21 U.S.C. § 360i — Records and reports on devices

**(a) General rule** Every person who is a manufacturer or importer of a device intended for human use shall establish and maintain such records, make such reports, and provide such information, as the Secretary may by regulation reasonably require to assure that such device is not adulterated or misbranded and to otherwise assure its safety and effectiveness. Regulations prescribed under the preceding sentence— (1) shall require a device manufacturer or importer to report to the Secretary whenever the manufacturer or importer receives or otherwise becomes aware of information that reasonably suggests that one of its marketed devices— (A) may have caused or contributed to a death or serious injury, or (B) has malfunctioned and that such device or a similar device marketed by the manufacturer or importer would be likely to cause or contribute to a death or serious injury if the malfunction were to recur, which report under this subparagraph— (i) shall be submitted in accordance with part 803 of title 21, Code of Federal Regulations (or successor regulations), unless the Secretary grants an exemption or variance from, or an alternative to, a requirement under such regulations pursuant to section 803.19 of such part, if the device involved is— (I) a class III device; (II) a class II device that is permanently implantable, is life supporting, or is life sustaining; or (III) a type of device which the Secretary has, by notice published in the Federal Register or letter to the person who is the manufacturer or importer of the device, indicated should be subject to such part 803 in order to protect the public health; (ii) shall, if the device is not subject to clause (i), be submitted in accordance with criteria established by the Secretary for reports made pursuant to this clause, which criteria shall require the reports to be in summary form and made on a quarterly basis; or (iii) shall, if the device is imported into the United States and for which part 803 of title 21, Code of Federal Regulations (or successor regulations) requires an importer to submit a report to the manufacturer, be submitted by the importer to the manufacturer in accordance with part 803 of title 21, Code of Federal Regulations (or successor regulations) 11 So in original. Probably should be followed by a semicolon. (2) shall define the term “serious injury” to mean an injury that— (A) is life threatening, (B) results in permanent impairment of a body function or permanent damage to a body structure, or (C) necessitates medical or surgical intervention to preclude permanent impairment of a body function or permanent damage to a body structure; (3) shall require reporting of other significant adverse device experiences as determined by the Secretary to be necessary to be reported; (4) shall not impose requirements unduly burdensome to a device manufacturer or importer taking into account his cost of complying with such requirements and the need for the protection of the public health and the implementation of this chapter; (5) which prescribe the procedure for making requests for reports or information shall require that each request made under such regulations for submission of a report or information to the Secretary state the reason or purpose for such request and identify to the fullest extent practicable such report or information; (6) which require submission of a report or information to the Secretary shall state the reason or purpose for the submission of such report or information and identify to the fullest extent practicable such report or information; (7) may not require that the identity of any patient be disclosed in records, reports, or information required under this subsection unless required for the medical welfare of an individual, to determine the safety or effectiveness of a device, or to verify a record, report, or information submitted under this chapter; and (8) may not require a manufacturer or importer of a class I device to— (A) maintain for such a device records respecting information not in the possession of the manufacturer or importer, or (B) to submit for such a device to the Secretary any report or information— (i) not in the possession of the manufacturer or importer, or (ii) on a periodic basis, unless such report or information is necessary to determine if the device should be reclassified or if the device is adulterated or misbranded. and 22 So in original. The word “and” probably should not appear. In prescribing such regulations, the Secretary shall have due regard for the professional ethics of the medical profession and the interests of patients. The prohibitions of paragraph (7) of this subsection continue to apply to rec­ords, reports, and information concerning any individual who has been a patient, irrespective of whether or when he ceases to be a patient. The Secretary shall by regulation require distributors to keep records and make such records available to the Secretary upon request. Paragraphs (4) and (8) apply to distributors to the same extent and in the same manner as such paragraphs apply to manufacturers and importers. **(b) User reports** (1) (A) Whenever a device user facility receives or otherwise becomes aware of information that reasonably suggests that a device has or may have caused or contributed to the death of a patient of the facility, the facility shall, as soon as practicable but not later than 10 working days after becoming aware of the information, report the information to the Secretary and, if the identity of the manufacturer is known, to the manufacturer of the device. In the case of deaths, the Secretary may by regulation prescribe a shorter period for the reporting of such information. (B) Whenever a device user facility receives or otherwise becomes aware of— (i) information that reasonably suggests that a device has or may have caused or contributed to the serious illness of, or serious injury to, a patient of the facility, or (ii) other significant adverse device experiences as determined by the Secretary by regulation to be necessary to be reported, the facility shall, as soon as practicable but not later than 10 working days after becoming aware of the information, report the information to the manufacturer of the device or to the Secretary if the identity of the manufacturer is not known. (C) Each device user facility shall submit to the Secretary on an annual basis a summary of the reports made under subparagraphs (A) and (B). Such summary shall be submitted on January 1 of each year. The summary shall be in such form and contain such information from such reports as the Secretary may require and shall include— (i) sufficient information to identify the facility which made the reports for which the summary is submitted, (ii) in the case of any product which was the subject of a report, the product name, serial number, and model number, (iii) the name and the address of the manufacturer of such device, and (iv) a brief description of the event reported to the manufacturer. (D) For purposes of subparagraphs (A), (B), and (C), a device user facility shall be treated as having received or otherwise become aware of information with respect to a device of that facility when medical personnel who are employed by or otherwise formally affiliated with the facility receive or otherwise become aware of information with respect to that device in the course of their duties. (2) The Secretary may not disclose the identity of a device user facility which makes a report under paragraph (1) except in connection with— (A) an action brought to enforce [section 331(q) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title21-section331/q&num=0&edition=prelim), or (B) a communication to a manufacturer of a device which is the subject of a report under paragraph (1). This paragraph does not prohibit the Secretary from disclosing the identity of a device user facility making a report under paragraph (1) or any information in such a report to employees of the Department of Health and Human Services, to the Department of Justice, or to the duly authorized committees and subcommittees of the Congress. (3) No report made under paragraph (1) by— (A) a device user facility, (B) an individual who is employed by or otherwise formally affiliated with such a facility, or (C) a physician who is not required to make such a report, shall be admissible into evidence or otherwise used in any civil action involving private parties unless the facility, individual, or physician who made the report had knowledge of the falsity of the information contained in the report. (4) A report made under paragraph (1) does not affect any obligation of a manufacturer who receives the report to file a report as required under subsection (a). (5) With respect to device user facilities: (A) The Secretary shall by regulation plan and implement a program under which the Secretary limits user reporting under paragraphs (1) through (4) to a subset of user facilities that constitutes a representative profile of user reports for device deaths and serious illnesses or serious injuries. (B) During the period of planning the program under subparagraph (A), paragraphs (1) through (4) continue to apply. (C) During the period in which the Secretary is providing for a transition to the full implementation of the program, paragraphs (1) through (4) apply except to the extent that the Secretary determines otherwise. (D) On and after the date on which the program is fully implemented, paragraphs (1) through (4) do not apply to a user facility unless the facility is included in the subset referred to in subparagraph (A). (E) Not later than 2 years after November 21, 1997, the Secretary shall submit to the Committee on Commerce of the House of Representatives, and to the Committee on Labor and Human Resources of the Senate, a report describing the plan developed by the Secretary under subparagraph (A) and the progress that has been made toward the implementation of the plan. (6) For purposes of this subsection: (A) The term “device user facility” means a hospital, ambulatory surgical facility, nursing home, or outpatient treatment facility which is not a physician’s office. The Secretary may by regulation include an outpatient diagnostic facility which is not a physician’s office in such term. (B) The terms “serious illness” and “serious injury” mean illness or injury, respectively, that— (i) is life threatening, (ii) results in permanent impairment of a body function or permanent damage to a body structure, or (iii) necessitates medical or surgical intervention to preclude permanent impairment of a body function or permanent damage to a body structure. **(c) Persons exempt** Subsection (a) shall not apply to— (1) any practitioner who is licensed by law to prescribe or administer devices intended for use in humans and who manufactures or imports devices solely for use in the course of his professional practice; (2) any person who manufactures or imports devices intended for use in humans solely for such person’s use in research or teaching and not for sale (including any person who uses a device under an exemption granted under [section 360j(g) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title21-section360j/g&num=0&edition=prelim)); and (3) any other class of persons as the Secretary may by regulation exempt from subsection (a) upon a finding that compliance with the requirements of such subsection by such class with respect to a device is not necessary to (A) assure that a device is not adulterated or misbranded or (B) otherwise to assure its safety and effectiveness. **(d) Repealed. Pub. L. 105–115, title II, § 213(a)(2), Nov. 21, 1997, 111 Stat. 2347** **(e) Device tracking** (1) The Secretary may by order require a manufacturer to adopt a method of tracking a class II or class III device— (A) the failure of which would be reasonably likely to have serious adverse health consequences; or (B) which is— (i) intended to be implanted in the human body for more than one year, or (ii) a life sustaining or life supporting device used outside a device user facility. (2) Any patient receiving a device subject to tracking under paragraph (1) may refuse to release, or refuse permission to release, the patient’s name, address, social security number, or other identifying information for the purpose of tracking. **(f) Unique device identification system** Not later than December 31, 2012, the Secretary shall issue proposed regulations establishing a unique device identification system for medical devices requiring the label of devices to bear a unique identifier, unless the Secretary requires an alternative placement or provides an exception for a particular device or type of device. The unique identifier shall adequately identify the device through distribution and use, and may include information on the lot or serial number. The Secretary shall finalize the proposed regulations not later than 6 months after the close of the comment period and shall implement the final regulations with respect to devices that are implantable, life-saving, or life sustaining not later than 2 years after the regulations are finalized, taking into account patient access to medical devices and therapies. **(g) Reports of removals and corrections** (1) Except as provided in paragraph (2), the Secretary shall by regulation require a manufacturer or importer of a device to report promptly to the Secretary any correction or removal of a device undertaken by such manufacturer or importer if the removal or correction was undertaken— (A) to reduce a risk to health posed by the device, or (B) to remedy a violation of this chapter caused by the device which may present a risk to health. A manufacturer or importer of a device who undertakes a correction or removal of a device which is not required to be reported under this paragraph shall keep a record of such correction or removal. (2) No report of the corrective action or removal of a device may be required under paragraph (1) if a report of the corrective action or removal is required and has been submitted under subsection (a). (3) For purposes of paragraphs (1) and (2), the terms “correction” and “removal” do not include routine servicing. **(h) Inclusion of devices in the postmarket risk identification and analysis system** (1) **In general** (A) *Application to devices* — The Secretary shall amend the procedures established and maintained under clauses (i), (ii), (iii), and (v) of [section 355(k)(3)(C) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title21-section355/k/3/C&num=0&edition=prelim) in order to expand the postmarket risk identification and analysis system established under such section to include and apply to devices. (B) *Exception* — Subclause (II) of clause (i) of [section 355(k)(3)(C) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title21-section355/k/3/C&num=0&edition=prelim) shall not apply to devices. (C) *Clarification* — With respect to devices, the private sector health-related electronic data provided under [section 355(k)(3)(C)(i)(III)(bb) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title21-section355/k/3/C/i/III/bb&num=0&edition=prelim) may include medical device utilization data, health insurance claims data, and procedure and device registries. (2) **Data** — In expanding the system as described in paragraph (1)(A), the Secretary shall use relevant data with respect to devices cleared under [section 360(k) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title21-section360/k&num=0&edition=prelim) or approved under [section 360e of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title21-section360e&num=0&edition=prelim), including claims data, patient survey data, and any other data deemed appropriate by the Secretary. (3) **Stakeholder input** — To help ensure effective implementation of the system as described in paragraph (1) with respect to devices, the Secretary shall engage outside stakeholders in development of the system, and gather information from outside stakeholders regarding the content of an effective sentinel program, through a public hearing, advisory committee meeting, maintenance of a public docket, or other similar public measures. (4) **Voluntary surveys** — Chapter 35 of title 44 shall not apply to the collection of voluntary information from health care providers, such as voluntary surveys or questionnaires, initiated by the Secretary for purposes of postmarket risk identification, mitigation, and analysis for devices. **(i) Postmarket pilot** (1) **In general** — In order to provide timely and reliable information on the safety and effectiveness of devices approved under [section 360e of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title21-section360e&num=0&edition=prelim), cleared under [section 360(k) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title21-section360/k&num=0&edition=prelim), or classified under [section 360c(f)(2) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title21-section360c/f/2&num=0&edition=prelim), including responses to adverse events and malfunctions, and to advance the objectives of part 803 of title 21, Code of Federal Regulations (or successor regulations), and advance the objectives of, and evaluate innovative new methods of compliance with, this section and section 360l of this title, the Secretary shall, within one year of August 18, 2017, initiate one or more pilot projects for voluntary participation by a manufacturer or manufacturers of a device or device type, or continue existing projects, in accordance with paragraph (3), that— (A) are designed to efficiently generate reliable and timely safety and active surveillance data for use by the Secretary or manufacturers of the devices that are involved in the pilot project; (B) inform the development of methods, systems, data criteria, and programs that could be used to support safety and active surveillance activities for devices included or not included in such project; (C) may be designed and conducted in coordination with a comprehensive system for evaluating medical device technology that operates under a governing board with appropriate representation of stakeholders, including patient groups and device manufacturers; (D) use electronic health data including claims data, patient survey data, or any other data, as the Secretary determines appropriate; and (E) prioritize devices and device types that meet one or more of the following criteria: (i) Devices and device types for which the collection and analysis of real world evidence regarding a device’s safety and effectiveness is likely to advance public health. (ii) Devices and device types that are widely used. (iii) Devices and device types, the failure of which has significant health consequences. (iv) Devices and device types for which the Secretary— (I) has received public recommendations in accordance with paragraph (2)(B); and (II) has determined to meet one or more of the criteria under clause (i), (ii), or (iii) and is appropriate for such a pilot project. (2) **Participation** — The Secretary shall establish the conditions and processes— (A) under which a manufacturer of a device may voluntarily participate in a pilot project described in paragraph (1); and (B) for facilitating public recommendations for devices to be prioritized under such a pilot project, including requirements for the data necessary to support such a recommendation. (3) **Continuation of ongoing projects** — The Secretary may continue or expand projects, with respect to providing timely and reliable information on the safety and effectiveness of devices approved under [section 360e of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title21-section360e&num=0&edition=prelim), cleared under [section 360(k) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title21-section360/k&num=0&edition=prelim), or classified under [section 360c(f)(2) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title21-section360c/f/2&num=0&edition=prelim), that are being carried out as of August 18, 2017. The Secretary shall, beginning on such date, take such steps as may be necessary— (A) to ensure such projects meet the requirements of subparagraphs (A) through (E) of paragraph (1); and (B) to increase the voluntary participation in such projects of manufacturers of devices and facilitate public recommendations for any devices prioritized under such a project. (4) **Implementation** (A) *Contracting authority* — The Secretary may carry out a pilot project meeting the criteria specified in subparagraphs (A) through (E) of paragraph (1) or a project continued or expanded under paragraph (3) by entering into contracts, cooperative agreements, grants, or other appropriate agreements with public or private entities that have a significant presence in the United States and meet the following conditions: (i) If such an entity is a component of another organization, the entity and the organization have established an agreement under which appropriate security measures are implemented to maintain the confidentiality and privacy of the data described in paragraph (1)(D) and such agreement ensures that the entity will not make an unauthorized disclosure of such data to the other components of the organization in breach of requirements with respect to confidentiality and privacy of such data established under such security measures. (ii) In the case of the termination or nonrenewal of such a contract, cooperative agreement, grant, or other appropriate agreement, the entity or entities involved shall comply with each of the following: (I) The entity or entities shall continue to comply with the requirements with respect to confidentiality and privacy referred to in clause (i) with respect to all data disclosed to the entity under such an agreement. (II) The entity or entities shall return any data disclosed to such entity pursuant to this subsection and to which it would not otherwise have access or, if returning such data is not practicable, destroy the data. (iii) The entity or entities shall have one or more qualifications with respect to— (I) research, statistical, epidemiologic, or clinical capability and expertise to conduct and complete the activities under this subsection, including the capability and expertise to provide the Secretary access to de-identified data consistent with the requirements of this subsection; (II) an information technology infrastructure to support electronic data and operational standards to provide security for such data, as appropriate; (III) experience with, and expertise on, the development of research on, and surveillance of, device safety and effectiveness using electronic health data; or (IV) such other expertise which the Secretary determines necessary to carry out such a project. (B) *Review of contract in the event of a merger or acquisition* — The Secretary shall review any contract, cooperative agreement, grant, or other appropriate agreement entered into under this paragraph with an entity meeting the conditions specified in subparagraph (A) in the event of a merger or acquisition of the entity in order to ensure that the requirements specified in this subsection will continue to be met. (5) **Compliance with requirements for records or reports on devices** — The participation of a manufacturer in pilot projects under this subsection or a project continued or expanded under paragraph (3) shall not affect the eligibility of such manufacturer to participate in any quarterly reporting program with respect to devices carried out under this section 360i 33 So in original. The section number probably should not appear. or section 360l of this title. The Secretary may determine that, for a specified time period to be determined by the Secretary, a manufacturer’s participation in a pilot project under this subsection or a project continued or expanded under paragraph (3) may meet the applicable requirements of this section or section 360l of this title, if— (A) the project has demonstrated success in capturing relevant adverse event information; and (B) the Secretary has established procedures for making adverse event and safety information collected from such project public, to the extent possible. (6) **Privacy requirements** — With respect to the disclosure of any health information collected through a project conducted under this subsection— (A) individually identifiable health information so collected shall not be disclosed when presenting any information from such project; and (B) any such disclosure shall be made in compliance with regulations issued pursuant to section 264(c) of the Health Insurance Portability and Accountability Act of 1996 ([42 U.S.C. 1320d–2](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320d–2&num=0&edition=prelim) note) and sections 552 and 552a of title 5. (7) **Limitations** — No pilot project under this subsection, or in coordination with the comprehensive system described in paragraph (1)(C), may allow for an entity participating in such project, other than the Secretary, to make determinations of safety or effectiveness, or substantial equivalence, for purposes of this chapter. (8) **Other projects required to comply** — Paragraphs (1)(B), (4)(A)(i), (4)(A)(ii), (5), (6), and (7) shall apply with respect to any pilot project undertaken in coordination with the comprehensive system described in paragraph (1)(C) that relates to the use of real world evidence for devices in the same manner and to the same extent as such paragraphs apply with respect to pilot projects conducted under this subsection. (9) **Report to Congress** — Not later than 18 months after August 18, 2017, and annually thereafter, the Secretary shall submit to the Committee on Energy and Commerce of the House of Representatives and the Committee on Health, Education, Labor and Pensions of the Senate a report containing a description of the pilot projects being conducted under this subsection and projects continued or expanded pursuant to paragraph (3), including for each such project— (A) how the project is being implemented in accordance with paragraph (4), including how such project is being implemented through a contract, cooperative agreement, grant, or other appropriate agreement, if applicable; (B) the number of manufacturers that have agreed to participate in such project; (C) the data sources used to conduct such project; (D) the devices or device categories involved in such project; (E) the number of patients involved in such project; and (F) the findings of the project in relation to device safety, including adverse events, malfunctions, and other safety information. (10) **Sunset** — The Secretary may not carry out a pilot project initiated by the Secretary under this subsection after October 1, 2022.