
Drug, and Cosmetic Act (FDCA)
Chapter 5 US FDA Code of Federal Regulations
(CFR) Title 21
Chapter 6 The EU Medical Device Directives
Chapter 7 Other International Regulations
Chapter 8 FDA Guidance for Manufacture of
In Vitro Diagnostic (IVD) Products
Chapter 9 International Standards for
Quality Systems
Chapter 10 Quality System Regulation (QSR)
Requirements
Chapter 11 Postmarket Surveillance
19
Chapter 4
US Requirements–Federal Food,
Drug, and Cosmetic Act (FDCA)
T
he Federal Food, Drug, and Cosmetic Act (also referred to as “FDCA”, “the
Act” or “the act”) allows for extensive regulation of medical devices. The
FDCA currently governs the entire lifespan of a device, from premarket
clearance or approval, through the manufacturing process, subsequent release to
the market, and use by a healthcare professional or patient. However, Congress’s
original Food and Drug Act did not govern medical devices.
The Pure Food and Drug Act, promulgated in 1906, regulated only drugs and
not medical devices. After repealing the act in 1938, Congress recast it as the FDCA,
adding specific provisions for enforcement actions concerning devices. However,
the actions were limited to policing postmarket activity through prohibition of
adulteration and misbranding. The 1938 act did not provide for premarket review
or postmarket surveillance of devices. When Congress amended the act in 1962, it
still did not include provisions for those regulatory activities.
With the passage of the Medical Device Amendments of 1976 (MDA), Congress
expanded the Food and Drug Administration’s (FDA) authority to regulate
devices. One significant change was a broadened definition of “device.” The term
included “implement, machine, implant, in vitro reagent, and other similar or
related article.”1 Additionally, the MDA increased the conditions that qualified
a device for regulation under the FDCA. Inclusion in the National Formulary or
the US Pharmacopeia (USP), or any supplement documents, became qualifying
criteria. The definition of “device” was also fine-tuned by adding limitations. To
be regulated by the MDA, a device must neither (1) “achieve any of its principal
intended purposes through chemical action within or on the body of man or other
animals” nor (2) be “dependent upon being metabolized for the achievement of
any of its principal intended purposes.”2
The MDA gave FDA the authority to inspect devices. This authority included
new requirements that device manufacturers or importers maintain records and
provide reports to assure that devices are safe and effective. Additionally, FDA
representatives were authorized to physically inspect “any factory, warehouse, or
establishment” in which devices “are manufactured, processed, packed, or held”
and to enter any vehicle being used to transport devices.3
The MDA also granted FDA the power to control the release of medical
devices into interstate commerce. The amendments created a three-tiered scheme
for premarket regulation and postmarket review. For this purpose, devices were
20
Chapter 4: US Requirements–Federal Food, Drug, and Cosmetic Act (FDCA) 21
divided into three classes based on their perceived safety risk. Class I devices,
those deemed to pose the least risk of harm, were to be the least regulated, while
Class III devices, which present the highest risk, would be the most heavily
regulated.
The MDA provided two procedures by which Class II and III devices could
be authorized for distribution in interstate commerce. They were 510(k) premarket
notifications and premarket approval applications (PMAs). FDA was also granted
the authority to impose performance standards and to ban devices entirely.
More than ten years later, Congress passed the Safe Medical Devices Act of
1990 (SMDA) to enhance FDA’s regulation of devices. This new legislation followed
in the wake of criticism by congressional investigators and others of the limits
of the earlier act. The SMDA imposed more-stringent premarket and postmarket
requirements, as well as new mechanisms for enforcement. Now FDA must issue
an order declaring a device to be substantially equivalent to a legally marketed
predicate device before a manufacturer can market a device pursuant to a 510(k)
notification.4 The SMDA also added the authority for FDA to set performance
standards. Further, it included a provision allowing postmarket surveillance of
Class II or III devices that may pose serious health risks, that are life supporting or
sustaining, or that are meant to be implanted in humans for more than one year.
Additionally, the FDCA added civil penalties to FDA’s enforcement options.
The device statutes of the FDCA had two further revisions in the 1990s. The
Medical Device Amendments of 1992 did not include major changes to existing
device law. However, the FDA Modernization Act of 1997 (FDAMA) is notable
for two of its provisions. The first provision provided a safe harbor for device
manufacturers and distributors in which to disseminate certain information to
medical practitioners concerning new uses for devices already in commercial
distribution, provided that the company committed to file, within a specified time
frame, a supplemental application to establish the safety and effectiveness of the
unapproved use. The provision was controversial, however, because many in the
device industry believed it was too restrictive. The provision ceased to be effective
on September 30, 2006, due to a sunset provision.5 Because the provision was no
longer effective, in 2009 the FDA issued a guidance document on dissemination
of journal articles and medical/scientific publications on unapproved new uses of
approved drugs and approved or cleared devices.6 The other FDAMA provision
allows shipment of investigational devices in emergency situations or to combat
serious conditions.7 The law further enables patients being treated by licensed
physicians to request and receive these devices directly from the manufacturer or
distributor. Although industry believed the FDAMA provision on dissemination
of information was too restrictive, both of these FDAMA provisions reflected a
shift for the FDCA. Since its inception, the amendments to the FDCA imposed
tighter restrictions on distribution of devices in the interest of safety. Here,
the countervailing interest of allowing greater access to medical advances and
information regarding new uses of approved or cleared devices began to be
balanced against the FDCA’s primary safety concerns.
22 Part II: Biomedical Quality Management System Requirements
FDCA CHAPTER II: DEFINITIONS

Section 201—Definitions
Section 201 of the FDCA provides definitions for terms used throughout the
quality system regulation. Many of these terms will be discussed in other chapters
where they are applicable to the regulation subpart.
(b) The term interstate commerce means:
(1) commerce between any State or Territory and any place outside
thereof; and
(2) commerce within the District of Columbia or within any other
Territory not organized with a legislative body.
(h) The term device means an instrument, apparatus, implement, machine,
contrivance, implant, in vitro reagent, or other similar or related article,
including any component, part, or accessory, which is:
(1) r ecognized in the official National Formulary or the United States
Pharmacopeia, or any supplement to them;
(2) intended for use in the diagnosis of disease or other conditions, or in
the cure, mitigation, treatment, or prevention of disease, in man or
other animals; or
(3) i ntended to affect the structure or any function of the body of man
or other animals, and which does not achieve its primary intended
purposes through chemical action within or on the body of man or
other animals and that is not dependent upon being metabolized for
the achievement of its primary intended purposes.
(k) The term label means a display of written, printed, or graphic matter
upon the immediate container of any article; and a requirement made
by or under the authority of this Act that any word, statement, or other
information on the label shall not be considered to be complied with
unless such word, statement, or other information also appears on the
outside container or wrapper, if any there be, of the retail package of
such article, or is easily legible through the outside container or wrapper.
(l) The term immediate container does not include package liners.
(m) The term labeling means all labels and other written, printed,
or graphic matter:
(1) upon any article or any of its containers or wrappers, or
(2) accompanying such article.
FDCA CHAPTER III: PROHIBITED ACTS AND PENALTIES

Section 301—Prohibited Acts
Section 301 of the FDCA8 specifies acts related to any food, drug, device, tobacco
product, or cosmetic that are prohibited, and the causing of such act is also
prohibited. Prohibited acts related to medical devices include:
(a) Introducing or causing introduction of an adulterated or misbranded
device.
(b) Adulteration or misbranding of a device in interstate commerce.
(c) Receipt and delivery or proffered delivery of an adulterated or
misbranded device.
(d) Introduction or delivery into interstate commerce of product in violation
of FDCA section 564 regarding authorization of medical products
intended for use in an actual or potential emergency.
(e) Refusal to allow access to or copying a required record, failure to establish
or maintain a required record, or make any report required by another
FDCA section as specified.
(f) Refusal to permit entry or inspection authorized under FDCA section 704,
factory inspection.
(g) Manufacture of an adulterated or misbranded device.
(h) Giving a guaranty or undertaking referred to in FDCA section 303(c)(2) or
303(c)(3), which is false.
(j) Using or revealing trade secret information for personal advantage. This
does not authorize withholding information from Congress or authorized
committee.
(k) Alter, mutilate, destroy, obliterate or remove whole or part of labeling
after shipment into interstate commerce which results in the device being
adulterated or misbranded.
(n) Use or reference to any report issued per FDCA section 704 factory
inspection in labeling, advertising or other sales promotion.
(p) Failure to register in accordance with FDCA section 510, failure to provide
device listing information or notice required by FDCA sections 510(j)
or 510(j)(2), or failure to provide information required by FDCA section
510(k) premarket notification.
(q) Failure or refusal to comply with a requirement under FDCA section 518
concerning notification or section 520(g) regarding investigational device
use; failure to notify or provide information required by FDCA section 519
concerning adverse event reporting or section 520(g); failure to comply
with a postmarket surveillance requirement under FDCA section 522; or
submitting a report that is false or misleading in material.
(r) Movement of a device subject to a detention order, or removal/alteration
of mark/label required identifying a detained device.
(w) Knowingly make a false statement, failure to submit a required certificate

of analysis, or failure to maintain or submit required records required
under FDCA section 801 regarding imports and exports.
(x) Falsifying a declaration of conformity to a performance standard, or
failure/refusal to provide data/information requested under FDCA
section 514 regarding provision of standards.
(y) Submission of a false/misleading report or recommendation, disclosure of
confidential information or trade secret without written consent, or receipt
of a bribe or other corrupt act by an accredited person as described under
FDCA section 523.
(z) Disseminating information in violation of FDCA section 551, regarding
treatment information for devices.
(ff) Import or offer to import when there is a failure to submit requested
establishment registration information.
(gg) Failure of an accredited person to report, include false information or fail
to include material facts in an inspection report, a condition observed
during inspection that could cause or contribute to an unreasonable risk
to public health.
(jj) Failure to submit certification or clinical trial information required by
Public Health Service Act section 402(j); knowingly submit false or
misleading information regarding clinical trials.
Section 302—Injunction Proceedings

A court-ordered injunction requires an individual or corporation to either do or
refrain from performing a specific act. The FDA may seek an injunction to prevent
an individual or corporation from violating or causing violation of the Act. A
court or jury shall try an individual or corporation in violation of an injunction or
restraining order issued under section 302.
Section 303—Penalties
Civil penalties may be levied against any person who violates a requirement
related to devices. Such penalty shall not exceed $15,000 for each violation related
to devices, and not exceed $1,000,000 for all violations adjudicated in a single
proceeding.
Section 304—Seizure
Seizure is intended to remove specific violative goods from commerce. This action
may be brought against an FDA-regulated product that is adulterated and/or
misbranded. Additionally, an officer or qualified FDA employee may order a
device be detained for a reasonable period up to twenty days, or up to thirty days
if the action requires more than twenty days.
FDCA CHAPTER V: DRUGS AND DEVICES

Section 501—Adulterated Drugs and Devices
Adulteration laws are intended to ensure that a Class III device has the required
approval and that all devices are manufactured in accordance with applicable
quality requirements. Adulteration regulations generally are intended to ensure
that marketed medical devices conform to FDA quality requirements. A device is
considered adulterated if it is actually or potentially unclean or injurious to health.9
To safeguard against adulterated devices, the regulations address the conditions
under which a device was manufactured, as well as its postmarket condition.
Adulteration laws and regulations concern general safety issues. For example,
the FDCA empowers FDA to impose good manufacturing practice (GMP)
requirements to ensure the safety and effectiveness of devices. The GMPs, referred
to as the “Quality System Regulation” or “QSR,” govern device manufacture and
control, including design validation, and packing, storage, and installation of
devices.10 Nonconforming devices are considered adulterated. Similarly, devices
that FDA has banned are also considered adulterated.11 Adulteration laws extend
to product containers, which are adulterated if composed in whole or part of
any poisonous or deleterious substance that may render the contents injurious
to health.12
Some adulteration laws focus on the cleanliness of devices. A device is
considered adulterated if it contains any filthy, putrid, or decomposed substances.
Devices are also adulterated if they have been prepared, packed, or held under13
unsanitary conditions where they may have become filthy or rendered injurious
to health.14
Other adulteration regulations address performance. FDA enforces two types
of performance standards: those established by FDA, and those established by
other organizations and recognized by FDA. A device that is obligated to meet
either of these standards will be considered adulterated if it does not conform to
the standard in every respect.15
Finally, if a Class III device is marketed without submission and approval of
a required premarket approval application, or if a premarket approval has been
denied, suspended, or withdrawn, or is otherwise ineffective, the device will be
considered adulterated under the FDCA.16
Section 502—Misbranded Drugs and Devices

Misbranding regulations protect against the sale of devices manufactured in
facilities that have not been registered, as well as against false, misleading, or
insufficient statements appearing in device labeling or advertisements. Through
misbranding statutes, device manufacturers are prohibited from making
misrepresentations about the device and are required to disclose specific types
of information to potential users, as well as to FDA. The laws forbid the inclusion
of false or misleading information in device labeling and advertisements.
Additionally, these materials must identify the product manufacturer, packer,
or distributor, and include uniform device descriptions and instructions for safe
use. Finally, misbranding statutes may require manufacturers and distributors
of certain devices to issue notifications of unreasonable risks or to conduct

postmarket surveillance.
Misbranding provisions protect the public from purchasing devices that have
not been properly registered and listed with FDA. A device may be characterized
as misbranded if it is disseminated without identifying the manufacturer, packer,
or distributor, or if it originates from a manufacturer that has failed either to
register its facilities or to list a device with the agency.17 FDA requires that the
device label identify the name and place of business of the device manufacturer,
packer, and/or distributor.18 In addition, to avoid being considered misbranded,
a device (1) must be manufactured, prepared, propagated, compounded, and/or
processed in a facility registered in compliance with FDCA regulations,19 (2) be
included on the facility’s registered list of devices for commercial distribution,20
and (3) comply with applicable performance standards and premarket approval
requirements prior to introduction into interstate commerce.21
In addition, the misbranding restrictions also forbid inclusion of false or
misleading information in device labeling or advertisements.22 A device is
misbranded if it is dangerous when used in the manner, frequency, or duration
suggested, prescribed, or recommended in its labeling.23 If the device is a
restricted one, the prohibition against false or misleading statements extends to
advertisements. 24
The FDCA also includes a duty to submit device labeling for review by
FDA. The amount of material to be submitted depends on whether the device
is restricted or is subject to a performance standard or premarket approval
requirements. Manufacturers and distributors of devices that do not fall into those
categories are simply obliged to provide FDA with the label and package insert, as
well as a representative sampling of any other labeling.25 All other manufacturers
and distributors have the greater obligation of providing a copy of all device
labeling.26 Those manufacturing and distributing restricted devices must submit
a representative sample of product advertisements and, upon good cause, FDA
may request that they provide a copy of all device advertisements.27
In addition to outlawing false statements, FDA requires the inclusion of
statements that create greater uniformity in labeling. For example, device
packaging must accurately state the weight, measure, or numerical count of
its contents.28 It must also include symbols from FDA’s uniform system of
identification of devices.29 Any information required under the FDCA must be
prominently and conspicuously placed on a device’s labeling so that an ordinary
individual “under customary conditions of purchase and use” would be likely to
read and understand it.30
Other mandatory labeling requirements are intended to promote safe use
of the device. Device labeling must include adequate directions for users, and
adequate warnings against potentially hazardous misuse, or against unsafe dosage
or methods or duration of use.31 Labeling for devices subject to a performance
standard may be required to prescribe the proper installation, maintenance,
and operation of the device.32 All advertisements and promotional material for
restricted devices must include safety information consisting of a brief statement
of the device’s intended uses, relevant warnings, precautions, and side effects.33
In special instances, where FDA finds it necessary to protect public health, the
agency may require a full description of a device’s components or formula,

including the quantity of each ingredient.34 In extraordinary circumstances, FDA
can even require prior approval of an ad’s content.35
Finally, misbranding laws impose notification and monitoring obligations on
manufacturers and distributors of devices presenting a high risk of harm to users.
Upon determining that a device presents an unreasonable risk of substantial
harm to public health, FDA may require a producer to issue notification of the
risk to all prescribing health professionals.36 Failure to issue the notification
renders the device misbranded. Similarly, FDA may order a manufacturer to
conduct postmarket surveillance of the following types of Class II or III devices:
(1) those likely to have serious adverse health consequences upon failure, (2) those
implanted in humans for more than a year, and (3) those that sustain or support
life and are used outside of a controlled facility.37 Devices that are not monitored
in compliance with this provision are also deemed misbranded.
Section 510—Registration of Producers of Drugs and Devices

Any person who owns or operates a US establishment engaged in the manufacture,
preparation, propagation, compounding, or processing of a medical device shall
register annually between October 1 and December 31. Any establishment located
outside the US, which performs any of the listed activities for a device imported
or offered for import into the US, is also required to register.
With the exception of initial importers, an establishment subject to registration
requirements is also required to provide a listing of devices manufactured,
prepared, propagated, compounded, or processed.
Initial registration and listing information is to be submitted by US
establishments within thirty days of beginning a regulated activity or putting a
medical device into commercial distribution. Establishments outside the US must
register and/or list before exporting devices to the US. If the device requires 510(k)
premarket notification clearance or premarket application (PMA) approval, its
regulatory application must be cleared/approved before registration and listing.
Section 510 also establishes registered firms engaged in the manufacture,
propagation, compounding, or processing of a Class II or Class III device are to be
inspected biennially.
Section 513—Classification of Devices Intended for Human Use

Each generic device type is categorized into one of sixteen classification panels
that are organized by clinical medicine and fundamental sciences, such as
cardiovascular, neurology, or orthopedic. These panels are codified in Parts 862 to
892 of Title 21 of the Code of Federal Regulations (CFR), and specify those human-
use devices subject to general controls, special controls, or premarket approval.
Devices intended for human use are further classified into one of three classes
(i.e., Class I, Class II, Class III) based on the level of control necessary to assure
device safety and effectiveness. Classification is based on the risk to patient
and/or user posed by the device where Class I devices present the lowest risk, and
Class III the highest risk. Device classification determines the type of premarket
submission/application required to legally market the device. The classifications

are described as:
• Class I, General Controls: Controls authorized by the Act are sufficient
to provide reasonable assurance of device safety and effectiveness.
These devices are not life supporting, life sustaining or have substantial
importance in preventing health impairment. Class I devices do not
present a potential unreasonable risk of illness or injury, and are
typically exempt from premarket regulatory requirements.
– General controls include adulteration; misbranding; establishment
registration and device listing; premarket notification; banned
devices; notification and repair, replacement, and refund; records
and reports; restricted devices; and Good Manufacturing Practices.
• Class II, General Controls and Special Controls: General controls alone
are not sufficient to provide reasonable assurance of device safety and
effectiveness. Special controls are necessary to provide reasonable
assurance. Class II devices typically require 510(k) premarket clearance
from the FDA prior to commercialization.
– Special controls are typically device-specific and may include
performance standards, postmarket surveillance, patient registries,
premarket data requirements, and FDA guidance documents.
• Class III, General Controls and Premarket Approval: Devices classified
as Class III have insufficient information to determine if general
and/or special controls would adequately provide reasonable assurance
of safety and effectiveness. These devices are characterized as being
life sustaining, life supporting, or have substantial importance in
preventing health impairment, and present a potentially unreasonable
risk of illness or injury. A Class III device generally requires premarket
application (PMA) approval from FDA, and potentially a human
clinical trial, prior to legally commercializing the device.
A device may be reclassified on the basis of valid scientific evidence including
the health benefit of the device, nature and incidence of risk (if known), and why
controls associated with the proposed classification are sufficient to provide a
reasonable assurance of safety and effectiveness. Proposed reclassification orders
are published in the Federal Register.
Section 518—Notification and Other Remedies

Under section 518 of the FDCA,38 FDA can issue three types of orders for resolving
problems with medical devices. The three main types of orders in ascending order
of seriousness are:
• Notification
• Repair, replacement, or refund
• Recall
Note that separate provisions of the FDCA apply to electronic products.39

Section 518 was originally included in the original Medical Device Amendments
of 1976.40 Since that time, this section has been amended twice.
The first change was in 1990 when the SMDA added subsection (e), which
gave FDA explicit authority to order device recalls.41 Two years later, the Medical
Device Amendments of 1992 modified the wording of the provision relating to
repair, replacement, or refund.42 In 1996, the FDA issued regulations implementing
the mandatory recall provisions of section 518(e).43
Notification Orders
If there is a problem with a medical device, FDA might issue a notification
order. The order will be issued if FDA determines that the device “presents an
unreasonable risk of substantial harm to the public health, that the notification
will be necessary to eliminate the specific risk and that no more practical means is
available to eliminate the risk.” As provided by section 518(a):44
If the Secretary determines that:
1. A device intended for human use which is introduced or delivered
for introduction into interstate commerce for commercial distribution
presents an unreasonable risk of substantial harm to the public
health, and
2. Notification under this subsection is necessary to eliminate the
unreasonable risk of such harm and no more practicable means is
available under the provisions of this chapter (other than this section)
to eliminate such risk, the Secretary may issue such order as may
be necessary to assure that adequate notification is provided in an
appropriate form, by the persons and means best suited under the
circumstances involved, to all health professionals who prescribe or
use the device and to any other person (including manufacturers,
importers, distributors, retailers, and device users) who should
properly receive such notification in order to eliminate such risk.
An order under this subsection shall require that the individuals
subject to the risk with respect to which the order is to be issued be
included in the persons to be notified of the risk unless the Secretary
determines that notice to such individuals would present a greater
danger to the health of such individuals than no such notification.
If the Secretary makes such a determination with respect to such
individuals, the order shall require that the health professionals
who prescribe or use the device provide for the notification of the
individuals whom the health professionals treated with the device
of the risk presented by the device and of any action which may be
taken by or on behalf of such individuals to eliminate or reduce such
risk. Before issuing an order under this subsection, the Secretary shall
consult with the persons who are to give notice under the order.
Neither the statute nor any of the regulations define what constitutes “an
unreasonable risk of substantial harm to public health.” But a 1984 draft, Medical
Device Notification and Voluntary Safety Alert Guideline, defined the phrase to mean
“actual or possible nonserious harm to a large number of persons as well as actual/

or possible serious harm to a few individuals.”
Unlike other orders under section 518, an “informal hearing” is not required
before FDA issues an order under this section. But the statute directs that the
secretary “shall consult with the persons who are to give notice under the order.”
As a matter of practice, FDA will notify the company and give it ten days to consult
with FDA. The company then has the opportunity to negotiate the terms of the
notification based on the nature of the risk as well as the scope of the affected
patient group.
The notice of the risk must be given either to the healthcare providers who
prescribed the device or to the individuals who are users of the device. But if
FDA decides that the notification would present a greater danger to the health of
such individuals, then “the order shall require that the health professionals who
prescribe or use the device provide for the notification of the individuals whom
the health professionals treated.”
The statute uses the phrase “provide for the notification” rather than “notify”
since individuals other than health professionals may be the appropriate persons
to provide notification.45 FDA may also require notification of any other party,
including manufacturers, importers, distributors, and device users, if it decides
that the notification will help to eliminate the risk. The content of the notification
must be “in an appropriate form,” and generally should include information about
the risk and about any action that may be taken to eliminate or reduce the risk.
As a matter of procedure, FDA relies on voluntary notifications called “safety
alerts” or “safety communications.”46 The 1984 Draft Guideline states that the
purpose of the safety alert is to “inform health professionals and other appropriate
persons of a situation that may present an unreasonable risk of substantial harm to
the public health presented by a device in commercial distribution and intended
for human use, in order to reduce or eliminate the risk.”
The manufacturer can develop these without FDA comment but, as always,
FDA will consider the content and effectiveness of the alert to determine whether
any other notification should be ordered. If a company does issue a safety alert, FDA
may classify it as a recall within the meaning of 21 CFR Part 7, as well as publish
the alert as a recall in the weekly FDA Enforcement Report. Enforcement Reports
are archived online at www.fda.gov/%20Safety/Recalls/EnforcementReports/
default.htm.
If the manufacturer issues a safety alert, FDA requires that it review its efforts
to ensure that the notification reached its intended audience.
Repair, Replacement, or Refund Orders

The next most serious regulatory power for dealing with a problem with a medical
device is an order by FDA that directs the manufacturer to repair, refund, or
replace the device.47 The applicable statute is 21 USC § 360h(b), which was enacted
in 1976 but has never been used. The procedure reveals the difficulties that FDA
would have if it were to take enforcement action under this section:
(b) Repair, replacement, or refund
1. A. I f, after affording opportunity for an informal hearing, the secretary
determines that—
(i) a device intended for human use that is introduced or delivered

for introduction into interstate commerce for commercial
distribution presents an unreasonable risk of substantial harm
to the public health,
(ii) there are reasonable grounds to believe that the device was not
properly designed or manufactured with reference to the state
of the art as it existed at the time of its design or manufacture,
(iii) there are reasonable grounds to believe that the unreasonable
risk was not caused by failure of a person other than a manufac
turer, importer, distributor, or retailer of the device to exercise
due care in the installation, maintenance, repair, or use of the
device, and
(iv) t he notification authorized by subsection (a) of this section
would not by itself be sufficient to eliminate the unreasonable
risk and action described in paragraph (2) of this subsection
is necessary to eliminate such risk, the Secretary may order
the manufacturer, importer, or any distributor of such device,
or any combination of such persons, to submit to him within
a reasonable time a plan for taking one or more of the actions
described in paragraph (2). An order issued under the
preceding sentence that is directed to more than one person
shall specify which person may decide which action shall
be taken under such plan and the person specified shall be
the person who the Secretary determines bears the principal,
ultimate financial responsibility for action taken under the
plan unless the Secretary cannot determine who bears such
responsibility or the Secretary determines that the protection
of the public health requires that such decision be made by a
person (including a device user or health professional) other
than the person he determines bears such responsibility.
B. The Secretary shall approve a plan submitted pursuant to an
order issued under subparagraph (A) unless he determines (after
affording opportunity for an informal hearing) that the action or
actions to be taken under the plan or the manner in which such
action or actions are to be taken under the plan will not assure that
the unreasonable risk with respect to which such order was issued
will be eliminated. If the Secretary disapproves a plan, he shall order
a revised plan to be submitted to him within a reasonable time. If the
Secretary determines (after affording opportunity for an informal
hearing) that the revised plan is unsatisfactory or if no revised plan
or no initial plan has been submitted to the Secretary within the
prescribed time, the Secretary shall (i) prescribe a plan to be carried
out by the person or persons to whom the order issued under
subparagraph (A) was directed, or (ii) after affording an opportunity
for an informal hearing, by order prescribe a plan to be carried out
by a person who is a manufacturer, importer, distributor, or retailer
of the device with respect to which the order was issued but to
whom the order under subparagraph (A) was not directed.
2. The actions that may be taken under a plan submitted under an order
issued under paragraph (1) are as follows:
A. To repair the device so that it does not present the unreasonable risk
of substantial harm with respect to which the order under paragraph
(1) was issued.
B. To replace the device with a like or equivalent device that is in
conformity with all applicable requirements of this chapter.
C. To refund the purchase price of the device (less a reasonable
allowance for use if such device has been in the possession of the
device user for one year or more—
(i) at the time of notification ordered under subsection (a) of this
section, or
(ii) at the time the device user receives actual notice of the
unreasonable risk with respect to which the order was issued
under paragraph (1), whichever first occurs).
3. No charge shall be made to any person (other than a manufacturer,
importer, distributor, or retailer) for availing himself of any remedy,
described in paragraph (2) and provided under an order issued under
paragraph (1), and the person subject to the order shall reimburse each
person (other than a manufacturer, importer, distributor, or retailer)
who is entitled to such a remedy for any reasonable and foreseeable
expenses actually incurred by such person in availing himself of
such remedy.
Thus, before issuing an order under section 360h, FDA must first determine whether:
• The device presents an unreasonable risk of substantial harm to the
public health.
• There are reasonable grounds to believe that the device was not
properly designed or manufactured when the state of the art as it
existed at the time of its design or manufacture is considered.
• There are reasonable grounds to believe that the risk is due to the
conduct of the manufacturer, importer, distributor, or retailer, and not
due to improper installation, maintenance, repair, or use.
• Notification of the defect alone will not eliminate the risk, and that
repair, replacement, or refund is necessary to eliminate the risk.
Congress intended 518(b) “to be in addition to and not as an alternative to the
notification requirements.”48
If FDA decides that the defect is the type that requires it to invoke section
518(b), it can direct the manufacturer, importer, distributor, or a combination of
them to submit a plan for the repair, replacement, or refund of the device. If FDA
requires action from more than one party, it will designate which party has the
responsibility to make the appropriate decisions for the plan. Once that party
is designated, he or she is the one who will bear the financial responsibility for
developing it and implementing it. However, FDA does have the ability to revisit
this assignment and make a new designation. FDA also has the power to order
a manufacturer, importer, distributor, or retailer of the device to reimburse any
other manufacturer, importer, distributor, or retailer for expenses incurred in
complying with the order. The only limitation is that the financial aspects of the
order “shall not affect” any contractual agreements between the parties. [FDCA
§ 518(c), 21 USC § 360h(c)] FDA must also provide “opportunity for an informal
hearing” before issuing the order requiring the plan.
Whoever has been designated by FDA to develop the plan must have “a
reasonable time” to submit a plan that satisfies the order. If a plan is not submitted,
FDA will then fashion one. Depending on what FDA orders, the plan must propose
one of the following:
• Repair the device in a way that eliminates the specific risk
• Replace the device with a like or equivalent device that conforms to
FDA requirements
• Refund the purchase price: either the full purchase price if the user
has had the device for less than a year as of the time the user receives
notice of the risk, or at a discounted purchase price if the user has had
possession for one year or more
If the user repairs or replaces the device on their own as provided by the approved
plan, the user can seek reimbursement of those reasonable and foreseeable
expenses from whichever party is subject to the order.
FDA must approve a submitted plan to ensure that it eliminates the
unreasonable risk. Before a plan is rejected, FDA must provide an opportunity for
an informal hearing to review why it has been rejected. Upon disapproval, FDA
“shall order a revised plan to be submitted.” If FDA considers the revised plan to
be unsatisfactory following the opportunity for an informal hearing, FDA shall
prescribe one. Again, largely because of the number of findings required and the
elaborate procedures, FDA has yet to issue an order under section 518(b).
Recall Authority
Until the SMDA added section 518(e), FDA did not have explicit authority to order
recalls of medical devices. Because FDA never used its authority under 518(b),
the recall authority added by section 518(e) in 1990 provided a different kind of
recall power. FDA issued a final rule on mandatory recall procedures that became
effective on May 17, 1997. As described on the FDA website:
Recalls are actions taken by a firm to remove a product from the market.
Recalls may be conducted on a firm’s own initiative, by FDA request, or
by FDA order under statutory authority. A Class I recall is a situation
in which there is a reasonable probability that the use of or exposure
to a violative product will cause serious adverse health consequences
or death. A Class II recall is a situation in which use of or exposure to a
violative product may cause temporary or medically reversible adverse
health consequences or where the probability of serious adverse health

consequences is remote. A Class III recall is a situation in which use of
or exposure to a violative product is not likely to cause adverse health
consequences.49
The act defines “serious, adverse health consequences” to include “any significant
adverse experience attributable to a device, including those which may be either
life-threatening, or involve permanent or long-term injuries.”50 The statutory
and regulatory scheme provides for two types of recalls: the mandatory recall
as well as a voluntary recall. The effect of the legislation is to provide FDA with
administrative injunctive power before there is a hearing extended to the company.
Mandatory Recall Order

The applicable regulations for a mandatory recall are set forth in 21 CFR Part 810.
Under the regulation, before there is a recall, FDA must find there is a reasonable
probability that a device would cause serious, adverse health consequences or
death. In such a case it will issue an order to cease distribution of the device
and to notify healthcare professionals about the risk. For the purposes of the
statute, “reasonable probability” means “it is more likely than not that an event
will occur.”51
Before it initiates a recall, FDA will conduct a health hazard evaluation.52
A health hazard evaluation is an evaluation by an ad hoc FDA committee that
evaluates the risk and assigns a recall classification. If FDA decides that the device
poses a risk, the order is directed to “the appropriate person,” which may include
manufacturers, importers, distributors, and retailers. FDA then issues a two-
part order to immediately cease distribution of the device and notify healthcare
professionals as well as device user facilities. These groups are advised about
the order and told to immediately stop using the device. The order will include
the device’s brand name; its common name; the model, catalog, or product code
number; and other identifying information such as lot or serial numbers. It will
also include a contact name at the agency.
As a matter of practice, FDA will provide an opportunity to consult with the
agency before it issues a cease distribution and notification order.53 The order
identifies the specific device that is the subject of the order, requirements of
the order, and basis for the recall.54 FDA may also include a model notification
letter, which it considers binding on manufacturers, as well as a schedule for the
completion of the notification.55
Once the order has been initiated, FDA may require the manufacturer to
provide specific information about the device, which may include the number
of devices that have been distributed, names and addresses of all distributors,
as well as the proposed strategy for complying with the order. The company can
request a hearing on the actions required by the order. The company can also ask
for a hearing to determine whether it should be modified, vacated, or amended to
require a mandatory recall. FDA can deny the request for a hearing if it determines
that no genuine and substantial issue of fact is raised by the request.56 It can also
submit a written request that the order be modified, vacated, or amended.57
Normally, there are three working days to request the hearing, but because of the
seriousness of the action, FDA may grant a shorter period. The hearing generally
must be held between two to ten working days after FDA receives the request.58
Once the hearing has been completed, FDA must provide a written notification of
its final decision within fifteen working days or within fifteen working days of
the receipt of a written request for review of the order.59
If there is a mandatory recall, FDA will provide for notice to individuals who
are subject to the device’s risk. FDA may seek to provide notice through the media
if there are significant difficulties in identifying the group. FDA also has the power
to specify the scope of the recall (wholesale, retail, user), as well as a timetable for
the recall. FDA may require the manufacturer to use a model notification letter,
to submit a proposed compliance strategy, and to give periodic progress reports.60
The only limitation to a recall is that the agency cannot order a recall if the health
risks of recalling the device are greater than those of not recalling it.61
The notification must be by verified written communication that is
conspicuously marked. Telephone calls or other personal contacts may be made
in addition to, but are not a substitute for, the verified written communication.62
The notice may be provided through affected individuals’ health professionals
rather than directly to individuals if FDA agrees this is appropriate and the most
effective method of notification.63
Effectiveness checks for a recall are required, and a strategy must be submitted
for approval.64 The purpose of the effectiveness check is to ensure the recall is
working as the plan intended. Follow-up communications must be sent to all who
fail to respond to the initial communication.65 The appropriate person can request
termination of the order by certifying compliance and including a copy of the
most current status report.66
FDA may terminate the order after determining that the person named in the
order has taken all reasonable notification efforts, and either removed or corrected
the device.67
FDA will publish new mandatory recalls in its weekly FDA Enforcement Report
unless it determines that such notification will cause unnecessary and harmful
anxiety in individuals, and that initial consultation between individuals and their
health professionals is essential.
FDCA CHAPTER VII: GENERAL AUTHORITY

Section 704—Inspection
Section 704 of the FDCA68 establishes the regulatory basis for an inspection of a
device company. The Office of Regulatory Affairs (ORA) is charged with enforcing
the law. ORA is the lead office for all US FDA field activities. Additional information
about ORA is available on its website at www.fda.gov/AboutFDA/CentersOffices/
OfficeofGlobalRegulatoryOperationsandPolicy/ORA/default.htm.
Information regarding inspections, compliance, enforcement, and criminal
investigations is available at http://www.fda.gov/ICECI/default.htm. This website
provides information to FDA investigators and inspectors to assist them in their
daily activities, including:
• Field Management Directives. The primary vehicle for distributing
procedural information/policy on the management of Office of
Regulatory Affairs field activities.
• Inspection Guides. Guidance documents written to assist FDA personnel

in applying FDA’s regulations, policies, and procedures during specific
types of inspection or for specific manufacturing processes.
• Foreign Inspections—Guide to International Inspections and Travel. Guide for
FDA personnel performing inspections including standard operational,
inspectional, and investigational procedures.
Reasonableness of the Inspection. Investigators from FDA are authorized to enter
and to inspect facilities “at reasonable times and within reasonable limits and in
a reasonable manner…”69 Note that the only limitation is that the times and scope
be “reasonable.”
Frequency of Inspections. Establishments that manufacture restricted devices are
subject to inspection pursuant to section 704 of the FDCA with a frequency of at
least once in every successive two-year period, following a first inspection within
two years of registration.70
Consents and Refusals. The authority to conduct an inspection is statutorily
mandated by the FDCA, and refusals of inspection are subject to criminal
prosecution. The FDCA requires that the inspector present his or her credentials
to the top management official at the facility, which should be the owner, operator,
or agent in charge, and a signed, completed Form 482 Notice of Inspection.71
Consent to the inspection will be implied if there is no express communication to
the inspector that the inspection is being refused, in total or in part.72
A refusal to permit an inspection is a prohibited act and, therefore, punishable
as a misdemeanor unless the investigator has failed to follow the procedures set
forth in section 704 (that is, presenting of credentials and issuance of written
Notice of Inspection).73
Warrants. The Supreme Court held in the landmark 1978 case of Marshall v.
Barlow’s, Inc. that administrative agency searches of commercial premises
without a warrant are unreasonable in violation of the Fourth Amendment.
The Court further held, however, that there is an exception for industries that
are so “pervasively regulated” that warrantless search authority is permitted.74
In 1981, the Eighth Circuit determined that the drug manufacturing industry is
pervasively regulated and within the Colonnade-Biswell exception to the warrant
requirement.75 In reaching this conclusion, courts have considered that the public
health interest ought to be protected, and that establishments operating in closely
regulated industries, such as drugs, voluntarily subject themselves to numerous
government regulations and to the restrictions placed on such activity. As such,
they have no reasonable expectation of privacy.76
In Marshall v. Barlow’s, Inc., the Court stated that such warrantless searches
are upheld because “when an entrepreneur embarks on such a business, he has
chosen to subject himself to a full arsenal of governmental regulation”77 and “in
effect consents to the restrictions placed on him.”78 Further, in the face of a long
history of government scrutiny, such a proprietor has no “reasonable expectation
of privacy.”79
The Eighth Circuit stated in Jamieson-McKames Pharmaceuticals that it believed
“the drug manufacturing industry is properly within the Colonnade-Biswell
exception to the warrant requirement. The drug manufacturing industry has a
long history of supervision and inspection. The present Food, Drug, and Cosmetic
Act has its origins in the Food and Drug Act of 1906, 34 Stat. 768. That act was an
attempt by Congress ‘to exclude from interstate commerce impure and adulterated
food and drugs’ and to prevent the transport of such articles ‘from their place of
manufacture.’”80
Likewise, giving Miranda warnings of constitutional rights to owners,
operators, or agents in charge of establishments being inspected is not necessary.
The issuance of Miranda warnings is not applicable when individuals are not in
custody, which is the typical situation during FDA inspections.81
Importantly, the decision by the Eighth Circuit in Jamieson-McKames
Pharmaceuticals as it relates to warrants applied to drug manufacturers, and it is not
clear that it extends to other FDA-regulated products. Further, FDA’s Investigation
Operations Manual does not instruct investigators to proceed without a warrant
when consent is denied.82
Reasons for FDA Administrative Inspection

An inspection may occur for a variety of reasons. For a Class III device
manufacturer, the initial inspection would probably be the preapproval inspection.
As a condition for approval of the device, the device manufacturing facility is
required to undergo an FDA inspection to determine its ability to produce the
product as claimed, as well as its ability to comply with GMPs. All marketed
devices are subject to periodic FDA inspections, and to directed inspections when
it comes to the agency’s attention that there may be violations of the FDCA. Other
types of enforcement actions taken by the agency, such as a seizure or a warning
letter, might also trigger unannounced inspections. Likewise, if there has been a
recall, FDA might inspect a company to determine the background for the recall
as well as to see what steps the company is taking to correct the problem. With
an increasingly aware healthcare community and public, the company might also
expect to see inspections following adverse events.
A special enforcement initiative may be part of local or national initiatives
and will focus on particular types of industries or products (for example, devices
that present an increased safety risk).
The Nuts and Bolts for Conducting Inspections

The Investigation Operations Manual is the basis for all inspections83 and serves
as primary guidance for FDA personnel performing investigational activities
supporting the FDA’s public health mission. Adherence is considered essential to
assuring quality, consistency, and efficiency in field operations.
Present Credentials and Notice of Inspection

An inspection begins when the FDA investigator presents their official credentials
and a properly signed, completed original written notice of inspection (form FDA
482) to the owner, operator, or agent in charge of the facility.84 A separate written
notice of inspection is required for each inspection unless an investigator makes
multiple entries during a single inspection continuing over a period of time.
Scope of Inspection
FDA investigators are authorized to enter any factory, warehouse, or establishment
where devices are manufactured, processed, packed, or held before or after
introduction into interstate commerce. Investigators are also authorized to enter
any vehicle used to transport or hold these devices, or cosmetics, in interstate
commerce.85
The FDA inspector can examine not only the premises but also all
equipment, finished and unfinished materials, containers, and labeling within
the establishment or vehicle in which the devices are manufactured, processed,
packed, held, or transported. Copies of documents can also be made. The refusal
to permit access or copying of required records is a prohibited act punishable as
a misdemeanor.86
There are limits, however. The agency’s authority under the FDCA does
not extend to financial data, sales data (other than shipment data), pricing data,
personnel data (other than data as to the qualifications of technical and professional
personnel performing functions subject to the act), or research data (other than, for
device facilities, data relating to devices and subject to reporting and inspection
under regulations lawfully issued pursuant to sections 519 or 520(g)87).
FDA’s Authority to Inspect Records of Interstate Shipment by

Common Carriers and Recipients
Section 703 of the FDCA requires that, upon an inspector’s request, carriers
engaged in interstate commerce, as well as those who receive or hold devices, must
permit access to and copying of all records showing the movement in interstate
commerce of medical devices.
If requested in writing, it is unlawful for any carrier or person to fail to permit
access to and copying of such records. Evidence obtained from a carrier or person
receiving such articles pursuant to a written request is not to be used in a criminal
prosecution of the person from whom such evidence was obtained. Common
carriers are not subject to the other provisions of the FDCA merely by reason of
their receipt, carriage, holding, or delivery of foods, drugs, devices, or cosmetics
in the usual course of business as carriers.88
If during the inspection the investigator obtains any sample of an article
(“official sample”), a receipt describing the samples must be provided before the
inspector leaves the premises.89 When an official sample is collected for analysis,
FDA must, upon request, provide a part of such official sample for examination or
analysis to any person named on the label, to the owner, or to the owner’s attorney
or agent.90
Samples Taken During Inspection

Documentary Sample (DOC Sample). In addition to official samples, investigators
may also collect DOC samples. DOC samples are collected in situations where an
actual physical sample is not practical (for example, a large, permanently installed
device), where a physical sample is no longer available, or where there is little
need for laboratory examination. DOC samples might also include copies of labels
and other documents subject to inspection, such as transportation records, dealer
affidavits, and an inventory of product on hand that documents the condition or

practices at the facility or establishes facts of a past act.
301(k) Sample. A 301(k) sample is one collected from a product lot that became
adulterated or misbranded while being held for sale after shipment in interstate
commerce. Under section 301(k) of the FDCA, it is a prohibited act to do anything
to a product after shipment in interstate commerce that results in the product
being adulterated or misbranded.91
Post-Seizure Sample. After the US marshal has seized a product, either the
claimant or the government may obtain a sample for analysis. The sample may be
collected only pursuant to court order.92
Investigational Sample (INV Sample). These samples are generally collected to
document observations, support regulatory actions, or provide other information.
INV samples may be used as evidence in court, and are sealed and handled by
FDA in a careful manner to protect their integrity. Examples of INV samples
include:
• Raw materials in process or finished products, to demonstrate
manufacturing conditions
• Filthy materials and other articles collected for exhibition purposes to
demonstrate manufacturing or storage conditions
• Samples collected during reconditioning under a court decree to
determine whether reconditioning was satisfactorily performed
• Survey samples to provide information about industry practices
regarding a particular issue
• Complaint samples collected during investigation of an injury or illness
An induced sample is an official sample that is obtained by FDA by mail or
through some other response to some type of advertisement or promotional
activity. The sample is induced, generally by mail or telephone, without disclosing
any association of the requestor or the transaction with FDA.
In-Plant Photographs
Taking photographs during an inspection is not specifically authorized by the
FDCA. Investigators, however, are directed to assume they have authority to take
photographs. The Investigations Operations Manual notes at section 5.3.4:
Photos taken during [establishment inspections] are not classified as
INV samples. They are exhibits. No C/R is used for photos taken unless
the photos are part of an official sample. See IOM 4.1.4 for information
on Official Samples.
Since photographs are one of the most effective and useful forms of
evidence, every photo should be taken with a purpose. Photographs
should be related to insanitary conditions contributing or likely to
contribute filth to the finished product, or to practices likely to render
it injurious or otherwise violative.
Section 5.3.4.1 provides additional details, including:

Do not request permission from management to take photographs
during an inspection. Take your camera into the firm and use it as
necessary just as you use other inspectional equipment.
If management objects to taking photographs, explain that photos are
an integral part of an inspection and present an accurate picture of
firm conditions. Advise management the US courts have held that
photographs may lawfully be taken as part of an inspection.
If management continues to refuse, provide them with the following
references:
“Dow Chemical v. United States,” 476 section 227 (1986) This Supreme
1.
Court decision dealt with aerial photographs by EPA, but the court’s
language seems to address the right to take photographs by any
regulatory agency. The decision reads in part, “… When Congress
invests an agency with enforcement and investigatory authority, it
is not necessary to identify explicitly each and every technique that
may be used in the course of executing the statutory mission. . .”
2. “United States of America v. Acri Wholesale Grocery Company, A
Corporation, and Joseph D. Acri and Anthony Acri, Individuals,” US
District Court for Southern District of Iowa. 409 F. Supp. 529. Decided
February 24, 1976.
If management refuses, obtain name and contact information for
the firm’s legal counsel, and advise your district management
immediately… If you have already taken some photos do not surrender
film to management. Advise the firm it can obtain copies of the photos
under the Freedom of Information Act. See IOM 5.3.4.5.
Affidavits and Interviews

FDA may ask for an affidavit as a part of the inspection process. The purpose
of an affidavit is to document shipment in interstate commerce of components
or finished products. Affidavits may also be used to establish particular facts
or individual responsibility that may later be used for enforcement purposes
(seizure, injunction, and prosecution). There is no requirement in the FDCA, or
elsewhere, for anyone to sign such an affidavit.
The FDCA does not expressly authorize investigators to interview a company’s
employees. However, discussions with company representatives may be useful or
necessary during an inspection in order to provide an investigator with complete
and accurate information in the event that the investigator may have questions or
need an explanation of certain processes, procedures, or records. The facts and
circumstances of a particular situation may influence the decision of whether to
allow employee interviews.
The Investigation Operations Manual also recognizes that there may be some
value to confidential interviews, and establishes a protocol. The Manual instructs
investigators that when they are faced with a situation involving informants who
want to remain anonymous, they should contact their supervisor and follow
the Manual procedures and any additional procedures in their district. They are
further advised to adhere to the procedures per IOM section 5.2.9.1:
Type of meeting—Try to schedule a personal interview with the person
rather than a telephone interview. At a face-to-face interview you can
assess the person’s demeanor, body language, overall presentation, and
truthfulness.
Meeting location—The place and time of the interview should be the
choice of the person, unless there is a concern with personal safety. If
the person’s suggested location is unsuitable, the investigator should
suggest the location. When you conduct the interview off FDA premises,
notify your supervisor of your destination, purpose, and estimated
time of return. When an off-site interview has been completed, check
in with your supervisor.93
Establishment Inspection Report

The report, called an establishment inspection report (EIR), is a detailed, written
narrative that discusses the inspection. The EIR contains information such as the
investigator’s findings, history of the firm, persons interviewed, responsibility,
operations, complaints, and corrective actions. It becomes the basis for FDA’s
determination of what future action, if any, will be taken by FDA. The reports
are available under the Freedom of Information Act94 if no action is contemplated.
Additionally, FDA procedures state that the district office or other office
responsible for the inspection “should endeavor to provide a copy of the EIR . . .
to the inspected establishment at the earliest time possible once the inspection is
deemed closed by the Agency.”95
After an Inspection
When an inspection is completed, the investigator is obligated to give to the
owner, operator, or agent in charge a written report summarizing the findings of
the inspection. This Inspectional Observations (form FDA 483) report identifies
objectionable conditions or practices observed during the inspection that, in the
inspector’s judgment, indicate that a device in such establishment may “(1) consist
in whole or in part of any filthy, putrid, or decomposed substance, or (2) [have]
been prepared, packed, or held under unsanitary conditions whereby it may have
become contaminated with filth, or whereby it may have been rendered injurious
to health.”96
Before leaving the inspection, the investigator is required to meet with the
company to discuss the results of the inspection. Section 5.2.7 of the manual notes:
During the discussion, be frank, courteous, and responsive with
management. Point out the observations listed on the FDA 483, are your
observations of objectionable conditions found during the inspection,
and explain the significance of each. Try to relate each listed condition
to the applicable sections of the laws and regulations administered by
the FDA.
If significant deviations are observed during the inspection, you should

inform management during the closeout discussion, the conditions
observed may, after further review by the Agency, be considered to
be violations of the Food, Drug, and Cosmetic Act or other statutes.
Legal sanctions available to FDA may include seizure, injunction, civil
money penalties, and prosecution.97
Thus, the primary purpose of such discussion is to inform management of the
conditions observed by the investigator. Another purpose is to give the investigator
an opportunity to elicit responses and commitments from the responsible
individual. When the inspector’s report is prepared, there will be a discussion of
the meeting.
Refusal to Permit Entry or Inspection or to Permit Access to or

Copying of Records
If the owner, operator, or agent in charge refuses entry or inspection, FDA’s
district office will approach either the Department of Justice and/or the local US
Attorney’s office to request assistance in obtaining an administrative inspection
warrant from a federal magistrate judge.
The US Attorney’s office and FDA district office will work together in preparing
an application for the warrant and present it to the judge or magistrate judge, who
reviews it. If the application is found to be adequate, the magistrate judge will
issue an administrative inspection warrant authorizing the FDA investigator to
return to the facility and conduct the inspection.
If the owner, operator, or agent in charge still refuses entry or inspection
pursuant to the warrant, that refusal is punishable as contempt of court for that
individual’s failure to obey an order of a federal court. Such warrants of inspection
would contain language that would allow the investigator broader inspectional
authority (for example, the taking of photographs) than allowed under
section 704.98
Chapter 5
US FDA Code of Federal
Regulations (CFR) Title 21
T
he Code of Federal Regulations (CFR) codifies general and permanent
rules published in the Federal Register. Each title of the CFR is essentially
a volume. Title 21 is specific to rules published by the US Food and Drug
Administration, with a revised version issued annually on approximately April 1.
The most recent version of CFR 21 is available for download from the Government
Printing Office (GPO).
21 CFR 11 ELECTRONIC RECORDS AND SIGNATURES

On March 20, 1997, FDA published a regulation in the Federal Register concerning
the use of electronic records and electronic signatures. This regulation defines
the criteria for which FDA considers the use of electronic records and electronic
signatures as equivalent to paper records and handwritten signatures. The
regulation is Title 21 of the Code of Federal Regulations (CFR) Part 11 and is
effective as of August 20, 1997.
This regulation had been greatly anticipated as technology evolution allows
companies to place greater reliance on electronic records. As regulatory require
ments for record control and retention increase, and companies strive for greater
efficiency, a transition to electronic records is both a logical and necessary step.
It should be noted that FDA has exercised enforcement discretion with this
regulation for medical device manufacturers. The regulation is framed around
"predicate rules." The predicate rules are those in other regulations that are
realized through electronic records or signatures. For example, 21 CFR 820 defines
a requirement ("predicate rule") for documented evidence of quality audits.99
If the manufacturer chooses to maintain the record in electronic form, Part 11
applies. It is important to understand the framework for the regulation and how
to determine which predicate rules are applicable. When FDA assesses a system, if
the manufacturer is not controlling records in accordance with Part 11, the finding
will be against the predicate rule, not Part 11.
Similarly, the EU has published expectations for computerized systems in
Volume 4 Good Manufacturing Practice—Medicinal Products for Human and Veterinary
Use, Annex 11 Computerised Systems of EudraLex—The Rules Governing Medicinal
Products in the European Union.100 While, by definition, this is a guidance and limited
to medicinal products for human and veterinary use, it shows current thinking in
the EU and establishes the foundation for managing electronic records/signatures
in the EU.
43
This chapter is included to provide the reader with the background necessary
to understand the use of electronic records and electronic signatures. This
discussion is not meant to provide a comprehensive discussion of all elements of
the regulation; it is meant to summarize key points that are required for electronic
records and electronic signatures.
Subpart B—Electronic Records

FDA has partitioned the use of electronic records into those used in Open Systems
and Closed Systems. Per the definition in the regulation:
An open system is an environment in which system access is not
controlled by persons who are responsible for the content of electronic
records that are on the system.
A closed system is an environment in which system access is controlled
by persons who are responsible for the content of electronic records
that are on the system.
This distinction is important as "open" systems have additional controls.
Controls for Closed Systems

The regulation states that people who use closed systems to “create, modify,
maintain, or transmit electronic records” are to implement the following
procedures and controls:
11.10.a Validation of Systems to Ensure Accuracy, Reliability, Consistency,
and Ability to Detect Record Changes. This regulation does not define the
criteria for validation; instead, other FDA guidelines are to be used to identify
what documents are applicable (e.g., General Principles of Software Validation; Final
Guidance for Industry and FDA Staff, issued January 11, 2002).101 Validation and
validation decisions should be risk-based (and it is highly recommended that the
decisions be documented).
An area of confusion in industry is whether or not a commercial system can
be "pre-validated" for Part 11. The answer is no. A system must be validated for its
intended use in the environment for which it is used. It would be quite possible
to install a (allegedly) pre-validated system and use it in a way that is contrary
to the regulation! The validation effort can leverage any existing validation
information provided by the supplier but cannot solely rely on such information to
achieve validation.
11.10.b Ability to Produce Copies in Electronic and Human Readable Form. The
requirement continues to state that the copies must be accurate and complete.
The system must provide a capability to generate reports on the stored data for
review. This has raised questions regarding the level of detail of data that is to
be provided and whether the “raw” data must be maintained. The manufacturer
should specifically identify the data and reports that are within the scope of
this requirement.
11.10.c Protection to Ensure Access throughout Storage Period. This means
that record retention must be defined, including archival processes. Problems
concerning this requirement include concerns as to whether the stored media
Chapter 5: US FDA Code of Federal Regulations (CFR) Title 21 45
(such as a disk) can actually be read for the duration of the retention period
given the rapid evolution of technology (i.e., will 3.5-inch floppy disks be read
able in available hardware ten years from now?). The manufacturer should
define a product life to clarify record retention time and also ensure that backup
procedures are established. A means to confirm (stored) record viability should
also be considered. Note also that companies often use off-site storage for housing
backup copies. In such cases, companies should ensure sufficient environmental
controls are established to help ensure record preservation.
11.10.d Limiting System Access to Authorized Individuals. Password controls to
limit access are to be provided, as a minimum, and preferably physical restrictions
to access as well.
11.10.e Date/Time Stamped Audit Trails for Any Changes. This is a unique problem
introduced by electronic records. How do you know that the record that is stored
has not been modified? The system must provide controls to indicate when any
new creation, modification, or deletion of records occurred and who is responsible
for the change, and to retain the previous data. For many applications, custom
modifications are required to satisfy this audit trail requirement. To ensure the
required record integrity, one solution used by several companies is to store
quality records on write-once CDs where changes cannot be made.
11.10.f Operational System Checks. This requirement is defined to be “as
appropriate,” meaning that where you can justify that this is not a needed
requirement, it need not apply. The intent here is that when events should occur
in a particular order, operational sequence checks are to be implemented by the
electronic system to enforce the required ordering. The checks could include
sequences such as review order.
11.10.g Authority Checks. These checks are to ensure that only authorized
individuals are allowed to access records or hardware components, or perform
controlled operations such as record modifications.
11.10.h Device Location Checks. This is another “as appropriate” requirement.
This concerns the ability to identify an individual as a result of the location of the
log-on. In other words, access for selected functions may be restricted not only to
certain individuals but also to the terminals that those individuals use.
11.10.i Training of Personnel Who Develop, Maintain, or Use Electronic Record/
Electronic Signature Systems. This defines the need for procedures for use of the
system, as well as training of personnel. A distinction is made in the training
required not only for users but also for the developers and maintainers of the
system. The added emphasis on the developers and maintainers is to ensure that
they understand the need to enforce security controls.
11.10.j Written Operation Policies and Procedures That Hold Individuals
Accountable and Liable. These policies and procedures are to ensure that
everyone understands that the use of electronic records is to be controlled in the
same manner as paper records. Falsification of electronic records is just as serious
and is to be treated with the same severity as falsification of paper records. (For
electronic signature systems, the regulation further states that when electronic
signatures are used, a certification is to be provided to the FDA stating that they
are the legally binding equivalent of handwritten signatures.)
11.10.k System Documentation Controls. This requirement is to ensure that the

system-level documentation that includes security information such as passwords
is also to be controlled to prevent potential falsification of records.
11.30 Controls for Open Systems

Procedures and controls are required to ensure authenticity, integrity, and, as
appropriate, confidentiality. Additional measures beyond the § 11.10 requirements
are expected for open systems such as document encryption and use of digital
signature standards. It does not seem logical to have an open system where a
company would allow access to electronic records that are subject to FDA scrutiny.
11.50 Signature Manifestations

Signed electronic records must contain (1) the name of the signer, (2) the date and
time of the signing, and (3) the meaning of the signature, such as author, reviewer,
or approver. This information is also to be provided with all readable forms of the
electronic records that are accessible electronically or in printed form.
11.70 Signature/Record Linking

Electronic signatures and handwritten signatures that are executed to electronic
records have to be linked to the record to ensure that they cannot be copied or
deleted. This requirement is to prevent the data associated with an individual’s
signing to be inappropriately linked to records that were not actually signed by
that individual.
Subpart C—Electronic Signatures
11.100 General Requirements

Electronic signatures have to be unique and cannot be reused or reassigned
to anyone else. The uniqueness of the electronic signature is assured with the
assignment of a unique user identification code, as is required for access to most
established computer systems. It is also important that the identity of individuals
be verified before they are allowed system access to prevent unauthorized
personnel from gaining access. This is a common security practice that is used
by credit card companies and banks to protect the privacy of individual accounts.
If a company has decided to use electronic signatures, a certification statement
must be provided to FDA stating that electronic signatures are intended to be
the legally binding equivalent of handwritten signatures. This is to ensure that
electronic signatures would be admissible in a court of law if necessary.
11.200 Electronic Signature Components and Controls

The regulation allows electronic signatures to be based on biometrics, such as
fingerprints and voice recognition systems, or the entry of digital information,
such as an identification code and password. For electronic signatures that are not
based on biometric links, both an identification code and password are required.
11.300 Controls for Identification Codes/Passwords

11.300.a Uniqueness of Each Combined Identification Code and Password.
Identification codes have to be unique. This is usually a standard function of the
information technology department to ensure that users have their own account.
11.300.b Identification Code and Password Issuances Are Periodically Checked.
Passwords have to be changed at some interval to ensure that if they are
compromised, the compromised state is corrected over time. The regulation does
not define the minimum period for changing, but any period greater than a year
would not seem to be effective or reasonable. Password changes should also be
checked to ensure that the user does not simply redefine the new password to be
the same as the password previously in use.
11.300.c Loss Management Procedures. Procedures must be established to
disallow use of access cards or system accounts that are compromised due to loss,
theft, or any other means. The procedures must allow for accounts to be reset
in a manner that prevents compromising system access. These procedures may
include issuing temporary access cards or resetting access passwords.
11.300.d Transaction Safeguards to Prevent Unauthorized Use. Controls must be
established for monitoring the system to detect possible intrusion into the computer
systems. If an unauthorized intrusion is detected, it is to be immediately reported
to the information technology department, and if additional violations occur, it
is also to be reported to management. Automated checks must be implemented
to be able to detect these intrusion attempts. Many companies define three failed
attempts by a user to enter a password as a potential indication of unauthorized
system access.
11.300.e Initial and Periodic Testing of Devices. When physical devices are used
for system access, such as a token or access card, procedures must be established
to check these devices periodically to ensure that they function properly.
EudraLex Volume 4, Annex 11

As noted above, Annex 11 is the initial foray by the EU into governance of electronic
records and signatures. And again, currently it is just a guidance applicable only
to medicinal products for human and veterinary use. Annex 11 establishes a
broader scope than Part 11 in four key areas:
• Supplier and service provider audits
• IT infrastructure qualification
• Risk Management (Part 11 only infers that risk should be used in
decision-making)
• Integrity of system operations and information stored in the system
Summary
The requirements for use of electronic records are not unreasonable and have
been implemented cost-effectively by many companies. Companies that are
using electronic records have realized increased efficiencies in the management
of quality records, and are expanding the role of these systems to include an
increasing portion of the records mandated by the FDA quality system regulation
and ISO 9001.
Many commercial systems are being offered today to support electronic
records and electronic signatures. It is recommended that the requirements of
21 CFR Part 11 be used to evaluate potential vendors to see how well their systems
satisfy these requirements. As the use of electronic signatures adds additional
requirements, most companies have elected to comply first with the electronic
record elements and address electronic signature in subsequent phases of
implementation.
21 CFR 801 LABELING

The general labeling requirements for medical devices are contained in
21 CFR Part 801, subpart A. Subparts B, C, D, E, and H specify the requirements
for unique device identification, over-the counter devices, exemptions, and special
requirements for specific devices; additionally subparts F through G are reserved.
Those parts are not covered under the scope of this manual. Labeling of in-vitro
diagnostic products is addressed in 21 CFR § 809.10 and is not in scope of this
handbook.
Subpart A—General Labeling Provisions
Regulatory Requirement 21 CFR § 801.1

Medical devices; name and place of business of manufacturer, packer, or
distributor.
a. The label of a device in package form shall specify conspicuously
the name and place of business of the manufacturer, packer, or
distributor.
b. The requirement for declaration of the name of the manufacturer,
packer, or distributor shall be deemed to be satisfied, in the case
of a corporation, only by the actual corporate name, which may be
preceded or followed by the name of the particular division of the
corporation. Abbreviations for “company,” “Incorporated,” etc., may
be used and “The” may be omitted. In the case of an individual,
partnership, or association, the name under which the business is
conducted shall be used.
c. Where a device is not manufactured by the person whose name
appears on the label, the name shall be qualified by a phrase that
reveals the connection such person has with such device, such as
“Manufactured for __________,” “Distributed by __________,”
or any other wording that expresses the facts.
d. The statement of the place of business shall include the street address,
city, state, and zip code; however, the street address may be omitted
if it is shown in a current city directory or telephone directory. The
requirement for inclusion of the zip code shall apply only to consumer
commodity labels developed or revised after the effective date of
this section. In the case of nonconsumer packages, the zip code shall
appear on either the label or the labeling (including the invoice).
e. If a person manufactures, packs, or distributes a device at a place
other than his principal place of business, the label may state the
principal place of business in lieu of the actual place where such
device was manufactured or packed or is to be distributed, unless
such statement would be misleading.
Discussion
The label of a device shall contain the name and place of business of the
manufacturer, packer, or distributor, including the street address, city, state, and
zip code. If the firm’s street address is in the local telephone directory, the street
address can be omitted. If the firm listed on the label is not the manufacturer,
the firm information must be qualified by an appropriate statement such as
“Manufactured for…” or “Distributed by…”
Regulatory Requirement 21 CFR § 801.3 Definitions

As used in this part:
Automatic identification and data capture (AIDC) means any technology that conveys
the unique device identifier or the device identifier of a device in a form that
can be entered into an electronic patient record or other computer system via an
automated process.
Center Director means the Director of the Center for Devices and Radiological
Health or the Director of the Center for Biologics Evaluation and Research,
depending on which Center has been assigned lead responsibility for the device.
Combination product has the meaning set forth in 3.2(e) of this chapter.
Convenience kit means two or more different medical devices packaged together
for the convenience of the user.
Device package means a package that contains a fixed quantity of a particular
version or model of a device.
Expiration date means the date by which the label of a device states the device must
or should be used.
FDA, we, or us means the Food and Drug Administration.

Finished device means any device or accessory to any device that is suitable for use
or capable of functioning.
Global Unique Device Identification Database (GUDID) means the database that
serves as a repository of information to facilitate the identification of medical
devices through their distribution and use.
Human cells, tissues, or cellular or tissue-based product (HCT/P) regulated as a device
means an HCT/P as defined in 1271.3(d) of this chapter that does not meet the
criteria in 1271.10(a) and that is also regulated as a device.
Implantable device means a device that is intended to be placed in a surgically or
naturally formed cavity of the human body. A device is regarded as an implantable
device for the purpose of this part only if it is intended to remain implanted
continuously for a period of 30 days or more, unless the Commissioner of Food
and Drugs determines otherwise in order to protect human health.
Label has the meaning set forth in section 201(k) of the Federal Food, Drug, and
Cosmetic Act.
Labeler means:
1. Any person who causes a label to be applied to a device with the
intent that the device will be commercially distributed without any
intended subsequent replacement or modification of the label; and
2. Any person who causes the label of a device to be replaced or
modified with the intent that the device will be commercially
distributed without any subsequent replacement or modification
of the label, except that the addition of the name of, and contact
information for, a person who distributes the device, without making
any other changes to the label, is not a modification for the purposes
of determining whether a person is a labeler.
Lot or batch means one finished device or more that consist of a single type,
model, class, size, composition, or software version that are manufactured
under essentially the same conditions and that are intended to have uniform
characteristics and quality within specified limits.
Shipping container means a container used during the shipment or transportation
of devices, and whose contents may vary from one shipment to another.
Specification means any requirement with which a device must conform.
Unique device identifier (UDI) means an identifier that adequately identifies a
device through its distribution and use by meeting the requirements of 830.20 of
this chapter. A unique device identifier is composed of:
1. A device identifier—a mandatory, fixed portion of a UDI that identifies
the specific version or model of a device and the labeler of that
device; and
2. A production identifier—a conditional, variable portion of a UDI that

identifies one or more of the following when included on the label of
the device:
(i) The lot or batch within which a device was manufactured;
(ii) The serial number of a specific device;
(iii) The expiration date of a specific device;
(iv) The date a specific device was manufactured;
(v) For an HCT/P regulated as a device, the distinct identification code
required by 1271.290(c) of this chapter.
Universal product code (UPC) means the product identifier used to identify an item
sold at retail in the United States.
Version or model means all devices that have specifications, performance, size, and
composition, within limits set by the labeler.
Regulatory Requirement 21 CFR § 801.4 Meaning of “Intended Uses”

The words “intended uses” or words of similar import in § 801.5, 801.119, and
801.122 refer to the objective intent of the persons legally responsible for the
labeling of devices. The intent is determined by such persons’ expressions or
may be shown by the circumstances surrounding the distribution of the article.
This objective intent may, for example, be shown by labeling claims, advertising
matter, or oral or written statements by such persons or their representatives. It
may be shown by the circumstances that the article is, with the knowledge of
such persons or their representatives, offered and used for a purpose for which
it is neither labeled nor advertised. The intended uses of an article may change
after it has been introduced into interstate commerce by its manufacturer. If, for
example, a packer, distributor, or seller intends an article for different uses than
those intended by the person from whom he received the devices, such packer,
distributor, or seller is required to supply adequate labeling in accordance with
the new intended uses. But if a manufacturer knows, or has knowledge of facts
that would give him notice that a device introduced into interstate commerce by
him is to be used for conditions, purposes, or uses other than the ones for which
he offers it, he is required to provide adequate labeling for such a device which
accords with such other uses to which the article is to be put.
Discussion
If a packer, distributor, or seller intends a device for uses other than those intended
by the person from whom he received the device, these parties must furnish
adequate labeling in accordance with the new intended use. If a manufacturer
knows or has information indicating that this device is to be used for conditions
or purposes other than which it was intended, he is required to provide adequate
labeling in accordance with such other uses. (An example of this might be a
manufacturer of dental X-ray equipment who is routinely selling his product to
podiatrists.)
Regulatory Requirement 21 CFR § 801.5 Medical Devices;

Adequate Directions for Use
“Adequate directions for use” means directions under which the layman can use
a device safely and for the purposes for which it is intended. Section 801.4 defines
intended use. Directions for use may be inadequate because, among other reasons,
of omission, in whole or in part, or incorrect specification of:
a. Statements of all conditions, purposes, or uses for which such device
is intended, including conditions, purposes, or uses for which it is
prescribed, recommended, or suggested in its oral, written, printed, or
graphic advertising, and conditions, purposes, or uses for which the
device is commonly used; except that such statements shall not refer
to conditions, uses, or purposes for which the device can be safely
used only under the supervision of a practitioner licensed by law and
for which it is advertised solely to such practitioner.
b. Quantity of dose, including usual quantities for each of the uses for
which it is intended and usual quantities for persons of different ages
and different physical conditions
c. Frequency of administration or application
d. Duration of administration or application
e. Time of administration or application, in relation to time of meals,
time of onset of symptoms, or other time factors
f. Route or method of administration or application
g. Preparation for use, that is, adjustment of temperature, or other
manipulation or process
Discussion
“Adequate directions for use” means directions under which the layman can use
a device safely and for the purpose intended. This includes:
• Statements of all purposes for which and conditions under which the
device can be used
• Quantity of dose for each use and usual quantities for persons of
different ages and physical conditions
• Frequency of administration
• Duration of application
• Time of administration in relation to other factors
• Route or method of application
• Any preparation necessary for use

Misleading Statements
Among representations in the labeling of a device, which render such a device
misbranded, is a false or misleading representation with respect to another device,
drug, food, or cosmetic.
Discussion
A device is misbranded if it makes a false or misleading statement with respect to
another device, drug, food, or cosmetic.

Prominence of Required Label Statements
a. A word, statement, or other information required by or under
authority of the act to appear on the label may lack that prominence
and conspicuousness required by section 502(c) of the act by reason,
among other reasons, of:
1. The failure of such word, statement, or information to appear on
the part or panel of the label that is presented or displayed under
customary conditions of purchase
2. The failure of such word, statement, or information to appear on
two or more parts or panels of the label, each of which has sufficient
space, and each of which is so designed as to render it likely to be,
under customary conditions of purchase, the part or panel displayed
3. The failure of the label to extend over the area of the container or
package available for such extension, so as to provide sufficient
label space for the prominent placing of such word, statement, or
information
4. Insufficiency of label space for the prominent placing of such word,
statement, or information, resulting from the use of label space for
any word, statement, design, or device that is not required by or
under authority of the act to appear on the label
5. Insufficiency of label space for the placing of such word, statement,
or information, resulting from the use of label space to give
materially greater conspicuousness to any other word, statement,
or information, or to any design or device
6. Smallness or style of type in which such word, statement, or
information appears, insufficient background contrast, obscuring
designs or vignettes, or crowding with other written, printed, or
graphic matter
b. No exemption depending on insufficiency of label space, as

prescribed in regulations promulgated under section 502(b) of the
FDCA, shall apply if such insufficiency is caused by:
1. The use of label space for any word, statement, design, or device
that is not required by or under authority of the FDCA to appear on
the label
2. The use of label space to give greater conspicuousness to any word,
statement, or other information than is required by section 502(c) of
the FDCA
3. The use of label space for any representation in a foreign language
c. 1. A
ll words, statements, and other information required by or under
authority of the act to appear on the label or labeling shall appear
thereon in the English language, provided, however, that in the
case of articles distributed solely in the Commonwealth of Puerto
Rico or in a territory where the predominant language is one other
than English, the predominant language may be substituted
for English.
2. If the label contains any representation in a foreign language, all
words, statements, and other information required by or under
authority of the act to appear on the label shall appear thereon in
the foreign language.
3. If the labeling contains any representation in a foreign language,
all words, statements, and other information required by or under
authority of the act to appear on the label or labeling shall appear
on the labeling in the foreign language.
Discussion
A word, statement, or other required information may lack the required prominence
and conspicuousness for the following reasons:
• If it fails to appear on the part or panel that is displayed under
customary conditions of purchase
• If the package contains sufficient space and the required information
fails to appear on two or more panels, each of which is designed to
render it likely to be displayed under customary conditions of purchase
• Failure to extend required labeling over package space provided
• Lack of sufficient label space for required labeling due to placement of
nonrequired labeling of the package
• Smallness or style of type, insufficient contrast between labeling and
package background, designs that obscure labeling, or overcrowding of
labeling renders it unreadable

Spanish-Language Version of Certain Required Statements
If devices restricted to prescription use only are labeled solely in Spanish for
distribution in the Commonwealth of Puerto Rico where Spanish is the predomi
nant language, such labeling is authorized under 21 CFR § 801.15(c).
Discussion
Where the device is restricted to prescriptions where Spanish is the prominent
language, labeling may be generated in that language as a substitute for the
English language.
21 CFR 803 MEDICAL DEVICE REPORTING

The statutory authority for the Medical Device Reporting (MDR) regulation
is section 519(a) of the FDCA. The final MDR regulation for user facilities was
published in the Federal Register on December 11, 1995. On July 31, 1996, the new
MDR regulation became effective for user facilities and device manufacturers. The
FDA Modernization Act of 1997 (FDAMA) changes to medical device adverse event
reporting became effective on February 19, 1998. On January 26, 2000, the changes to
the implementing regulations, 21 CFR § 803, were published in the Federal Register
to reflect these amendments in the act. The MDR regulation provides a mechanism
for FDA to identify and monitor significant adverse events involving medical
devices so problems may be detected and corrected in a timely manner.
The purpose of Part 803 is to provide domestic and foreign manufacturers with:
• A thorough description of the current MDR regulation
• A clear understanding of their reporting responsibilities
• Guidance to help in the completion of the MDR forms
• An overview of required written MDR procedures, records, and files
• Information on sources for forms, instructions, and other MDR
information
Further guidance on the MDR regulation is available on the FDA’s website.
Subpart A—General Provisions
Regulatory Requirement 21 CFR § Section 803.1 What Does this

Part Cover?
a. This part establishes the requirements for medical device reporting
for device user facilities, manufacturers, importers, and distributors.
If you are a device user facility, you must report deaths and serious
injuries that a device has or may have caused or contributed to,
establish and maintain adverse event files, and submit summary
annual reports. If you are a manufacturer or importer, you must

report deaths and serious injuries that your device has or may
have caused or contributed to, you must report certain device
malfunctions, and you must establish and maintain adverse event
files. If you are a manufacturer, you must also submit specified follow
up. These reports help us to protect the public health by helping
to ensure that devices are not adulterated or misbranded and are
safe and effective for their intended use. If you are a medical device
distributor, you must maintain records (files) of incidents, but you are
not required to report these incidents.
b. This part supplements and does not supersede other provisions of
this chapter, including the provisions of part 820 of this chapter.
c. References in this part to regulatory sections of the Code of Federal
Regulations are to chapter I of title 21, unless otherwise noted.
Discussion
Under this part, device manufacturers, user facilities, and importers must report
deaths and serious injuries that a device has or may have caused or contributed
to, must establish and maintain adverse event files, and must submit to FDA
specified follow-up and summary reports. Manufacturers also must report device
malfunctions that would be likely to cause or contribute to a death or serious injury
if they recurred. Medical device distributors are not required to submit reports of
adverse events, but are required to establish and maintain complaint records.
Regulatory Requirement 21 CFR § Section 803.3 How Does FDA

Define the Terms Used in This Part?
FDA has set forth the following definitions applicable to medical device reporting:
Ambulatory surgical facility (ASF) means a distinct entity that operates for the
primary purpose of furnishing same day outpatient surgical services to patients.
An ASF may be either an independent entity (i.e., not a part of a provider of
services or any other facility) or operated by another medical entity (e.g., under
the common ownership, licensure, or control of an entity). An ASF is subject to
this regulation regardless of whether it is licensed by a Federal, State, municipal,
or local government or regardless of whether it is accredited by a recognized
accreditation organization. If an adverse event meets the criteria for reporting,
the ASF must report that event regardless of the nature or location of the medical
service provided by the ASF.
Become aware means that an employee of the entity required to report has acquired
information reasonably suggesting a reportable adverse event has occurred.
1. If you are a device user facility, you are considered to have become
aware when medical personnel, as defined in this section, who are
employed by or otherwise formally affiliated with your facility, obtain
information about a reportable event.
2. If you are a manufacturer, you are considered to have become

aware of an event when any of your employees becomes aware of a
reportable event that is required to be reported within 30 calendar
days or that is required to be reported within five work days because
we had requested reports in accordance with 803.53(b). You are also
considered to have become aware of an event when any of your
employees with management or supervisory responsibilities over
persons with regulatory, scientific, or technical responsibilities, or
whose duties relate to the collection and reporting of adverse events,
becomes aware, from any information, including any trend analysis,
that a reportable MDR event or events necessitates remedial action to
prevent an unreasonable risk of substantial harm to the public health
3. If you are an importer, you are considered to have become aware of
an event when any of your employees becomes aware of a reportable
event that is required to be reported by you within 30 days.
Caused or contributed means that a death or serious injury was or may have been
attributed to a medical device, or that a medical device was or may have been a
factor in a death or serious injury, including events occurring as a result of: (1)
failure, (2) malfunction, (3) improper or inadequate design, (4) manufacture, (5)
labeling, or (6) user error.
Device user facility means a hospital, ambulatory surgical facility, nursing home,
outpatient diagnostic facility, or outpatient treatment facility as defined in this
section, which is not a physician’s office, as defined in this section. School nurse
offices and employee health units are not device user facilities.
Distributor means any person (other than the manufacturer or importer) who
furthers the marketing of a device from the original place of manufacture to the
person who makes final delivery or sale to the ultimate user, but who does not
repackage or otherwise change the container, wrapper, or labeling of the device or
device package. If you repackage or otherwise change the container, wrapper, or
labeling, you are considered a manufacturer as defined in this section.
Expected life of a device means the time that a device is expected to remain functional
after it is placed into use. Certain implanted devices have specified “end of life”
(EOL) dates. Other devices are not labeled as to their respective EOL, but are
expected to remain operational through activities such as maintenance, repairs,
or upgrades, for an estimated period of time.
FDA, we, or us means the Food and Drug Administration.
Five-day report means a medical device report that must be submitted by a
manufacturer to us under 803.53, on FDA Form 3500A or an electronic equivalent
approved under 803.14, within five work days.
Hospital means a distinct entity that operates for the primary purpose of providing
diagnostic, therapeutic (such as medical, occupational, speech, physical), surgical,
and other patient services for specific and general medical conditions. Hospitals
include general, chronic disease, rehabilitative, psychiatric, and other special-
purpose facilities. A hospital may be independent (e.g., not a part of a provider of
services or any other facility) or it may be operated by another medical entity (e.g.,
under the common ownership, licensure, or control of another entity). A hospital
is covered by this regulation regardless of whether it is licensed by a Federal,
State, municipal, or local government or whether it is accredited by a recognized
accreditation organization. If an adverse event meets the criteria for reporting, the
hospital must report that event regardless of the nature or location of the medical
service provided by the hospital.
Importer means any person who imports a device into the United States and who
furthers the marketing of a device from the original place of manufacture to the
person who makes final delivery or sale to the ultimate user, but who does not
repackage or otherwise change the container, wrapper, or labeling of the device or
device package. If you repackage or otherwise change the container, wrapper, or
labeling, you are considered a manufacturer as defined in this section.
Malfunction means the failure of a device to meet its performance specifications
or otherwise perform as intended. Performance specifications include all claims
made in the labeling for the device. The intended performance of a device refers
to the intended use for which the device is labeled or marketed, as defined in 801.4
of this chapter.
Manufacturer means any person who manufactures, prepares, propagates,
compounds, assembles, or processes a device by chemical, physical, biological, or
other procedure. The term includes any person who either:
1. Repackages or otherwise changes the container, wrapper, or labeling
of a device in furtherance of the distribution of the device from the
original place of manufacture
2. Initiates specifications for devices that are manufactured by a
second party for subsequent distribution by the person initiating the
specifications
3. Manufactures components or accessories that are devices that are
ready to be used and are intended to be commercially distributed and
intended to be used as is, or are processed by a licensed practitioner
or other qualified person to meet the needs of a particular patient; or
4. Is the US agent of a foreign manufacturer.
Manufacturer or importer report number means the number that uniquely identifies
each individual adverse event report submitted by a manufacturer or importer.
This number consists of the following three parts:
1. The FDA registration number for the manufacturing site of the
reported device, or the registration number for the importer. If the
manufacturing site or the importer does not have an establishment
registration number, we will assign a temporary MDR reporting
number until the site is registered in accordance with Part 807 of
this chapter. We will inform the manufacturer or importer of the
temporary MDR reporting number;
2. The four-digit calendar year in which the report is submitted; and

3. The five-digit sequence number of the reports submitted during the
year, starting with 00001. (For example, the complete number will
appear 1234567-1995-00001.)
MDR means medical device report.
MDR reportable event (or reportable event) means:
1. An event that user facilities become aware of that reasonably suggests
that a device has or may have caused or contributed to a death or
serious injury; or
2. An event that manufacturers or importers become aware of that
reasonably suggests that one of their marketed devices:
(i) May have caused or contributed to a death or serious injury, or
(ii) Has malfunctioned and that the device or a similar device marketed
by the manufacturer or importer would be likely to cause or
contribute to a death or serious injury if the malfunction were
to recur.
Medical personnel means an individual who:
1. Is licensed, registered, or certified by a State, territory, or other
governing body, to administer health care;
2. Has received a diploma or a degree in a professional or scientific
discipline
3. Is an employee responsible for receiving medical complaints or
adverse event reports; or
4. Is a supervisor of these persons.
Nursing home means:
1. An independent entity (i.e., not a part of a provider of services or
any other facility) or one operated by another medical entity (e.g.,
under the common ownership, licensure, or control of an entity) that
operates for the primary purpose of providing:
(i) Skilled nursing care and related services for persons who require
medical or nursing care;
(ii) Hospice care to the terminally ill; or
(iii) Services for the rehabilitation of the injured, disabled, or sick
2. A nursing home is subject to this regulation regardless of whether
it is licensed by a Federal, State, municipal, or local government or
whether it is accredited by a recognized accreditation organization.
If an adverse event meets the criteria for reporting, the nursing home
must report that event regardless of the nature or location of the
medical service provided by the nursing home.
Outpatient diagnostic facility

1. Outpatient diagnostic facility means a distinct entity that:
(i) Operates for the primary purpose of conducting medical diagnostic
tests on patients,
(ii) Does not assume ongoing responsibility for patient care, and
(iii) Provides its services for use by other medical personnel.
2. Outpatient diagnostic facilities include outpatient facilities providing
radiography, mammography, ultrasonography, electrocardiography,
magnetic resonance imaging, computerized axial tomography,
and in vitro testing. An outpatient diagnostic facility may be either
independent (i.e., not a part of a provider of services or any other
facility) or operated by another medical entity (e.g., under the common
ownership, licensure, or control of an entity). An outpatient diagnostic
facility is covered by this regulation regardless of whether it is licensed
by a Federal, State, municipal, or local government or whether it is
accredited by a recognized accreditation organization. If an adverse
event meets the criteria for reporting, the outpatient diagnostic facility
must report that event regardless of the nature or location of the
medical service provided by the outpatient diagnostic facility.
Outpatient treatment facility means a distinct entity that operates for the primary
purpose of providing nonsurgical therapeutic (medical, occupational, or physical)
care on an outpatient basis or in a home health care setting. Outpatient treatment
facilities include ambulance providers, rescue services, and home health care
groups. Examples of services provided by outpatient treatment facilities include
the following: cardiac defibrillation, chemotherapy, radiotherapy, pain control,
dialysis, speech or physical therapy, and treatment for substance abuse. An
outpatient treatment facility may be either independent (i.e., not a part of a provider
of services or any other facility) or operated by another medical entity (e.g., under
the common ownership, licensure, or control of an entity). An outpatient treatment
facility is covered by this regulation regardless of whether it is licensed by a Federal,
State, municipal, or local government or whether it is accredited by a recognized
accreditation organization. If an adverse event meets the criteria for reporting,
the outpatient treatment facility must report that event regardless of the nature or
location of the medical service provided by the outpatient treatment facility.
Patient of the facility means any individual who is being diagnosed or treated
and/or receiving medical care at or under the control or authority of the facility.
This includes employees of the facility or individuals affiliated with the facility
who, in the course of their duties, suffer a device-related death or serious injury
that has or may have been caused or contributed to by a device used at the facility.
Physician’s office means a facility that operates as the office of a physician or other
health care professional for the primary purpose of examination, evaluation, and
treatment or referral of patients. Examples of physician offices include dentist
offices, chiropractor offices, optometrist offices, nurse practitioner offices, school
nurse offices, school clinics, employee health clinics, or freestanding care units.
A physician’s office may be independent, a group practice, or part of a Health
Maintenance Organization.
Remedial action means any action other than routine maintenance or servicing of a
device where such action is necessary to prevent recurrence of a reportable event.
Serious injury means an injury or illness that:
1. Is life-threatening,
2. Results in permanent impairment of a body function or permanent
damage to a body structure, or
3. Necessitates medical or surgical intervention to preclude permanent
impairment of a body function or permanent damage to a body
structure.
Permanent means irreversible impairment or damage to a body structure or
function, excluding trivial impairment or damage.
User facility report number means the number that uniquely identifies each report
submitted by a user facility to manufacturers and to us. This number consists of
the following three parts:
1. The user facility’s 10-digit Centers for Medicare and Medicaid
Services (CMS) number (if the CMS number has fewer than 10 digits,
fill the remaining spaces with zeros);
2. The four-digit calendar year in which the report is submitted; and
3. The four-digit sequence number of the reports submitted for the
year, starting with 0001. (For example, a complete user facility report
number will appear as follows: 1234560000-2004-0001. If a user facility
has more than one CMS number, it must select one that will be used
for all of its MDR reports. If a user facility has no CMS number,
it should use all zeros in the appropriate space in its initial report
[e.g., 0000000000-2004-0001]. We will assign a number for future
use and send that number to the user facility. This number is used
in our record of the initial report, in subsequent reports, and in any
correspondence with the user facility. If a facility has multiple sites,
the primary site may submit reports for all sites and use one reporting
number for all sites if the primary site provides the name, address,
and CMS number for each respective site.)
Work day means Monday through Friday, except Federal holidays.
Human cell, tissue, or cellular or tissue-based product (HCT/P) regulated as a device

1. A device identifier —a mandatory, fixed portion of a UDI that identifies
the specific version or model of a device and the labeler of that
device; and
2. A production identifier —a conditional, variable portion of a UDI that
the device:
(iv) The date a specific device was manufactured.
Regulatory Requirement 21 CFR § 803.9 What Information from

the Reports Do We Disclose to the Public?
a. We may disclose to the public any report, including any FDA record
of a telephone report, submitted under this part. Our disclosures are
governed by Part 20 of this chapter.
b. Before we disclose a report to the public, we will delete the following:
1. Any information that constitutes trade secret or confidential
commercial or financial information under 20.61 of this chapter;
2. Any personal, medical, and similar information, including the serial
number of implanted devices, which would constitute an invasion
of personal privacy under 20.63 of this chapter. However, if a patient
requests a report, we will disclose to that patient all the information
in the report concerning that patient, as provided in 20.61 of this
chapter; and
3. Any names and other identifying information of a third party that
voluntarily submitted an adverse event report.
c. We may not disclose the identity of a device user facility that makes a
report under this part except in connection with:
1. An action brought to enforce section 301(q) of the FDCA, including
the failure or refusal to furnish material or information required by
section 519 of the FDCA;
2. A communication to a manufacturer of a device that is the subject of
a report required to be submitted by a user facility under 803.30; or
3. A disclosure to employees of the Department of Health and Human

Services, to the Department of Justice, or to the duly authorized
committees and subcommittees of the Congress.
Discussion
All reports submitted under this part are subject to public availability. Prior to any
disclosure to the public, any confidential or private information will be removed,
with a few minor exceptions, which are also defined under this subpart.
Regulatory Requirement 21 CFR § 803.10 Generally, What Are the

Reporting Requirements That Apply to Me?
a. If you are a device user facility, you must submit reports (described in
subpart C of this part), as follows:
1. Submit reports of individual adverse events no later than 10 work
days after the day that you become aware of a reportable event:
(i) Submit reports of device-related deaths to us and to the
manufacturer, if known; or
(ii) Submit reports of device-related serious injuries to the
manufacturers or, if the manufacturer is unknown, submit
reports to us.
2. Submit annual reports (described in 803.33) to us.
b. If you are an importer, you must submit reports (described in subpart D
of this part), as follows:
1. Submit reports of individual adverse events no later than 30 calendar
days after the day that you become aware of a reportable event:
(i) Submit reports of device-related deaths or serious injuries to us
and to the manufacturer; or
(ii) Submit reports of device-related malfunctions to the manufacturer.
c. If you are a manufacturer, you must submit reports (described in
subpart E of this part) to us, as follows:
1. Submit reports of individual adverse events no later than 30 calendar
days after the day that you become aware of a reportable death,
serious injury, or malfunction.
2. Submit reports of individual adverse events no later than 5 work
days after the day that you become aware of:
(i) A reportable event that requires remedial action to prevent an
unreasonable risk of substantial harm to the public health, or
(ii) A reportable event for which we made a written request.
3. Submit supplemental reports if you obtain information that you did
not submit in an initial report.
Discussion
This section briefly outlines the reporting requirements for user facilities,
importers, and manufacturers. There are similarities in the individual reporting
and differences in the periodic reporting. Time frames vary for reporting
requirements as well. Further, complete detail can be found in the subsequent
sections and in Table 5.1, “Summary table—adverse event reporting requirements.”
Regulatory Requirement 21 CFR § 803.11 What Form Should I Use

to Submit Reports of Individual Adverse Events and Where Do I
Obtain These Forms?
a. If you are a manufacturer or importer, you must submit reports
of individual adverse events to FDA in an electronic format in
accordance with 803.12(a) and 803.20, unless granted an exemption
under 803.19.
b. Importer reports submitted to device manufacturers may be in paper
format or an electronic format that includes all required data fields to
ensure that the manufacturer has all required information.
c. If you are a user facility, you must submit reports of individual
adverse events in accordance with 803.12(b) and 803.20.
d. Form FDA 3500A is available on the Internet at http://www.fda.
gov/medwatch/getforms.htm or from Division of International and
Consumer Education, Center for Devices and Radiological Health,
Food and Drug Administration, 10903 New Hampshire Ave., Bldg. 66,
Rm. 4261, Silver Spring, MD 20993-0002, by email: DICE@fda.hhs.gov,
FAX: 301-847-8149, or telephone: 800-638-2041.
Discussion
This section states the requirement for manufacturers and importers to submit
individual adverse event forms electronically to the FDA unless the Agency has
granted an exemption, allowance for importers to submit reports to manufacturers
via paper or electronic means, references user facility reporting requirements, and
provides for availability of form FDA 3500A.
Regulatory Requirement 21 CFR § 803.12 How Do I Submit Initial

and Supplemental or Follow-up Reports?
a. Manufacturers and importers must submit initial and supplemental
or follow-up reports to FDA in an electronic format that FDA can
process, review, and archive.
b. User facilities that submit their reports and additional information
to FDA electronically must use an electronic format that FDA can
process, review, and archive. User facilities that submit their reports
to FDA on paper must submit any written report or additional
information required under this part to FDA, CDRH, Medical Device

Reporting, P.O. Box 3002, Rockville, MD 20847-3002, using Form FDA
3500A. Each report must be identified (e.g., "User Facility Report" or
"Annual Report").
c. If you are confronted with a public health emergency, this can be
brought to FDA's attention by contacting FDA's Office of Crisis
Management, Emergency Operations Center by telephone, 24-hours
a day, at 301-796-8240 or toll free at 866-300-4374, followed by the
submission of an email to: emergency.operations@fda.hhs.gov.
d. You may submit a voluntary telephone report to the MedWatch
office at 800-FDA-1088. You may also obtain information regarding
voluntary reporting from the MedWatch office at 800-FDA-1088.
You may also find the voluntary Form FDA 3500 and instructions
to complete it at: http://www.fda.gov/Safety/MedWatch/HowToReport/
DownloadForms/default.htm.
Discussion
This section states manufacturers and imports are to submit initial and
supplemental reports electronically; user facilities are to submit electronically or
via written report. It also states how to contact FDA in the event of a public health
emergency, and how to submit voluntary reports via telephone.
Regulatory Requirement 21 CFR § 803.13 Do I Need to Submit

Reports in English?
Yes. You must submit all reports required by this part in English.
Discussion
All reports must be submitted to the FDA must be in the English language.
Regulatory Requirement 21 CFR § 803.15 How Will I Know If You

Require More Information About My Medical Device Report?
a. We will notify you in writing if we require additional information
and will tell you what information we need. We will require
additional information if we determine that protection of the public
health requires additional or clarifying information for medical
device reports submitted to us and in cases when the additional
information is beyond the scope of FDA reporting forms or is not
readily accessible to us.
b. In any request under this section, we will state the reason or purpose
for the information request, specify the due date for submitting the
information, and clearly identify the reported event(s) related to
our request. If we verbally request additional information, we will
confirm the request in writing.
Discussion
In the event that FDA requires additional information beyond what was submitted,
they should request that information in writing. The firm is responsible to provide
the additional information; the original MDR number should be references. In
the case where required information was not provided at the time of the original
report, it is the firm’s responsibility to follow-up with that information without
any request from the FDA per § 803.56 regarding supplemental reports.
Regulatory Requirement 21 CFR § 803.16 When I Submit a

Report, Does the Information in My Report Constitute an
Admission That the Device Caused or Contributed to the
Reportable Event?
No. A report or other information submitted by you, and our release of that report
or information, is not necessarily an admission that the device, or you or your
employees, caused or contributed to the reportable event. You do not have to admit
and may deny that the report or information submitted under this part constitutes
an admission that the device, you, or your employees caused or contributed to a
reportable event.
Discussion
Any report submitted under this part does not in any way constitute admission of
contribution to the reportable event by the person reporting. This means that the
person submitting the report does not admit guilt of committing any violation by
submitting the report.
Regulatory Requirement 21 CFR § 803.17 What Are the

Requirements for Developing, Maintaining, and Implementing
Written MDR Procedures That Apply to Me?
If you are a user facility, importer, or manufacturer, you must develop, maintain,
and implement written MDR procedures for the following:
a. Internal systems that provide for:
1. Timely and effective identification, communication, and evaluation of
events that may be subject to MDR requirements;
2. A standardized review process or procedure for determining when
an event meets the criteria for reporting under this part; and
3. Timely transmission of complete medical device reports to
manufacturers or to us, or to both if required
b. Documentation and recordkeeping requirements for:

1. Information that was evaluated to determine if an event was
reportable;
2. All medical device reports and information submitted to
manufacturers and/or us;
3. Any information that was evaluated for the purpose of preparing the
submission of annual reports; and
4. Systems that ensure access to information that facilitates timely
follow-up and inspection by us.
Discussion
User facilities, importers, and manufacturers are required to establish documented
procedures to define their internal requirements for meeting the requirements of
this part as it applies to their business. Additionally, files must be established and
maintained at the facility to reflect that the company has met the requirements of
this part. Such files must be maintained in a manner to assure they are preserved
for the required time period and are readily accessible.

Requirements for Establishing and Maintaining MDR Files or
Records That Apply to Me?
a. If you are a user facility, importer, or manufacturer, you must
establish and maintain MDR event files. You must clearly identify
all MDR event files and maintain them to facilitate timely access.
b. 1. For purposes of this part, “MDR event files” are written or
electronic files maintained by user facilities, importers, and
manufacturers. MDR event files may incorporate references to
other information (e.g., medical records, patient files, engineering
reports), in lieu of copying and maintaining duplicates in this file.
Your MDR event files must contain:
(i) Information in your possession or references to information
related to the adverse event, including all documentation of your
deliberations and decision-making processes used to determine if
a device-related death, serious injury, or malfunction was or was
not reportable under this part; and
(ii) Copies of all reports submitted under this part (whether paper
or electronic), and of all other information related to the event
that you submitted to us or other entities such as an importer,
distributor, or manufacturer; and
(iii) Copies of all electronics acknowledgements FDA sends you in
response to electronic MDR submissions.
2. If you are a user facility, importer, or manufacturer, you must permit

any authorized FDA employee, at all reasonable times, to access, to
copy, and to verify the records required by this part.
c. If you are a user facility, you must retain an MDR event file relating
to an adverse event for a period of 2 years from the date of the event.
If you are a manufacturer or importer, you must retain an MDR event
file relating to an adverse event for a period of 2 years from the date
of the event or a period of time equivalent to the expected life of the
device, whichever is greater. If the device is no longer distributed, you
still must maintain MDR event files for the time periods described in
this paragraph (c).
d. 1. If you are a device distributor, you must establish and maintain
device complaint records (files). Your records must contain
any incident information, including any written, electronic, or
oral communication, either received or generated by you, that
alleges deficiencies related to the identity (e.g., labeling), quality,
durability, reliability, safety, effectiveness, or performance of a
device. You must also maintain information about your evaluation
of the allegations, if any, in the incident record. You must clearly
identify the records as device incident records and file these
records by device name. You may maintain these records in written
or electronic format. You must back up any file maintained in
electronic format.
2. You must retain copies of the required device incident records for a
period of 2 years from the date of inclusion of the record in the file
or for a period of time equivalent to the expected life of the device,
whichever is greater. You must maintain copies of these records for
this period even if you no longer distribute the device.
3. You must maintain the device complaint files established under this
section at your principal business establishment. If you are also a
manufacturer, you may maintain the file at the same location as you
maintain your complaint file under part 820 of this chapter. You must
permit any authorized FDA employee, at all reasonable times, to
access, to copy, and to verify the records required by this part.
e. If you are a manufacturer, you may maintain MDR event files as
part of your complaint file, under part 820 of this chapter, if you
prominently identify these records as MDR reportable events. We
will not consider your submitted MDR report to comply with this
part unless you evaluate an event in accordance with the quality
system requirements described in part 820 of this chapter. You must
document and maintain in your MDR event files an explanation of
why you did not submit or could not obtain any information required
by this part, as well as the results of your evaluation of each event.
Discussion
User facilities, importers, and manufacturers are required to establish and
maintain MDR event files. Such files must contain or reference information
related to the adverse event and copies of all MDR forms. User facilities must
retain MDR event files for two years from the date of event. Manufacturers and
importers must retain MDR event files for two years from the date of event or
the expected life of the device, whichever is longer. Distributors are required to
establish and maintain complaint files, and retain device incident records for two
years or the expected life of the device, whichever is greater. Manufacturers may
maintain MDR event files with complaint files provided the MDR event files are
prominently identified and distinguishable from complaint files.
Regulatory Requirement 21 CFR § 803.19 Are There Exemptions,

Variances, or Alternative Forms of Adverse Event Reporting
Requirements?
a. We exempt the following persons from the adverse event reporting
requirements in this part:
1. A licensed practitioner who prescribes or administers devices
intended for use in humans and manufactures or imports devices
solely for use in diagnosing and treating persons with whom the
practitioner has a “physician-patient” relationship;
2. An individual who manufactures devices intended for use in humans
solely for this person’s use in research or teaching and not for sale.
This includes any person who is subject to alternative reporting
requirements under the investigational device exemption regulations
(described in part 812 of this chapter), which require reporting of all
adverse device effects; and
3. Dental laboratories or optical laboratories.
b. If you are a manufacturer, importer, or user facility, you may
request an exemption or variance from any or all of the reporting
requirements in this part, including the requirements of 803.12. You
must submit the request to us in writing at the following address:
MDR Exemption Requests, Office of Surveillance and Biometrics,
10903 New Hampshire Ave., Bldg. 66, Rm. 3217, Silver Spring, MD
20993-0002. Your request must include information necessary to
identify you and the device; a complete statement of the request for
exemption, variance, or alternative reporting; and an explanation why
your request is justified. If you are requesting an exemption from
the requirement to submit reports to FDA in electronic format under
803.12(a), your request should indicate for how long you will require
this exemption.
c. If you are a manufacturer, importer, or user facility, we may grant

in writing an exemption or variance from, or alternative to, any
or all of the reporting requirements in this part and may change
the frequency of reporting to quarterly, semiannually, annually or
other appropriate time period. We may grant these modifications in
response to your request, as described in paragraph (b) of this section,
or at our discretion. When we grant modifications to the reporting
requirements, we may impose other reporting requirements to ensure
the protection of public health.
d. We may revoke or modify in writing an exemption, variance, or
alternative reporting requirement if we determine that revocation
or modification is necessary to protect the public health.
e. If we grant your request for a reporting modification, you must
submit any reports or information required in our approval of
the modification. The conditions of the approval will replace and
supersede the regular reporting requirement specified in this part
until such time that we revoke or modify the alternative reporting
requirements in accordance with paragraph (d) of this section or until
the date specified in our response granting your variance, at which
time the provisions of this part will again apply.
Discussion
The following persons are exempt from reporting requirements under this part:
1. An individual who is a licensed practitioner who prescribes or
administers devices for human use with a specific “physician–
patient” relationship
2. An individual who manufactures devices intended for use in humans
solely for use in research or teaching and not for sale
3. Dental or optical laboratories
Manufacturers, importers, or user facilities may submit a written request for an
exemption, a variance, or alternatives from some or all of these requirements.
FDA may grant such request in writing; they may also revoke such exemptions,
variances, or alternative requirements.
Subpart B—Generally Applicable Requirements for Individual

Adverse Event Reports
Regulatory Requirement 21 CFR § 803.20 How Do I Complete and

Submit an Individual Adverse Event Report?
a. What form must I complete and submit?
1. If you are a health professional or consumer or other entity, you
may submit voluntary reports to FDA regarding devices or other
FDA-regulated products using the Form FDA 3500.
2. To submit a mandatory report in written form, a user facility must

use Form FDA 3500A.
3. An electronic submission of a mandatory report from a user facility,
importer, or manufacturer must contain the information from the
applicable blocks of Form FDA 3500A. All electronic submissions
must include information about the patient, the event, the device,
and the "initial reporter." An electronic submission from a user facility
or importer must include the information from block F. An electronic
submission from a manufacturer must include the information
from blocks G and H. If you are a manufacturer and you receive a
report from a user facility or importer, you must incorporate that
information in your electronic submission and include any corrected
or missing information.
b. To whom must I submit reports and when?
1. If you are a user facility, you must submit MDR reports to:
(i) The manufacturer and to us no later than 10 work days after
the day that you become aware of information that reasonably
suggests that a device has or may have caused or contributed to
a death or
(ii) The manufacturer no later than 10 work days after the day that
you become aware of information that reasonably suggests that a
device has or may have caused or contributed to a serious injury. If
the manufacturer is not known, you must submit this report to us.
2. If you are an importer, you must submit MDR reports to:
(i) The manufacturer and to us, no later than 30 calendar days after
the day that you become aware of information that reasonably
a death or serious injury or
(ii) The manufacturer, no later than 30 calendar days after receiving
information that a device you market has malfunctioned and that
this device or a similar device that you market would be likely to
cause or contribute to a death or serious injury if the malfunction
were to recur.
3. If you are a manufacturer, you must submit MDR reports to us:
(i) No later than 30 calendar days after the day that you become
aware of information that reasonably suggests that a device may
have caused or contributed to a death or serious injury or
(ii) No later than 30 calendar days after the day that you become
aware of information that reasonably suggests a device has
malfunctioned and that this device or a similar device that you
market would be likely to cause or contribute to a death or
serious injury if the malfunction were to recur or
(iii) Within 5 work days if required by § 803.53.
c. What kind of information reasonably suggests that a reportable event

has occurred?
1. Any information, including professional, scientific, or medical facts,
observations, or opinions, may reasonably suggest that a device has
caused or may have caused or contributed to an MDR reportable
event. An MDR reportable event is a death, a serious injury, or, if you
are a manufacturer or importer, a malfunction that would be likely
to cause or contribute to a death or serious injury if the malfunction
were to recur.
2. If you are a user facility, importer, or manufacturer, you do not have
to report an adverse event if you have information that would lead
a person who is qualified to make a medical judgment reasonably
to conclude that a device did not cause or contribute to a death or
serious injury, or that a malfunction would not be likely to cause
or contribute to a death or serious injury if it were to recur. Persons
qualified to make a medical judgment include physicians, nurses, risk
managers, and biomedical engineers. You must keep in your MDR
event files (described in § 803.18) the information that the qualified
person used to determine whether or not a device-related event
was reportable.
Discussion
Information that reasonably suggests that the device has or may have caused or
contributed to an MDR reportable event includes any information (for example,
professional, scientific, or medical facts and observations or opinions) that would
reasonably suggest that a device has caused or may have caused or contributed to
a reportable event. MDRs are reported by medical professionals and consumers
on form FDA 3500, and by user facilities and importers on form FDA 3500A. These
mandatory reporting forms have sections that must be completed by all reporters
and other sections that are required to be completed only by the user facility,
importer, or manufacturer.
The reporting requirements for user facilities, importers, and manufacturers
are slightly different, are slightly different, as summarized in Table 5.1. These
reports must be submitted within the prescribed time frame either in writing or
by an electronic equivalent approved by FDA in accordance with § 803.14:
• User facilities are required to submit MDR reports to the medical
device manufacturer and to submit MDR reports, as well as an annual
report, to FDA. Annual reports are submitted January 1 of each year
by the user facility. These reports contain information such as Health
Care Financing Administration (HCFA) provider number, user facility
contact person, and specific information regarding all reportable events
for that facility.
• Importers are required to submit death and serious injury reports to
FDA, and malfunction reports to the manufacturer.
Table 5.1 Summary table—adverse event reporting requirements.
Reporter What to report To whom When
Manufacturer/ importer 30-day reports of deaths, serious FDA Within 30 calendar

injuries, and malfunctions days from becoming
aware of an event
Manufacturer Five-day reports on events that FDA Within five work
require remedial action to prevent days from becoming
an unreasonable risk of substantial aware of an event
harm to the public health, and
other types of events designated
by FDA
User facility Death FDA and Within 10 work days
manufacturer
User facility Serious injury Manufacturer. Within 10 work days
FDA only if
manufacturer
unknown
User facility Annual reports of death and FDA January 1
serious injury
• Manufacturers are required to submit MDR reports, baseline

reports, and supplemental reports on the forms. Baseline reports are
submitted when a device model is first reported under § 803.50. They
contain information regarding the registration, MDR contact person,
product, and market. These reports must be updated annually on the
anniversary of the initial submission. Supplemental reports are used
to update information on an existing MDR that was not known at the
time of the initial submission. Foreign manufacturers must designate
a US agent to be responsible for reporting in accordance with § 807.40.
Regulatory Requirement 21 CFR § 803.21 Where Can I Find the

Reporting Codes for Adverse Events That I Use with Medical
Device Reports?
a. The MedWatch Medical Device Reporting Code Instruction Manual
contains adverse event codes for use with Form FDA 3500A. You may
obtain the coding manual from FDA's Web site at: http://www.fda.gov/
MedicalDevices/Safety/ReportaProblem/FormsandInstructions/default.htm;
and from the Division of Small Manufacturers, International and
Consumer Assistance, Center for Devices and Radiological Health,
10903 New Hampshire Ave., Bldg. 66, Rm. 4621, Silver Spring, MD
20993-0002, FAX: 301-847-8149, or email to DSMICA@fda.hhs.gov.
b. We may sometimes use additional coding of information on the

reporting forms or modify the existing codes. If we do make
modifications, we will ensure that we make the new coding
information available to all reporters.
Discussion
FDA has developed a MedWatch mandatory reporting form coding manual.
Each MDR has a unique identifier number for tracking and trending purposes.
MedWatch forms should be reconciled to the associated MDR so that only one
MDR is filed per each event. This form codes manual is available from the Division
of Small Manufacturers, International and Consumer Assistance (DSMICA),
CDRH. (See address above.)

Circumstances in Which I Am Not Required to File a Report?
a. If you become aware of information from multiple sources regarding
the same patient and same reportable event, you may submit one
medical device report.
b. You are not required to submit a medical device report if:
1. You are a user facility, importer, or manufacturer, and you determine
that the information received is erroneous in that a device-related
adverse event did not occur. You must retain documentation of these
reports in your MDR files for the time periods specified in 803.18.
2. You are a manufacturer or importer and you did not manufacture or
import the device about which you have adverse event information.
When you receive reportable event information in error, you must
forward this information to us with a cover letter explaining that you
did not manufacture or import the device in question.
Discussion
There are only two cases where the mandatory reporting would not be required:
1. If the reporter determines that the information they have received is
erroneous (in this case, it must be justified, documented, and filed in
the MDR file).
2. If the reporter determines that the device was manufactured or
imported by a different manufacturer or importer (in this case, the
information should be forwarded to the FDA).
Regulatory Requirement 21 CFR § 803.23 Where Can I Find

Information on How to Prepare and Submit an MDR in
Electronic Format?
a. You may obtain information on how to prepare and submit reports
in an electronic format that FDA can process, review, and archive at:
http://www.fda.gov/ForIndustry/FDAeSubmitter/ucm107903.htm.
b. We may sometimes update information on how to prepare and submit
reports electronically. If we do make modifications, we will ensure
that we alert reporters by updating the eMDR Web page.
Discussion
FDA has provided instructions for preparation and submission of reports
electronically.
Subpart C—User Facility Reporting Requirements
Regulatory Requirement 21 CFR § 803.30 If I Am a User Facility,

What Reporting Requirements Apply to Me?
a. You must submit reports to the manufacturer or to us, or both, as
specified in paragraphs (a)(1) and (a)(2) of this section as follows:
1. Reports of death. You must submit a report to us as soon as practicable
but no more than 10 work days after the day that you become
aware of information, from any source, that reasonably suggests
that a device has or may have caused or contributed to the death
of a patient of your facility. You must also submit the report to the
device manufacturer, if known. You must submit the information
required by 803.32. Reports sent to the Agency must be submitted in
accordance with the requirements of 803.12(b).
2. Reports of serious injury. You must submit a report to the manufacturer
of the device no later than 10 work days after the day that you
become aware of information, from any source, that reasonably
a serious injury to a patient of your facility. If the manufacturer
is not known, you must submit the report to us. You must report
information required by 803.32. Reports sent to the Agency must be
submitted in accordance with the requirements
of 803.12(b).
b. What information does FDA consider “reasonably known” to me? You
must submit all information required in this subpart C that is
reasonably known to you. This information includes information
found in documents that you possess and any information that
becomes available as a result of reasonable follow-up within your

facility. You are not required to evaluate or investigate the event by
obtaining or evaluating information that you do not reasonably know.
Discussion
User facilities (for example, hospitals, clinics, laboratories) must report to FDA
and to the manufacturer (if known) when a device has or may have caused or
contributed to the death, serious illness, or serious injury of a patient of the
facility. They are required to submit all information known on MedWatch form
3500A within 10 work days of becoming aware of the information.

What Information Must I Submit in My Individual Adverse
Event Reports?
You must include the following information in your report, if reasonably known
to you, as described in 803.30(b). These types of information correspond generally
to the elements of FDA Form 3500A:
a. Patient information (Form 3500A, Block A). You must submit the
following:
1. Patient name or other identifier;
2. Patient age at the time of event, or date of birth;
3. Patient gender; and
4. Patient weight.
b. Adverse event or product problem (Form 3500A, Block B). You must
submit the following:
1. Identification of adverse event or product problem;
2. Outcomes attributed to the adverse event (e.g., death or serious
injury). An outcome is considered a serious injury if it is:
(i) Life-threatening injury or illness;
(ii) Disability resulting in permanent impairment of a body function
or permanent damage to a body structure; or
(iii) Injury or illness that requires intervention to prevent permanent
impairment of a body structure or function;
3. Date of event;
4. Date of this report;
5. Description of event or problem, including a discussion of how the
device was involved, nature of the problem, patient follow-up or
required treatment, and any environmental conditions that may have
influenced the event;
6. Description of relevant tests, including dates and laboratory data; and
7. Description of other relevant history, including preexisting medical

conditions.
c. Device information (Form 3500A, Block D). You must submit the
following:
1. Brand name;
2. Product Code, if known, and Common Device Name;
3. Manufacturer name, city, and state;
4. Model number, catalog number, serial number, lot number, or other
identifying number; expiration date; and unique device identifier
(UDI) that appears on the device label or on the device package;
5. Operator of the device (health professional, lay user/patient, other);
6. Date of device implantation (month, day, year), if applicable;
7. Date of device explantation (month, day, year), if applicable;
8. Whether the device is a single-use device that was reprocessed and
reused on a patient (Yes, No?);
9. If the device is a single-use device that was reprocessed and reused
on a patient (yes to paragraph (c)(8) of this section), the name and
address of the reprocessor;
10. Whether the device was available for evaluation and whether the
device was returned to the manufacturer; if so, the date it was
returned to the manufacturer; and
11. Concomitant medical products and therapy dates. (Do not report
products that were used to treat the event.)
d. Initial reporter information (Form 3500A, Block E). You must submit
the following:
1. Name, address, and telephone number of the reporter who initially
provided information to you, or to the manufacturer or distributor;
2. Whether the initial reporter is a health professional
3. Occupation; and
4. Whether the initial reporter also sent a copy of the report to us, if
known.
e. User facility information (Form 3500A, Block F). You must submit the
following:
1. An indication that this is a user facility report (by marking the user
facility box on the form);
2. Your user facility number;
3. Your address;
4. Your contact person;
5. Your contact person’s telephone number;
6. Date that you became aware of the event (month, day, year);
7. Type of report (initial or follow-up); if it is a follow-up, you must
include the report number of the initial report;
8. Date of your report (month, day, year);
9. Approximate age of device;
10. Event problem codes—patient code and device code (refer to the
“MedWatch Medical Device Reporting Code Instructions”);
11. Whether a report was sent to us and the date it was sent (month, day,
year);
12. Location where the event occurred;
13. Whether the report was sent to the manufacturer and the date it was
sent (month, day, year); and
14. Manufacturer name and address, if available.
Discussion
User facilities are required to complete the mandatory MedWatch form 3500A as
defined previously. All known information must be completed and submitted to
FDA and the manufacturer (if known) on the form within the prescribed 10-day
time frame. A copy of the form should be retained at the facility.

What Must I Include When I Submit an Annual Report?
a. You must submit to us an annual report on Form FDA 3419. You must
submit an annual report by January 1, of each year. You may obtain
this form from the following sources:
1. On the Internet at: http://www.fda.gov/downloads/AboutFDA/
ReportsManualsForms/Forms/UCM080796.pdf or
2. Division of International and Consumer Education, Center for
Devices and Radiological Health, Food and Drug Administration,
10903 New Hampshire Ave., Bldg. 66, Rm. 4621, Silver Spring,
MD 20993-0002, by email: DICE@fda.hhs.gov, FAX: 301-847-8149, or
telephone: 800-638-2041.
b. You must clearly identify your annual report as such. You must
submit your annual report to FDA, CDRH, Medical Device Reporting,
P.O. Box 3002, Rockville, MD 20847-3002. Your annual report must
include:
1. Your CMS provider number used for medical device reports, or
the number assigned by us for reporting purposes in accordance
with 803.3;
2. Reporting year;
3. Your name and complete address;

4. Total number of reports attached or summarized;
5. Date of the annual report and report numbers identifying the range
of medical device reports that you submitted during the report
period (e.g., 1234567890-20011-0001 through 1000);
6. Name, position title, and complete address of the individual
designated as your contact person responsible for reporting to us and
whether that person is a new contact for you; and
7. Information for each reportable event that occurred during the
annual reporting period including:
(i) Report number;
(ii) Name and address of the device manufacturer;
(iii) Device brand name and common name;
(iv) Product model, catalog, serial, and lot number and unique device
identifier (UDI) that appears on the device label or on the device
package;
(v) A brief description of the event reported to the manufacturer
and/or us; and
(vi) Where the report was submitted, i.e., to the manufacturer,
importer, or us.
c. In lieu of submitting the information in paragraph (b)(7) of this
section, you may submit a copy of each medical device report that you
submitted to the manufacturers and/or to us during the reporting
period.
d. If you did not submit any medical device reports to manufacturers
or us during the time period, you do not need to submit an annual
report.
Discussion
FDA requires user facilities to provide an annual summary report of all MDRs by
January 1 of each year for the previous year MDRs. There is a designated form FDA
3419 that must be completed, as described previously in § 803.33, and submitted to
the FDA unless there were no MDRs during that previous year.
Subpart D—Importer Reporting Requirements
Regulatory Requirement 21 CFR § 803.40 If I Am an Importer,

a. Reports of deaths or serious injuries. You must submit a report to us,
and a copy of this report to the manufacturer, as soon as practicable
but no later than 30 calendar days after the day that you receive or
otherwise become aware of information from any source, including

user facilities, individuals, or medical or scientific literature, whether
published or unpublished, that reasonably suggests that one of your
marketed devices may have caused or contributed to a death or
serious injury. You must submit the information required by 803.42.
Reports sent to the Agency must be submitted in accordance with the
requirements of 803.12(a).
b. Reports of malfunctions. You must submit a report to the manufacturer
as soon as practicable but no later than 30 calendar days after the
day that you receive or otherwise become aware of information
from any source, including user facilities, individuals, or through
your own research, testing, evaluation, servicing, or maintenance
of one of your devices, that reasonably suggests that one of your
devices has malfunctioned and that this device or a similar device
that you market would be likely to cause or contribute to a death or
serious injury if the malfunction were to recur. You must submit the
information required by 803.42. Reports to manufacturers may be
made in accordance with 803.11(b).
Discussion
Importers are required to report, to FDA and to the manufacturer, when a device
has or may have caused or contributed to a death, serious illness, or serious injury.
They are required to submit a report to the manufacturer when they receive
information that the device has malfunctioned and that this device or a similar
device they market would be likely to cause or contribute to a death or serious
injury if the injury were to recur. They are required to submit all information
known within 30 calendar days of becoming aware of the information.
Regulatory Requirement 21 CFR § 803.42 If I Am an Importer,

Event Reports?
You must include the following information in your report, if the information
is known or should be known to you, as described in § 803.40. These types of
information correspond generally to the format of FDA Form 3500A:
a. Patient information (Form 3500A, Block A). You must submit the
following:
4. Patient weight.

3. Date of event;
5. Description of the event or problem, including a discussion of how
the device was involved, nature of the problem, patient follow-up or
required treatment, and any environmental conditions that may have
influenced the event;
6. Description of relevant tests, including dates and laboratory data; and
7. Description of other relevant patient history, including preexisting
medical conditions.
c. Device information (Form 3500A, Block D). You must submit the
following:
1. Brand name;
6. Date of device implantation (month, day, year);
7. Date of device explantation (month, day, year);
10. Whether the device was available for evaluation, and whether the
device was returned to the manufacturer, and if so, the date it was
the following:
1. Name, address, and telephone number of the reporter who initially
provided information to the manufacturer, user facility,
or distributor;
2. Whether the initial reporter is a health professional;
3. Occupation; and
4. Whether the initial reporter also sent a copy of the report to us,
if known.
e. Importer information (Form 3500A, Block F). You must submit the
following:
1. An indication that this is an importer report (by marking the
importer box on the form);
2. Your importer report number;
3. Your address;
4. Your contact person;
5. Your contact person’s telephone number;
6. Date that you became aware of the event (month, day, year);
7. Type of report (initial or follow-up). If it is a follow-up report, you
must include the report number of your initial report;
8. Date of your report (month, day, year);
9. Approximate age of device;
10. Event problem codes—patient code and device code (refer to FDA
MedWatch Medical Device Reporting Code Instructions);
11. Whether a report was sent to us and the date it was sent (month,
day, year);
12. Location where event occurred;
13. Whether a report was sent to the manufacturer and the date it was
sent (month, day, year); and
14. Manufacturer name and address, if available.
Discussion
Importers are required to complete the mandatory MedWatch form 3500A as
defined in § 803.32. All known information must be completed and submitted to
FDA and the manufacturer (if known), on the form within the prescribed 30-day
time frame. A copy of the form should be retained at the facility.
Subpart E—Manufacturer Reporting Requirements
Regulatory Requirement 21 CFR § 803.50 If I Am a Manufacturer,

a. If you are a manufacturer, you must report to us the information
required by 803.52 in accordance with the requirements of 803.12(a),
no later than 30 calendar days after the day that you receive or
otherwise become aware of information, from any source, that
reasonably suggests that a device that you market:
1. May have caused or contributed to a death or serious injury or
2. Has malfunctioned and this device or a similar device that you
market would be likely to cause or contribute to a death or serious
injury, if the malfunction were to recur.
b. What information does FDA consider “reasonably known” to me?
1. You must submit all information required in this subpart E that is
reasonably known to you. We consider the following information to
be reasonably known to you:
(i) Any information that you can obtain by contacting a user facility,
importer, or other initial reporter;
(ii) Any information in your possession; or
(iii) Any information that you can obtain by analysis, testing, or other
evaluation of the device.
2. You are responsible for obtaining and submitting to us information
that is incomplete or missing from reports submitted by user
facilities, importers, and other initial reporters.
3. You are also responsible for conducting an investigation of each
event and evaluating the cause of the event. If you cannot submit
complete information on a report, you must provide a statement
explaining why this information was incomplete and the steps you
took to obtain the information. If you later obtain any required
information that was not available at the time you filed your initial
report, you must submit this information in a supplemental report
under 803.56 in accordance with the requirements of 803.12(a).
Discussion
Medical device manufacturers are required to report within 30 calendar days any
event that suggests that their device was involved in an incident that has or may have
contributed to a death, serious illness, or serious injury. Additionally, manufacturers
are required to report any confirmed device malfunction that, if it were to recur,
would likely have this result. In any case, the manufacturer must provide all
available information, including the results of a failure investigation and root cause
analysis. Where possible, all information should be retrieved and collected from all
available sources prior to the initial report of the event. Supplemental reports may
also be forwarded to FDA after the initial report per § 803.56.

Event Reports?
You must include the following information in your reports, if known or reasonably
known to you, as described in 803.50(b). These types of information correspond
generally to the format of FDA Form 3500A:
a. Patient information (Form 3500A, Block A). You must submit
the following:
4. Patient weight.
3. Date of event;
5. Description of the event or problem, including a discussion of how
the device was involved, nature of the problem, patient follow-up
or required treatment, and any environmental conditions that may
have influenced the event;
6. Description of relevant tests, including dates and laboratory
data; and
7. Other relevant patient history including preexisting medical
conditions.
c. Device information (Form 3500A, Block D). You must submit
the following:
1. Brand name;

6. Date of device implantation (month, day, year);
7. Date of device explantation (month, day, year);
10. Whether the device was available for evaluation, and whether the
device was returned to the manufacturer, and if so, the date it was
the following:
1. Name, address, and phone number of the reporter who initially
provided information to you, or to the user facility or importer;
2. Whether the initial reporter is a health professional;
3. Occupation; and
4. Whether the initial reporter also sent a copy of the report to us,
if known.
e. Reporting information for all manufacturers (Form 3500A, Block G).
You must submit the following:
1. Your reporting office’s contact name and address and device
manufacturing site;
2. Your telephone number;
3. Your report sources;
4. Date received by you (month, day, year);
5. PMA/510k Number and whether or not the product is a
combination product;
6. Type of report being submitted (e.g., 5-day, initial, follow-up); and
7. Your report number.
f. Device manufacturer information (Form 3500A, Block H). You must
1 Type of reportable event (death, serious injury, malfunction, etc.);
2. Type of follow-up report, if applicable (e.g., correction, response to

FDA request, etc.);
3. If the device was returned to you and evaluated by you, you
must include a summary of the evaluation. If you did not perform
an evaluation, you must explain why you did not perform an
evaluation;
4. Device manufacture date (month, day, year);
5. Whether the device was labeled for single use;
6. Evaluation codes (including event codes, method of evaluation,
result, and conclusion codes) (refer to FDA MedWatch Medical
Device Reporting Code Instructions);
7. Whether remedial action was taken and the type of action;
8. Whether the use of the device was initial, reuse, or unknown;
9. Whether remedial action was reported as a removal or correction
under section 519(f) of the Federal Food, Drug, and Cosmetic Act,
and if it was, provide the correction/removal report number; and
10. Your additional narrative; and/or
11. Corrected data, including:
(i) Any information missing on the user facility report or importer
report, including any event codes that were not reported, or
information corrected on these forms after your verification;
(ii) For each event code provided by the user facility under 803.32(e)
(10) or the importer under 803.42(e)(10), you must include a
statement of whether the type of the event represented by the
code is addressed in the device labeling; and
(iii) If your report omits any required information, you must explain
why this information was not provided and the steps taken to
obtain this information.
Discussion
Manufacturers are required to provide the information as defined in § 803.52.
All known information must be completed and submitted to FDA within the
30-day allowed time frame. The exception to this is where either the information
necessitates remedial action to prevent an unreasonable risk of substantial harm
to the public health or in a case where the FDA has made a written request for the
submission of a five-day report.

in Which Circumstances Must I Submit a 5-Day Report?
You must submit a 5-day report to us with the information required by 803.52 in
accordance with the requirements of 803.12(a) no later than 5 work days after the
day that you become aware that:
a. An MDR reportable event necessitates remedial action to prevent an
unreasonable risk of substantial harm to the public health. You may
become aware of the need for remedial action from any information,
including any trend analysis; or
b. We have made a written request for the submission of a 5-day report.
If you receive such a written request from us, you must submit,
without further requests, a 5-day report for all subsequent events
of the same nature that involve substantially similar devices for the
time period specified in the written request. We may extend the time
period stated in the original written request if we determine it is in
the interest of the public health.
Discussion
Manufacturers are required to submit a five-day report when the information
necessitates remedial action to prevent an unreasonable risk of substantial harm
to the public health or in a case where the FDA has made a written request for the
submission of a five-day report.

in What Circumstances Must I Submit a Supplemental or Follow-up
Report and What Are the Requirements for Such Reports?
If you are a manufacturer, when you obtain information required under this part
that you did not provide because it was not known or was not available when you
submitted the initial report, you must submit the supplemental information to us
within 30 calendar days of the day that you receive this information. You must
submit the supplemental or follow-up report in accordance with the requirements
of 803.12(a). On a supplemental or follow-up report, you must:
a. Indicate that the report being submitted is a supplemental or
follow-up report;
b. Submit the appropriate identification numbers of the report that
you are updating with the supplemental information (e.g., your
original manufacturer report number and the user facility or importer
report number of any report on which your report was based), if
applicable; and
c. Include only the new, changed, or corrected information.
Discussion
Any information that was not provided in the original MDR must be submitted
to the FDA with reference to the original MDR number within 30 calendar
days of the manufacturer becoming aware of the information. In order to be
clear and efficient, it is important to provide only new or changed information,
with reference to the original report number, and clearly indicate the report
as supplemental.
Regulatory Requirement 21 CFR § 803.58 (Stayed) Foreign

Manufacturers
a. Every foreign manufacturer whose devices are distributed in
the United States shall designate a US agent to be responsible
for reporting in accordance with 807.40 of this chapter. The US
designated agent accepts responsibility for the duties that such
designation entails. Upon the effective date of this regulation, foreign
manufacturers shall inform FDA, by letter, of the name and address
of the US agent designated under this section and 807.40 of this
chapter, and shall update this information as necessary. Such updated
information shall be submitted to FDA, within 5 days of a change in
the designated agent information.
b. US-designated agents of foreign manufacturers are required to:
1. Report to FDA in accordance with 803.50, 803.52, 803.53, and 803.56;
2. Conduct, or obtain from the foreign manufacturer the necessary
information regarding, the investigation and evaluation of the event
to comport with the requirements of 803.50;
3. Forward MDR complaints to the foreign manufacturer and maintain
documentation of this requirement;
4. Maintain complaint files in accordance with 803.18; and
5. Register, list, and submit premarket notifications in accordance with
part 807 of this chapter.
Discussion
FDA began to receive comments regarding the regulation following publication
of the December 11, 1995, final rule on MDR for manufacturers and user facilities.
The FDA staff subsequently met with industry representatives to discuss their
concerns about the new regulation. Following these discussions, FDA decided to
stay this regulation.102 Therefore:
1. The requirement that foreign manufacturers have a US-designated
agent is stayed.
2. A foreign manufacturer is fully subject to the MDR requirements.
21 CFR 806 CORRECTIONS AND REMOVALS

Pursuant to the Safe Medical Devices Act of 1990, device manufacturers and
importers are required to report to FDA any correction or removal of a device
undertaken to reduce a risk to health posed by the device or to remedy a violation
of the FDCA caused by the device that may present a risk to health.103 Reports
must be submitted to FDA within 10 working days of initiating the correction
or removal.104 If there is no “risk to health,” a report is not required, but records
must be maintained that document the correction and include a justification for
not reporting the correction or removal to FDA.105 FDA regulations define “risk
to health” as “(1) a reasonable probability that use of, or exposure to, the product
will cause serious adverse health consequences or death; or (2) that use of, or
exposure to, the product may cause temporary or medically reversible adverse
health consequences, or an outcome where the probability of serious adverse
health consequences is remote.”106
Regulatory Requirement 21 CFR § 806.1 Scope

a. This part implements the provisions of section 519(g) of the
Federal Food, Drug, and Cosmetic Act (the act) requiring device
manufacturers and importers to report promptly to the Food and
Drug Administration (FDA) certain actions concerning device
corrections and removals, and to maintain records of all corrections
and removals regardless of whether such corrections and removals
are required to be reported to FDA.
b. The following actions are exempt from the reporting requirements of
this part:
1. Actions taken by device manufacturers or importers to improve the
performance or quality of a device but that do not reduce a risk to
health posed by the device or remedy a violation of the act caused by
the device.
2. Market withdrawals as defined in 806.2(h).
3. Routine servicing as defined in 806.2(k).
4. Stock recoveries as defined in 806.2(l).
Discussion
Under this part, device manufacturers and importers must report certain
correction and removal activities to the FDA and retain records of corrections and
removals regardless of whether or not the activity met the threshold for reporting
to the FDA.

FDA has set forth the following definitions applicable to corrections and removals:
Act means the Federal Food, Drug, and Cosmetic Act [FDCA].
Agency or FDA means the Food and Drug Administration.
Consignee means any person or firm that has received, purchased, or used a device
subject to correction or removal.
Correction means the repair, modification, adjustment, relabeling, destruction, or
inspection (including patient monitoring) of a device without its physical removal
from its point of use to some other location.
Correction or removal report number means the number that uniquely identifies each
report submitted.
Importer means, for the purposes of this part, any person who imports a device
into the United States.
Manufacturer means any person who manufactures, prepares, propagates,
compounds, assembles, or processes a device by chemical, physical, biological, or
other procedure. The term includes any person who:
1. Repackages or otherwise changes the container, wrapper, or labeling
of a device in furtherance of the distribution of the device from the
original place of manufacture to the person who makes final delivery
or sale to the ultimate user or consumer;
2. Initiates specifications for devices that are manufactured by a
second party for subsequent distribution by the person initiating the
specifications; or
3. Manufactures components or accessories which are devices that are
ready to be used and are intended to be commercially distributed and
intended to be used as is, or are processed by a licensed practitioner
or other qualified person to meet the needs of a particular patient.
Market withdrawal means a correction or removal of a distributed device that
involves a minor violation of the act that would not be subject to legal action by
FDA or that involves no violation of the act, e.g., normal stock rotation practices.
Removal means the physical removal of a device from its point of use to some
other location for repair, modification, adjustment, relabeling, destruction, or
inspection.
Risk to health means
1. A reasonable probability that use of, or exposure to, the product will
cause serious adverse health consequences or death; or
2. That use of, or exposure to, the product may cause temporary or
medically reversible adverse health consequences, or an outcome where
the probability of serious adverse health consequences is remote.
Routine servicing means any regularly scheduled maintenance of a device,
including the replacement of parts at the end of their normal life expectancy,
e.g., calibration, replacement of batteries, and responses to normal wear and tear.
Repairs of an unexpected nature, replacement of parts earlier than their normal life
expectancy, or identical repairs or replacements of multiple units of a device are not
routine servicing.
Stock recovery means the correction or removal of a device that has not been
marketed or that has not left the direct control of the manufacturer, i.e., the device
is located on the premises owned, or under the control of, the manufacturer, and
no portion of the lot, model, code, or other relevant unit involved in the corrective
or removal action has been released for sale or use.
this chapter. A UDI is composed of:
the specific version or model of a device and the labeler of that device;
and
the device:
Subpart B—Reports and Records
Regulatory Requirement 21 CFR § 806.10 Reports of Corrections

and Removals
a. Each device manufacturer or importer shall submit a written report
to FDA of any correction or removal of a device initiated by such
manufacturer or importer if the correction or removal was initiated:
1. To reduce a risk to health posed by the device; or
2. To remedy a violation of the act caused by the device which may
present a risk to health unless the information has already been
provided as set forth in paragraph (f) of this section or the corrective
or removal action is exempt from the reporting requirements

under 806.1(b).
b. The manufacturer or importer shall submit any report required by
paragraph (a) of this section within 10 working days of initiating such
correction or removal.
c. The manufacturer or importer shall include the following information
in the report:
1. The seven-digit registration number of the entity responsible
for submission of the report of corrective or removal action (if
applicable), the month, day, and year that the report is made,
and a sequence number (i.e., 001 for the first report, 002 for the
second report, 003 etc.), and the report type designation "C" or "R."
For example, the complete number for the first correction report
submitted on June 1, 1997, will appear as follows for a firm with the
registration number 1234567: 1234567-6/1/97-001-C. The second
correction report number submitted by the same firm on July 1, 1997,
would be 1234567-7/1/97-002-C etc. For removals, the number will
appear as follows: 1234567-6/1/97-001-R and 1234567-7/1/97-002-R,
etc. Firms that do not have a seven-digit registration number may use
seven zeros followed by the month, date, year, and sequence number
(i.e., 0000000-6/1/97-001-C for corrections and 0000000-7/1/97-001-R
for removals). Reports received without a seven digit registration
number will be assigned a seven digit central file number by the
district office reviewing the reports.
2. The name, address, and telephone number of the manufacturer or
importer, and the name, title, address, and telephone number of the
manufacturer or importer representative responsible for conducting
the device correction or removal.
3. The brand name and the common name, classification name, or usual
name of the device and the intended use of the device.
4. Marketing status of the device, i.e., any applicable premarket
notification number, premarket approval number, or indication that
the device is a preamendments device, and the device listing number.
A manufacturer or importer that does not have an FDA establishment
registration number shall indicate in the report whether it has ever
registered with FDA.
5. The unique device identifier (UDI) that appears on the device
label or on the device package, or the device identifier, universal
product code (UPC), model, catalog, or code number of the device
and the manufacturing lot or serial number of the device or other
identification number.
6. The manufacturer's name, address, telephone number, and contact
person if different from that of the person submitting the report.
7. A description of the event(s) giving rise to the information reported

and the corrective or removal actions that have been, and are
expected to be taken.
8. Any illness or injuries that have occurred with use of the device. If
applicable, include the medical device report numbers.
9. The total number of devices manufactured or distributed subject to
the correction or removal and the number in the same batch, lot, or
equivalent unit of production subject to the correction or removal.
10. The date of manufacture or distribution and the device's expiration
date or expected life.
11. The names, addresses, and telephone numbers of all domestic and
foreign consignees of the device and the dates and number of devices
distributed to each such consignee.
12. A copy of all communications regarding the correction or removal
and the names and addresses of all recipients of the communications
not provided in accordance with paragraph (c)(11) of this section.
13. If any required information is not immediately available, a statement
as to why it is not available and when it will be submitted.
d. If, after submitting a report under this part, a manufacturer or
importer determines that the same correction or removal should
be extended to additional lots or batches of the same device, the
manufacturer or importer shall within 10 working days of initiating
the extension of the correction or removal, amend the report by
submitting an amendment citing the original report number assigned
according to paragraph (c)(1) of this section, all of the information
required by paragraph (c)(2), and any information required by
paragraphs (c)(3) through (c)(12) of this section that is different from
the information submitted in the original report. The manufacturer
or importer shall also provide a statement in accordance with
paragraph (c)(13) of this section for any required information that
is not readily available.
e. A report submitted by a manufacturer or importer under this section
(and any release by FDA of that report or information) does not
necessarily reflect a conclusion by the manufacturer, importer, or FDA
that the report or information constitutes an admission that the device
caused or contributed to a death or serious injury. A manufacturer
or importer need not admit, and may deny, that the report or
information submitted under this section constitutes an admission
that the device caused or contributed to a death or serious injury.
f. No report of correction or removal is required under this part,
if a report of the correction or removal is required and has been
submitted under parts 803 or 1004 of this chapter.
Discussion
Manufacturers and importers are required report to FDA within ten working days
of initiating a correction or removal to reduce a risk to health or resolve a violation
of the FDCA that may present a risk to health. Part 806.10 provides minimum
data requirements when reporting a correction or removal. Submission of a report
does not reflect an admission the device caused or contributed to a death or
serious injury.
Regulatory Requirement 21 CFR § 806.20 Records of Corrections

and Removals Not Required to be Reported
a. Each device manufacturer or importer who initiates a correction or
removal of a device that is not required to be reported to FDA under
806.10 shall keep a record of such correction or removal.
b. Records of corrections and removals not required to be reported
to FDA under 806.10 shall contain the following information:
1. The brand name, common or usual name, classification, name
and product code if known, and the intended use of the device.
2. The unique device identifier (UDI) of the device, or the device
identifier, universal product code (UPC), model, catalog, or code
number of the device, and the manufacturing lot or serial number
of the device or other identification number.
3. A description of the event(s) giving rise to the information reported
and the corrective or removal action that has been, and is expected
to be taken.
4. Justification for not reporting the correction or removal action to
FDA, which shall contain conclusions and any follow-ups, and be
reviewed and evaluated by a designated person.
5. A copy of all communications regarding the correction or removal.
c. The manufacturer or importer shall retain records required under
this section for a period of 2 years beyond the expected life of
the device, even if the manufacturer or importer has ceased to
manufacture or import the device. Records required to be maintained
under paragraph (b) of this section must be transferred to the new
manufacturer or importer of the device and maintained for the
required period of time.
Discussion
Although a correction or removal may not be reportable to the FDA under § 806.10,
the manufacturer or importer initiating the action is required to maintain records
of the action. Such records are to include device identity and intended use, device
identifier, description of event resulting in correction or removal, justification

why the action is not reportable, and copies of all communications relating to the
correction or removal.
Regulatory Requirement 21 CFR § 806.30 FDA Access to Records

Each device manufacturer or importer required under this part to maintain
records and every person who is in charge or custody of such records shall, upon
request of an officer or employee designated by FDA and under section 704(e) of
the act, permit such officer or employee at all reasonable times to have access to,
and to copy and verify, such records and reports.
Discussion
Each device manufacturer or importer shall make available records of corrections
and removals to designated FDA personnel, for copying and verification purposes.
Regulatory Requirement 21 CFR § 806.40 Public Availability

of Reports
a. Any report submitted under this part is available for public disclosure
in accordance with part 20 of this chapter.
b. Before public disclosure of a report, FDA will delete from the report:
1. Any information that constitutes trade secret or confidential
commercial or financial information under 20.61 of this chapter; and
2. Any personnel, medical, or similar information, including the serial
numbers of implanted devices, which would constitute a clearly
unwarranted invasion of personal privacy under 20.63 of this chapter
or 5 U.S.C. 552(b)(6); provided, that except for the information
under 20.61 of this chapter or 5 U.S.C. 552(b)(4), FDA will disclose
to a patient who requests a report all the information in the report
concerning that patient.
Discussion
Reports of corrections and removals submitted to the FDA are subject to public
disclosure. Prior to any such public disclosure the FDA will redact information
constituting an invasion of patient’s personal privacy.
21 CFR 807 ESTABLISHMENT REGISTRATION AND DEVICE

LISTING FOR MANUFACTURERS AND INITIAL IMPORTERS
OF DEVICES
Registration is a process through which the owner/operator of an establishment that
manufactures, assembles, or otherwise processes a device for distribution in the
United States provides to FDA information about the facility and its management.
Listing is the process that identifies to FDA the types of devices that a firm
distributes or offers for distribution in the United States.

FDA has set forth the following definitions applicable to establishment registration
and device listing:
Act means the Federal Food, Drug, and Cosmetic Act [FDCA].
Commercial distribution means any distribution of a device intended for human use
which is held or offered for sale but does not include the following:
1. Internal or interplant transfer of a device between establishments
within the same parent, subsidiary, and/or affiliate company;
2. Any distribution of a device intended for human use which has in
effect an approved exemption for investigational use under section
520(g) of the act and part 812 of this chapter;
3. Any distribution of a device, before the effective date of part 812 of
this chapter, that was not introduced or delivered for introduction
into interstate commerce for commercial distribution before May 28,
1976, and that is classified into Class III under section 513(f) of the
act: Provided, That the device is intended solely for investigational
use, and under section 501(f)(2)(A) of the act the device is not required
to have an approved premarket approval application as provided in
section 515 of the act; or
4. For foreign establishments, the distribution of any device that is
neither imported nor offered for import into the United States.
Establishment means a place of business under one management at one general
physical location at which a device is manufactured, assembled, or otherwise
processed.
Manufacture, preparation, propagation, compounding, assembly, or processing of a device
means the making by chemical, physical, biological, or other procedures of any
article that meets the definition of device in section 201(h) of the act. These terms
include the following activities:
1. Repackaging or otherwise changing the container, wrapper, or

labeling of any device package in furtherance of the distribution of
the device from the original place of manufacture to the person who
makes final delivery or sale to the ultimate consumer;
2. Initial importation of devices manufactured in foreign
establishments; or
3. Initiation of specifications for devices that are manufactured by a
second party for subsequent commercial distribution by the person
initiating specifications.
Official correspondent means the person designated by the owner or operator of an
establishment as responsible for the following:
1. The annual registration of the establishment;
2. Contact with the Food and Drug Administration for device listing;
3. Maintenance and submission of a current list of officers and directors
to the Food and Drug Administration upon the request of the
Commissioner; and
4. The receipt of pertinent correspondence from the Food and Drug
Administration directed to and involving the owner or operator and/
or any of the firm's establishments.
Owner or operator means the corporation, subsidiary, affiliated company,
partnership, or proprietor directly responsible for the activities of the registering
establishment.
Initial importer means any importer who furthers the marketing of a device from
a foreign manufacturer to the person who makes the final delivery or sale of the
device to the ultimate consumer or user, but does not repackage, or otherwise
change the container, wrapper, or labeling of the device or device package.
Any term defined in section 201 of the act shall have that meaning.
Restricted device means a device for which a requirement restricting sale,
distribution, or use has been established by a regulation issued under section
520(e) of the act, by order as a condition of premarket approval under section
515(d)(1)(B)(ii) of the act, or by a performance standard issued in accordance with
sections 514(a)(2)(B)(v) and 514(b) of the act.
Classification name means the term used by the Food and Drug Administration
and its classification panels to describe a device or class of devices for purposes of
classifying devices under section 513 of the act.
Product code means the code used by FDA to identify the generic category of a device.
Representative sampling of advertisements means typical advertising material that
gives the promotional claims made for the device.
Representative sampling of any other labeling means typical labeling material

(excluding labels and package inserts) that gives the promotional claims made for
the device.
Material change includes any change or modification in the labeling or
advertisements that affects the identity or safety and effectiveness of the device.
These changes may include, but are not limited to, changes in the common or
usual or proprietary name, declared ingredients or components, intended use,
contraindications, warnings, or instructions for use. Changes that are not material
may include graphic layouts, grammar, or correction of typographical errors
which do not change the content of the labeling, changes in lot number, and, for
devices where the biological activity or known composition differs with each lot
produced, the labeling containing the actual values for each lot.
510(k) summary (summary of any information respecting safety and effectiveness)
means a summary, submitted under section 513(i) of the act, of the safety and
effectiveness information contained in a premarket notification submission
upon which a determination of substantial equivalence can be based. Safety and
effectiveness information refers to safety and effectiveness data and information
supporting a finding of substantial equivalence, including all adverse safety and
effectiveness information.
510(k) statement means a statement, made under section 513(i) of the act, asserting
that all information in a premarket notification submission regarding safety and
effectiveness will be made available within 30 days of request by any person if
the device described in the premarket notification submission is determined to be
substantially equivalent. The information to be made available will be a duplicate
of the premarket notification submission, including any adverse safety and
effectiveness information, but excluding all patient identifiers, and trade secret or
confidential commercial information, as defined in 20.61 of this chapter.
Class III certification means a certification that the submitter of the 510(k) has
conducted a reasonable search of all known information about the Class III device
and other similar, legally marketed devices.
Class III summary means a summary of the types of safety and effectiveness
problems associated with the type of device being compared and a citation
to the information upon which the summary is based. The summary must be
comprehensive and describe the problems to which the type of device is susceptible
and the causes of such problems.
United States agent means a person residing or maintaining a place of business
in the United States whom a foreign establishment designates as its agent. This
definition excludes mailboxes, answering machines or services, or other places
where an individual acting as the foreign establishment's agent is not physically
present.
Wholesale distributor means any person (other than the manufacturer or the initial
importer) who distributes a device from the original place of manufacture to the
person who makes the final delivery or sale of the device to the ultimate consumer
or user.
Fiscal year means the FDA fiscal year, which runs from October 1 through
September 30.
FURLS means the Food and Drug Administration's Unified Registration and
Listing System.
FDA premarket submission number means the number assigned by FDA to a
premarket device submission, such as a Premarket Approval Application
(PMA); Humanitarian Device Exemption (HDE); New Drug Application (NDA);
Biologics License Application (BLA); de novo classification petition; or Premarket
Notification (510(k)).
Importer means, for purposes of this part, a company or individual in the United
States that is an owner, consignee, or recipient, even if not the initial owner,
consignee, or recipient, of the foreign establishment's device that is imported into
the United States. An importer does not include the consumer or patient who
ultimately purchases, receives, or uses the device, unless the foreign establishment
ships the device directly to the consumer or patient.
Person who imports or offers for import means, for purposes of this part, an agent,
broker, or other entity, other than a carrier, that the foreign establishment uses to
facilitate the import of its device into the United States.
Subpart B—Procedures for Device Establishments
Regulatory Requirement 21 CFR § 807.20 Who Must Register and

Submit a Device List?
a. An owner or operator of an establishment not exempt under section
510(g) of the Federal Food, Drug, and Cosmetic Act or subpart
D of this part who is engaged in the manufacture, preparation,
propagation, compounding, assembly, or processing of a device
intended for human use shall register and submit listing information
for those devices in commercial distribution, except that registration
and listing information may be submitted by the parent, subsidiary,
or affiliate company for all the domestic or foreign establishments
under the control of one of these organizations when operations
are conducted at more than one establishment and there exists
joint ownership and control among all the establishments. The
term "device" includes all in vitro diagnostic products and in vitro
diagnostic biological products not subject to licensing under section
351 of the Public Health Service Act. An owner or operator of an
establishment located in any State as defined in section 201(a)(1) of the
Federal Food, Drug, and Cosmetic Act shall register its name, places
of business, and all establishments and list the devices whether or
not the output of the establishments or any particular device so listed
enters interstate commerce. The registration and listing requirements
shall pertain to any person who is engaged in the manufacture,
preparation, propagation, compounding, assembly, or processing

of a device intended for human use, including any person who:
1. Initiates or develops specifications for a device that is to be
manufactured by a second party;
2. Sterilizes or otherwise makes a device for or on behalf of a
specifications developer or any other person:
3. Repackages or relabels a device;
4. Reprocesses a single-use device that has previously been used
on a patient;
5. Acts as an initial importer as defined in 807.3(g), except that initial
importers may fulfill their listing obligation for any device for which
they did not initiate or develop the specifications for the device or
repackage or relabel the device by submitting the name and address
of the manufacturer. Initial importers shall also be prepared to
submit, when requested by FDA, the proprietary name, if any, and
the common or usual name of each device for which they are the
initial importer;
6. Manufactures components or accessories that are ready to be used for
any intended health-related purpose and are packaged or labeled for
commercial distribution for such health-related purpose, e.g. blood
filters, hemodialysis tubing, or devices which of necessity must be
further processed by a licensed practitioner or other qualified person
to meet the needs of a particular patient, e.g., a manufacturer of
ophthalmic lens blanks.
b. Registration or listing does not constitute an admission or agreement
or determination that a product is a device within the meaning of
section 201(h) of the Federal Food, Drug, and Cosmetic Act.
c. Registration and listing requirements shall not pertain to any person
who acts as a wholesale distributor, as defined in 807.3(t), and who
does not manufacture, repackage, process, or relabel a device.
d. Owners and operators of establishments or persons engaged in the
recovery, screening, testing, processing, storage, or distribution
of human cells, tissues, and cellular and tissue-based products, as
defined in 1271.3(d) of this chapter, that are regulated under the
Federal Food, Drug, and Cosmetic Act must register and list those
human cells, tissues, and cellular and tissue-based products with
the Center for Biologics Evaluation and Research on Form FDA
3356 following the procedures set out in subpart B of part 1271 of
this chapter, instead of the procedures for registration and listing
contained in this part, except that the additional listing information
requirements of 807.26 remain applicable.
e. Owners and operators of establishments that manufacture devices

licensed under section 351 of the Public Health Service Act as well as
licensed biological products used in the manufacture of a licensed
device must register and list following the procedures set out in part
607 of this chapter, instead of the procedures for registration and
listing contained in this part.
Discussion
Owners and operators of firms engaged “in the in the manufacture, preparation,
propagation, compounding, assembly, or processing of a device intended for
human use”107 are required to submit establishment registration and device listing
data to the FDA. This includes firms that are contract manufacturers, specification
developers, contract sterilizers, repackagers or relabelers of devices, reprocessers
of devices originally labeled for single use, initial importers, manufacturers of
components or accessories packaged or labeled for commercial distribution
for health-related purposes to an end user, and US manufacturers of export
only devices.
Regulatory Requirement 21 CFR § 807.21 How to Register

Establishments and List Devices
a. Owners or operators of establishments that are subject to the
registration and listing requirements of this part must provide the
following information to us using our electronic device registration
and listing system, except as provided in paragraphs (b), (c), and
(d) of this section:
1. Initial establishment registration information as required by
807.22(a) and 807.25;
2. Updates to registration information as required by 807.22(b)
and 807.25;
3. Initial device listing information as required by 807.22(a), 807.25,
and 807.28;
4. Updates to device listing information as required by 807.22(b),
807.25, and 807.28, including updates to reflect the discontinuance
or resumption of the commercial distribution of a previously listed
device as specified at paragraphs (d) and (e) of 807.28.
b. If the information under 807.21(a) cannot be submitted electronically,
a waiver may be requested. Waivers will be granted only if use of
electronic means is not reasonable for the person requesting the
waiver. To request a waiver, applicants must send a letter to the Office
of Compliance, Center for Devices and Radiological Health, Food
and Drug Administration, 10903 New Hampshire Ave., Bldg. 66,
rm. 2621, Silver Spring, MD 20993-0002, that includes the following
information:
1. The name and address of the device establishment(s) to be registered,

a contact person for the owner or operator of the establishment, and
the telephone number at which that person can be reached. If the
establishment has already registered in the past, the letter should
also include the owner or operator number, registration number,
and any listing numbers previously assigned by FDA for devices
manufactured at that establishment.
2. Information about whether the company is an initial importer as
defined in 807.3(g) and, if so, whether it also conducts any other
activities or operations relating to devices.
3. A statement that use of the Internet is not reasonable for the person
requesting the waiver, and an explanation of why such use is not
reasonable. The statement must be signed by the owner or operator
of the establishment, or by a person employed by the owner or
operator who is authorized to make the declaration on behalf of the
owner or operator.
c. Those owners or operators who have obtained a waiver from filing
registration and listing information electronically should refer to
807.34 for information on how to submit such information by
postal mail.
d. When additional device listing information (e.g., copies of labeling
or advertisements) is requested by FDA as described at 807.26(e),
such information may be submitted by postal mail or electronically
by email, but will not be submitted using the FDA electronic device
registration and listing system.
Discussion
Unless FDA grants an exemption by waiver, FDA’s online system is used to fulfill
requirements for initial establishment registration and device listing, as well as
providing updates to such information as appropriate.
Regulatory Requirement 21 CFR § 807.22 Times for Establishment

Registration and Device Listing
a. Initial registration and listing. An owner or operator of an establishment
who has not previously entered into an operation described in
807.20(a) shall register within 30 days after entering into such an
operation and submit device listing information at that time.
b. Registration and listing updates. Owners or operators shall review
and update all of their establishment registration and device listing
information that is on file at FDA, documenting any changes that
were not previously reported as follows:
1. Annual registration for each fiscal year is required for all

establishments. Annual registration shall take place during the
period beginning on October 1 and ending on December 31 of each
fiscal year;
2. Updates to the registration information as described in 807.25(b)
shall be made within 30 days of any change to such information;
3. Every fiscal year, during the period beginning on October 1 and
ending on December 31, owners or operators shall review and
update all of their device listing information that is on file at FDA,
reporting any changes or deletions to listings and any new listings
that were not previously reported. The accuracy of all information on
file must be confirmed each year regardless of whether any changes
were made to the owner or operator's list of devices; and
4. Changes to listing information may also be made at other times, such
as when a device is introduced into commercial distribution, when a
change is made to a previously-listed device, or when a previously-
listed device is removed from commercial distribution.
c. Failure to submit required information. Failure to submit any of the
required information on time, as specified in paragraphs (a) and
(b) of this section, will put the establishment in a "failed to register"
or "failed to list" status as applicable. The establishment will not
be considered active and the establishment registration and device
listing information may not appear on the FDA Web site until such
time as the owner or operator submits and FDA processes the
required information.
Discussion
Within thirty days of entering an operation requiring registration and listing,
establishments are required to complete their initial registration and device
listing. Establishments are required to register annually between October 31 and
December 31 of each FDA fiscal year, review their device listings, and update
as appropriate. Although device listings are reviewed concurrently with annual
registration, updates to device listings may be made at any time. Registration
information must be updated within thirty days of changes.
Regulatory Requirement 21 CFR § 807.25 Information Required

for Device Establishment Registration and Device Listing
a. All owners or operators that are subject to the registration and listing
requirements of this part shall provide such information to us by
using the FDA electronic device registration and listing system,
unless granted a waiver from electronic submission in accordance
with 807.21(b). Electronic submissions of registration and listing
information must comply with part 11 of this chapter, except for
the requirements in 11.10(b), (c), and (e), and the corresponding
requirements in 11.30 of this chapter. Those owners or operators

granted a waiver from electronic submission should refer to
paragraphs (c) and (g) of this section and 807.34 for instructions
on how to submit device registration and listing information.
b. Registration information required to be submitted includes: The
name and mailing address of the device establishment; the Web site
address of the device establishment, if any; the name, address, phone
number, fax number, and email address of the owner or operator; the
name, address, phone number, fax number, and email address of the
establishment's official correspondent; and all trade names used by
the establishment.
c. Owners or operators who have been granted a waiver from electronic
filing must submit the establishment registration information
described in paragraph (b) of this section, except for the Web site and
email address information, in paper form using the procedures set
forth in 807.34.
d. Each owner or operator is required to maintain a listing of all officers,
directors, and partners for each establishment registered by the owner
or operator and to furnish this information to FDA upon request.
e. For each establishment, an official correspondent must be designated
by the owner or operator to serve as a point of contact with FDA
on matters relating to the registration of device establishments and
the listing of device products. Each owner or operator shall also
provide FDA with the name of a contact person at the owner or
operator's offices who will be responsible for identifying the official
correspondent for each establishment. The owner or operator contact
person will be the official correspondent in the event no one else has
been properly designated. The official correspondent is responsible
for:
1. Providing FDA with all required registration and listing information
electronically unless a waiver from electronic submission has been
granted in accordance with 807.21(b);
2. Receiving all correspondence from FDA concerning registration
and listing;
3. Supplying, when requested by FDA, the names of all officers,
directors, and partners; and
4. Receiving communications from FDA by email, or by postal mail
if the owner or operator has been granted a waiver from the
requirement to file registration and listing information electronically.
f. The designation of an official correspondent does not in any manner
affect the liability of the owner or operator of the establishment or any
other individual under section 301(p) or any other provision of the
Federal Food, Drug, and Cosmetic Act.
g. Device listing information must be submitted to FDA electronically

unless a waiver from electronic submission has been granted in
accordance with 807.21(b). Owners or operators who have been
granted a waiver must submit the required device listing information,
including information required by this paragraph, 807.28, and any
listing information requested by FDA under 807.26(e), in paper form
using the procedures set forth in 807.34. The information required for
each device listed includes:
1. The current registration number and name of each establishment
under the ownership and control of the owner or operator where
the device is manufactured, repackaged, relabeled, or otherwise
processed, or where specifications are developed.
2. The product code for each device that is exempt from premarket
notification and approval or which was in commercial distribution
prior to May 28, 1976.
3. The proprietary or brand name(s) under which each device
is marketed.
4. The FDA-assigned premarket submission number of the
approved application, cleared premarket notification, granted
de novo classification petition, or approved humanitarian device
exemption for each device listed that is subject to sections 505, 510(k),
513(f)(2), 515, or 520(m) of the Federal Food, Drug, and Cosmetic
Act, which includes devices that are not exempt from premarket
notification and approval.
5. Each activity or process that is conducted on or done to the device
at each establishment, such as manufacturing, repacking, relabeling,
developing specifications, remanufacturing, single-use device
reprocessing, contract manufacturing, contract sterilizing, or
manufacturing for export only.
Discussion
Registration and listing information is submitted via FDA’s electronic system,
unless FDA has granted a waiver. Each establishment owner/operator designates
an official correspondent who interacts with the Agency regarding registration
and listing. Required registration information includes: establishment name and
mailing address, website (if applicable), owner/operator contact information,
contact information for official correspondent, and trade names used by the
establishment. Information required for device listing includes: establishment
name and registration number, product code for any preamendments devices,
device proprietary or trade names used in marketing, and FDA-assigned
premarket submission numbers.
Regulatory Requirement 21 CFR § 807.26 Additional Listing

Information
a. Each owner or operator shall maintain a historical file containing
the labeling and advertisements in use on the date of initial listing,
and in use after October 10, 1978, but before the date of initial listing,
as follows:
1. For each device subject to section 514 or 515 of the act that is not
a restricted device, a copy of all labeling for the device;
2. For each restricted device, a copy of all labeling and advertisements
for the device;
3. For each device that is neither restricted nor subject to section
514 or 515 of the act, a copy of all labels, package inserts, and a
representative sampling of any other labeling.
b. In addition to the requirements set forth in paragraph (a) of this
section, each owner or operator shall maintain in the historical file
any labeling or advertisements in which a material change has been
made any time after initial listing.
c. Each owner or operator may discard labeling and advertisements
from the historical file 3 years after the date of the last shipment
of a discontinued device by an owner or operator.
d. Location of the file:
1. Currently existing systems for maintenance of labeling and
advertising may be used for the purpose of maintaining the
historical file as long as the information included in the systems
fulfills the requirements of this section, but only if the labeling and
advertisements are retrievable in a timely manner.
2. The contents of the historical file may be physically located in
more than one place in the establishment or in more than one
establishment provided there exists joint ownership and control
among all the establishments maintaining the historical file. If no
joint ownership and control exists, the registered establishment must
provide the Food and Drug Administration with a letter authorizing
the establishment outside its control to maintain the historical file.
3. A copy of the certification and disclosure statements as required by
part 54 of this chapter shall be retained and physically located at the
establishment maintaining the historical file.
e. Each owner or operator shall be prepared to submit to the Food
and Drug Administration, only upon specific request, the following
information:
1. For a device subject to section 514 or 515 of the act that is not a
restricted device, a copy of all labeling for the device.
2. For a device that is a restricted device, a copy of all labeling for the
device, a representative sampling of advertisements for the device,
and for good cause, a copy of all advertisements for a particular
device. A request for all advertisements will, where feasible, be
accompanied by an explanation of the basis for such request.
3. For a device that is neither a restricted device, nor subject to section
514 of 515 of the act, the label and package insert for the device and
a representative sampling of any other labeling for the device.
4. For a particular device, a statement of the basis upon which the
registrant has determined that the device is not subject to section 514
or 515 of the act.
5. For a particular device, a statement of the basis upon which the
registrant has determined the device is not a restricted device.
6. For a particular device, a statement of the basis for determining that
the product is a device rather than a drug.
7. For a device that the owner or operator has manufactured for
distribution under a label other than its own, the names of all
distributors for whom it has been manufactured.
f. Labeling, advertisements, and other information to be submitted
upon request in accordance with paragraph (e) of this section may be
submitted by postal mail or electronically by email, but will not be
submitted using the FDA electronic device registration and listing
system. Electronic submissions of such information must comply
with part 11 of this chapter, except for the requirements in 11.10 (a), (c)
through (h), and (k), and the corresponding requirements in 11.30 of
this chapter. The information provided in electronic format must be in
a form that we can process, review, and archive.
Discussion
The owner/operator of each establishment is to maintain a historical file of labeling
and advertisements at the time of initial device listing and any subsequent labeling
or advertisements with a material change. This historical file generally includes
all labels, package inserts, and a representative sample of any additional labeling.
This file may be in the format of the establishment’s system for maintaining
labeling and advertising (e.g., document control system) provided the labeling
and advertising can be retrieved timely or physically located in multiple locations
within the establishment or multiple establishments if under joint control and
ownership. Labeling and advertisements in the historical file are to be retained for
at least three years after the last shipment date of a discontinued device. Labeling,
advertisement and other information must be submitted to the FDA upon request.
Regulatory Requirement 21 CFR § 807.28 Updating Device

Listing Information
a. Updating of device listing information is required if an additional
establishment begins to engage in any of the activities described
in 807.3(d) with respect to a listed device, such as manufacturing,
developing specifications, repackaging, relabeling, or otherwise
processing the device. Updating of the listing is also required if
an establishment begins performing another activity on or to the
device, or ceases to perform an activity on or to the device that had
previously been identified on the device listing.
b. An owner or operator shall create a new device listing using the FDA
electronic device registration and listing system:
1. If introducing into commercial distribution an exempt device
identified with a product code that is not currently listed by the
owner or operator; or
2. If introducing into commercial distribution a non-exempt device with
an FDA premarket submission number that is not currently listed by
the owner or operator.
c. All device listings for foreign establishments must be submitted
before the device may be imported or offered for import into the
United States.
d. An owner or operator who discontinues commercial distribution of
a device shall discontinue the device listing using the FDA electronic
device registration and listing system. A device listing is considered
discontinued if:
1. All devices under an exempt product code have been discontinued or
2. All devices associated with an FDA premarket submission number
have been discontinued.
e. If commercial distribution of a discontinued device is resumed,
the owner or operator must reactivate the previously discontinued
listing using the electronic device registration and listing system.
Any changes to the listing information for the product that is the
subject of the listing such as a new establishment, new activity, or
new proprietary name must be made using the electronic device
registration and listing system at the time the listing is reactivated.
f. FDA will assign one listing number for all devices exempt from
premarket notification requirements under a single product code.
For products not exempt from premarket notification requirements,
a single listing number will be assigned by FDA for each FDA
premarket submission number.
Discussion
Device listing information is to be maintained as current, including updating
if the establishment begins or ceases an activity (e.g., manufacture, develop
specifications). Introduction of a new device under a FDA product code for which
an establishment is not currently registered necessitates an update to its device
listing. Device listings for a non-US establishment are to be submitted prior to the
device being imported or offered for import into the US. The listing for a device
may be discontinued if all devices under the FDA product code or premarket
submission number have been discontinued. If distribution of a previously
discontinued device is resumed, the device listing must be re-activated with
current information.
Regulatory Requirement 21 CFR § 807.34 Summary of

Requirements for Owners or Operators Granted a Waiver from
Submitting Required Information Electronically
a. For initial registration and listing, owners or operators who have been
granted a waiver from electronic filing using the procedures set forth
in 807.21(b) must send a letter containing all of the registration and
listing information described in 807.22, 807.25, (and 807.26 when such
information is requested by FDA), at the times described in 807.22,
to: The Office of Compliance, Center for Devices and Radiological
Health, Food and Drug Administration, 10903 New Hampshire Ave.,
Bldg. 66, rm. 3521, Silver Spring, MD 20993-0002.
b. As specified in 807.22(b)(1) and (b)(3), all owners or operators shall
update their establishment registration and device listings annually
during the period beginning on October 1 and ending on December
31 of each fiscal year.
c. Failure to submit any of the required information on time, as
specified in 807.22(a) and (b), will put the establishment in a "failed to
register" or "failed to list" status as applicable.
The establishment will not be considered active and the establishment registration
and device listing information may not appear on the FDA Web site until the
required information is submitted to and processed by FDA.
Discussion
An establishment granted a waiver from electronic filing is required to submit
a letter to the FDA containing the information required by regulation for initial
registration and listing. Owners/operators are required to update their registration
and listing information between October 1 and December 31 each FDA fiscal year.
Failure to meet these requirements will render the establishment as “failed to
register” or “failed to list.”
Regulatory Requirement 21 CFR § 807.35 Notification of Registrant

a. The Food and Drug Administration will assign each device
establishment a registration number after verifying the initial
establishment registration information that has been submitted.
The owner or operator of the establishment will also be assigned
an identifying number. Both numbers will be sent to the official
correspondent by email, or by postal mail if the owner or operator has
been granted a waiver from the requirement to file registration and
listing information electronically.
b. Owners or operators of device establishments who also manufacture
or process biological products (including devices licensed under
section 351 of the Public Health Service Act) or drug products at the
same establishment must also register and list those products under
part 607 or part 207 of this chapter, as appropriate. Registration and
listing for human blood and blood products, devices licensed under
section 351 of the Public Health Service Act, and licensed biological
products used in the manufacture of a device licensed under section
351 of the Public Health Service Act, are subject to part 607 of this
chapter; registration and listing for all other drug products (including
other biological products that are also regulated as drug products) are
subject to part 207 of this chapter.
c. Although establishment registration and device listing are required
to engage in the device activities described in 807.20, validation
of registration and the assignment of a device listing number
in itself does not establish that the holder of the registration is
legally qualified to deal in such devices and does not represent a
determination by the Food and Drug Administration as to the status
of any device.
Discussion
The FDA assigns a registration number to each establishment and an identifying
number to each owner/operator following verification of initial registration
information. Assigned numbers are provided to the establishment’s official
correspondent. Assignment of an establishment registration number or owner/
operator number does not represent a legal qualification of the firm or convey the
status of any device. Owners/operators of establishments engaged in additional
products may be required to complete registration and listing activities additional
to the requirements of § 807.
Regulatory Requirement 21 CFR § 807.37 Public Availability of

Establishment Registration and Device Listing Information
a. Establishment registration and device listing information is available
for public inspection in accordance with section 510(f) of the Federal
Food, Drug, and Cosmetic Act and will be posted on the FDA Web
site, with the exception of the information identified in paragraph

(b) of this section. Requests for information by persons who do
not have access to the Internet should be directed to the Office of
Compliance, Center for Devices and Radiological Health, Food and
Drug Administration, 10903 New Hampshire Ave., Bldg. 66, rm. 3521,
Silver Spring, MD 20993-0002. In addition, there will be available
for inspection at each of the Food and Drug Administration district
offices the same information for firms within the geographical area
of such district offices. Upon request, verification of a registration
number or location of a registered establishment will be provided.
b. The following listing information will not be available for public
inspection or posted on the FDA Web site:
1. For contract manufacturers, contract sterilizers, and private label
manufacturers, the proprietary or brand name(s) under which a
device is marketed and the FDA-assigned premarket submission
number, if this information would reveal a confidential business
relationship;
2. FDA-assigned listing numbers.
Discussion
Registration and listing information is disclosed to the public via the FDA web site
or written request, except for FDA-assigned listing numbers and instances where
disclosure of a device’s proprietary or brand name would disclose a confidential
business relationship with a contract manufacturer, contract sterilizer, or private
label manufacturer.
Regulatory Requirement 21 CFR § 807.37 Misbranding by

Reference to Establishment Registration or to Registration
Number
Registration of a device establishment or assignment of a registration number
does not in any way denote approval of the establishment or its products.
Any representation that creates an impression of official approval because of
registration or possession of a registration number is misleading and constitutes
misbranding.
Discussion
Assignment of an establishment registration number by FDA does not signify
approval of a firm or its products; any representation of this is considered
misbranding.
Subpart C—Procedures for Foreign Device Establishments
Regulatory Requirement 21 CFR § 807.40 Establishment

Registration and Device Listing for Foreign Establishments
Importing or Offering for Import Devices into the United States
a. Any establishment within any foreign country engaged in the
manufacture, preparation, propagation, compounding, or processing
of a device that is imported or offered for import into the United
States shall register such establishment and list such devices using the
FDA electronic device registration and listing system in conformance
with the procedures in this section, 807.41, and subpart B of this part.
The official correspondent for the foreign establishment shall facilitate
communication between the foreign establishment's management
and representatives of FDA for matters relating to the registration of
device establishments and the listing of device products.
b. Each foreign establishment required to register under paragraph (a)
of this section shall submit the name, address, and phone number of
its United States agent as part of its initial and updated registration
information in accordance with subpart B of this part. Each foreign
establishment shall designate only one United States agent and may
designate the United States agent to act as its official correspondent.
1. The United States agent shall reside or maintain a place of business
in the United States.
2. Upon request from FDA, the United States agent shall assist FDA
in communications with the foreign establishment, respond to
questions concerning the foreign establishment's products that are
imported or offered for import into the United States, and assist
FDA in scheduling inspections of the foreign establishment. If the
agency is unable to contact the foreign establishment directly or
expeditiously, FDA may provide information or documents to the
United States agent, and such an action shall be considered to be
equivalent to providing the same information or documents to the
foreign establishment.
3. The foreign establishment or the United States agent shall report
changes in the United States agent's name, address, or phone number
to FDA within 10 business days of the change.
c. No device may be imported or offered for import into the United
States unless it is the subject of a device listing as required under
subpart B of this part and is manufactured, prepared, propagated,
compounded, or processed at a registered foreign establishment;
however, this restriction does not apply to devices imported or offered
for import under the investigational use provisions of part 812 of
this chapter.
d. The device establishment registration and device listing information

shall be in the English language.
Discussion
Foreign establishments involved in the manufacture, preparation, propagation,
compounding, or processing of a device imported to or offered for import into
the US is required to register and list electronically with the FDA in English,
designate an official correspondent, and designate a US agent. The same
individual may serve as both official correspondent and US agent provided the
requirements for US agent are met. A US agent is required to reside or maintain a
place of business in the US and to facilitate communication between FDA and the
foreign establishment. Changes in US agent name or contact information are to be
reported within ten business days of said change.
Regulatory Requirement 21 CFR § 807.41 Identification of

Importers and Persons Who Import or Offer for Import
a. Upon initial registration, annually, and at the time of any changes,
each foreign establishment required to register and list as provided
in 807.40(a) must, using the FDA electronic device registration and
listing system, submit the name, address, telephone and fax numbers,
email address, and registration number, if any has been assigned, of
any importer (defined in 807.3(x)) of the establishment's devices that
is known to the foreign establishment. The foreign establishment
must also specify which of the establishment's listed products each
importer receives from the foreign establishment.
b. Upon initial registration, annually, and at the time of any changes,
each foreign establishment required to register and list as provided in
807.40(a) must, using the FDA electronic device registration and listing
system, submit the name, address, telephone and fax numbers, email
address, and registration number, if any has been assigned, of each
person who imports or offers for import the establishment's devices
into the United States. The term "person who imports or offers for
import," which is defined in 807.3(y), includes agents, brokers, or other
parties used by the foreign establishment to facilitate the import of its
device into the United States.
c. For each individual or organization identified by the foreign
establishment under paragraphs (a) and (b) of this section, the foreign
establishment must submit to FDA electronically the current FDA
premarket submission number and any other identifying information
that is known to the establishment for each device being imported or
offered for import by the named individuals or organizations.
Discussion
Foreign establishments are required to electronically register and list for initial
registration, annually thereafter, and when any changes are made. This includes
identification of any organization or individual who imports or offers for import
of the establishment’s devices to the US, and the devices for import or offer to
import as well as the current FDA premarket submission number and other
known identifying information.
Subpart D—Exemptions
Regulatory Requirement 21 CFR § 807.65 Exemptions for Device

Establishments
The following classes of persons are exempt from registration in accordance with
807.20 under the provisions of section 510(g)(1), (g)(2), and (g)(3) of the act, or
because the Commissioner of Food and Drugs has found, under section 510(g)(5)
of the act, that such registration is not necessary for the protection of the public
health. The exemptions in paragraphs (d), (e), (f), and (i) of this section are limited
to those classes of persons located in any State as defined in section 201(a)(1) of
the act.
a. A manufacturer of raw materials or components to be used in the
manufacture or assembly of a device who would otherwise not be
required to register under the provisions of this part.
b. A manufacturer of devices to be used solely for veterinary purposes.
c. A manufacturer of general purpose articles such as chemical reagents
or laboratory equipment whose uses are generally known by persons
trained in their use and which are not labeled or promoted for
medical uses.
d. Licensed practitioners, including physicians, dentists, and
optometrists, who manufacture or otherwise alter devices solely for
use in their practice.
e. Pharmacies, surgical supply outlets, or other similar retail
establishments making final delivery or sale to the ultimate user.
This exemption also applies to a pharmacy or other similar retail
establishment that purchases a device for subsequent distribution
under its own name, e.g., a properly labeled health aid such
as an elastic bandage or crutch, indicating "distributed by" or
"manufactured for" followed by the name of the pharmacy.
f. Persons who manufacture, prepare, propagate, compound, or process
devices solely for use in research, teaching, or analysis and do not
introduce such devices into commercial distribution.
g. [Reserved]
h. Carriers by reason of their receipt, carriage, holding or delivery of

devices in the usual course of business as carriers.
i. Persons who dispense devices to the ultimate consumer or whose
major responsibility is to render a service necessary to provide the
consumer (i.e., patient, physician, layman, etc.) with a device or the
benefits to be derived from the use of a device; for example, a hearing
aid dispenser, optician, clinical laboratory, assembler of diagnostic
x-ray systems, and personnel from a hospital, clinic, dental laboratory,
orthotic or prosthetic retail facility, whose primary responsibility to
the ultimate consumer is to dispense or provide a service through the
use of a previously manufactured device.
Discussion
Entities and persons exempt from registration and listing requirements consist
of manufacturers of raw materials or components not otherwise classified
as a finished device and distributed only to a finished device manufacturer;
manufacturers of articles not labeled or promoted for medical use; licensed
practitioners manufacturing or altering devices for use in their own practice;
retail establishments that purchase a device for subsequent distribution under
their own name; individuals involved in research, teaching or analysis without
introducing a medical device into commercial distribution; carriers of medical
devices in their normal course of business; and individuals dispensing devices to
the consumer or rendering a necessary service.
Subpart E—Premarket Notification Procedures
Regulatory Requirement 21 CFR § 807.81 When a Premarket

Notification Submission is Required
a. Except as provided in paragraph (b) of this section, each person who
is required to register his establishment pursuant to 807.20 must
submit a premarket notification submission to the Food and Drug
Administration at least 90 days before he proposes to begin the
introduction or delivery for introduction into interstate commerce for
commercial distribution of a device intended for human use which
meets any of the following criteria:
1. The device is being introduced into commercial distribution for
the first time; that is, the device is not of the same type as, or is not
substantially equivalent to, (i) a device in commercial distribution
before May 28, 1976, or (ii) a device introduced for commercial
distribution after May 28, 1976, that has subsequently been
reclassified into Class I or II.
2. The device is being introduced into commercial distribution for the
first time by a person required to register, whether or not the device
meets the criteria in paragraph (a)(1) of this section.
3. The device is one that the person currently has in commercial

distribution or is reintroducing into commercial distribution, but
that is about to be significantly changed or modified in design,
components, method of manufacture, or intended use. The following
constitute significant changes or modifications that require a
premarket notification.
(i) A change or modification in the device that could significantly
affect the safety or effectiveness of the device, e.g., a significant
change or modification in design, material, chemical
composition, energy source, or manufacturing process.
(ii) A major change or modification in the intended use of the device
b. 1. A
premarket notification under this subpart is not required
for a device for which a premarket approval application under
section 515 of the act, or for which a petition to reclassify under
section 513(f)(2) of the act, is pending before the Food and Drug
Administration.
2. The appropriate FDA Center Director may determine that the
submission and grant of a written request for an exception or
alternative under 801.128 or 809.11 of this chapter satisfies the
requirement in paragraph (a)(3) of this section.
c. In addition to complying with the requirements of this part, owners
or operators of device establishments that manufacture radiation-
emitting electronic products, as defined in 1000.3 of this chapter, shall
comply with the reporting requirements of part 1002 of this chapter.
Discussion
Persons wanting to market a Class I, II or III device intended for human use in
the United States must submit a 510(k) premarket notification to the FDA unless
a Premarket Approval (PMA) is required or the device is exempt from 510(k)
requirements. The premarket notification submission is required at least 90 days
prior to starting to introduce or deliver the device into interstate commerce for
commercial distribution. Changes or modifications to a device with an existing
510(k) that affect its intended use or could significantly affect device safety or
effectiveness require premarket notification submission and FDA clearance prior
to marketing the modified device.
Medical devices considered radiation-emitting electronic products are also
required to comply with reporting requirements in 21 CFR 1002 Records and
Reports.
Regulatory Requirement 21 CFR § 807.85 Exemption from

Premarket Notification
a. A device is exempt from the premarket notification requirements
of this subpart if the device intended for introduction into
commercial distribution is not generally available in finished form

for purchase and is not offered through labeling or advertising by
the manufacturer, importer, or distributor thereof for commercial
distribution, and the device meets one of the following conditions:
1. It is intended for use by a patient named in the order of the physician
or dentist (or other specially qualified person); or
2. It is intended solely for use by a physician or dentist (or other
specially qualified person) and is not generally available to, or
generally used by, other physicians or dentists (or other specially
qualified persons).
b. A distributor who places a device into commercial distribution for
the first time under his own name and a repackager who places his
own name on a device and does not change any other labeling or
otherwise affect the device shall be exempted from the premarket
notification requirements of this subpart if:
1. The device was in commercial distribution before May 28, 1976; or
2. A premarket notification submission was filed by another person.
Discussion
Devices that are a) generally not available for purchase in final form, b) offered
through labeling or advertising, and c) either intended for a named patient or
intended solely for use by a specially qualified person (e.g. physician, dentist) are
exempt from premarket notification requirements. Distributors commercializing
a device under their own name and repackagers who add their name to a device
without modifying the original labeling or device, are exempt from premarket
submission requirements if the device was in commercial distribution prior to
May 28, 1976 (i.e., preamendments devices) or US premarket clearance has been
previously obtained by another entity.
Regulatory Requirement 21 CFR § 807.87 Information Required in

a Premarket Notification Submission
Each premarket notification submission shall contain the following information:
a. The device name, including both the trade or proprietary name and
the common or usual name or classification name of the device.
b. The establishment registration number, if applicable, of the owner or
operator submitting the premarket notification submission.
c. The class in which the device has been put under section 513 of the
act and, if known, its appropriate panel; or, if the owner or operator
determines that the device has not been classified under such section,
a statement of that determination and the basis for the person's
determination that the device is not so classified.
d. Action taken by the person required to register to comply with the

requirements of the act under section 514 for performance standards.
e. Proposed labels, labeling, and advertisements sufficient to describe
the device, its intended use, and the directions for its use. Where
applicable, photographs or engineering drawings should be supplied.
f. A statement indicating the device is similar to and/or different
from other products of comparable type in commercial distribution,
accompanied by data to support the statement. This information
may include an identification of similar products, materials, design
considerations, energy expected to be used or delivered by the device,
and a description of the operational principles of the device.
g. Where a person required to register intends to introduce into
commercial distribution a device that has undergone a significant
change or modification that could significantly affect the safety
or effectiveness of the device, or the device is to be marketed for
a new or different indication for use, the premarket notification
submission must include appropriate supporting data to show that
the manufacturer has considered what consequences and effects the
change or modification or new use might have on the safety and
effectiveness of the device
h. A 510(k) summary as described in 807.92 or a 510(k) statement as
described in 807.93.
i. A financial certification or disclosure statement or both, as required
by part 54 of this chapter.
j. For submissions claiming substantial equivalence to a device which
has been classified into Class III under section 513(b) of the act:
1. Which was introduced or delivered for introduction into interstate
commerce for commercial distribution before December 1, 1990; and
2. For which no final regulation requiring premarket approval has
been issued under section 515(b) of the act, a summary of the
types of safety and effectiveness problems associated with the
type of devices being compared and a citation to the information
upon which the summary is based (Class III summary). The 510(k)
submitter shall also certify that a reasonable search of all information
known or otherwise available about the Class III device and other
similar legally marketed devices has been conducted (Class III
certification), as described in 807.94. This information does not refer
to information that already has been submitted to the Food and Drug
Administration (FDA) under section 519 of the act. FDA may require
the submission of the adverse safety and effectiveness data described
in the Class III summary or citation.
k. A statement that the submitter believes, to the best of his or her
knowledge, that all data and information submitted in the premarket
notification are truthful and accurate and that no material fact has
been omitted.
l. Any additional information regarding the device requested by the
Commissioner that is necessary for the Commissioner to make a
finding as to whether or not the device is substantially equivalent
to a device in commercial distribution. A request for additional
information will advise the owner or operator that there is insufficient
information contained in the original premarket notification
submission for the Commissioner to make this determination and that
the owner or operator may either submit the requested data or a new
premarket notification containing the requested information at least
90 days before the owner or operator intends to market the device, or
submit a premarket approval application in accordance with section
515 of the act. If the additional information is not submitted within
30 days following the date of the request, the Commissioner will
consider the premarket notification to be withdrawn.
Discussion
Minimum information required for a 510(k) submission includes: device name to
include trade/proprietary name as well as common/usual name or classification
name; submitter’s establishment registration number; device classification;
compliance to performance standards; proposed labeling including directions for
use; substantial equivalence to a legally marketed predicate device; data to support
the proposed device modification or change (if applicable); 510(k) summary or
statement; financial certification, disclosure or both; Class III summary and
certification (if applicable); truthful and accurate statement; and any additional
information requested by the FDA.
Regulatory Requirement 21 CFR § 807.90 Format of a Premarket

Notification Submission
Each premarket notification submission pursuant to this part shall be submitted
in accordance with this section. Each submission shall:
a. 1. A For devices regulated by the Center for Devices and Radiological
Health, be addressed to the Food and Drug Administration,
Center for Devices and Radiological Health, Document Mail
Center, 10903 New Hampshire Ave., Bldg. 66, rm. G609, Silver
Spring, MD 20993-0002.
2. For devices regulated by the Center for Biologics Evaluation and
Research, be addressed to the Food and Drug Administration, Center
for Biologics Evaluation and Research, Document Control Center,
10903 New Hampshire Ave., Bldg. 71, Rm. G112, Silver Spring,
MD 20993-0002; or for devices regulated by the Center for Drug
Evaluation and Research, be addressed to the Central Document
Room, Center for Drug Evaluation and Research, Food and Drug
Administration, 5901-B Ammendale Rd., Beltsville, MD 20705-1266.

Information about devices regulated by the Center for Biologics
Evaluation and Research is available by using the Center for
Biologics Evaluation and Research electronic Web-based application
on the Internet.
3. All inquiries regarding a premarket notification submission should
be in writing and sent to one of the addresses above.
b. Be bound into a volume or volumes, where necessary.
c. Be submitted in duplicate on standard size paper, including the
original and two copies of the cover letter.
d. Be submitted separately for each product the manufacturer intends to
market.
e. Designated "510(k) Notification" in the cover letter.
Discussion
Format requirements for a 510(k) submission are rather limited. Submissions are
required to be sent to the appropriate center within FDA (i.e., CDRH or CBER,
Center for Biologics Evaluation and Research), to be bound into one or multiple
volumes, to be submitted in duplicate on 8.5” x 11” paper, and to be clearly
identified as a 510(k) Notification in the cover letter. A separate 510(k) is to be
submitted for each product the manufacturer intends to commercialize; however,
FDA does allow the bundling of multiple devices or indications for use within a
single 510(k) submission in accordance with its Guidance for Industry and FDA Staff:
Bundling Multiple Devices or Multiple Indications in a Single Submission108 issued June
2007. Bundling is considered appropriate when scientific and regulatory issues
associated with the devices can be most efficiently addressed during a single
review.
Regulatory Requirement 21 CFR § 807.92 Content and Format of

a 510(k) Summary
a. A 510(k) summary shall be in sufficient detail to provide an
understanding of the basis for a determination of substantial
equivalence. FDA will accept summaries as well as amendments
thereto until such time as FDA issues a determination of substantial
equivalence. All 510(k) summaries shall contain the following
information:
1. The submitter's name, address, telephone number, a contact person,
and the date the summary was prepared;
2. The name of the device, including the trade or proprietary name if
applicable, the common or usual name, and the classification name,
if known;
3. An identification of the legally marketed device to which the
submitter claims equivalence. A legally marketed device to which
a new device may be compared for a determination regarding

substantial equivalence is a device that was legally marketed prior to
May 28, 1976, or a device which has been reclassified from Class III
to Class II or I (the predicate), or a device which has been found to
be substantially equivalent through the 510(k) premarket notification
process;
4. A description of the device that is the subject of the premarket
notification submission, such as might be found in the labeling or
promotional material for the device, including an explanation of how
the device functions, the scientific concepts that form the basis for the
device, and the significant physical and performance characteristics
of the device, such as device design, material used, and physical
properties;
5. A statement of the intended use of the device that is the subject
of the premarket notification submission, including a general
description of the diseases or conditions that the device will
diagnose, treat, prevent, cure, or mitigate, including a description,
where appropriate, of the patient population for which the device
is intended. If the indication statements are different from those of
the legally marketed device identified in paragraph (a)(3) of this
section, the 510(k) summary shall contain an explanation as to why
the differences are not critical to the intended therapeutic, diagnostic,
prosthetic, or surgical use of the device, and why the differences do
not affect the safety and effectiveness of the device when used as
labeled; and
6. If the device has the same technological characteristics (i.e., design,
material, chemical composition, energy source) as the predicate
device identified in paragraph (a)(3) of this section, a summary of
the technological characteristics of the new device in comparison to
those of the predicate device. If the device has different technological
characteristics from the predicate device, a summary of how the
technological characteristics of the device compare to a legally
marketed device identified in paragraph (a)(3) of this section.
b. 510(k) summaries for those premarket submissions in which
a determination of substantial equivalence is also based on an
assessment of performance data shall contain the following
information:
1. A brief discussion of the nonclinical tests submitted, referenced,
or relied on in the premarket notification submission for a
determination of substantial equivalence;
2. A brief discussion of the clinical tests submitted, referenced, or relied
on in the premarket notification submission for a determination
of substantial equivalence. This discussion shall include, where
applicable, a description of the subjects upon whom the device
was tested, a discussion of the safety or effectiveness data obtained
from the testing, with specific reference to adverse effects and

complications, and any other information from the clinical testing
relevant to a determination of substantial equivalence; and
3. The conclusions drawn from the nonclinical and clinical tests that
demonstrate that the device is as safe, as effective, and performs
as well as or better than the legally marketed device identified in
paragraph (a)(3) of this section.
c. The summary should be in a separate section of the submission,
beginning on a new page and ending on a page not shared with any
other section of the premarket notification submission, and should be
clearly identified as a "510(k) summary."
d. Any other information reasonably deemed necessary by the agency.
Discussion
Either a 510(k) summary or 510(k) statement is required in each premarket
notification submission. This section provides requirements for the content and
format of a 510(k) summary, including: submitter’s contact information; date
of summary preparation; device name (trade or proprietary name, common or
usual name, and classification name); identification of legally marketed predicate
device; device description; statement of intended use; comparison of technological
characteristics of the device being submitted and predicate device, including
similarities and differences; brief discussion of nonclinical and clinical testing
and conclusions; be clearly identified as a “510(k) summary;” and provide any
additional information the FDA deems necessary.
Regulatory Requirement 21 CFR § 807.93 Content and Format of

a 510(k) Statement
a. 1. A 510(k) statement submitted as part of a premarket notification
shall state as follows:
I certify that, in my capacity as (the position held in company by
person required to submit the premarket notification, preferably the
official correspondent in the firm), of (company name), I will make
available all information included in this premarket notification on
safety and effectiveness within 30 days of request by any person
if the device described in the premarket notification submission is
determined to be substantially equivalent. The information I agree
to make available will be a duplicate of the premarket notification
submission, including any adverse safety and effectiveness
information, but excluding all patient identifiers, and trade secret
and confidential commercial information, as defined in 21 CFR 20.61.
2. The statement in paragraph (a)(1) of this section should be signed by
the certifier, made on a separate page of the premarket notification
submission, and clearly identified as "510(k) statement."
b. All requests for information included in paragraph (a) of this

section shall be made in writing to the certifier, whose name will be
published by FDA on the list of premarket notification submissions
for which substantial equivalence determinations have been made.
c. The information provided to requestors will be a duplicate of
the premarket notification submission, including any adverse
information, but excluding all patient identifiers, and trade secret
and confidential commercial information as defined in 20.61 of this
chapter.
Discussion
If the submitter of a premarket notification submission elects to provide a 510(k)
statement in lieu of a 510(k) summary, the statement is to be in compliance with
807.93(a)(1), signed by the certifying individual, and clearly identified as a “510(k)
statement.” The official correspondent of the submitting establishment is preferred
as the certifying individual, who agrees to make available safety and effectiveness
information in the submission within 30 days of request.
Regulatory Requirement 21 CFR § 807.94 Format of a Class III

Certification
a. A Class III certification submitted as part of a premarket notification
shall state as follows:
I certify, in my capacity as (position held in company), of (company
name), that I have conducted a reasonable search of all information
known or otherwise available about the types and causes of safety
or effectiveness problems that have been reported for the (type of
device). I further certify that I am aware of the types of problems to
which the (type of device) is susceptible and that, to the best of my
knowledge, the following summary of the types and causes of safety
or effectiveness problems about the (type of device) is complete and
accurate.
b. The statement in paragraph (a) of this section should be signed by the
certifier, clearly identified as "Class III certification," and included at
the beginning of the section of the premarket notification submission
that sets forth the Class III summary.
Discussion
If a premarket notification submission includes a Class III certification, such
certification must comply with 807.94(a) and summarize the types and causes of
safety and effectiveness issues known about the device being submitted.
Regulatory Requirement 21 CFR § 807.95 Confidentiality of

Information
a. The Food and Drug Administration will disclose publicly whether
there exists a premarket notification submission under this part:
1. Where the device is on the market, i.e., introduced or delivered for
introduction into interstate commerce for commercial distribution;
2. Where the person submitting the premarket notification submission
has disclosed, through advertising or any other manner, his intent
to market the device to scientists, market analysts, exporters, or
other individuals who are not employees of, or paid consultants
to, the establishment and who are not in an advertising or law firm
pursuant to commercial arrangements with appropriate safeguards
for secrecy; or
3. Where the device is not on the market and the intent to market the
device has not been so disclosed, except where the submission is
subject to an exception under paragraph (b) or (c) of this section.
b. The Food and Drug Administration will not disclose publicly the
existence of a premarket notification submission for a device that is not
on the market and where the intent to market the device has not been
disclosed for 90 days from the date of receipt of the submission, if:
1. The person submitting the premarket notification submission
requests in the submission that the Food and Drug Administration
hold as confidential commercial information the intent to market the
device and submits a written certification to the Commissioner;
(i) That the person considers his intent to market the device to be
confidential commercial information;
(ii) That neither the person nor, to the best of his knowledge, anyone
else, has disclosed through advertising or any other manner,
his intent to market the device to scientists, market analysts,
exporters, or other individuals, except employees of, or paid
consultants to, the establishment or individuals in an advertising
or law firm pursuant to commercial arrangements with
appropriate safeguards for secrecy;
(iii) That the person will immediately notify the Food and Drug
Administration if he discloses the intent to market the device
to anyone, except employees of, or paid consultants to, the
establishment or individuals in an advertising or law firm
pursuant to commercial arrangements with appropriate
safeguards for secrecy;
(iv) That the person has taken precautions to protect the
confidentiality of the intent to market the device; and
(v) That the person understands that the submission to the

government of false information is prohibited by 18 U.S.C. 1001
and 21 U.S.C. 331(q); and
2. The Commissioner agrees that the intent to market the device is
confidential commercial information.
c. Where the Commissioner determines that the person has complied
with the procedures described in paragraph (b) of this section with
respect to a device that is not on the market and where the intent to
market the device has not been disclosed, and the Commissioner
agrees that the intent to market the device is confidential commercial
information, the Commissioner will not disclose the existence of the
submission for 90 days from the date of its receipt by the agency. In
addition, the Commissioner will continue not to disclose the existence
of such a submission for the device for an additional time when any of
the following occurs:
1. The Commissioner requests in writing additional information
regarding the device pursuant to 807.87(h), in which case the
Commissioner will not disclose the existence of the submission
until 90 days after the Food and Drug Administration's receipt
of a complete premarket notification submission;
2. The Commissioner determines that the device intended to
be introduced is a Class III device and cannot be marketed
without premarket approval or reclassification, in which case the
Commissioner will not disclose the existence of the submission
unless a petition for reclassification is submitted under section 513(f)
(2) of the act and its existence can be disclosed under 860.5(d) of this
chapter; or
d. FDA will make a 510(k) summary of the safety and effectiveness
data available to the public within 30 days of the issuance of a
determination that the device is substantially equivalent to another
device. Accordingly, even when a 510(k) submitter has complied
with the conditions set forth in paragraphs (b) and (c) of this section,
confidentiality for a premarket notification submission cannot
be granted beyond 30 days after FDA issues a determination of
equivalency.
e. Data or information submitted with, or incorporated by reference
in, a premarket notification submission (other than safety and
effectiveness data that have not been disclosed to the public) shall be
available for disclosure by the Food and Drug Administration when
the intent to market the device is no longer confidential in accordance
with this section, unless exempt from public disclosure in accordance
with part 20 of this chapter. Upon final classification, data and
information relating to safety and effectiveness of a device classified
in Class I (general controls) or Class II (performance standards) shall
be available for public disclosure. Data and information relating to
safety and effectiveness of a device classified in Class III (premarket

approval) that have not been released to the public shall be retained
as confidential unless such data and information become available for
release to the public under 860.5(d) or other provisions of this chapter.
Discussion
The FDA generally maintains existence of a premarket notification as confidential;
however, 807.95 presumes public disclosure unless the FDA is satisfied the intent
to market the device is actually confidential. Specifically, the FDA will not
publicly disclose the existence of a premarket notification submission when the
device is not marketed, intent to market the device has not been disclosed, the
submitter requests the FDA hold the information as confidential, and the FDA
Commissioner agrees the intention to market the submitted device is confidential
commercial information.
The FDA will publish the 510(k) summary of a device determined substantially
equivalent within 30 days of such determination, i.e., 510(k) clearance. Public
disclosure of the 510(k) summary is not subject to confidentiality provisions.
Regulatory Requirement 21 CFR § 807.97 Misbranding by

Reference to Premarket Notification
Submission of a premarket notification in accordance with this subpart, and a
subsequent determination by the Commissioner that the device intended for
introduction into commercial distribution is substantially equivalent to a device
in commercial distribution before May 28, 1976, or is substantially equivalent
to a device introduced into commercial distribution after May 28, 1976, that has
subsequently been reclassified into Class I or II, does not in any way denote
official approval of the device. Any representation that creates an impression of
official approval of a device because of complying with the premarket notification
regulations is misleading and constitutes misbranding.
Discussion
A determination of substantial equivalence by the FDA does not signify approval
of the device. Representing compliance to premarket notification requirements as
device approval is misleading and renders the device misbranded.
Regulatory Requirement 21 CFR § 807.100 FDA Action on a

Premarket Notification
a. After review of a premarket notification, FDA will:
1. Issue an order declaring the device to be substantially equivalent to a
legally marketed predicate device;
2. Issue an order declaring the device to be not substantially equivalent
to any legally marketed predicate device;
3. Request additional information; or

4. Withhold the decision until a certification or disclosure statement is
submitted to FDA under part 54 of this chapter.
5. Advise the applicant that the premarket notification is not required.
Until the applicant receives an order declaring a device substantially
equivalent, the applicant may not proceed to market the device.
b. FDA will determine that a device is substantially equivalent to a
predicate device using the following criteria:
1. The device has the same intended use as the predicate device; and
2. The device:
(i) Has the same technological characteristics as the predicate
device; or
(ii) (A) Has different technological characteristics, such as a
significant change in the materials, design, energy source,
or other features of the device from those of the predicate
device;
(B) T
he data submitted establishes that the device is substantially
equivalent to the predicate device and contains information,
including clinical data if deemed necessary by the
Commissioner, that demonstrates that the device is as safe
and as effective as a legally marketed device; and
(C) Does not raise different questions of safety and effectiveness
than the predicate device.
3. The predicate device has not been removed from the market at the
initiative of the Commissioner of Food and Drugs or has not been
determined to be misbranded or adulterated by a judicial order.
Discussion
Following its review of a premarket notification submission, the FDA may take
one of several actions. The agency may determine the device is substantially
equivalent or not substantially equivalent, request additional information,
withhold a decision until receipt of financial disclosure or statement by clinical
investigators (as appropriate), or advise the device is exempt from premarket
notification requirements.
To determine a new device is substantially equivalent to a predicate device,
the FDA must determine that the new and predicate device have the same
intended use, the devices either have the same technological characteristics or
their differences do not raise different questions of safety and effectiveness, and
the new device is as safe and effective as the predicate device.
21 CFR 820 QUALITY SYSTEM REGULATION

The Quality System Regulation (QSR), promulgated as 21 CFR 820, became effective
June 1, 1997 replacing the 1978 Good Manufacturing Practice (GMP) requirements
for medical devices. The regulation provides a framework of basic requirements
for manufacturers to follow and includes requirements related to methods used in,
and facilities and controls used for the design, manufacture, packaging, labeling,
storage, installation and servicing of medical devices for human use. Refer to
Chapter 10 for detailed discussion of the QSR.
21 CFR 821 MEDICAL DEVICE TRACKING REQUIREMENTS

Manufacturers must adopt a method of tracking any Class II and Class III
devices whose failure would be reasonably likely to have serious, adverse health
consequences, are intended to be implanted in the human body for more than
one year, or are life-sustaining or life-supporting devices used outside of a device
user facility. Statutory authority for the MDR regulation is § 519 (e) of the FDCA
21 CFR Part 821 implemented tracking requirements effective as of August 29,
1993. Effective February 19, 1998, the tracking requirement has been changed to
eliminate automatic mandatory tracking for certain devices.
Regulatory Requirement 21 CFR § 821.1 Scope
a. The regulations in this part implement section 519(e) of the Federal

Food, Drug, and Cosmetic Act (the act), which provides that the Food
and Drug Administration may require a manufacturer to adopt a
method of tracking a class II or class III device, if the device meets
one of the following three criteria and FDA issues an order to the
manufacturer: the failure of the device would be reasonably likely to
have serious adverse health consequences; or the device is intended to
be implanted in the human body for more than 1 year; or the device is
a life-sustaining or life-supporting device used outside a device user
facility. A device that meets one of these criteria and is the subject of
an FDA order must comply with this part and is referred to, in this
part, as a "tracked device."
b. These regulations are intended to ensure that tracked devices can
be traced from the device manufacturing facility to the person
for whom the device is indicated, that is, the patient. Effective
tracking of devices from the manufacturing facility, through the
distributor network (including distributors, retailers, rental firms
and other commercial enterprises, device user facilities, and licensed
practitioners) and, ultimately, to the patient is necessary for the
effectiveness of remedies prescribed by the act, such as patient
notification (section 518(a) of the act) or device recall (section 518(e) of
the act). Although these regulations do not preclude a manufacturer
from involving outside organizations in that manufacturer's device

tracking effort, the legal responsibility for complying with this part
rests with manufacturers who are subject to tracking orders, and that
responsibility cannot be altered, modified, or in any way abrogated by
contracts or other agreements.
c. The primary burden for ensuring that the tracking system works
rests upon the manufacturer. A manufacturer or any other person,
including a distributor, final distributor, or multiple distributor, who
distributes a device subject to tracking, who fails to comply with any
applicable requirement of section 519(e) of the act or of this part, or
any person who causes such failure, misbrands the device within the
meaning of section 502(t)(2) of the act and commits a prohibited act
within the meaning of sections 301(e) and 301(q)(1)(B) of the act.
d. Any person subject to this part who permanently discontinues doing
business is required to notify FDA at the time the person notifies
any government agency, court, or supplier, and provide FDA with
a complete set of its tracking records and information. However, if
a person ceases distribution of a tracked device but continues to do
other business, that person continues to be responsible for compliance
with this part unless another person, affirmatively and in writing,
assumes responsibility for continuing the tracking of devices
previously distributed under this part. Further, if a person subject to
this part goes out of business completely, but other persons acquire
the right to manufacture or distribute tracked devices, those other
persons are deemed to be responsible for continuing the tracking
responsibility of the previous person under this part.
Regulatory Requirement 21 CFR § 821.2 Exemptions and Variances

a. A manufacturer, importer, or distributor may seek an exemption or
variance from one or more requirements of this part.
b. A request for an exemption or variance shall be submitted in the form
of a petition under 10.30 of this chapter and shall comply with the
requirements set out therein, except that a response shall be issued
in 90 days. The director or deputy directors, CDRH, or the director,
Office of Compliance, CDRH, shall issue responses to requests under
this section. The petition shall also contain the following:
1. The name of the device and device class and representative labeling
showing the intended use(s) of the device
2. The reasons that compliance with the tracking requirements of this
part is unnecessary
3. A complete description of alternative steps that are available, or that
the petitioner has already taken, to ensure that an effective tracking
system is in place
4. Other information justifying the exemption or variance.

c. An exemption or variance is not effective until the director, Office
of Compliance and Surveillance, CDRH, approves the request under
section 10.30(e)(2)(i) of this chapter.
Discussion
A petition for exemption or variance to the tracking regulation may be submitted
per 21 CFR § 10.30. Any petition must be formally approved by the center prior to
discontinuation of medical device tracking of any device.

The following definitions and terms apply to this part:
Act means the Federal Food, Drug, and Cosmetic Act, 21 U.S.C. 321 et seq., as
amended.
Importer means the initial distributor of an imported device who is subject
to a tracking order. "Importer" does not include anyone who only furthers the
marketing, e.g., brokers, jobbers, or warehousers.
Manufacturer means any person, including any importer, repacker and/or relabeler,
who manufactures, prepares, propagates, compounds, assembles, or processes a
device or engages in any of the activities described in 807.3(d) of this chapter.
Device failure means the failure of a device to perform or function as intended,
including any deviations from the device's performance specifications or
intended use.
Serious adverse health consequences means any significant adverse experience related
to a device, including device-related events which are life-threatening or which
involve permanent or long-term injuries or illnesses.
Device intended to be implanted in the human body for more than 1 year means a device
that is intended to be placed into a surgically or naturally formed cavity of the
human body for more than 1 year to continuously assist, restore, or replace the
function of an organ system or structure of the human body throughout the useful
life of the device. The term does not include a device that is intended and used
only for temporary purposes or that is intended for explantation in 1 year or less.
Life-supporting or life-sustaining device used outside a device user facility means a
device which is essential, or yields information that is essential, to the restoration
or continuation of a bodily function important to the continuation of human life
that is intended for use outside a hospital, nursing home, ambulatory surgical
facility, or diagnostic or outpatient treatment facility. Physicians' offices are not
device user facilities and, therefore, devices used therein are subject to tracking if
they otherwise satisfy the statutory and regulatory criteria.
Distributor means any person who furthers the distribution of a device from the
original place of manufacture to the person who makes delivery or sale to the
ultimate user, i.e., the final or multiple distributor, but who does not repackage
or otherwise change the container, wrapper, or labeling of the device or device
package.
Final distributor means any person who distributes a tracked device intended for
use by a single patient over the useful life of the device to the patient. This term
includes, but is not limited to, licensed practitioners, retail pharmacies, hospitals,
and other types of device user facilities.
Distributes means any distribution of a tracked device, including the charitable
distribution of a tracked device. This term does not include the distribution of a
device under an effective investigational device exemption in accordance with
section 520(g) of the act and part 812 of this chapter or the distribution of a device
for teaching, law enforcement, research, or analysis as specified in 801.125 of this
chapter.
Multiple distributor means any device user facility, rental company, or any other
entity that distributes a life-sustaining or life-supporting device intended for use
by more than one patient over the useful life of the device.
Licensed practitioner means a physician, dentist, or other health care practitioner
licensed by the law of the State in which he or she practices to use or order the use
of the tracked device.
Any term defined in section 201 of the act shall have the same definition in
this part.
the specific version or model of a device and the labeler of that device;
and
the device:
(v) For an HCT/P regulated as a device, the distinct identification
code required by 1271.290(c) of this chapter.
Regulatory Requirement 21 CFR § 821.4 Imported Devices

For purposes of this part, the importer of a tracked device shall be considered the
manufacturer and shall be required to comply with all requirements of this part
applicable to manufacturers. Importers must keep all information required under
this part in the United States.
Discussion
The importer of a tracked device is considered the manufacturer and therefore
must comply with the requirements of 21 CFR 821.
Subpart B—Tracking Requirements
Regulatory Requirement 21 CFR § 821.20 Devices Subject to Tracking

a. A manufacturer of any Class II or Class III device that fits within
one of the three criteria within 821.1(a) must track that device in
accordance with this part, if FDA issues a tracking order to that
manufacturer.
b. When responding to premarket notification submissions and
premarket approval applications, FDA will notify the sponsor by
issuing an order that states that FDA believes the device meets the
criteria of section 519(e)(1) of the act and, by virtue of the order, the
sponsor must track the device.
Discussion
The final decision on whether a device is to be tracked is agreed on by the firm
in conjunction with the FDA at the time of preapproval or market clearance,
or in the subsequent case of a petition or variance review. This will mean that
the firm is required to provide a system with the means to track the control
number beyond the requirements of 820.65 Traceability. The tracking regulation
requires traceability of the individual device to the patient, with a response to the
manufacturer that provides complete and accurate information about the patient
and their assigned device.
Regulatory Requirement 21 CFR § 821.25 Device Tracking System

and Content Requirements: Manufacturer Requirements
a. A manufacturer of a tracked device shall adopt a method of
tracking for each such type of device that it distributes that enables
a manufacturer to provide FDA with the following information in
writing for each tracked device distributed:
1. Except as required by order under section 518(e) of the act, within
3 working days of a request from FDA, prior to the distribution of a
tracked device to a patient, the name, address, and telephone number
of the distributor, multiple distributor, or final distributor holding the
device for distribution and the location of the device;
2. Within 10 working days of a request from FDA for tracked devices

that are intended for use by a single patient over the life of the
device, after distribution to or implantation in a patient:
(i) The unique device identifier (UDI), lot number, batch number,
model number, or serial number of the device or other
identifier necessary to provide for effective tracking of the
devices;
(ii) The date the device was shipped by the manufacturer;
(iii) The name, address, telephone number, and social security
number (if available) of the patient receiving the device unless
not released by the patient under 821.55(a);
(iv) The date the device was provided to the patient;
(v) The name, mailing address, and telephone number of the
prescribing physician;
(vi) The name, mailing address, and telephone number of the
physician regularly following the patient if different than the
prescribing physician; and
(vii) If applicable, the date the device was explanted and the name,
mailing address, and telephone number of the explanting
physician; the date of the patient’s death; or the date the device
was returned to the manufacturer, permanently retired from
use, or otherwise permanently disposed of.
3. Except as required by order under section 518(e) of the act, within
10 working days of a request from FDA for tracked devices that are
intended for use by more than one patient, after the distribution of
the device to the multiple distributor:
(i) The unique device identifier (UDI), lot model number, batch
number, serial number of the device, or other identifier
necessary to provide for effective tracking of the device;
(ii) The date the device was shipped by the manufacturer;
(iii) The name, address, and telephone number of the multiple
distributor;
(iv) The name, address, telephone number, and social security
number (if available) of the patient using the device, unless not
released by the patient under 821.55(a);
(v) The location of the device;
(vi) The date the device was provided for use by the patient;
(vii) The name, address, and telephone number of the prescribing
physician; and
(viii) If and when applicable, the date the device was returned to
the manufacturer, permanently retired from use, or otherwise
permanently disposed of.
b. A manufacturer of a tracked device shall keep current records in

accordance with its standard operating procedure of the information
identified in paragraphs (a)(1), (a)(2), and (a)(3)(i) through (a)(3)(iii) of
this section on each tracked device released for distribution for as
long as such device is in use or in distribution for use.
c. A manufacturer of a tracked device shall establish a written standard
operating procedure for the collection, maintenance, and auditing
of the data specified in paragraphs (a) and (b) of this section. A
manufacturer shall make this standard operating procedure available
to FDA upon request. A manufacturer shall incorporate the following
into the standard operating procedure:
1. Data collection and recording procedures, which shall include a
procedure for recording when data that are required under this part
are missing and could not be collected and the reason why such
required data are missing and could not be collected;
2. A method for recording all modifications or changes to the tracking
system or to the data collected and maintained under the tracking
system, reasons for any modification or change, and dates of any
modification or change. Modification and changes included under
this requirement include modifications to the data (including
termination of tracking), the data format, the recording system, and
the file maintenance procedures system; and
3. A quality assurance program that includes an audit procedure to
be run for each device product subject to tracking, at not less than
6-month intervals for the first 3 years of distribution and at least once
a year thereafter. This audit procedure shall provide for statistically
relevant sampling of the data collected to ensure the accuracy of data
and performance testing of the functioning of the tracking system.
d. When a manufacturer becomes aware that a distributor, final
distributor, or multiple distributor has not collected, maintained,
or furnished any record or information required by this part, the
manufacturer shall notify the FDA district office responsible for
the area in which the distributor, final distributor, or multiple
distributor is located of the failure of such persons to comply with the
requirements of this part. Manufacturers shall have taken reasonable
steps to obtain compliance by the distributor, multiple distributor, or
final distributor in question before notifying FDA.
e. A manufacturer may petition for an exemption or variance from one
or more requirements of this part according to the procedures in 821.2
of this chapter.
Subpart C—Additional Requirements and Responsibilities
Regulatory Requirement 21 CFR § 821.30 Tracking Obligations

of Persons Other Than Device Manufacturers: Distributor
Requirements
a. A distributor, final distributor, or multiple distributor of any tracked
device shall, upon purchasing or otherwise acquiring any interest in
such a device, promptly provide the manufacturer tracking the device
with the following information:
1. The name and address of the distributor, final distributor, or multiple
distributor;
2. The unique device identifier (UDI), lot number, batch number, model
number, or serial number of the device or other identifier used by the
manufacturer to track the device;
3. The date the device was received;
4. The person from whom the device was received;
5. If and when applicable, the date the device was explanted, the date
of the patient’s death, or the date the device was returned to the
distributor, permanently retired from use, or otherwise permanently
disposed of.
b. A final distributor, upon sale or other distribution of a tracked device
for use in or by the patient, shall promptly provide the manufacturer
tracking the device with the following information:
1. The name and address of the final distributor;
2. The unique device identifier (UDI), lot number, batch number, model
number, or serial number of the device or other identifier used by the
manufacturer to track the device;
3. The name, address, telephone number, and social security number (if
available) of the patient receiving the device, unless not released by
the patient under 821.55(a);
4. The date the device was provided to the patient or for use in
the patient;
5. The name, mailing address, and telephone number of the
6. The name, mailing address, and telephone number of the physician
regularly following the patient if different than the prescribing
physician; and
7. When applicable, the date the device was explanted and the name,
mailing address, and telephone number of the explanting physician,
the date of the patient’s death, or the date the device was returned
to the manufacturer, permanently retired from use, or otherwise
permanently disposed of.
c. 1. A
multiple distributor shall keep written records of the following
each time such device is distributed for use by a patient:
(i) The unique device identifier (UDI), lot number, batch number,
model number, or serial number of the device or other
identifier used by the manufacturer to track the device;
(ii) The name, address, telephone number, and social security
number (if available) of the patient using the device;
(iii) The location of the device, unless not released by the patient
under 821.55(a);
(iv) The date the device was provided for use by the patient;
(v) The name, address, and telephone number of the
(vi) The name, address, and telephone number of the physician
regularly following the patient if different than the prescribing
physician; and
(vii) When applicable, the date the device was permanently retired
from use or otherwise permanently disposed of.
2. Except as required by order under section 518(e) of the act, any
person who is a multiple distributor subject to the record-keeping
requirement of paragraph (c)(1) of this section shall, within five
working days of a request from the manufacturer or within 10
working days of a request from FDA for the information identified
in paragraph (c)(1) of this section, provide such information to the
manufacturer or FDA.
d. A distributor, final distributor, or multiple distributor shall make
any records required to be kept under this part available to the
manufacturer of the tracked device for audit upon written request by
an authorized representative of the manufacturer.
e. A distributor, final distributor, or multiple distributor may petition for
an exemption or variance from one or more requirements of this part
according to the procedures in 821.2.
Discussion
The device manufacturer shall establish the method of tracking. The method
should also be well understood and implemented by the distributor(s). All
associated business processes and operating systems should include the method
and responsibilities to ensure that the tracking is carried forward to the user
facility upon delivery of the device. The manufacturer must provide a mechanism
within the system to ensure that distributor and patient information is received
back into the manufacturer quality system in a timely manner. There are detailed
requirements for the manufacturer and distributor(s) to provide information
within a specified time frame to FDA regarding the device, patient, and physician.
In the event that the distributors are remiss in carrying out their duties within the
process of device tracking, FDA will be expected to get involved to assure that
the tracking information is always complete, accurate, and current. It is up to the
manufacturer to notify FDA in the event of any system breakdown on the part of
the distributor that cannot otherwise be resolved.
Key consideration: the most effective way to ensure that distributors are aware
of tracking requirements is to build the requirements into the business contract
with the distributor. In addition to providing the requirements in the contract, it
is highly recommended that the method used to ensure device tracking through
distribution is for the manufacturer and the distributor to design and agree to the
process. Periodically, that system should be challenged by means of a mock recall,
as well as audits of the inventory, records, and quality system.
Subpart D—Records and Inspections
Regulatory Requirement 21 CFR § 821.50 Availability
a. Manufacturers, distributors, multiple distributors, and final

distributors shall, upon the presentation by an FDA representative of
official credentials and the issuance of Form FDA 482 at the initiation
of an inspection of an establishment or person under section 704 of
the act, make each record and all information required to be collected
and maintained under this part and all records and information
related to the events and persons identified in such records available
to FDA personnel.
b. Records and information referenced in paragraph (a) of this section
shall be available to FDA personnel for purposes of reviewing,
copying, or any other use related to the enforcement of the act and
this part. Records required to be kept by this part shall be kept in
a centralized point for each manufacturer or distributor within the
United States.
Discussion
Records and information required by this part must be made available to
authorized FDA personnel. Such records and information for each manufacturer
and distributor must be maintained at a centralized location in the US.
Regulatory Requirement 21 CFR § 821.55 Confidentiality

a. Any patient receiving a device subject to tracking requirements
under this part may refuse to release, or refuse permission to release,
the patient's name, address, telephone number, and social security
number, or other identifying information for the purpose of tracking.
b. Records and other information submitted to FDA under this part shall
be protected from public disclosure to the extent permitted under Part
20 of this chapter, and in accordance with section 20.63 of this chapter,

information contained in such records that would identify patient or
research subjects shall not be available for public disclosure except as
provided in those parts.
c. Patient names or other identifiers may be disclosed to a manufacturer
or other person subject to this part or to a physician when the health
or safety of the patient requires that such persons have access to the
information. Such notification will be pursuant to agreement that
the record or information will not be further disclosed except as
the health aspect of the patient requires. Such notification does not
constitute public disclosure and will not trigger the availability of the
same information to the public generally.
Discussion
Patients with tracked devices are allowed to refuse disclosure of personal
information. Medical device tracking records submitted to FDA are protected
from public disclosure to the extent allowed.
Regulatory Requirement 21 CFR § 821.60 Retention of Records

Persons required to maintain records under this part should maintain such
records for the useful life of each tracked device they manufacture or distribute.
The useful life of a device is the time a device is in use or in distribution for use.
For example, a record may be retired if the person maintaining the record becomes
aware of the fact that the device is no longer in use, has been explanted, returned
to the manufacturer, or the patient has died.
Discussion
All record requirements under this section must be established in a formally
documented system. Every point in the process where the system requires
responsibility and action should be clearly defined within that system (i.e.,
manufacturer, distributor, retailer, rental firm, user facilities, and other licensed
practitioners). The outputs from that system that provide evidence of accuracy,
completeness, and current status of each device and the associated patient must
be available during internal audits and investigations, as well as for FDA during
site inspections. Those records and all information contained therein will remain
confidential at all times. The records should be maintained while the device is in
functional use. If there is no proof that the device has been explanted or returned,
or that the patient has died, then those records should be maintained.
Chapter 6
The EU Medical Device Directives
There are three EU directives that apply specifically to medical devices:

• Active Implantable Medical Devices Directive 90/385/EEC (AIMDD)
• Medical Device Directive 93/42/EEC (MDD)
• In Vitro Diagnostic Directive 98/79/EC (IVDD)
The EU directives are actually addressed to EU member states and require EU
member states to transpose the directives into local member state regulations.
Strictly speaking, manufacturers are required to comply with the local member
state regulations of each market in which they place devices; however, in practice
most manufacturers start with the directives and then use other mechanisms to
address local transpositions.
Medical devices and in vitro diagnostic (IVD) medical devices that are to be
placed on the market in the European Economic Area (EEA) are required to have
a CE marking affixed (unless the devices are permitted to be placed on the market
without a mark for medical device clinical investigation, or are custom made or
are for IVD performance evaluation). The requirements for medical devices and
IVDs are defined in the three European directives that divide devices into three
separate regulatory areas:
• Active implantable medical devices
• Medical devices
• In vitro diagnostic devices
The three directives need to be considered as a set since the AIMDD was amended
by the MDD, and the IVDD amended the MDD. Manufacturers should also be
aware that other EU directives have amended the three core directives and added
to or amended the original directive’s requirements:
• Blood derivatives (2000/70/EC and 2001/104/EC)
• Animal tissue (2003/32/EC)
• Reclassification of breast implants (2003/12/EC)
• Reclassification of hip, knee, and shoulder joint implants (2005/50/EC)
• Amendment of Medical Device Directive (2007/47/EC)
139
There are also EU directives that may be applicable, partially or in whole, to

medical devices and may be required for CE marking and market access:
• Cosmetic products (76/768/EEC)
• Medicinal products for human use products (2004/27/EC)
• Personal protective equipment (89/686/EC), which will be replaced
April 2018 by Regulation (EU) 2016/425
• Telecommunication equipment (RTTE) (1999/5/EC), which was replaced
by the Radio Equipment Directive (RED) 2014/53/EC in June 2016 with
a one-year transitional period
• Waste electrical and electronic equipment (WEEE) (2002/96/EC and
2012/19/EU)
• Restriction on certain hazardous substances in electrical and electronic
equipment (RoHS) (2011/65/EU)
• Pressure equipment (97/23/EC)
• Machinery (2006/42/EC)
• Electrical equipment designed for use within certain voltage limits
(low voltage) (2006/95/EC)
PURPOSE OF THE MEDICAL DEVICE DIRECTIVES

The purpose of the EU medical device directives is to harmonize the regulations
and administrative provisions among the member states of the EEA and ensure
the safety, health, protection, and performance characteristics of medical devices
and in vitro diagnostic devices.
The format of the directives consists of a number of articles that cover
definitions, scope, free movement of CE marked devices, standards, conformity
assessment, and reporting of device incidents. These are followed by a number
of annexes that include coverage of the essential requirements for product safety
and performance, conformity assessment procedures, classification criteria, and
clinical evaluation requirements.
Before a manufacturer can place the CE marking on a medical device and
legally sell to or within the EEA, it must be in compliance with all the requirements
of the applicable directive.
REQUIREMENTS FOR COMPLIANCE

The following items should be considered in preparing for and demonstrating
compliance with the directives:
• Determination of whether the product has to comply with one of
the EU medical device directives and other directives that may be
appropriate
Chapter 21
Reprocessing/Reuse and
Cleaning of Medical Devices
I
n recent years medical devices have become increasingly complex, and that has
led to the manufacture of devices that are more difficult to clean and disinfect
or sterilize. Scientific advances in the knowledge and technology involved
in reprocessing reusable medical devices have also been observed. Proper
reprocessing of reusable medical devices is necessary to help assure these devices
remain safe and effective over their intended lifetime of multiple reuses and can
be appropriately prepared for their next clinical use.
FDA DRAFT GUIDANCE

The US Food and Drug Administration released its Draft Guidance for Industry
and Staff; Processing/Reprocessing Medical Devices in Health Care Settings: Validation
Methods and Labeling on May 2, 2011. The primary purpose of the guidance is to
ensure that reusable medical devices are appropriate and safe for their application
when reprocessed and reused. Both the manufacturer and user of a reusable
device have responsibilities to ensure the safe and effective reprocessing of
reusable medical devices.
This draft guidance provides recommendations regarding labeling and
validation of reprocessing instructions for reusable devices. The draft guidance
document does not apply to processes used in industrial setting to manufacture
single-use devices intended to be sold sterile or to the reprocessing of devices
labeled for single-use. The draft guidance specifically applies to three device
reprocessing situations:
• Reusable medical devices initially supplied sterile and requiring
the end user to process the device after initial use (i.e., cleaning and
disinfection or sterilization) before use with a subsequent patient.
• Reusable medical devices initially supplied non-sterile and requiring
the end user to disinfect or sterilize the initial packaged device and
subsequently reprocess the device after initial use (i.e., cleaning and
disinfection or sterilization).
• Single-use medical devices initially supplied non-sterile and requiring
the end user to sterilize the device prior to its use.
283
284 Part III: Technical Biomedical Knowledge
NOTE: This draft guidance was replaced with the issuance of Reprocessing Medical
Devices in Health Care Settings: Validation Methods and Labeling; Guidance for Industry
and Food and Drug Administration Staff171 on March 17, 2015.
PROCESS OVERVIEW
Three steps are identified in the reprocessing of reusable medical devices:
• Reprocessing starts at the point of clinical use with initial cleaning
and to prevent drying of soil and contaminants in and on the device;
• The reusable device is thoroughly cleaned in a dedicated cleaning
area; and
• Depending on its intended use, the device is disinfected or sterilized
and routed back into use.
LABELING FOR REUSABLE DEVICES

To comply with the requirements for adequate directions for use per 21 CFR
Part 801, a reusable device should include reprocessing instructions. Provision
of adequate and effective reprocessing instructions requires development of
the cleaning process and disinfection or sterilization method, and validation of
the cleaning process, disinfection, or sterilization method to demonstrate the
instructions are complete and understandable.
Cleaning, disinfection, and sterilization are distinct processes and therefore
should be validated separately. FDA will review labeling of reusable devices
containing reprocessing instructions. If a US premarket submission is required
for a device, these validations should therefore be completed prior to making a
submission and adequate reprocessing instructions provided in the labeling.
FDA’S CRITERIA FOR REPROCESSING INSTRUCTIONS

The FDA draft guidance provides seven criteria for reprocessing instructions
it considers appropriate to ensure users understand and correctly follow the
reprocessing instructions. The criteria are:
1. Labeling should reflect the intended use of the device.
2. All reprocessing instructions for reusable devices should advise users
to thoroughly clean the device.
3. The instructions should indicate the appropriate microbicidal process
for the device.
4. Reprocessing recommendations should be technically feasible.
5. The reprocessing instructions should only include devices and
accessories that are legally marketed.
6. The instructions should be comprehensive.
7. The instructions should be understandable.
Chapter 21: Reprocessing/Reuse and Cleaning of Medical Devices 285
VALIDATION OF REPROCESSING METHODS

Manufacturers are required to validate the design of reusable devices and the
reprocessing methods associated with reuse, in accordance with 21 CFR Part 820,
to ensure the device can be effectively reprocessed over its life. Devices subject
to design controls under § 820.30 must consider labeling, including reprocessing
instructions, during design validation to assure user needs and intended uses
are met.
Any known postmarket human factors issues with the specific reusable device
or a similar device should be addressed when developing reprocessing instruc
tions. Such issues may be identifiable by reviewing complaint files, published
literature, and reported adverse events. Reprocessing instructions should also be
validated under design controls to ensure users will be able to understand and
follow the instructions.
VALIDATION OF CLEANING PROCESS

The FDA recommends developed cleaning processes and instructions are validated
to demonstrate that reprocessing methods are adequate to allow the device to
undergo further processing and the reprocessing instructions effectively convey
the reprocessing methods. Validation of the cleaning process should use soils that
are clinically relevant to the device, specify predetermined acceptance criteria for
cleaning endpoints, address the most inaccessible device locations (e.g., mating
surfaces, lumens), and include a statistically relevant number of replicate samples.
Cleaning validations should use an artificial soil that creates the worst
case challenge to the cleaning process, inoculate the device in all locations that
are likely to contact the patient or that are difficult to clean, and simulate use
conditions. Cleaning validation protocols should be conducted under challenge
conditions, e.g., shortest contact time, lowest temperature, weakest dilution, to
account for worst case cleaning process conditions.
VALIDATION OF TERMINAL REPROCESSING

The guidance recommends disinfection processes are validated in accordance with
product-specific FDA guidance documents and recognized consensus standards.
Similarly, the FDA recommends sterilization validation is completed in accordance
with applicable FDA guidance documents and recognized consensus standards.
Where possible, validation of terminal reprocessing should be completed in
FDA-cleared equipment, e.g., medical washer-disinfector, sterilizer.
Part IV
Quality Tools and Techniques
Chapter 22 Quality Control and Problem-Solving Tools
Chapter 23 Process Improvement Techniques
Chapter 24 Data Types and Sampling
287
Chapter 22
Quality Control and
Problem-Solving Tools
A
uditors may or may not use these basic tools during an audit, but they will
need to understand and interpret them. These tools, in a large part, form
the basis for the language of quality. Auditors must be able to recognize
them, understand their purpose, interpret their results, and often determine
whether the tool chosen is appropriate for the task and properly applied.
Quality tools can help you identify causes, understand processes, collect and
analyze data, generate ideas, keep projects on track, and make informed decisions
for all of your continuous improvement activities. Statistical methods such as
process capability and sampling are additional tools for an auditor, especially
when determining how many records should be reviewed during an audit. Each
tool will be introduced and explained, indicating how and why they are used.
PARETO CHARTS
A Pareto chart is used to graphically summarize and display the relative importance
of the differences between groups of data. The Pareto principle states that 20% of
causes determine 80% of problems. For example, 80% of delays in schedule arise
from 20% of the possible causes of the delays. A Pareto chart quickly helps to
identify issues through a visual depiction of the data from the highest impact to
lowest impact on quality. Figure 22.1 is an example of a Pareto chart.
CAUSE AND EFFECT

The cause-and-effect diagram, sometimes called an Ishikawa diagram or fishbone
diagram, is used to associate multiple possible causes with a single effect. Thus,
given a particular effect, the diagram is constructed to identify and organize
possible causes for it. The primary branch represents the effect (the quality
characteristic that is intended to be improved and controlled) and is typically
labeled on the right side of the diagram. Each major branch of the diagram
corresponds to a major cause (or class of causes) that directly relates to the effect.
Minor branches correspond to more detailed causal factors. This type of diagram
is useful in any analysis, as it illustrates the relationship between cause and effect
in a rational manner. Causes can be derived from brainstorming sessions. These
groups can then be labeled as categories of the fishbone. Causes can be traced
back to root causes using this technique. Figure 22.2 is an example of a cause-and-
effect diagram.
288
Chapter 22: Quality Control and Problem-Solving Tools 289
Pareto Chart of Defect Category
250 100
200 80
Frequency
Percent
150 60
100 40
50 20
0 0
d r t l e g s r
ea se tro ttl Ja
m
sin at
e he
isr e
In Co
n Bo tte is cu
l Ot
M g f ed e M ti
de ka to f ill uv ber Par
Co c u er C
r Pa O d u m
Ba No t or Un tN
ra Lo
l ib
Ca
Frequency 105 54 29 21 19 12 10 6
Percent 41.0 21.1 11.3 8.2 7.4 4.7 3.9 2.3
Cum % 41.0 62.1 73.4 81.6 89.1 93.8 97.7 100.0
Figure 22.1 Pareto chart.
Measurements Material Personnel
Accuracy Paper Stock Customers
Number of Scans Ink QC
Bar Code
Misreads
Processing Software
Humidity
Procedure Computer
Heat
Location of Scanners
Bar Code
Dirt Printers
Environment Methods Machines
Figure 22.2 Cause-and-effect diagram.

290 Part IV: Quality Tools and Techniques
FLOWCHARTS
A flowchart is a pictorial representation of a process. By breaking the process
down into its constituent steps, flowcharts can be useful in identifying where
errors are likely to be found in the system. Flowcharts use special shapes to
represent different types of actions or steps in a process. Lines and arrows show the
sequence of the steps, and the relationships among them. Flowcharts are flexible
and are a common tool for quality practitioners. Medical device companies use
flowcharts as part of their risk management process to identify potential harms.
They are also used in software development processes to map out scenarios for
determining when alarms should be activated. Figure 22.3 shows an example of
a flowchart. The diamonds are decision points where potential risks or errors
can occur.
Process Flowchart: IEC/ISO 62366
Medical purpose Research

Patient population Application
Intended users specification
Use context Usability
Use Error Risk Analysis specification
User interface
Task analysis requirements
Primary operating FMEA
functions Usability Objectives
Use errors
Iterative Design Design outputs

and Risk Mitigation
Usability goals
Formative protocol Usability Verification Formative usability
Discussion guide report
Usability
Objectives Attainable
Figure 22.3 Process flowchart.

STATISTICAL PROCESS CONTROL

There are several methods used to trend data in order to highlight both the
preventative and corrective nature of the system. Plotting data over time is a good
visual method to identify trends. Statistical process control (SPC) techniques such
as control charts provide an objective method to identify trends. Statistical process
control is based on the idea of separating the common cause (inherent variation)
from the special cause (unexpected variation). Control charts are a method to
assess whether the process variation is consistent or unpredictable. Control charts
can be used with variable (continuous) and attribute (discrete) data; there are two
charts for variables and four charts for attributes.
The two variables charts are:
1. X-bar and range/standard deviation charts
2. Individual with a moving range charts
The four attribute charts are:
1. p charts (percent defective charts)
2. c charts (defect charts)
3. np charts (number of rejects charts)
4. u charts (defects per unit charts)
X-bar and range/standard deviation charts are used when sub-groups of data
are collected. An individual chart is used when a single data point is taken at a
given time point. The p chart is used to estimate the percent defective. The c chart
measures the number of defects in a sample when all subgroups are equal. The np
chart is similar to the p chart with restriction of a constant subgroup size. The u
chart measures the number of nonconformities per unit.
CHECK SHEETS
The check sheet is used to collect data in real time at the location where the data
is generated. The data can be quantitative (numerical) or qualitative (descriptive).
Check sheets are used when data can be observed and collected repeatedly by the
same person or at the same location. It is primarily used when collecting data on
the frequency or patterns of events, problems, defects or defect location.
SCATTER PLOT
Scatter plots are simple to construct and might be your best analysis when you
first look at a new situation. These are simply X-Y charts (graphs) where the output
(dependent variable) is usually shown on the Y-axis and the drivers (independent
variable) on the X-axis. All dots grouped along a rough curve (or straight line)
indicate further analysis could be valuable. A scatter plot can suggest correlations
between variables. Correlations may be positive (rising), negative (falling), or
uncorrelated. A formal statistical analysis using regression techniques with an
equation for the line can be employed to study the relationship between the
variables. Figure 22.4 shows an example of a scatter plot.
70
60
50
Noise (dB)
40
30
20
10
3.8 4.0 4.2 4.4 4.6 4.8 5.0 5.2
Voltage Applied
Figure 22.4 Scatter plot.
HISTOGRAMS
A histogram is used to assess the shape and spread of continuous sample data.
Use a histogram prior to or in conjunction with an analysis to help confirm
assumptions and guide further analysis. Histograms are sometimes confused
with bar charts. A histogram is used for continuous data, where the bins represent
ranges of data, while a bar chart is a plot of categorical variables. Figure 22.5 is an
example of a histogram.
ROOT CAUSE ANALYSIS

Root cause analysis (RCA) is a method to determine the cause of an ordered
sequence of events that lead to an outcome or effect of interest. Commonly, root
cause is used to describe the depth in the course of events where an intervention
could reasonably be implemented to change performance and prevent an
undesirable outcome. Quality tools such as the five whys and cause-and-effect
diagrams are useful to identify the root cause. RCA is a four-step process involving
the following:
• Data collection
• Causal factor charting
• Root cause identification
• Recommendation generation and implementation.172
12
10
8
Frequency
0
82 84 86 88 90 92 94
CB1
Figure 22.5 Histogram.
PLAN-DO-CHECK-ACT
Plan-do-check-act (PDCA) is an iterative four-step process attributed to Dr. W.
Edwards Deming. Plan addresses the what and why of the problem. The do is
the experimental phase where you test your plan. Check involves comparing
the output of the experiments with the expectations of the plan. Action is taken
based on the output, either to implement a change or to revise your experiment
or hypothesis.
Chapter 23
Process Improvement Techniques
A
number of techniques are available that would be considered quality tools.
This chapter provides a brief explanation of several.
PROCESS CAPABILITY
Process capability compares the output of an in-control process to the specification
limits by using capability indices. The comparison is made by forming the ratio of
the spread between the process specifications (the specification “width”) and the
spread of the process values, as measured by six process standard deviation units
(the process “width”).
SIX SIGMA
Six Sigma is a business management strategy originally developed by Motorola
USA in 1986. Six Sigma became well known after Jack Welch made it a central
focus of his business strategy at General Electric in 1995, and today it is widely
used in many sectors of industry.
Six Sigma seeks to improve the quality of process outputs by identifying
and removing the causes of defects (errors) and minimizing variability in manu
fact uring and business processes. It uses a set of quality management methods,
including statistical methods, and creates a special infrastructure of people
within the organization (e.g., Black Belts, Green Belts) who are experts in these
methods. Each Six Sigma project carried out within an organization follows a
defined sequence of steps and has quantified financial targets (cost reduction
and/or profit increase).
The term Six Sigma originated from terminology associated with manufac
turing, specifically with statistical modeling of manufacturing processes. The
maturity of a manufacturing process can be described by a sigma rating indicating
its yield, or the percentage of defect-free products it creates. A six sigma process is
one in which 99.99966% of the products manufactured are statistically expected to
be free of defects (3.4 defects per million). Motorola set a goal of six sigma for all of
its manufacturing operations, and this goal became a byword for the management
and engineering practices used to achieve it.
294
Chapter 23: Process Improvement Techniques 295
LEAN TOOLS
The term lean thinking refers to the use of ideas originally employed in lean
manufacturing to improve functions in all departments of an enterprise. The
National Institute of Standards and Technology (NIST), through its Manufacturing
Extension Partnership, defines lean as “a systematic approach to identifying and
eliminating waste (non-value-added activities) through continuous improvement
by flowing the product at the pull of the customer in pursuit of perfection.” ASQ
defines non-value-added as “a term that describes a process step or function that is
not required for the direct achievement of process output. This step or function is
identified and examined for potential elimination.”
Lean manufacturing seeks to eliminate or reduce these wastes by use of the
following:
• Teamwork with well-informed, cross-trained employees who participate
in the decisions that impact their function
• Clean, organized, and well-marked work spaces
• Flow systems instead of batch and queue systems (that is, reduce batch
size toward its ultimate ideal, one)
• Pull systems instead of push systems (that is, replenish what the
customer has consumed)
• Reduced lead times through more efficient processing, setups, and
scheduling
The history of lean thinking may be traced to Eli Whitney, who is credited with
spreading the concept of part interchangeability. Henry Ford, who went to great
lengths to reduce cycle times, furthered the idea of lean thinking and later the
Toyota Production System (TPS) packaged most of the tools and concepts now
known as lean manufacturing.173
MEASUREMENT SYSTEMS ANALYSIS

Measurement systems analysis (MSA) is used to understand and quantify
the variability associated with measurements and measurement systems. All
processes, no matter how well they are designed and executed, possess the
component of variability. It is only the degree of variability that varies from
process to process.
The third edition of Measurement Systems Analysis Reference Manual (2002),
from the Automotive Industry Action Group (AIAG), defines measurement as “the
assignment of numbers [or values] to material things to represent the relations
among them with respect to particular properties.” Similarly, the manual defines
a measurement system as “the collection of instruments or gauges, standards,
operations, methods, fixtures, software, personnel, environment and assumptions
used to quantify a unit of measure or fix assessment to the feature characteristic
being measured; the complete process used to obtain measurements.”
“MSA” is commonly used interchangeably with “gage repeatability and
reproducibility” (gage R&R). MSA is a more comprehensive analysis quantifying
variability components from gage stability, gage bias, gage linearity, gage
repeatability, and reproducibility (that is, variability from operator measurements).
Gage R&R is, in fact, a subset or component of MSA.174
COST OF QUALITY
Cost of quality (COQ) or quality costs is the total cost associated with making,
finding, repairing, or preventing defects. The following categories are associated
with these costs: internal failure costs, external failure costs, appraisal costs, and
prevention costs.
Internal failure costs include all the costs associated with the following: scrap,
rework, retest, downtime, yield losses, and disposition of nonconforming material.
External failure costs are those associated with defects detected after shipment
to the customer. Appraisal costs are those associated with evaluation of product
condition or status during a product’s first passage through the manufacturing
and assembly process. Prevention costs are those incurred to keep failure and
appraisal costs to a minimum.
COQ is an important indicator of the effectiveness of a company’s quality
management system. It is important to relate the cost of quality to other operational
data, for example, COQ as a percentage of sales or compared to profit.175
Chapter 24
Data Types and Sampling
QUALITATIVE VERSUS QUANTITATIVE ANALYSIS

Qualitative Analysis: Richness and Precision
The aim of qualitative analysis is a complete, detailed description. No attempt is
made to assign frequencies to the linguistic features that are identified in the data,
and rare phenomena receive (or should receive) the same amount of attention as
more frequent phenomena. Qualitative analysis allows for fine distinctions to be
drawn because it is not necessary to shoehorn the data into a finite number of
classifications. Findings of the research are not tested to discover whether they are
statistically significant or due to chance.
Quantitative Analysis: Statistically Reliable and Generalizable Results

In quantitative analysis we classify features, count them, and even construct more-
complex statistical models in an attempt to explain what is observed. Findings
can be generalized to a larger population, and direct comparisons can be made
between two corpora so long as valid sampling and significance techniques have
been used. Thus, quantitative analysis allows us to discover which phenomena
are likely to be genuine reflections of the behavior of a language or variety, and
which are merely chance occurrences. The more basic task of just looking at a
single language variety allows one to get a precise picture of the frequency and
rarity of particular phenomena, and thus their relative normality or abnormality.
However, the picture of the data that emerges from quantitative analysis is
less rich than that obtained from qualitative analysis. For statistical purposes,
classifications have to be of the hard-and-fast (so-called “Aristotelian”) type. An
item either belongs to class x or it doesn’t. As can be seen, many linguistic terms
and phenomena do not therefore belong to simple, single categories: rather, they
are more consistent with the recent notion of “fuzzy sets.”
ATTRIBUTE AND VARIABLE DATA

Basically, there are two types of data to collect as a part of a problem-solving
process: attribute data (or go/no-go information) and variable data (or measurement
information).
297
Because the level of sensitivity of a measurement depends on the precision

of the measuring device, there are times when variable data can be treated as
attribute data. For example, suppose you are producing aluminum pins that may
be smaller than 1.065 inches in diameter but not larger. Rather than measuring
each pin or even a sample of pins, you can:
• Use a plate that has a hole 1.065 inches in diameter bored through it (a
go/no-go gauge).
• Insert each pin to be inspected into the hole.
• Classify any pin that passes through the hole as acceptable, treating
others as rejects.
Thus, treating the variable as an attribute offers an efficient way to determine
whether the pin will be effective.
Performance measures, also known as process metrics or key quality
indicators, should be ratios. These ratios are the statistics that describe how well
or how poorly a process is performing. Sometimes the ratios have labels such as
defects per unit (dpu), defects per defective unit, defects per X units, or defects per
million opportunities (dpmo) or parts per million (ppm). However, there are ratios
that do not have labels, for example, Cp, the process capability index, and Cpk, the
mean-sensitive process capability index.176
Appendix A
Glossary of Terms
abnormal use—An intentional act or intentional omission of an act by the

responsible organization or user of a medical device as a result of conduct that
is beyond any further reasonable means of risk control by the manufacturer.
absorbed dose—The quantity of radiation energy imparted per unit mass of
matter. The unit of absorbed dose is the gray (Gy), where one gray is equivalent
to absorption of one joule per kilogram.
accessory—An article that, while not a device, is intended specifically by its
manufacturer to be used together with a device in accordance with the use of
the device intended by the manufacturer of the device.
accompanying document—A document accompanying a medical device and
containing information for use by those accountable for the installation, use,
and maintenance of the medical device, particularly regarding safety.
act—The Food, Drug, and Cosmetic Act (FDCA), 21 USC 321 et seq., as amended.
active implantable medical device—Any active medical device that is intended
to be totally or partially introduced, surgically or medically, into the human
body or by medical intervention into a natural orifice, and that is intended to
remain after the procedure.
active medical device—Any medical device relying for its functioning on a source
of electrical energy or any source of power other than that directly generated
by the human body or gravity.
aeration—The removal of ethylene oxide and its reaction products (such as ethylene
chlorohydrin) from a medical device using forced warm air ventilation.
aseptic—A condition resulting from a process in which sterile product is packaged
in sterile containers in a manner that avoids contamination of the product, for
example, the aseptic filling of sterile vials with sterile liquid.
audit—A systematic and independent examination to determine whether quality
activities and related results comply with planned arrangements, and whether
these arrangements are implemented effectively and are suitable to achieve
objectives.
299
300 Appendix A
audit language—The language(s) routinely used for the communication or

exchange of information between auditee’s personnel and auditors.
auditee—Any organization whose quality systems are to be audited for compliance
with the relevant medical device regulatory requirements.
auditing organization—A body designated, on the basis of specific regulations,
to carry out audits according to assigned tasks.
auditor—A person with relevant qualifications and competence to perform audits
or specified parts of such audits and who belongs to, or is authorized by, the
auditing organization.
authorized representative (EU)—Any natural or legal person established in the
community who, explicitly designated by the manufacturer, acts and may
be addressed by authorities and bodies in the community instead of the
manufacturer with regard to the latter’s obligations under this directive.
bacteriostasis/fungistasis test—A test that utilizes selected microorganisms to
demonstrate the presence of substances that may inhibit the multiplication of
the microorganisms.
batch—A defined quantity of bulk, intermediate, or finished product that is
intended or purported to be uniform in character and quality and which has
been produced during a defined cycle of manufacture.
bioburden—The population of living microorganisms, bacterial and fungal, on a
raw material, component, finished product, or package.
biological indicator—A carrier inoculated with a known microorganism with a
known resistance to the sterilization process under study.
calibration—The comparison of a measurement system or device of unknown
accuracy to a measurement system or device of known accuracy to detect,
correlate, report, or eliminate by adjustment any variation from the required
performance limits of the unverified measurement system or device.
commercial distribution (21 CFR § 807.3 (b))—Any distribution of a device
intended for human use that is held or offered for sale but does not include
the following: (1) internal or interplant transfer of a device between
establishments within the same parent, subsidiary, and/or affiliate company;
(2) any distribution of a device intended for human use that has in effect
an approved exemption for investigational use under section 520(g) of the
act and Part 812 of this chapter; (3) any distribution of a device, before the
effective date of Part 812 of this chapter, that was not introduced or delivered
for introduction into interstate commerce for commercial distribution before
May 28, 1976, and that is classified into Class III under section 513(f) of the act,
provided that the device is intended solely for investigational use, and under
section 501(f)(2)(A) of the act the device is not required to have an approved
premarket approval application as provided in section 515 of the act; or (4) for
foreign establishments, the distribution of any device that is neither imported
nor offered for import into the United States.
Glossary of Terms 301
commissioning—Developing the evidence that equipment has been provided

and installed in accordance with its specification and that it functions
within predetermined limits when operated in accordance with operational
instructions.
complaint—Any written, electronic, or oral communication that alleges
deficiencies related to the identity, quality, durability, reliability, safety,
effectiveness, or performance of a device after it is released for distribution.
component—Any raw material, substance, piece, part, software, firmware,
labeling, or assembly that is intended to be included as part of the finished,
packaged, and labeled device.
contract sterilizer—Any facility that offers to provide a contractual service
intended to sterilize products that are manufactured by another establishment.
control number—Any distinctive symbols, such as a distinctive combination
of letters or numbers or both, from which the history of the manufacturing,
packaging, labeling, and distribution of a unit, lot, or batch of finished devices
can be determined.
correction—An action taken to eliminate a detected nonconformity (for example,
repair or rework). A correction can be taken in conjunction with a corrective
action.
corrective action—An action taken to eliminate the cause of a detected
nonconformity or other undesirable situation. Corrective action is taken to
prevent recurrence of a nonconformity.
D value—The exposure time to a sterilizing process that is required to produce
a 1-logarithm or 90 percent reduction in the population of a microorganism,
usually an indicator organism.
design history file (DHF)—A compilation of records that describe the design
history of a finished device.
design input—The physical and performance requirements of a device that are
used as a basis for device design.
design output—The results of a design effort at each design phase and at the
end of the total design effort. The finished design output is the basis for the
device master record. The total finished design output consists of the device,
its packaging and labeling, and the device master record.
design review—A documented, comprehensive, systematic examination of a
design to evaluate the adequacy of the design requirements, to evaluate the
capability of the design to meet these requirements, and to identify problems.
design validation—Establishing by objective evidence that device specifications
conform with user needs and intended use(s).
device failure—The failure of a device to perform or function as intended,
including any deviations from the device’s performance specifications or
intended use.
302 Appendix A
device for self-testing—Any device intended by the manufacturer to be used by

laypersons in a home environment.
device history record (DHR)—A compilation of records containing the production
history of a finished device.
device intended to be implanted in the human body for more than one year—
A device that is intended to be placed into a surgically or naturally formed
cavity of the human body for more than one year to continuously assist,
restore, or replace the function of an organ system or structure of the human
body throughout the useful life of the device. The term does not include
a device that is intended and used only for temporary purposes or that is
intended for explantation in one year or less.
device master record (DMR)—A compilation of records containing the procedures
and specifications for a finished device.
directions for use—Directions under which the practitioner or layman (for
example, patient or unlicensed health care provider), as appropriate, can use
the device safely and for the purposes for which it is intended. Directions
for use also include indications for use and appropriate contraindications,
warnings, precautions, and adverse reaction information. Directions for use
requirements applicable to prescription and over-the-counter devices appear
throughout 21 CFR Part 801 and, in the case of in vitro diagnostic products,
under 21 CFR § 809.10.
distributes—Any distribution of a tracked device, including the charitable
distribution of a tracked device. This term does not include the distribution
of a device under an effective investigational device exemption in accordance
with Section 520(g) of the FDCA and 21 CFR Part 812, or the distribution of
a device for teaching, law enforcement, research, or analysis as specified in
21 CFR § 801.125.
distributor—Any person who furthers the distribution of a device from the
original place of manufacture to the person who makes delivery or sale to
the ultimate user, that is, the final or multiple distributor, but who does not
repackage or otherwise change the container, wrapper, or labeling of the
device or device package.
dosimeter—A device or system having a reproducible, measurable response to
radiation, which can be used to measure the absorbed dose in a given material.
environmental controls—Those controls and standardized procedures used in
manufacturing areas to control bioburden levels. Such controls may include
air filters, fluid filters, use of surface disinfectants, personnel gowning or
uniforms, and personnel training.
establish—Define, document (in writing or electronically), and implement.
establishment (21 CFR § 807.3 (c))—A place of business under one management at
one general physical location at which a device is manufactured, assembled,
or otherwise processed.
F value—A measure of the effectiveness of a heat sterilization process to

inactivate living microorganisms. The F value is calculated by determining
the lethal rate per minute at each process temperature using the z value of the
microorganisms.
F0 value—The F value of a heat sterilization process calculated at 121.1° C with a
z value of 10 K and a D value of one minute.
final distributor—Any person who distributes a tracked device intended for
use by a single patient over the useful life of the device to the patient. This
term includes, but is not limited to, licensed practitioners, retail pharmacies,
hospitals, and other types of device user facilities.
finished device—Any device or accessory to any device that is suitable for use or
capable of functioning, whether or not it is packaged, labeled, or sterilized.
importer—The initial distributor of an imported device who is required to
register under section 510 of the FDCA and 21 CFR § 807.20. “Importer’’ does
not include anyone who only performs a service for the person who furthers
the marketing, that is, brokers, jobbers, or warehousers.
in vitro diagnostic (IVD) accessory—An article that, while not being an in
vitro diagnostic medical device, is intended specifically by its manufacturer
to be used together with an IVD device to enable that device to be used in
accordance with its intended purpose.
Invasive sampling devices or those that are directly applied to the human
body for the purpose of obtaining a specimen within the meaning of Directive
93/42/EEC shall not be considered to be accessories to in vitro diagnostic
medical devices.
in vitro diagnostic (IVD) medical device—Any medical device that is a reagent,
reagent product, calibrator, control material, kit, instrument, apparatus,
equipment, or system, whether used alone or in combination, intended
by the manufacturer to be used in vitro for the examination of specimens,
including blood and tissue donations, derived from the human body, solely
or principally for the purpose of providing information (1) concerning a
physiological or pathological state, (2) concerning a congenital abnormality,
(3) to determine the safety and compatibility with potential recipients, or (4)
to monitor therapeutic measures.
Specimen receptacles are considered to be in vitro diagnostic medical devices.
Specimen receptacles are those devices, whether vacuum-type or not,
specifically intended by their manufacturers for the primary containment
and preservation of specimens derived from the human body for the purpose
of in vitro diagnostic examination.
Products for general laboratory use are not in vitro diagnostic medical devices
unless such products, in view of their characteristics, are specifically intended
by their manufacturer to be used for in vitro diagnostic examination.
304 Appendix A
initial importer (21 CFR § 807.3 (g))—Any importer who furthers the marketing
of a device from a foreign manufacturer to the person who makes the final
delivery or sale of the device to the ultimate consumer or user, but does not
repackage, or otherwise change the container, wrapper, or labeling of the
device or device package.
installation qualification (GHTF.SG3.N99-10)—Establishing by objective evidence
that all key aspects of the process equipment and ancillary system installa
tion adhere to the manufacturer’s approved specification and that the
recommendations of the supplier of the equipment are suitably considered;
demonstrating by objective evidence that equipment is correctly installed.
installation qualification (sterilization)—A step in the sterilization validation
program that establishes, using appropriate studies and records, that the
process equipment can perform within its design specifications.
intended uses (21 CFR § 801.4)—The term “intended uses” refers to the objective
intent of the persons legally responsible for the labeling of the device.
The intent is determined by their expressions or may be shown by the
circumstances surrounding the distribution of the device. This objective
intent may, for example, be shown by labeling claims, advertising matter, or
oral or written statements by such representatives. It may be shown by the
offering or the using of the device, with the knowledge of such persons or their
representatives, for a purpose for which it is neither labeled nor advertised.
label (FDCA § 201(k))—A display of written, printed, or graphic matter upon the
immediate container of any article.
• The term 'immediate container' does not include package liners. Any word,
statement, or other information appearing on the immediate container
must also appear 'on the outside container or wrapper, if any there be, or
the retail package of such article, or be easily legible through the outside
container or wrapper.'
labeling (FDCA § 201(m))—Includes all labels and other written, printed, or
graphic matter (1) upon any article or any of its containers or wrappers, or
(2) accompanying such article.
•
The term 'accompanying' is interpreted liberally to mean more than
physical association with the product. It extends to posters, tags, pamphlets,
circulars, booklets, brochures, instruction books, direction sheets, fillers,
etc. 'Accompanying' also includes labeling that is brought together with the
device after shipment or delivery for shipment in interstate commerce.
lead auditor—An auditor designated to manage an audit (also known as an audit
team leader).
licensed practitioner—A physician, dentist, or other healthcare practitioner
licensed by the law of the state in which he or she practices to use or order the
use of the tracked device.
life-supporting or life-sustaining device (used outside a device user facility)—

A device that is essential, or yields information that is essential, to the
restoration or continuation of a bodily function important to the continuation
of human life that is intended for use outside a hospital, nursing home,
ambulatory surgical facility, or diagnostic or outpatient treatment facility.
Physicians’ offices are not device user facilities and, therefore, devices used
therein are subject to tracking if they otherwise satisfy the statutory and
regulatory criteria.
lot or batch—One or more components or finished devices that consist of a
single type, model, class, size, composition, or software version that are
manufactured under essentially the same conditions and are intended to have
uniform characteristics and quality within specified limits.
management system—A system whereby to establish policy and objectives and
to achieve those objectives.
management with executive responsibility—Senior employees of a manufacturer
who have the authority to establish or make changes to the manufacturer’s
quality policy and quality system.
manufacturer (FDA)—Any person who designs, manufactures, fabricates,
assembles, or processes a finished device. Manufacturer includes, but is not
limited to, those who perform the functions of contract sterilization, installa
tion, relabeling, remanufacturing, repacking, or specification development
and initial distributors of foreign entities performing these functions.
manufacturer (ISO)—The natural or legal person with responsibility for the
design, manufacture, packaging, and labeling of a device before it is placed
on the market under his own name, regardless of whether these operations
are carried out by that person or on his or her behalf by a third party. The
obligations of this directive to be met by manufacturers also apply to the
natural or legal person who assembles, packages, processes, fully refurbishes,
and/or labels one or more ready-made products and/or assigns to them their
intended purpose as devices with a view to their being placed on the market
under his or her own name. This subparagraph does not apply to the person
who, while not a manufacturer within the meaning of the first subparagraph,
assembles or adapts devices already on the market to their intended purpose
for an individual patient.
manufacturing material—Any material or substance used in or used to facilitate
the manufacturing process, a concomitant constituent, or a byproduct
constituent produced during the manufacturing process that is present in or
on the finished device as a residue or impurity not by design or intent of the
manufacturer.
medical device (FDA)—An instrument, apparatus, implement, machine,
contrivance, implant, in vitro reagent, or other similar or related article,
including a component part or accessory that is:
•
Recognized in the official National Formulary, or the United States
Pharmacopoeia, or any supplement to them,
306 Appendix A
• Intended for use in the diagnosis of disease or other conditions, or in

the cure, mitigation, treatment, or prevention of disease, in man or other
animals, or
• Intended to affect the structure or any function of the body of man or other
animals, and which does not achieve any of its primary intended purposes
through chemical action within or on the body of a human or other animals
and which is not dependent upon being metabolized for the achievement of
any of its primary intended purposes.
medical device (MDD)—Any instrument, apparatus, appliance, software,
material or other article, whether used alone or in combination, including the
software intended by its manufacturer to be used specifically for diagnostic
and/or therapeutic purposes and necessary for its proper application, intended
by the manufacturer to be used for human beings for the purpose of:
• Diagnosis, prevention, monitoring, treatment, or alleviation of disease,
• Diagnosis, monitoring, treatment, alleviation of or compensation for an
injury or handicap,
• Investigation, replacement, or modification of the anatomy or of a physio
logical process,
• Control of conception,
and which does not achieve its principal intended action in or on the human
body by pharmacological, immunological, or metabolic means but which may
be assisted in its function by such means.
microbiological challenge—A population of known microorganisms, such as
biological indicators, biological indicator test packs, or inoculated product,
that can be used to test a sterilization cycle.
multiple distributor—Any device user facility, rental company, or any other
entity that distributes a life-sustaining or life-supporting device intended for
use by more than one patient over the useful life of the device.
nonconformity—The nonfulfillment of a specified requirement.
objective evidence—Verifiable information or records pertaining to the quality of
an item or service or to the existence and implementation of a quality system
element that is based on visual observation, measurement, or test.
official correspondent (21 CFR § 807.3 (e))—The person designated by the owner
or operator of an establishment as responsible for the following: (1) the annual
registration of the establishment; (2) contact with the FDA for device listing;
(3) maintenance and submission of a current list of officers and directors to
the FDA upon the request of the commissioner; (4) the receipt of pertinent
correspondence from the FDA directed to and involving the owner or operator
and/or any of the firm’s establishments; and (5) the annual certification of
MDRs required by section 804.30 of this chapter or forwarding the certification
form to the person designated by the firm as responsible for the certification.
operational qualification (GHTF.SG3.N99-10)—Establishing by objective evidence

process control limits and action levels that result in product that meets all
predetermined requirements; demonstration that a process will produce
acceptable results and establish process limits (worst case parameters).
owner or operator (21 CFR § 807.3 (f))—The corporation, subsidiary, affiliated
company, partnership, or proprietor directly responsible for the activities of
the registering establishment.
parametric release—A method of declaring that a product is sterile based on
a review of the process data rather than on the basis of sample testing or
biological indicator results.
performance qualification (GHTF.SG3.N99-10)—Establishing by objective
evidence that the process, under anticipated conditions, consistently produces
a product that meets all predetermined requirements; established long-term
process stability.
permanently implantable device—A device that is intended to be placed into
a surgically or naturally formed cavity of the human body to continuously
assist, restore, or replace the function of an organ system or structure of the
human body throughout the useful life of the device. The term does not
include any device that is intended and used for temporary purposes or that
is intended for explantation.
preconditioning—A step in the sterilization process prior to exposure to the
sterilizing gas mixture, designed to bring the product to specified conditions
of temperature and relative humidity. This step may be accomplished within
the sterilization vessel, in an external area, or in both.
presterilization count—The population of viable microorganisms on a product or
package prior to sterilization.
preventive action—An action taken to eliminate the cause of a potential
nonconformity or other undesirable potential situation. Preventive action is
taken to prevent occurrence of a nonconformity.
primary operating function—A function that involves user interaction that is
either frequently used or related to the safety of the medical device.
process qualification (sterilization)—Obtaining and documenting evidence that
the sterilization process will produce acceptable products.
process validation—Establishing by objective evidence that a process consistently
produces a result or product meeting its predetermined specifications.
product—Components, manufacturing materials, in-process devices, finished
devices, and returned devices.
pyrogen—A biological or chemical agent that produces a fever in mammals.
quality—The totality of features and characteristics that bear on the ability of a
device to satisfy fitness for use, including safety and performance.
308 Appendix A
quality audit—A systematic, independent examination of a manufacturer’s quality

system that is performed at defined intervals and at sufficient frequency
to determine whether both quality system activities and the results of such
activities comply with quality system procedures, that these procedures are
implemented effectively, and that these procedures are suitable to achieve
quality system objectives.
quality audit observation—A statement of fact made during a quality audit and
substantiated by objective evidence.
quality policy—The overall intentions and direction of an organization with
respect to quality, as established by management with executive responsibility.
quality system—The organizational structure, responsibilities, procedures,
processes, and resources for implementing quality management.
quality system record—Procedures and the documentation of activities required
by this part that are not specific to a particular device(s), including but not
limited to the records required by 21 CFR § 820.20.
recovery efficiency—Measure of the ability of a specific technique to remove and
culture microorganisms from a test article.
regulatory requirements—Any part of a law, ordinance, decree, or other
regulation that applies to quality systems of medical device manufacturers.
Guidelines, guidance documents, notes, draft documents, or the like should
not be used as regulatory documents and are not to be construed as such
unless formally promulgated.
remanufacturer—Any person who processes, conditions, renovates, repackages,
restores, or does any other act to a finished device that significantly changes
the finished device’s performance or safety specifications or intended use.
rework—Action taken on a nonconforming product so that it will fulfill the
specified DMR requirements before it is released for distribution.
serious adverse health consequences—Any significant adverse experience
related to a device, including device-related events that are life-threatening or
that involve permanent or long-term injuries or illnesses.
simulated product load—A sterilization vessel load that is as difficult to sterilize
as the actual product load.
specification—Any requirement with which a product, process, service, or other
activity must conform.
sterile—Free from living microorganisms. In practice, sterility is expressed as a
probability function. For example, sterility may be expressed as the probability
of a surviving microorganism being one in a million (10 –6).
sterility assurance level (SAL)—The probability of a nonsterile product after
sterilization. The SAL is usually expressed as 10 –n.
sterilization—The process used to remove all living microorganisms on a product.

sterilization dose—The minimum absorbed dose of radiation required to achieve
the specified sterility assurance level.
temperature distribution study—A study to determine the temperature profile
within a sterilizing chamber during a sterilization cycle.
terminal sterilization—The process in which the product is rendered free of
microorganisms at the last stage(s) of the manufacturing process. In the case
of ethylene oxide and radiation sterilization, the product is typically sterilized
in the final packaging, including the shipping containers. In the case of moist
heat sterilization, the product is sterilized in the primary container with
subsequent label application and final packaging.
training elements—Topics within a training program that describe the content
for addressing a particular training need.
US agent (21 CFR § 807.3(r))—A person residing in or maintaining a place of
business in the United States whom a foreign establishment designates as its
agent. This definition excludes mailboxes, answering machines, or services, or
other places where an individual acting as the foreign establishment’s agent
is not physically present.
usability—Characteristic of the user interface that establishes effectiveness,
efficiency, ease of user learning and user satisfaction.
usability specification—Documentation defining the user interface requirements
related to usability.
user interface—Means by which the user and the medical device interact.
user profile—Summary of the mental, physical and demographic traits of an
intended user population, as well as any special characteristics that can have a
bearing on design decisions, such as occupational skills and job requirements.
validation—Confirmation by examination and provision of objective evidence
that the particular requirements for a specific intended use can be consistently
fulfilled.
validation (sterilization)—A written procedure for developing, recording, and
interpreting the data required to determine that a process will consistently
yield product that complies with established specifications. In the case of
sterilization cycles, validation includes commissioning (demonstrating
that the equipment to be used conforms to specifications) and performance
qualification (demonstrating that acceptable product will be produced
when the commissioned equipment is used in accordance with documented
procedures).
verification—Confirmation by examination and provision of objective evidence
that specified requirements have been fulfilled.
310 Appendix A
verification (sterilization)—Evaluation to assure current operation or applicability

for use of a system. For example, although a set of thermocouples has been
calibrated, a single-point check of the thermocouples in the temperature range
to be measured is considered a verification of the correct functioning of the
equipment prior to and after use in developing a sterilization cycle. In other
words, it is a confirmation that specified requirements have been met.
where appropriate—When a requirement is qualified by “where appropriate,” it is
deemed to be appropriate unless the manufacturer can document justification
otherwise.
z value—The number of degrees of temperature required for a 1-logarithm change
in the D value. A z value can be obtained from a thermal resistance curve.
D values are plotted against temperature and the reciprocal of the slope is
determined as the z value.
Appendix B
Certified Biomedical Auditor (CBA)
Body of Knowledge (2013)
T
he topics in this body of knowledge (BOK) include additional detail in
the form of subtext explanations and cognitive level. These details will
be used by the Exam Development Committee as guidelines for writing
test questions, and are designed to help candidates prepare for the exam by
identifying specific content within each topic that may be tested. The subtext
is not intended to limit the subject matter or be all-inclusive of what might be
covered in an exam, but is intended to clarify how the topics relate to a Biomedical
Auditor’s role. The descriptor in parentheses at the end of each entry refers to the
maximum cognitive level at which the topic will be tested. A more comprehensive
description of cognitive levels is provided at the end of this document.
I. Auditing Fundamentals (10 Questions)
A. Types of audits
1. Audits by method. Identify and distinguish between audits by
method: product, process, system, compliance, first-party, second-
party, third-party, internal, external, desk, management, department,
function. (Analyze)
2. Audits by purpose. Identify and distinguish between audits by
purpose: organizational effectiveness, system efficiency, process
effectiveness, risk management, conformance to requirements,
business performance. (Analyze)
B. Audit roles and responsibilities. Explain key functions and
responsibilities of various audit participants including audit team
members, lead auditor, client, auditee, etc. (Understand)
C. Ethical, legal, and professional issues
1. Professional conduct and responsibilities. Define and apply the ASQ
Code of Conduct, concepts of due diligence and due care with
respect to confidentiality and conflict of interest, and various factors
that influence audit credibility including auditor independence,
objectivity, and qualifications. (Apply)
2. Legal consequences and liability. Identify potential legal and financial
ramifications of improper auditor actions (carelessness, negligence,
etc.) in various situations, and anticipate the effect that certain audit
results can have on an auditee’s liability. (Apply)
311
312 Appendix B
II. Auditing and Inspection Processes (24 Questions)

A. Audit preparation and planning
1. Elements of the audit planning process. Determine and implement
steps in audit preparation and planning, such as verifying audit
authority and establishing the purpose, scope, and type of audit,
the requirements to audit against, and the resources necessary,
including the size and number of audit teams. (Evaluate)
2. Auditor selection. Identify and examine various auditor selection
criteria, such as education, experience, industry background,
and subject-matter expertise, and the characteristics that make
auditors effective, such as interpersonal skills, problem-solving
skills, attention to detail, cultural sensitivity, and ability to work
independently as well as in a group or on a team. (Analyze)
3. Audit-related documentation. Identify sources of pre-audit information
and examine audit-related documentation, such as reference
materials and prior audits. (Analyze)
4. Auditing tools. Identify the sampling plan or method and procedural
guidelines to be used for the specific audit. Select and prepare
working papers (checklists, log sheets, etc.) to document the audit.
(Create)
5. Auditing strategies. Identify and use various tactical methods for
conducting an audit, such as forward and backward tracing,
discovery, etc. (Apply)
6. Logistics. Identify and organize various audit-related logistics,
such as travel, safety and security considerations, and the need for
escorts, translators, confidentiality agreements, clear right of access,
etc. (Apply)
B. Audit performance
1. Opening meeting. Manage the opening meeting of an audit, including
identifying the audit’s purpose and scope, describing any scoring or
rating criteria that will be used during the audit, creating a record
of the attendees, reviewing the audit schedule, and answering
questions as needed. (Apply)
2. Data collection and analysis. Select and apply various data collection
methods, such as observing work activities, taking physical
measurements, examining paper and electronic documents, etc.
Evaluate the results to determine their importance for providing
audit evidence. (Evaluate)
3. Communication techniques. Define and apply appropriate
interviewing techniques (e.g., when to use various question
types, the significance of pauses and their length, when and how
to prompt a response) in various situations, including when
supervisors are present, when conducting multiple interviews,
when using a translator, etc. Identify typical conflict situations and
use appropriate techniques to resolve them. (Apply)
Certified Biomedical Auditor (CBA) Body of Knowledge (2013) 313
4. Organization and analysis of objective evidence. Identify and

differentiate characteristics of objective evidence, such as observed,
measured, confirmed or corroborated, and documented. Classify
evidence in terms of significance, severity, frequency, and level
of risk. Evaluate the evidence for its potential impact on product,
process, system, cost of quality, etc., and determine whether
additional investigation is required to meet the scope of the audit.
(Evaluate)
5. On-site audit management. Interpret situations throughout the
performance of the audit to determine whether time is being
managed well and when changes need to be made, such as revising
planned audit team activities, reallocating resources, adjusting
the audit plan, etc., and communicate with the auditee about any
changes or other events related to the audit. (Analyze)
6. Exit meeting. Formally manage these meetings: reiterate the audit’s
purpose, scope, and scoring or rating criteria, and create a record of
the attendees. Present the audit results and obtain concurrence on
evidence that could lead to an adverse conclusion. Discuss the next
steps in the process (follow-up audit, additional evidence-gathering,
etc.) and clarify who is responsible for performing those steps.
(Apply)
C. Audit reporting
1. Basic elements. Define, plan, and apply the steps in generating an
audit report, including reviewing and finalizing results, organizing
details, obtaining necessary approvals, and distributing the report.
(Create)
2. Effective audit reports. Report observations and nonconformances
accurately, cite objective evidence, procedures, and requirements,
and develop and evaluate various components, such as executive
summaries, prioritized data, graphic presentation, and the impact of
conclusions. (Create)
3. Record retention. Identify and apply record retention requirements,
including the type of documents and storage considerations, for
various audits. (Apply)
D. Audit follow-up and closure
1. Elements of corrective and preventive action. Identify and apply the
elements of these processes, including problem identification,
assignment of responsibility, verifying the performance of root cause
analysis and recurrence prevention. (Analyze)
2. Review of corrective action plan. Use various criteria to evaluate the
acceptability of corrective action plans, and identify and apply
strategies for negotiating changes to unacceptable plans. (Evaluate)
3. Conducting audit follow-up. Use various methods to verify and
evaluate the adequacy of corrective actions taken, such as
314 Appendix B
re-examining procedures, observing revised processes, and

conducting follow-up audits or re-audits. Develop strategies when
corrective actions are not implemented or are not effective, such
as communicating to the next level of management, re-issuing the
corrective action request, etc. (Evaluate)
4. Audit closure. Identify and apply various elements of, and criteria
for, audit closure. (Evaluate)
E. Audit procedural references
1. International guidelines for auditing quality systems. Describe general
auditing principles and approaches as described in ISO 19011 and
GHTF SG4 guidance documents. (Analyze)
2. Quality System Inspection Technique (QSIT) and FDA CPG 7382.845.
Describe QSIT auditing requirements and its various subsystems.
Explain the purpose and scope of FDA criteria for taking action on
the basis of quality system audit results. (Analyze)
III. Biomedical Quality Management System Requirements (47 Questions)
A. Regulatory laws and requirements
1. FDA—Code of Federal Regulations (CFR) Title 21. Identify, define, and
apply the following FDA requirement parts: 11—Electronic records
and signatures, 801—Labeling, 803—Medical device reporting,
806—Corrections and removals, 807—Establishment registration
and device listing, 820—Quality system regulation (includes
preamble—FR October 7, 1996) and 821—Medical device tracking.
(Apply)
2. U.S. requirements (FD&C Act, 201, 301–304, 501–502, 510, 513, 518,
704). Identify how the FD&C Act defines and differentiates between
device classifications and pre-market requirements. Recognize the
implications of misbranding and adulteration. (Apply)
3. European directive: Medical Device Directive 93/42/EEC (MDD) 14
June 1993 (Article 1) as amended by Directive 2007/47/EC. Recognize
requirements of the directive and the key differences between this
and US regulations. (Understand)
4. Health Canada. Recognize requirements of the Canadian Medical
Devices Conformity Assessment System (CMDCAS) and (SOR/98-
282) and the key differences between them and US regulations.
(Understand)
5. Japan. Recognize the requirements of the Japanese Pharmaceutical
Affairs Law (JPAL) for medical devices. (Understand)
6. Other international agencies. Recognize other international agencies
such as Therapeutic Goods Administration (TGA), State Food and
Drug Administration (SFDA) National Health Surveillance Agency
Brazil (ANVISA), etc. (Understand)
B. FDA guidance for the manufacture of (IVD) products. Explain how

FDA guidelines for in vitro diagnostic (IVD) devices are applied to the
current good manufacturing practices (cGMPs). (Understand)
C. International standards for quality systems
1. ISO 9001, ISO 13485, ISO 17025. Evaluate the selection and use of
these various quality system standards. (Evaluate)
2. GHTF.SG3.N99-10. Explain the selection and use of this guidance for
an auditee’s quality system. (Understand)
D. Quality system regulation (QSR) requirements (21 CFR 820—parts as
shown)
1. Management responsibility (Parts 20, 22, 25). Assess management’s
responsibility in establishing and maintaining the quality system:
organizational structure, resources, management reviews, quality
audits, personnel training and education, control of customer
property, etc. (Evaluate)
2. Design control system (Part 30). Evaluate the scope, purpose, and
implementation of these systems and their elements, including
system requirements, design input, output, reviews, and validation.
(Evaluate)
3. Document (Part 40) and record control (Parts 180–186). Describe
and review elements of a document and change control system,
including approval processes, retention policies, communication
procedures, and maintenance of device master records (DMRs),
design history files (DHFs), device history records (DHRs), and
quality system records. (Analyze)
4. Purchasing controls and acceptance activities (Parts 50, 80, 86). Describe
supplier qualification and purchasing control requirements
for products, components, and services. Describe appropriate
identification and acceptance activities, including inspection, test,
and verification processes used for incoming products. (Apply)
5. Identification and traceability (Parts 60, 65). Use appropriate methods
for identifying and tracing products during all stages of receipt,
production, distribution, and installation. (Apply)
6. Production and process controls (Parts 70, 72, 75). Assess production
and process controls using monitoring and validation procedures,
control of materials, equipment, environment, and contamination,
software validation for automated processes, etc. (Evaluate)
7. Nonconforming product (Part 90). Determine the adequacy of
procedures, processes, and records established for the control and
disposition of nonconforming product. (Analyze)
8. Corrective and preventive action (CAPA) system (Part 100). Define
and distinguish between corrective action and preventive action.
Review CAPA procedures, processes, and records to evaluate the
effectiveness of the system. (Evaluate)
316 Appendix B
9. Product handling, storage, distribution, and installation (Parts 140–170).

Determine the adequacy of procedures, processes, and records
established for these aspects of product control to ensure product
integrity, etc. (Analyze)
10. Servicing (Part 200). Determine the adequacy of procedures,
processes, and records established for products that require
servicing activities such as troubleshooting and repair. Evaluate
service reports for events that must be reported to the FDA to ensure
that they are included in the complaint handling process. (Analyze)
11. Statistical techniques (Part 250). Interpret commonly used statistical
tools and methods (control charts, hypothesis tests, etc.) and
evaluate the appropriateness of conclusions drawn. Determine the
adequacy and validity of statistical techniques and sampling plans
used to measure process capability and acceptability of product
characteristics. Evaluate the rationale for statistical techniques used
in quality systems, including design verification and validation,
acceptance sampling, etc. (Analyze)
E. Postmarket surveillance (Guidance under section 522 of FD&C Act)
Determine the appropriateness of the procedures, processes, and
records established for the control of postmarket surveillance activities
such as the review and analysis of complaint handling and servicing
data and feedback into the risk management and design processes.
Define and describe vigilance, medical device reporting (MDR), and
adverse event reporting (AER) requirements. Review the adequacy of
requirements and processes for product recall, corrections, removals,
and tracking. (Analyze)
IV. Technical Biomedical Knowledge (40 Questions)
A. Risk management
1. ISO 14971. Describe the principles of risk management as defined in
this standard, including risk analysis, evaluation, and control; the
incorporation of production and post-production information, etc.
(Evaluate)
2. IEC 62366. In accordance with this standard, determine whether the
processes used for identification of known or foreseeable hazards
are suitable in both normal and fault conditions, including hazards
arising from device use. Verify that risk control measures have been
implemented in design and production. (Evaluate)
B. Sterilization
1. Definitions. Describe and distinguish between aseptically processed
products and terminally sterilized products. (Understand)
2. Methods and process controls. Identify elements of sterilization
validations for dry heat, steam, ethyl oxide (EO), and radiation.
Determine whether appropriate process controls and monitors
(dose audits, parametric release, process challenge device (PCD),
residuals, and limulus amebocyte lysate (LAL) testing, etc.) are

properly implemented and documented in accordance with
industry standards: ISO 17665-1, ISO 11135-1, ISO 11137-1, ISO
11138-1, ISO 11737-1. (Apply)
C. Biocompatibility. Describe the principles of biocompatibility test
selection rationale as described in ISO 10993-1 and FDA Blue Book
#G95-1. (Understand)
D. Controlled environments and utility systems
1. Controlled environments. Identify and interpret controlled
environment specifications, qualifications, validations, and
monitoring as described in ISO 14644. Review cleaning, disinfection,
and sanitization processes in terms of controlled environment
specifications, classifications, and standards. Verify that
appropriate training and personnel practices are used in controlled
environments. (Analyze)
2. Utility systems. Describe utility setups in medical device
manufacturing facilities for water, compressed gas, heating,
ventilation, and air conditioning (HVAC) systems, including
whether they require qualification, validation, or maintenance.
(Understand)
E. Software development and maintenance for products. Identify
principles of product software lifecycle in accordance with FDA
Pre-Market Submissions Software Guidance, ISO 80002, and IEC
62304. Describe the software development lifecycle model, including
V&V, change control methods, and the risk management process.
(Understand)
F. Laboratory testing and failure analysis. Assess procedures and records
used for laboratory test methods and determine whether they are
appropriate. (Evaluate)
G. Sources for new and evolving standards. Describe the sources for
standards and guidance documents that form the basis for industry
norms and standards such as the FDA Recognized Consensus
Standards Database, the Harmonised Standards Listing, such as
Medical Devices Guidances (MEDDEV), Notified Body Operating
Group (NBOG), Europa, etc. (Remember)
H. Common medical device directives and standards. Define and
describe elements of various standards and directives as they relate to
medical devices. (Understand)
1. IEC 60601-1 and IEC 80001
2. Restriction of Hazardous Substances (RoHs) directive
3. Registration, Evaluation, Authorization, and Restriction of
Chemicals (REACH)
4. Waste Electrical and Electronic Equipment (WEEE)
318 Appendix B
I. Packaging. Interpret the appropriate standards for sterile and non-

sterile product packaging per ISO 11607, and referenced standards
including, ASTM D4169 (Distribution) and ASTM F1980 (Aging).
(Understand)
J. Reprocessing/reuse and cleaning of medical devices. Identify elements
of reprocessing and cleaning validations in accordance with the FDA
Guidance on Reprocessing of Reusable Devices. (Understand)
V. Quality Tools and Techniques (14 Questions)
A. Quality control and problem-solving tools. Identify, interpret, analyze,
and draw conclusions based upon: (1) Pareto charts, (2) cause-and-
effect diagrams, (3) flowcharts, (4) statistical process control (SPC)
charts, (5) check sheets, (6) scatter diagrams, (7) histograms, (8) root
cause analysis, (9) plan-do-check-act (PDCA). (Analyze)
B. Process improvement techniques
1. Process capability. Identify and interpret various process capability
indices, such as Cp, Cpk, Pp, and Ppk. Recognize how these metrics are
used in relation to established requirements. (Understand)
2. Six sigma. Identify and define the six sigma DMAIC phases: define,
measure, analyze, improve, and sustaining control. (Understand)
3. Lean tools. Identify and define various lean tools: 5S, standard
operations, kanban (pull), error-proofing, value-stream mapping,
etc. (Understand)
4. Measurement system analysis (MSA). Identify and define various MSA
terms (bias, linearity, stability, accuracy, precision, repeatability,
reproducibility, etc.) and describe how these elements affect
measurement systems. (Understand)
5. Cost of quality (COQ). Define and describe the four basic cost of
quality (COQ) categories: prevention, appraisal, internal failure,
external failure. (Understand)
C. Data types and sampling
1. Qualitative and quantitative analysis. Describe qualitative data in
terms of the nature, type, or other characteristics of an observation
or condition. Describe how quantitative data are used to detect
patterns or trends. Identify how such analyses can indicate whether
a problem is systemic or isolated. (Analyze)
2. Attributes and variables data. Determine whether to use an attributes
sampling plan or variables sampling plan in various situations such
as process monitoring and control, receiving inspection, auditing,
etc. (Analyze)
SIX LEVELS OF COGNITION BASED ON BLOOM’S

TAXONOMY (REVISED 2001)
In addition to content specifics, the subtext detail also indicates the intended
complexity level of the test questions for that topic. These levels are based on the
Revised “Levels of Cognition” (from Bloom’s Taxonomy, 2001) and are presented
below in rank order, from least complex to most complex.
Remember (commonly referred to as recognition, recall, or rote

knowledge)
Be able to remember or recognize terminology, definitions, facts, ideas, materials,
patterns, sequences, methodologies, principles, etc.
Understand
Be able to read and understand descriptions, communications, reports, tables,
diagrams, directions, regulations, etc.
Apply
Be able to apply ideas, procedures, methods, formulas, principles, theories, etc., in
job-related situations.
Analyze
Be able to break down information into its constituent parts and recognize the
parts’ relationship to one another and how they are organized; identify sublevel
factors or salient data from a complex scenario.
Evaluate
Be able to make judgments regarding the value of proposed ideas, solutions,
methodologies, etc. by using appropriate criteria or standards to estimate accuracy,
effectiveness, economic benefits, etc.
Create
Be able to put parts or elements together in such a way as to show a pattern or
structure not clearly there before; be able to identify which data or information
from a complex set are appropriate to examine further or from which supported
conclusions can be drawn.
Appendix C
Certified Biomedical Auditor
References (2013)
A
ll reference materials listed below cover the parts of the Body of Knowledge.
ASQ Certification Board does not endorse any one particular reference
source.
ANSI/ISO/ASQ Q9001:2008, Quality management systems—Requirements.
ANSI/AAMI/IEC 62304:2006, Medical device software, software life cycle
processes.
Arter, Dennis R. Quality Audits for Improved Performance. 3rd ed. Milwaukee, WI:
ASQ Quality Press, 2003.
ASQ Code of Ethics: https://asq.org/about-asq/code-of-ethics
ASTM D4169-09, Standard Practice for Performance Testing of Shipping
Containers and Systems.
ASTM F1980-07(2011), Standard Guide for Accelerated Aging of Sterile Barrier
Systems for Medical Devices.
ANSI/ISO/ASQ QE19011S-2004, Guidelines for quality and/or environmental
management systems auditing, E-Standard.
ANSI/ISO/ASQ 19011-2:2011, Guidelines for auditing management systems.
Australian Regulatory Guidelines for Medical Devices (ARGMD)
http://www.tga.gov.au/pdf/devices-argmd.pdf
Brassard, Michael, and Diane Ritter. The Memory Jogger 2. 2nd ed. Goal/QPC,
2010. ISBN 978-1-57681-113-9
Canadian Medical Devices Conformity Assessment System (CMDCAS) Quality:
http://www.hc-sc.gc.ca/dhp-mps/md-im/qualsys/cmdcas_scecim_syst_
pol-eng.php
EED 93/42/EEC, Council Directive 93/42/EEC, Medical Devices Directive (14
June 1993) amended by Directive 2007/47/EC.
EU Directive 2002/96/EC on waste electrical and electronic equipment (WEEE)
http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2003:037:0024:0
038:EN:PDF.
321
322 Appendix C
FDA—10-Jan-94, Guideline for the Manufacture of In Vitro Diagnostic Products.

FDA—11-May-2005, Guidance for the Content of Premarket Submissions for
Software Contained in Medical Devices.
FDA—9-Sep-99, Guidance for Industry, FDA Reviewers and Compliance on
Off-The-Shelf Software Use in Medical Devices.
FDA—11-Jan-02, General Principles of Software Validation Final, Guidance for
Industry and FDA Staff.
FDA—Blue Book #G95-1, Required Biocompatibility Training and Toxicology
Profiles for Evaluation of Medical Devices.
FDA—Code of Federal Regulations (CFR) Title 21 Part 11: 201 Subpart A; 801
Subpart A; 803; 806; 807; 820; 821.
FDA—CPG 7382.845 (7 Feb 2001), Inspection of Medical Device manufacturers—
Final Guidance for Industry and FDA.
FDA—Food Drug, and Cosmetic (FD&C) Act, Sections 201, 301-4; 501-2; 510, 513,
518, 704.
FDA—QSIT: 8/99, Guide to Inspection of Quality Systems.
GHTF/SG2/N54R8:2006, Medical Devices Post Market Surveillance: Global
Guidance for Adverse Event Reporting for Medical Devices.
GHTF/SG3/N99-10:2004, Process Validation Guidance.
GHTF/SG4, Guidelines for Regulatory Auditing of Quality Systems of Medical
Device Manufacturers General Requirements, Parts 1-5.
GHTF/SG4(00) 3, Training Requirements for Auditors.
Gryna, Frank M., Richard Chua, and Joseph Defeo. Juran's Quality Planning and
Analysis for Enterprise Quality. 5th ed. New York: McGraw-Hill Co, 2007.
IEC 80001-1:2010, Application of risk management for IT-networks incorporating
medical devices—Part 1: Roles, responsibilities and activities.
IEC/TR 80002-1:2009, Medical device software—Part 1: Guidance on the
application of ISO 14971 to medical device software.
IEC 60601-1:2005, Medical electrical equipment—Part 1:General requirements for
basic safety and essential performance.
ISO 11135-1:2007, Sterilization of health care products—Ethylene oxide—
Part 1: Requirements for development, validation and routine control of a
sterilization process for medical devices.
ISO 11137-1:2006, Sterilization of health care products—Radiation—Part 1:
Requirements for development, validation and routine control of a
ISO 11138-1:2006, Sterilization of health care products—Biological indicators -
Part 1: General requirements.
Certified Biomedical Auditor References (2013) 323
ISO 11737-1:2006, Sterilization of medical devices—Microbiological methods—

Part 1: Determination of a population of microorganisms on products.
ISO 11607-1:2006, Packaging for terminally sterilized medical devices—Part 1:
Requirements for materials, sterile barrier systems and packaging systems.
ISO 10993-1:2009, Biological evaluation of medical devices—Part 1: Evaluation
and testing within a risk management process.
ISO 14644-1:1999, Part 1: Classification of air cleanliness, cleanrooms, and
associated controlled environments.
ISO 13485:2003, Medical devices—Quality management systems—Requirements
for regulatory purposes.
ISO 17665-1:2006, Sterilization of health care products—Moist heat—Part 1:
Requirements for the development, validation and routine control of a
ISO 14937:2009, Sterilization of health care products - General requirements for
characterization of a sterilizing agent and the development, validation and
routine control of a sterilization process for medical devices.
ISO 14971:2007, Medical devices -Application of risk management to medical
devices.
ISO 17025:2005, General requirements for the competence of testing and
calibration laboratories.
ISO 14969:2004, Medical Devices—Quality Management systems—Guidance on
the application of ISO 13485:2003
ISO/IEC 62366:2008, Medical devices—Application of usability engineering to
medical devices
Ishikawa, Kaoru. Guide to Quality Control. White Plains, NY: Quality Resources,
1986. ISBN 9283310365
Juran, Joseph M. Juran's Quality Handbook. 5th ed. Milwaukee, WI: ASQ Quality
Press, 1999.
Japanese Pharmaceutical Affairs Law (JPAL) MHLW Ministerial Ordinance
No 169, 2004. http://www.emergogroup.com/files/japan-mhlw-ordinance-
169-english.pdf/.
Mills, Charles A. The Quality Audit: A Management Evaluation Tool. McGraw-Hill
Professional, 1988. ISBN 0070424284
MEDDEV—2.12-1 Rev 6, Guidelines on a medical devices vigilance system
(December 2009).
Parsowith, B. Scott. Fundamentals of Quality Auditing. Milwaukee, WI:
Pérez, José Rodríguez. CAPA for the FDA-Regulated Industry. Milwaukee, WI:
324 Appendix C
REACH—Registration, Evaluation, Authorisation and Restriction of Chemicals:

http://echa.europa.eu/guidancedocuments/guidance-on-reach.
RoHs—Restriction of the use of certain hazardous materials in electrical and
electronic equipment directive 2011/65/EU: EU Directive for Restriction of
the use of certain hazardous materials in electrical equipment.
Sayle, Allan J. Management Audits. 3rd ed. Brighton, Michigan: Allan Sayle
Associates, 1997. ISBN 0951173901
Tague, Nancy R. The Quality Toolbox. 2nd ed. Milwaukee, WI: ASQ Quality
Press, 2004.
Wilson, Paul F., Larry D. Dell, and Gaylord F. Anderson. Root Cause Analysis: A
Tool for Total Quality Management. Milwaukee, WI: ASQ Quality Press, 1993.
For the latest version of the above referenced standards, regulations, and
guidance visit:
ISO standards @ www.iso.org
FDA regulations @ www.fda.gov
Endnotes
Chapter 4
1. 21 USC § 321(h) (Pub. L. 94-295, § 3(a)(1)(A).
2. Id.
3. 21 USC § 360(i); Publ L. 94-295 §6(a).
4. FDCA § 513(i), 21 USC § 360c(i), 21 CFR § 807.100.
5. 21 USC § 360aaa-aaa-1 (2001).
6. FDA—Jan-2009, Good Reprint Practices for the Distribution of Medical Journal
Articles and Medical or Scientific Reference Publications on Unapproved New
uses of Approved Drugs and Approved or Cleared Medical Devices; accessible at:
http://www.fda.gov/RegulatoryInformation/Guidances/ucm125126.htm
7. 21 USC § 360bbb (2001).
8. 21 USC § 331.
9. 21 USC § 351(a)(1) (2001).
10. 21 USC § 351(h) (2001).
11. 21 USC § 360(j)(1)(A) (2001).
12. 21 USC § 351(a)(3) (2001).
13. Id.
14. 21 USC § 351(a)(2)(A) (2001).
15. 21 USC § 351(e)(1)-(2) (2001).
16. 21 USC § 351(f)(1)(B)(i)-(ii); 351(f)(1)(C) (2001).
17. 21 USC § 352(o), 360(j) (2001).
18. 21 USC § 352(b), 352(0) (2001).
19. 21 USC § 352(o), 360(b) (2001).
20. 21 USC § 352(o), 360(j) (2001).
21. 21 USC § 352(o), 360(k), 360(d), 360(e) (2001).
22. 21 USC § 352(a), 352(q) (2001).
23. 21 USC § 352(j) (2001).
24. 21 USC § 352(q) (2001).
25. 21 USC § 60(j)(1)(B)(ii) (2001). The FDCA distinguishes between “label” and
“labeling.” A “label” refers to written, printed, or graphic statements that appear
upon “the immediate container” of an article. “Labeling” encompasses all labels,
as well as additional written, printed, or graphic statements appearing upon any
container or wrapper for the article, the article itself, or any material accompanying
the article.
26. 21 USC § 360(j)(1)(A), 360(j)(1)(B)(i) (2001).
27. 21 USC § 360(j)(1)(A) (2001).
28. 21 USC § 352(b) (2001).
29. 21 USC § 352(b), 352(0), 360(e) (2001).
325
326 Endnotes
30. 21 USC § 352(c) (2001).

31. 21 USC § 352(f) (2001).
32. 21 USC § 352(s), 260d(2)(C) (2001).
33. 21 USC § 352(r) (2001).
34. Id.
35. Id.
36. 21 USC § 352(t), 360(h) (2001).
37. 21 USC § 352(t), 360(l) (2001).
38. 21 USC § 360h.
39. 21 USC § 360ll.
40. MDA, Pub. L. No. 94-295, 90 Stat. 539 (1976), codified at 15 USC § 55 (1994); 21 USC
§ 301, 331, 334, 351, 352, 358, 360, 374, 379, 381.
41. Pub. L. No. 101-629, 104 Stat. 4511 (1990), codified at 21 USC § 301 note, 321, 333, 333
note, 351, 353, 360, 360c, 360c note, 360d-i, 360i notes, 360j, 360j note, 3601, 360gg-hh,
360hh note, 360ii-ss, 383, 383 note; 42 USC § 263b-n (Supp. 1991).
42. Pub. L. No. 102-300, 106 Stat. 238 (1992), 21 USC § 301 note, 321, 331, 334, 346a, 352,
353, 356, 357, 360c-d, 371, 372, 372a, 376, 381; 42 USC § 262.
43. See 21 CFR 810 (effective May 19, 1997).
44. FDCA § 518(a), 21 USC § 360h(a).
45. H.R. Cong. Rep. No. 1090, 94th Cong. 60, 2nd Sess. (1976)(reprinted in 1976
U.S.C.C.A.N. 1112-13).
46. FDA’s site posts safety alerts that can be used to develop sample forms.
http://www.fda.gov/safety/recalls/EnforcementReports/default.htm. An
individual can also subscribe to e-mail notification through the website.
47. FDCA § 518(b), (c), 21 USC § 360h(b), (c).
48. H.R. Rep. No. 953, 94th Cong., 2nd Sess. (1976).
49. By “serious, adverse health consequences,” Congress meant “any significant
adverse experience attributable to a device, including those which may be either
life-threatening, or involve permanent or long-term injuries, but excluding those
non-life-threatening injuries that are temporary and reasonably reversible”
[S. Rep. No. 513, 101st Cong., 2nd Sess. (1990)].
50. S. Rep. No. 513, 101st Cong., 2nd Sess. 19 (1990).
51. 21 CFR § 810.2(h).
52. 61 Federal Register 59,004, 59,005 (1996).
53. 21 CFR § 810.10(a).
54. 21 CFR § 810.10(b).
55. 21 CFR § 810.10(c).
56. 21 CFR § 810.11(a).
57. 21 CFR § 810.10(e), (f); 810.11(b).
58. 21 CFR § 810.11 (a), (e).
59. 21 CFR § 810.11(e), 810.12(c).
60. 21 CFR § 810.13(b), (d); 810.14.
61. FDCA § 518(e) (2) (B) (i) (I), (II); 21 USC § 360h(e) (2) (B) (i) (I), (II).
62. 21 CFR § 810.15(b).
63. 21 CFR § 810.14(C)(2).
64. 21 CFR § 810.14(C)(3).
65. 21 CFR § 810.15(d).
66. 21 CFR § 810.17(a).
67. 21 CFR § 810.17(b).
68. 21 USC § 374.
69. FDCA § 704(a)(1)(A), (B); 21 USC § 374(a)(1)(A), (B).
70. FDCA § 510(h); 21 USC § 360(h).
Endnotes 327
71. FDCA § 704(a)(1), 21 USC § 374(a)(1).

72. United States v. Crescent-Kelvan Co., 164 F.2d 582 (3rd Cir. 1948); United States v.
Arnold’s Pharmacy, Inc. 116 F. Supp. 310 (D.N.J. 1953); Golden Grain Macaroni Co.
v. United States, 209 F.2d 166 (9th Cir. 1953).
73. FDCA § 304, 21 USC § 374.
74. Marshall v. Barlow’s, Inc., 436 U.S. 307, 313 (1978), citing Colonnade Catering Corp. v.
United States, 397 U.S. 72, 77 (1970) and United States v. Biswell, 406 U.S. 311, 316 (1972).
75. Jamieson-McKames Pharmaceuticals, Inc., 651 F. 2d 532 (8th Cir. 1981), cert. denied,
455 U.S. 1016 (1982).
76. Id. at 538.
77. Marshall v. Barlow’s, Inc., 536 U.S. at 313.
78. Id., citing Almeida-Sanchez v. United States, 413 U.S. 266, 271, (1973).
79. Id.
80. United States v. Jamieson-McKames Pharmaceuticals, Inc., 651 F. 2d 532, 537 (8th Cir.
1981), citing McDermott v. Wisconsin, 228 U.S. 115 (1913).
81. United States v. Thriftimart, Inc., 429 F. 2d 1006 (9th Cir. 1970); United States v. Jamieson-
McKames Pharmaceuticals, Inc., 651 F. 2d 532 (8th Cir. 1981), cert. denied, 455 U.S. 1016
(1982).
82. FDA Investigation Operations Manual 2013, at 5.2.5 and 5.2.6.
83. The full manual can be found at http://www.fda.gov/ora/inspect_ref/iom/default.htm.
84. Sample form accessible at https://www.fda.gov/downloads/ICECI/Inspections/
IOM/UCM497756.pdf.
85. FDCA § 704(a)(1)(A), 21 USC § 374(a)(1)(A).
86. FDCA § 301(e), (f); 21 USC § 331(e), (f).
87. FDCA § 704(a)(1), 21 USC § 374(a)(1).
88. FDCA § 703, 21 USC § 373.
89. FDCA § 704(c), 21 USC § 374(c); see Attachment 3, form FDA 484.
90. FDCA § 702(b), 21 USC § 372(b).
91. FDCA § 301(k), 21 USC § 331(k).
92. FDCA § 304(c), 21 USC § 334(c).
93. Investigation Operations Manual, 5.2.9.1.
94. 5 USC § 552.
95. FDA Field Management Directive, Procedure for Release of Establishment Inspection
Report (April 1, 1997).
96. FDCA § 704(b), 21 USC § 374(b).
97. Investigation Operations Manual, 5.2.7.
98. FDCA § 74, 21 USC § 374.
Chapter 5
99. 21 CFR § 820.22.
100. Accessible at http://ec.europa.eu/health/files/eudralex/vol-4/
annex11_01-2011_en.pdf
101. Accessible at http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/
GuidanceDocuments/ucm085281.htm
102. 61 Federal Register 38347, July 23, 1996.
103. FDCA § 519(g), 21 USC § 360i(g).
104. 21 CFR § 806.10.
105. 21 CFR § 806.20.
106. 21 CFR § 806.2(j).
107. 21 CFR § 807.20(a).
108. https://www.fda.gov/MedicalDevices/ucm089731.htm
328 Endnotes
Chapter 10
109. 21 USC § 351, 352, 360, 360c, 360d, 360e, 360h, 360i, 360j, 360l, 371, 374, 381, 383.
110. http://www.fda.gov/downloads/Drugs/.../Guidances/UCM070336.pdf
111. 21 CFR § 820.90.
112. 21 CFR § 820.100.
113. 21 CFR § 820.198.
114. 21 CFR § 820.198(c) and (d).
115. 21 CFR § 820.198(g).
Chapter 11
116. 21 CFR § 7.3(g).
117. FDCA § 518(e), 21 USC § 360h(e).
118. 21 CFR § 810.10.
119. 21 CFR § 810(d).
120. 21 CFR § 7.40.
121. 21 CFR § 7.3(m).
122. 21 CFR § 7.41.
123. 21 CFR § 7.41.
124. 21 CFR § 7.41(a).
125. 21 CFR § 7.40(c).
126. 21 USC § 7.45.
127. 21 CFR § 7.45.
128. 21 CFR § 7.46(b).
129. 21 CFR § 7.48(d).
130. 21 CFR § 7.46.
131. 21 CFR § 7.46(a).
132. 21 CFR § 7.42(a).
133. 21 CFR § 7.42(b).
134. 21 CFR § 7.3.
135. 21 CFR § 7.42(a)(1).
136. 21 CFR § 7.42(a)(2).
137. 21 CFR § 7.42(a)(1).
138. 21 CFR § 7.49(a).
139. 21 CFR § 7.49(b).
140. 21 CFR § 7.49(c).
141. 21 CFR § 7.49(c).
142. 21 CFR § 7.42(b)(2).
143. 21 CFR § 7.50.
144. 21 CFR § 7.42(b)(3).
145. 21 CFR § 7.53.
146. 21 CFR § 7.53(b).
147. 21 CFR § 7.53(c).
148. 21 CFR § 7.55.
Chapter 12
149. FDA—29-May-1998, Guidance for the Content of Premarket Submissions for Software
Contained in Medical Devices. This document was superseded by FDA—2005-May-11,
Guidance for the Content of Premarket Submissions for Software Contained in Medical
Devices.
Endnotes 329
Chapter 13
150. 21 CFR § 820.70(c).
151. 21 CFR § 820.70(d).
152. 21 CFR § 820.70(e).
153. 21 CFR § 820.70(f).
154. 21 CFR § 820.70(g).
155. 21 CFR § 820.70(h).
156. 21 CFR § 820.70(i).
157. 21 CFR § 820.72.
158. ISO 11135-1:2007.
159. http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/
GuidanceDocuments/ucm109897.pdf
Chapter 16
161. http://www.fda.gov/downloads/MedicalDevices/.../UCM263366.pdf
162. Medical Device Data Systems Final Rule, 76 Federal Register 8637, February 15, 2011.
GuidanceDocuments/UCM401996.pdf
164. 21 CFR § 880.6310.
165. 21 CFR § 892.2010.
166. 21 CFR § 892.2020.
Chapter 18
167. https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfstandards/search.cfm
169. https://ec.europa.eu/growth/single-market/european-standards/
harmonised-standards/medical-devices_en
170. http://ec.europa.eu/growth/sectors/medical-devices/guidance_en
Chapter 21
171. http://www.fda.gov/downloads/medicaldevices/deviceregulationandguidance/
guidancedocuments/ucm253010.pdf
Chapter 22
172. James J. Rooney and Lee N. Vanden Heuvel, (2004). “Root Cause Analysis for
Beginners.” Quality Progress, 37(7), 45-53.
Chapter 23
173. T. M. Kubiak and Donald W. Benbow, The Certified Six Sigma Black Belt Handbook,
Second Edition (Milwaukee: ASQ Quality Press, 2009): 7–8.
330 Endnotes
174. H. Fred Walker, Ahmad Elshennawy, Bhisham C. Gupta, and Mary McShane
Vaughn, The Certified Quality Inspector Handbook, Second Edition (Milwaukee: ASQ
Quality Press, 2013): 120–121. Reference noted: Automotive Industry Action Group,
Measurement Systems Analysis (MSA) Work Group, Measurement Systems Analysis
Reference Manual, Third Edition (Dearborn, MI: Automotive Industry Action Group
Press, 2002).
175. Jack B. ReVelle, Quality Essentials: A Reference Guide from A to Z (Milwaukee:
ASQ Quality Press, 2004): 27–28.
Chapter 24
176. Id., pages 126-7.
Index
A Agência Nacional de Vigilância Sanitária

(ANVISA), 155
acceptable suppliers, 188 AIMD, 143
acceptance activities, 195–197 ambulatory surgical facility (ASF), 56
acceptance records, 196 analytical testing, 268
acceptance status, 196–197 animal tissue, 139
access to records, 95 Annex 11, 43, 47
the Act. See Food, Drug, and Cosmetic Annex I, 143–144
Act (FDCA) Annex II, 143, 144t
active implantable medical devices, Annex IX, 143, 147
139, 141–142 annual reports, 78–79
Active Implantable Medical Devices anticipatory risk planning, 221
Directive (AIMDD), 141–142, 143 appraisal costs, COQ and, 296
adequate directions for use, 52 ASTM D4169 standard, 281–282, 296
admission of responsibility, 66 ASTM F1608 standard, 296
adulterated drugs and devices, 25–26 ASTM F1980 packaging, 282
adverse events reporting attribute and variable data, 297–298
admission of responsibility, 66 audit completion, 11
annual reports and, 78–79 audit confidentiality, 124–126
electronic reporting, 75 audit execution, 10–11
English language requirement, 65 audit follow-up and closure, 11
exemptions, variances, or alternative auditor competence and evaluation, 13–14
forms, 69–70, 74 auditor's role, 4
foreign manufacturers, 88 audit performance, 10–11, 13
forms, 64 audit preparation and planning
importer requirements, 79–82 adequacy of documentation, 7–8
initial and supplemental reports, 64–65 audit process, 8, 8f
manufacturer requirements, 83–88 audit purpose and scope, 6
reporting codes, 73–74 independence, 7
reporting requirements, 69–73, 73t, 74 resources, 6
user facility reporting and, 75–78, 76–78 stage 1, 9–10
advertisements team competence, 6–7
adequate directions for use and, 52 written procedures, 7
device listing information and, 102 audit principles, 12–13
historical file maintenance of, 106–107 audit procedural references
induced samples and, 39 FDA compliance policy guide (CPG)
"intended uses" and, 51 7382.845, 16–17
material change and, 98 ISO 19011, 12–14
misbranding restrictions, 26 quality system inspection technique
representative sampling of, 97 (QSIT), 14–16
affidavits and interviews, 40–41 audit program management, 13
331
332 Index
audit reporting, 11 "caused or contributed," 57

audit roles, responsibilities, and CE markings, 147
authorities, 3 Center Director, 49
audits by purpose, 311 Center for Devices and Radiological Health
audit types, 311 (CDRH), 157, 244
AudraLex Volume 4, Annex 11, 47–48 Certified Biomedical Auditor body of
Australia, 153–154 knowledge (BOK), 311–318
Australian Register of Therapeutic change records, 185
Goods (ARTG), 154 check sheets, 291
Australian Regulatory Guidelines for China, 155–156
Medical Device (ARGMD), 155 China Food and Drug Administration
authority checks, 45 (CFDA), 155–156
authorized representative, 147 Class I, II, and III described, 28
automatic identification and data classification names, 97
capture (AIDC), 49 Class III certification, 98, 123
Class III summary, 98
cleaning process, validation of, 285
B cleanrooms, 249–251, 250t
closed systems, controls for, 44–46
bacterial endotoxin testing, 268 Code of Federal Regulations (CFR) Title 21
"become aware," 56–57 controls for open systems, 46–48
bioburden monitoring and testing, corrections and removals, 89–95
241–242, 267–268 electronic records and signatures, 43–46
biocompatibility establishment registration and device
FDA Blue Book Memorandum listing, 96–127
#G95-1, 248 labeling, 48–55
ISO 10993, 245–247, 247t medical device reporting, 55–88, 73t
biological testing, 267–268 medical device tracking requirements,
blood derivatives, 139 128–138
Blue Book Memorandum #G95-1, 248 quality system regulation (QSR), 128
body of knowledge (BOK), Certified codes/passwords, 47
Biomedical Auditor, 311–318 combination product, 49
Brazil, 155 commercial distribution, defined, 96
breast implants, reclassification of, 139 commercial off-the-shelf software (COTS),
buildings, 191 254, 258
common medical devices
directives, 276–277
C regulations, 277
standards, 277–278
calibration records and standards, 193 complaint files, 210–213
Canada, 150–152 complaints, 170
Canadian Medical Devices Conformity Compliance Policy Guide (CPG) 7382.845, 16–17
Assessment System (CMDCAS), compliance with essential requirements, 143
149, 152 components, defined, 170, 186
CAPA program development, 198–202 confidentiality of information, 124–126, 207
case law conformity assessment route, 143, 144t, 145t
Dow Chemical v. United States (1986), 40 consensus standards, FDA recognized, 270
Jamieson-McKames Pharmaceuticals, consents and refusals, 36
United States v., 36 consignee, 90
Marshall v. Barlow’s, Inc. (1978), 36 contamination control, 191
United States of America v. Acri Wholesale contract sterilization, 239, 301
Grocery Company (1976), 40 controlled environments, 249–251, 250t
United States v. Jamieson-McKames control numbers, 170, 203
Pharmaceuticals, 36 controls for open systems, 46–48
United States v. K-N Enterprises (1978), convenience kits, 49
225
Index 333
corrections and removals distribution procedures, 205–206

definitions, 90–91 distributor, defined, 57, 131
general provisions, 89–91 Division of Clinical Laboratory Diagnostics
reports and records, 91–94 (DCLD), 157
reports not required, 94–95 document approval and distribution,
scope, 89 184–185
corrective and preventive action (CAPA), documentary samples (DOC Samples), 38–39
198–202 documentation, 266–267
cosmetic products, 140 document changes, 185
cost of quality (COQ), 296 document controls, 183–185
credentials, FDA investigator, 37 Dow Chemical v. United States (1986), 40
current good manufacturing practice drugs and devices
(cGMP), 166 adulterated, 25–26
classification of, 27–28
mandatory recall orders, 34–35
D misbranded, 25–27
notification and other remedies, 28–29
data, attribute and variable, 297–298 notification orders, 29–30
data accountability, 264–265 recall authority, 33–34
data types and sampling, 297–298 registration of producer of, 27
death, reporting of, 75 repair, replacement, or refund orders,
declaration of conformity, 148 30–33
defect ratios, 298 dry heat sterilization, 241
dental laboratories, adverse events
reporting and, 69
design architecture, 255 E
design controls
defined, 178 effectiveness checks, recalls and, 224
design and development planning, 179 electrical equipment, low voltage, 140
design changes, 182–183 electron beam sterilization, 242
design history file (DHF), 170, 183 electronic records and signatures
design input, 170, 179–180 components and controls, 46–47
design output, 170, 180 controls for closed systems, 44–46
design review, 170, 181 controls for open systems, 46
design transfer, 182, 258 defined, 44
design validation, 171, 182 EudraLex Volume 4, Annex 11, 47–48
design verification, 181–182 general requirements, 46
project management, 178–179 identification codes/passwords, 47
design dossier/technical file, 146–147 predicate rules, 43
device, defined, 20 signature components and controls,
device classification, 20–21, 27–28 46–47
device corrections and removals, 89–95 signature manifestations, 46
device failure, defined, 130 signature/record linking, 46
device history record (DHR), 170, 209–210 emergency situation provision, 21
device identifier, 62, 91, 172 English language reporting requirement,
device incident reporting, 226 54, 65, 113, 151
"device intended to be implanted in EN ISO 13485, 160–161
the human body for more than EN ISO 13485:2012, 146
1 year," 130 EN ISO 14971:2009, 145
device labeling, misbranding and, 26 EN ISO 14971 version, 145
device location checks, 45 EN ISO device conformity assessments, 144t
device master record (DMR), 170, 208–209 entry or access, refusal to permit, 42
device packaging, 49 environmental control, 190–191
device reclassification, 28 equipment calibration, 191, 265–266
devices intended for human use, 27–28 establishment, defined, 97
device user facility, 57 establishment inspection report (EIR), 41
directives, defined, 276
334 Index
establishment registration and device listing expected life of a device, 57

for manufacturers and importers expiration date, 49
additional listing information, 106–107 external failure costs, 296, 318
Class III certification format, 123
confidentiality of information, 124–126
definitions, 96–99 F
electronic submission, 109
exemptions, 114–115 facilities, 266
501(k) summary content and format, facilities, MDR regulation, 55
120–123 facility qualification, 251
foreign device establishments, 112–113 failure analysis, 202, 269
general provisions, 96–99 failure mode and effects analysis (FMEA),
how to register, 101–102 230
identification of importers, 113–114 fault tree analysis (FTA), 231
information required, 103–105 FDA administrative inspection
misbranding, 111, 126 affidavits and interviews, 40–41
notification of registrant, 110 credentials and notice of inspection, 37
premarket notification, FDA actions establishment inspection report (EIR), 41
on, 126–127 in-plant photographs, 39–40
premarket notification exemptions, interstate shipment by common
116–117 carriers, 38
premarket notification information Investigation Operations Manual, 37
requirement, 117–119 investigator credentials, 37
premarket notification procedures, notice of, 37
115–116 post-inspection activity, 41–42
premarket notification submission reasons for, 37
format, 119–120 refusal to permit entry or access, 42
procedures for device establishments, samples taken, 38–39
99–100 scope of, 38
public availability of, 110–111 FDA Blue Book Memorandum #G95-1, 248
registration procedures, 101–102 FDA compliance policy guide (CPG)
timing of, 102–103 7382.845, 16–17
updating device listing information, FDA Enforcement Report, 30, 35
108–109 FDA Modernization Act (FDAMA) (1997),
waiver requirements, 109 21, 270
ethical issues, 5 FDA Quality System Inspection Technique
ethylene oxide sterilization, 241–242, 243 (QSIT), 330
EU harmonized standards listing, 271 field management directives, 35
EU medical device directives final acceptance, 196
authorized representative, 147 final distributor, defined, 131
CE marking, 147 finished devices, 50, 170
compliance with essential requirements, fishbone diagrams, 288
143–144 501(k) statement, 98
conformity assessment route, 143 501(k) summary, 98
declaration of conformity, 148 510(k) content and format, 120–123
determination of compliance, 141–142 510(k) premarket notifications, 21
device classification, 142–143 five-day reports, 57
overview, 139–140 flowcharts, 290, 290f
purpose of, 140 follow-up reports submission, 64–65
requirements for compliance, 140–141 Food, Drug, and Cosmetic Act (FDCA)
risk analysis, 144–146 definitions, 22
technical file/design dossier, 146–147 drugs and devices, 25–29
European Economic Area (EEA), 139, 274 general authority, 35–42
EU standards, hierarchy of, 270–271 notification orders, 29–35
evaluation and selection, 187 origins of, 20
evaluation results, control based on, 187 prohibited acts and penalties, 23–24
exemptions to adverse events reporting, 69–70
Index 335
Food and Drug Administration (FDA) I

authority, 20
Code of Federal Regulations (CFR), 43 identification and traceability, 189–190
confidentiality of information, 124 identification codes/passwords, 47
Draft Guidance for Industry and Staff, 283 IEC 60601 product certification, 155
notification of registrants, 110 implantable devices, 50
premarket notification submissions, 115 importer, defined, 58, 90, 130
Unified Registration and Listing System importer reporting, 79–82
(FURLS), 99 individual adverse events reporting
foreign inspections, 36 admission of responsibility, 66
foreign manufacturer reporting annual reports and, 78–79
requirements, 88 electronic reporting, 75
formal design review, 158 English language requirement, 65
Fourier transform infrared spectroscopy exemptions, variances, or alternative
(FTIR) analysis, 268 forms, 69–70, 74
Freedom of Information Act, 40 foreign manufacturers, 88
frequency of inspection, 36 forms for reporting, 64
FURLS (FDA Unified Registration and importer requirements, 79–82
Listing System), 99 initial and supplemental reports, 64–65
manufacturer requirements, 83–88
reporting codes, 73–74
G reporting requirements, 69–73, 73t, 74
user facility reporting and, 76–78
gage repeatability and reproducibility induced samples, 39
(gage R&R), 295–296 information, FDAMA provision on
gamma sterilization, 242 dissemination of, 21
General Principles of Process Validation, 194 initial audits, 2
GHTF.SG3. N99-10, 162–163 initial forms submission, 64–65
GHTF/SG4/N28R4:2008, 2 initial importers, 96–97
Global Harmonization Task Force (GHTF), injunction proceedings (Section 302), 24
2, 12, 152 in-plant photographs, 39–40
global unique device identification in-process acceptance, 196
database (GUDID), 50 inspection
Guide to Inspections of Quality Systems frequency, 36
(1999), 14 general authority, 35–37
Investigation Operations Manual, 37
notice of, 37
H scope of, 38
inspection, measuring, and test
handling, storage, distribution, and equipment, 193
installation, 204–206 inspection guides, 36
harmonized standards, 271 installation procedures, 206–207
hazardous substances in electrical and installation qualification (IQ), 163, 195,
electronic equipment (RoHS), 140 251, 266
HCT/P (human cells, tissues, or cellular/ intended uses, 51
tissue-based product), 50 internal failure costs, 296
Health Canada, 152, 314 international auditing guidelines, 9–10
health hazard evaluation, 34 international regulations
hip, knee, and shoulder joint implants, 139 Australia, 153–154
histograms, 292, 293f Brazil, 155
horizontal standards, 277 Canada, 150–152
hospital, 57–58 China, 155–156
human cells, tissues, or cellular/tissue-based Japan, 152–153
product (HCT/P), 50, 61, 90, 171 MDSAP Pilot Program, 149
international standards, 271
336 Index
interstate commerce, FDA and, 20–21 labeling and package control, 202–204
interstate shipment by common carriers, 38 labels, defined, 50
interviews, inspection, 41 label statements, required, 53
investigational samples (INV samples), 39 laboratory testing and failure analysis
Investigation Operations Manual, 37 analytical testing, 268
in vitro diagnostic devices approved procedures, 262–263
CDRH jurisdiction over, 157 bacterial endotoxin testing, 268
EU directives, 139 bioburden testing, 267–268
FDA recognized standards, 157–158 biological testing, 267–268
MDD compliance, 142 cGMP and, 262
product development, 158 data accountability, 264–265
In Vitro Diagnostic Directive (IVDD), documentation, 266–267
142, 143 environmental, 268
Ishikawa diagrams, 288 equipment, 265–266
ISO 9001, 159–160 facilities, 266
ISO 10993, biocompatibility, 245–247, 247t failure analysis, 269
ISO 11135-1:2007 standard, 241–242 methods validation, 265
ISO 11137-1:2006 standard, 242–243 personnel training, 265
ISO 11138-3:2006 standard, 241–242 quality management systems, 263
ISO 11607, packaging, 280–281 sterility testing, 267
ISO 11737-1:2006 standard, 241, 268 testing and operating procedures, 264
ISO 11737-2:2009 standard, 241 lead auditor role, 3
ISO 13485, 160–161 lean tools, 295
ISO 14160:2011 standard, 244 legal issues, 5
ISO 14644-1:1999 standard, 249 legislation
ISO 14971, risk management, 230–234 FDA Modernization Act (FDAMA)
ISO 17665-1:2006 standard, 242 (1997), 21, 270
ISO 19011, 12–14 Freedom of Information Act, 40
ISO 62366, risk management, 234–235 Safe Medical Devices Act (SMDA)
ISO/IEC 17025, 161–162 (1990), 218
licensed practitioner, defined, 131
"life-supporting or life-sustaining device
J used outside a device user
facility," 130
Jamieson-McKames Pharmaceuticals, United limulus amebocyte lysate (LAL) test, 268
States vs., 36 listing, defined, 96
Japan, 152–153 lot or batch, 50, 170
low-voltage electrical equipment, 140
K
key quality indicators, 298
M
machinery, 140
L maintenance schedules, 191
malfunction
labeler, 50 defined, 58
labeling reports of, 80
adequate directions for use, 52 management representative, 174
definitions, 49–51 management review, 175
intended uses, 51 management with executive
mandatory requirements, 26–27 responsibility, 170
misleading statements, 53 mandatory labeling requirements, 26–27
regulatory requirements, 48–49 mandatory recall orders, 34–35
required label statements prominence, mandatory recalls, 218
53–54 manufacturer, defined, 58, 90
for reusable devices, 284 manufacturer/importer report
Spanish-language labeling, 55 number, 58–59
Index 337
manufacturer reporting distributor requirements, 135–137

adverse events reporting and, 84–86 general provisions, 128–132
five-day reports and, 87–88 records and inspections, 137
foreign manufacturers, 88 retention of records, 138
requirements, 83–84 tracking requirements, 132–134
manufacturing material, 171, 186, 191–192 medical personnel, 59
manufacturing resource planning (MRP) MedWatch Medical Device Reporting
software, 253 Code Instruction Manual, 73
market withdrawal, 90 methods validation, 265
Marshall v. Barlow’s, Inc. (1978), 36 MHLW Ministerial Ordinances, 153
material change, 98 Miranda warnings, 37
MDD device classification, 143 misbranded drugs and devices
MDR files and records maintenance, 67–69 (Section 502), 25–27
MDR procedures, written, 66–67 misbranding, premarket notification and,
MDR reportable events, 59 126
MDSAP Pilot Program, 149 misleading statements, 53
measurement systems analysis (MSA), mobile medical applications (apps), 252–253
295–296 MRD (medical device report), 59
Medical Device Amendments (MDA) MSA (measurement systems analysis),
(1976), 20, 29 295–296
Medical Device Amendments (MDA) multiple distributor, defined, 131
(1992), 21, 29
medical device classification, 139, 142,
143–146 N
medical device data systems (MDDS), 253
Medical Device Directive (MDD), 142, 143 National Formulary, 20
medical device directives National Institute of Metrology, Quality
common, 276–277 and Technology (INMETRO), 155
EU, 139 national standards, 271
medical device guidance (MEDDEV) nonconforming product, 197–198
standards, 272–273 nonconformity, defined, 171
“Medical Device Notification and Voluntary nonconformity review and disposition, 197
Safety Alert Guideline,” 29–30 nontraditional sterilization methods,
medical device reporting 243–244
applicable requirements, 83–88 notice of inspection, 37
general provisions, 55–70 notification and other remedies, 28–35
importer reporting requirements, 79–82 notification orders, 29–30
individual adverse event reports and, Notified Body Operations Group (NBOG),
70–75, 73t 274–275
purpose of, 55 nursing home, 59
user facility reporting requirements,
75–79
medical devices, reuse and cleaning of O
FDA criteria for reprocessing
instructions, 284 occurrence ratings, 232t
FDA draft guidance, 283–284 Office of Regulatory Affairs (ORA), 35
labeling for reusable devices, 284 official correspondent, 97, 104, 112, 122
process overview, 284 open systems, 44, 46–48
validation of cleaning process, 285 operational qualification (IQ), 163, 195, 251,
validation of reprocessing methods, 285 266
validation of terminal reprocessing, 285 operational system checks, 45
Medical Device Single Audit Program operator, defined, 97
(MDSAP), 149 optical laboratories, adverse events
medical device tracking requirements reporting and, 69
additional requirements and organizational structure, 173
responsibilities, 134–137 out of specification (OOS) test results, 263
confidentiality, 137–138 outpatient diagnostic facility, 60
338 Index
outpatient treatment facility, 60 process metrics, 298

owner or operator, 97 process software validation, 259
process validation, 162, 171, 194, 236
process validation decision tree, 162f
P product, defined, 171, 186
product classification, Japan, 153t
packaging product code, 97
ASTM D4169, 281–282 production and process changes, 190
ASTM F1980, 282 production and process controls
design for sterility, 279 automated processes, 192–193
ISO 11607, 280–281 buildings, 191
packaging requirements, 26 calibration, 193–194
password controls, 45, 46, 47 contamination control, 191
"patient of the facility," 60 environmental control, 190–191
penalties (Section 303), 24 equipment, 191
performance measures, 298 examples, 190
performance qualification (IQ), 163, 195, 251, general provisions, 190
266 inspection, measuring, and test
permanent, defined, 61 equipment, 193–194
personal protective equipment, 140 manufacturing material, 191–192
personnel, 177, 191 personnel, 191
personnel training, 265 process validation, 194–195
photographic evidence, 39–40 production and process changes, 190
physician's office, 60–61 production identification, 51, 91, 172
plan-do-check-act (PDCA) process, 293 production identifier, 62
postmarket review, three-tiered scheme for, product recalls
20–21 court-ordered, 225
postmarket surveillance studies, 216 defined, 217
post-seizure samples, 39 elements of a model, 221–222
predicate rules, 43 FDA policy, 216–217
premarket approval applications (PMAs), 21 injunctive relief, 225
premarket notification mandatory, 218
exemptions, 116–117 mechanics and classification of, 218–221
FDA action on, 126–127 packaging and labeling and, 202
information requirement, 117–119 strategy elements, 222–225
misbranding and, 126 strategy overview, 222
procedures, 115–116 termination of, 225
submission format, 119–120 voluntary, 217
premarket regulation, three-tiered scheme websites about, 225–226
for, 20–21 professional issues, 5
pressure equipment, 140 programmable logic controllers (PLCs), 253
prevention costs, 296 prohibited acts (Section 301), 23–24
preventive action. See corrective and project management, 178–179
preventive action (CAPA) public availability of reports, 95
probability of occurrence, 231, 232t public disclosure, 62–63
process capability, 294 public warning, recalls and, 224
process controls. See production and process purchasing controls
controls purchasing data, 188
process improvement techniques scope of the requirement, 186
cost of quality (COQ), 296 supplier, contractor, consultant
lean tools, 295 evaluation, 187–188
measurement systems analysis (MSA), purchasing data, 188–189
295–296 Pure Food and Drug Act (1906), 20
process capability, 294 pyrogenicity testing, 246
Six Sigma, 294
Index 339
Q quality system requirements

management review, 175–176
qualitative analysis, 297–298 organizations, 173–175
quality, defined, 171 personnel, 177
quality audits quality audit, 176–177
defined, 171 quality planning, 176
ethical, legal, and professional issues, 5 quality policy, 173
objectives, 2 quality system procedures, 176
roles, responsibilities, and authorities, quality systems, international standards for
3–5 EN ISO 13485, 160–161
types of, 2–3 GHTF.SG3. N99-10, 162–163
quality control, problem-solving tools and ISO 9001, 159–160
cause-and-effect diagrams, 288, 289f ISO 13485, 160–161
check sheets, 291 ISO/IEC 17025, 161–162
flowcharts, 290, 290f process validation decision tree, 162f
histograms, 292, 293f quantitative analysis, 297
Pareto charts, 288, 289f
plan-do-check-act (PDCA) process, 293
root cause analysis, 292 R
scatter plots, 291, 292f
statistical process control, 291 radiation sterilization, 242–243
quality costs, 296 Radio Equipment Directive (RED), 140
quality management systems, 263–264 reasonableness of inspection, 36
quality policy, 171 "reasonably known" information, 75
quality system, defined, 171, 172 recall authority, 33–34
quality system inspection technique recalls. See product recalls
(QSIT), 14–16 recall strategy, 222–223
quality system record (QSR), 210 receiving, in-process, and finished device
quality system regulation (QSR) acceptance, 195–196
acceptance activities, 195–197 receiving acceptance, 187, 195
authority, 168 record retention period, 207
corrective and preventive action, records
198–202 acceptable suppliers, 188
definitions, 169–172 access to, 95
design controls, 178––183 complaint files, 210–213
document controls, 183–185 device history record, 209–210
exemptions or variances, 169 device master record, 208–209
general provisions, 166–173 general requirements, 207–208
handling, storage, distribution, and quality system record, 210
installation, 204–206 refusal to permit entry or access, 42
identification and traceability, 189–190 registration, defined, 96
labeling and packaging control, 202–204 Registration, Evaluation, Authorisation and
limitations, 168 Restriction of Chemicals (REACH)
nonconforming product, 197–198 regulation, 277
preamble, 164–166 registration and device listing for
production and process controls, manufacturers and importers,
190–195 96–127
purchasing controls, 185–188 regulations, defined, 277
quality system, 172 Regulations for Buildings and Facilities of
quality system requirements, 173–177 Pharmacies, Etc (MHLW
records, 206–213 Ordinance), 153
replacing Good Manufacturing remanufacturer, 171
Practice (GMP) requirements, 128 remedial action, 61
servicing, 213–214 removal, defined, 90
statistical techniques, 214–215 repackagers, 117
quality system regulation subsystems, 15–16 repair, replacement, or refund orders, 30–33
340 Index
reportable events, 59, 79–80 Six Sigma, 294

reporting codes, 73 software development
reporting requirements, 63 commercial off-the-shelf software
reports, disclosed to the public, 62–63 (COTS), 254, 258
reports of death or serious injury, 79–80 design approaches, 255–256
reports of malfunctions, 80 design changes, 258–259
representative sampling, 97, 98 design transfer, 258
reprocessing instructions, FDA criteria “for its intended use,” 253
for, 284 implementation, 256
reprocessing methods, validation of, 285 medical device data systems
required label statements (MDDS), 253
prominence of, 53–54 mobile medical applications
Spanish-language versions, 55 (apps), 252–253
requirements definition, 255 planning and process, 254, 254f
resources, 174 process software validation, 259
responsibility and authority, 174 program guidelines, 260–261
restricted devices, 97 requirements definition, 255
Restriction on Hazardous Substances software of unknown provenance
(RoHS) directive, 276 (SOUP), 254, 258
rework, defined, 171 third-party validation, 259, 260t
risk analysis, 144–146, 230–231 verification and validation, 256–258
risk control, 232, 232t software development life cycle (SDLC), 254
risk estimation, 231–232, 231t, 232t software implementation, 256
risk management software of unknown provenance (SOUP),
ISO 14971, 230–234 254, 258
ISO 62366, 234–235 Spanish-language label requirements, 55
risk management report, 233 special audits, 2
risk mitigation, 146 specification, defined, 171
risk planning, 221 standards, defined, 276
risk reduction, 233 standards, new and evolving
risk severity, 231 EU harmonized standards, 271
risk to health, 90–91 FDA recognized consensus standards,
root cause analysis, 292 270
root cause investigation, 201, 202 hierarchy of EU standards, 270–271
routine servicing, 91 medical device guidance (MEDDEV),
272–273
Notified Body Operations Group
S (NBOG), 274–275
statistical process control, 291
safe harbor provision, 21 statistical techniques, 214–215
Safe Medical Devices Act (SMDA) (1990), status reports, recalls and, 225
21, 218 steam sterilization, 242
safety alerts, 30 sterility testing, 267
samples taken, 38–39 sterilization methods
sampling tables, 16 dry heat, 241
scatter plots, 291, 292f ethylene oxide, 241–242, 243
scope of inspection, 38 nontraditional, 243–244
seizure (Section 304), 24 radiation (gamma or electron beam),
serious, adverse health consequences, 34, 130 242–243
serious conditions provision, 21 steam, 242
serious injury, reporting of, 61, 75, 79–80 traditional, 240–243
servicing, 213–214 sterilization process
severity ratings, 231, 231t deficiencies, 240
shipping containers, 50 sterility assurance level (SAL), 236
sigma ratings, 294 validation studies, 236–240
signature manifestations, 46 stock recovery, 91
signature/record linking, 46 storage procedures, 204–205
Index 341
supplemental forms submission, 64–65 V

supplemental reports, 73
surveillance audits, 2 validation. See also design validation;
process validation
closed systems and, 44
T defined, 69–70, 74, 171
and revalidation, 194
technical file/design dossier, 146–147 variable data, attribute and, 297–298
telecommunication equipment (RTTE), 140 variances, adverse events reporting,
terminal reprocessing, validation of, 285 69–70, 74
testing and operating procedures, 264 verification, defined, 171
Therapeutic Goods Administration verification and validation of software, 256
(TGA), 153–154 version or model, 51
301(k) samples, 39 vertical standards, 277
traceability, 189 vigilance (EU device incident reporting),
226–227
voluntary notifications, 30
U voluntary recalls, 217
Ultraviolet-visible (UV-VIS) spectroscopy,

268 W-Z
unannounced audits, 2
unique device identifier (UDI), 50, 62, 91, 172 warrants, 36–37
United States agent, 98 waste electrical and electronic equipment
United States of America v. Acri Wholesale (WEEE), 140
Grocery Company (1976), 40 "where appropriate" (use of term), 167
United States v. Jamieson-McKames wholesale distributors, 98
Pharmaceuticals, 36 work day, defined, 61
United States v. K-N Enterprises (1978), 225 worst-case scenarios, 195, 235, 257
universal product code (UPC), 51, 172 written procedures, 7, 157–158, 175, 183, 188
“unreasonable risk of substantial harm
to public health,” 29–30
user facility reporting
adverse events and, 76–78
annual reports, 78–79
report number, 61
requirements, 75–76
US Pharmacopeia (USP), 20
utility systems, 251
WHY ASQ?
ASQ is a global community of people passionate about quality, who use the tools,
their ideas and expertise to make our world work better. ASQ: The Global Voice of Quality.
FOR INDIVIDUALS
Advance your career to the next level of excellence.
ASQ offers you access to the tools, techniques and insights that can help distinguish
an ordinary career from an extraordinary one.
FOR ORGANIZATIONS
Your culture of quality begins here.
ASQ organizational membership provides the invaluable resources you need to
concentrate on product, service and experiential quality and continuous improvement
for powerful top-line and bottom-line results.
www.asq.org/why-asq
BELONG TO THE
QUALITY COMMUNITY
JOINING THE ASQ GLOBAL QUALITY COMMUNITY
GIVES YOU A STRONG COMPETITIVE ADVANTAGE.
For people passionate about improvement, ASQ is the global knowledge
network that links the best ideas, tools, and experts — because ASQ has the
reputation and reach to bring together the diverse quality and continuous
improvement champions who are transforming our world.
• 75,000 individual and organizational members in 150 countries
• 250 sections and local member communities
• 25 forums and divisions covering industries and topics
• 30,000+ Quality Resources items, including articles, case studies, research
and more
• 19 certifications
• 200+ training courses
For more information, visit asq.org/communities-networking.

The Biomedical Quality Auditor Handbook Sampler

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

The Biomedical Quality Auditor Handbook Sampler

Uploaded by

Copyright:

Available Formats

The Biomedical Quality

Quality Risk Management in the FDA-Regulated Industry, Second Edition

The Certified Pharmaceutical GMP Professional Handbook, Second Edition

Handbook of Investigation and Effective CAPA Systems, Second Edition

The FDA and Worldwide Current Good Manufacturing Practices and

Statistical Process Control for the FDA-Regulated Industry

Proactive Supplier Management in the Medical Device Industry

The ISO 9001:2015 Implementation Handbook: Using the Process Approach to

The Certified Six Sigma Yellow Belt Handbook

Advanced Quality Auditing: An Auditor’s Review of Risk Management, Lean Improvement,

Mastering and Managing the FDA Maze, Second Edition

Development of FDA-Regulated Medical Products, Second Edition

To request a complimentary catalog of ASQ Quality Press publications, call

ASQ Biomedical Division

ASQ Quality Press

Library of Congress Cataloging-in-Publication Data

Director, Quality Press and Programs: Ray Zielke

Printed on acid-free paper

List of Figures and Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

Part II: Biomedical Quality Management System Requirements

Chapter 6 The EU Medical Device Directives . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

Chapter 11 Postmarket Surveillance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216

Part III: Technical Biomedical Knowledge

Chapter 19 Common Medical Device Directives and Standards . . . . . . . . . . . 276

Part IV: Quality Tools and Techniques

Figure 2.1 Audit process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Mark Roberts, Roberts Consulting and Engineering, who contributed to

• Scope and results of the previous audits

AUDIT ROLES, RESPONSIBILITIES, AND AUTHORITIES

An auditor’s role is to:

In addition to the aforementioned responsibilities, the lead auditor must also:

Responsibilities of the manufacturer are:

ETHICAL, LEGAL, AND PROFESSIONAL ISSUES

AUDIT PREPARATION AND PLANNING

Competence of the Audit Team

Adequacy of Audit Documentation

Documentation maintained may include a record of the:

Audit Corrective action

Figure 2.1 Audit process.

Stage 1: Audit Preparation

working documents; team members should assist as appropriate. Examples of

• Failure to implement appropriate corrective and preventive actions

AUDIT FOLLOW-UP AND CLOSURE

Standards and guidance are made available by organizations including the

Clause 4 Principles of auditing

Clause 5 Managing an audit program

Clause 6 Performing an audit

Clause 7 Competence and evaluation of auditors

Auditors should be evaluated to determine whether additional training or work

QUALITY SYSTEM INSPECTION TECHNIQUE (QSIT)

QSIT inspections are preannounced inspections where FDA will request

FDA COMPLIANCE POLICY GUIDE (CPG) 7382.845

FDCA CHAPTER II: DEFINITIONS

FDCA CHAPTER III: PROHIBITED ACTS AND PENALTIES

(w) Knowingly make a false statement, failure to submit a required certificate

Section 302—Injunction Proceedings

FDCA CHAPTER V: DRUGS AND DEVICES

Section 502—Misbranded Drugs and Devices

of certain devices to issue notifications of unreasonable risks or to conduct

agency may require a full description of a device’s components or formula,

Section 510—Registration of Producers of Drugs and Devices

Section 513—Classification of Devices Intended for Human Use

submission/application required to legally market the device. The classifications

Section 518—Notification and Other Remedies

(i) a device intended for human use that is introduced or delivered