Vigilance Reporting Under the MDR: Insider’s Guide
Implementing the European Medical Devices Regulation (MDR; 2017/745) and the In Vitro Diagnostic Medical Devices Regulation (IVDR; 2017/746) have significantly increased post-market surveillance and vigilance system requirements for medical device manufacturers compared to previous regulations.
The regulations are clear that medical device manufacturers and authorized representatives (AR) must take action to notify competent authorities of any incident or field safety corrective action (FSCA) involving their medical device.
However, the circumstances of incident reports and their timing and follow-up are not always clear to regulatory and quality professionals in the industry.
Fear not! This article reviews vigilance system reporting requirements in the EU and gives tips on how you can ensure compliance and appropriate follow-up for any events involving your medical device.
A note: adverse event reporting and incident reporting can be considered similar concepts. The phrase “adverse event” is used mostly in the United States, while the European equivalent is “incident.”
Vigilance Reporting Requirements Under the MDR
Before going into details on the medical device vigilance system and reporting requirements in the EU, first, we need to understand which events require reporting and when.
What is a reportable event?
According to the MDR, any event involving a medical device must live up to the established criteria to be considered reportable.
A medical device event is reportable if:
- It caused or might cause a serious public health threat
- It caused death or serious deterioration of health of the patient, user, or any other person involved
- If it did not cause serious deterioration of health in the patient or user but might lead to it should the event recur
“Serious deterioration of health” is defined as life-threatening illness or injury, permanent impairment of a body structure or function, hospitalization or prolongation of hospitalization, medical or surgical intervention to prevent life-threatening illness or permanent impairment, chronic disease, indirect harm as a consequence or incorrect diagnostic or test results, fetal distress or death, and congenital abnormalities.
Timelines for reporting
Events related to serious public health threats must be reported immediately but no later than two days after the manufacturer becomes aware of the incident.
Events related to death or serious deterioration of health must be reported immediately but no later than ten days after the manufacturer becomes aware of the incident.
Events with no consequence to the patient but the risk of death or serious deterioration of health should the event recur must be reported immediately but no later than 15 days after the manufacturer becomes aware of the incident.
MEDDEV 2.12
In 2013, the European Commission issued MEDDEV 2.12-1 rev.8 Guidelines of a medical devices vigilance system. The guideline is meant to clarify and describe the European system for the notification and evaluation of incidents and field safety corrective actions involving medical devices and in vitro diagnostic medical devices.
It has since been updated with the Additional Guidance Regarding the Vigilance System as outlined in MEDDEV 2.12-1 rev.8.
While MEDDEV 2.12 1 rev.8 is not a legally binding document, it is extremely helpful for anyone involved with vigilance reporting in the EU.
The additional guidance updates the definitions of field safety corrective action and field safety notice. It also provides the new Manufacturer’s Incident Report Form and explains the new concepts included within.
Frequently Asked Questions
Do I need to submit vigilance reports for incidents that occur outside the EU?
Events are only reportable if the incident or field safety corrective action takes place within the EU.
Please note the phrasing of the latter – events that happen outside of the EU that result in a field safety corrective action within the EU must also be reported.
Are user errors reportable?
User errors are reportable if they result in death or serious deterioration of the patient or user. If they do not, they can be handled by the manufacturer internally.
All user errors should be included in trend analysis and trend reporting. If a significant trend in user errors appears, it must be reported.
Abnormal use, i.e., use that deviates from the norm, such as off-label use or untrained use, does not need to be reported to the competent authority.
What about events that are reported in the literature or social media?
While there are no direct requirements to report events originating in the literature or social media, the requirement to report to the competent authority when a medical device manufacturer “becomes aware” of the incident can be interpreted as the manufacturer has to report events coming from any source.
If a manufacturer comes across any events reported outside of the traditional sources. In that case, they should be logged into their complaint system and evaluated as reportable incidents using the criteria outlined above.
It is recommended that manufacturers report in cases of doubt.
What is the timeline for following up on my initial incident report?
MEDDEV does not specify any timelines for follow-up reports. It is recommended to submit a follow-up report within 30 days of the initial report or as soon as additional information becomes available.
Note that member states might have local timeline expectations that differ from the European Commission. We always recommend making sure you check the rules and recommendations in the member state where your incident report is submitted.
Vigilance Reporting Process
You have become aware of an incident that requires reporting – now what?
- Determine the timeline for reporting. Serious public health threats have much shorter reporting timelines than serious incidents. Make sure you understand what event category your incident belongs to.
- Report the incident to the appropriate competent authorities.
- Respond to any questions the competent authority might have about the incident. It is normal for the competent authority to return with clarifying questions and requests for more documentation.
- Determine if your incident requires any field safety corrective actions or field safety notices. If so, report them to the appropriate competent authority.
- Submit final incident reports and FSCA reports to the authorities.
- Add the vigilance report and any relevant documentation to your quality system records or ISO 13485.
- Inform your notified body of the incident and/or FSCA. If your device is class I self-certified, you are exempt from this requirement.
Additional vigilance resources
Market surveillance of medical devices under the EU MDR
Post-market surveillance documents: Which ones do you need?
Post-market surveillance, market surveillance, and vigilance – what is the difference?
