Great questions. Much needs to be said here regarding this robust and challenging topic for which superficial answers can be risky. I'll apologize in advance for my lengthy narrative.
Remember that for practical intents and purposes, 21 CFR Part 806 (Medical Devices; Reports of Corrections and Removals) is inseparable from, and integrated with, the recall parameters of 21 CFR Part 7. Decoupling Part 7 from Part 806 makes it essentially impossible to clearly and properly solve pressing Part 806 questions like interpreting what FDA means by "risk to health". That can easily lead to over-reporting or under-reporting of a firm's remedial actions. Indeed, a comment from FDA during a recent FDA webinar echoes this, where FDA stated, "…correctly categorizing medical device recalls…amplifies the likelihood that firms will appropriately determine when 806 reports to CDRH are and are not necessary and increases the likelihood that FDA will concur with industry decisions regarding reporting obligations…"
So when approaching Part 806, be sure to first review and internalize the 21 CFR Part 7 definition of "recall", which means a correction or removal of a marketed product that the Food and Drug Administration considers to be in violation of the laws it administers and against which the agency would initiate legal action. Since the longstanding Part 7 definition of "recall" is anchored by the terms "correction" and "removal", and because the use of those same terms in Part 806 is not a coincidence but rather directly predicated on FDA's established use of them for the specific context of recalls (in fact the Part 806 definitions are identical to the preexisting Part 7 and/or Part 810 predecessors), one can start to see even more clearly how Part 806 most definitely asserts certain requirements about "recalls".
Next, remember that when promulgating Part 806, FDA formally established that the Part 806 recall reporting requirements track directly to Part 7 Class I and Class II recalls (yet not Class III recalls). In fact, the Part 806 definition of "risk to health" is an identical combination of the Part 7 definitions for Class I and II recalls, thus giving us still more insight into Part 806's inseparability from FDA recalls. Specifically, because the Part 806 reportability threshold is predicated on, and directly tethered to, the Part 7 definitions of Class I and II recalls, a proper interpretation of Part 806's definition of "risk to health" intrinsically mandates that we achieve a fuller understanding about FDA's notions of Class I and II recalls, as FDA's Part 806 promulgation activities didn't give further insights about this (and understandably so, as Part 806's "risk to health" definition is fully dependent on Part 7).
Therefore, this demands a deeper dive into FDA's standard procedures and interpretations about "recall" in general. We can get that from looking closer at FDA's Part 7 (and Part 810) promulgation activities and also in associated interpretive and implementing practices like FDA's Regulatory Procedures Manual and Investigations Operations Manual. Below, I summarize my conclusions drawn from my pursuit of that exercise, but I encourage stakeholders to also do that exercise for themselves, because, as becomes quickly apparent by studying FDA's promulgation of Part 7, the identification of the need for "recall" is often a nebulous endeavor and often requires some subjective judgment due to the statutory and legally-intensive characteristics intrinsic in the Part 7 recall definition.
Now, when promulgating Part 7 and characterizing the basis for its corresponding policies affecting the need for "recall", FDA stated that part of its recall deliberations involves consideration of some rather intangible keywords like:
- Unacceptable HHE findings (more on that below);
- Unacceptable degree of deception;
- Danger to health;
- Widely distributed;
- Urgent (beyond serious) matter;
- Protect public welfare (beyond just health hazards);
- Significant violations;
- Considerations and principles of reasonableness require a legal action that wouldn't be frivolous; and
- Flexible procedures, not rigid rules.
Because of such intangibles and because they might be interpreted differently by different stakeholders, all firms should be careful when employing a pure "1+1 = 2" approach to identify "risk to health". Such mechanical paradigms are certainly useful, especially when characterizing the basic severity and frequency of the problem, but should not be applied in a vacuum without also applying more dynamic subjective judgment so as to assure FDA's intangibles and fundamental goals for recalls are also given due consideration.
By the way, it is critical that such severity and frequency calculations use the same paradigms that are employed in the firm's risk management procedures. Otherwise, compliance problems can spiral when FDA detects discrepancies between the two. For example, if the product's standing risk analysis assigns a high severity to a projected problem while the firm's recall deliberations yield a low severity; or likewise, if the standing risk analysis correlates “remote” with 1-in-10,000 occurrences while the recall deliberations happen to characterize the same or higher observed frequency with something less than “remote”, then such discrepancies would need careful justification or resolution. Indeed, these kinds of discoveries by FDA could quickly lead to compliance trouble. So, without prejudice against the narratives below regarding HRA/HHE, firms should think twice about inventing risk assessment schemes for recalls that fundamentally differ from the basic scheme already established in the firm's risk management procedure. Such inventions are no doubt impressive in the theoretical realm but can be perilous in the real world.
It is true that FDA has full and final authority over determining the need for a recall and classifying recalls. But for the health of a regulated firm's business, compliance, and brand, it is absolutely imperative when grappling with a potential recall that the firm independently and formally analyze the need for, and the projected classification of, a possible recall. Accordingly, it's important to know that FDA, when deliberating about a possible recall (and any consequent need for Part 806 reporting), uses its Health Risk Assessment (HRA) / Health Hazard Evaluation (HHE) process. Accordingly, firms should employ the very same technique. In fact, I recommend integrating a version of FDA's HRA/HHE into the firm's written recall procedures. This is important because the HRA/HHE process contains key organic questions that culminate in conclusions and outputs ultimately driving the recall decision and classification, thus in turn more clearly revealing whether there is a "risk to health" and consequent need for Part 806 reporting. If a firm instead relies solely on a health risk assessment paradigm of its own invention for the context of recall deliberations, then it increases the likelihood of conflict with the FDA and improper recall handling. Moreover, including the firm's side of the story via the same HRA/HHE method used by FDA is a powerful component of defending the firm's recall documentation which will, sooner or later, be reviewed and scrutinized by FDA. Don't wait for the agency to take the lead on the recall classification, as such a practice can result in additional damaging and unnecessary compliance consequences.
In a nutshell, my analysis of the Class I and II recall (and thus the Part 806 reporting) thresholds is this:
- If there is a "reasonable probability" (FDA says this means "more likely than not" and promises us that the agency has "considerable discretion" in this interpretation) that use of, or exposure to, the violative product will cause serious adverse health consequences or death, then this generally tracks to a Class I recall and corresponding Part 806 report.
- If there is even a "remote" probability that use or exposure could cause serious adverse health consequences, then that generally tracks to a Class II recall and corresponding Part 806 report. FDA online guidance gives some additional insights by stating that this category is where there is a "slight chance" that the violative product will cause serious health problems or death.
- If use or exposure "may" (i.e., more than a remote chance that it could) cause temporary or medically-reversible adverse health consequences, then that also generally tracks to a Class II recall and corresponding Part 806 report.
- If use or exposure of the violative product is not likely to (yet still could) cause any adverse health consequences (and those don't exceed the Class I or II thresholds), then that generally tracks to a Class III recall, for which no Part 806 report is required. The FDA Commissioner when promulgating Part 7 gave some additional guidance stating that Class III recalls are for those product recall situations where use of the product would result in "no or little likelihood" of harm and the violative product is not otherwise associated with the degrees of hazard contemplated by Class I or II. Another clue to help delineate the line between reporting and not reporting is where FDA, when promulgating Part 806, stated that FDA's Part 806 reporting threshold, "…allows FDA to allocate its resources efficiently and precludes an unnecessary burden on manufacturers of reporting requirements for extremely remote, trivial risks to the public health…"
- If the violation otherwise harms public welfare (beyond just health hazards) such as via gross consumer deception, breadth of distribution, or other significant violations for which FDA legal action would not be frivolous, then that generally tracks to a Class III recall, for which no Part 806 report is required.
Now, forgive me for the delayed punchline [I know the burning question still remains about understanding the frequency-related attributes of these thresholds (e.g., "reasonable probability", "more likely than not", "remote", "may", "not likely", etc.)], but the foregoing background demonstrates that there is not an easy answer. Yet it also shows that we can nevertheless still achieve compliance acuity enabling us to more confidently, and more properly, identify the ultimate need for Class I and II recalls (i.e., the need for Part 806 reporting). Specifically, firms should assert a combination of:
- Proper understanding of the close synergy between Part 7 and Part 806;
- Clear discernment of Class I and Class II recall thresholds;
- The same frequency categories defined in the firm's existing risk management procedures rather than inventing something different just for recalls;
- Careful consideration of the answers to the questions documented in the HRA/HHE; and
- Dynamic judgments regarding the aforementioned intangibles (legal and otherwise).
Hope this helps.
------------------------------
Kevin Randall, ASQ CQA, RAC (U.S., Canada, Europe)
Principal Consultant
ComplianceAcuity, Inc.
Golden CO
United States
www.complianceacuity.com© Copyright 2019 by ComplianceAcuity, Inc. All rights reserved.
The information provided in Kevin Randall’s commentary does not, and is not intended to, constitute legal advice; instead, all information, content, and materials available or referred to within this commentary are for general informational purposes only. Information in this commentary may not constitute the most up-to-date legal or other information. This commentary may reference other third-party content. Such references are only for the convenience of the reader, user or browser; the author does not recommend or endorse the contents of such third-party content. Readers of this commentary should contact their attorney to obtain advice with respect to any particular legal matter or compliance scenario. No reader, user, or browser of this commentary should act or refrain from acting on the basis of information in this commentary without first seeking legal advice from counsel in the relevant jurisdiction and/or contacting ComplianceAcuity directly. Only your individual attorney can provide assurances that the information contained herein – and your interpretation of it – is applicable or appropriate to your particular situation. Use of, and access to, this commentary or any of the references therein do not create an attorney-client relationship between the reader, user, or browser and the author or RAPS. The views expressed in, or through, this commentary are those of the individual author writing in his individual capacity only – not those of his employer or RAPS. All liability with respect to actions taken or not taken based on the contents of this commentary are hereby expressly disclaimed. The content in this commentary is provided "as is;" no representations are made that the content is error-free.
------------------------------
Original Message:
Sent: 18-Oct-2019 08:28
From: Lauren Kamer
Subject: FDA Medical Device Recall Reportability
Hello Colleagues
I'm hoping that I can get some pearls of wisdom from you related to the wording of the regulations for deciding when a medical device recall must be reported to FDA.
21 CFR 806.10(a) says the following:
(a) Each device manufacturer or importer shall submit a written report to FDA of any correction or removal of a device initiated by such manufacturer or importer if the correction or removal was initiated:
(1) To reduce a risk to health posed by the device; or
(2) To remedy a violation of the act caused by the device which may present a risk to health...
This seems pretty straightforward to me until read the definition of a "risk to health" in 21 CFR 806.2(k):
(k) Risk to health means
(1) A reasonable probability that use of, or exposure to, the product will cause serious adverse health consequences or death; or
(2) That use of, or exposure to, the product may cause temporary or medically reversible adverse health consequences, or an outcome where the probability of serious adverse health consequences is remote.
Section (k)(1) is straightforward, but section (k)(2) is confusing to me. It seems like there is a typo, and that the word "not" should present before "remote" (?)
Based on all the great experiences and knowledge out there, can you help me understand how I should interpret "risk to health"? The way it's worded now seems like it covers everything from a high probability of severe health consequences to a remote probability of severe health consequences.
Thanks tons for your insights, and Best Regards, Lauren
------------------------------
Lauren Kamer RAC
Sr. Director of Regulatory and Clinical Affairs
United States
------------------------------