Regulation of Medical Devices in the United States and European Union

Daniel B. Kramer, M.D., Shuai Xu, M.Sc., and Aaron S. Kesselheim, M.D., J.D., M.P.H.

N Engl J Med 2012; 366:848-855March 1, 2012

Comments open through March 8, 2012

Article
References
Citing Articles (1)
Comments (6): Millions of patients worldwide depend on an ever-widening array of medical devices for the diagnosis and management of disease. In the United States, the Food and Drug Administration (FDA) requires manufacturers of high-risk devices such as heart valves and intraocular lens implants to demonstrate safety and effectiveness before the devices can be marketed. However, some policymakers and device manufacturers have characterized U.S. device regulation as slow, risk-averse, and expensive.1,2 Other experts, such as those at the Institute of Medicine, have suggested that current premarketing procedures may not be comprehensive enough and may be particularly dangerous for devices that have been cleared by the FDA on the basis of substantial similarity to an already marketed device.3 A frequent point of comparison for device regulation in the United States is regulation in the European Union.4-6 Reports suggest that European patients have access to some high-risk medical devices, such as coronary stents and replacement joints, earlier than American patients. This system has been touted as being better for patient care,7 as well as supporting good-paying jobs and a positive trade balance.8 However, the E.U. system has drawn criticism for conflicts of interest in its evaluation process,9 and a recent recall of a popular silicone breast implant that was approved only in the European Union has reinforced European concerns about the clinical evaluation of high-risk devices.10-12 As policymakers in the United States and Europe weigh these critiques, it is an opportune time to compare the two systems and consider what evidence exists on the performance of each device-approval system.

Approval Systems for Medical Devices

United States
The Medical Device Amendments of 1976 gave the FDA primary authority to regulate medical devices and required the FDA to obtain “reasonable assurance of safety and effectiveness” before marketing.13 This legislation has been updated several times, including the Medical Device User Fee and Modernization Act of 2002, which established sponsor user fees for application reviews and set performance targets for review times.14 Each device type is assigned by the FDA into one of three regulatory classes on the basis of its risk and the evaluation necessary to demonstrate safety and effectiveness.15,16 Most class I devices (e.g., stethoscopes) are low-risk and subject only to “general controls,” such as tests of sterility. Class II devices (e.g., computed tomographic scanners) meet general controls as well as “special controls,” such as additional labeling requirements. These moderate-risk devices generally pass through the 510(k) review pathway, which refers to the section of the Food, Drug, and Cosmetic Act dealing with premarket notification. In this process, the FDA and the manufacturer rely on similarities between the device at issue and a previously cleared device. If a manufacturer can show that its device is “substantially equivalent,” additional clinical data are usually not required, although requirements for performance standards and postmarketing surveillance may be imposed. Class III products (e.g., deep-brain stimulators and implantable cardioverter–defibrillators) require clinical studies evaluating the safety and effectiveness of the device, called a Premarket Approval (PMA) application.17 However, class III devices that arise from changes to previously PMA-approved devices may not need additional clinical studies.18,19 In addition, some older class III devices for which the FDA has not specifically called for PMAs can receive clearance through the 510(k) pathway.17 Devices that treat rare disorders (fewer than 4000 patients annually) may receive a Humanitarian Device Exemption and be approved on the basis of “probable” benefits, a more flexible standard that recognizes the difficulty of studying patient populations with small numbers and limited treatment options.20 Sites where cleared or approved devices are used must report related serious adverse events to the FDA and the manufacturer.21,22 These reports are stored in a searchable, publicly available database called Manufacturer and User Facility Device Experience. In addition, the FDA may conduct inspections, require manufacturers of high-risk devices to conduct postapproval studies, and initiate recalls.

European Union
Until the 1990s, each country had its own approach to device evaluation.6 To regulate an uneven and complex market, E.U. directives that outlined requirements under which a medical device (as well as other commercial goods) could be marketed across all E.U. member states after earning a Conformité Européenne (CE) mark in any one member country.23,24 These directives categorize devices into four classes (I, IIa, IIb, and III) on the basis of increasing risks associated with their intended use.25,26 Device approval in each E.U. country is overseen by a governmental body called a Competent Authority, such as the Medicines and Healthcare Products Regulatory Agency in the United Kingdom and the French Agency for the Safety of Health Products. The lowest-risk devices are declared to the Competent Authority, which may conduct inspections to confirm manufacturing standards and review the technical file for the device. Approval for more complex devices is directly handled by Notified Bodies, independent companies that specialize in evaluating many products, including medical devices, for CE marks and are designated by Competent Authorities to cover certain types of devices. First, a manufacturer of a device selects a properly designated Notified Body in a country of the manufacturer's choosing. For approval by a Notified Body, devices are subject to performance and reliability testing linked to the risks of their intended use.27 For most devices, the standard is met if the device successfully performs as intended in a manner in which benefits outweigh expected risks.23,28 The specific requirements for premarketing clinical studies are vague, and details of trials are typically not made available to the public. Although clinical data are required for high-risk devices, guidelines for the nature of these studies are not binding on manufacturers or Notified Bodies.29 In the postmarketing phase, manufacturers are required to report all serious adverse events to the Competent Authorities. Since 1998, each Competent Authority (but not the public) has had access to the European Databank on Medical Devices (EUDAMED). This database stores information on manufacturers, data related to approvals and clinical studies, and details on postmarket events. Manufacturers have been required to directly report events to EUDAMED since May 2011. However, coordination and analysis of postmarketing reports are highly variable, and EUDAMED has limited utility even to Competent Authorities. A few E.U. member states provide the majority of adverse-event reports and field-safety notices, which are public notifications of device-related safety concerns.30 In 2004, the guidelines published by the European Commission urged manufacturers to include both general and device-specific follow-up as part of their quality-assurance programs.31 These programs, which the guidance document suggests might include registries or more formal prospective postmarketing studies, are left to the discretion of manufacturers.

Prominent Differences between the Systems

Mandate
Emerging from a public outcry over adverse events, the FDA was given a mandate to provide reasonable assurance of the safety and effectiveness of medical devices32,33 (Table 1Table 1Prominent Points of Comparison between the United States and European Union for Approval of Medical Devices.). Thus, the FDA may consider the severity of the disease and available alternatives when evaluating high-risk devices. For example, a new system for catheter ablation of atrial fibrillation, which had been marketed in the European Union since 2006 on the basis of pilot data, was presented to the FDA in 2011 on the basis of a clinical trial involving 210 patients.34 An FDA advisory panel recommended against approval owing to safety questions raised by the study, the existence of established alternatives, and the fact that the treatment largely targeted quality of life rather than survival. By contrast, the E.U. system is part of a framework for commerce, which originated as a means of streamlining trade and coordinating manufacturing, safety, and environmental standards within the European Union.35,36 Notified Bodies are not designed to work as public health agencies. The most important public health role in the system is played by Competent Authorities, which primarily oversee device safety, although the composition, funding, and responsibilities of Competent Authorities vary widely among member states. These features in part explain why proof that the device works as intended may be sufficient to permit marketing of even high-risk medical devices.23 For example, a distal protection system for coronary-artery interventions received a CE mark after a single-group study involving 22 subjects showed that the device worked as intended.37,38 In the United States, FDA approval came several years later on the basis of a randomized study involving 800 subjects, in which a clinical end point of major adverse cardiac events was used.39

Centralization
Central coordination in the United States allows postmarket phenomena in one generation of devices to inform later applications and study designs. For example, specific criteria for trial design and end points have been developed to standardize the development of artificial heart valves40 and devices to treat congenital heart disease.41,42 These criteria also informed novel methods and statistical approaches to studying devices.43 A central registration system also provides publicly searchable listings and databases of adverse events and postmarketing reports, which are useful to independent researchers evaluating specific devices.44-46 Directives and guidance documents provide an overview of the evaluation process in the European Union, but the system defers significant authority to Competent Authorities and even more to nongovernmental Notified Bodies. Though individual Notified Bodies may be motivated to provide a predictable and streamlined approach to attract customers, there may be inconsistency in the process for approving similar devices among Notified Bodies.47 Such differences in interpreting and applying European directives may allow manufacturers to identify the most conducive path toward earning the CE mark. Decentralization also hinders collection and analysis of safety data and does not aggregate large numbers of patients to help identify potential rare but life-threatening adverse events.9,48

Data Requirements
In the United States and the European Union, data requirements for high-risk devices can differ substantially. For example, a device for left atrial appendage exclusion for prevention of stroke in atrial fibrillation received a CE mark in 2009 on the basis of pilot data but was rejected by the FDA on the basis of safety concerns, including procedural complications and high rates of stroke, emerging from a 700-patient study conducted as part of a PMA.49-51 Notably, researchers have criticized the data that have been collected in some PMAs.46,52 One group showed that about two thirds of the PMA applications were approved on the basis of a single study and that trials were rarely randomized or blinded.52 Trials may lack sufficient representation of women53 and have inconsistencies in the way they report data.54 Differences in data requirements between the United States and the European Union are less stark for devices that do not require a PMA. Devices that are cleared through the 510(k) process in the United States generally do not require clinical trials, which remains a point of substantial controversy. For example, one study investigating a cohort of high-risk recalls in the United States showed that 71% of such devices had previously been cleared through the 510(k) process and another 7% had been exempt from review.55 In another report, approximately 25% of high-risk device submissions during a 4-year period were found to be inappropriately evaluated through the 510(k) pathway,18 although the FDA has a stated goal of correcting these cases by the end of 2012.56 Studies in the European Union regarding the premarket features of devices that are subject to recalls have proved impossible to conduct.57

Transparency
The FDA has several mechanisms for making its decision-making process accessible, even though much of a sponsor's application for a new device may remain proprietary. Open presentations to advisory committees describe particularly novel, complex, or high-risk devices, and committee panelists can publish their views.58,59 At the time of approval of high-risk devices, a “Summary of Safety and Effectiveness Data” provides the justification for approval as well as discussion of adverse events. Public postmarket data have been used in the United States to quantify the risks for several devices, including implantable cardioverter–defibrillator leads44 and generators60 and cardiac septal-closure devices.45 In contrast, in the European Union, Notified Bodies have no obligation to publish their decision-making process or the evidence provided by sponsors.9,47,61

Funding
In the United States, user fees account for less than 20% of the budget for the medical-device approval process, and the government supplies the remainder.62 Relying on centralized funding subjects the FDA to resource limitations, particularly in postmarketing surveillance.63,64 However, public funding also promotes the independence of regulators. In the European Union, the funding of Competent Authorities varies with different combinations of public support and fees levied on manufacturers or Notified Bodies, and this variability may exacerbate differences among the resources focused on device safety in each country. The system of Notified Bodies is for-profit, with funds derived from the review fees. This sets up a dynamic in which Notified Bodies view manufacturers as clients or customers and compete with one another for business. As one Notified Body writes in its advertising brochure, “Our aim is to provide a high quality, fast, reliable and stress-free service to meet your deadlines.”65

Access
Patients in the European Union have access to some new, complex technologies earlier than patients in the United States (in some cases, several years earlier), though precise estimates vary among reports.66,67 The timing of approval of low- and moderate-risk devices, which account for more than 95% of devices reviewed by the FDA, is generally equivalent.67 For devices in which clinical data ultimately prove favorable, E.U. patients will have enjoyed these options before similar patients in the United States. For example, two devices for transcatheter aortic-valve implantation (TAVI) have had CE marks since 2007.68 Later, in a study involving patients with inoperable severe aortic stenosis, TAVI was shown to reduce mortality in absolute terms by 20 percentage points at 1 year, as compared with standard therapy,69 with a favorable effect on quality of life.70 On the basis of these data, the FDA approved one TAVI model in late 2011. In the United States, truly new but high-risk devices may be available at an early stage only through a humanitarian exception or as part of a clinical trial, and in both cases conditions of use include oversight by institutional review boards and typically postapproval studies evaluating outcomes. However, differences in timing are related to the need in the United States to conduct clinical trials for high-risk devices. Although E.U. patients may have earlier access to some devices, they also face the risk that subsequent studies will show no benefit to the new device or reveal important harms from adverse events that did not emerge from the premarket review. For example, the PleuraSeal Lung Sealant System for the treatment of air leaks after pulmonary resection was approved for the E.U. market from 2007 through 2011 but was withdrawn after an FDA-required study showed a higher complication rate than with standard care.71 Approval of a device in the European Union does not necessarily guarantee earlier access for patients, since insurance coverage and payers' decisions vary widely.72

Recommendations
This review of device approval in the United States and Europe shows that both systems are facing problems requiring policy changes. Much attention has been focused on the time to approval and regulatory barriers in the United States,73 but we found numerous examples of high-risk devices that were first approved in the European Union but showed no benefit or demonstrated substantial safety risk in subsequent testing. There is some irony in criticizing the FDA for delayed approval of technology, such as TAVI, in which the effectiveness has been shown only in the studies performed to meet the FDA's safety and effectiveness requirements. One essential question that remains unanswered is whether speedier access to some newer technologies in the European Union has improved public health. Or does the more deliberative posture taken for some high-risk devices by the FDA better serve patients overall? Certainly, swifter approval helps generate revenue for manufacturers, and physicians may benefit from having more tools at their disposal. But the primary goal of bringing new devices to market should be to improve the treatment of specific diseases, and no current studies address this outcome. The few studies that have evaluated the performance of regulatory systems have relied on unconvincing outcomes such as recall rates. Because recalls require a number of unpredictable steps (including device-malfunction recognition, reporting, aggregation with other events, and regulatory action), low rates of recalls do not show an optimally functioning system, and high rates do not necessarily translate into patient harm or identify regulatory flaws. One way to address unresolved questions about the effectiveness of the two approaches to device regulation would be to perform more comparative-effectiveness studies of device technology or disease management in which outcomes with new therapeutics could be compared with alternative approaches or devices. Yet the FDA and Competent Authorities have limited power to require these sorts of studies. Comparative technology assessment in the European Union is currently handled by other government bodies or private organizations in an unsystematic manner, whereas policymakers' attention to comparative-effectiveness research for devices in the United States remains in its infancy. More government resources in the two settings need to be applied to address both the effectiveness and cost-effectiveness of new device technology. In our view, the greatest challenge facing U.S. device regulation is the evaluation of high-risk devices through pathways intended for lower-risk devices, such as the 510(k) process. Although it is worrisome that many PMA approvals in the United States result from unblinded studies or other features of high-quality clinical trials, these study elements may be impossible in trials of some of the highest-risk implantable devices. In such cases, one solution is reliance on postmarket surveillance to ensure that devices are closely monitored when they are approved, perhaps with automatic review of clinical experiences after a period of years to ensure that the devices are operating as intended and producing the expected benefits. However, calls for more drastic increases in requirements or the adoption of a more lenient and outsourced “European” system lack any legitimate empirical basis in the literature. By contrast, the E.U. system may be improved with better coordination and centralization to ensure consistent interpretation of directives at the level of a Notified Body and to assist understaffed Competent Authorities in monitoring device safety. Key problems in the European Union are the near-total lack of empirical evidence regarding the performance of its system and the lack of public access to either premarket or postmarket data. Data transparency also promotes improved knowledge about device performance and would facilitate more precise comparisons of regulatory decisions among regions. Adopting these characteristics would promote more rapid identification of postmarket safety signals and allow for a coordinated response to adverse events, as has been possible at times in the United States.

Conclusions
Systems for approving new medical devices must provide pathways to market for important innovations while also ensuring that patients are adequately protected. To achieve these goals, the United States and European Union use a combination of premarket testing and postmarket vigilance but with some marked contrasts in their approaches. Features of both environments require reform, as well as continuing research to assess policy changes.

Supported in part by a grant from the FDA Center for Devices and Radiological Health (to Drs. Kramer and Kesselheim), by a career development award from the Agency for Healthcare Research and Quality (K08HS18465-01, to Dr. Kesselheim), and by a Robert Wood Johnson Foundation Investigator Award in Health Policy Research (to Dr. Kesselheim). Disclosure forms provided by the authors are available with the full text of this article at NEJM.org. This article (10.1056/NEJMhle1113918) was published on February 14, 2012, at NEJM.org. We thank Alan Fraser, Graeme Tunbridge, and Stefan Menzl for their comments on an earlier draft of the manuscript.
Source Information
From Harvard Medical School (D.B.K., S.X., A.S.K.), Cardiovascular Division, Beth Israel Deaconess Medical Center (D.B.K.), and the Division of Pharmacoepidemiology and Pharmacoeconomics, Department of Medicine, Brigham and Women's Hospital (A.S.K.) — all in Boston.