FDA medical device reporting for user facilities
Short answer
Under 21 CFR Part 803, a device user facility must report a device-related death to FDA and the manufacturer. The deadline is 10 work days from becoming aware. It reports a serious injury to the manufacturer, or to FDA if the manufacturer is unknown, in the same time. A facility that filed any reports also sends FDA an annual report on Form FDA 3419 by January 1.
- Death
- Report to FDA and the manufacturer (if known) as soon as practicable, no more than 10 work days after you become aware
- Serious injury
- Report to the manufacturer within 10 work days. To FDA if the manufacturer is not known
- Annual report
- Form FDA 3419, due January 1. Not required if you filed no reports
- Malfunctions
- Not required for user facilities. Voluntary reports go through MedWatch
- Work day
- Monday through Friday, except Federal holidays
- Report form
- Form FDA 3500A on paper, or an electronic format FDA can process
- Records
- Keep each MDR event file for 2 years from the date of the event
- Not covered
- Physician offices, school nurse offices and employee health units
Applies to: Hospitals · Ambulatory surgical facilities · Nursing homes, including hospice and rehabilitation providers · Outpatient diagnostic and outpatient treatment facilities, including home health care groups
Who is a device user facility?
A device user facility is a hospital, ambulatory surgical facility, nursing home, outpatient diagnostic facility or outpatient treatment facility. It is not a physician's office. The definitions are broad. Nursing homes include hospice and rehabilitation providers. Outpatient treatment facilities include home health care groups and ambulance providers.
Physician offices, school nurse offices and employee health units are not user facilities. A facility is covered whether or not it is licensed or accredited.
What must a user facility report?
| Event | Report to | Deadline | Form |
|---|---|---|---|
| A device may have caused or contributed to a death | FDA and the manufacturer, if known | As soon as practicable, no more than 10 work days after you become aware | Form FDA 3500A |
| A device may have caused or contributed to a serious injury | The manufacturer; FDA if the manufacturer is not known | No later than 10 work days after you become aware | Form FDA 3500A |
| A device malfunction with no death or serious injury | Not required for user facilities | None. You may report voluntarily through MedWatch | Form FDA 3500 (voluntary) |
| All reports filed during the year | FDA | Annual report by January 1 | Form FDA 3419 |
Caused or contributed is broad. It covers a death or serious injury that was or may have been attributed to a device. It also covers one in which a device was or may have been a factor. That includes failure, malfunction, improper design, manufacture or labeling, and user error.
When does the 10-work-day clock start?
The count runs from the day after you become aware. A facility becomes aware when medical personnel get information that reasonably suggests a reportable event. These are people employed by or formally affiliated with the facility. Medical personnel includes licensed, registered or certified clinicians, people with a diploma or degree in a professional or scientific field, employees who receive medical complaints or adverse event reports, and their supervisors.
Report what is reasonably known: the information in your documents and what reasonable follow-up inside the facility turns up. You need not investigate to gather information you do not reasonably have.
What counts as a serious injury?
A serious injury is an injury or illness that meets any of three tests. It is life-threatening. It results in permanent impairment of a body function or permanent damage to a body structure. Or it needs medical or surgical intervention to prevent that impairment or damage. Permanent means irreversible. It excludes trivial impairment or damage.
What goes in each report?
Each report carries a user facility report number. It is built from your 10-digit CMS provider number, the year and a four-digit sequence, such as 1234560000-2011-0001. Reports go on Form FDA 3500A if on paper, or in an electronic format FDA can process.
The annual report, Form FDA 3419, is due by January 1 each year. It lists each reportable event from the year. For each, give the report number, manufacturer name and address, device brand and common name, model, catalog, serial and lot numbers and UDI, a brief description, and where the report went. You may attach copies of the reports instead. If you filed no reports, you file no annual report.
What written procedures and files are required?
Every user facility must develop, maintain and implement written MDR procedures. They must provide for:
- timely identification, communication and evaluation of events that may be reportable;
- a standard review process for deciding whether an event meets the reporting criteria;
- timely transmission of complete reports to manufacturers or FDA; and
- documentation and records, including the information evaluated to decide if an event was reportable.
Keep an MDR event file for each event for 2 years from the date of the event. It holds your record of how you decided whether the event was reportable, including events you chose not to report. It also holds copies of every report and FDA's electronic acknowledgments. Authorized FDA staff may access, copy and verify these records at reasonable times.
What should intake capture?
The annual report needs device details that are easy to lose. They are brand and common name, manufacturer, model, catalog, serial and lot numbers, and UDI. Capture them when the incident is first reported, with the date and time medical personnel learned of it. The reportability decision, and who made it, belongs in the incident record. It must be in the MDR event file.
A device-related death or serious injury may also be a sentinel event and may start a state reporting clock. See the state reporting overview.
A repeatable path from event to filing
- Flag the possible device event at intakeAsk whether a device was involved and record its identifiers.
- Note when medical personnel became awareThat date starts the 10-work-day count.
- Decide reportability under your written procedureRecord the decision and who made it, including a decision not to report.
- File on timeDeath: FDA and the manufacturer. Serious injury: the manufacturer, or FDA if the manufacturer is unknown.
- Keep the MDR event file for 2 yearsInclude reports, acknowledgments and your deliberations.
- File the annual report by January 1Only needed if you filed any reports during the year.
How IncidentKit supports this requirement
| What the rule asks for | Where it lives in IncidentKit |
|---|---|
| Written MDR procedures with a standard review process (803.17) | Routing and escalation sends a possible device event to the person your procedure names. The investigation records the reportability decision. You write the procedure itself. |
| Report within 10 work days of becoming aware, from any source | Intake by text, QR code, email or web form timestamps the report. The audit trail logs who acted and when. Lauren asks whether a device was involved. |
| MDR event file kept for 2 years (803.18) | The incident, the investigation and the audit trail stay together in one record with every change logged. |
| Annual report details: device identifiers, event description, where reported | Incident fields hold device details. Analytics groups incidents by equipment, so you can list the year's device-related events before you complete Form FDA 3419. |
| Submitting reports to FDA and manufacturers | IncidentKit does not file with FDA or manufacturers. Submit through FDA's electronic reporting or on Form FDA 3500A. |
Product parts involved: Incident reporting, Routing and escalation, Investigations and RCA, Audit trail, Analytics. Capabilities marked “rolling out” are being released in stages; see the changelog.
Frequently asked questions
Do user facilities have to report device malfunctions?
No. User facilities report only deaths and serious injuries a device may have caused or contributed to. Malfunction reports are voluntary, through MedWatch.
Who gets the report when a patient is seriously injured?
The device manufacturer, or FDA if the manufacturer is unknown. A death goes to FDA and the manufacturer. Both are due within 10 work days of becoming aware.
What is a work day?
Monday through Friday, except Federal holidays. Counting starts the day after you become aware. For a death, file as soon as practicable, well before the last day.
Is a surgery center covered by the device reporting rule?
Yes. An ambulatory surgical facility is a user facility, whether independent or run by another entity, licensed or not. Physician offices are excluded.
How long do we keep device reporting records?
2 years from the date of the event. The file holds your reportability decision record, every report and FDA's electronic acknowledgments.
Sources
- 21 CFR 803.3, definitions (eCFR)
- 21 CFR 803.30, user facility reporting requirements (eCFR)
- 21 CFR 803.33, user facility annual report (eCFR)
- 21 CFR 803.17, written MDR procedures (eCFR)
- 21 CFR 803.18, MDR files and records (eCFR)
- FDA, Mandatory reporting requirements: manufacturers, importers and device user facilities
Reviewed against the sources above on Oct 5, 2026. Rules change: confirm current requirements with the issuing body or your counsel before relying on any summary.
Map this requirement to your records.
IncidentKit connects each rule to the incident, investigation and corrective action that satisfy it.