Quick background: The Medical Device Reporting (MDR) process and efforts for improvement

• Medical Device Reporting (MDR) is a mandatory program for device manufacturers, user facilities (e.g., hospitals) and importers. Under 21 CFR 803, these entities are required to report certain adverse events and device problems, such as patient injury or death or a malfunction of the device, to the FDA. MDRs can be submitted electronically (eMDR) and are fed into the FDA’s medical device adverse event database, the Manufacturer and User Facility Device Experience (MAUDE), which helps the agency conduct safety surveillance over time as potential issues are reported. The regulations specify processes for manufactures to submit individual malfunction reports to FDA according to specific timeframes.
• Under the 2007 FDA Amendments Act (FDAAA), Congress modified the MDR requirements. While MDR regulations have been in place since the 1980s, the requirements have undergone several revisions and statutory updates. Under FDAAA, the malfunction reporting requirements for Class III and Class II devices that are permanently implantable, life supporting, or life sustaining (ILSLS) were maintained, although the FDA may “grant an exemption, variance from, or an alternative to” some of the 803 requirements. Further, FDAAA updated the Class I and Class II reporting requirements, directing the FDA to establish criteria to determine reporting for these devices. In effect, the FDA could determine that certain Class I and Class II devices that are not ILSLS could be subject to quarterly summary requirements, rather than the individual reporting requirements. However, the agency needed to formally determine that such a flexibility would be granted to specific device types. (See the MDR guidance here)
• Industry submits an extremely high volume of Medical Device Reports (MDRs) each year that the FDA must process, so there are benefits to a more streamlined process. FDA receives and reviews several hundred thousand MDRs each year regarding suspected device-associated deaths, serious injuries, and malfunctions.
• The FDA has worked to streamline the system. In 1997, FDA created the Alternative Summary Reporting (ASR) Program that was intended to provide a condensed reporting pathway for specific well-known and well-characterized events associated with specific devices. Guidance issued in 2000 allowed manufacturers to request permission to submit certain MDR reportable events in summary form to FDA in a “line item” spreadsheet of codes. However, following concerns about transparency and efficiency the ASR was formally ended in 2019.
• In 2015, FDA announced a new pilot program: the Medical Device Reporting on Malfunctions pilot. The new program was intended “to facilitate exploration of an appropriate format for collecting malfunction reports in summary form.” The pilot’s approach allowed participating manufacturers to submit malfunction reports for certain devices in a summary format on a quarterly basis. The reports were submitted electronically using Form FDA 3500A. The results of that pilot concluded that under this type of approach, “participants were able to reduce the volume of reports by over 87 percent using the pilot format, while preserving the essential information regarding the context around malfunction events.” The pilot also found that the approach was usable and feasible for both large and small firms.
• The previous medical device user fee program sought to advance the ability to leverage “summary” reporting. Under the last iteration Medical Device User Fee Amendments (MDUFA IV), the FDA committed to streamlining the MDR process for certain devices, as identified by their product codes (e.g., NBH: Arthroscopic Accessories). “For most, if not all, device procodes,” the MDUFA IV commitment letter stated, “FDA will permit manufacturers of such devices in those procodes to report malfunctions on a quarterly basis and in summary MDR format,” as outlined under FDAAA.

Those efforts became the Voluntary Malfunction Summary Reporting (VMSR) program

• The VMSR program was proposed in 2017. The proposal closely mirrored the approach of the 2015 pilot, with the submissions involving a summary format on a quarterly basis. The proposal received 26 comments; most comments were supportive of the overall programmatic principles but had specific requests for its implementation (e.g., eligibility criteria, form submission). In 2018, the final VMSR rule was released, addressing the comments and largely implementing the program as originally proposed. Under the VMSR Program, certain manufacturers can elect to submit summary reports for each unique combination of brand name, device model, and problem code(s) on a quarterly basis, rather than individual reports on a rolling basis.
• The streamlined requirements are only available for certain types of devices, and only in certain situations. For example, Class III devices and Class II devices that are permanently implantable, life supporting, or life sustaining are categorically excluded from participation and must submit individual MDRs. Devices with that do not have an established risk profile or if individual reporting would be needed to address a public health issue are also excluded, among other types. In addition, reports of a death or serious injury cannot be submitted through the VMSR Program. The eligibility of a given device product code for summary reporting under the VMSR program is listed in the CDRH Product Classification Database. Reports from the VMSR program are publicly available in the Manufacturer and User Facility Device Experience (MAUDE) database.
• In 2019, then-CDRH Director JEFF SHUREN released a statement about medical device reporting that announced the formal end of the ASR program and touting the implementation of the VMSR Program. Shuren emphasized CDRH’s commitment to promoting public transparency.
• FDA published an FAQ with pandemic-era clarifications to the VMSR program’s instructions in October 2020 [ Read AgencyIQ’s analysis here]. These new instructions did not fundamentally alter the program’s specifications, but supplied new recommendations on adverse event reports for devices and manufacturers that operate under an Emergency Use Authorization (EUA) or enforcement discretion during the emergency. The clarifications stated that the FDA will not consider new device classifications—effectively, those that have existed “for less than 2 years”—to be eligible for the program unless the product code was issued “solely for administrative reasons.”

CDRH has just finalized its first guidance on the VMSR program – and made a technical modification to the program

• This comes after a draft version of the guidance that was issued in 2022. This was the first time that the agency issued guidance on this program since its implementation. The draft guidance served as an explainer on the program, rather than updating the program itself. It detailed the process for identifying VMSR program eligibility, the program’s scope (reportable events and how the agency would determine whether devices [by code] are eligible for VMSR), process for summary reporting and when manufacturers can bundle reports under the VMSR, and situations in which an individual report would be needed (e.g., substantial harm).
• Comments from medical device trade associations AdvaMed and MDMA sought additional clarity on the process. The comments from these two entities, which are the only industry-submitted comments on the docket, both sought clarity from CDRH on several specific, granular points of the VMSR program’s operation and the process for summary reporting. MDMA sought additional information on three main themes: (1) How to navigate submitting reports using Form FDA 3500A; (2) the potential efficiency of allowing manufacturers to submit reports “for each unique brand name or model only and not require separate submissions for each unique combination of brand name, model, and product problem experienced”; and (3) ways to streamline the process for situations in which a previously submitted summary report also requires an individual MDR. AdvaMed asked for additional clarity in how to consider eligibility for the program, sought more information on when the VMSR program list of included procodes would be updated, and asked FDA to provide a list of codes eligible for VMSR reporting directly on the FDA’s website. AdvaMed further requested more information on expectations for formatting reports and what to do when “root causes of malfunctions are not well understood” – as well as the process for “unique combinations” as flagged by MDMA.
• Up first: The final guidance generally reflects the 2022 draft version, which is unsurprising given that the document is an explainer of VMSR overall. However, there are some minimal changes between the two versions, generally related to an August 2024 notice published in the Federal Register alongside the final guidance, which the agency refers to as “the Modification Notice.” The Modification Notice made a technical modification related to the use of Form FDA 3500A, which is used to submit the summary reports under the program; the notice revises the VMSR program to reflect those updates. As that notice describes, FDA has updated Form FDA 3500A to specifically include a “check box” indicating that the form includes a summary report, and some associated fields about summary reporting.
• Compared to the draft guidance, the new final guidance also includes a new version of the Appendix that offers a “Sample Report” – an example of fhow to fill out FDA Form 3500 for VMSR purposes – and adds a couple of pages to the document overall.

An overview of the final guidance, which provides an explainer on the VMSR program going forward

• The final guidance document reiterates the overarching six principles of the VMSR program as they were laid out in 2018. These include: (1) that the submitted summary format information should give FDA sufficient information about malfunctions; (2) that reporting should use a common electronic format; (3) that information should be transparent to both FDA and the public; (4) manufacturers must communicate imminent hazards as soon as possible; (5) that VMSR does not change regulatory requirements for MDRs, but instead seeks to streamline reporting processes; and (6) summary reporting info should not be duplicative of other submissions.
• The document details FDA’s assessment process for VMSR program eligibility. In order to determine if a product would be appropriate for summary reporting, FDA explained that it initially evaluated all device product codes, for all device classes, to determine eligibility for the VMSR program when it was first implemented in 2018. FDA assesses new product codes for eligibility once they have been in existence for two years (as noted above), and also periodically evaluates ineligible product codes for eligibility changes. While FDA did not provide a specific timeline for “periodic” evaluation of product code eligibility, as was requested by AdvaMed, the agency does now “provide information regarding the list of eligible product codes for the VMSR Program on the VMSR webpage.” That new webpage includes information on the VMSR Program overall, this guidance document, and the 2024 Modification Notice – as well as a “Comprehensive List of Eligible Product Codes” (note: the link to the list on that website is an automatic zip file download).
• The final guidance goes on to explain: When conducting these assessments for appropriateness, FDA considers the device’s benefit-risk profile and available postmarket safety information (e.g., frequency of adverse events, type and complexity of malfunctions). The document also explains that manufacturers may send a request via email (MDRPolicy@fda.hhs.gov) for a product code to be considered for eligibility in the VMSR program and delineates the specific information that must be included in the request. The guidance explicitly names event types of MDR reportable events and entities that will never be covered by the VMSR program: (1) reportable death and serious injuries, (2) reportable malfunction associated with a 5-day report, as required in 21 CFR 242 803.53, and (3) importers and device user facilities.
• Manufacturers must follow three specific conditions if they elect to participate in the VMSR Program. First, “individual reports,” rather than summary reports, are required under certain circumstances for manufacturers participating in the VMSR Program. There are five specific situations that would require an individual report: (1) Reportable malfunction is associated with a 5-day report under 21 CFR 803.53(a) – these are reportable events that necessitate remedial action to prevent an unreasonable risk of substantial harm to the public health; (2) A reportable malfunction is the subject of certain device recalls, and is triggered by the date that a recall (including corrective and preventive actions) are reported to the FDA. Notably, if the manufacturer becomes aware of reportable malfunction events before this trigger, then they should submit a summary report “within 30 calendar days” of submitting the correction or removal report and check the corresponding box on Form FDA 3500A; (3) FDA has determined that individual MDR reporting is necessary to address a public health issue, which the agency will “specify” in “written notification”; (4) FDA has determined that a device manufacturer may not report in summary reporting format and is no longer eligible to participate in VMSR; (5) A new type of reportable malfunction occurs for a device.
• Notably, the agency has added a clarification to scenario number four in the final guidance: If a device manufacturer becomes aware of a reportable malfunction that would go into its summary report before FDA determines that the manufacturers may no longer participate in VMSR, then they may still submit those events in the summary format – but should still do so “within 30 days of receiving notification from FDA” that they may no longer participate in the program. If the agency believes that an individual report is needed for any reportable events, it will specify that in its written notification to the manufacturer.
• The second condition focuses on new information. Under this condition, VMSR program participants should submit supplemental reports to FDA if a manufacturer becomes aware of required information that either not known or not available when the initial summary malfunction report was transmitted. These reports must be submitted by the applicable quarterly deadline (see Table 1, page 14), and manufacturers should indicate that the report is a supplemental or follow-up report, including only the new, changed, or corrected information. If the new information suggests that the event represents a reportable serious injury or death, or a new type of reportable malfunction, the manufacturer must submit an individual MDR within 30 calendar days of becoming aware of the additional information, as well as a simultaneous supplemental report “to update the initial malfunction summary report.” While this the process that MDMA asked FDA to streamline, the agency did not make that change.
• The third condition for VMSR program is adherence to the format and schedule for submitting summary reports, which is reiterated from the 2018 implementation materials – as updated by the Modification Notice (described above) issued in August 2024. Manufacturers must complete the applicable sections of Form FDA 3500A, which must be submitted electronically on a quarterly basis. The final guidance includes explicit instructions for using Form FDA 3500A and a list of the minimum information needed for each summary malfunction report – as well as a new appendix that includes an example.
• The guidance also emphasizes benefit of “bundling.” In certain circumstances, manufacturers can “bundle” reports of like events, with examples provided in the guidance’s Appendix. In the introduction of the guidance, FDA asserted that “bundling “like events” together into a single summary report description has benefits for manufacturers, FDA, and the public.” However, this bundling is limited to like events, and separate summary malfunction reports must be submitted for each unique combination of brand name, device model, and MDR adverse event code(s). Reports on similar devices cannot be bundled. As noted above, the device trade associations had asked for some additional flexibility to submit reports or “unique combinations” of brand name and device model only, and not every individual “MDR adverse event problem code” as a “unique combination” – but the agency did not incorporate this into the final guidance.

What’s next?

• In general, industry has been supportive of VMSR, albeit asking for some programmatic improvements. These include more regular updates to the eligible product codes and the ability to bundle reports with different MDR adverse event problem codes. The new final guidance should provide some consistency and transparency for manufacturers leveraging the program.
• The final guidance nearly completely aligns with the draft version from 2022, with a few new clarifications and the addition of an example of a Form FDA 3500A summary report. As noted above, industry did ask for some additional points of clarity or flexibility, but these were generally not incorporated by the FDA into the final guidance in a meaningful way. However, future program updates are possible as the agency and industry grow more familiar with VMSR as an implemented program.

Featuring previous research by Amanda Conti.

To contact the author of this item, please email Laura DiAngelo ( ldiangelo@agencyiq.com).To contact the editor of this item, please email Kari Oakes ( koakes@agencyiq.com).

Key Documents and Dates

• Voluntary Malfunction Summary Reporting (VMSR) Program for Manufacturers: Guidance for Industry and Food and Drug Administration Staff
• Medical Devices and Device-led Combination Products: Voluntary Malfunction Summary Reporting for Manufacturers (Modification Notice)