FDA issues draft guidance on Unique Device Identifiers

On July 26, 2016, the FDA issued draft guidance to help clarify the form and content requirements of the Unique Device Identifier (UDI). Industry groups have 60 days to comment on the draft guidance.

Background

The UDI final rule, which established the UDI system, was published on September 24, 2013. The rule aims to develop a system to sufficiently identify devices through distribution and use to improve their overall safety.   The final rule requires device labelers to include a unique device identifier on certain device labels and packages.

A UDI is a unique numeric or alphanumeric code that consists of two parts:

• a device identifier (DI), a mandatory, fixed portion of a UDI that identifies the labeler and the specific version or model of a device, and
• a production identifier (PI), a conditional, variable portion of a UDI that identifies one or more of the following when included on the label of a device:
  • the lot or batch number within which a device was manufactured;
  • the serial number of a specific device;
  • the expiration date of a specific device;
  • the date a specific device was manufactured;
  • the distinct identification code required by §1271.290(c) for a human cell, tissue, or cellular and tissue-based product (HCT/P) regulated as a device.

Each UDI must be provided in both a plain-text version and in a form that uses automatic identification and data capture (AIDC) technology on the label of the device and on each device package. The UDI must be issued by an FDA-accredited issuing agency. As part of the system, the device labelers are required to submit information to the FDA-administered Global Unique Device Identification Database (GUDID).

Draft Guidance

The draft guidance focuses on the form and content of the UDIs. Some of the major provisions of the draft guidance are detailed below.

A. Form of UDI

• The draft guidance clarifies that the purpose of the AIDC form is to minimize errors in records resulting from manual transcriptions. While a specific form of AIDC technology is not required by the rule, the FDA recommends using a form that will allow rapid and accurate data acquisition, recording, and retrieval. Specifically, the AIDC technology should be in a format that can be read by a bar code scanner or some other AIDC technology and should be tested by the labeler to ensure that the UDI can be reliably read at the point of scanning by the applicable type of technology.

• The AIDC form of the UDI may be split into multiple segments but the DI bar code should precede the PI bar code. For example, one UDI may be presented in two linear bar codes: one bar code for the DI and another bar code for the PIs. These two bar codes should be proximally located to each other on the device label, device packages, and when required, on the device itself.

• The labeler may choose to use more than one type of AIDC technology form to assist users who may be employing different methods of UDI capture technology. Contrastingly, only one easily readable plain-text form of the UDI should be on the label.

• Regardless of the type of AIDC technology chosen, the form should be tested for print quality that meets the respective form of technology’s established standards.

• If the UDI presented in the AIDC technology format is not visible to the human eye upon visual examination of the label or device package (e.g., RFID technology), the label or device package must disclose the presence of AIDC technology. FDA does not require a specific format or sign that the labeler should choose to disclose the presence of the technology.

• The easily readable plain-text form of the UDI should include the device identifier (DI), production identifiers (PIs), and data delimiters contained in the UDI, and be limited to those characters specified under ISO/IEC 646.

• The easily readable plain-text form of the UDI may be presented as a single line or multiple lines of text and should be displayed below or near the AIDC technology form of the UDI.

B. Content of UDI

• The draft guidance clarifies that the FDA considers that UDI is comprised solely of a single DI and one or more of the five PIs listed in 21 CFR 801.3 and 801.40(b), along with the data delimiters for the DI and PIs. Some of the FDA-accredited issuing agencies may allow for non-UDI elements, such as quantity, in the UDI carrier, but FDA does not recognize any such additional non-UDI elements as being part of the UDI.
• The guidance also explains how the UDIs may vary for different classes of devices. For example, there are some situations where a UDI may comprise a DI only. Additionally, for instance, the UDI of a class I device is not required to include a PI. Contrastingly, for devices other than class I devices, if one or more of the five PIs defined under 21 CFR 801.3 are included on a device label, the UDI must include each of the PIs that appears on the label.
• The UDI Rule does not include any additional requirement to place any of the five elements that would be considered a PI on the label.
• The guidance also explains the order of information in the UDI and that in the UDI carrier, the UDI should precede any non-UDI elements. Specifically, the easily readable plain-text form of the UDI should be ordered to specify the DI first, followed by the PIs, and lastly, the non-UDI elements, if any.

C. Data Delimiters

• The guidance clarifies that the UDI elements should be easily distinguishable and captured separately from the non-UDI elements that may be represented in the UDI carrier. This can be accomplished by having separate data delimiters for non-UDI elements.

• Data delimiters should be included in both the easily readable plain text and AIDC technology.

• Data delimiters for the PI and DI should be included in the UDI.

HIPAA Guidance

At the same time, Department of Health and Human Services Office of Civil Rights guidance clarified that the DI portion of the UDI is not the type of “device identifier” that would be excluded from a limited or de-identified data set.  This is because the DI portion of the UDI is the model or version number of a device, which is not unique to a specific device and thus, not uniquely identifying to a particular individual.  Rather, “device identifier” for purposes of the HIPAA standards for limited and de-identified data sets refers to serial and other numbers assigned to a specific device and thus, that may be uniquely identifying for a particular individual.

However, the PI portion of a UDI would be a “device identifier” because it includes a serial number or other numbers that correspond to a specific device. Thus, the PI would not be included in a limited data set or data set that is de-identified. The PI portion of a UDI or other similar device identifiers may only be included as part of a de-identified data set to the extent an expert has determined, in accordance with 45 CFR 164.514(b)(1), that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify individuals.

Compliance Dates

The final rule requires that the UDI system goes into effect in different stages, over a period of seven years, to ensure a smooth implementation and to spread out the costs and burdens of implementation for the industry over a longer period of time. Impacted parties should make note of the timeline below and ensure that processes are in place in order to meet the applicable compliance deadlines.

The below table from the FDA summarizes the compliance dates for different classes of devices: