Drafting PMS and vigilance obligations into medical device distribution agreements

The EU Medical Device Regulations 2017/745 and In vitro Diagnostic Regulations 2017/746 (together the Regulations) introduced new post-market surveillance obligations (PMS), including an obligation for manufacturers to proactively seek data about their devices and to have a plan for PMS activities. We discuss here how manufacturers might ensure, through appropriate contractual provisions, that distributors (and importers) will provide all necessary support to allow a manufacturer to comply with its PMS obligations.

What is post-market surveillance under the Regulations and how should it work?

PMS under the Regulations is intended to be a continuous and systematic activity that surveilles a range of data including vigilance data passively collected and a range of additional data that is proactively sought. Properly engaged in, a PMS system allows a continuous feedback loop in which the data gathered is analysed and used to update technical documentation (including the CER and risk management file), the QMS, IFU and documents filed with competent authorities such as the PMCF and PSUR, as well as, on occasion, CAPAs, FSCAs and FSNs. The hope of the EU regulators is that not only will incidents be noted, analysed and acted upon appropriately, but also that devices will be continuously improved for the benefit of patients and users. 

Swissmedic and the Dutch IGJ have each undertaken limited surveys of PMS activities and found that device companies are largely failing to live up to the expectations on which the Regulations are built. This article focuses on the need for manufacturers to work closely with their distributors to establish and operate a compliant PMS system, and the corresponding requirement to include provisions in the distribution agreement that oblige medical device distributors to do so.

A PMS system is not a solitary activity: it takes a team of many to gather, review and analyse the data, to work out any trends shown, determine implications of the data and trends, and then to implement actions arising. The hope is that trends will be noted and acted upon to avoid future incidents. While manufacturers are in control up to the point of delivery of their devices to the distributor, thereafter, distributors will, in most cases, be the sole contact point for customers and users of the devices. In some cases, there might be a series of distributors and sub-distributors between the manufacturer and the customer or user. 

It is typical for companies to include a 'copy and paste' of the distributor obligations from Article 14 of the Regulations either in the distribution agreement, or in a separate 'quality agreement'. Both are insufficient if the manufacturer is to meet the requirements for a PMS system as it just provides a contractual mechanism to enforce obligations already imposed by law.

Manufacturers should instead consider what their distributors must do to support the PMS system and the manufacturer's compliance with its PMS obligations. These can be added as obligations to the distribution agreement, together with a requirement that the same obligations will be imposed on any sub-distributors. A separate quality agreement is not necessary.

What might be in the manufacturer's PMS plan?

A PMS plan needs to set out all relevant sources of data and to plan for the collection and collation of that data. Sources of data might include discussions and surveys with patients, users and/or sales representatives. In a supply chain that involves distributors, access to these three groups are controlled by those distributors. The manufacturer needs the contact details for this group as well as to be granted access to them and for the distributor to convey information and surveys between this group and the manufacturer.

While the Regulations include an obligation for distributors to report complaints to the manufacturer, an additional contractual obligation is helpful to have an enforceable contractual obligation. 

Manufacturers must report incidents without specific timelines as set out below:

The PMS plan and any contract with the distributor must take these timings into account. Before a manufacturer can report, they have to assess the complaint to determine whether it is an incident and if so whether it is a serious incident and this takes time. The manufacturer, therefore, needs to receive complaint data immediately. The manufacturer will also not want the distributor to undertake any analysis of the data to avoid creating documents which might be either unhelpful or disclosable to a regulator.

Under the Regulations distributors have a direct line of communication with competent authorities. Manufacturers should seek to control all communications to avoid any misinformation being provided to the regulators which can be hard or impossible to rectify. The manufacturer must ensure that it controls the narrative with all regulators.

The manufacturer should think through various scenarios for corrective and preventive actions, which can include: a recall, replacement, device modification, software update, addition to or change in instruction for use. If distributors will need to be engaged to support such activities, the distribution agreement needs to include an obligation to do so. 

Obligations to include in the distribution agreement to support a manufacturer's PMS system

Manufacturers should note that complaint data is of course likely to include sensitive personal information from patients. Appropriate privacy provisions with the manufacturer being controller of that complaint data is necessary so that the manufacturer can control its use, deployment and deletion.

Contractual obligations to impose on distributors:

• Direct access to data sources: provide contact information for customers, sales representatives, patients and users and attend in-person meetings alongside the manufacturer.
• Proactive assistance: provide all reasonable support and assistance in engagement with customers, users, patients and sales representatives to support the PMS system.
• Complaints: to be immediately communicated to the manufacturer and no analysis undertaken by the distributor of that data.
• Dealings with regulatory authorities: immediately inform the manufacturer of all communications and only provide written responses which have been agreed in writing with the manufacturer (save if the manufacturer is acting in breach of the Regulations).
• Handling outcome of CAPAs: provide assistance to the manufacturer in relation to customers, users and patients to properly undertake corrective and preventive actions, including chasing up unresponsive customers and allowing direct communication by the manufacturer if they deem it necessary.
• Sub-distributors: include the above provisions in all sub-distribution agreements.

Manufacturers should note that of all above apply also to entities which are importers under the Regulations.