Introduction
On September 24, 2013 the Food and Drug Administration (“FDA” or “the agency”) published its final rule establishing the Unique Device Identification System (“UDIS”) (“UDIS final rule”).178 Fed. Reg. 58786 (Tuesday, September 24, 2013) 7 MELR 605, 10/2/13.
The rule responds to successive statutory commands of Congress: (1) Section 226 of the Food and Drug Administration Amendments Act of 2007 (“FDAAA”); and (2) Section 614 of the Food and Drug Administration Safety and Innovation Act of 2012 (“FDASIA”). Each dealt with Section 519(f) of the Federal Food, Drug, and Cosmetic Act (“FDCA” or “the Act”). FDAAA inserted Section 519(f) to instruct the agency to “promulgate regulations establishing a unique device identification system for medical devices requiring the label of devices to bear a unique identifier … which shall adequately identify the device through distribution and use, and may include information on the lot or serial number.”2FDAAA, P.L. 110-85, §226 (21 U.S.C. §360i(f)). FDASIA subsequently amended Section 519(f) by establishing the deadline of December 31, 2012 for the agency to propose a rule, requiring FDA to promulgate final regulations within six months of the ending of the comment period and ordering FDA to implement the system — for life saving, life sustaining and implantable medical devices — within two years of finalization.3FDASIA, P.L. 112-144, §614 (21 U.S.C. §360i(f)).
UDIS comprises two, interconnected parts: unique device identifiers (“UDI”) and the Global Unique Device Identification Database (“GUDID”).478 Fed. Reg. at 58786. The UDI permits healthcare providers and patients to identify accurately a particular medical device by providing information about the device’s version, model and labeler5The UDIS final rule relies heavily on the concept of the “labeler.” “Labeler” is broader than “manufacturer.” It includes “[a]ny person who causes a label to be applied to a device with the intent that the device will be commercially distributed without any intended subsequent replacement or modification of the label” and “[a]ny person who causes the label … to be replaced or modified with the intent that the device will be commercially distributed.” 21 CFR §801.3. Adding distributor information is not considered a modification. (the “device identifier” portion) and the lot, serial number, expiration and/or manufacturing date (the “production identifier” portion).6“Global Unique Device Identification Database (GUDID),” FDA Draft Guidance for Industry (September 24, 2013) (“GUDID Draft Guidance”) at 5. FDA initially will issue UDIs but will also accredit third parties for their issuance. 21 CFR §830.100. The GUDID manages information mapped to medical devices through reference to their UDIs.7The GUDID does not collect or maintain identifiable patient data. Id.
UDIS’ ambitious goals include: (1) reducing medical errors by providing accurate device identification and use information; (2) better integration of records of device treatment use into electronic data systems (e.g., electronic health records), especially through “automatic identification and data capture” (“AIDC”)8“System and Network Security Acronyms and Abbreviations,” National Institute of Standards and Technology, NIST Interagency Report 7581 (September 2009). Radio frequency identification is often referred-to as “RFID.” technology (e.g., bar codes, magnetic strips, radio frequency identification); (3) more precisely identifying devices implicated in adverse events; (4) more precisely identifying devices when filing adverse event reports; (5) facilitating device recalls; (6) improving the clarity and focus of FDA safety communications; and (7) offering educational, inventory management and other indirect benefits.978 Fed. Reg. at 58786-58787. GUDID will use UDIs as the keys to return data to the public (e.g., patients/consumers, healthcare providers, hospitals) on the brand name, manufacturer, version, device description, commercial distribution status, product code, product classification, and prescription status for individual devices.10GUDID Draft Guidance at 25, Appendix B. Many additional data points are included.
According to Dr. Jeffrey Shuren, Director for FDA’s Center for Devices and Radiological Health, the UDIS will allow manufacturers, healthcare providers and patients “to report medical device adverse events more accurately. And recalls will be faster and more effective. Where there are critical issues with a medical device, the UDI could be specified in safety alerts and recall notices… . [S]imilar devices not implicated would not be taken out of use.”11“Identifying Medical Devices Will Strengthen Safety”, Jeffrey Shuren, MD, JD, FDA Voice (September 20, 2013) last accessed 11/10/2013 at http://blogs.fda.gov/fdavoice/index.php/2013/09/identifying-medical-devices-will-strengthen-safety/.
Regulatory and Political Background
At least a decade of sporadic effort underlies the UDI Rule. That effort approached critical mass with FDA’s 2004 proposal for mandatory bar code labeling on pharmaceuticals. The connection was clear. If a bar code labeling system for pharmaceuticals was necessary for public health improvement and protection (for example, by minimizing medication errors and improving accuracy) then medical devices could benefit from the same system.
Pharmaceutical bar coding, however, enjoyed an enormous advantage: The National Drug Code system. There was no comparable, uniform device identification system.12ERG Final Report, “Unique Identification for Medical Devices”, p.1-1 (March 22,2006) (last accessed 11/10/2013 at http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/UniqueDeviceIdentification/ucm054270.pdf). See 69 Fed. Reg. 9120, 9132. FDA, for that reason, ultimately found extension of the identification scheme to medical devices unworkable. If the National Drug Code system were indispensable to the effort with pharmaceuticals then, in order to achieve the same public health benefits, FDA would need a universal, standardized system of unique identifiers for medical devices also.
FDA’s early planning developed over a series of facilitated meetings with manufacturers, consultants, providers, trade associations and regulators, starting in the spring of 2005.13“Report on Meeting to Discuss Unique Device Identification – April 14-15, 2005,” June 14, 2005, last accessed 11/10/2013 at http://www.fda.gov/medicaldevices/deviceregulationandguidance/uniquedeviceidentification/ucm054190.htm. Both AdvaMed (the “Advanced Medical Technology Association”) and the Medical Device Manufacturers Association (“MDMA”) opposed mandatory identification systems. Whether responding to this opposition — or already so inclined — the agency from the outset expressed interest in fomenting an industry-led effort: the first meeting included discussing “the potential for developing a public-private partnership with the goal of promulgating a voluntary program.”14Id. But in March, 2006, FDA’s outside consultants submitted a report citing concern over “how and whether UDI [unique device identification] will evolve further into a universal standard for the medical device industry.”15ERG Final Report, “Unique Identification for Medical Devices,” p.5-1 (March 22,2006) (last accessed 11/10/2013 at http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/UniqueDeviceIdentification/ucm054270.pdf). The researchers pointed out that despite certain voluntary efforts “[t]he quality of device information remains uneven” and that, in fact, “UDI systems might allow much greater opportunity for price and performance comparability” thereby creating disincentives for manufacturers voluntarily to cooperate.16Id. at p. 5-1 – 5-2.
The consultants were clear, however, in describing significant potential advantages. Their report argued that a unique device identifier coding scheme linked to a robust database (now known as the Global Unique Device Identification Database or “GUDID”) for the collection of device information throughout distribution and use17UDI Rule at 58817. could: Reduce medical errors, improve accuracy in reporting, facilitate recalls, identify device incompatibilities with proposed treatments (through incorporation of the device code into the patient’s electronic health record), identify potential allergic reactions, reduce product counterfeiting and enhance post-market surveillance.18Id. at p. 2-1 – 2-3.
FDA held meetings with stakeholders throughout the year19“FDA Seeking Comments on Use of Identifier System for Medical Devices,” FDA News Release (P06-112) August 9, 2006 last accessed 11/10/2013 at http://www.fda.gov/newsevents/newsroom/pressannouncements/2006/ucm108708.htm. and, by the fall of 2006, began explicitly to invite consideration of “the benefits and costs of a regulatory solution.”20“FDA Public Meeting on Unique Device Identification – October 25, 2006,” October 31, 2006 last accessed 11/10/2013 at http://www.fda.gov/medicaldevices/deviceregulationandguidance/uniquedeviceidentification/ucm249650.htm. Additional FDA meetings and workshops on unique device identification followed after FDAAA became law in 2007.21E.g., 74 Fed. Reg. 2601 (Thursday, January 15, 2009). It was another five years (July, 2012) before FDA published a proposed rule for unique device identification.2277 Fed. Reg. 40736 (Tuesday, July 10, 2012) 6 MELR 442, 7/11/12. That initial rule, intended to be phased-in over a period of seven years, used U.S. standard dating (month, day, year), required unique device identifiers (plain text and automatic identification and data capture technology, i.e., “bar codes”) on product labels, packages and implants and exempted over-the-counter devices sold at retail as well as very basic class I devices.2377 Fed. Reg. at 40737-40738.
President Obama signed FDASIA into law almost simultaneously, forcing FDA to operate under fairly strict deadlines: Six months to finalize its proposed regulations after the end of the comment period (November 7, 2012) and not more than two years post-finalization to implement the regulations for implantable, life saving and life sustaining devices. This last provision had probably the most dramatic, immediate effect by accelerating implementation for all (not just class III) implantable, life saving and life sustaining devices — they would be required to comply a year earlier than originally planned.2477 Fed. Reg. at 69394 (Monday, November 19, 2012). Additionally, it required FDA to accelerate the requirement that implantable devices be marked directly with a UDI to within two years of the final rule.25Id.
FDA announced responsive changes on November 19, 2012.26Id 6 MELR 717, 11/28/12. By that point medical device companies — active in the UDI discussions for almost a decade — had reacted strongly to many of the July proposed rule’s requirements. Industry, represented by AdvaMed and MDMA, sought adoption of the international dating format27AdvaMed Comments on Proposed Rule, Doc.No. FDA-2011-N-0090 (November 7, 2012) (“AdvaMed Comments”) at 2; Bio Comments on Proposed Rule, Doc.No. FDA-2011-N-0090 (November 7, 2012) at 2., elimination of the requirement that implantable devices carry “direct marking” of the unique device identifier28AdvaMed Comments at 5., modification of the rule governing combination products29AdvaMed Comments at 14., delayed implementation for all class III devices30AdvaMed Comments at 9. and removal of the requirement that many types of “convenience kits” carry overlapping unique device identifiers with their components.31AdvaMed Comments at 17.
The UDIS final rule incorporates many of the device manufacturers’ proposals and industry has been supportive, “commend[ing] FDA for addressing many of the concerns industry raised in the proposed rule,” particularly with respect to the issues of marking implants, marking single-use devices in multi-packs, exhausting non-complying inventory, international date formatting and delayed implementation.32“AdvaMed Statement on Final Unique Device Identification Rule,” Press Release (September 20, 2013), last accessed 11/10/2013 at advamed.org/news/65/.
The UDIS Final Rule
Timetable for Implementation
FDA starts phasing-in the UDIS final rule on September 24, 2014. Implementation for device classes proceeds — in descending order of risk — through September 24, 2020.
- Labelers of class III devices (and those licensed under the Public Health Service Act) will be required to use UDIs and begin populating the GUDID by September 24, 2014.3321 CFR §§801.20, 830.300.
- By September 24, 2015, the labels and packages of all implantable, life supporting and life sustaining devices will be similarly affected, with multi-use, reprocessed life-supporting and life-sustaining devices required to bear UDI marking.34Id. Implantable devices will not be required to bear direct UDI marking.
- Class II devices will come “on-line” by September 24, 2016, and all multi-use, reprocessed class III devices must then be marked.35Id.
- Labeling and packaging for class I devices will be affected by September 24, 2018 (with corresponding population of the GUDID) and multi-use, reprocessed class II devices must be marked.36Id.
- Finally, by September 24, 2020, multi-use, reprocessed class I devices will be required to bear markings.37Id.
Structure of the UDIS final rule
As discussed, unique device identifiers and the global unique device identification database work together to form the unique device identification system. The global unique device identification database accepts data on a number of device (and corresponding manufacturer’s) characteristics and links them to the UDI. The UDI itself is simply a numeric or alphanumeric code which must be displayed (a) in plain text and (b) using AIDC technology (e.g., bar code, RFID).3821 CFR §801.40. The UDI consists of two parts: (1) the device identifier (“DI”), which codes for the device, model or version and labeler; and (2) the production identifier (“PI”), which codes the device’s lot, serial number and expiration and/or manufacturing date. FDA expects to accredit private, for-profit entities to issue UDIs under international standards as long as those entities “protect against conflicts of interest between the issuing agency … and labelers.”3921 CFR §830.100.
Given the pivotal role UDIs play in the UDIS system, many provisions of the UDIS final rule fall within Part 801 (Labeling) of Title 21, Code of Federal Regulations. UDI labeling is mandatory under the rule in the absence of an exception;4021 CFR §801.20. the failure to label will produce a misbranded device under the FDCA.41E.g., Section 502(c) of the Act; 21 U.S.C. §352(c) (a device is deemed misbranded if the label or labeling fails to include “any word, statement, or other information required by or under authority of this Act to appear”). FDA may grant exceptions based on technological infeasibility, the superiority of an alternative approach or “in the best interest of public health.”4221 CFR §801.55(b), (d). Presumably FDA would use the “best interest of public health” criterion to extend, discretionarily, the deadline for labeling class III devices as urged by industry groups. Devices must be physically imprinted with a UDI unless doing so “would interfere with the safety or effectiveness of the device,” would not be technologically feasible or the device is “a single-use device and is subjected to additional processing and manufacturing for the purpose of an additional single use.”4321 CFR §801.45(c). The UDI marked on a device need not match the device’s packaging UDI if, for example, the device is part of a multi-unit pack.4421 CFR §801.45(b). Implants need not be marked directly.4521 CFR §801.45(a). Standalone software devices, however, must be marked through the electronic display (on start-up or via menu command) of the UDI.4621 CFR §801.50.
The UDIS final rule systematically incorporates the UDI throughout FDA’s information infrastructure most critically, perhaps, including medical device adverse reporting. User facilities4721 CFR §803.33., importers4821 CFR §803.42. and manufacturers4921 CFR §803.52. all must include the UDI in their reports. Reports of device corrections and removals must also use the product’s UDI5021 CFR §806.10. as must the records of unreported events.5121 CFR §806.20. FDA orders requiring cessation of distribution will use the UDI5221 CFR §810.10. and the UDIS final rule introduces UDIs throughout the quality system regulation (Part 820 of Title 21).53E.g., device labeling (§820.120), history records (§820.184), complaint files (§820.198) and service records (§820.200). UDIs will also be critical components of device tracking5421 CFR §§821.25, 821.30. and postmarket surveillance programs.5521 CFR §822.9. Device labelers must retain, for three years after the labeler ceases to market the corresponding versions or models of the devices, records of all the UDIs used.5621 CFR §830.360(a).
FDA specifies requirements for GUDID information under Subpart E, Part 830, Title 21 Code of Federal Regulations (“Global Unique Device Identification Database”). Every labeler must designate an individual responsible for agency UDI communications5721 CFR §830.320(a). who must also provide, inter alia, labeler information, the name of the UDI issuing agency, device sterility, version/model numbers, magnetic resonance imaging safety and premarket submission information.5821 CFR §830.310. Additional data points include whether the device incorporates natural latex which may contact patients. The required information must be updated immediately upon a change in the device’s labeling or, if the label itself is not changed, within ten business days.5921 CFR §830.330(b). Labelers have thirty (30) days to correct erroneous (or potentially misleading) information submitted to GUDID.6021 CFR §830.350.
Conclusion
More than a decade has passed during which the unique device identification system has progressed from an identified need through conception, study, public engagement, consensus building, legislative mandate and rulemaking. It moved from a (proposed) voluntary system to one which FDA asserted (and was granted) statutory authority to mandate. Its formal proposal (July, 2012) produced two hundred and seventy (270) submissions from approximately two hundred and twenty-five (225) sources, resulting in over one thousand, seven hundred (1,700) pages of comments. Stakeholders ranging from AdvaMed to Public Citizen have weighed in on the result.61“FDA’s Unique Device Identifier Rule Years Delayed but a Welcome Step Forward for Medical Device Safety”, Statement by Dr. Michael Carome, September 20, 2013, last accessed 11/11/2013 at http://www.citizen.org/pressroom/pressroomredirect.cfm?ID=3982 (“Public Citizen applauds today’s announcement by the Food and Drug Administration (FDA) that the agency at last has issued a final regulation requiring implementation of a unique device identifier (UDI) system for medical devices. Public Citizen strongly advocated for a UDI system”).
The UDIS final rule, notwithstanding the relative brevity of the regulatory text, has been described by industry observers as “one of the most extensive and most complex regulations to be issued in recent memory.”62Janet Trunzo, AdvaMed, Conference call with reporters, November 8, 2012. Medical device manufacturers were fairly successful in achieving some of their more important aims. For example, the UDIS final rule adopts the international standard date format6321 CFR §801.18(a)., permits class I devices to use their existing UPC codes6421 CFR §801.40(d)., “bundles” devices in certain combination products and convenience kits under their umbrella product codes6521 CFR §801.30(a)(11),(b)., exempts non-implantable, single-use devices in all classifications (I, II and III) from UDI marking6621 CFR §801.30(a)(3)., exempts all implantable devices from UDI marking6721 CFR §801.45(a)., adds an additional three-year period to deplete unmarked devices from inventory6821 CFR §801.30(a)(1). and creates a process to request extensions of time to comply.6921 CFR §801.55(b). FDA included the process to respond to comments that, for example, the one-year compliance window for class III devices was too short. 78 Fed. Reg. at 58795. The medical products, provider and patient communities must now wait to see if Dr. Jeffrey Shuren’s assertion that “what [UDI] stands for is better patient health” proves true during the next decade.
