Medical Device Tracking—How It Is and How It Should Be

In 2007, Congress mandated that medical device manufacturers create a unique identifying number for each of their products that was similar to a vehicle identification number on automobiles.¹ Work to implement the law did not begin until in 2012, when Congress added a deadline. In 2013, the US Food and Drug Administration (FDA) adopted the final rule.²

Currently, device manufacturers must include a unique device identifier (UDI) on the label of all implantable and life-supporting/life-sustaining medical devices. By September 2022, the UDI will also be required for lower-risk, nonimplantable devices. The UDI is meant to be readable by people and also scannable; it contains up to 62 data elements, such as the company name, device name, and model number.³ This information is stored in the Access Global Unique Device Identification Database (AccessGUDID), a free, publicly available database maintained by the FDA.

As previously observed, the UDI system for medical devices has “remarkable potential to improve the data about devices available to physicians and to improve clinical care.”⁴ For example, if fully integrated into the infrastructure of the health care system, the data elements can automate decision supports about whether a device has expired, been recalled, or could affect patient care because it contains latex or is not magnetic resonance tomography–compatible.

In December 2019, more than 600 000 unique users downloaded UDI data from AccessGUDID.⁵ However, there are many gaps in this tracking system that confound its fundamental purposes. For example, although electronic health record (EHR) vendors are required to include the ability to record the UDI to meet certification requirements, the recording of data has varied substantially among health systems. Currently, the most widely available method for identifying the patients who received a device implant is through standardized electronic health care claims payment forms; however, the UDI is not used in these records. In 2017, X12, the group that administers these forms, indicated its intention to add a UDI field for implanted devices. However, 3 years later, the field has yet to be finalized and implemented.⁶ Moreover, once the UDI field is finalized, regulations from the US Centers for Medicare & Medicaid Services (CMS) will be needed before physicians and health care facilities can be required to use it.

The AccessGUDID database contains limited information about the materials in medical devices, such as in implantable staples and transvaginal mesh. From the database, health care personnel can quickly identify safety information for a device that contains latex and that should not be used in patients with a latex allergy. Yet other substances that commonly cause allergic or immunologic reactions, such as cobalt-chromium and nickel, are not included. Some device manufacturers have claimed that the chemical makeup of a silicone breast implant or the coating on a cardiac stent are trade secrets. As the information is important for public health, the FDA should require that information about the chemical makeup of devices (for instance, whether nickel or cobalt is contained in a titanium hip alloy) be included in the database. The agency should not protect the materials used in implanted medical devices as trade secrets.

The UDI is also inconsistently included in adverse event reports or recalls. In 2019, the FDA received approximately 1.2 million adverse event reports for medical devices, which were mostly from device manufacturers and hospitals; however, fewer than 21 000 of these reports (1.6%) contained the UDI.⁷ Although entering the UDI on the adverse event form is important for accurately identifying the device, the FDA does not require this information. If a device cannot be readily identified or tracked, especially when it has already been implanted, reporting patient harm that was caused by that specific device is even more difficult. If a device is recalled, accurate identification is also important to link the recalled device to patients and inventory. Yet, only about 10% of device recalls reported by manufacturers include the UDIs. The lack of clear and complete information about the UDI impedes the effective management of device recalls.^8,9 The FDA should require manufacturers to include information about the UDIs on all reports to the agency about specific devices as well as on recalls.

Although adverse event reports rarely include the UDI, an associated problem is that when the identifier is included, the Freedom of Information Act Office at the FDA redacts it as a trade secret in whole or in part in 84.5% of adverse event reports.¹⁰ This lack of transparency in adverse event reports prevents the specific identification of a device. As the UDI should never be considered a trade secret, the FDA should immediately stop redacting the information from adverse event reports.

Transparency about the UDI is an important concern for patients, health care professionals, and all systems that track device safety. The FDA should do more to strengthen the value of the UDI. For example, the FDA should attach or require manufacturers to attach documents to the UDI record in AccessGUDID, including a device’s instructions for use, material safety data sheet, and, when applicable, a black box warning about safety.

A final concern is that hospitals are not using the UDI effectively. Currently, the UDI record contains a commercial distribution end date for a device. Hospitals could use the end date to help prevent shortages or the use of devices that may no longer be marketed because a newer version is available. In addition, the capture of the UDI for devices that are reused in patient care, such as duodenoscopes, ventilators, and the heater coolers for open-heart surgery, could help identify a device that may have contributed to an outbreak of infections on a hospital ward or at a surgical facility. Documenting the UDI of reusable devices can help hospitals, as well as state and federal officials, track the chain of custody. Currently, when there is an extensive infectious disease outbreak and the serial number of the contaminated device has not been recorded in the patient’s EHR, hundreds if not thousands of potentially affected patients have to be contacted.

The UDI for medical devices is very useful. It should be adopted in additional areas of health care, including supply-chain tracking for devices, the patient’s medical record, and for identifying all the costs associated with using a device. For example, when a device fails or is recalled, associated costs, such as explanting the device, should be considered in addition to the cost of the device itself.

To our knowledge, in the US, there is no national, publicly accessible registry for tracking postmarket experiences with medical devices. As a rigorous testing process before FDA approval or clearance is lacking for most devices, postmarket tracking is essential. Numerous private device registries use the UDI to monitor long-term outcomes for breast implants, cardiac pacemakers, implantable defibrillators, and other devices. However, participating physicians may not be able to view each other’s submissions, and nonparticipating physicians cannot view submissions. The data are proprietary and not publicly available. Congress should authorize the infrastructure to create a national and publicly accessible registry that uses the UDI for tracking postmarket medical outcomes and safety.

The rollout of the UDI label on devices is a necessary but not sufficient step for successful use. Until the CMS also facilitates and requires the use of the UDI by clinicians and health care facilities, its full promise for improving device performance and patient safety will not be achieved. Widespread, comprehensive, and transparent use of the UDI by the FDA and CMS and in EHRs, recall alerts, adverse event reports, and claims payment forms will improve the postmarket surveillance of medical devices and public health.

Corresponding Author: Madris Kinard, MBA, Device Events, 1539 Heritage Ln, York, PA 17403 (madris@deviceevents.com).

Published Online: December 16, 2020. doi:10.1001/jamainternmed.2020.7797

Conflict of Interest Disclosures: Ms Kinard reported being the owner of Device Events, a commercial software tool that identifies patterns of problems with medical devices using publicly available US Food and Drug Administration (FDA) data sources, as well as previous work as a public health analyst for the FDA until 2014 and participation with the American Hospital Association’s Learning UDI Community, which collaborates with health care providers, medical device companies, and other third-party stakeholders to improve UDI implementation. Ms McGiffert reported employment with Consumer Reports through May 2018 as the director of the Safe Patient Project.