FDA Issues Proposed Rules for Unique Identification System for Medical Devices

July 10, 2012—Members of the medical device industry are responding to the U.S. Food and Drug Administration's (FDA)proposed rules, published today, regarding the agency's much anticipated Unique Device Identification (UDI) System. The rules, in the works since 2007, when they were included in the FDA Amendments Act (see FDA Works on Draft ID System for Medical Devices, Supplies), will require manufacturers of medical devices—from tongue depressors and bedpans to prostate specific antigen (PSA) testing kits, cardiac stents and programmable pacemakers—to provide each item with a unique identifier in human-readable text, as well as some form of automatic identification and data capture (AIDC) technology. This technology, which can be either bar codes or radio frequency identification, must enable the number to be captured automatically. The FDA will also provide a Global Unique Device Identification Database (GUDID) on which all UDI numbers and details related to those numbers will be stored, accessible to members of the industry and the public seeking to learn more about a particular device. The FDA has been working to create the rules for approximately five years, in order to establish a unique identifying system similar to identifiers used in the pharmaceutical industry. Work has included pilot tests of the AIDC technology, industry feedback, workshops, drafting the rules and designing the database.

Because the regulation is technology-neutral, Jay Crowley, an FDA senior advisor for patient safety, says that the choice of automatic-identification technology is left up to each device manufacturer. When it comes to RFID, the FDA has tested RF technology and its effect on the operation of medical devices. According to Crowley, "there's not a great level of concern about RF use in hospitals now."

With the publication of the proposed UDI ruling in the Federal Register, the industry now has 120 days to provide feedback. Written submissions can be sent via fax (301-827-6870) or mail (Division of Dockets Management [HFA-305], Food and Drug Administration, 5630 Fishers Lane, Room 1061, Rockville, MD 20852). Comments can also be submitted electronically, at the Federal eRulemaking Portal. After the 120-day period has passed, the agency will have six months to issue the final rules. At that point, Crowley explains, there will be a phased-in implementation. Manufacturers of Class III devices—those deemed to pose the highest risk to health and safety—must comply with the final regulation within one year after its publication. Class II device manufacturers will have three years to meet the new requirements, while Class 1 device manufacturers will have five years.

Initially, the system will be employed to simply capture basic details, such as a device's make and model, as well as the date and location of manufacture. However, Crowley notes, the solution could be used for considerably more, including documenting the item's actual use; tracking and tracing the device through the supply chain, in order to thwart counterfeiting or diversion; and reducing medical errors, such as the use of an incorrect device during surgery.

Under the new rules, medical device manufacturers must provide human-readable text and an auto-ID number on the device's packaging label—or, in some cases, on the device itself, if the item is likely to be removed from its packaging, such as an implantable device or an item intended to be used more than once, and that needs to be sterilized prior to each use. The manufacturer can work with standards organizations, such as GS1, to acquire an identifier—for instance, a Global Trade Identification Number (GTIN)— and that ID would then be registered in the GUDID database.

The FDA rules are intended to ensure that a medical device can be identified and used safely. For example, if that device's identifier was entered into the database by a health-care facility's staff, prior to its use, details such as a product recall, or the incorrect make or model for the particular procedure being planned, could be detected. It could also ensure that no counterfeit or diverted product was utilized, since the identifier of a diverted or counterfeit device would not be recognized as valid. In addition, a health-care provider could link specific UDI numbers to a patient's records; however, the UDI database would not store any patient records.

In addition to simply tracking an item prior to its use on a patient, the FDA reports that the UDI system could be employed by other federal agencies as well—including the Centers for Disease Control and Prevention and the Department of Homeland Security—to manage stockpile inventory and for a variety of other purposes, such as identifying similar devices in the event of a shortage.

An amended version of the Food and Drug Administration Safety and Innovation Act (S. 3187) passed the Senate last month, and currently awaits President Obama's signature. If passed, it would require that some Class II items—life-sustaining devices, such as cardiac implants—meet UDI regulations within two years, rather than the FDA's proposed three-year time period.

Crowley speculates that the rules will not prove surprising for most of those in the medical device industry who have been following its development. However, he adds, the list of exceptions—devices that may not require labeling—is broader than initially anticipated. The proposed rules exempt devices sold at retail establishments, as well as those delivered directly to hospitals or health-care facilities.

Following the UDI ruling, the agency also plans to continue following the work underway within the pharmaceutical industry, with regard to creating electronic pedigree (e-pedigree) systems to help track a product through the supply chain, thereby reducing the incidence of product counterfeiting or diversion. "Once the UDI is up and running," Crowley states, "I fully expect us to examine e-pedigrees." At present, California is the only state that has issued e-pedigree requirements for tracking pharmaceuticals, however, with a phased-in approach targeted to take place from 2015 to 2017. The FDA could opt to issue its own pharmaceutical e-pedigree regulations that would supersede those in California.

In September of this year, the FDA will host a conference at which members of the industry are invited to learn more about the UDI system. "It gives us the opportunity to explain the proposed rule and answer any questions people may have," Crowley says. The date and location of the conference have yet to be determined.

-RFID Journal