Regulatory Open Forum

(a) Each device manufacturer or importer shall submit a written report to FDA of any correction or removal of a device initiated by such manufacturer or importer if the correction or removal was initiated:
(1) To reduce a risk to health posed by the device; or
(2) To remedy a violation of the act caused by the device which may present a risk to health...

This seems pretty straightforward to me until read the definition of a "risk to health" in 21 CFR 806.2(k):

(k) Risk to health means
(1) A reasonable probability that use of, or exposure to, the product will cause serious adverse health consequences or death; or
(2) That use of, or exposure to, the product may cause temporary or medically reversible adverse health consequences, or an outcome where the probability of serious adverse health consequences is remote.

Section (k)(1) is straightforward, but section (k)(2) is confusing to me.  It seems like there is a typo, and that the word "not" should present before "remote" (?)

Based on all the great experiences and knowledge out there, can you help me understand how I should interpret "risk to health"?  The way it's worded now seems like it covers everything from a high probability of severe health consequences to a remote probability of severe health consequences.

Thanks tons for your insights, and Best Regards,  Lauren

• A reasonable probability that use of, or exposure to, the product will cause serious adverse health consequences or death; or
• Use of, or exposure to, the product may cause temporary or medically reversible adverse health consequences, or
• (Use of, or exposure to, the product may cause) an outcome where the probability of serious adverse health consequences is remote.

I.e., a reasonable probability of serious, a remote probability of serious, or some probability of reversible injury/illness.

The guidance document may also help if you're in a gray area:  https://www.fda.gov/media/89909/download

(a) Each device manufacturer or importer shall submit a written report to FDA of any correction or removal of a device initiated by such manufacturer or importer if the correction or removal was initiated:
(1) To reduce a risk to health posed by the device; or
(2) To remedy a violation of the act caused by the device which may present a risk to health...

This seems pretty straightforward to me until read the definition of a "risk to health" in 21 CFR 806.2(k):

(k) Risk to health means
(1) A reasonable probability that use of, or exposure to, the product will cause serious adverse health consequences or death; or
(2) That use of, or exposure to, the product may cause temporary or medically reversible adverse health consequences, or an outcome where the probability of serious adverse health consequences is remote.

Section (k)(1) is straightforward, but section (k)(2) is confusing to me.  It seems like there is a typo, and that the word "not" should present before "remote" (?)

Based on all the great experiences and knowledge out there, can you help me understand how I should interpret "risk to health"?  The way it's worded now seems like it covers everything from a high probability of severe health consequences to a remote probability of severe health consequences.

Thanks tons for your insights, and Best Regards,  Lauren

(a) Each device manufacturer or importer shall submit a written report to FDA of any correction or removal of a device initiated by such manufacturer or importer if the correction or removal was initiated:
(1) To reduce a risk to health posed by the device; or
(2) To remedy a violation of the act caused by the device which may present a risk to health...

This seems pretty straightforward to me until read the definition of a "risk to health" in 21 CFR 806.2(k):

(k) Risk to health means
(1) A reasonable probability that use of, or exposure to, the product will cause serious adverse health consequences or death; or
(2) That use of, or exposure to, the product may cause temporary or medically reversible adverse health consequences, or an outcome where the probability of serious adverse health consequences is remote.

Section (k)(1) is straightforward, but section (k)(2) is confusing to me.  It seems like there is a typo, and that the word "not" should present before "remote" (?)

Based on all the great experiences and knowledge out there, can you help me understand how I should interpret "risk to health"?  The way it's worded now seems like it covers everything from a high probability of severe health consequences to a remote probability of severe health consequences.

Thanks tons for your insights, and Best Regards,  Lauren

First a word of caution. Part 806 is not about recalls; it is about corrections and removals. Recalls are in Part 7 and run by CDRH. This is important because I seen companies try to make Part 806 reporting decisions based the company's anticipated recall classification. FDA assigns the recall class not the manufacturer. Base the decision to report on the logic in Part 806 only, not using anything in Part 7.

In terms of 806(2)(k), it covers death and four cases involving serious adverse health consequences:
(k)(1) covers a reasonable probability
(k)(2) first part covers temporary
(k)(2) first part covers medically reversible
(k)(2) second part covers remote probability

The four parts are not mutually exclusive, which causes confusion. The other source of confusion is that the definition entangles severity and probability.

In my opinion, the best classification uses a two-dimensional matrix. (This will look similar to a traditional ISO 14971:2007 risk matrix.)

First determine the severity using the scale: death, serious adverse health consequence, medically reversible adverse health consequence, temporary adverse health consequence, and no adverse health consequence.

Second determine the probability using the scale: reasonable probability and remote probability.

This provides a 5 x 2 matrix with 10 cells. Based on the definition, fill in the cells with either RTH or Not RTH where RTH means risk to health.

Take the result up to the two reporting conditions in 806.10(a). This will give you a 2 x 2 matrix with the cell values as reportable or not reportable. Then apply the five exemptions. Four are in 806.1(b) and one is in the post-market cyber-security guidance document. Then apply the two exceptions in 806.10(f). Finally, you have a yes/no response to the question "Submit a C&R report?"

There are multiple ways to document the decision process. I think Fault Tree Analysis, FTA, is a great way. The top event is "Submit a C&R report". You will need AND gates, OR gates, and NOT gates.

(a) Each device manufacturer or importer shall submit a written report to FDA of any correction or removal of a device initiated by such manufacturer or importer if the correction or removal was initiated:
(1) To reduce a risk to health posed by the device; or
(2) To remedy a violation of the act caused by the device which may present a risk to health...

This seems pretty straightforward to me until read the definition of a "risk to health" in 21 CFR 806.2(k):

(k) Risk to health means
(1) A reasonable probability that use of, or exposure to, the product will cause serious adverse health consequences or death; or
(2) That use of, or exposure to, the product may cause temporary or medically reversible adverse health consequences, or an outcome where the probability of serious adverse health consequences is remote.

Section (k)(1) is straightforward, but section (k)(2) is confusing to me.  It seems like there is a typo, and that the word "not" should present before "remote" (?)

Based on all the great experiences and knowledge out there, can you help me understand how I should interpret "risk to health"?  The way it's worded now seems like it covers everything from a high probability of severe health consequences to a remote probability of severe health consequences.

Thanks tons for your insights, and Best Regards,  Lauren

(a) Each device manufacturer or importer shall submit a written report to FDA of any correction or removal of a device initiated by such manufacturer or importer if the correction or removal was initiated:
(1) To reduce a risk to health posed by the device; or
(2) To remedy a violation of the act caused by the device which may present a risk to health...

This seems pretty straightforward to me until read the definition of a "risk to health" in 21 CFR 806.2(k):

(k) Risk to health means
(1) A reasonable probability that use of, or exposure to, the product will cause serious adverse health consequences or death; or
(2) That use of, or exposure to, the product may cause temporary or medically reversible adverse health consequences, or an outcome where the probability of serious adverse health consequences is remote.

Section (k)(1) is straightforward, but section (k)(2) is confusing to me.  It seems like there is a typo, and that the word "not" should present before "remote" (?)

Based on all the great experiences and knowledge out there, can you help me understand how I should interpret "risk to health"?  The way it's worded now seems like it covers everything from a high probability of severe health consequences to a remote probability of severe health consequences.

Thanks tons for your insights, and Best Regards,  Lauren

Great questions.  Much needs to be said here regarding this robust and challenging topic for which superficial answers can be risky.  I'll apologize in advance for my lengthy narrative.

Remember that for practical intents and purposes, 21 CFR Part 806 (Medical Devices; Reports of Corrections and Removals) is inseparable from, and integrated with, the recall parameters of 21 CFR Part 7.  Decoupling Part 7 from Part 806 makes it essentially impossible to clearly and properly solve pressing Part 806 questions like interpreting what FDA means by "risk to health".  That can easily lead to over-reporting or under-reporting of a firm's remedial actions.  Indeed, a comment from FDA during a recent FDA webinar echoes this, where FDA stated, "…correctly categorizing medical device recalls…amplifies the likelihood that firms will appropriately determine when 806 reports to CDRH are and are not necessary and increases the likelihood that FDA will concur with industry decisions regarding reporting obligations…"

So when approaching Part 806, be sure to first review and internalize the 21 CFR Part 7 definition of "recall", which means a correction or removal of a marketed product that the Food and Drug Administration considers to be in violation of the laws it administers and against which the agency would initiate legal action.  Since the longstanding Part 7 definition of "recall" is anchored by the terms "correction" and "removal", and because the use of those same terms in Part 806 is not a coincidence but rather directly predicated on FDA's established use of them for the specific context of recalls (in fact the Part 806 definitions are identical to the preexisting Part 7 and/or Part 810 predecessors), one can start to see even more clearly how Part 806 most definitely asserts certain requirements about "recalls".

Next, remember that when promulgating Part 806, FDA formally established that the Part 806 recall reporting requirements track directly to Part 7 Class I and Class II recalls (yet not Class III recalls).  In fact, the Part 806 definition of "risk to health" is an identical combination of the Part 7 definitions for Class I and II recalls, thus giving us still more insight into Part 806's inseparability from FDA recalls. Specifically, because the Part 806 reportability threshold is predicated on, and directly tethered to, the Part 7 definitions of Class I and II recalls, a proper interpretation of Part 806's definition of "risk to health" intrinsically mandates that we achieve a fuller understanding about FDA's notions of Class I and II recalls, as FDA's Part 806 promulgation activities didn't give further insights about this (and understandably so, as Part 806's "risk to health" definition is fully dependent on Part 7).

Therefore, this demands a deeper dive into FDA's standard procedures and interpretations about "recall" in general.  We can get that from looking closer at FDA's Part 7 (and Part 810) promulgation activities and also in associated interpretive and implementing practices like FDA's Regulatory Procedures Manual and Investigations Operations Manual.  Below, I summarize my conclusions drawn from my pursuit of that exercise, but I encourage stakeholders to also do that exercise for themselves, because, as becomes quickly apparent by studying FDA's promulgation of Part 7, the identification of the need for "recall" is often a nebulous endeavor and often requires some subjective judgment due to the statutory and legally-intensive characteristics intrinsic in the Part 7 recall definition.

Now, when promulgating Part 7 and characterizing the basis for its corresponding policies affecting the need for "recall", FDA stated that part of its recall deliberations involves consideration of some rather intangible keywords like:

• Unacceptable HHE findings (more on that below);
• Unacceptable degree of deception;
• Danger to health;
• Widely distributed;
• Urgent (beyond serious) matter;
• Protect public welfare (beyond just health hazards);
• Significant violations;
• Considerations and principles of reasonableness require a legal action that wouldn't be frivolous; and
• Flexible procedures, not rigid rules.

Because of such intangibles and because they might be interpreted differently by different stakeholders, all firms should be careful when employing a pure "1+1 = 2" approach to identify "risk to health".  Such mechanical paradigms are certainly useful, especially when characterizing the basic severity and frequency of the problem, but should not be applied in a vacuum without also applying more dynamic subjective judgment so as to assure FDA's intangibles and fundamental goals for recalls are also given due consideration.

By the way, it is critical that such severity and frequency calculations use the same paradigms that are employed in the firm's risk management procedures.  Otherwise, compliance problems can spiral when FDA detects discrepancies between the two.  For example, if the product's standing risk analysis assigns a high severity to a projected problem while the firm's recall deliberations yield a low severity, then such a discrepancy would need careful justification or resolution.  Such a discovery by FDA could quickly lead to compliance trouble.  So, without prejudice against the narratives below regarding HRA/HHE, firms should think twice about inventing risk assessment schemes for recalls that fundamentally differ from the basic scheme already established in the firm's risk management procedure.  Such inventions are no doubt impressive in the theoretical realm but can be perilous in the real world.

It is true that FDA has full and final authority over determining the need for a recall and classifying recalls.  But for the health of a regulated firm's business, compliance, and brand, it is absolutely imperative when grappling with a potential recall that the firm independently and formally analyze the need for, and the projected classification of, a possible recall.  Accordingly, it's important to know that FDA, when deliberating about a possible recall (and any consequent need for Part 806 reporting), uses its Health Risk Assessment (HRA) / Health Hazard Evaluation (HHE) process.  Accordingly, firms should employ the very same technique.  In fact, I recommend integrating a version of FDA's HRA/HHE into the firm's written recall procedures.  This is important because the HRA/HHE process contains key organic questions that culminate in conclusions and outputs ultimately driving the recall decision and classification, thus in turn more clearly revealing whether there is a "risk to health" and consequent need for Part 806 reporting.  If a firm instead relies solely on a health risk assessment paradigm of its own invention for the context of recall deliberations, then it increases the likelihood of conflict with the FDA and improper recall handling.  Moreover, including the firm's side of the story via the same HRA/HHE method used by FDA is a powerful component of defending the firm's recall documentation which will, sooner or later, be reviewed and scrutinized by FDA.  Don't wait for the agency to take the lead on the recall classification, as such a practice can result in additional damaging and unnecessary compliance consequences.

In a nutshell, my analysis of the Class I and II recall (and thus the Part 806 reporting) thresholds is this:

1. If there is a "reasonable probability" (FDA says this means "more likely than not" and promises us that the agency has "considerable discretion" in this interpretation) that use of, or exposure to, the violative product will cause serious adverse health consequences or death, then this generally tracks to a Class I recall and corresponding Part 806 report.
2. If there is even a "remote" probability that use or exposure could cause serious adverse health consequences, then that generally tracks to a Class II recall and corresponding Part 806 report. FDA online guidance gives some additional insights by stating that this category is where there is a "slight chance" that the violative product will cause serious health problems or death.
3. If use or exposure "may" (i.e., more than a remote chance that it could) cause temporary or medically-reversible adverse health consequences, then that also generally tracks to a Class II recall and corresponding Part 806 report.
4. If use or exposure of the violative product is not likely to (yet still could) cause any adverse health consequences (and those don't exceed the Class I or II thresholds), then that generally tracks to a Class III recall, for which no Part 806 report is required. The FDA Commissioner when promulgating Part 7 gave some additional guidance stating that Class III recalls are for those product recall situations where use of the product would result in "no or little likelihood" of harm and the violative product is not otherwise associated with the degrees of hazard contemplated by Class I or II.  Another clue to help delineate the line between reporting and not reporting is where FDA, when promulgating Part 806, stated that FDA's Part 806 reporting threshold, "…allows FDA to allocate its resources efficiently and precludes an unnecessary burden on manufacturers of reporting requirements for extremely remote, trivial risks to the public health…"
5. If the violation otherwise harms public welfare (beyond just health hazards) such as via gross consumer deception, breadth of distribution, or other significant violations for which FDA legal action would not be frivolous, then that generally tracks to a Class III recall, for which no Part 806 report is required.

Now, forgive me for the delayed punchline [I know the burning question still remains about understanding the frequency-related attributes of these thresholds (e.g., "reasonable probability", "more likely than not", "remote", "may", "not likely", etc.)], but the foregoing background demonstrates that there is not an easy answer.  Yet it also shows that we can nevertheless still achieve compliance acuity enabling us to more confidently, and more properly, identify the ultimate need for Class I and II recalls (i.e., the need for Part 806 reporting).  Specifically, firms should assert a combination of:

• Proper understanding of the close synergy between Part 7 and Part 806;
• Clear discernment of Class I and Class II recall thresholds;
• The same frequency categories defined in the firm's existing risk management procedures rather than inventing something different just for recalls;
• Careful consideration of the answers to the questions documented in the HRA/HHE; and
• Dynamic judgments regarding the aforementioned intangibles (legal and otherwise).

Hope this helps.

(a) Each device manufacturer or importer shall submit a written report to FDA of any correction or removal of a device initiated by such manufacturer or importer if the correction or removal was initiated:
(1) To reduce a risk to health posed by the device; or
(2) To remedy a violation of the act caused by the device which may present a risk to health...

This seems pretty straightforward to me until read the definition of a "risk to health" in 21 CFR 806.2(k):

(k) Risk to health means
(1) A reasonable probability that use of, or exposure to, the product will cause serious adverse health consequences or death; or
(2) That use of, or exposure to, the product may cause temporary or medically reversible adverse health consequences, or an outcome where the probability of serious adverse health consequences is remote.

Section (k)(1) is straightforward, but section (k)(2) is confusing to me.  It seems like there is a typo, and that the word "not" should present before "remote" (?)

Based on all the great experiences and knowledge out there, can you help me understand how I should interpret "risk to health"?  The way it's worded now seems like it covers everything from a high probability of severe health consequences to a remote probability of severe health consequences.

Thanks tons for your insights, and Best Regards,  Lauren