FDA Medical Device Tracking: 21 CFR 821 and UDI Requirements for Implants
Practices that implant tracked devices have specific recordkeeping obligations under 21 CFR 821 in addition to the UDI capture requirements that apply to almost all implants. Failures show up during recall response and during state license renewals where surveyors sample patient records. This article outlines the practical capture, retention, and reporting workflow.
Which Devices Are Tracked
21 CFR 821 designates a specific list of high-risk implantable and life-sustaining devices that the FDA requires manufacturers to track from production through patient. Examples include pacemakers, implantable cardioverter-defibrillators, breast implants in some categories, and certain orthopedic implants.
Tracking obligations are passed down through the distribution chain to the implanting facility, which must capture patient identifying information, the device unique identifier, and a means of contacting the patient or surrogate if a recall is issued.
Devices not on the 21 CFR 821 tracking list still typically have UDI capture obligations, which means the device identifier and production identifier must be captured in the patient record, even if continuous tracking is not mandated.
The FDA Access GUDID database is the public lookup tool for UDI information. Practices should bookmark it for verification of device identifiers post-implantation.
Capture Workflow at the Procedure
Capture happens at the moment of implantation, not at end of day. The most reliable workflow is barcode scan into the EHR or implant log, with the human-readable UDI as a backup field.
The minimum data set is patient identifier, device identifier (DI), production identifier (PI) including lot, serial, and expiration when applicable, date of implantation, and the implanting clinician's identifier.
Implant cards or patient device cards are typically issued to the patient by the manufacturer. The practice should verify that the patient receives the card and document that delivery in the medical record.
Two-person verification at the time of implantation is a common quality control practice. The circulating nurse and the proceduralist both sign the implant record to confirm device identity.
Recall Response Obligations
When a manufacturer issues a recall on a tracked device, the practice must produce a list of patients who received the device within the timeline specified by the recall notice, typically 30 to 90 days.
The practice is responsible for notifying affected patients per the recall instructions. Notification language should match what the manufacturer and FDA recommend, and should include a clear next step (return for evaluation, schedule explant, monitor for symptoms).
Documentation of every notification attempt, every patient response, and every clinical action taken in response to a recall must be retained. Recall response records are reviewed by FDA inspectors and by state boards.
Failure to respond timely to a recall has been cited in FDA warning letters and in state board enforcement actions, particularly when patients suffered harm because of delayed notification.
Retention and Reporting
Tracking records must be retained for the expected useful life of the device or for the duration the device remains in the patient, whichever is longer. For most cardiac and orthopedic implants this is decades.
Adverse events suspected to be related to a tracked device are reportable to the manufacturer and through the FDA MedWatch program (Form 3500A for mandatory reporting from facilities and manufacturers, Form 3500 for voluntary reporting).
Death or serious injury that may be device-related triggers mandatory MDR (Medical Device Report) submission within timelines defined in 21 CFR 803. The 10-day window for facility reports of death or serious injury caused by a device is the most cited timeline.
Internal device-related event logs should be reviewed at quality committee on a defined cadence. This is one of the surveyable items for AAAHC, Joint Commission, and CMS.
What is the difference between UDI and device tracking?
UDI (Unique Device Identification) is a labeling and recordkeeping requirement that applies to almost all medical devices and ensures the device can be uniquely identified through its lifetime. Device tracking under 21 CFR 821 is a narrower requirement that applies only to specific high-risk implantables and requires the practice to maintain a continuous record of who has the device, with the ability to contact the patient if a recall is issued.
Where do I look up a UDI to confirm device information?
The FDA Access GUDID (Global Unique Device Identification Database) is the public lookup tool. Enter the device identifier and the database returns manufacturer, brand name, version, model number, and other label information. This is useful for verifying device identity at implant and during recall response.
How long do I have to respond to a recall?
The timeline depends on the recall classification. Class I recalls (reasonable probability of serious injury or death) typically require notification within days, often 30 days or less. Class II and Class III recalls allow longer windows. Always read the recall letter for the specific timeline and document your response activity against that timeline.
For practices
Bring this to your own practice.
QR Rx turns every procedure into a branded recovery plan that keeps patients engaged and brings them back. Start free in minutes, or see it live in a 20-minute demo.
This blog provides general information about healthcare compliance and aftercare best practices. It does not constitute legal, medical, or regulatory advice. Consult qualified professionals for guidance specific to your practice.
