Understanding The UDI Rule – A Guide For Medical Device Manufacturers

By Dan O'Leary, President, Ombu Enterprises

The FDA’s UDI (unique device identification) final rule has arrived, and medical device manufacturers are working on their implementation strategies. The first two important dates related to UDI have passed:

• Changes to your quality management procedures should reflect the new regulations that became effective on December 23, 2013.
• Manufacturers of Class III devices produced after September 24, 2014, should have a UDI and compliant date format on all device labels and all package labels. The UDI contains information that allows retrieval of device identification information from the FDA-CDRH Global Unique Device Identification Database (GUDID). The device manufacturer will have loaded the information into GUDID and declared it is ready for public retrieval.

Other devices will come under the aegis of the UDI rule in a phased approach defined by compliance dates. At each compliance date, additional devices must meet specific UDI requirements. The compliance dates apply to devices based on their attributes, such as device class, whether the device is life-supporting, whether the device needs to be reprocessed before each use, etc.

A Simple Model
Understanding UDI, at a high level, is simple. The device manufacturer ships a comprehensive data package with each device. The label contains some of that data, such as applicable lot number, expiration date, etc. The bulk of the data, about 60 data elements, reside in a master database, the GUDID. The device label has a key called the device identifier (DI) that allows the user to retrieve the identification data for that device.

In addition, the device manufacturer updates the quality system to include UDI requirements. This ranges from UDI verification as part of label inspection to including the UDI in complaint records and adverse event reports.

UDI And Identification, Tracking, And Tracing
In implementing UDI, there is often confusion among identification, tracing, and tracking. It is instructive to understand how UDI fits into these important concepts.

Identification provides specific characteristics of a device. This is the purpose of UDI. The DI on the label provides the key to a public database, the GUDID, of device characteristics.

Tracing determines the production history of the device. This tracing extends to the first consignee as required by 21 CFR 820.160(b). The UDI rule does not change this requirement. In particular, GUDID does not provide any information about the first consignee or any other party that has the device.

Tracking identifies the patient who received the device. Tracked devices are covered by 21 CFR Part 821. The UDI rule does not change this requirement. In particular, GUDID does not provide any information about the patient.

Some manufacturers are concerned about the use of lot numbers and serial numbers as part of the UDI. GUDID does not include lot numbers, serial numbers, etc. It contains only a check box (yes/no) about this information on the label. The public cannot go to GUDID and determine the number of lots or serial numbers a device manufacturer has produced.

Tracking and tracing for medical devices

Constructing The UDI
The identification system has two fundamental parts — the information on the label (the UDI) and the information in the database (GUDID).

While we say the UDI is on the device label, we need to be clear that in some cases it could be on the device itself, and in some cases it could be on package labels. In all cases, the UDI structure is the same, but the included elements may not be.

The UDI has two major constituents. One is the mandatory device identifier (DI) that is unique to the version or model of the device. The other is the optional production identifiers (PI).

The constituents of a UDI

The DI is the unique part of UDI. On the device label, it is specific to the version or model of the device. If the version or model changes, the DI changes with it.

The PIs are optional. If you don’t use one of them for the device, you don’t need to include it as part of UDI. (The HCT/P ID code is for medical devices made from tissue products.) If your device uses any of the optional PIs, they must appear in both human‑readable and machine‑readable (e.g. barcode) form.

In addition, any dates on the label must be in the prescribed format, YYYY-MM-DD. (Electronic products regulated by FDA require a different format for date of manufacture.)

To help preserve the DI’s uniqueness, the manufacturer must contract with an accredited agency that assigns the number; manufacturers don’t assign the number themselves. To date, FDA has accredited three agencies: GS1, Health Industry Business Communications Council (HIBCC), and ICCBBA.

In addition to the UDI on the device label, manufacturers must put a UDI on the label of all standard packaging configurations. In this case, there is a different DI that represents the number of the devices in the standard package.

Each packaging configuration has a different device identifier (DI)

If the device meets three conditions, then the UDI must also be on the device. This is called direct marking. The conditions are:

• The device is intended to be used more than once.
• The device is intended to be processed before each use.
• The device must have a UDI on its label.

Using a direct marking device identifier (DI)

Populating The Database
The DI provides the key to the identification in the database. FDA calls it the Global Unique Device Identification Database (GUDID) even though it only contains information on products marketed in the U.S.

The manufacturer populates the database through the interface options (web-based or submitting HL7 SPL XML files). The required information includes about 60 data fields. Some are mandatory, and some are optional. Some are contingent on the data in other fields, and some are populated automatically.

Mandatory fields include the device identifier and the identity of the accredited agency that issued it.

Optional fields include the catalog number of the device, whether the device is for prescription use, and whether there is a DI for the packaging configuration.

Conditional fields include the number of devices in one of the standard packaging configurations.

Automatic populating fields include the company name, populated from the required DUNS number.

Updating The Quality Management System
The UDI rule requires many changes in the quality management system (QMS). For example, labeling inspection in Part 820 must include an examination for the correct UDI. This includes readability of the machine‑readable format. This means revised procedures and training.

Complaint records must contain the UDI. Adverse event reports to FDA include the UDI for both medical device reports (MDRs) and correction and removals. This means updated procedures, revalidation of databases, and training.

Compliance Dates
FDA intends to phase in these requirements over time. While there are additional factors (such as standalone software), Table 1 provides a basic schedule.

In the next installment in this series, we will look at specific UDI device, label, and package requirements.

About The Author
Dan O'Leary is president of Ombu Enterprises, a company offering training and execution in Operational Excellence, focused on analytic skills and a systems approach to operations management. He has more than 30 years’ experience in quality, operations, and program management in regulated industries including medical devices, aviation, defense, and clinical labs. He has a master’s degree in mathematics; is an ASQ (American Society for Quality) certified Biomedical Auditor, Quality Auditor, Quality Engineer, Reliability Engineer, and Six Sigma Black Belt; and is certified by APICS in resource management.