Post-Market Surveillance (PMS) and Vigilance: US & EU Guide

According to the EU MDR, post-market surveillance (PMS) is the “proactive, systematic activities carried out by manufacturers in cooperation with other economic operators to collect and review experience gained from their devices to identify any need to immediately apply any necessary corrective or preventive actions.” The IVDR uses a similar definition. PMS is essential because it’s a regulatory obligation in most device markets around the world. It’s also a critical risk management mechanism, as it allows manufacturers to monitor the safety and performance of their device, identify new hazards or risks, and understand how the device is being used in the field. A well-designed PMS system can also bring opportunities to the surface by uncovering new uses and applications for your product. 

Vigilance and post-market surveillance are sometimes used interchangeably. However, vigilance is a PMS mechanism for reporting serious adverse events or incidents involving your device. Vigilance is a requirement in the US and Europe, though the timelines and circumstances differ considerably.  

If you are still in the submission preparation phase, it might seem like you have plenty of time to worry about PMS. But it’s essential to begin planning your PMS approach early in the regulatory process. In this article, we’ll review PMS requirements for medical devices in the US and Europe, so you know what to expect in these major markets. 

PMS and Vigilance Reporting Requirements Under US FDA

FDA’s post market surveillance requirements for Class II and III devices are addressed in 21 CFR Part 822 – Post market Surveillance.

Part 822 applies to devices that meet these criteria: 

• • Failure of the device would be reasonably likely to have serious adverse health consequences;  
  • Device is intended to be implanted in the human body for more than 1 year; 
  • Device is intended to be used to support or sustain life and to be used outside a user facility; or 
  • Device is expected to have significant use in pediatric populations. 

FDA will send you a post market surveillance order if your device requires PMS. The letter may come at difference times in the clearance process, depending on when FDA determines the PMS requirement. You might receive the order following FDA’s review of your marketing submission or not until your device has been on the market for some time. Once you receive the order, you must file a Post market Surveillance Plan within 30 days. Surveillance must begin device within 15 months of the date the order was issued in accordance with your approved plan. The required surveillance period could be as long as 36 months. 

What to Include in an FDA PMS Plan?

Thirty days isn’t a lot of time to plan your PMS approach. It’s advisable to begin planning PMS strategies well in advance if your device fulfills FDA criteria for PMS. Keep in mind that your PMS Plan must respond to the surveillance question posed in the PMS order. If the question is in response to an unforeseen adverse event, it may be difficult to fully prepare in advance.  

Your submission must include basic administrative information, such as your company name, address, and contact information, FDA product codes, device description, indications for use and claims, etc. The PMS Plan will make up the bulk of the submission content.

Here’s a short list of points to cover: 

• • Plan objectives 
  • Surveillance approach and methodology 
  • Study subjects and sample size 
  • Clinical parameters or outcomes 
  • Data sources 
  • Surveillance monitoring procedures 
  • Planned data analyses and tests 
  • Report content and timing 

The most important thing to address is the FDA’s surveillance question post in the PMS order. As FDA reviews your submission for completeness and approval, they will be looking for evidence that your plan will gather sufficient quality data to address the concern in their initial order. 

Vigilance Reporting for Medical Device Manufacturers Under US FDA

Medical Device Reporting (MDR) requirements are addressed in 21 CFR Part 803. Requirements and timelines vary based on your role, i.e., if you are a manufacturer, distributor, importer, or device user facility. In this section, we’ll focus on requirements for manufacturers.

In short, manufacturers have 30 days to submit an adverse event report from the date they “become aware” that a device they market: 

1. May have caused or contributed to a death or serious injury, or 

2. Has malfunctioned in such a way that could potentially cause a death or serious injury. 

Your adverse event report must include all information that is “reasonably known” to you as well as the minimum information required for an individual adverse event report, which is extensive. If you obtain new information, you must submit a supplemental report. You are also required to conduct an investigation to analyze the root cause of the event. 

PMS and Vigilance Reporting for Medical Devices in the European Union (EU)

Manufacturers selling in the US should prepare to comply with vastly different PMS requirements in Europe. The EU Medical Devices Regulation (EU MDR 2017/745) emphasizes lifecycle risk management in nearly every aspect of the regulation. PMS is no exception.  

Many companies who transitioned to the MDR from the Medical Device Directive (MDD) are still grappling with the MDR’s more rigorous post market surveillance requirements. MDR also introduced reporting processes that are mirrored in the IVDR, which can be found in Chapter VII of both regulations.  

Early planning and preparation for PMS activities is not just essential in Europe, it’s required. All devices and IVDs must submit a PMS plan with their technical documentation. Like the PMS plan in the US, the MDR’s PMS Plan should convey, in detail, your PMS approach. However, instead of addressing a specific post market concern addressed by the regulator, your EU PMS Plan must be holistic in its scope and take into account that your PMS activities must continue throughout the device’s lifecycle.

Annex III of the MDR itemizes a detailed list of points to cover in your PMS Plan, including: 

• • Methods for proactive and systemic data collection 
  • Methods and processes for assessing data 
  • Indicators and values used to reassess the risk-benefit analysis 
  • Methods for investigating complaints and field experience 
  • Protocols used to analyze the frequency and severity of incidents 
  • Communication methods  
  • Procedures for identifying and implementing responses to incidents 
  • Device identification and traceability 
  • Post market Clinical Follow-up (PMCF) Plan or justification for abstaining from PMCF 

Annex III also specifies the types of post market data manufacturers should include in their PMS activities, such as information concerning serious incidents and non-serious incidents or side-effects; relevant technical literature, databases or registers; feedback and complaints provided by users, distributors and importers; and publicly available information about similar medical devices.  

What is PMCF for Medical Devices?

Post-market Clinical Follow-up (PMCF) refers to the continuous process in which a manufacturer proactively collects and evaluates clinical data, which may include conducting post-market clinical investigations. PMCF is considered a general obligation but some types of PMCF activities and data collection may not be necessary for all device types and classifications. If your device is very low risk, you may make a convincing case that your device does not require PMCF. Nevertheless, a PMCF Plan is required as part of your PMS Plan.  

PMS and Reporting Requirements Under the EU MDR

Once your device is on the market and your PMS activities are underway, you are required to submit a number of reports at regular intervals. Your device classification and characteristics (e.g., is it implantable, etc.) will dictate the types of reports you must submit and the frequency. For instance, Class I devices must follow their PMS Plan with a PMS Report, which should be updated as needed.  

Class IIa devices and above must prepare a Periodic Safety Update Report (PSUR) in lieu of the PMS Report. Class IIa devices should update their PSUR at least every two years while Class IIb and III devices must update them annually. The PSUR and PMS Report both summarize conclusions from PMS data analysis, while the PSUR covers some additional requirements, such as revised benefit-risk determination, key PMCF findings, sales volume, etc. Both documents are part of your technical documentation. 

Class IIa and IIb implantable devices and all Class III devices must also maintain a Summary of Safety and Clinical Performance (SSCP). The SSCP is primarily used by healthcare professionals and patients. It provides an overview of the device’s safety, performance, and clinical data. 

Vigilance Reporting Requirements for Medical Devices Under the EU MDR

Vigilance requirements are addressed in Chapter VII, Section 2 of the EU MDR. The Medical Device Coordination Group (MDCG) document “Questions and Answers on vigilance terms and concepts as outlined in the Regulation (EU) 2017/745 on medical devices” is extremely useful when applying MDR’s requirements and timelines to the myriad scenarios that may require vigilance.  

For instance, the difference in severity between an “incident” and a “serious incident” carries many implications for manufacturers. An “incident” is any malfunction or deterioration in performance of a device (including those caused by ergonomic use errors or insufficient information supplied by the manufacturer) and any side effects. Incidents do not require reporting to Competent Authorities but do require documentation and consideration within your QMS.  

A serious incident, however, is any event involving your device that directly or indirectly led (or may lead) to the death of a person, the deterioration in the health of a person, or poses a serious public health threat. Serious incidents must be reported to regulatory authorities “without undo delay.” 

While there are many circumstances that could affect the reporting requirements for an incident involving your device, in general, reporting timelines for serious incidents are as follows: 

• • Within 15 days: Serious incidents that do not involve a death or an unanticipated serious deterioration in a person’s health but may lead to the death or unanticipated serious deterioration of health, must be reported (a) immediately after the causal relationship to the device is confirmed or suspected and (b) no later than 15 days after the awareness date. 
  • Within 10 days: Serious incidents that resulted in the death of a person or an unanticipated serious deterioration in a person’s health must be reported (a) immediately after the causal relationship to the device is confirmed or suspected and (b) no later than 10 days after the awareness date. 
  • Within 2 days: Serious public health threats must be reported immediately and no later than 2 days after the awareness date. 

It is worth noting that an incident should be investigated for its potential to cause a serious incident. If the latter is deemed a possible scenario, you should report the incident according to the appropriate vigilance timeline. Timelines are calculated in calendar days and include weekends and holidays as well as working days. 

Optimizing Post-market Surveillance and Vigilance

Post market surveillance is a significant undertaking that requires planning and preparation, particularly in Europe. Manufacturers must strike a balance between fulfilling regulatory obligations and getting the most out of your PMS processes. Working with an expert to understand your PMS requirements and design an effective strategy can ensure your PMS system is an asset to your company. MedEnvoy’s team of consultants has expertise in US and EU PMS requirements. We are ready to help, contact us today. 

Related resources: