FDA categorizes medical devices in one of three classifications based on the degree of potential risk and control needed to reasonably ensure their safety and effectiveness. Class I, or “low risk,” devices are subject to minimum regulation and include such items as tongue depressors, elastic bandages, and bed pans. Class II, or “medium risk,” devices include syringes, hearing aids, resuscitators, and electrocardiograph machines and are subject to more scrutiny than class I devices. Most medical devices designated as class I or class II reach the market through FDA’s premarket notification—or 510(k)—process. Class III, or “high risk,” devices are the most rigidly controlled and include devices such as heart valves, pacemakers, and defibrillators. These devices are life-supporting or life-sustaining, or are substantially important in preventing the impairment of human life, or present a potentially unreasonable risk of illness or injury. Class III devices are subject to FDA’s premarket approval process, which requires the manufacturer to present evidence, often including extensive clinical data, that there is a reasonable assurance that the device is safe and effective before placing it on the market. To help ensure the safety of medical devices, the Federal Food, Drug, and Cosmetic Act was amended in 1976 to expand FDA’s responsibility for regulating medical devices in the United States. However, studies prepared by our office, the former Office of Technology Assessment, and the Office of Inspector General of the Department of Health and Human Services, as well as congressional investigations and hearings led the Congress to conclude that the 1976 amendments were inadequate to protect the public from dangerous and defective medical devices. Among its concerns, the Congress concluded that FDA’s ability to ensure the removal of dangerous or defective devices, such as heart valves and other life-sustaining devices, from the market was hampered because manufacturers did not have adequate systems for tracking patients with these high-risk devices. The efforts of two medical device manufacturers—Shiley, Inc., and Vitek, Inc.—to notify product recipients of potential product defects highlight the need for effective medical device tracking systems. Shortly after passage of the 1976 Medical Device Amendments, Shiley applied for and received approval to market its Bjork-Shiley artificial heart valve under FDA procedures—which were under development and would not be finalized for another decade. According to a congressional study, between 1979 and 1986, an estimated 40,000 people in the United States received the valve. During this period, the struts that held the mechanical valves in place fractured, leading to death in an estimated two out of three cases where strut failures occurred. Despite a redesign, strut fractures persisted, and Shiley was forced to recall all of its devices and cease production in November 1986. According to the congressional study, Shiley had reported a total of 389 fractures related to one of its valves and 248 deaths, as of January 1990. In December 1990, Shiley voluntarily undertook an effort to locate and inform approximately 23,000 recipients about one of its artificial heart valves that was subject to life-threatening fractures. Although Shiley reported distributing patient registration cards to hospitals to obtain recipients’ names when valves were implanted, less than 50 percent of the cards were reportedly returned. As a result, efforts to locate patients—which also included letters and telephone calls to physicians and announcements in print media—confirmed the locations of only about 14,000 of the 23,000 (61 percent) heart valve recipients, as of November 1991. There were similar difficulties in locating patients who had received a jaw implant device manufactured by Vitek. The device contained layers of teflon or proplast—or various combinations of these materials—which Vitek argued were substantially equivalent to a product on the market prior to the 1976 amendments. Following FDA approval, the devices were reportedly prone to break apart, fragment, and function improperly. FDA estimated that more than 26,000 of the devices were distributed between 1973 and 1988. However, Vitek did not know how many devices were actually implanted because it was not required to and did not maintain records of patients who had received an implant. FDA officials reported that apart from the devices recovered through seizures executed in October 1990, it was unable to determine the number of devices that were in distribution or implanted in patients because the devices were manufactured in sets of two, which could be split between patients. Following Vitek’s declared bankruptcy in June 1990 and the bankruptcy trustee’s refusal to notify recipients of Vitek’s implant device, FDA established and funded a patient notification program, which it estimates cost about $41,000. In September 1991, as part of its patient notification program, FDA notified physicians and hospitals on Vitek’s consignee list and requested that they advise patients about the problems associated with the Vitek implants and treatment options. FDA also conducted an extensive media campaign, which included a video news release and various press releases and forums targeted to health organizations and professionals. In addition, the Medic Alert Foundation, a nonprofit organization, established a registration program for Vitek proplast implant patients at FDA’s request. For an enrollment fee, patients in the registry received updated information about Vitek implants, symptoms and treatments available after the implant was removed, and other devices that could possibly serve patients better. Through the program, FDA could, if needed, locate patients and their doctors. However, in mid-1994, Medic Alert informed FDA that it was no longer financially feasible to operate the program. In November 1994, FDA issued letters to about 5,000 patients to inform them that the notification program was closing and that patients could receive updated information through various organizations. The medical device tracking provision, enacted in November 1990 as part of SMDA 90, was intended to improve manufacturers’ ability to track patients with high-risk medical devices and to ensure that FDA and manufacturers could quickly remove dangerous or defective devices from the market. The provision defines high-risk devices as those that are permanently implantable and would likely have serious adverse health consequences were the device to fail or those that are life sustaining or life supporting and are used outside the device-user facility. The Secretary of Health and Human Services may also designate any other device as high risk. All manufacturers of such devices must adopt a method of device tracking. CDRH’s Office of Compliance has primary responsibility for implementing and enforcing the requirements of the device tracking regulation. These responsibilities include providing agency field staff with guidance on inspecting manufacturers for compliance with the regulation during GMP inspections and monitoring corrections and removals of device products from the market. The Office of Compliance is also responsible for reviewing and approving exemptions and variances from one or more parts of the tracking regulation, filed by a manufacturer, importer, or distributor seeking relief. In addition, FDA’s Office of Regulatory Affairs and FDA’s 21 district offices within the United States and Puerto Rico are responsible for all FDA inspections, which include inspections of medical devices. District office staff conduct on-site GMP inspections for all FDA-regulated facilities and monitor the efforts of recalling manufacturers to ensure that defective or dangerous devices are corrected or removed from the market. In August 1993, FDA issued a medical device tracking regulation that implemented the new tracking requirement of SMDA 90. Under the regulation, manufacturers must adopt a method of tracking that enables them to quickly provide FDA information on the location of the device and patients using them to facilitate efficient and effective mandatory recalls or notifications. Manufacturers generally use one of two basic approaches. The first approach registers the patient at the time of implant and uses a periodic follow-up mechanism—such as post card, letter, or phone call—to update names and addresses. The second approach uses a health care professional, usually a physician, who stays in contact with the patient to update his or her location. While no specific method of tracking is required, under the regulation, manufacturers are required to follow three key tracking requirements: First, manufacturers are required to develop written standard operating procedures for implementing a tracking method to generate the required information on devices and patients. The operating procedures must include data collection and recording procedures that include documentation on the reasons for missing required tracking data, a method for recording all modifications to the tracking system—including changes to the data format, file maintenance, and recording system—and a quality assurance procedure to ensure that the operating procedures are working effectively. The manufacturer’s quality assurance program must provide for audits of the tracking system based on a statistically relevant sampling of the manufacturer’s tracking data. For the first 3 years of tracking a device, manufacturers are required to perform the audits in 6-month intervals; thereafter, the tracking systems must be audited annually. These audits must check both the functioning of the tracking system and the accuracy of the data in the system. Second, manufacturers are required to establish and maintain certain data in their tracking systems. For device products that have not yet been distributed to a patient, the manufacturer must obtain and keep current the name, address, and telephone number of the distributor holding the device, as well as the location of the device. For tracked devices distributed to a patient, the manufacturer must obtain and maintain information on the identity and current location of the patient and other information on the device product, such as the lot, batch, model, or serial number, and the attending physician’s name, address, and telephone number. Finally, upon request by FDA, manufacturers must be able to quickly report device and patient location information. Within 3 workdays of FDA’s request, manufacturers must report the location of tracked devices that have not yet been distributed to patients as well as provide information about the distributor. For devices distributed to patients, manufacturers must report the locations of devices and patients within 10 workdays of FDA’s request. The tracking regulation also states that manufacturers have the responsibility of determining the devices subject to tracking and to initiate tracking. To provide guidance to manufacturers, FDA listed 26 categories of devices in the regulation that it regards as subject to tracking and has focused enforcement efforts on manufacturers of such devices. (See app. II for the 26 device categories.) Distributors of devices—which may include user facilities, physicians, and pharmacies—also have reporting and recordkeeping responsibilities under the device tracking regulation. Distributors must collect, maintain, and report back to the manufacturer current information on the locations of tracked devices and patients who use them. Following concerns that SMDA 90 provisions did not provide manufacturers with clear guidance on which devices were subject to tracking, the medical device tracking provision was revised in FDAMA.Under FDAMA, FDA—not manufacturers—is required to determine whether certain devices are subject to tracking and to issue orders to manufacturers requiring them to adopt a tracking system for these devices. Devices not identified are exempt from the tracking requirement until FDA issues an order to the contrary. FDA has taken several actions to implement the changes mandated by FDAMA. In February 1998, FDA issued orders to manufacturers of devices in categories designated for tracking under SMDA 90 provisions, requiring them to continue their tracking systems while FDA considered reducing the number of devices subject to tracking. In March 1998, FDA announced in a Federal Register notice the availability of guidance on manufacturers’ responsibilities for medical device tracking under FDAMA and requested comments from the public on factors FDA should consider in deciding whether some device categories should no longer be subject to tracking. FDA is currently reviewing these comments and plans to publish a notice in the Federal Register with a revised list of device categories subject to tracking. If a medical device exhibits a problem after it is marketed, one remedial action available to the manufacturer of the device and FDA is to recall the product. In these cases, manufacturers must develop a strategy for implementing recalls and take appropriate action to protect the public health, including effectiveness checks to ensure that users of devices have been notified of the recall. FDA reviews and approves recall strategies and assigns one of three recall classifications—class I, II, or III—to indicate the relative degree of health hazard of the product being recalled. For a class I recall, FDA has determined that the use of or exposure to the product could cause serious health consequences or death. Class II recalls are designated for situations where FDA has determined that the use of or exposure to the product could cause temporary or medically reversible adverse health consequences and the probability of serious health consequences is remote. Class III recalls are reserved for situations that involve minor component malfunction repairs and labeling changes where use of or exposure to the product is not believed likely to cause adverse health consequences. FDA also monitors the progress of recalls and audits a sample of completed recalls to verify that the recalling manufacturer has properly removed defective devices from the market. As a goal, FDA expects manufacturers to complete recalls within 6 months of initiation and requires FDA staff to conduct audits and terminate recalls in not more than 90 workdays after the manufacturer reports the recall completed. (For more details of FDA’s recall process, see app. III.) FDA’s approach to ensuring that device manufacturers are operating tracking systems capable of tracing devices from distribution to end users has several limitations, such as a failure to include audits of the tracking systems in its inspections and infrequent inspections. To address these problems, CDRH’s Office of Compliance is considering initiatives that are intended to strengthen its oversight of manufacturers’ tracking systems, but the details of most of these initiatives have not yet been developed. Moreover, FDA has not taken steps to ensure that tracking continues when manufacturers responsible for tracking go out of business, merge, or are acquired by others. FDA on-site inspections of device manufacturers’ facilities are intended to ensure compliance with the requirements of the GMP regulation, the medical device reporting regulation, and the medical device tracking regulation. Manufacturers of class II or class III devices, such as those subject to tracking, are to receive inspections at least once every 2 years.Although these inspections represent a key element of FDA’s oversight of device tracking, we found that both the scope and frequency of the inspections are limited. FDA’s Compliance Program Guidance Manual requires investigators to determine whether manufacturers are complying with the device tracking regulation by reviewing their written standard operating procedures for tracking during GMP inspections. If the manufacturer does not have a tracking system, the investigator is required to cite the violation on the agency’s list of inspection observations, commonly referred to as FDA form 483. This form is presented to and discussed with the manufacturer’s management at the conclusion of the inspection. The investigator also prepares an establishment inspection report, which summarizes the manufacturer’s operations and any conditions observed during the inspection that may violate federal statutes. FDA’s guidance manual also requires investigators to document in the report whether the manufacturer makes any of the devices subject to tracking, and if so, whether it is meeting its tracking obligations. However, in making assessments of manufacturers’ compliance with the tracking regulation, FDA does not require inspectors to conduct independent audits of the tracking systems to ensure that the systems are working. Moreover, inspectors are directed not to review manufacturers’ quality assurance audit reports that evaluate the functioning and accuracy of data in the tracking systems. Reviewing these reports or conducting independent audits of manufacturers’ tracking systems would assist FDA investigators in assessing whether manufacturers are operating tracking systems capable of quickly identifying the locations of devices and patients that use them. FDA can use its existing regulatory authority to require manufacturers to certify that they are, in fact, conducting required audits. However, a senior FDA official told us that this requirement has never been used and is not included in FDA’s guidance manual. FDA officials explained that its current inspection strategy for assessing compliance with the tracking requirements is intended to educate and encourage compliance among manufacturers before actually enforcing the provisions of the regulation. The officials also explained that due to a written policy established as part of the GMP regulation in 1978, FDA inspectors are precluded from reviewing or copying manufacturers’ records and reports that result from audits performed in accordance with a written quality assurance program at any regulated entity. FDA officials also told us that the medical device industry has resisted the agency’s access to the audits because they fear the audits would yield incriminating information that FDA could use against them. According to FDA officials, this belief may cause manufacturers to be less than candid and thorough in their audits if the audits were subject to FDA inspection. As such, FDA adopted the policy to encourage manufacturers to conduct self-audits that are unbiased and meaningful. Nevertheless, the agency has not conducted its own audits of the tracking systems. In addition, FDA’s inspections of manufacturers’ tracking systems have not been conducted at least once every 2 years, as required by GMP standards. Our analysis of FDA data shows that FDA conducted GMP inspections in 137 (58 percent) of the 238 reportedly active establishments subject to tracking during fiscal years 1996 and 1997. In addition, during fiscal years 1994 and 1995, FDA conducted GMP inspections in only 91 (45 percent) of the 202 reportedly active manufacturers subject to tracking. FDA officials told us that reductions in field staff resources used to conduct inspections has made it difficult for FDA to meet the GMP biennial inspection requirement. According to FDA officials, the number of investigators available to inspect all FDA-regulated facilities—including manufacturers of foods, drugs, biologics, veterinary medicine, and medical devices—has declined since 1993. They noted for example that investigators assigned specifically to cover the approximately 4,400 device manufacturing establishments nationwide declined from 34 in fiscal year 1994 to 28 in fiscal year 1997, while the scope of GMP inspections has increased to include compliance programs for the medical device reporting regulation and medical device tracking regulation. FDA officials acknowledged that changes are needed to better assess compliance with the medical device tracking regulation and improve its oversight of manufacturers subject to tracking. For example, FDA has included in its fiscal year 1999 performance plan a risk-based inspection plan that will require FDA to identify and prioritize device areas of concern to focus resources on the highest priorities. Inspection activities would be prioritized based on several factors, including reports of problems with medical devices, earlier inspections, and devices associated with higher risk. FDA officials told us that many of the devices designated for tracking, such as cardiovascular implants, would likely receive priority attention because of the relative high risk associated with their use. The risk-based plan is expected to be presented to FDA’s Medical Device Field Committee, which is responsible for reviewing and approving significant changes to on-site inspections before they can be included in FDA’s compliance program. To improve FDA’s assessment of manufacturer compliance with tracking requirements, officials of the Office of Compliance told us they are considering separating GMP inspections of manufacturing and distribution processes from records inspections—which typically include reviews of manufacturer compliance with medical device reporting and tracking requirements under SMDA 90—thereby allowing inspectors more time to review manufacturer compliance with recordkeeping requirements. In addition, the Office of Compliance also plans to develop an audit plan that will require FDA inspectors to independently verify the adequacy of manufacturers’ standard operating procedures for tracking and determine whether the procedures are being followed. However, at the time of our review, FDA did not have a draft of the planned changes available for review and had not established a time frame for presenting these changes to FDA’s Medical Device Field Committee for approval. Maintaining accurate and complete tracking records when a manufacturer goes out of business, merges, or is acquired by another manufacturing establishment is critical to ensuring that devices can be traced from distribution to end users if a recall becomes necessary. However, FDA has not acted to ensure that tracking continues in these situations. Several options are available to FDA for covering the costs of operating a tracking system when a manufacturer goes out of business. Requiring manufacturers to notify FDA when mergers and acquisitions take place could also help FDA ensure that device tracking systems continue. The device tracking regulation requires a manufacturer that goes out of business to advise FDA at the time it notifies any government agency, court, or supplier and provide FDA with a complete set of its tracking records and information. Our review of FDA’s registry of device manufacturers shows that 47—or 16 percent—of the 285 establishments subject to tracking were classified by the agency as either tentatively (21 establishments) or permanently (26 establishments) out of business, as of May 1997, and that some manufactured high-risk devices, such as heart valves, pacemakers, ventilators, defibrillators, and apnea monitors. However, none of the manufacturers that were reportedly closed for business has provided FDA with tracking records. FDA officials believe it is possible that several of the manufacturers may have merged or been acquired. In such instances, the tracking regulation requires the acquiring establishment to continue the tracking obligations of the failed one. However, the device tracking regulation does not require the establishment acquiring the rights to manufacture the device to notify FDA when these transactions take place. As a result, FDA officials could not determine the number of manufacturers that were involved in mergers or acquisitions or whether any of them had assumed the tracking responsibilities of establishments involved in these transactions. FDA officials told us they have no plans to recover the tracking records of any failed establishments and operate a tracking system itself. In FDA’s view, absent a public health emergency with a tracked device, the agency would not be able to justify cuts in other programs to carry out a tracking program, which is largely the responsibility of a manufacturer. Further, officials said they have no basis to determine how much it would cost to operate any of the failed establishment’s tracking systems because the variables, such as the number of devices distributed by the manufacturers and used by patients, are unknown. Thus, no valid cost estimates could be made by FDA. While we recognize that FDA would likely incur additional costs to operate the tracking system of a failed establishment, without reliable tracking data, FDA may have serious difficulties promptly recalling and notifying patients if a public health emergency were to occur. To pay the cost of maintaining the tracking systems of failed establishments, FDA could seek legislative authority to require manufacturers of tracked devices to provide some form of financial assurance to FDA that would demonstrate their commitment to meet their tracking obligations. Alternatively, FDA could encourage patients and health providers that use tracked devices of defunct establishments to pay a fee to establish and maintain a registry of the current locations of patients and devices, as was done in the case of the Vitek jaw implants. FDA could also consider shifting resources from other programs or request additional funding from the Congress for the operation of a tracking program. A senior FDA official said the agency could attempt to obtain the tracking records of failed establishments. This, at a minimum, would provide FDA with information on the last known locations of devices and patients in the event a recall and notification became necessary. To locate the records would likely require FDA investigators to visit the last known address of the manufacturer to confirm its closure, the local post office to determine whether a forwarding address was provided, or government agencies or courts that may have received notification of the manufacturer’s closing. For manufacturers involved in mergers and acquisitions, FDA could include a requirement in the medical device tracking regulation that an establishment that has acquired the right to manufacture another manufacturer’s tracked device must notify FDA that it has assumed the tracking duties of the former establishment. This would provide FDA with greater assurance that tracking of critical devices is being continued when mergers and acquisitions have taken place. Medical device recalls are an important remedial action that manufacturers and FDA can take to protect the public from unsafe and ineffective device products. According to FDA, delays in the identification and removal of potentially hazardous devices from the market can increase the chances of inadvertent misuse of devices and risk to public health. To encourage expeditious recalls, FDA requires that manufacturers complete recalls within 6 months from the date of initiation. In addition, FDA, through its Regulatory Procedures Manual, requires district offices to review and audit the recall effort and submit a report to headquarters that summarizes the results of the recall and recommends approval to terminate the recall not more than 90 workdays after the recall is completed. These reports provide FDA with assurance that recalling manufacturers have taken prompt and appropriate actions to resolve problems with devices and assists FDA in identifying trends and evaluating new problem areas in manufacturing and processing. (See app. III for additional detail on FDA’s recall process.) However, our review of recalls of defective tracked devices initiated by manufacturers and monitored by FDA shows that most were not completed within the required time frames. The number of devices subject to recall and type of correction or modification required were among possible factors cited by FDA officials as contributing to delays in manufacturers completing recalls; late submissions of summary recall reports due to other work priorities in district offices were believed to have contributed to delays in FDA terminating the recalls. At this writing, FDA has not conducted a comprehensive review of its recall procedures and recall performance to determine how to improve the timeliness of recalls. From FDA’s recall records and computer databases, we identified 54 recalls of tracked devices, all of which were voluntarily initiated by 35 manufacturers, during fiscal years 1994 through 1996. Three of the 54 recalls were designated by FDA as class I recalls—where FDA had determined that use of or exposure to the device could have serious adverse health consequences; 43 were class II recalls—where FDA determined that use of or exposure to the device could cause adverse health consequences that are reversible or the probability of adverse health consequences is remote; and 7 were class III recalls—where FDA determined that use of or exposure to the device would likely not cause adverse health consequences. The remaining recall was a safety alert. As of January 1998, 49 (90 percent) of the 54 recalls of tracked devices had been completed; however, only 15 (31 percent) of these 49 recalls had been completed within FDA’s 6-month guideline. Thirty-four (69 percent) of the 49 completed recalls took longer than 6 months to complete, including 17 (35 percent) that took between 6 months to 1 year to complete. Seventeen other recalls (34 percent) took more than 1 year to complete, including 4 class II recalls that took more than 2 years. For example, a class II recall of ventilators took 919 calendar days to complete. In addition, we found that five class II recalls were still ongoing as of January 16, 1998, even though four of the recalls were started in 1996 and one started in 1995. Recall completions ranged from 12 calendar days to 1,044 calendar days, with a median of 226 calendar days. (See table 1.) FDA also did not terminate recalls of tracked devices in a timely manner. Of the 49 recalls that were reported completed by manufacturers, less than one-half were terminated by FDA within its 90-workday standard. As of January 16, 1998, FDA had approved 36 (73 percent) of the 49 recalls for termination; 13 recalls (27 percent) were still awaiting termination by FDA, which included two class I recalls of a ventilator and a pacemaker that were completed by the manufacturers in August 1995 and August 1997, respectively. For the 36 recalls terminated by FDA, 24 (67 percent) were reviewed and terminated by FDA within 90 workdays. For 12 completed recalls (33 percent), FDA took more than 90 workdays, including 2 class II recalls of ventilators and defibrillators that required about 1 year or more for termination. (See table 2.) FDA time to terminate the 36 recalls ranged from 1 day to as many as 390 workdays, with a median of 45 workdays. Total recall time for device manufacturers and FDA ranged from 20 days to 786 days, with a median of 333 combined calendar days and workdays. Total recall time for one class I recall of a defibrillator was 529 days. (App. IV shows for each recall, the number of calendar days elapsed for manufacturers to complete the recall, the number of workdays elapsed for FDA to terminate the recall, and the total time elapsed.) It was beyond the scope of this study to identify the underlying reasons for delays in completing recalls of tracked devices. However, we discussed our analysis of the recalls with officials in FDA’s Office of Regulatory Affairs who are responsible for recalls. Although these officials did not conduct an in-depth review of the recalls, they told us that the length of time manufacturers generally took to complete recalls can vary due to factors such as the amount and type of recall correction or modification required, the amount of product subject to recall or correction, the number of notifications needed to obtain responses from consignees, and inadequate attention some manufacturers give to recalls. The officials also explained that while district offices are often slow in submitting the summary reports to FDA for closure due to higher-priority work, such as conducting comprehensive GMP inspections, district offices are monitoring the progress of recalls and completing audit checks to verify the effectiveness of recalls. FDA reported that it is taking a number of actions to complete and close all outstanding recalls initiated during 1994 through 1996, as quickly as possible. These include instructing district offices to complete and close out all outstanding recalls by the end of fiscal year 1998 and updating the recall database with current information on the status of all recalls. FDA’s approach to inspecting medical device tracking systems provides little assurance that manufacturers can track devices through the chain of distribution to patients within a short period of time. Without conducting inspections once every 2 years that include audits of the tracking systems to verify the reliability of data in them, FDA cannot be certain manufacturers are operating systems that will work when recalls are necessary. FDA’s initiatives for improving oversight of high-risk manufacturers appear to be a step in the right direction. However, it is unclear whether these initiatives will provide FDA with adequate oversight of manufacturers subject to tracking, given the workload and size of FDA’s inspection force available to conduct inspections in device establishments. Still, FDA may be able to increase its oversight presence, if as expected, FDA reduces the number of device categories subject to tracking under FDAMA, focuses its inspection priorities on high-risk devices, and separates GMP inspections from record inspections. In addition, because FDA has not acted to recover the tracking records of failed establishments and is unaware of manufacturers involved in mergers or acquisitions, the agency has no assurance that the tracking obligations of such manufacturers are being continued. While we recognize that device tracking is the responsibility of manufacturers, FDA, as the protector of public health, must have a method of continuing the tracking obligations of manufacturers when they go out of business or the agency will likely have serious problems executing prompt and effective recalls—as was the case with Vitek’s jaw implants. FDA can explore a number of options for funding tracking systems for failed establishments to ensure public safety, including seeking necessary legislation. Requiring manufacturers to notify FDA when they merge or acquire the rights to manufacture another establishment’s product would also better fulfill the goals of tracking and protect public health. Finally, because recalls of tracked devices have been executed slowly by manufacturers and FDA, the agency has less assurance that dangerous or defective devices under recall are promptly and appropriately removed from the market and less information available to analyze trends in device problems. Timely completion and termination of recalls provide FDA with greater assurance that defective devices are corrected and removed promptly and effectively and with more information to analyze and resolve device problems. FDA actions to address these problems are encouraging. Nevertheless, FDA’s efforts to improve the timeliness of recalls could benefit from evaluating the reasons why manufacturers and FDA frequently require extensive amounts of time to complete and terminate device recalls. To improve FDA’s ability to monitor manufacturer compliance with the medical device tracking regulation and conduct recalls of tracked devices in a timely manner, we recommend that the Commissioner of FDA develop and implement a plan to verify the completeness and accuracy of data in the tracking systems of device manufacturers to ensure that the systems can trace devices through the chain of distribution to end users, take steps to recover the medical device tracking records of manufacturers that have failed and have not provided such information to FDA and report to the Congress on the results of its assessment of options for covering the costs of operating a device tracking system for failed establishments, revise the medical device tracking regulation to require an establishment that acquires the right to manufacture another establishment’s tracked device either through merger or acquisition to immediately notify FDA that it has assumed the tracking obligations of the former establishment, and examine the reasons for delays in completing recalls of tracked devices and develop and implement strategies for improving the timeliness of recalls. We obtained comments on a draft of this report from FDA and three trade associations that represent the medical device industry—Health Industry Manufacturers Association (HIMA), Medical Device Manufacturers Association (MDMA), and the National Electrical Manufacturers Association (NEMA). In general, FDA agreed with the findings and some of the recommendations in our report and said they had begun acting on them. While NEMA agreed with our findings and recommendations, HIMA and MDMA were concerned that implementing our recommendations would place undue burdens on manufacturers without improving the agency’s oversight of device tracking or benefiting public health. FDA agreed that manufacturers should maintain accurate and complete data in tracking systems and indicated that it was revising its inspection approach to verify that manufacturers have adequate procedures in place to comply with medical device tracking requirements. However, FDA does not plan to verify the data in the tracking systems as we recommended because it believes the agency should focus on ensuring that manufacturers have tracking systems in place. While we agree that determining whether manufacturers have appropriate tracking procedures in place is an important element of an FDA inspection, limiting inspections in this way does not provide FDA with assurance that the data in the tracking system are accurate and complete. HIMA and MDMA were concerned about the methods FDA may use to implement our recommendation to verify tracking system data and the cost of these efforts. HIMA believes it is unnecessary for FDA to conduct independent audits of tracking systems because such audits would duplicate those already performed by the manufacturers. They noted that, if necessary, FDA is authorized to require manufacturers to certify that they are, in fact, conducting required audits. MDMA indicated that we had not linked weaknesses in FDA’s oversight of tracking systems with an adverse impact on public health. They also believed that in order to independently verify tracking system data, FDA would need to conduct “mock recalls” that would require manufacturers to generate reports of the location of all devices in distribution with hypothetical malfunctions. MDMA believes such an effort would be costly and provide little benefit to FDA and the public. In our view, FDA needs to develop an approach to verify the data in manufacturers’ tracking systems. However, the industry’s comments are not without merit and should be considered by FDA as it weighs the costs and benefits of different approaches for addressing this issue. We agree with HIMA that requiring FDA inspectors to conduct independent audits of tracking systems could duplicate manufacturers’ own internal audits and would likely result in some additional costs to FDA and manufacturers. Nevertheless, it may be one way FDA can verify the tracking data without having access to the internal audit reports. HIMA also correctly notes that FDA is authorized to require manufacturers to certify that they are conducting required audits of tracking system. We have revised our report to include certification as an option FDA could use to verify tracking system data. While our report does not link weaknesses in FDA’s oversight of device tracking with adverse health events, as noted by MDMA, we do not believe FDA should await a public health emergency before taking action to ensure that device tracking systems are capable of tracing devices to end users. We disagree with MDMA that FDA would need to conduct mock recalls to independently verify the tracking data. Indeed, such an approach would be costly and inefficient and may be outside of FDA’s authority. Although we are not prescribing a specific method of verification for FDA, the agency could select a random sample of tracking system data and contact end users of devices to confirm their locations. Such an approach would likely take less time and resources to complete than the mock recalls suggested by MDMA. HIMA and MDMA also disagreed with our recommendation that FDA examine options for requiring manufacturers of tracked devices to provide financial assurance to offset the costs FDA may incur in maintaining a tracking program for failed establishments. HIMA said that such a requirement would be costly and difficult to implement. MDMA indicated that while it supports FDA’s efforts to ensure compliance with these regulations, the cost should be borne by the taxpayers who benefit from the tracking of medical devices, rather than the manufacturers. While it may be costly to operate the tracking systems of failed establishments, these systems must be maintained so that end users can be promptly notified of serious device problems that warrant corrective action. However, as HIMA and MDMA point out, there may be ways to cover the cost of this activity other than requiring manufacturers to provide financial assurance. In our view, FDA needs to evaluate approaches for resolving this problem, including who should be responsible for maintaining the tracking records and who should pay the cost of this activity. FDA should report its findings to the Congress, and, if necessary, seek authority from the Congress to implement a solution. We have modified the report and recommendation to address this issue. HIMA believes it would be better to measure the effectiveness of a recall based on a manufacturer’s success in identifying and contacting a device’s end users or patients where notification was required. While we agree with HIMA that the ability of a tracking system to locate end users provides a valuable measure of recall success, we believe that the timeliness of recalls is also important. A key goal of tracking is to ensure that defective or dangerous devices can be corrected or removed from the market within a short period of time. Thus, in our view, FDA’s timeliness guidelines for completing and terminating recalls are valuable indicators for measuring recall performance. As agreed with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days from the date of this letter. At that time, we will send copies of this report to other congressional committees and members with an interest in this matter, and we will make this report available to others upon request. If you or your staff have any questions about this report, please call me at (202) 512-7119 or John Hansen at (202) 512-7105. Other major contributors to this report are Darryl Joyce, Julian Klazkin, and Claude Hayeck. We conducted our study of FDA’s implementation of the provisions of the medical device tracking requirements of the Safe Medical Devices Act of 1990 at FDA’s Office of Compliance within the Center for Devices of Radiological Health (CDRH) and the Office of Regulatory Affairs. In addition to reviewing the laws, regulations, and literature relevant to medical device tracking, we met with officials of CDRH and the Office of Regulatory Affairs to discuss the agency’s efforts to implement the tracking regulation and policies and procedures used to inspect manufacturers’ tracking systems and recall tracked devices. From a list of about 150 manufacturers subject to tracking provided to us by the Emergency Care Research Institute (ECRI), a nonprofit health research agency, we judgmentally selected and interviewed representatives of 10 manufacturers to discuss the methods they used to track devices, which included pacemakers, heart valves, defibrillators, ventilators, apnea monitors, and jaw implants. We also analyzed FDA statistics on the number of GMP inspections conducted in establishments that were subject to tracking during fiscal years 1994 through 1997. We reviewed a list of manufacturers registered with FDA to identify the number of active and inactive establishments that were subject to tracking as of May 1997. To identify recalls of medical devices that were subject to tracking during fiscal years 1994 through 1996, we reviewed a list of recalls of tracked devices known to FDA. To supplement this list, we obtained a list of recalls of tracked devices covering the same period from ECRI because it maintains an automated database that collects information from manufacturers, FDA weekly enforcement reports, and scientific literature on devices subject to recalls. With CDRH staff, we reviewed a total of 135 recalls from these two sources and identified 54 recalls of devices that were subject to tracking. Included in our analysis were recalls of devices distributed on or after August 29, 1993, the effective date of the medical device tracking regulation. We excluded recalls for at least one of the following reasons: date of distribution of the device could not be determined; device was not subject to the tracking regulation; date of distribution of the device occurred prior to the effective date of device was granted an exemption from tracking by FDA; recall commenced in 1997, which was beyond the scope of our study; or recall involved devices distributed outside the United States, which are not subject to tracking. To determine the amount of time manufacturers and FDA took to complete recalls of tracked devices, we analyzed data in recall records and FDA’s recall database maintained by CDRH and the Office of Regulatory Affairs on the dispositions of 54 recalls of tracked devices that were initiated by manufacturers during fiscal years 1994 through 1996. From documentation in the recall records and databases, we calculated the number of calendar days manufacturers took to complete each of the 54 recalls and compared the results against FDA’s instructions to manufacturers to complete recalls within 6 months of initiation. Calendar days were used because we wanted to measure the time elapsed for manufacturers to remove devices subject to recall from the market. The number of workdays FDA took to review and approve recalls for termination was compared to FDA’s requirement that recalls be terminated in not more than 90 workdays after manufacturers reported recalls completed. Next, to measure total recall time, we added the number of calendar days spent by manufacturers to complete recalls to the number of workdays FDA took to terminate the recalls. We did not independently verify the information contained in the recall databases or evaluate the internal controls of the computer systems. FDA’s medical device tracking regulation, effective August 29, 1993, required manufacturers to use the criteria established in SMDA 90 to determine the devices that meet the criteria for tracking and to initiate tracking. To illustrate and provide guidance to manufacturers, FDA listed 26 categories of devices in the regulation that it regarded as subject to tracking. A recall is a voluntary action by a manufacturer to remove a medical device from the market or to correct a problem with a medical device to protect the public from products that present a risk of injury, gross deception, or are otherwise defective. Under SMDA 90, FDA can require manufacturers to report to the agency any corrections and removals of problem devices from the market and order recalls of defective and dangerous devices. However, in practice, with the exception of urgent situations, the majority of recalls are initiated voluntarily by manufacturers with FDA oversight. FDA assigns one of three classifications—class I, class II, and class III—to indicate the relative degree of risk the recalled product presents to public health. For a class I recall, FDA has determined that the use of or exposure to the product could cause serious health consequences or death. Class II is designated for situations where FDA has determined that the use of or exposure to the product could cause temporary or medically reversible adverse health consequences and the probability of serious health consequences is remote. A class III recall is reserved for situations where use of or exposure to the product is considered not likely to cause adverse health consequences. To initiate a recall of a product from the market, manufacturers develop and submit a recall strategy report to FDA that includes information on the reason for the correction or removal of the device, an assessment of the health hazard associated with the device, and volume of product in distribution. The recall strategy also includes provisions for effectiveness checks to ensure that users of devices have been notified of the recall and taken appropriate action to protect the public health. In general, class I recalls require a check with 100 percent of the device users that received notice of the recall and class II recalls require checks of 80 percent of device users. No checks are required for class III recalls because there is no public health risk involved. FDA guidelines instruct manufacturers to complete recalls within 6 months from the date of initiation of the recall. FDA reviews and recommends changes, if any, to the proposed recall strategy; advises the manufacturer of the assigned recall classification; and places the recall in its weekly enforcement report. At least once a month, FDA district offices monitoring recalls receive recall status reports from manufacturers that provide updates on the progress of recalls. Status reports on class I and some class II recalls are forwarded to FDA headquarters for review. Upon completion of the recall, the district offices conduct audit checks to confirm that the recalling manufacturer has properly corrected or removed devices from the market, in accordance with the recall strategy. Audit checks, which generally range from 2 to 10 percent of the total number of device users notified of the recall notice, are always performed on class I recalls and are usually conducted on class II recalls. After the monitoring district has determined that the recall was effective at notifying device users and appropriate action has been taken, a recall termination recommendation and summary of recall report is prepared by the district and forwarded to FDA headquarters for termination approval. This report provides FDA headquarters with documentation that reasonable and appropriate actions have been taken by the manufacturer to correct or remove the defective device product from the market. FDA requires from the time a manufacturer considers the recall completed to FDA’s recall termination approval should not exceed 90 days. Both the Office of Compliance and Office of Regulatory Affairs maintain separate automated computer databases that track the processing of recalls. Table IV.1 shows our analysis of the days elapsed for manufacturers and FDA to complete and terminate recalls of tracked devices that were initiated during fiscal years 1994 through 1996. Monitor (apnea detector, ventilatory effort) DC-defibrillator, low energy (including paddles) Defibrillator, automatic implantable cardioverter Pump, infusion, implanted, programmable Pulse generator, pacemaker, implantable (continued) As of January 16, 1998, FDA had not received a summary recall recommendation report from the district office and, therefore, had not approved the recall for termination. Recall was classified as a safety alert. The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a congressional request, GAO provided information on whether the Food and Drug Administration (FDA) is providing adequate oversight of the tracking systems of high-risk device manufacturers and whether recalls of devices are executed promptly, focusing on whether: (1) FDA ensures that manufacturers operate tracking systems that are capable of tracking devices through the distribution chain to end users; and (2) device manufacturers and FDA are executing recalls of tracked devices in a timely manner. GAO noted that: (1) there are several weaknesses in FDA's approach for determining whether device manufacturers are operating tracking systems capable of quickly locating and removing defective devices from the market and notifying patients who use them; (2) FDA's inspections of the tracking systems do not include independent audits that could verify the completeness and accuracy of data in the systems; (3) instead, the inspections focus on reviews of the manufacturers' written standard operating procedures for tracking; (4) further, although the good manufactured product standard require FDA to inspect manufacturers of tracked devices at least once every 2 years, only about one-half of the 238 manufacturers subject to tracking were inspected during fiscal year (FY) 1996 and FY 1997; (5) FDA attributed its limited inspection activity to a reduction in field resources; (6) FDA has also not acted to ensure that device tracking continues when establishments go out of business, merge, or are acquired by other entities; (7) FDA officials told GAO they are planning to revise their inspection program to include an audit plan to better assess manufacturers' compliance with the tracking requirements and redirect FDA's compliance priorities toward high-risk devices, such as implant devices; (8) the details for most of these plans, however, have not yet been determined; (9) in GAO's analysis of FDA's recall data, manufacturers and FDA have not acted in a timely manner to correct and remove defective devices from the market; (10) less than one-third of the 54 recalls initiated from FY 1994 through FY 1996 were completed by manufacturers within 6 months, as specified in FDA guidelines; (11) FDA has also had problems terminating device recalls in a timely manner; (12) less than one-half of the 49 recalls reported completed by manufacturers were reviewed and terminated by FDA within the 90-workday standard established by the agency; and (13) FDA officials have identified several factors that may contribute to delays in completing recalls, but an in-depth review of the recall procedures used by manufacturers and FDA has not been conducted.