7.5 Safe Medical Device Act, Device Reporting, and Tracking Logs

Why This Topic Is Tested

The Safe Medical Device Act (SMDA) of 1990 is one of the few federal statutes that places a direct reporting duty on the hospital rather than on a manufacturer or a licensed clinician, and in most organizations the person who owns that duty is the risk manager. Domain 3 (Legal and Regulatory) contributes 20 scored items to the CPHRM, and SMDA reporting appears there alongside device reporting and tracking logs. Questions are rarely pure recall of the statute's name. They hand you a device-involved event and ask what you report, to whom, within how many days, and what you do with the device in the meantime.

Frame it correctly and most items answer themselves: SMDA is a reporting obligation, not an adjudication. The risk manager does not decide whether the device was defective before reporting, and does not need engineering confirmation, a completed root cause analysis, or the manufacturer's agreement. Any answer choice that makes the report contingent on proving causation is wrong for that reason alone.

What the SMDA Requires of User Facilities

The SMDA amended the Federal Food, Drug, and Cosmetic Act and is implemented through the FDA's Medical Device Reporting (MDR) regulation at 21 CFR Part 803. Before 1990 only manufacturers reported device problems, which meant the FDA learned of failures only when a manufacturer chose to tell it. The SMDA closed that gap by creating a newly regulated class: the device user facility.

A device user facility is a hospital, ambulatory surgical facility, nursing home, outpatient diagnostic facility, or outpatient treatment facility that is not a physician's office. Physician offices, school health rooms, and employee health units are excluded, which is a favorite distractor when a stem places the event in an affiliated clinic. The practical consequence for an integrated system is real: the same event may carry a mandatory MDR duty in the hospital's surgery center and no MDR duty in an owned physician practice down the street, although that practice may still report voluntarily.

The trigger standard: "reasonably suggests"

A user facility must report when it becomes aware of information that reasonably suggests a device has or may have caused or contributed to a death or serious injury. Three features of that standard are heavily tested:

1. "May have" - possible contribution is enough. Certainty is never required.
2. "Reasonably suggests" - a deliberately low threshold designed to over-collect signal. Filing an MDR is expressly not an admission that the device, the facility, or any employee caused harm, and the FDA says so on the form.
3. "Becomes aware" - the clock starts when any employee learns the information, not when the risk manager is finally told. That is why event-reporting systems must route device events to risk management the day they are entered.

Serious injury carries a regulatory definition worth memorizing: an injury or illness that is life-threatening, results in permanent impairment of a body function or permanent damage to a body structure, or necessitates medical or surgical intervention to preclude such permanent impairment or damage. A burn requiring grafting to prevent contracture qualifies. A transient bruise does not.

The Reporting Matrix

This table is the single most testable object in the topic. Learn destination and clock together.

Four memory anchors:

• Death goes to both. Injury goes to the maker. The only time a serious injury goes to the FDA is when the manufacturer cannot be identified.
• Ten work days, not ten calendar days, running from awareness - not from the RCA, not from the family's complaint, not from the claim.
• 3500A is mandatory; 3500 is voluntary. A clinician who files a voluntary 3500 on her own does not discharge the facility's 3500A duty.
• Malfunctions belong to manufacturers. User facilities report deaths and serious injuries.

Part 803 also requires every user facility to develop, maintain, and implement written MDR procedures covering internal identification, evaluation, timely transmission, and documentation of reportable events, and to retain MDR event files for two years from the date of the event or a period equal to the expected life of the device, whichever is longer. Surveyors ask to see the written procedure and the event files, so the compliance evidence is the process, not merely the individual reports. Facilities enrolled in MedSun, the FDA's Medical Product Safety Network of sentinel reporting sites, report through that channel and receive feedback on national device signals.

Device Tracking, UDI, and Recalls

Tracking orders (21 CFR Part 821)

The FDA may order a manufacturer to track specific devices so any individual patient can be located quickly if the device must be recalled or corrected. The categories subject to tracking are devices whose failure would be reasonably likely to have serious adverse health consequences, devices intended to be implanted in the body for more than one year, and life-sustaining or life-supporting devices used outside a user facility. In a hospital that typically means implantable cardioverter-defibrillators, pacemakers, heart valves, ventricular assist devices, and certain home ventilators.

The user facility's share of tracking is the log. At implantation the facility captures manufacturer, model, lot and serial number, implant date, and the identity and current location of the patient, and provides that data to the manufacturer on request. Weak implant-log discipline is a routine survey finding and it converts a straightforward recall into a chart-by-chart manual hunt.

Unique Device Identification

The Unique Device Identifier (UDI) system requires most devices to carry a machine-readable identifier composed of a device identifier (DI), which encodes make and model, and a production identifier (PI), which encodes lot, serial number, expiration, and manufacturing date. DIs are published in the FDA's Global Unique Device Identification Database (GUDID). When the UDI is captured at the point of use in the electronic health record and the supply chain system, recall response becomes a database query rather than an investigation. Advocating for point-of-use UDI capture is a standard risk-management recommendation and a defensible exam answer.

Recall classification

Recall class describes the health hazard, not the size of the recall and not who initiated it. Most recalls are voluntary manufacturer actions; the FDA assigns the class.

The recall workflow itself is identical each time: receive the notice or the alert from the group purchasing organization or a patient-safety organization; identify every affected unit across all campuses, clinics, crash carts, consignment stock, and loaner instrument sets; quarantine physically and in the item master so the unit cannot be reissued; determine which patients received or were exposed to the device; decide with medical staff leadership and counsel who must be notified and by what method; execute notification for implant recipients with tracked, documented mailing; and report reconciliation back to the safety committee. Failure to close the loop on implant notification is a liability exposure independent of the device defect itself.

Sequestration: What the Risk Manager Does First

Scenario

During a laparoscopic procedure a patient sustains a full-thickness bowel injury when the electrosurgical generator reportedly arced. The patient returns to the operating room for a bowel resection and is admitted to the ICU. The circulating nurse has already sent the generator to biomedical engineering, a surgical technician discarded the disposable electrode and its packaging, and the manufacturer's field representative calls at 4:00 p.m. offering to pick up the unit "for testing." Everything that matters here happens in the first hour, and none of it is clinical.

Sequester immediately and completely. Remove the device from service and secure it in a locked, access-controlled location. Sequestration covers everything that was in the circuit, not just the console: disposables, cables, leads, electrodes, tubing, batteries, packaging, sterilization indicators, and any single-use item that would ordinarily be thrown away. In this scenario the discarded electrode and its packaging carried the lot number and expiration date and were arguably the most probative evidence in the room.

Do not alter the device's state. Do not clean or reprocess it. Do not recharge or swap batteries. Do not clear alarms or error logs. Do not reset or reprogram settings. Do not run preventive maintenance on it. Do not "just test whether it still works." Where circumstances allow, photograph the device in place with settings and displays visible before anything is moved.

Document identity. Capture manufacturer, model, serial number, UDI, software or firmware version, lot numbers of every disposable, the settings in use, the biomedical engineering service and preventive maintenance history, and the names of everyone who handled the device.

Establish chain of custody. A signed, dated custody log recording every transfer of possession, with one accountable custodian, is what turns a piece of equipment into an admissible exhibit. Coordinate with biomedical engineering, which may inspect but must not repair; materials management, to quarantine remaining stock from the same lot; and legal counsel.

Run the SMDA clock in parallel. Sequestration and MDR reporting are not sequential steps. This event is a serious injury because it necessitated surgical intervention to preclude permanent damage, so it is reported to the manufacturer within 10 work days regardless of what the internal investigation eventually concludes.

The manufacturer's request for the device

This is the discriminating question on the exam. The manufacturer has a legitimate regulatory interest in evaluating the device and cooperation is generally appropriate, but once litigation is reasonably anticipated the risk manager does not surrender the device without counsel's agreement. Two independent harms follow from handing it over informally. First, the organization loses control of the single most important defense exhibit and may never get it back intact. Second, if the device is altered, destructively tested, or lost in the manufacturer's possession, the organization can face a spoliation claim and an adverse-inference instruction even though a third party did the destroying. The defensible path is a written agreement negotiated by counsel: non-destructive testing first, joint or observed inspection with notice to other interested parties, a defined return date, and preservation of all test data and photographs. The risk manager's job is to keep the device intact until that agreement exists.

Exam Traps

• Waiting for causation. "Complete the root cause analysis, then decide whether to report" is always wrong; the trigger is information that reasonably suggests involvement.
• Swapping the destinations. Death goes to the FDA and the manufacturer. Serious injury goes to the manufacturer, and to the FDA only when the manufacturer is unknown.
• Calendar days. The clock is 10 work days from awareness.
• Form confusion. 3500A is the mandatory MDR form, 3500 is voluntary, 3419 is the user-facility annual summary.
• Sending the device out to be "fixed." Repair, reprocessing, or unilateral manufacturer testing destroys evidence.
• Sequestering only the machine. Disposables, packaging, and lot numbers travel with the device.
• Treating the MDR as an admission. It is not one, and the report should not be delayed out of liability fear - though the narrative states observed facts and does not speculate about fault.
• Exceeding the role. The risk manager reports, preserves, documents, coordinates, and escalates. Declaring the device defective, disciplining the technician, or promising the family a conclusion all exceed the risk manager's authority.