FDA categorizes medical devices in one of three classifications based on the degree of potential risk and control needed to reasonably ensure their safety and effectiveness. Class I, or “low risk,” devices are subject to minimum regulation and include such items as tongue depressors, elastic bandages, and bed pans. Class II, or “medium risk,” devices include syringes, hearing aids, resuscitators, and electrocardiograph machines and are subject to more scrutiny than class I devices. Most medical devices designated as class I or class II reach the market through FDA’s premarket notification—or 510(k)—process. Class III, or “high risk,” devices are the most rigidly controlled and include devices such as heart valves, pacemakers, and defibrillators. These devices are life-supporting or life-sustaining, or are substantially important in preventing the impairment of human life, or present a potentially unreasonable risk of illness or injury. Class III devices are subject to FDA’s premarket approval process, which requires the manufacturer to present evidence, often including extensive clinical data, that there is a reasonable assurance that the device is safe and effective before placing it on the market. To help ensure the safety of medical devices, the Federal Food, Drug, and Cosmetic Act was amended in 1976 to expand FDA’s responsibility for regulating medical devices in the United States. However, studies prepared by our office, the former Office of Technology Assessment, and the Office of Inspector General of the Department of Health and Human Services, as well as congressional investigations and hearings led the Congress to conclude that the 1976 amendments were inadequate to protect the public from dangerous and defective medical devices. Among its concerns, the Congress concluded that FDA’s ability to ensure the removal of dangerous or defective devices, such as heart valves and other life-sustaining devices, from the market was hampered because manufacturers did not have adequate systems for tracking patients with these high-risk devices. The efforts of two medical device manufacturers—Shiley, Inc., and Vitek, Inc.—to notify product recipients of potential product defects highlight the need for effective medical device tracking systems. Shortly after passage of the 1976 Medical Device Amendments, Shiley applied for and received approval to market its Bjork-Shiley artificial heart valve under FDA procedures—which were under development and would not be finalized for another decade. According to a congressional study, between 1979 and 1986, an estimated 40,000 people in the United States received the valve. During this period, the struts that held the mechanical valves in place fractured, leading to death in an estimated two out of three cases where strut failures occurred. Despite a redesign, strut fractures persisted, and Shiley was forced to recall all of its devices and cease production in November 1986. According to the congressional study, Shiley had reported a total of 389 fractures related to one of its valves and 248 deaths, as of January 1990. In December 1990, Shiley voluntarily undertook an effort to locate and inform approximately 23,000 recipients about one of its artificial heart valves that was subject to life-threatening fractures. Although Shiley reported distributing patient registration cards to hospitals to obtain recipients’ names when valves were implanted, less than 50 percent of the cards were reportedly returned. As a result, efforts to locate patients—which also included letters and telephone calls to physicians and announcements in print media—confirmed the locations of only about 14,000 of the 23,000 (61 percent) heart valve recipients, as of November 1991. There were similar difficulties in locating patients who had received a jaw implant device manufactured by Vitek. The device contained layers of teflon or proplast—or various combinations of these materials—which Vitek argued were substantially equivalent to a product on the market prior to the 1976 amendments. Following FDA approval, the devices were reportedly prone to break apart, fragment, and function improperly. FDA estimated that more than 26,000 of the devices were distributed between 1973 and 1988. However, Vitek did not know how many devices were actually implanted because it was not required to and did not maintain records of patients who had received an implant. FDA officials reported that apart from the devices recovered through seizures executed in October 1990, it was unable to determine the number of devices that were in distribution or implanted in patients because the devices were manufactured in sets of two, which could be split between patients. Following Vitek’s declared bankruptcy in June 1990 and the bankruptcy trustee’s refusal to notify recipients of Vitek’s implant device, FDA established and funded a patient notification program, which it estimates cost about $41,000. In September 1991, as part of its patient notification program, FDA notified physicians and hospitals on Vitek’s consignee list and requested that they advise patients about the problems associated with the Vitek implants and treatment options. FDA also conducted an extensive media campaign, which included a video news release and various press releases and forums targeted to health organizations and professionals. In addition, the Medic Alert Foundation, a nonprofit organization, established a registration program for Vitek proplast implant patients at FDA’s request. For an enrollment fee, patients in the registry received updated information about Vitek implants, symptoms and treatments available after the implant was removed, and other devices that could possibly serve patients better. Through the program, FDA could, if needed, locate patients and their doctors. However, in mid-1994, Medic Alert informed FDA that it was no longer financially feasible to operate the program. In November 1994, FDA issued letters to about 5,000 patients to inform them that the notification program was closing and that patients could receive updated information through various organizations. The medical device tracking provision, enacted in November 1990 as part of SMDA 90, was intended to improve manufacturers’ ability to track patients with high-risk medical devices and to ensure that FDA and manufacturers could quickly remove dangerous or defective devices from the market. The provision defines high-risk devices as those that are permanently implantable and would likely have serious adverse health consequences were the device to fail or those that are life sustaining or life supporting and are used outside the device-user facility. The Secretary of Health and Human Services may also designate any other device as high risk. All manufacturers of such devices must adopt a method of device tracking. CDRH’s Office of Compliance has primary responsibility for implementing and enforcing the requirements of the device tracking regulation. These responsibilities include providing agency field staff with guidance on inspecting manufacturers for compliance with the regulation during GMP inspections and monitoring corrections and removals of device products from the market. The Office of Compliance is also responsible for reviewing and approving exemptions and variances from one or more parts of the tracking regulation, filed by a manufacturer, importer, or distributor seeking relief. In addition, FDA’s Office of Regulatory Affairs and FDA’s 21 district offices within the United States and Puerto Rico are responsible for all FDA inspections, which include inspections of medical devices. District office staff conduct on-site GMP inspections for all FDA-regulated facilities and monitor the efforts of recalling manufacturers to ensure that defective or dangerous devices are corrected or removed from the market. In August 1993, FDA issued a medical device tracking regulation that implemented the new tracking requirement of SMDA 90. Under the regulation, manufacturers must adopt a method of tracking that enables them to quickly provide FDA information on the location of the device and patients using them to facilitate efficient and effective mandatory recalls or notifications. Manufacturers generally use one of two basic approaches. The first approach registers the patient at the time of implant and uses a periodic follow-up mechanism—such as post card, letter, or phone call—to update names and addresses. The second approach uses a health care professional, usually a physician, who stays in contact with the patient to update his or her location. While no specific method of tracking is required, under the regulation, manufacturers are required to follow three key tracking requirements: First, manufacturers are required to develop written standard operating procedures for implementing a tracking method to generate the required information on devices and patients. The operating procedures must include data collection and recording procedures that include documentation on the reasons for missing required tracking data, a method for recording all modifications to the tracking system—including changes to the data format, file maintenance, and recording system—and a quality assurance procedure to ensure that the operating procedures are working effectively. The manufacturer’s quality assurance program must provide for audits of the tracking system based on a statistically relevant sampling of the manufacturer’s tracking data. For the first 3 years of tracking a device, manufacturers are required to perform the audits in 6-month intervals; thereafter, the tracking systems must be audited annually. These audits must check both the functioning of the tracking system and the accuracy of the data in the system. Second, manufacturers are required to establish and maintain certain data in their tracking systems. For device products that have not yet been distributed to a patient, the manufacturer must obtain and keep current the name, address, and telephone number of the distributor holding the device, as well as the location of the device. For tracked devices distributed to a patient, the manufacturer must obtain and maintain information on the identity and current location of the patient and other information on the device product, such as the lot, batch, model, or serial number, and the attending physician’s name, address, and telephone number. Finally, upon request by FDA, manufacturers must be able to quickly report device and patient location information. Within 3 workdays of FDA’s request, manufacturers must report the location of tracked devices that have not yet been distributed to patients as well as provide information about the distributor. For devices distributed to patients, manufacturers must report the locations of devices and patients within 10 workdays of FDA’s request. The tracking regulation also states that manufacturers have the responsibility of determining the devices subject to tracking and to initiate tracking.