Results of FDA Pilot Activities To Explore Opportunities and Challenges With the Implementation of a Unique Device Identifier System
Table of Contents
- Labeler Organization Objectives
- FDA Internal User Objectives
- Results: Labeler Organizations
- Labeler Organization Feedback on Specific UDI Issues
- Linking Number Possibilities.
- Problematic Attributes.
- Definitional Understanding for Obtaining a New UDI.
- Capturing Device Information Across Packaging Levels.
- Additional Labeler Feedback by Email.
- Written Feedback on Expected Volume of UDIs and Expected Frequency of Changes to a UDI.
- Labeler Organization Feedback on Software in Medical Devices
- Written Feedback from Labelers.
- Labeler Teleconference Feedback on Software Issues.
- Providing UDI Data for the Revised UDI Prototype Database
- Labeling Organization Test of User Permissions
- Labeler Organization Feedback on Specific UDI Issues
- Results: FDA Internal Pilot Activities
- TPLC and Using UDI to Integrate FDA Databases
- Introducing UDI into OIVD Processes
- Simulating the UDI Database for This Pilot Activity.
- Experience Submitting the CLIA Add-to File
- Simulating Adverse Event Reporting
- Issues Related to Device Grouping Systems
- Recommendations and Follow-Up
- Labeling Organizations
- FDA Internal Processes
- Appendix A. Instruction Sheet for January 2010 Informal Feedback Sessions with Labeling Organizations
- Appendix B. Information Sheet for Labelers on Software-related Considerations in UDI: Informal Feedback to FDA
- Appendix C. UDID Data Elements from Revised UDI Prototype Database
Table of Figures
- Table 1. Labeler Organization Written Responses: Approximately how many total devices do you have in your product catalogue?
- Table 2. Labeler Organization Written Responses: How many UDIs do you estimate this will require to represent?
- Table 3. Labeler Organization Written Responses: Please estimate the percentages for each type of device in your catalogue.
- Table 4. Labeler Organization Written Responses: How often do you expect to have changes to products that will require making device edits or device additions to the UDI system?
- Table 5. Percent of Labeling Organization Products Which Include Software
- Table 6. Manufacturers’ Processes for Tracking Software in Products
- Table 7. Labeling Organization Processes for Software Updating
- Table 8. Labeling Organization Written Responses: From a UDI and software perspective, are there any holes/issues with the summary? If so, what are they?
- Table 9. Labeling Organization Written Responses: How would you propose to handle the situation described in 3 above (new software makes “new” device)?
- Table 10. Additional Written Feedback: Are there any other UDI-software issues that you have identified? Please list them and provide an example, if possible.
- Table 11. Written Feedback: Issues/Comments on Specific User Roles
- Table 12. Written Feedback: Comments on Data Elements
- Table 13. Rating of Labelers’ GMDN Correctness in Data from August 2009 UDI Prototype Database
- Table 14. Example of Correct GMDN Information for a UDI Record (from August 2009 database)
The various UDI pilot activities involved team members from various FDA CDRH offices, Social & Scientific Systems, and a variety of organizations concerned with medical devices.
We thank them all for their interest, involvement, and participation to help ensure FDA’s ability to be ready for and responsive to the changes expected once the UDI system is implemented.
AI letter - Additional information letter
BD - Becton, Dickinson and company
CAPA - Corrective and Preventive Action
CARS - CDRH Ad hoc Reporting System
CDRH - Center for Devices and Radiological Health
CLIA - Clinical Laboratory Improvement Amendment
CoO - Country of Origin
FACTS - Field Accomplishments and Compliance Tracking System
FDA - Food and Drug Administration
FEI - FDA Establishment Identifier
FURLS - FDA Electronic Registration and Listing System
GHTF - Global Harmonization Task Force
GMDN - Global Medical Device Nomenclature
GTIN - Global Trade Item Number
HIT - Health Information Technology
IDE - Investigational Device Exemption
LIC - Labeler Identification Code
MAUDE - Manufacturer and User Device Experience
MDD - Medical Devices Directive
MDR - Medical Device Reporting
OC - Office of Compliance
OIVD - Office of In Vitro Diagnostic Device Evaluation and Safety
ORA - Office of Regulatory Affairs
PMA - Premarket Approval
QSR - Quality System Regulation
R&L - Registration and Listing
RECS - Recalls (CDRH database)
RES - Recall Enterprise System (ORA database)
RFID - Radio-Frequency Identification
SKU - Stock Keeping Unit
SOP - Standard Operating Procedure
SSS - Social & Scientific Systems, Inc.
TPLC - Total Product Lifecycle
TurboEIR - Application for the Establishment Inspection Report (EIR)
UDI - Unique Device Identification
UDID - Unique Device Identifier database
For the past 2 years, FDA has been proactively exploring requirements and needs for implementation of a Unique Device Identification (UDI) system. In 2010, FDA has focused UDI pilot activity efforts to work through and gather information on the business processes for those stakeholders (labeling organizations, FDA internal users, and a variety of end users across the general public) that will be part of the UDI database business processes (submission, receipt, and analysis and use of data). This feedback and review has helped identify issues and, where possible, answered questions related to stakeholders’ populating and using the UDI database (UDID) to improve the identification of device information and ultimately to improve the safe and effective use of the identified medical devices.
The pilot activities focused on different aspects of UDI information use and business processes, as described below in the objectives categorized by the various stakeholders.
Labeler Organization Objective
Pilot activities on the labeler organization side focused on identifying and understanding potential and actual issues that would arise for labelers implementing UDI. Labeler organizations volunteered to provide informal feedback on various situations which would arise for them in complying with the regulation.
- Their ability to comply with requirements to provide UDI information to the UDI database using a revised prototype UDID containing the draft revised list of UDI database attributes which reflect the harmonization of efforts of FDA with the Global Harmonization Task Force (GHTF)
- Simulating user permission processes required by labeler organization business units and other organizations for UDI database access (user registration for entering and submitting data as well as for modifying records)
- Provision of feedback from labelers on:
- Expected labeling-organization use of the UDI database
- User permissions needed within labeling organizations to be able to populate the UDI database
- Software-related issues in medical devices
FDA Internal User Objectives
Two pilot activities were conducted within FDA to explore the way in which business processes would need changing to integrate the inclusion of UDI information.
- Integration of UDI with device data used throughout FDA’s Total Product Lifecycle (TPLC):
- Identification of the issues, opportunities and challenges for the integration of UDI into various Center databases and regulatory processes when UDI comes on line in late 2011.
- Introduction of UDI into OIVD Processes:
- Introduction of the UDI into a CRDH office, the Office of In Vitro Diagnostic Device Evaluation and Safety (OIVD), where premarket and postmarket processes were already integrated and were using electronic submissions/processes to identify process changes for incorporating and integrating a device’s UDI number into FDA’s existing business processes -- such as add-to files, 510(k)s, MDRs (Medical Device Report), and recalls -- from a variety of perspectives (manufacturer, user, FDA).
The methods used for each pilot activity were generally either simulation/practical exercises or feedback sessions around one or more UDI-related topics. Key participants included FDA staff, staff from labeling organizations which volunteered to provide informal feedback, and select staff working on FDA contracts. More details and documentation about the implementation of each pilot activity are on file with FDA and SSS.
Labeler Organization Feedback on Specific UDI Issues
The 2009 pilot test of the prototype UDI database identified various issues for which FDA wanted more information from representatives from labeling organizations. A variety of labeling organizations volunteered to participate in various informal teleconference feedback sessions. They were given several questions ahead of time to be addressed in the feedback sessions, and a few labeling organizations returned written responses before the feedback sessions.
The first set of sessions focused on questions for understanding at a detailed level how labeling organizations associate a UDI to other systems (FDA, company level). (See Appendix A, Instruction Sheet for January 2010 Informal Feedback Sessions with Labeling Organizations.)
Linking Number Possibilities. One issue that had surfaced previously was labeling organization concern with what identifier would be used to link the UDI data to existing FDA information. For this feedback activity, FDA queried about which identifier to use (listing number or premarket submission number for non-exempt and procode for exempt devices)
- “We would prefer the identification of the product by the product listing number. In our opinion point b. and c. [premarket submission number for non-exempt and procode for exempt] are too general.”
- “We are unclear what the suggested information will be used for. Will the listing or premarket submission number be included as an attribute in a UDI database or will this information be used for other purposes? We could provide either the listing number. We have concerns about providing either the listing or premarket submission numbers in a public database due to potential for gray market activity.”
- “After learning more about FDA's need to associate UDI with existing product identification processes and listings, we agree with the idea of linking UDI to the Listing Number. With the explanation and understanding that the Listing Number will not be shared through public data bases (to prevent unauthorized uses, diversion, unapproved imports...), linking the UDI via the Listing Number is a logical step.”
- “For products with multiple packaging levels, utilizing all the associated GTINs or HIBCC LIC numbers for each level of packaging for a specific Listing Number may make sense.”
- “Exempt products may need to utilize the Procode. Although the point was not fully resolved on the call, we wanted to reiterate that there [sic] are situations that result in multiple 510(k) assignments for an individual product.”
- The clarification that listing number relationship to UDI will be kept confidential is important. Otherwise proprietary information on sources for all contract manufacture would be compromised.”
Teleconference feedback. In the teleconference feedback sessions (attended by 15 different labeling organizations), FDA clarified that, with each UDID submission, the UDI and another number that is already in an FDA database would be used to validate that the device is an FDA-regulated product. The summary of the discussion was that the listing number would be useful as long as concerns that labeling organizations have about keeping that information private are addressed. Consensus was that none of the three options (listing number or premarket submission number for non-exempt and procode for exempt) would offer perfect matching capabilities. For some labeling organizations, listing number may not be available centrally (requiring more effort to obtain, but they could do it), and some older products may not have it.
Problematic Attributes. FDA wanted feedback from both large and small labeling organizations on which attributes in the revised data element list described above would be the most problematic for them. All feedback on this topic was in teleconferences sessions only. The general teleconference discussion did not identify any particular attribute as being problematic across the majority of labeling organizations except for one organization which said that the assignment of model numbers and lot numbers is problematic. (“These are often done manually and are therefore not identifiable by an automated process.”) The consensus was that several attributes are better captured in a product description field because there are multiple aspects to the attrib utes.
More discussion was focused on some of the particular attributes. The consensus was that information on Allergens as well as Storage conditions, Sterility, and Restricted Number of Uses are often only on the product labeling. These data are not stored in an easy-to-obtain, discrete form. The labelers further specified that latex information is on the labeling, and most organizations keep that restriction in a centralized database. Information about other allergens is more problematic as that is often only in the labeling.
In discussion on the Size attribute, labeling organizations wanted to clarify that this attribute is capturing the size of the device, not of the packaging. The size attribute is seen as a problem because it is so varied and choices are very product-specific. They would like to see size specified as part of a descriptive field because there are multiple aspects.
When FDA raised the topic of the Global Medical Device Nomenclature (GMDN) attribute, organizations stated that GMDN is not used by all labeling organizations. At this point, the GMDN codes are still changing and that makes maintenance difficult. In addition, different countries have different codes for the same product.
Definitional Understanding for Obtaining a New UDI. FDA was also interested in labeling organizations’ perspectives on and experience with when they would need to get a new UDI and what would trigger this (e.g., if models or products change). Again, all feedback on this topic was in teleconferences sessions only.
In the teleconference discussions, perspectives and experience varied. One organization bases their decision to change on GTIN allocation rules on packaging where a change in the GTIN would imply a change in UDI. In that situation, if a catalog number or reorder number changes, the UDI would change.
Another organization described the lack of standard definitions. Thus, they change numbers whenever they change the country of origin. In the US, that organization is required to list the country of origin (where it is manufactured) on the label, but this regulatory requirement does not apply in Europe.
There was consensus that the decision on obtaining a new UDI will be difficult for them to decide in some cases. Labelers also feel that it will be difficult for organizations to keep track of and identify the trail of previous UDI designations for similar devices.
Capturing Device Information across Packaging Levels. FDA is interested in capturing UDI information at the level of unit of use but also needs to be able to identify a UDI across multiple packaging levels. Current business rules do not account for different packaging, so FDA may receive adverse event reports with different UDIs for the same device because of differences in the packaging and unit of use. FDA needs to be able to relate the several different UDIs that encompass the same product.
Written responses. Responses to the question What is the best solution for generating a UDI at the unit of use when there are multiple packaging levels? included:
- “In the dental industry the placement of the UDI on the primary package is impossible due to the small size of some containers.”
- “Proper assignment of UDIs (GTINs) will enable ‘nested visibility’ to UDI regardless of whether the UDI is added to the actual unit of use. It is clear that not all devices can have (due to space limitations) or should have (due to product risk and usage) UDIs on the unit of use packaging. Therefore, we propose an approach that maximizes the availability and traceability of the UDIs for those products.”
- “The best solution for ensuring that UDIs are traceable down to the individual level of packaging is when there are multiple levels of packaging from which the product is dispensed that contain the UDI. The adoption of the following rules would allow the useful implementation of UDIs.
- Assign GTINs for every level of packaging
- Share GTIN data for every level of packaging
- Print GTINs on the Case and Shelf Pack for all products
- Print GTINs on the each level package when it fits on the package and adds value to the clinical process
- Utilize a “virtual GTIN” in IT systems for products that are removed from their Shelf Pack and do not have GTIN printed on the each level package.”
- “Need to define ‘capture’. Mandating unit-of-use labeling to capture UDI is impractical to the point of effective economic impossibility for commodity disposables and other low value products. Hospitals sometimes re-label to unit of use, but they are not registered as relabelers or repackagers. Even they do not routinely label commodity disposables to the unit of use. Moving healthcare to alternate sites is arguably more cost-effective. Alternate site providers do not have the capability to repack or relabel to unit of use.”
Teleconference feedback. The summary/consensus from the feedback teleconferences on the packaging issue was:
- There is no standard way of designating packaging differences of the same product. There are no standards in place for defining parent-child and packaging levels. Different suppliers use different techniques.
- A single solution to cover all devices/packaging/units of use will not be easy. For many products, it could be relatively easy if the labeler constructs the UDI number with a syntax that allows the general device description as the main part and adds unit of use and packaging in additional part(s) of the number.
- The GTIN/GS1 standard might work, but it is not required and is used differently by different suppliers. There can be many parent GTINs for one child and conversely, many child GTINs for one parent.
- It is possible that some DoD experience would be useful here.
Additional Labeler Feedback by Email. Some labeling organizations provided additional written information on concerns their organizations had about UDI data submission requirements that they felt were not adequately addressed. Below are the verbatim written responses from different organizations.
- “Getting bar codes on small unit of use (e.g., capsule, syringe, vial, tube, cartridge) is very problematic and expensive. In this case we would have to install on each of our filling machines/devices new inline barcode-printer (dependent of packing material) and barcode-scanner. Some of those product packages (e.g., capsules) are too small for barcodes (even too small for Lot-No. + Expiry-Date)
- Product packaging and selling unit (e.g., folding box, pouch, etc.) will have different Item-No.
- How to handle kits comprised of products with various barcodes”
- Org 2
- “Cost of implementing a system is a major concern. Adding UDI to packages, equipment to record and recording are added costs. To maintain margins, industry must either gain efficiencies or pass along the added costs.
- Distributors must require contract manufacturers to add UDI to private label products, add equipment and record just as manufacturers must. Contract manufacturer’s brand products would carry UDI of person introducing into commerce. This parallels MDD [Medical Device Directive] requirements.
- Manufacturers generally ship large quantities to each destination. Alternate site distributors ship small quantities to many sites. Alternate site healthcare provides cost reductions by moving procedures out of hospitals. Any disproportionate increases (in) alternate care costs thwart some efforts to ‘bend the healthcare cost curve downward.”
- Org 3
- “Opportunities in the supply chain related to potential cost savings have not been adequately studied and publicized.
- Participation in the recently announced GS-1/RAND study is cost-prohibitive for distributors and small suppliers in the current economic environment.
- UDI impact on dental laboratories and other custom devices are not yet clear to some in industry. Labs making custom products under DDS direction are not registered as manufacturers. Some DDS still have their own lab in the practice.”
- “Capturing item-level serialization at shipment adds a significant step in any pick and pack process. Validations of processes are required.
- It is unclear whether RFID [radio-frequency identification] will be used by a substantial segment of the industry. Assuming RFID will be used by some, distribution will have to equip lines to deal with both RFID and barcodes. The current generation of imagers has the capability to read either linear or 2D barcodes. Most do not also read RFID. RFID has issues which must be overcome.
- Pharma pedigree system, UDI and other systems should be interoperable worldwide.
- No added state or federal labeling or track and trace requirements should be imposed once the UDI is in place.
- Has there been coordination with Department of Commerce and international counterparts to insure that import clearance requirements are covered by UDI? This, to avoid unnecessary added requirements. For import clearance and Certificate of Free Sale which more countries are requiring, FDA requires procode and listing number (or 510(K) if assigned).”
- Org 5
- “UDI structure should allow marketing of the same labeling in US and elsewhere. While FDA and GHTF are attempting to harmonize requirements, interpretations in various jurisdictions may be different.
- UDI impact on software sold separately, software revisions in devices, kits, repairs and spare parts are concerns.”
- Would be helpful for FDA to advise industry how the information in the database will be used. Also, UDI relationship to Sentinel.
- GS-1 initial and annual registration costs are high. GS-1 fees for participation in groups advising on building the systems are so high as to preclude inclusion of all but very large, high margin companies. Industry needs to have clear definition of all added charges by geographic region or for additional blocks of UDI numbers.”
Another topic of interest to FDA was the volume of UDIs that a labeling organization will have and the expected frequency of changes that the organization would need to make in the UDI database after the UDID system is implemented. This feedback was requested in writing. Table 1 shows that, across seven labeling organizations, there is a wide range of responses about how many devices they have in their product catalogue - from 20 to 120,000.
|120K Active SKUs||9,000||< 5000 products may translate into ~15000 GTINs||Approximately 30,000 SKUs||~1850||20||12,769|
In Table 2, we show their responses about the number of UDIs that they will need to represent their product catalogue. In some cases, labelers felt the number would be the same as the number of devices. In other cases, the number has increased a bit (from 12,769 to 15,687) or a lot (from 9,000 to more than 250,000).
~ 250k - 1M/yr
(It's hard to estimate this number within the given timeframe as we'd have to go to the various ~60 Product P&Ls1 for this information.)
It depends on whether instrument spare parts require a UDI. It could be all, or a subset.
Not sure how UDI will be used.
1 P&L = this organization’s business unit
We asked labelers to estimate the breakdown of their product catalogue by class of device. Table 3 shows the responses for the seven organizations. Class I is generally thought to be the largest percentage of devices overall, estimated at more than 50% of medical devices in the US. The table below, though, shows that the several organizations have very different profiles. Most have a low percentage of class I devices except for two whose product catalogues encompass 65% and 95%, respectively. Most of the seven organizations have more than 50% of their catalogues made up of class II devices with only two organizations for which they form a very small proportion of the content (15% and 5%, respectively). Class III devices are generally a small percent of the total number of medical devices. Among the seven labeling organizations, most have 10% or less (ranging 0-10%), with two organizations for which class II devices form 20% and 35% of their catalogues.
|Device Class||Labeler Organization|
We also asked labelers to estimate the expected frequency of changes they would have to make to the UDID system (new device records or updating existing device records) because of product changes. Table 4 below summarizes their responses. Almost all had an overall comment on the question, which is shown next to the letter designation for the organization. Half of those responding made an estimate of both the expected frequency of updates to existing device records as well as volume of new device UDIs that would need to be added. Responses ranged from very infrequent to very frequent changes for a varied number of devices.
Two organizations responded with only general comments:
- Org A: “ We create on average 100 GTINs or SKUs a day. This number increases when we have new product launches to the market.”
- Org E: “ Once products are loaded into the database, it’s not expected that there will be many changes. When a new product launches, it could be a handful of UDIs, or if the product is an instrument system, and spare parts are entered as separate UDIs, it could be several hundred.”
Org B gave a qualitative response - the same for both of the categories shown in Table 4 below:
- “# TBD - once a long-term solution is in place, we would anticipate making weekly updates to the UDI”
- “# TBD - initially, we believe we can support monthly updates to the UDI”
|Labeler Organization |
|Expected Number of Changes |
to Existing Device Records
|Expected Number of |
New Devices to Add
|Org C: Here's our information below. Please note its all pretty rough estimates. If you're looking for solid numbers we'd need a few weeks to get back to you. We are currently in process of defining our GTIN allocation rules; the outcome of that process will drive the number of expected device models up or slightly down possibly.||~4 (~200/yr)||< 5 changes|
|Org D: * Depends on the final attributes in the database||10-25*||50 - 100*||150-300*||3-7*||15 - 30*||45-100*|
|Org F: I don’t know why I would change any records, or when changes would be necessary, so I really don’t know how to answer this. We add new class 1 products at a rate of 2 per year, but usually they are subtle variations from existing products [no new 510(k)], so I’m not sure how to answer this. Changes may not occur for years.||5||20||60||1||3||18|
Labeler Organization Feedback on Software in Medical Devices
Written Feedback from Labelers. There has been much interest in and need to discuss the issue of medical devices in which software is incorporated. We gathered feedback specifically on this topic, both through written responses to questions and through teleconference sessions.
Labeling organizations were asked to provide written information about the use of software in the medical devices which they manufacture prior to taking part in the software-related feedback sessions. Five responded to the question, What % of products that your company develops contain software?, with a very wide range of responses about the presence of software in medical devices, as shown in the table below.
|Org A||Approximately 20%|
|Org D||Less than 1%|
|Org E||This is very small as long as Software is defined as not being Firmware. If firmware is included in the Software definition, then many of our products contain Firmware (Software). Note: We also have software products that are not contained within any products. These software products are either intended for direct use within a customer’s network database environment or are internally implemented directly with a customer interface.|
|Org F||< 5% of items|
Five manufacturers responded to the question, Is the software in your company’s products developed in house? Two answered yes and three added details:
- “Our company’s software is developed in both ways – some is developed in-house and some with the use of consultants.”
- “Both internally and externally.”
- “Org F typically develops its own software.”
FDA was interested in the ways that manufacturers track software in different products. As shown in the next table, they have varied but quite similar internal processes.
|Org A||Via end-item number, lot number and software version.|
|Org C||Software is part of the Device Master Record, and has a part number identification and revision|
|Org D||Software version is linked to both product code and individual serial numbers, i.e., we can find from the DHR what software and version went with what product.|
|Org F||Each device which contains software has a serial number. The device configurations, including any changes, are tracked in the device service file, specific to that serial number.|
As shown in Table 7, labeling organizations also responded to a question on software updating: “How does your company plan for software updates and ad hoc responses (scheduled updates, emergency patches such as security issues, viruses, etc.)?”
|Org A||We have a software development process which is applied to all changes, whether planned or unplanned.|
|Org C||Change Control of revision level|
|Org D||Software development has to comply with the software life cycle development requirements.|
|Org E||Project plans, Design History Files and cross-functional teams are developed and maintained for all software product updates. Regulatory assessments and submissions occur as needed for all software products. Business development plans drive most scheduled updates. Issue tracking systems drive the need for updates that are not included in the business development plans.|
|Org F||All of our devices are machine software based, and do not depend on a third party operating system. The software is programmed into chips in the unit. As such, the user can not access or update the code. With this type of software, security issues and viruses are not a concern. Updates of any type would be handled via routine service activities. If an urgent program change was required, we would likely contract with a third-party to go to the hospitals that have the units and perform a software update.|
FDA had prepared a summary of software-related considerations in UDI that was shared with the manufacturers for feedback (See Appendix B). The document identified two categories of software in UDI [software as health information technology (HIT) and software as a component of a finished device] and two relevant situations [changes (revisions) made before the device goes on the market and changes made after the device is on the market].
Tables 8, 9, and 10 which follow show the written responses to these 3 questions:
- From a UDI and software perspective, are there any holes/issues with the summary? If so, what are they?
- How would you propose to handle the situation described in 3 above (new software makes “new” device)?
- Are there any other UDI-software issues that you have identified? Please list them and provide an example, if possible.
|Org A||-Does the end-item number (e.g., catalog number) have to be changed when the UDI is changed? If so, the assumption in point 3 that new functionality equals a new UDI will be problematic. Not every change in functionality would necessitate an end-item number to change. -Additionally, it is important to stress that many countries link product registrations with specific end-item numbers. If the end-item number changes, sponsors are required to submit a new product registration, and wait for approval (up to 2 years in certain countries, such as China) before marketing the upgraded device.|
|Org C||Our software is a part of our device and is not sold separately. So the device identification is not a relevant issue.|
|Org D||No issues, the UDI should not change as long as the device falls within the boundaries of the corresponding UDI description|
|Org F||The rule should help provide clear guidelines that distinguish between minor repairs and revisions. |
There should also be some clarification regarding the definition of software. It may not make sense to have the “software” rules apply to the types of software that are integral to the workings of the device but cannot be transferred to another device. For example, our digital predictive thermometers rely on complex software. That software cannot be separated from the device without rendering the device itself inoperable. It should not require a separate unique identifier as it cannot reasonably be separated itself from the device and the device would already have an identifier (including a serial number). Any action (such as a recall) would be no more effective with a requirement for this type of software to have an additional identifier.
|Org A||Not all changes in functionality are identical, and I am not certain that we should accept the conclusion that ‘a change in functionality MUST require [sic] a new UDI’.|
|Org C||If software were sold separately as a new device, it would be classified under a Classification Name and Product Code. Software in some countries is considered to be classified based on invasiveness and the fact it is always part of an “active device” (e.g., powered by electricity). I think the FDA would have to look at software sold separately as its own product code. Example Classification Name: Dental X-Ray Diagnostic Software – A stand-alone software product that is loaded onto a computer, which is used to enhance input from a dental x-ray, for the purpose of enhancing x-ray images of tooth structure in order to improve dental diagnosis or as an aid in instrumentation a root canal. Software is not a device, unless sold separately for use with other manufacturer’s hardware.|
|Org D||If a new functionality falls under a new UDI, otherwise remains the same UDI.|
|Org F||We should clearly define the difference between software that is sold on its own and software that is an integral part of the item. If there is a product where the software is intended for use on a variety of different platforms, it will likely be sold or marketed as an unique item. Therefore, it should have its own unique device identifier. If there is a platform device that can host a wide variety of software, there may be an optional need for unique identifiers. If the software itself cannot be divorced from the product without rendering the product inoperable, it may make more sense to consider the device/software combination as if it were an unified whole. Any action (such as a recall) could be based on the platform device’s unique identifier since it would, by definition, also include the software.|
|Org A||Software upgrades performed prior to the device leaving the manufacturer are tracked within the device history record. Software upgrades performed in the field are typically tracked in a service and repair database. It is possible/likely that these two systems are not electronically linked.|
|Org D||Have not seen any UDIs, no comment at this time.|
|Org F||Software may be common to devices which are different in other ways, and thus have differing UDIs. For example two device models set to operate with differing power mains connections, but are otherwise identical. Software should only influence the assignment of the UDI when there is a direct link to a different intended use.|
Labeler Teleconference Feedback on Software Issues. Nine labeling organizations participated in the teleconference feedback sessions, which focused primarily on the definition for software in devices, dealing with version changes, and UDI labeling issues.
FDA initiated the sessions, summarizing that, if the software cannot be separated from the device, then it should not have a separate UDI. The concept of where the UDI resides is important. If the software/firmware is not separate, then it is just like the power supply or motor of a device – it can’t be separated.
One labeler raised a basic question about what is software and described differences between software and firmware, identifying the latter as a different entity although they are closely related but are handled differently. He summarized these as:
- Firmware is created and embedded; it is usually “controlling” software.
- Software is usually seen as “user interface” based. It is more regularly modifiable and modified. Firmware can be updated with software.
This same labeler stated that they wouldn’t change the UDI even if they change the firmware because the device is implanted. When they change the software that changes the firmware, they have the model number and the version number to indicate the version.
Tracking Version Changes. What FDA has heard is that software is a little different because it tends to be updated frequently. For example, there may be infusion pumps with different software versions, so FDA was interested to know what could be done about that issue. FDA wants to be able to identify a device with various software versions (e.g., the same device with the same serial number but with a different version of software). One labeler described a system internal to their processes that knows which device has which version of which software. The representative also acknowledged the difficulty for FDA to be able to obtain this information, which is maintained in a company’s internal records.
Another labeler clarified that when the software changed and thus how the device was used is changed, and what the user sees changes, they will assign a new number to it [the device] because they track the product separately. This is based on their practice that, if the instructions on use change, the device gets a new product number.
Software tends to be significantly different from other device issues in that it may be changed outside of the labeler. FDA is also concerned about what happens when the software gets changed in the healthcare setting, such as by a biomedical engineer at a hospital. In this case, then, the software is updated outside of the manufacturing facility so that the manufacturer loses track of which device serial number is linked to what software.
Only one labeler responded to the FDA’s question on how to track changes in the hardware or the software or both. That labeler mentioned that software updates can happen (be pushed out from manufacturers) via computer networks within the hospitals.
Location for a UDI “label.” Only a couple of labelers had any ideas for FDA’s request about ways to put a physical label on software or indicate a UDI for that.
- One labeler suggested that, if there is a user interface with the software, it could be put there. He also cautioned that some software might be used for many products/devices so there could be the same software across multiple products.
- Another labeler said there are choices of where to store the UDI: in the startup screens (or other user-interface location), in the software’s “about” message, or in the software code itself.
We received written feedback from one industry representative after the feedback teleconference session on software-related UDIs:
- “Some devices have software inherent in them. They are part of the device. The 2 are deployed together and dependant [sic] on each other. I would suggest that this be considered a single device, with a single UDI.
- In other cases the software operates independently on a device and can be recognized as a separate entity. In this case the Device and the Software could have separate UDIs. It would be important to link these 2 UDIs together, as it is likely that that physical device would be the primary focus in any adverse event reporting
- If the regulation were to distinguish between dependent and independent software, the processes could be adapted to minimize exceptions. For the dependent software/device combo….if I change the software, I need to assign a new UDI. For the independent software/device combo….the rules for new UDIs would be separate.”
Providing UDI Data for the Revised UDI Prototype Database
In early 2010, GHX updated the UDI prototype database originally developed in mid-2009 to contain a much reduced set of data elements, in line with the GHTF attributes. (See Appendix C for list of data elements.) We then worked with five labeling organizations which volunteered to enter data. (Three of the organizations had participated in the August 2009 pilot test.) This practical exercise was designed to be much more self-driven as would be expected when the UDI regulation takes effect and the UDID system is available. Labeling organizations were given two different documents to use:
- Instructions for the practical exercise including specifications of the types of devices for which FDA wanted information, as possible
- Spreadsheet template with instructions and attribute definitions for providing data on 10 UDIs.
Labeling organizations provided their spreadsheets to GHX staff who then uploaded the data (71 UDI records) into the UDID.
Generally, the labelers were able to provide complete information. The only data element which was incomplete, not surprisingly, was marketing end date. (Information for a second contact at the labeling organization was completed by only three of the five labelers.)
The five labeling organizations had no real difficulties filling medical device information into the Excel template, but they did provide written feedback on data elements for which further clarification will be needed for the upcoming UDID, as we describe below by specific data element.
- Country of Origin:
- “…. we had two items that are packaged in Mexico, but contain product [sic] from Malaysia. Since we could only put in the one country code, we have included Mexico as the country of Origin, but we wanted to point that out as an issue.”
- “We have several products that are manufactured in multiple locations. I am not referring to components from multiple countries but rather independent manufacturing facilities in different locations. Product A is an example. The data sheet now lists only one of the locations. It seems as though the database should allow for multiple countries to be listed.”
- Marketing Start Date:
- “ …we do not have access to the marketing start date for all of our products since many of them have been in the market for quite some time.”
- GMDN code problems and inconsistencies
- Several labelers had product information linked to GMDN codes that were not available in the Preferred Terms table that GHX had received from FDA to use for validation of this data element.
- DUNS Number
- One labeler had information from two different business units, each with their own DUNS number. They had to update their template by filling out a row for each of the business units on the Organization table. (See Appendix C, Table C1. UDID Organization Data Elements).
In addition to the information gathered from the labeler experience, an analysis conducted by FDA produced illustrative information on labeler data quality. A data subset from one labeler was used by FDA for the OIVD pilot activity described in the next section. When an FDA staff person validated the device information with FDA’s R&L system, he found the following issues that needed correcting:
- For one product, listing number was found to be invalid
- For 12 products, the product code did not match the listing number.
- For two products, 510(k) number did not match the one shown in the listing number database
Labeling Organization Test of User Permissions
Six labeling organizations participated in a second practical exercise for developing and testing of criteria and the validation process for registering labeling-organization users for access to the prototype UDI database. All six completed the exercise of assigning roles and permissions, adding a new device and editing an existing device, and viewing/verifying the new of changed device entries.
While general user instructions were given to the participants, we asked participants to do the simulation without using the instructions initially to see how they were able to maneuver in the UDI prototype database application. Those who responded with feedback felt that they could easily do this. In the exercise, a few questions and issues that focused on the application itself (such as browser compatibility or minor issues of obtaining access through the URL) arose. Almost all were of minimal importance and did not hamper those participating in the exercise.
Three levels of organizational permissions were identified for labelers to use in this exercise:
- Administrator: This user works for a Device Organization, perhaps in a master data management or regulatory role. This person will be responsible for allocating permissions for UDI prototype database access within their Device Organization(s).
- Device Editor: This user works for a Device Organization, in a data management, regulatory or other role. They will be responsible for keeping the UDIs up to date along with their associated attributes within their Device Organization(s). This user will likely be responsible for loading data into the UDI prototype database. They may also want to view devices from other Device Organizations.
- Device Viewer: This user works for a Device Organization, perhaps in a support role for those in data management or regulatory divisions. The user may need to view or verify items in the prototype UDI database for their organization(s). They may also want to look at items from other Device Organizations.
After the administrator set up the user permissions for the labeling organization, participants were asked to complete two scenarios - one for editing a UDI record in the UDI database and one for adding a new device to the UDID. The device editor edited a record and added a record while the device viewer verified that the information was correctly completed.
We asked that each type of user provide written feedback on issues and questions that arose at their role level. Several provided overall positive comments on using the UDID application and one felt that system performance was slow:
- “Very user friendly, quick to enter editors/viewers, database allows immediate access once entered.”
- “I liked having the ability to filter and the ability to export all users to excel [sic]. These features could come in handy when there are multiple users for an organization.”
- “System is a HUGE improvement from FURLS.”
- “Very user friendly, easy to navigate and view database, information very accessible and transparent.”
- “I did utilize the Instructions for Practical Exercise for entering the first new user. However the system is user friendly and relatively quick and the instructions were not needed after the initial user creation.”
- “Access and performance of system was slow. Got better on last try.”
Comments specific to each type of permission role are shown in the table below.
One organization’s representative provided additional written feedback on the editor and viewer roles from the perspective of his organization:
“With thousands of SKU’s, viewers/editors may need to be restricted to materials they are responsible for. Perhaps this could be done with business assigned attributes. The UDI database would provide perhaps 1-3 optional generic fields (business attribute 1, business attribute 2, business attribute 3) for the business to define as needed to help organize all of their data. Security permissions could then potentially be defined for a particular viewer or editor at these levels. For example, Org C could chose to use business attribute 1 to reflect business segment and populate Diagnostics, Medical, etc. as a value on each record. Another company could choose to use business attribute 1 as product family or product hierarchy.”
Various participants provided written feedback on additions to existing features that they would like to have to make it more user-friendly.
- “We tried filtering using a single digit or letter. This worked as expected for the UDI, Model Number, and FDA listing fields by providing records that started with this character. This did not work on the Descriptive Name field (i.e., filtering on ‘B’ still returned all records)”
- “It would be nice if the system could recognize the population of the last data entry field; user is forced to click into another cell prior to the ‘Finish’ button being available for selection.”
- “When attempting to re-enter the new entry, the databases allowed us to enter all of the information and only validated the potential duplication after selecting Finish and reporting ‘violation of PRIMARY KEY…’ Ideally the fields composing the primary key would be validated up front before entering all of the other information.”
- “For the descriptive name and Brand name, I could not type in the copyright symbols. So, instead I wrote it out in a word doc and then copied and pasted in.”
In Table 12 below are various user comments on specific data elements.
|Marketing Start Date|
In addition, we noted that, while the application offered a type-ahead functionality so that users would not have to use a very long look-up table to identify a choice such as a GMDN code, not all users seemed familiar with this as three organizations had issues with this or noted this in the feedback form.
Two organizations made general written comments similar to feedback FDA has received at various times in other pilot activities and in other fora as well.
- “I am concerned that information already required by other FDA systems (such as device listing, market authorization type/code, and Brand name) will be required to be re-entered into this system. Duplicative data entry leaves room for error and inconsistency between systems.”
- “510k number and FDA listing number [Org] confidential and should be viewed by FDA or regulatory agencies only.”
- “Users would like the UDID to be able to synchronize data device listing, market authorization type/code, and Brand name be synchronized between UDI and other FDA systems so that organizations do not need to enter the data twice.”
Participants asked for additional features:
- “A ‘nice to have’ would be the ability to create multiple new users using a predefined import file template.”
- “Consider allowing the filters to select a range of values such as a range of Model Numbers.”
- “Although not part of this test, the export file format and import file format should be identical to allow records to be exported, changed externally, and then re-imported without converting format. Leading zeroes especially on the UDI value can be easily lost during export.”
- “When the system is released into Production:
- “Will/can creation of a new user auto-generate an email to that user informing them of their new login info? Or will the admin need to forward this info to each new user?
- “Will public users have the ability to request private permissions through the homepage of the public system?”
Practical-exercise participants were also asked to answer a few general questions in writing to provide more information regarding user permission roles.
We first asked whether the three defined roles were sufficient for the organization or whether additional roles would be needed. While all the participants felt that the three organizational roles of hierarchical permissions were sufficient, three provided comments indicating their need for additional levels and types of permissions within their own organization, primarily focusing on business units. Two specified the need for corporate level permissions and then the same hierarchy at the business-unit level.
When asked how their organization would use the viewer role internally (i.e., a viewer can see all attributes for the org where a public user would not see private information), two responded that they used the viewer role as a verification not only of the correctness of the information but also of regulatory compliance. In one case, a senior regulatory staff person functioned in this role. They also said:
- “The viewer role would be used to give view access to those internal users not responsible for data entry tasks but that might have interest in seeing the private information.”
- “I would think that any of our folks that are involved with the FDA and our products would need to be able to view the information”
- “Viewers may be used to internally audit entries in the UDI database or pull exports of data. Access to the private attributes may help with filtering or performing these checks.”
We also wanted organizational perspective on whether it makes sense for authorized users to inherit the roles in a hierarchical fashion (that is, the lower level a user’s role, the fewer permissions and more limited access that role has) or whether they should be independent. All organizations agreed with a hierarchical approach.
All organizations also agreed with the best practice of having more than one administrator for their organization, with all administrators being able to add additional administrators in addition to editors and viewers. One further elaborated in writing:
“We believe it is important to control access to database and limit user permissions, but want administer to control adding other admins/editors/viewers and determining their setting permissions. Internally, we would have procedures to control how administrator allows access/permissions within the company vs. requiring us to go through the FDA to add/change administrator status.”
Some organizations used this feedback form as an opportunity to ask for additional information about kits. The issue of how kits that various labelers have in their product catalogues are handled is one that FDA has been working on for quite a while. Questions on how to enter data on kits in the UDID arose in the August 2009 pilot test, in the data entry exercise described above, and in this user-permissions exercise.
Examples that organizations provided during this practical exercise show some of the issues:
- Org Y had problems entering kit-related information during the practical exercise. “In many cases, our kits include mostly semi-finished-goods which have no barcode-label and therefore no separate UDI.” In the exercise, they “entered a kit with 2 components and then also listed each component separately (because they are also sold separately).” They were also advised: to list a kit on one line with UDI (in column M) and include the same UDI in "other UDI" (column M). Then for each device in the kit, provide separate line listings for each device. For example, if there are 4 UDIs in a kit, provide 4 separate line listings for each device, with four K numbers and four GMDN numbers, then reference the kit UDI in "other UDI" (column M). Then each device is described and listed separately, and all devices would be referenced to a kit that contains them.”
- Org Z raised concerns when they participated in the feedback sessions earlier this year: “…we had concerns about not being able to get our products into database that were kits. We have some kits that contain multiple products, with different 510k numbers (not sold separately, so no individual UDIs on the individual devices in the kits), but the kit is the saleable unit, with one UDI (but more than one 510k and device in kit). We were not able to enter these into database and do not want to include individual UDIs on each component of kit, if they are not sold separately as unique products.”
FDA conducted two internal pilot activities to identify and explore potential business issues that may arise with implementation of the UDI regulation:
- Integration of UDI with device data used throughout its FDA Total Product Lifecycle (TPLC)
- Introduction of UDI into Office of In Vitro Diagnostic Device Evaluation and Safety ( OIVD) processes
TPLC and Using UDI to Integrate FDA Databases
The TPLC pilot activity focused on potential ways to identify where and how UDI could be useful to connect to various FDA databases. Currently, there is no standard connection among and between the databases. CDRH integrates information among and across databases using fields such as product codes and manufacturer names.
To explore the feasibility of using UDI in existing CDRH data sources to allow FDA to obtain more detail on devices, even though the UDI system has not yet been implemented, we simulated the availability of UDI information for medical devices. For this activity, we used two sources of product-related information that had UDI incorporated in them to explore where UDI might facilitate integration of TPLC data:
- 631 records from the original pilot test of the UDI prototype database (mid-2009) that contained 47 attributes
- 71 records from a second pilot of the UDI prototype database (early 2010) that refined the attributes to 23 device-related attributes along with labeler contact information
Two TPLC sheets were prepared - the Product Code sheet for MIH and the UDI TPLC sheet - and used to identify information that each contained. Both Product Code and UDI TPLC sheets contained pre-market information for the selected device in the UDI databases under product code MIH. The Product Code TPLC sheet counted 1322 MDRs and provided aggregated information on patient problems and device problems. Due to limited data available because of lack of UDI information in present FDA databases and significant variation in manufacturer name and brand name, the UDI TPLC sheet provided detailed information on only one MDR. No recalls or inspections were recorded on either version.
Because UDI is not yet available, we used a combination of procode, manufacturer, brand name, and model number to match the UDI information to existing FDA data sources which do not yet have UDI information matched to them . Manufacturer and brand name along with model number were identified as possible data elements that allowed a link between the information in the UDI prototype database and the existing FDA sources. A major issue with using brand name, manufacturer name, and model number is that these fields are all text fields in existing FDA data sources. The data is entered directly into a field rather than through standardized look-up tables and thus there are many inconsistencies. The TPLC Project includes a manufacturer name consolidation table (with over 25,000 manufacturer name variations) to make connection possible. Due to misspellings, division and/or location information, many companies have multiple variations on manufacturer name. For example, there are 843 firm names that were simplified to 1 manufacturer in the consolidation table.
Three CDRH SMEs identified some of the issues surrounding the introduction of a UDI into the current information flow. The information in the two UDI prototype databases, along with various FDA databases such as CARS, provided the input the SMEs needed to understand and identify some of the issues. The SMEs felt that quite a few of the UDI attributes would be very useful, going forward. They gave specific input on business processes, specific data needs, information of interest, and potential UDI benefit by type of CDRH action as shown:
- Recall: Full Corrective and Preventive Action (CAPA) and root cause analysis
- Inspectional Guidance for Directed Inspection
- Warning letter
- Office of Compliance (OC) Complaints
- 510(k) review
- Writing guidance
The SMEs identified the need for connection of information as device designs evolve. Often over the years, manufacturers will make changes to the device design, to the indication for use and/or to the manufacturing process. Each submission will result in a different set of adverse events and recalls. Higher-level grouping of information (along with product code, GMDN and manufacturer) allows the SME to understand differences in device performance across design iterations.
Since current product information fields in existing CDRH databases are populated with text entries, it will be difficult to take advantage of the standard format that UDI will provide unless UDI data is added to all FDA databases. For UDI to add value to analyses using any one FDA database, it would need to be included as an entry in all data systems – R & L, Pre-market, Recalls, MDR – even if the entry is added later or if there are multiple UDIs to one entry.
This activity documented that FDA will not be able to conduct retrospective analyses of CDRH’s existing data sources using a device’s UDI when UDI becomes available:
- It would take a very high level of effort for CDRH to link UDI to existing data. Because there are few means to match a product’s UDI without extensive effort (computer and human data cleaning and analysis as described above), it would be impractical for CDRH to use existing data sources to examine device issues at a finer level of granularity. Matches on data that FDA currently has would not be sufficient to identify UDI. Devices may keep the same product code and manufacturer and brand name and yet change key UDI characteristics such as sterilization technique.
- FDA can move forward with analyses benefiting from having the information that a UDI can provide only once UDI begins to be required (expected in late 2011 for class III devices).
The SMEs determined that the UDI TPLC sheets contained limited information. Information about previous device designs and their post-market performance was not included. A device’s UDI without a grouping code such as procode or GMDN may produce too-specific information because of the granularity of UDI. The implementation of UDI will include a link to GMDN and product code as well as an association of prior device designs to the currently submitted product.
The UDI database will need to include and be able to account for multiple packaging levels across a device so that all UDIs related to a device can readily be included in FDA analyses and reviews. It is vital to identify the process for matching the reported UDI to the base-packaging UDI in the requirements phase of the UDI database application development.
In summary, the TPLC pilot activity explored the potential for UDI to be integrated into TPLC processing and to be used to analyze data from existing FDA data sources. The difficultly in matching data between the prototype UDI database and existing FDA information emphasized the problems with existing FDA databases. Eliminating the data-matching issues is expected to greatly streamline the ability of FDA to integrate and use device-related data across and among its databases. It will not be possible to retrospectively match up device UDIs to the relevant records in FDA’s databases because of the very high costs involved. Thus, UDI will be of most value to FDA going forward from the time the regulation is implemented.
Introducing UDI into OIVD Processes
This pilot activity provided FDA with an opportunity to test processes that UDI may affect before it is integrated into FDA systems. This included the following simulated activities:
- Integration and validation of UDI data with CDRH databases.
- Registration and Listing (R&L)
- Clinical Laboratory Improvement Amendment (CLIA)
- Manufacturer and User Device Experience (MAUDE)
- Potential collection of discrete pre-market submission/labeling data and links to UDI
- Manufacturer’s ability to modify labeling and report submission
Simulating the UDI Database for This Pilot Activity. Org M has been participating in various opportunities to provide informal feedback to FDA for more than a year. One of those opportunities was to provide FDA with device-related UDI data in the pilot test of the UDI prototype database (mid-2009). The information Org M provided at that time included in-vitro diagnostic devices. FDA and Org M identified one of Org M’s products to be used for the simulation in this pilot activity.
Because there is no UDI database application at present that could be used for this pilot activity, an FDA staff person developed an Access database, incorporating Org M’s UDI records to allow linking of their data records to R&L. There was a conflict between what Org M submitted for R&L and the UDI data in terms of matching their 510(k)s and product codes to their listings. Org M submitted a UDI number for the test kit and the listing numbers for components in the kit. Corrections were then made.
This highlighted two issues:
- Manufacturers need to coordinate what is submitted to FDA - that is, UDI and listing number. In the case of Org M, since the device selected for the pilot was a kit, the issue is related to kits and how FDA relates the component parts to the kit itself. This is an interesting and important problem and needs further discussion (as described above).
- Another issue was related to a device having a single UDI number and multiple listing numbers. As explained by the manufacturer, this was due to several modifications of the product. To avoid confusion in the future, manufacturers will need to submit the latest listing number with the UDI.
Experience Submitting the CLIA Add-to File . For submitting the CLIA add-to file, FDA staff decided to use the test server environment rather than the production server for this simulated activity so that there would not be any issues with removing a device record after submission. Org M used a modified eSubmitter template to create and submit the add-to file submission to include the UDI number and barcode. The submission was sent to FDA via e-mail and loaded into the test system. The process in a live production environment would be similar in that the sponsor would send FDA the submission (in the case of production, on a CD) and it would be loaded into the production system. The method of how the submission is sent is not relevant for 510(k) and CLIA categorizations as the method of loading the submission is the same regardless of the method of submission.
Simulating Adverse Event Reporting
Mandatory Reporting (Form 3500A ): For this pilot activity, we proceeded with minimal MDR information: the UDI number, report number, procode and event text (without the other UDI attributes). It was included in the D4 "Other #" section of the 3500A form since the eSubmitter 3500A template is already set up to handle the UDI in the "Other #" section (having a 30-character limit) and did not require any modifications for the pilot.
Org M submitted a simulated 3500A form to the test system and an FDA staff person loaded the report with the UDI information into the test MDR database and test document storage system. We determined that a simulated electronic MDR with UDI information was adequate until the UDI database regulation is out for public comment.
Voluntary Reporting (Form 3500): After reviewing the experience, we did not proceed with voluntary reporting using a simulated electronic MDR with UDI information, deferring this until the UDI database regulation is out for comment.
While we did not carry the OIVD pilot activity through all scenarios, we did identify that there will be a variety of FDA users who will need to be oriented to how and in what way having UDI-related information available to them will enhance and facilitate their work. The UDI database application, once it is developed and begins to be used, will be the authoritative source for device-related information for FDA internal users as well as a variety of external stakeholders. It is expected that FDA would be able to benefit from various internal databases being able to link to the UDI database information so that, in an MDR or recall, there would be electronic population of the UDI attribute information into the MAUDE and RES (Recall Enterprise System) databases. This would minimize transcription errors and save industry from sending FDA the same information multiple times.
Issues Related to Device Grouping Systems
A few general issues arose during the FDA internal pilot activities that were informative for FDA.
Procodes. As part of the OIVD pilot activity, Org M identified an issue of product code inconsistency over time when FDA identifies product codes in clearance letters for the same product line. Implementing the UDI regulation may alert companies to the inconsistency since they will see these discrepancies as they prepare the UDI data to be uploaded into the UDI database application. This will provide them with an opportunity to fix product code problems by asking FDA for correction letters.
Ensuring that Pre-Market Submission Information Contains UDI. Pre-market submission [510(k)] and PMA information are included as part of the R&L record. Therefore, UDI product submissions will be linked to their pre-market application number as part of the UDI submission process. However, because the UDI is often not assigned until after FDA has approved the product, the original pre-market submission record will not contain a UDI. A goal of UDI processing should be to associate the UDI retrospectively to the original pre-market application information.
GMDN Codes . The data from the UDI prototype database pilot test conducted in mid-2009 was used during pilot activities being conducted internally at FDA to conduct analyses such as examining ways in which device data could be aggregated and disaggregated across different attributes. One analysis examined procodes and the use of the GMDN code to further disaggregate device-related data.
Currently, FDA uses procodes to group similar devices from various manufacturers, and these will continue to be useful in the future. A procode is already assigned to most data in CARS and manufacturers are required to assign a procode to all new devices. The nearly 6000 procodes currently in use are not hierarchical; each stands alone. The codes themselves are 3 random letters. Often, the category described by a procode is very wide and encompasses a large number of devices. FDA’s standard method of grouping procodes is by assignment to a Medical Review Panel, which often, but not always, approximates a medical specialty area.
GMDN ( Global Medical Device Nomenclature) is a system of generic descriptors used to identify all medical devices. It was compiled by medical device experts around the world including the FDA. It is in use internationally, and it has been more and more integrated into FDA databases. GMDN is hierarchical and has more categories than there are among FDA procodes. GMDN has 16 top-level groupings, some of which approximate the Medical Review Panels assigned to procodes.
We examined the expected ability for labelers to provide GMDN information, including use of the correct GMDN code. A GMDN code was not a required attribute for the August 2009 pilot test. There are, however, many products used in the U.S. that have GMDN codes because they are also marketed in international locations where the GMDN is used for device certification. Labelers supplied a GMDN code and additional descriptive information for more than two-thirds of the records (70%), which was surprising since GMDN was not a required attribute and labelers tended to supply only the required information in the pilot test.
Table 13 shows the rating results for labelers’ GMDN correctness (based on two fields: GMDN code and GMDN Preferred Terms Description). Most of the GMDN codes supplied for devices (of the 434 records with sufficient information to be evaluated) were correct, giving a success rate of 89%.
|Rating of GMDN Correctness||No. of Records|
|GMDN code correct||386|
|GMDN code incorrect||48|
|No GMDN code||14|
|Can’t Evaluate (insufficient information in record)||6|
|Neither GMDN field supplied||177|
An example where the GMDN information was supplied and was correct for the device is shown below.
|GMDN Code||GMDN Preferred Terms Desc||Abbreviated Desc||FDA Product Code|
|46309||Catheter, flush syringe||SYRINGE 10ML SALINE 10ML FILL||FOZ – Catheter, Intravascular, Therapeutic, Short-Term Less Than 30 Days|
The GMDN code was deemed incorrect in 48 records. Most of these were cases where the manufacturer’s product was a kit or set that includes as a major component the device represented by the selected GMDN code, or the reverse. Of the 31% with insufficient information to enable the correctness evaluation, for 14 records, there was no GMDN code available so no evaluation of the code’s correctness could be done. These 14 records were also missing most of the other data including required attributes such as FDA product code, organization name, and brand name. There were six records which were rated as Can’t Evaluate, e ither because the listed GMDN codes do not exist or the abbreviated descriptions were insufficient t o determine if the correct code was applied as shown below. In 177 records, most of the information contained in the two GMDN fields was not supplied. There are more than adequate numbers of GMDN codes to represent most of these products, so either these are cases where the labeler simply never had a GMDN code for the product or they just did not supply the data during the pilot test.
While this is a very limited analysis based on very little information for each product, the expert assessor who conducted this correctness review determined that most of the GMDN codes/names are from the GMDN as it was at least 4-5 years ago. GMDN terminology now has many more codes and more specific codes. This has obvious implications for labelers who will be supplying GMDN codes into the UDI database who will need to ensure that their GMDN codes are updated.
A variety of labeling organizations participated in various informal feedback opportunities and simulated practical exercises.
Labelers were able to expand FDA’s understanding of issues that could affect their ability to comply with the UDI regulation.
- Labelers provided quite a bit of feedback to FDA on various issues including possible data elements to use to link the UDI database to various FDA databases, likely at this point to be the registration and listing number. Almost all labelers were comfortable with this. Labelers continue to have specific needs (identified during the practical data entry exercises) and wish-lists for additional features that they would like the UDID system to have. FDA will need to balance the range of needs and desires expressed with the priorities needed in the UDID system to ensure that FDA and other end users have timely and always-updated access to medical device information.
- Feedback from labelers on issues related to identifying and linking software that is incorporated into medical devices documented that there are still issues for FDA to resolve before implementing the UDID system after the regulation is implemented. FDA should secure a variety of use cases from various labelers to help ensure that the UDID system design encompasses the needs across many types of labelers. FDA will need to address UDI issues around kits and combination products including specification of where the UDI number has to be – on the kit, on the individual device components, or on both – and the impact of this on the development of the UDI database.
- Labelers continue to provide feedback to FDA on their expected ability to comply with the UDI regulation. Organizations varied widely in the number of UDIs they expect to have from their product catalogues as well the volume and frequency of changes to device records and additions of new devices that they will need to make to keep their UDID records updated. As the UDID system is implemented and goes through refresh cycles, FDA will need to ensure that they continue to check with labeling organizations on their perspectives about UDID system implementation such as database performance as the database increases in size. This will ensure that the system works well for labelers and thus will give the information needed.
User roles and permissions were tested at labeling organizations and helped FDA and labelers understand what labelers will need.
- Organizations will need multiple and nested levels of permissions to accommodate their organizational business processes for this regulatory compliance (corporate level and business-unit user roles). Linking permissions to business units within a labeling organization will require some sort of identifier at that sub-organization level.
- One labeling organization used the Viewer function also as a verifier role (for regulatory compliance). The definition of this role and how organizations would use it may need to be explored further.
- One feature that an organization requested was for an organization to enter data into the UDI database and have it retained there until someone in another role such as an approver or verifier completes the approval or verification (i.e., could data be entered but not verified and thus remain not submitted/published/released). This organization says that they have products awaiting final approval from FDA which they would like to enter into the UDI database ahead of the approval being received and then have their organization’s approver role approve the entry as soon as FDA approval is received. This could help ensure that FDA has very timely information.
- Validation of the organization as an FDA-recognized entity not yet tested: Initial validation/assignment of the labeling organization’s administrator still needs to be explored and defined - how and in what way this initial-assignment process will work including insuring that the organization is valid and currently registered with FDA. Options have been discussed and explored across and among various parties including GHX, FDA, and others.
- Labelers will need to ensure that they have accurate and updated information going into the UDID. Some inaccurate listing numbers and GMDN codes were identified, signifying that labelers’ information was outdated.
FDA Internal Processes
- FDA will need to review and ensure that UDI is included as an attribute in all databases containing product information, especially R&L, Pre-market, RES, FACTS, and MAUDE, so that analyses across and among FDA databases can be done.
- UDI numbers should be included as a data element in each folder in CARS:
- Adverse Event (MDR) – eMDR, MedWatch 3500A database, MedSun
- Alternative Summary Report
- Pre-market (back fill based on R&L)
- Registration and Listing
- To incorporate UDI into these data sources, FDA may need to revise forms and instructions to accommodate a place for the UDI and to develop shorter term solutions until forms are actually able to be changed or updated.
- TPLC data should be grouped by UDI as well as by other attributes (product code, GMDN, registration number, manufacturer)
- The UDI database application must have a linking method across and among a device’s packaging levels (e.g., unit, package and case) so that there is a connection between them (translation table).
- Further research is needed to understand the following questions. Most of them will not be able to be answered until at least a year after the UDI regulatory compliance period is completed:
- What grouping of device data allows CDRH to identify issues?
- How many brands and/or design changes can occur within a single UDI?
- Does the UDI change with each 510(k) or PMA submission?
- How many different indications for use are within a single UDI?
- Are recalls faster or more effective using UDI?
- Can adverse event patterns be identified more quickly using UDI?
- In the report on the OIVD pilot activity, we outlined the suggested processes that should be considered for modification to ensure that UDI-related device information is appropriately incorporated into various FDA processes. Some of these steps may need further modification once the UDID system is operational. FDA may want to develop a timeline for updating instructions and procedures that will be affected by the need to include UDI information. FDA may also want to prioritize a timeline for updating or changing the processes that may benefit from and/or be affected by incorporation of UDI information.
- Even in the small amount of device information provided for the OIVD pilot (15 items), there were R&L and procode issues that the manufacturer had to correct or clarify. This may have implications such as specific Help instructions or FAQs needed to assist labelers on this for the roll-out of the UDI Database system.
- Modifications to the 3500A/3500 form may be needed at some point. At present, submitters of reports can include UDI information (number and bar code) in the D.4 “Other #” section of the 3500A form or the E.4 “Other #” section of the 3500 form. The FDA champions for the UDI initiative want to better understand how and when changes to the 3500A form can be made so that a timeline for incorporation of UDI attributes not currently on the form can be developed.
- The UDI group at FDA also needs to understand and identify whether there will be any difficulties incorporating specific attributes.
- Issues with electronic submission should also be discussed at this same time to ensure that the experiences in the test environment mirror what the actual submission process will be.
- In participating in this pilot activity, Org M identified inconsistencies in some procodes. The implementation of the UDI regulation may bring an additional burden on FDA staff to update procodes if many manufacturers need to send correction letters to FDA.
- Orientation of the FDA staff to use of the UDI Database information will be needed. As part of the roll-out plan for implementing the unique device identification system, FDA should take into account the variety of internal FDA stakeholders needing orientation to this change. The FDA UDI group may want to consider exploring developing a communications plan and a timeline for orienting key FDA stakeholders to using information from the UDID system.
In the past year, FDA has continued to explore what the implementation of the UDID system will mean for a variety of stakeholders. Labeling organizations continued to participate in informal feedback opportunities which included teleconference discussions and practical simulation exercises which provided FDA with a range of information that has further elucidated UDID system needs. Pilot activities conducted internally at FDA identified processes which can handle UDI needs already as well as those that will need changing or adapting to meet the requirement to incorporate UDI information. Many fewer issues and questions now remain as FDA is close to releasing the UDI regulation, and FDA has sufficient time to resolve these before the UDID system is implemented.
Appendix A. Instruction Sheet for January 2010 Informal Feedback Sessions with Labeling Organizations
INFORMAL FEEDBACK FOR FDA ON UDI INITIATIVE:
ISSUES/INSTRUCTIONS FOR MANUFACTURERS AND DISTRIBUTORS
Feedback Objective: Understand at a detailed level how manufacturers associate a UDI to other systems (FDA, company-level)
Based upon previous discussions with the UDI prototype database pilot-test participants, we understand that there may be multiple data sources for the supply chain and listing information that FDA’s UDI system would need. We have described below the various questions that FDA has identified to help us better understand potential issues and challenges that manufacturers and suppliers may have.
We would like you to come to the telcon feedback session with the information to answer as many of these questions as possible.
We ask that you will use the questions on the next page to:
- Identify the appropriate group(s)/individual(s) in your organization that can address the identified data issues.
- Request as much detail as possible on the characteristics and meaning of this data in your organization to ensure that we have common definitions, standards, and methods for exchanging the data.
For example, we are interested in:
- Your data definitions
- Current perspective on the regulatory requirements met by this data
- For example, see Table 1 that lists the Characteristics we have outlined below for Listing number, 510(K) and PMA number. Does your organization agree with how FDA characterizes this data? Why or Why not?
- Request information about /identify across your organization the relevant data sources so that FDA can adequately assess the burden, feasibility and completeness associated with collecting one type of information versus another.
For example, we are interested in:
- Current methods for reporting the product identification information to FDA (as applicable). This could also include how this type of information is sent to CDRH vs. CDER vs CBER or any other regulatory body.
- Current problems/concerns with obtaining and/or reporting the data
- Current problems/concerns with how this data relates to other data associated with unique device identification data – GS1, SPL, GMDN, etc
- Provide us with additional information that concerns your organization about UDI data submission requirements that we have not adequately addressed.
Illustrative questions on which FDA would like feedback during the telcon feedback sessions
- What identifier to use to link into existing FDA info:
- the listing number OR
- premarket submission number for non-exempt)
- procode for exempt
- How does one device have multiple US marketing authorization codes?
- In what kind of device situations does this arise so FDA can anticipate this in the UDID?
- Which are the most problematic attributes for manufacturers to comply with?
- When do you get a new UDI? What triggers this (e.g., if models or products change)?
- FDA would like to capture UDI at the level of unit of use. What is the best solution for generating a UDI at the unit of use when there are multiple packaging levels?
- What Organization identifiers does your company use for the product labeler? Are you familiar with DUNS? (One participant mentioned 7 different entities for pilot items?)
- What are suggestions for handling multiple trade names/brand names? Who populates these in FDA R & L?
- Knowledge of UCUM – Does you organization have staff who understand and/or use UCUM (Unified code of Units of Measure)? Any other standards?
- Pre-Market Amendment ID: all Pre-Market amendment products should have a product code assigned. What are issues with pre-market amendment products?
- Labeling requirements and storage. How difficult/easy is it for vendors to format label information into a standard data exchange format (e.g. XML)? Is that information stored discretely? How often does the information change etc?
- Use of Product URL for dynamic information. Suggestions were made to use URLs to capture dynamic information. Any ideas on how that could be implemented?
Table A. 1 Characteristics of Product ID Numbers
|Listing Number||510(K)||PMA||Exempt with Product Code||Catalogue Number|
|How Assigned/ changed?||Created as part of product; changes if product owner changes;||Assigned by FDA ODE – could be based upon equivalency to previous product; does not change; one number regardless of where manufactured||Assigned by FDA ODE; changes are identified by supplements; one number regardless of where manufactured||Assigned by FDA based upon association with CFR definition; changed if intended use or product changes||Assigned by Manufacturer/ others?|
|Entity that is required to submit this to FDA?||All foreign establishments exporting device to U.S.; All U.S. mfrs, spec developers, repackers, relabelers, remanufacturers, single-use device reprocessors. All U.S. contract mfrs and sterilizers who put product in commercial distribution||510(K) owner; Registered entity (if applicable); lister||PMA owner; Registered entity (if applicable); lister||Registered entity (if applicable); lister||Not required|
|Granularity of Product Identification||Identifies a non-exempt product to the same level as the submission number; exempt product to the product code level||Identifies a product grouping that can contain multiple models of a product||Identifies a product – one PMA can have multiple supplements.||One product can have multiple product codes due to differences in intended use||?|
|Data Confidentiality||Used for import security; not released||Publicly available – currently not to UDI level||Publicly available – currently not to UDI level||Publicly available-currently not to UDI level||Publicly available?|
|Issues to address from FDA perspective||Current FURLS – can have multiple listing number for one product if listed by multiple company owners||How to handle PMA supplements?||Relationship of Product Code to GMDN or other product categorization||Pilot participants said that there are too many numbers for this|
|Timing of assignment of listing number vs. timing of assignment of UDI|
|Labeler does not always = owner/operator|
Appendix B. Information Sheet for Labelers on Software-related Considerations in UDI: Informal Feedback to FDA
Software in UDI comes in two categories:
- software as health IT
- software as a component of a finished device
There are two situations:
- changes (revisions) made before the device goes on the market
- changes made after the device is on the market
- Before the device goes on the market
- If the device is essentially the same (i.e., same device identifier) and the manufacturer makes changes to the device (software revision, new pump motor, new material), those changes are reflected in the device history record and the production identifier
- e.g., serial number 123 has software version 2A or pump motor A1B2
- This happens all the time with many different devices.
- The same is true for software that is a device. If it is (essentially) the same device, then it retains its DI and any changes (e.g., version #) are reflected in the production identifier.
- If the device is essentially the same (i.e., same device identifier) and the manufacturer makes changes to the device (software revision, new pump motor, new material), those changes are reflected in the device history record and the production identifier
- After the device is on the market
- We have already stated that the UDI on the device should never change. It remains the same for the life of the device.
- If changes are made to device in the field, these are reflected in the manufacturer's records or in, for example, hospital maintenance records. So, if software is updated on a device, the device retains the same UDI.
- If the software is a device and it is updated but essentially the same (rev 2 - rev 3), it would retain the same UDI.
- The major difference with software seems to be where the "revision" significantly alters the device such that it is a new "device."
- So, if ver 3 (which is replacing ver 2) adds new functionally to the software such that it is a different device, then it would/should get a new UDI (that is, a new DI).
Questions for manufacturers/distributors:
- Background information:
- What % of products that your company develops contains software?
- Is the software in your company’s products developed in house?
- How does your company track software in different products?
- How does your company plan for software updates and ad hoc responses (scheduled updates, emergency patches such as security issues, viruses, etc)?
- From a UDI and software perspective, are there any holes/issues with the summary? If so, what are they? Please be as specific as possible and provide examples, if useful.
- How would you propose to handle the situation describe in 3. above (new software makes “new” device)?
- Are there any other UDI-software issues that you have identified? Please list them and provide an example, if possible.
Table C. 1 UDID Organization Data Elements
|Organization Data Elements||Definitions|
|Labeler Organization Name||Labeler: Any person who causes a label to be applied/modified to a device with the intent that the device will be introduced into interstate commerce without any subsequent replacement or modification of the label.|
|Labeler Organization DUNS Number||DUNS Number: a 9-digit number that is a useful resource for FDA in identifying and verifying certain business information for the entity.|
|Contact 1 Name||Contact: The person who will serve as the primary point of contact with FDA on matters relating to the identification of medical devices marketed by the labeler and who is responsible for ensuring FDA is provided with all the required information.|
|Contact 1 Phone|
|Contact 1 Email address|
|Contact 2 Name|
|Contact 2 Phone|
|Contact 2 Email address|
Table C. 2 UDID Device Data Elements
|Device Element||Field Type||Field Length||Device Element Definition|
|Labeler Identifier||Alpha Numeric||80||Labeler Organization DUNS Number. Labeler is any person who causes a label to be applied/modified to a device with the intent that the device will be introduced into interstate commerce without any subsequent replacement or modification of the label|
|Unique Device Identifier||GTIN- Numeric||GTIN- 14|
Unique Device Identifier Code is the specific GTIN, N or NDC for the device.
|UPN- Alpha||UPN- 25|
|NDC- Numeric||NDC- 10|
|Unique Device Identifier Type||G= GS1 |
|1||An identifier that meets the requirements to uniquely identify a device through its distribution and use. Unique Device Identifier Types include: GS1, HIBCC, NDC|
|Model/Catalog/ Reference Number||Alpha Numeric||80||The exact model number found on the device label or accompanying packaging|
|FDA Listing Number||Alpha Numeric||7||Link to FDA medical device R&L system|
|FDA Marketing Authorization Type||K= 510K||1||FDA Marketing Authorization Types include 510K OR PMA. For some devices Labelers may be unable to provide the information|
|N= Not available|
|FDA Marketing Authorization Code||Numeric||6||Code that was provided by FDA authorizing the Labeler to market the device in the US. ONLY Required if K or P|
|Descriptive Name||Alpha Numeric||512||A brief description of the important distinguishing features and functions of the device.|
|Package Type||Alpha||2||Unit of Measure (from ANSI Unit of Measure List)|
|Package Quantity||Numeric||Quantity of Each-The number of units of use in the Unit of Measure. (e.g., case of 10 boxes, 12 in a box. Case QOE=120, Box QOE =12)|
|Brand Name||Alpha Numeric||80||The Brand name of the medical device as used in product labeling or in the catalog (e.g., Flo-Easy Catheter, Reliable Heart Pacemaker, etc.). This information may 1) be on a label attached to a durable device, 2) be on a package of a disposable device, or 3) appear in labeling materials of an implantable device.|
|Device Type GMDN||Numeric||5||GMDN Classification Code: Unique numerical five-digit number used to generically identify medical devices and related health care products.|
|Other Device Identifier Type||G= GS1 |
|1||Other Device Identifier Types include, GS1, HIBCC, NDC.|
|Other Device Identifier||GTIN- Numeric|
|Alternate Unique Device Identifier Code is the specific GTIN, UPN or NDC for the device.|
|Size||Alpha Numeric||512||Device size|
|Sterilization Information||Alpha Numeric||512||Sterile condition of device|
|Allergens (Latex)?||Boolean||1||Does the device contain latex?|
|Storage Information||Alpha Numeric||512||Storage information such as temperature, humidity, light.|
|Is Controlled by Serial Number?||Boolean||1||Is the device controlled by serial number? (Y or N) This number can be found on the device label or accompanying packaging; it is assigned by the labeler and should be specific to each device.|
|Is Controlled by Batch Number?||Boolean||1||Is the device controlled by batch number? (Y or N) This number can be found on the label or packaging material. Lot or Batch means one or more components or finished devices that consist of a single type, model, class, size, composition, or software version that are manufactured under essentially the same conditions and that are intended to have uniform characteristics and quality within specified limits.|
|Is Controlled by Manufacturing Date?||Boolean||1||Is the device controlled by manufacturing Date? (Y or N)|
|Is Controlled by Expiration Date?||Boolean||1||Is the device controlled by expiration date? (Y or N) The date by which the label states the device must or should be used.|
|Marketing Information||Alpha Numeric||512||Marketing status such as active, completed|
|Marketing Start Date||DATETIME||Date when marketing started|
|Marketing End Date||DATETIME||Date when marketing ended|
|Product URL||AlphaNumeric||512||Link to the Device Organization’s website and/or specific product.|