FDA Flags Inconsistent Hospital Reporting Of Medical Device Problems

Abstract

The National Evaluation System for Health Technology will be developed over the next five years to upgrade and improve the reporting of medical device adverse events. However, participants using the new system will incur significant capital costs.

Concerns about medical devices going awry in hospitals are pushing the Food and Drug Administration (FDA) to create a new adverse effects reporting system, which, as it is developed over the next five years, will produce seismic changes both directly and indirectly in the way hospitals collect and report incident information. “Passive” hard-copy reports, dinosaurs in this electronic day and age, will be out. The establishment of the new National Evaluation System for Health Technology (NEST) will usher in an era of “active” electronic reports that include clinical data (the current hot term is “real-world evidence” or RWE) about patients hurt by medical devices. New software will appear. Although reporting to the NEST will be voluntary, hospitals, medical device manufacturers, disease registries, insurance companies, and others will be forced to understand new industry software standards, such as the suddenly popular “Fast Healthcare Interoperability Resources;” purchase new inventory and claims software; and upgrade device tracking to identify unique device identification (UDI) barcodes. Significant capital expenditures will be involved.

“What portion of our health care dollars should we be spending on reporting in this time when health care dollars are shrinking?” asks Janis Orlowski, MD, MACP, Chief Health Care Officer for the American Association of Medical Colleges in Washington, D.C. “We have to be very cognizant of that.”

The FDA’s recent push for medical device regulation has something to do with an investigation of 17 hospitals conducted in December 2015. It confirmed what the FDA probably already knew: the “medical device reports” that hospitals are supposed to submit to the FDA and, in some instances, to device manufacturers are very often not submitted.¹ The negative impact on patient safety can be significant.

The FDA’s concern gave birth to a December 2016 workshop called The Role of Hospitals in Modernizing Evidence Generation for Device Evaluation: Harnessing the Digital Revolution for Surveillance. At the meeting, Jeffrey Natterman, Risk Manager and Associate Senior Counsel for the Johns Hopkins Hospital, said, “One of the problems at hospitals is that no one knows they are supposed to do it.” The “it” was a reference to reporting adverse effects from medical devices. The FDA is committed to undertaking an “education” program with hospitals, but the details have not been announced.

Over the past year, the FDA has focused on improving reporting from medical device manufacturers, too, mostly through the issuance of guidance documents, many of which have included controversial segments. For example, in December the FDA issued a final guidance called Public Notification of Emerging Postmarket Medical Device Signals.² Various industry officials, such as Diane Wurzburger, Executive of Regulatory Affairs for GE Healthcare, had asked the FDA to include language committing the FDA to “validate” with the manufacturer any signal the agency receives. The FDA declined to do so.

Stephen Barlas

The Current System ... and Its Limitations

Under federal rules, hospitals have 10 days to report serious device-related injuries to the device’s manufacturer and to notify both the manufacturer and the FDA about any deaths that may have resulted. Manufacturers are required to file reports with the FDA within 30 days of learning about an injury or death that may have been caused by a device. Manufacturers must also report to the FDA when they become aware that their device has malfunctioned and would be likely to cause or contribute to a death or serious injury if the malfunction were to reoccur. The above reports are sent in on a 3500A form. Although a user facility is not required to report a device malfunction, it can voluntarily inform the FDA of product problems through MedWatch, the FDA’s safety information and adverse event reporting program.

Hospitals cannot be blamed fully for failures to report. The reporting requirement states that reporting is necessary if a device “may have caused death or serious illness or injury or a malfunction.” The qualifier “may” throws confusion into the definition. Isaac Chang, PhD, Director of the Division of Postmarket Surveillance at the FDA’s Center for Devices and Radiological Health (CDRH), says that a hospital does not have to provide “causality” before reporting. Almost every word of the reporting requirement can be parsed. “Serious illness or injury” means a life-threatening situation or permanent impairment, or damage to a body function or structure. Even temporary impairment dictates a report when there was quick medical or surgical intervention to prevent it from becoming permanent. And even if a “life-threatening” condition is a temporary threat, it must be reported. The “malfunction” portion of the requirement is equally ambiguous.

Controversial Guidance Documents

The FDA tried to clarify some of these conundrums when it published final guidance called Medical Device Reporting for Manufacturers in November.³ Again, this guidance only covers manufacturers, not hospitals, though health care facilities have similar rules. It defines what actually triggers a company’s responsibility to report the injuries and malfunctions mentioned in the previous paragraph. The precipitating event is when a manufacturer receives or otherwise becomes aware of information from any source that reasonably suggests that one of its marketed devices caused injury or malfunctioned. The “becomes aware of” and “reasonably suggests” portions of the requirement are open to interpretation.

One concern has to do with the use of trend analysis to determine whether a reportable event has occurred in the past. That comes up in the guidance’s explication of when a company “becomes aware” of information, which includes trend analysis. It is unclear from the final guidance whether trend analysis is required or is something that, if done voluntarily, must be an element in a decision as to whether the company “becomes aware” that a reportable event under medical device reporting (MDR) necessitates remedial action to prevent an unreasonable risk of substantial harm to public health. Jeffrey Secunda, MS, MBA, Vice President of Technology and Regulatory Affairs for the Advanced Medical Technology Association in Washington, D.C., the device manufacturers’ trade group, states, “It is not clear when an event that was previously evaluated as not reportable would become reportable based on a trend.”

Hospital Underreporting

Over the past year, however, the high visibility issue has been the FDA’s concern about hospital underreporting of medical device problems. Throughout their workday, hospital staff members use a variety of medical devices: imaging machines, electrocardiographs, and in vitro tests to make diagnoses; infusion pumps, ventilators, and robotics to provide treatment; and an array of implants to replace diseased joints and organs. The agency held a meeting at its suburban Maryland location on December 5 and outlined some of its concerns about hospital reporting, its ongoing initiatives to encourage reporting, and its understanding of the barriers that either prevent or discourage hospitals from reporting instances in which a device may have caused death, serious illness, or injury or a malfunction.

The agency has long guessed that reporting is sketchy at best. That assumption was born out in early 2016 when the FDA announced the results of 17 hospital inspections it initiated in December 2015.¹ The hospitals were chosen because there were reports of events at these facilities related to the spread of uterine cancer from the use of morcellators or the spread of infections associated with contaminated duodenoscopes. “While these events appeared to be the kind that would have fallen under current medical device reporting requirements, we did not see corresponding adverse event reports in our adverse event MAUDE [Manufacturer and User Facility Device Experience] database,” states Jeffrey Shuren, MD, JD, Director of the FDA’s CDRH. Some of the reporting lapses were found at Massachusetts General Hospital in Boston, at NewYork–Presbyterian Hospital, and at two hospitals in Los Angeles—the Ronald Reagan UCLA Medical Center and the Cedars–Sinai Medical Center. Among the 17 hospitals reviewed, the FDA said six didn’t properly report both patient deaths and injuries linked to medical devices within 10 days, as required. Five other hospitals didn’t report serious injuries in a timely manner, according to the agency.

“We believe that these hospitals are not unique in that there is limited to no reporting to the FDA or to the manufacturers at some hospitals,” Dr. Shuren wrote in an agency blog report. “Hospital staff often were not aware of, nor trained to comply with, all of the FDA’s medical device reporting requirements. We feel certain there is a better way to work with hospitals to get the real-world information we need, and we should work with the hospital community to find that right path, especially in light of developments in the creation and evaluation of electronic health information.”¹

While those and other hospitals can make a case for the turgidity of reporting regulations, it is also true that hospitals that fail to report have very little to worry about in terms of FDA remedial action. In the case of the 17 hospitals subject to the FDA inspections starting in December 2015, the agency issued a Form FDA 483 to 15 of them, which noted observations that the FDA investigators made during the inspections. Observations listed on a Form FDA 483 do not represent a final agency determination regarding a facility’s compliance. The violations noted during the inspections varied by facility but included observations that written MDR procedures had not been developed, maintained, and implemented. “For some hospitals with significant violations of the MDR regulation, FDA received a response that we determined was not adequate to address those violations, and we engaged with these facilities to facilitate an effective path to voluntary compliance,” states Deborah Kotz, an FDA spokeswoman. “These hospitals indicated their willingness to work with us and address the violations, and at this time, we do not believe any additional action with regard to these hospitals is necessary.” The FDA plans to partner with hospitals to educate them on the agency’s MDR requirements to improve their reporting of device-related adverse events.

Long-Standing Problems

The FDA recognized about five years ago, before the investigation of the 17 hospitals reconfirmed it, that a better system for reporting was needed. In 2012, the agency issued a report, Strengthening Our National System for Medical Device Postmarket Surveillance, that described the limitations of current authorities and approaches to medical device post-market surveillance and proposed a strategy for a national medical device post-market surveillance system.⁴

“There are issues, I am not going to lie,” states Hopkins’ Natterman, referring to the barriers hospitals face when complying with the reporting requirement. Part of the problem is lack of buy-in from hospital leadership. Concern about hospital liability also dampens reporting. “It has happened that we send a report to the manufacturer, and then it goes into a black hole,” Natterman continues. “Then we get sued, and we end up struggling with the manufacturer to get information.”

Even if every hospital in the country reported adverse events correctly, the FDA would still have a MAUDE database filled with passive information. Such passive surveillance has important limitations because it relies on people to identify that harm occurred or risk is present, recognize that the harm or risk is associated with the use of a particular device, and take the time to report it. In the past few years, the FDA has initiated efforts to make it easier for some hospitals to report and for the agency to obtain adverse effect information beyond what a hospital reports on its 3500A.

The Medical Product Safety Network (MedSun) was created in 2002. Composed of 300 hospitals, it allows them to submit data electronically (not necessary in MAUDE) and gives the FDA the ability to go into a hospital and tweeze out additional information. But participation in MedSun is limited, in part because the FDA requires 10 reports to be filed every year. Hopkins’ Natterman says that of the six hospitals in the Johns Hopkins Health System, only his—Johns Hopkins Hospital—files MedSun reports.

MedSun is an improvement over MAUDE because it collects more than just passive information. But the Holy Grail is the collection of more robust data. Obtaining clinical information from hospitals, insurance companies, electronic health records (EHRs), medical registries, and other sources would be an even bigger boon. The Sentinel system does that. It was authorized by Congress in 2008, but has taken more than half a decade to progress beyond a pilot stage. It allows the FDA to weed through medical claims data submitted by insurers in an attempt to find early-warning signs that a device is causing problems. The Sentinel system apparently has access to claims for nearly 200 million Americans.⁵

The medical device surveillance program within Sentinel is called BloodScan. It looks for problems with biologic products, such as vaccines, allergenic products, blood, blood components, and blood derivatives, tissues, and cellular and gene therapies. It has a lot of power, given those 200 million individuals, when it comes to looking for rare events for the purpose of analysis. However, 10% of the records in the Sentinel database are from EHRs, and the rest are from claims data. “That has a lot of limitations for the kind of work we want to do,” admits Steven Anderson, PhD, MPP, Director of the Office of Biostatistics and Epidemiology in the FDA’s Center for Biologics Evaluation and Research. Of the 24 data partners in the program, a major one is Hospital Corporation of America, which has 160 hospitals and 20 million patient encounters a year. Dr. Anderson notes, however, that there are significant shortcomings to BloodScan, including medical chart validation, which can take from six to eight months. That is, if the transfusion is even noted in the chart; 50% or more are not noted, he says.

The ultimate bonanza is a system that leverages RWE—data developed through routine clinical practice. These data would be captured in electronic health information (such as device registries, EHRs, and payer claims forms) that incorporated UDIs to quickly identify poorly performing devices; accurately characterize and disseminate information about real-world device performance, including the clinical benefits and risks of marketed devices; and efficiently generate data to support pre-market clearance or approval of new devices and new uses of currently marketed devices.

That evolution is moving forward with the creation of the NEST. The FDA issued a $3 million grant in September to the Medical Device Innovation Consortium (MDIC) to establish the coordinating center, which would organize and run the NEST. It is envisioned as a virtual network of data partners, connected through reusable, standardized data use agreements, that permits access to data from multiple sources to optimize data standardization, expedite project-specific research agreements, and reduce the cost of evidence development through economies of scale.

Early critical data partners include the National Patient-Centered Clinical Research Network, Sentinel, coordinated registry networks, payers, large health care systems, claims data systems, the device industry, the National Center for Health Statistics, and patients, to name a few examples. Dawn Bardot, PhD, Vice President of Technology Innovation for MDIC, did not reply to a request for information about the NEST’s progress.

The concept of the NEST is well and good. However, the problem with collecting RWE on medical devices is that the quality of clinical information is inconsistent. In July, the FDA issued draft guidance on what it would like to see from the various sectors that could contribute medical device RWE.⁶ The responses indicate the long road the FDA has ahead of it as it tries to wrestle various sectors into a unified approach to submission of RWE. The 510(k) Coalition, composed of device manufacturers, feels the draft guidance relies too heavily on registries. “The final guidance needs to be clear that RWE is not limited to situations where the data is derived from a registry,” states Ralph Hall, a partner at Leavitt Partners, a Washington policy shop headlined by former Health and Human Services (HHS) Secretary Mike Leavitt.

The Coalition also believes that the draft guidance is not clear enough on the usage of different types of RWE and real-world data (RWD). “Most of the examples in the draft guidance seem to focus on clinical-type data, and do not consider data from sources such as engineering analysis and bench testing,” Hall explains. “Such information is often highly valuable in the device context.” Hall declined to elaborate.

RWD could be used in regulatory decision-making. But what about actions short of that, such as recalls or notifications to physicians and consumers about devices on the market that have shown recent troublesome effects? It is that instance the agency attempted to clarify when it issued its final guidance document in December: Public Notification of Emerging Postmarket Medical Device Signals.² The objective was to define the “emerging signals” that raise an issue about a device on the market that the agency has determined has the potential to impact patient management decisions and/or the known risk–benefit profile of the device. An emerging signal can arrive at the FDA from a variety of sources including, but not limited to, MDRs, MedSun reports, data from mandated post-market studies, clinical trials or data published in the scientific literature, epidemiologic research including evaluation of administrative databases, health care claims data or registries, and inquiries or investigations from global, federal, or state health agencies.

Mark B. Leahey, President and Chief Executive Officer of the Medical Device Manufacturers Association in Washington, D.C., worries that the FDA’s guidance may have unintended consequences related to unvalidated information being relied upon by patients, providers, and the public to make certain clinical decisions that may not be in a patient’s best interest. But in the final guidance, the FDA nowhere states the need for any emerging signal to be “validated” before the agency issues a communication of concern. Rather, it cites a standard that “the available evidence is of sufficient strength.” It does note, however, that the device manufacturer will be consulted during the process of signal refinement, unless time does not permit because of the risk of patient harm or because it is not feasible, e.g., CDRH cannot reach all manufacturers.

The FDA can issue all the guidance documents in the world, and they can all be clear as a bell, but device reporting will still be sketchy because there is no penalty for failing to submit a report. Moreover, even if all reports that should be submitted were submitted, the data, especially from hospitals, would still be lacking. The EHR software developed by companies such as Cerner and Epic and certified by the HHS Office of the National Coordinator for Health Information Technology does not allow for the hospital to code for the UDI. “I see that as a missed opportunity,” states Chantal Worzala, MPA, Vice President for Health Information and Policy Operations at the American Hospital Association in Chicago, Illinois.

That shortcoming may be fixed in the next few years. But the ability to track devices via UDIs will be costly for hospitals to implement, and it is hard to see the FDA forcing them to spend the money.