United States: Medical Devices & Consumer Health Products 2022

Law and Practice

1. Applicable Product Safety Regulatory Regimes

1.1 Medical Devices

The Federal Food, Drug, and Cosmetic Act (FDCA) and the Public Health Service Act (PHSA) are the two key statutes governing the development, manufacturing, distribution, registration, licensing, clearance and approval of such products in the USA. The US Food and Drug Administration (FDA) is the federal administrative agency with primary authority for ensuring such products are safe and effective for their intended uses by enforcing the FDCA. The FDA issues regulations and guidance documents further detailing and interpreting requirements of the FDCA. The relevant regulations are located in Title 21 of the US Code of Federal Regulations.

The Federal Trade Commission (FTC) is the primary federal agency responsible for policing unfair, deceptive and anti-competitive advertising, and other business practices, including in the medical products industry. Through a Memorandum of Understanding, and as discussed further, the FDA and FTC share jurisdiction over the regulation of medical devices and certain other medical products. The FTC's primary statutory authority is the US Federal Trade Commission Act, which, among other things, prohibits unfair or deceptive advertising. Numerous states have implemented their own similar consumer protection/unfair or deceptive advertising statutes. Moreover, many states have laws regulating the manufacturing and distribution of prescription medical devices and the storage and distribution of human tissue products.

The FDA regulates products as medical devices based on their "intended use(s)". A product's intended use refers to "the objective intent of the persons legally responsible for the labelling of devices"; see 21 CFR Section 801.4. Such objective intent can be shown by, among other things:

• labelling claims;
• advertisements;
• oral or written statements by a manufacturer or its representatives; and
• circumstances surrounding a product's distribution.

The FDCA defines a "device" to mean, in relevant part, an "instrument, apparatus, implement, machine, contrivance, implant in vitro reagent or other similar or related article, including any component, part, or accessory [that is] (1) intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man or other animals, or (2) intended to affect the structure or any function of the body of man or other animals, and which does not achieve its primary intended purposes through chemical action within or on the body of man or other animals and which is not dependent upon being metabolized for the achievement of its primary intended purposes"; see 21 USC Section 321(h).

Where a product falls within the scope of this statutory definition, the FDA may regulate such product as a medical device under the FDCA. In certain instances, the FDA has authority to exert "enforcement discretion" – that is, authority to not enforce some or all FDCA requirements against manufacturers of products which meet the definition of a medical device but which the FDA believes pose a low risk of harm to patients, either because of regulation through a parallel or complementary regulatory regime (such as in the case of certain in vitro diagnostic tests) or due to the inherent properties of the product (such as clinical decision support software which uses transparent, easy-to-understand inputs and outputs to assist a physician to track a patient's disease symptoms). The FDA can apply its device authorities to software-based products, including artificial intelligence-enabled software, that meet the statutory definition of a "device" as further discussed in 1.3 New Products/Technologies and Digital Health.

The FDA applies a risk-based classification to its regulation of medical devices. This means that a particular device's classification dictates the requirements applicable to its development, manufacture and commercialisation. The FDA places devices into three classes based on their risk.

Class I devices present the lowest level of risk and are those for which general controls (ie, basic FDA device authorities) are sufficient to provide reasonable assurance of such devices' safety and effectiveness.

Class II devices present a medium level of risk and are those for which general controls alone are not sufficient to provide reasonable assurance of such devices' safety and effectiveness, and for which there is sufficient information to establish special controls (ie, additional FDA device authorities, including performance standards) to provide such assurance.

Class III devices present the highest level of risk and are those that support or sustain human life, are of substantial importance in preventing impairment of human health, or which present a potential, unreasonable risk of illness or injury.

1.2 Healthcare Products

The FDA also regulates cosmetics and food, including dietary supplements, under the FDCA. Although these products generally do not require pre-market approval or clearance, except for certain additives, they must comply with applicable labelling and promotional requirements and must not be manufactured in a manner that renders them adulterated (eg, contaminated). Such products must also be safe for human use. The US Environmental Protection Agency (EPA) generally regulates biocides under the Federal Insecticide, Fungicide, and Rodenticide Act (FIFRA), which requires, among other things, the registration of biocides and their manufacturing facilities. Depending on their intended use, however, biocides may also fall under FDA jurisdiction in certain instances.

1.3 New Products/Technologies and Digital Health

Certain digital health technologies, such as medical apps, telemedicine platforms, and wearables, may be subject to regulation under the FDCA if they meet the definition of a medical device as discussed in 1.1 Medical Devices. As a result of the passage of the 21st Century Cures Act in December 2016, the FDCA statutorily excludes software functions from the medical device definition, under 21 USC Section 360j(o), that are intended:

• for administrative support of a healthcare facility;
• for maintaining or encouraging a healthy lifestyle and are unrelated to the diagnosis, cure, mitigation, prevention or treatment of a disease or condition;
• to serve as electronic patient records provided certain conditions are met;
• for transferring, storing, converting formats or displaying clinical laboratory test or other device data and results; or
• to serve as clinical decision support unless the function is intended to acquire, process, or analyse a medical image or a signal from an in vitro diagnostic device or a pattern or signal from a signal acquisition system and provided certain conditions are met.

In addition, the FDA is currently exercising enforcement discretion for certain software functions that may constitute medical devices as defined by the FDCA but are deemed by the FDA to be low risk. Specifically, the FDA is exercising enforcement discretion for software functions that help patients self-manage a disease or condition without providing specific treatment recommendations or treatment and software functions that automate simple tasks for healthcare providers. Manufacturers of these products are encouraged to seek guidance from the FDA through various administrative meeting and feedback mechanisms, such as the "pre-submission" meeting process and "request for classification" process.

1.4 Borderline Products

As a consequence of the broad definition of "device", many types of products fall within FDA jurisdiction. As noted, in some cases, the FDA has elected to exercise enforcement discretion. In others, fulfilment of FDA requirements, such as those governing manufacturing quality standards, may make reference to other regulatory or quasi-regulatory regimes. For example, while respirator particulate filtration claims are subject to the National Institute for Occupational Safety and Health and other non-FDA standards, these products are considered medical devices when marketed for a medical purpose, such as mitigation of airborne pathogens, and must go through the same registration, clearance, or approval pathway as other devices.

2. Commercialisation and Product Life Cycle

2.1 Design and Manufacture

Domestic and foreign establishments engaged in the manufacture, preparation, propagation, compounding, assembly and/or processing of a medical device must register with the FDA and list such device with the FDA. The FDA has jurisdiction over any establishment that is engaged in these activities for a medical device intended for the US market regardless of its location in the world. Examples of such establishments include:

• specification developers;
• contract manufacturers and sterilisers;
• repackagers and relabellers; and
• initial importers of medical devices into the USA.

Generally, establishments must register and list their devices with the FDA no later than 30 days after engaging in any of the above activities. However, foreign establishments must register and list their devices prior to exporting such devices to the USA. Similarly, domestic importers must register with the FDA prior to importing devices. These initial importers must have a physical address in the USA and are responsible for ensuring that imported devices comply with FDA requirements. In addition, foreign establishments must designate, and submit to the FDA, the information of a US agent that resides or maintains a place of business in the USA.

Typically, the initial importer is also the importer of record from a US customs perspective and is generally the party responsible for ensuring that medical devices or device components imported into the USA are properly labelled and meet relevant customs requirements. The FDA has joint review authority with US Immigrations and Customs Enforcement (ICE) to review and inspect shipments of suspected medical devices or device components intended for distribution within the USA.

Establishments must re-submit their registration and listing information on an annual basis between 1 October and 31 December. Establishments may also update such information at any time. Certain changes, however, must be updated no later than 30 days after their occurrence, such as changes to the establishment's name, mailing address and trade name. The failure to comply with these registration and listing requirements results in a device being misbranded.

Unless specifically exempt based on the specific product classification regulation or an FDA enforcement discretion policy, manufacturers of devices must comply with current good manufacturing practice (cGMP) requirements, known as the quality system regulation (QSR). The QSR sets forth cGMP requirements for devices which govern "the methods used in, and the facilities and controls used for, the design, manufacture, packaging, labelling, storage, installation, and servicing of all finished devices"; see 21 CFR Section 820.1(a).

The QSR applies to manufacturers of devices, meaning those that engage in the design, manufacture, fabrication, assembly or processing of a finished device. Although the QSR is broad in scope, a manufacturer only needs to comply with the provisions of the QSR that apply to its particular operations. In addition, a regulated firm may delegate certain aspects of QSR compliance to another party by written agreement; however, it remains responsible for its share of any regulated activity. The manufacture of a device in violation of the QSR renders it adulterated. In addition to complying with the QSR, manufacturers may also employ FDA-recognised consensus standards relating to, among other things, the performance, safety and other characteristics of a device, which can facilitate the pre-market review process discussed in 2.4 Marketing and Sales.

A fundamental QSR requirement is that a manufacturer maintains a quality management system (QMS) appropriate for the devices it manufactures, and that it complies with the QSR. Management must be involved in the oversight and review of the QMS and establish and implement an overarching quality policy. In addition, a manufacturer must have an appropriate quality organisation with sufficient resources. The head of a manufacturer's quality department must also have sufficient authority, and support from management to run an effective QMS free from undue commercial influence. Manufacturers must also establish procedures for, and routinely conduct, quality audits and take appropriate corrective action. The QSR requires manufacturers to have sufficient quality personnel with the necessary education, background, training and experience, and to implement procedures for, and conduct, training.

The QSR also requires manufacturers to establish and maintain procedures to control the design of the device to ensure that specified design requirements are met. This particular QSR provision has been used by the FDA to address the emerging role of software in devices. Manufacturers must also establish and maintain procedures to control all quality documents, to ensure that all purchased or otherwise received products and services conform to specified requirements, and to identify products during all stages of receipt, production, distribution and installation. Manufacturers must develop, conduct, control and monitor production processes to ensure that a device conforms to its specifications and establish and maintain process control procedures.

Each manufacturer must also ensure that all inspection, measuring and test equipment is suitable for its intended purposes and capable of producing valid results. The QSR also requires manufacturers to establish and maintain procedures to ensure that equipment is routinely calibrated, inspected, checked and maintained, and implement and follow procedures for acceptance activities. Procedures must also be implemented for control of non-conforming products, implementing corrective and preventative actions, control of labelling activities, and the handling and storage of products.

The QSR also imposes various record-keeping requirements on manufacturers. Records must be obtained at the manufacturing establishment or another location that is reasonably accessible to the manufacturer's responsible officials and FDA inspection personnel. Manufacturers must also maintain device master records for each device, as well as device history records for each batch/lot/unit of devices manufactured. The QSR also requires manufacturers to maintain a quality system record and complaint files. Manufacturers must establish and maintain procedures for receiving, reviewing and evaluating complaints by a formally designated unit. Finally, establishment of a corrective and preventative action planning process is an essential part of a QMS.

2.2 Corporate Social Responsibility, the Environment and Sustainability

The FDA does not directly regulate corporate social responsibility, the environment or sustainability throughout the product life cycle, although rarely an environmental assessment can be required in certain regulatory scenarios. However, the EPA at the federal level and state and local agencies govern the disposal of certain medical waste and manufacturing facilities. Such requirements may include obtaining appropriate licences and permits and conducting testing. These authorities generally apply to medical device and consumer health product manufacturers to the extent they generate regulated waste or other regulated substances in their operations.

2.3 Advertising and Product Claims

Device manufacturers are responsible for ensuring that a device's label and labelling comply with the FDCA and are otherwise consistent with its 510(k) clearance or pre-market approval, each of which are discussed in 2.4 Marketing and Sales. A device's label is any written, printed or graphic matter displayed upon its immediate container; whereas, a device's labelling broadly refers to any labels and other written, printed or graphic matter on the device or any of its containers or that otherwise accompany the device. Labelling is broadly construed to include any material that has a textual relationship to a device, including user manuals, instructions for use, sales brochures and information on product websites.

The FDA has promulgated specific requirements for device labels and labelling. For example, a device's label must specify the name and address of the manufacturer, packer or distributor and contain a unique device identifier. In addition, a device's labelling must be adequate for its intended use, provide adequate directions for use, and cannot be false or misleading in any particular. Product labelling claims must generally be substantiated by the same level of evidence required for FDA clearance or approval of those claims. For Class I and II devices, the FDA and FTC essentially share the same standard of evidence for claim substantiation, although the FDA has more detailed guidance and requirements for the kinds of clinical and non-clinical data that a manufacturer must collect and submit to support clearance/approval and subsequent promotional labelling claims.

In 2018, the FDA issued guidance clarifying that manufacturers may make claims in labelling or advertising which is consistent with their cleared or approved labelling and scope of authorised intended uses so long as those claims are substantiated, do not raise new or significant safety issues, and do not represent a material departure from the scope of approval, as detailed in the guidance.

The FDA has long recognised that certain types of communications will not, as a matter of FDA enforcement policy, be used as evidence of a product's intended use or subject to promotional requirements. Generally, to fall within this category of communications, known as "scientific exchange", a communication must be objective and medical/scientific in nature, delivered in a non-promotional setting/context, and delivered by non-promotional personnel (eg, medical affairs). Examples of such communications include medical/scientific peer-reviewed publications, presentations of clinical data at scientific conferences, responses to unsolicited requests for medical information, certain information regarding unapproved/uncleared products or uses provided to payors, and institutional review board (IRB)-approved clinical trial recruitment materials.

As noted in 1.1 Medical Devices, while the FDA has primary jurisdiction over and sets the standards for device labels and labelling, the FTC has primary jurisdiction over advertising. As a threshold matter, any advertising or promotional claims of a device must be consistent with its labelling and 510(k) clearance or pre-market approval and be truthful and non-misleading, including disclosing material limitations and risks and being substantiated by the appropriate level of scientific evidence. Specific FTC regulations and guidance govern the evidence required to substantiate device performance claims, safety and efficacy claims, and endorsements or testimonials given by product users or prescribers. The FTC requires medical product safety or efficacy claims to be substantiated by competent and reliable scientific evidence. Additionally, the FTC issued the Green Guides, codified at 16 CFR Part 260, which provide guidance on, among other things, general principles for environmental marketing claims, substantiating particular claims, and qualifying claims to avoid deceiving consumers. This includes guidance on using product certifications/seals of approval, carbon offset claims, and claims about renewable materials and energy.

The FTC, as well as state attorneys general and, in certain instances, competitors or consumers, all have standing to bring suit against a medical device company that engages in false, deceptive, disparaging or misleading advertising practices. Even where promotional claims are consistent with a broad/general indication, however, claims should not detail a more specific indication that may, among other things, presume a specific clinical outcome or provide a new type of diagnostic information that significantly impacts patient management. Failure to comply with advertising requirements renders a device misbranded and is a common area of enforcement and scrutiny by the FDA, the FTC, other federal and state agencies, competitors and other private litigants. Consequently, US regulatory and enforcement authorities expect companies responsible for product labelling and promotion to review product claims (such as advertising materials, sales representative field materials, and websites) for consistency with applicable FDA and FTC requirements prior to use.

2.4 Marketing and Sales

Generally, Class I devices do not require a pre-market clearance or approval unless otherwise specified in the applicable classification regulation. Class II devices generally require pre-market clearance through the submission of a 510(k) pre-market notification upon a determination of "substantial equivalence" to a legally marketed predicate device. If an appropriate predicate does not exist, a device would be considered a Class III device (requiring a pre-market approval), unless down-classified to Class II or Class I via a de novo submission. The de novo process is a risk-based classification process in which the FDA will make a risk-based evaluation as to whether the device can be classified into Class I or Class II. Class III devices require a pre-market approval (PMA) prior to commercial distribution. The PMA process, which often requires demonstration of safety and efficacy for the proposed intended use, is a more rigorous and lengthy process than pre-market clearance and generally requires the sponsor to conduct clinical trials.

Manufacturers must submit a 510(k) to the FDA at least 90 days prior to the initial marketing of a device, making a change or modification to a cleared device that could significantly affect the safety or efficacy of the device, or making a major change or modification to the intended use of a previously cleared device. A 510(k) is a pre-market notification intended to demonstrate that the device, or change or modification, is substantially equivalent to a predicate device (ie, a device that is already legally marketed because it was on the market prior to 28 May 1976 and does not require a PMA, or because it was found to be substantially equivalent to another device, or because it was reclassified by the FDA from Class III to II).

A device is considered substantially equivalent to a predicate device if: (i) it has the same intended use and technological characteristics as the predicate; or (ii) it has the same intended use as the predicate but different technological characteristics that do not raise different questions of safety and effectiveness, and the information submitted to the FDA demonstrates that the device is as safe and effective as the predicate device. If the FDA finds that the 510(k) demonstrates that the device, or change or modification, is substantially equivalent to the predicate device, it will "clear" the device for marketing. The FDA will notify the 510(k) applicant within 15 calendar days of receiving the submission on whether the 510(k) was accepted for substantive review. The FDA's goal is to reach a decision on the 510(k) within 90 calendar days of receiving the submission.

PMA approval, on the other hand, is based on a determination by the FDA that the PMA contains sufficient and accurate scientific evidence demonstrating a reasonable assurance that the device is safe and effective for its intended use(s). This applies to initial product approval as well as subsequent new intended uses and certain changes or modifications. The FDA's goal is to reach a decision on a PMA within 180 days after receipt of a PMA that it accepts for filing and to which the sponsor does not submit a major amendment. PMAs must include, among other information, clinical and non-clinical data, and often require sponsors to conduct their own clinical studies.

Before conducting clinical studies in support of a PMA, the sponsor must comply with the investigational device exemption (IDE) standards at 21 CFR Part 812, which govern clinical and non-clinical data collection. An IDE allows the investigational device to be used in a clinical study in order to collect necessary data, including on the device's safety and effectiveness, so long as certain regulatory standards, including protections for the health, safety and welfare of clinical trial subjects are met. The IDE regulations apply to all clinical evaluations of investigational devices, unless exempt; however, submissions to the FDA are only required for significant risk studies. An IDE will go into effect 30 days after the FDA's receipt of the application unless the FDA notifies the sponsor that the investigation cannot begin.

2.5 Internationalisation

A variety of factors over the past several decades have contributed to device manufacturers moving their physical manufacturing operations abroad, although the USA market remains a key commercial focus. Such factors include:

• changes to the US tax code that no longer advantaged domestic manufacturing;
• lowering production costs;
• increasing productivity;
• reducing environmental-related liabilities;
• finding suitable locations for large-scale manufacturing facilities; and
• growth of ex-US markets.

Even where products are produced oversees, they must meet applicable FDA requirements in order to enter, and remain on, the US market.

The FDA actively co-ordinates with foreign regulatory authorities, especially as part of international harmonisation efforts. In particular, the FDA frequently collaborates with the EU's European Medicines Agency, the UK's Medicines and Healthcare products Regulatory Agency (MHRA), and Japan's Ministry of Health, Labour and Welfare (MHLW) and Pharmaceuticals and Medical Devices Agency (PMDA) to help establish international harmonised standards.

The FDA also participates in the Medical Device Single Audit Program (MDSAP), which permits an MDSAP-recognised auditing organisation to conduct a single regulatory audit of a medical device manufacturer that satisfies the requirements of MDSAP-participating regulatory authorities. The FDA accepts MDSAP audit reports in lieu of routine surveillance inspections. In addition to the FDA, MDSAP members are currently:

• the Therapeutic Goods Administration of Australia;
• Brazil's Agência Nacional de Vigilância Sanitária;
• Health Canada; and
• Japan's MHLW and PMDA.

2.6 Post-marketing Obligations, Including Corrective Actions and Recalls

Device manufacturers must comply with requirements governing field corrective actions and safety reporting. Due to public health implications, these requirements are generally subject to increased FDA scrutiny. Failures to timely recall or correct defective products, and to notify the FDA of this, are often the focus of product liability plaintiffs who seek to establish knowledge of a safety issue and the failure to meet a duty of care by the manufacturer. Such failures may also lead to the FDA conducting a "for cause" inspection.

Device manufacturers (ie, persons or entities that manufacture, prepare, propagate, compound, assemble or process a device) must comply with the FDA requirements regarding medical device reports (MDRs) and reporting certain corrections and removals of medical devices. Under MDR requirements, a device manufacturer must submit reports of individual adverse events to the FDA within 30 calendar days of becoming aware of a reportable death, serious injury or malfunction. Manufacturers must also submit reports of individual adverse events to the FDA within five working days after becoming aware of a reportable event that requires remedial action to prevent an unreasonable risk of substantial harm or for which the FDA has made a written request. Reportable events are generally those that reasonably suggest a device may have caused or contributed to a death or serious injury or involve malfunctions that would likely cause or contribute to a death or serious injury.

In addition to these reporting requirements, manufacturers must develop and implement written MDR policies and procedures regarding, among other things, the identification, communication and evaluation of events. Manufacturers must also abide by documentation and record-keeping requirements for MDRs.

Manufacturers must also submit reports to the FDA regarding any correction or removal of a device that it initiates to reduce a risk to health posed by the device or to remedy a violation of the FDCA caused by the device and which may present a risk to health. Manufacturers must submit such reports to the FDA no later than ten working days from initiating the correction or removal. A correction is any repair, modification, adjustment, relabelling, destruction or inspection of a device without its physical removal from its point of use. A removal is the physical removal of a device from its point of use to another location for correction. Even where a correction or removal is not reported to the FDA, a manufacturer must maintain records of such correction or removal.

Device manufacturers maintain primary responsibility for the initiation and conduct of product recalls, market withdrawals and stock recoveries. A recall is where a manufacturer corrects or removes a marketed product that the FDA considers to be in violation of the FDCA and against which the agency would initiate legal action, but does not include a market withdrawal or a stock recovery. A market withdrawal is a manufacturer's removal or correction of a distributed product that involves a minor violation that would not be subject to legal action by the FDA or that involves no violation; a stock recovery is a manufacturer's removal or correction of a product that has not been marketed or that has not left the direct control of the firm (ie, the product remains on premises owned by, or under the control of, the manufacturer and has not been released for sale or use).

Manufacturers may voluntarily initiate recalls of products that violate the FDCA and must notify the FDA accordingly. The FDA will evaluate the health hazard presented by a recalled product by considering, among other things, any harm that may have already occurred, the likelihood of further harm and the seriousness of such harm. Based on this evaluation, the FDA will categorise the recall as:

• Class I – there is a reasonable probability that the use of, or exposure to, a violative device will cause serious adverse health consequences or death;
• Class II – use of, or exposure to, a violative device may cause temporary or medically reversible adverse health consequences or the probability of serious adverse health consequences is remote; or
• Class III – use of, or exposure to, a violative device is not likely to cause adverse health consequences.

Manufacturers must take several actions in connection with a recall, including notifying its direct accounts and other users of the recall, ceasing further distribution of the product, conducting effectiveness checks, preparing status reports and arranging for appropriate disposition of the recalled products. The failure to timely conduct a recall or to notify the FDA can result in violations of the FDCA, including criminal violations if the issue caused a significant risk of patient harm. In addition, recalls often precipitate consumer litigation and requests for refunds.

3. Regulator Engagement and Enforcement

3.1 Regulatory Authorities

See 1.1 Medical Devices.

3.2 Regulatory Enforcement Mechanisms

The FDA oversees manufacturers' compliance with the FDCA medical device requirements in a variety of ways, including routine or for-cause inspections, which are often the product of complaints by customers, competitors or other regulators, reviews or inspections of regulated materials entering the US ports of entry, surveillance of manufacturer websites or presentations at industry conferences, reviews of manufacturer regulatory submissions, and reviews of information received from other agencies such as requests for technical review assistance by the US Securities and Exchange Commission of securities filings describing regulated products.

The FDA may conduct routine or "for cause" inspections. For routine inspections, the FDA will inspect device establishments using a risk-based inspection schedule. The FDA will consider, among other things, the establishment's compliance history, its history of recalls, and the inherent risk of the devices it manufactures. The FDA will generally conduct a for cause inspection following the emergence of a safety signal, complaints by product users, patients, customers or competitors, or field corrective actions, such as recalls. In either case, device establishments must co-operate and comply with such inspections or else they risk the FDA deeming its devices adulterated. Depending on the outcome of the inspection, the establishment may receive an FDA Form 483, detailing inspectional observations. The establishment will need to promptly respond to, and remediate, such observations or risk further agency action.

Where the FDA believes it has identified evidence of a violation of the FDCA, the agency may take a variety of advisory and administrative actions on its own, such as sending the violative firm an Untitled Letter or Warning Letter and requesting corrective action, issuing an import alert, authorising administrative hold or detention of violative products, or working with the Department of Justice (DOJ) to sue to seize products or enjoin certain violative activity. The FDA is generally afforded wide enforcement discretion in determining whether to initiate such actions and which actions to utilise.

Untitled Letters and Warning Letters are usually made public and are followed closely by other regulatory enforcement agencies as well as the plaintiffs' bar; thus, even a resolved Untitled Letter or Warning Letter can result in collateral legal and reputational consequences. In addition to inspectors, the FDA employs criminal investigators through the FDA Office of Criminal Investigations (OCI). The FDA OCI is an expert investigative branch that is authorised to collect and evaluate evidence to determine whether an individual or company may have committed a serious violation of the FDCA. As the FDCA authorises criminal penalties for companies and individuals, the FDA has the authority to refer cases to the DOJ for further investigation and prosecution.

In general, enforcement under the FDCA in the device space tends to involve the following.

• Distribution or sale of a medical device without appropriate clearance, approval, or IDE on file ("pre-approval promotion"); this is a violation of the misbranding and adulteration provisions of the FDCA.
• Promotion of a medical device for an intended use other than the one for which it has been cleared or approved, such as promotion of a device with a broad intended use for a specific disease or organ type ("off-label promotion"). Although the FDA's authority to police truthful, non-misleading statements about off-label efficacy or safety has increasingly been limited by US courts, the agency continues to use evidence of off-label promotion to support enforcement, particularly where there is evidence of patient harm.
• Manufacturing or distribution of a medical device or device component that is not in compliance with the QSR or special controls related to product manufacturing or safety. Such an act is a violation of the adulteration provisions of the FDCA. In addition to failing to comply with the QSR, the FDA may deem devices adulterated for a number of other reasons – for example, failing to produce the product in sanitary conditions or within the specifications required for the device to perform safely and effectively for the uses intended. Others relate to technical but important prohibitions under the FDCA, such as improper refusal of the FDA to inspect a manufacturing facility or changing or altering the physical device packaging without authorisation.
• Failure to timely file accurate required reports, such as MDR reporting, field actions (such as recalls), or other required reports. Failure to file is a separate violation of the FDCA, although such a failure can also be used as evidence of adulteration. False or misleading filings can also give rise to separate violations of US law, including liability for the individual making the false report.

4. Liability

4.1 Product Safety Offences

Committing or causing prohibited acts (ie, violations) under the FDCA is subject to criminal penalties. Criminal penalties are periodically adjusted for inflation and other factors under the Criminal Fines Enforcement Act. As a general matter, such violations are misdemeanours punishable by imprisonment of up to one year and/or a fine of up to USD100,000 per offence for individuals and USD200,000 per offence for corporations. However, subsequent violations, and violations committed with the intent to defraud or mislead, are felonies punishable by imprisonment of up to three years and/or a fine of up to USD250,000 per offence for individuals and USD500,000 per offence for corporations. Generally, the FDA will afford potential violators an opportunity to take appropriate and prompt corrective actions before initiating a criminal prosecution unless the offence presents a danger to health or constitutes an intentional, gross or flagrant violation.

For certain violations of the FDCA, the FDA may seek to impose civil monetary penalties (CMPs). Subject to certain exceptions, the FDA may impose CMPs against any person who violates a requirement of the FDCA relating to devices; these have most often been used in instances where an executive or their company has failed to file required post-marketing device reports. CMPs cannot exceed USD31,076 per violation and USD2,071,819 for all such violations adjudicated in a single proceeding. These CMP amounts are adjusted annually. The FDA will first issue a complaint to the manufacturer against which it is considering issuing CMPs, and the manufacturer can request a hearing on the matter. Additional procedural requirements also apply.

4.2 Product Liability

The USA does not have a comprehensive federal statutory or regulatory regime governing product liability. Rather, each state has its own product liability laws and doctrines derived from statutes or case law. As a result, the precise legal theories available to any given plaintiff depend on which state's law applies. Federal law compliance can be used, in certain instances, as a defensive doctrine by plaintiffs under the argument that federal law pre-empts contrary or less specific state law. The US case law on pre-emption is nuanced and extensive.

In product liability cases, courts typically apply the law of the home state of the plaintiff. Although specifics may differ among the states, the broad principles that govern product liability are generally similar across the USA. It is also important to note that the scope of liability depends significantly on the state in which the litigation proceeds. This is not just the result of different laws, but because the jury pools' and judges' approaches toward product liability litigation differs widely among the states. Frequently, plaintiffs' attorneys seek to bring product liability cases in jurisdictions that have gained reputations for plaintiff-favourable verdicts and/or judges. As a result of this state-by-state variation, a common key dispute in product liability cases is determining the proper location for the litigation to proceed.

4.3 Judicial Requirements

There are several common theories of liability that plaintiffs pursue in medical device litigation across the USA. However, because of the existing FDA regulatory framework governing medical devices, plaintiffs must first overcome the issue of pre-emption, which precludes state product liability suits. The level of protection afforded by pre-emption depends heavily on whether the product is a PMA device or a 510(k) device.

Devices approved under a PMA enjoy robust, though not absolute, protection from product liability suits. Generally, state law claims for negligence, strict liability and implied warranty against the manufacturer of a PMA device are pre-empted except where violations of FDA requirements are alleged. 510(k)-cleared devices enjoy much less protection. However, the US Supreme Court has rejected the broad application of pre-emption to 510(k)-cleared devices because the clearance process instead depends on substantial equivalence vis-à-vis a predicate device and is not a full safety and effectiveness review.

The most common theory of medical device product liability in the USA is "strict liability". Under that theory, one who designs, manufactures or sells a product in a defective condition that caused the product to be unreasonably dangerous to the user or his or her property may be subject to liability for physical harm caused to the user without regard to whether the manufacturer was at fault or engaged in culpable wrongdoing. As a result, a defendant may be held liable under a strict liability theory even if it exercised all possible care in the preparation and sale of the product.

There are three sub-theories of strict liability, as detailed below.

• Design defect: most courts impose liability for design defect if the product could feasibly have been designed in a safer manner. A minority of courts ask instead whether a product is considered defective when it is dangerous to an extent not expected by the ordinary consumer who purchases it.
• Failure to warn: to hold a manufacturer liable for failing to warn of certain risks, the plaintiff must establish that the foreseeable risks of harm could have been avoided by providing reasonable instructions or warnings, and the failure to provide those instructions or warnings makes the product unreasonably dangerous. The adequacy of a product's label or instructions for use is the typical focus of this claim.
• Manufacturing defect: to hold a manufacturer liable for a manufacturing defect, the plaintiff must establish that due to a problem in the manufacturing process, the particular product used by the plaintiff was unsafe because it differed from the manufacturer's intended design.

Under the theory of negligence, the plaintiff must establish that a manufacturer failed to exercise reasonable care in manufacturing, labelling or designing the product. Many jurisdictions impose both strict and negligence-based liability for harm caused by products based on manufacturing defects, design defects and warning defects. Commonly, plaintiffs will assert both strict liability and negligence theories together in the same case.

Most states recognise various causes of action against manufacturers on the basis that they misled consumers about the safety of their products. "Common-law fraud" generally requires the plaintiff to prove that a misrepresentation was made with knowledge of its falsity with an intent to defraud, that the plaintiff justifiably relied on that misrepresentation, and that the plaintiff suffered damage as a result.

"Negligent misrepresentation" is similar but requires only that the defendant should have known of the falsity rather than having actual knowledge of such falsity. As referenced in 1.1 Medical Devices, many states have enacted consumer protection statutes under which plaintiffs may bring consumer fraud actions. Such statutes generally prohibit false advertising and/or deceptive acts or practices and include special remedies such as multiple damages or recovery of attorneys' fees.

Most states also provide a cause of action against manufacturers for breach of express warranty where the manufacturer has made a representation about the product's performance or safety that is alleged to be untrue. Plaintiffs often bring express warranty claims along with one or more of the fraud-based theories discussed above.

"Implied warranty" is also a viable theory of liability in many jurisdictions. To hold a manufacturer liable for breach of implied warranty, the plaintiff must establish that the product is not fit for the ordinary purposes for which such a product is used. Many courts have held that the implied warranty theory of liability is duplicative of, or identical to, strict liability.

In addition to seeking the costs of past or expected future medical treatment, plaintiffs who claim injury from medical devices will often seek large damage awards for non-economic or punitive damages. Non-economic damages include, for example, compensation for pain and suffering. Punitive damages may be awarded to deter and punish wrongdoing. In order to obtain punitive damages, plaintiffs typically need to prove that a company acted with "malice" or similar showing of heightened culpability. In some jurisdictions, there are statutory limits on the size of punitive damages awards; in other states, larger awards may be allowed.

4.4 Costs

Generally, defendants in product liability cases maintain insurance policies that cover, among other things, product liability settlements and judgments, recalls, regulatory penalties and attorneys' fees. In addition, jurisdictions may limit a plaintiff's recovery to the amounts that their own insurance (eg, medical insurance) does not cover. Depending on the jurisdiction and circumstances of a particular case, a party may also be able to recover court costs and attorneys' fees if they prevail.

4.5 Product-Related Contentious Matters

In the USA, competitors in the medical device space may bring actions against each other in a judicial or private forum. For example, the Lanham Act allows a device manufacturer to bring a civil lawsuit against a competitor that is alleged to have misrepresented their own or the manufacturer's product in advertising or promotion. Similarly, such manufacturer can bring a complaint before the National Advertising Division of the Better Business Bureau (NAD). Although the NAD process is voluntary, the NAD may refer cases to the FTC where a defendant refuses to participate.

4.6 Class Actions, Representative Actions or Co-ordinated Proceedings

The Federal Rules of Civil Procedure govern class actions in federal courts while states may have their own roles and procedures for such actions. Under federal rules, a class action may only be brought where:

• the class is so numerous that a joinder of all members is impracticable;
• there are questions of law or fact common to the class;
• the claims or defences of the representatives must be typical of the claims or defences of the class; and
• the representative parties must fairly and adequately protect the interest of the class.

In addition, in order to maintain a class action, it must be shown that:

• prosecution of separate actions could create a risk of inconsistent or varying adjudications that would establish incompatible standards of conduct or a risk of adjudications with respect to individual class members that, as a practical matter, would be dispositive of the interests of the other members or would substantially impair or impede their ability to protect their interests;
• the party opposing the class has acted or refused to act on grounds generally applicable to the class, so that final injunctive or declaratory relief is appropriate as to the class as a whole; or
• the court finds that questions of law or fact common to the class predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy.

4.7 ADR Mechanisms

Generally, alternative dispute resolution (ADR) mechanisms are pursued following agreement between the parties to a dispute. Courts may also prompt or order parties to a lawsuit to participate in settlement conferences or meetings where they can attempt to resolve the dispute prior to going to trial.

4.8 Interrelation Between Liability Mechanisms

Although the FDCA does not provide private litigants with a cause of action, violations of FDCA requirements may be used as evidence in product liability or other litigation to establish a standard of care or other baseline requirements. Courts may differ as to the application of such violations to a particular case. Several states have enacted their own versions of the FDCA, which mirror the FDCA's requirements and could be enforced by private litigants depending on the particular statute.

5. Policy and Legislative Reform

5.1 Policy Development

In February 2022, a proposed rule was issued by the FDA to align the QSR with the international consensus standard ISO 13485:2016, in order to better harmonise this regulation with foreign requirements. Despite this goal, the proposed rule contains some definitions, clarifications, and requirements in addition to those set forth in ISO 13485:2016. This proposed rule has not yet been finalised so it is not yet clear what changes the FDA will implement.

As a result of the COVID-19 pandemic, there have been executive and legislative efforts, both proposed and implemented, to encourage the onshoring of the manufacture of medicinal products, including certain medical devices. For example, the Coronavirus Aid, Relief, and Economic Security Act, which was signed into law on 27 March 2020, amended the FDCA to provide the FDA with authority to prevent or mitigate medical device shortages before or during a public health emergency. Among other things, manufacturers of certain medical devices deemed critical to public health must notify the FDA of a permanent discontinuance in the manufacture of the device or an interruption in the manufacture of the device that is likely to lead to a meaningful disruption in supply of that device in the USA during a public health emergency.

In addition, the pending user fee legislation, the Food and Drug Administration Safety and Landmark Advancements Act of 2022 (FDASLAA), contains the Verifying Accurate Leading-edge IVCT Development (VALID) Act of 2022, which would give the FDA authority to regulate diagnostic tests and most of their constitutive components by creating an entirely new product category, in vitro clinical tests (IVCTs), for all in vitro diagnostics and laboratory developed tests (LDTs). The new risk-based framework attempts to clarify and recalibrate regulatory authorities between the FDA and the Centers for Medicare and Medicaid Services, which implements the Clinical Laboratory Improvement Amendments of 1988 (CLIA). Currently, the FDA asserts jurisdiction over LDTs under the FDCA but exercises enforcement discretion in most instances as long as the tests are developed, validated and performed within an individual, CLIA-certified lab and performed at the direction of a licensed healthcare provider. The VALID Act intends to better clarify this authority by, among other things, establishing high-risk IVCTs, moderate-risk IVCTs, and low-risk IVCTs, which would not be subject to FDA pre-market review. Though a focus of significant industry attention (positive and negative), the future of this transformative legislation remains uncertain as of the time of writing given political concerns about other aspects of the FDASLAA as currently proposed.

The FDA has also continued to focus on the importance of cybersecurity controls for medical devices. In April 2022, the FDA released a draft guidance on cybersecurity controls to supplement, and in at least one instance replace, certain existing FDA guidances on this subject. In issuing this guidance, the FDA expressed a need for both an updated and iterative approach to medical device cybersecurity based on the evolving landscape and increased understanding of cybersecurity threats. Among other things, the guidance clarifies existing FDA requirements applicable to cybersecurity controls and contains recommendations for manufacturers on designing secure devices and preparing pre-market submissions.

In addition to these FDA-specific developments, in early August 2022, the EPA announced its intention to issue a proposed air pollution rule to address emissions of ethylene oxide at commercial sterilisers, including sterilisers of medical devices. Even prior to this announcement, however, the FDA has been working with medical device sterilisers to help reduce the amount of ethylene oxide used in their sterilisation processes as well as to help develop novel sterilisation methods to replace ethylene oxide sterilisation.

5.2 Legislative Reform

See 5.1 Policy Development.

5.3 Impact of COVID-19

COVID-19 has largely impacted the FDA's ability to conduct domestic and foreign inspections of device manufacturers and facilities engaged in clinical and non-clinical research.

On 10 March 2020, the FDA announced its intention to postpone most inspections of foreign manufacturing facilities and products, and temporarily postponed routine surveillance inspections of domestic manufacturing facilities on 18 March 2020. On 10 July 2020, the FDA announced its intention to resume certain on-site inspections of domestic manufacturing facilities subject to a risk-based prioritisation system. The FDA further clarified its intentions in an August 2020 guidance that the agency would evaluate whether to conduct a physical inspection on a case-by-case basis, according to whether a domestic or foreign inspection is "mission critical", and would employ alternative tools when a physical inspection is not possible.

In April 2021, the FDA issued guidance describing how it will request and conduct voluntary remote interactive evaluations of manufacturing and outsourcing facilities as well as facilities involved in non-clinical and clinical research. Due to the emergence and rapid spread of the COVID-19 omicron variant, the FDA ceased a majority of its inspection activities at the end of 2021, which extended into early February 2022. Although the FDA is moving toward resuming normal inspection activities, the agency has indicated that it may continue to use certain techniques utilised during the pandemic, such as record requests and remote interactive evaluations.

In addition, the COVID-19 pandemic has resulted in significant use of the FDA's emergency use authorisation (EUA) authority, particularly for diagnostic tests and personal protective equipment. Under the FDA's EUA authority, the FDA may authorise an uncleared or unapproved device, or uncleared or unapproved use of an approved device, to diagnose, treat or prevent serious or life-threatening diseases or conditions caused by chemical, biological, radiological and nuclear threats when certain criteria are met and the Secretary of the Department of Health and Human Services (the parent agency of the FDA) has declared that an EUA is appropriate.

It should be noted that an EUA is not the same as a clearance or approval and establishes various conditions that the EUA holder (eg, manufacturer) and certain other entities (eg, distributors) must comply with, particularly relating to the collection of performance and safety data. The FDA has taken action against EUA holders that failed to comply with EUA conditions.

COVID-19 has also caused significant delays in initiating and maintaining litigation. Although many courts have successfully adopted virtual tools, such as videoconferencing services, to conduct hearings and enable trials to proceed, delays or postponements have persisted. As restrictions continue to ease in the USA, it is expected that such delays will be alleviated.

Originally published by Chambers Global Practice Guides.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.