Summary
This SOP outlines the procedure for managing serious incidents and field safety corrective actions (FSCA), as well as the reporting obligations to relevant authorities.
| Process Owner | \ |
| Key Performance Indicators | \ |
Regulatory references:
| EU Regulation 2017/745 (MDR) | Art. 87 – 92 (Vigilance) |
| ISO 13485:2016 | Para. 8.2.3 |
For further guidance, refer to MDCG 2023-3 and MEDDEV 2.12./1. As a manufacturer in Germany, national regulations must be adhered to, including the transition from the Medizinproduktegesetz (MPG) to the Medizinprodukte-Durchführungsgesetz (MPDG) and the replacement of the Medizinprodukte-Sicherheitsplanverordnung (MPSV) with the Medizinprodukte-EU-Anpassungsverordnung (MPEUAnpV).
General Considerations
Reportable Serious Incident
An incident is defined as any malfunction or deterioration of a device’s characteristics or performance available on the market, including use errors due to design flaws and inadequacies in provided information or unintended side effects.
Any incident is reportable if it involves one of our medical devices and meets the criteria for a serious incident as outlined in this procedure. Potentially serious incidents are evaluated using the designated incident assessment template [reference document ID here].
A serious incident is defined as “a subset of incidents that directly or indirectly resulted, might have resulted, or could result in death or serious deterioration in health, or poses a significant public health risk.” (Refer to MDR Art. 2 and MDCG 2023-03). Examples include:
- Device malfunction (e.g., software issue)
- Incorrect labeling, instructions, or promotional materials
- Usability flaws leading to misuse
Serious deterioration in health includes:
- Life-threatening injury or illness
- Permanent impairment of a body part or function
- Hospitalization or extended hospitalization, or a condition requiring medical or surgical intervention to prevent serious outcomes
- Chronic disease
- Indirect harm from incorrect diagnostic results when the device is used according to manufacturer instructions
Note: Incidents do not always result in death or serious health impacts. If an incident occurred that could have led to such outcomes under different circumstances (e.g., without medical intervention), it is still considered reportable.
Field Safety Corrective Action (FSCA)
An FSCA refers to any action taken to minimize the risk of death or severe health decline linked to a device already on the market. FSCA measures, whether addressing direct or indirect harm, must be reported through a field safety notice. Potential FSCAs include:
- Device recall
- Modifications, such as design updates (e.g., software changes), permanent or temporary labeling updates, or making the device temporarily unavailable (e.g., software lock)
- Manufacturer-provided guidance on device use
Reporting Timeframes
- In cases of imminent danger: Immediately (without unjustifiable delay)
- In cases of serious public health risk: Immediately, no later than 2 calendar days from awareness.
- Death or serious health deterioration: Immediately upon suspected causal link, no later than 10 calendar days from awareness.
- Other reportable incidents: Immediately once a causal link is suspected or confirmed, no later than 15 calendar days from awareness.
- FSCA actions: Immediately at the start of implementation, except for urgent cases where immediate action is necessary.
All timelines refer to the initial notification to the national authority. If uncertainty arises regarding reportability, the incident should be reported within these timeframes.
Responsible Authorities
Incidents must be reported to the relevant national authority in the country where the incident occurred:
Germany:
* Federal Institute for Drugs and Medical Devices (BfArM)
* Website: www.bfarm.de
* Email: [email protected]; Phone: +49 228 207 5355
* Reporting via “MIR Formular”
Spain:
* Spanish Agency for Drugs and Medical Products (AEMPS)
* Website: www.aemps.gob.es
* Email: [email protected]
* Phone: +34918225274
Netherlands:
* CIBG-Farmatec
* Website: www.igj.nl
* Email: [email protected]
Poland:
* Office for the Registration of Medical Products (URPLWMiPB)
* Website: www.urpl.gov.pl/en
* Email: [email protected]
* Phone: +48 22 492 11 90
Other national authorities: More contact information is available on the European Commission’s website: link
FSCAs must be reported to the relevant authorities of the countries where the FSCA is executed, including cases outside the European Economic Area (EEA) if they result in recalls in European countries.
In addition to reporting to the national authorities, our Notified Body must be notified where applicable, as per the conformity assessment procedure.
Process Steps
1. Documentation and Immediate Action
Employees who become aware of an event impacting health must notify the Person Responsible for Regulatory Compliance (PRRC) to initiate the process. Input can also come through various channels (e.g., post-market surveillance).
- Sources may include:
- Internal staff
- Device users (e.g., feedback, feedback management process)
- Authorities (e.g., notification of serious incidents)
- Post-market surveillance (e.g., related events triggering an FSCA)
Initially, the PRRC opens a CAPA to document the incident. Immediate action, such as an FSCA, is initiated as necessary per the CAPA process.
| Participants | Person Responsible for Regulatory Compliance (PRRC) |
| Input | Event with a potential health impact |
| Output | Documented incident and immediate action, if necessary |
2. Investigation of Causal Relationship
The PRRC investigates the root cause to confirm if the incident is related to the device. The findings are documented in the CAPA.
If no causal relationship exists, the event is not reportable. However, the PRRC evaluates if FSCA is warranted to prevent future reportable incidents.
| Participants | Person Responsible for Regulatory Compliance (PRRC) |
| Input | Documented incident |
| Output | Documented analysis of causal relationship |
3. Incident Report Evaluation
If a causal relationship is confirmed, the PRRC assesses if the incident qualifies as a reportable serious incident using the incident assessment form. Events in doubt are reported as serious incidents.
If deemed non-reportable, the reason must be documented in the assessment form, and the incident is recorded in the QMS for future reference.
| Participants | Person Responsible for Regulatory Compliance (PRRC) |
| Input | Documented incident and causal analysis |
| Output | Reportable incident evaluation documented |
4. Reporting to Authorities
Within the specified timeframe, the PRRC reports the event to the relevant national authority using the required forms. The Manufacturer Incident Report (MIR) is prepared as per the European Commission’s guidelines: link. The report may be shared with the Notified Body as applicable.
Authorities should be notified about:
* Serious incidents involving the organization’s devices
* FSCAs initiated by the organization
* Notable increases in non-serious incidents or side effects impacting the device’s benefit-risk profile (Art. 88 MDR and SOP Post-Market Surveillance)
| Participants | Person Responsible for Regulatory Compliance (PRRC) |
| Input | Incident evaluation completed |
| Output | Reporting completed to authorities and Notified Body |
5. Initiating FSCA
Based on a risk and cause analysis, the PRRC decides whether an FSCA is necessary to mitigate risks or prevent reportable incidents. Actions are documented and communicated via a field safety notice (FSN) to affected users.
The FSN should include:
* Subject: Safety Alert
* Manufacturer contact details
* Identification of affected devices (e.g., device name, software version)
* Description of the incident and rationale for FSCA
* Recommended actions for users, if applicable
The FSN is stored, and confirmation of receipt and action implementation are obtained from customers. Unresponsive customers require at least three delivery attempts. This is documented in the CAPA process.
For B2B customers, contact details for vigilance must be documented in the Medical Devices List. B2C customer information must be recorded for each device to enable unique identification.
All FSCAs must be reported as described in para. 4 and documented in the CAPA.
Note: Consider having a separate process for non-conforming product handling, which would include product-specific labeling instructions and employee handling guidelines.
| Participants | Person Responsible for Regulatory Compliance (PRRC) |
| Input | Incident-related risks |
| Output | Implemented FSCA and FSCA reporting to authorities |
6. Verification and Evaluation of Effectiveness
The effectiveness of FSCAs is assessed during the CAPA process. A final report is submitted to authorities once the CAPA