Complaint Handling Procedure for Medical Devices: FDA 21 CFR 820.198 Guide

What FDA Defines as a Complaint

Understanding the regulatory definition of a complaint is the foundation of a compliant complaint handling procedure. FDA's QSR §820.3(b) (and QMSR equivalent) defines a complaint as any written, electronic, or oral communication that alleges deficiencies related to the identity, quality, durability, reliability, safety, effectiveness, or performance of a device after it is released for distribution.

Several elements of this definition create compliance implications that are frequently misunderstood.

"After it is released for distribution" means complaints include feedback received about devices already in the field, whether from customers, healthcare providers, patients, or any other source. Pre-market product feedback (from clinical trials, for example) is not subject to complaint handling requirements — it is addressed through design control and risk management processes.

"Written, electronic, or oral" means verbal complaints reported by phone must be documented. This is a process challenge for manufacturers who receive customer feedback through service representatives or technical support teams — those teams must understand and implement the complaint documentation obligation.

"Any... communication that alleges deficiencies" is deliberately broad. The customer does not need to say "I am filing a complaint" — if they are reporting that the device may not have worked as expected, that is a complaint. Training customer-facing personnel to recognize complaints and initiate the complaint process is a persistent challenge for many organizations.

Distinguishing complaints from other types of customer feedback is also important. A request for additional training, a question about device function, or a comment about labeling clarity may not be a complaint if no deficiency is alleged. However, when in doubt, it is better to capture a record and then determine the item is not a complaint, than to miss a complaint that should have been documented and investigated.

FDA 21 CFR 820.198: Core Requirements

21 CFR §820.198 (currently active QSR; QMSR will align with ISO 13485 Clause 8.2.2 with FDA-specific additions) establishes specific requirements for complaint handling that every manufacturer must implement.

Complaint file: Manufacturers must maintain complaint files and must establish and maintain procedures for receiving, reviewing, and evaluating complaints. The complaint file must be accessible to FDA investigators during inspections.

Complaint records: Each complaint must be documented with: the name of the device, the date the complaint was received, any unique device identifier (UDI) or universal product code, the name and address of the complainant (if provided), the nature of the complaint, the reply date (if applicable), the name of the person who received the complaint, and the outcome of the investigation.

Investigation requirements: Each complaint must be reviewed and evaluated to determine whether an investigation is necessary. If an investigation is not conducted, the file must document the reason. Investigations that are conducted must document: (1) the device name, (2) the date of investigation, (3) the person conducting the investigation, (4) the complaint evaluation, (5) evaluation of the device involved in the complaint if available, (6) any corrective action taken, and (7) the reply to the complainant, if applicable.

Evaluation for Medical Device Reports (MDRs): Every complaint must be evaluated to determine whether it represents a reportable event under 21 CFR Part 803. This evaluation must be documented. The MDR evaluation cannot be deferred to a later point in the complaint process — it must occur during the complaint investigation.

Oral complaints: Complaints received orally must be documented upon receipt and entered into the written complaint record system. The QSR does not permit a separate oral complaint log — all complaints, regardless of how received, must be captured in the main complaint record system.

Medical Device Reporting (MDR) Under 21 CFR Part 803

Medical Device Reporting (MDR) is the FDA's adverse event reporting system for medical devices. Complaint handling and MDR reporting are separate but tightly integrated processes — complaint investigation generates the information needed to make MDR reportability determinations, and the MDR determination is a mandatory output of every complaint evaluation.

Reportable events: 21 CFR Part 803 requires device manufacturers to submit MDRs for events where the manufacturer's device may have caused or contributed to: a patient death (30-day reporting deadline), a serious injury (30-day reporting deadline), or a malfunction that would be likely to cause or contribute to death or serious injury if it were to recur (30-day reporting deadline). Certain 5-day expedited reports are required for events requiring remedial action to prevent an unreasonable risk of substantial harm to public health.

"May have caused or contributed to" is the evidentiary standard. You do not need to confirm causation to be required to report — reasonable likelihood is sufficient. This is a low threshold. The investigation of a complaint does not need to be complete to trigger an MDR reporting obligation. If you receive information suggesting your device may have contributed to a death or serious injury, the 30-day clock starts from when you receive that information, not when your investigation is complete.

MDR investigation timeline: FDA expects complaint investigations that involve potential MDR-reportable events to be completed within 30 days of receiving the complaint. This timeline drives the need for a streamlined complaint investigation process with clearly defined escalation paths for serious events.

MDR submission: MDRs are submitted electronically through FDA's eMDR system (MedWatch 3500A form). FDA's MDR database (MAUDE) is publicly searchable. Each submitted MDR becomes part of the public record. Quality professionals should regularly review MAUDE data for their device category — it provides intelligence on field performance issues that competitors or similar devices have encountered.

Complaint Investigation: A Structured Approach

Effective complaint investigations require a structured methodology that consistently produces complete, defensible investigation records. FDA investigators frequently observe complaint investigations that lack depth, fail to evaluate root cause, or do not connect to corrective action when one is warranted.

Investigation phases:

Receipt and triage: Complaints received through any channel must be captured in the complaint management system within a defined timeframe (typically 1-3 business days of receipt). Triage involves initial severity assessment to determine whether the event is a potential MDR, whether it requires expedited handling, and whether the complainant needs immediate support.

Product evaluation: When available, obtain the returned device or product samples for evaluation. Physical examination, functional testing, and environmental analysis of returned devices often yields root cause information that is not available from complaint description alone. Maintain chain-of-custody documentation for returned devices.

Root cause analysis: For complaints that identify a genuine device deficiency, root cause analysis (RCA) is required. Common RCA tools used in complaint investigation include 5-Why analysis, fishbone (Ishikawa) diagrams, and fault tree analysis. The depth of RCA should be proportional to the severity of the event and the potential for recurrence.

CAPA determination: After root cause is identified, determine whether corrective action (to address the root cause) or preventive action (to prevent recurrence in currently conforming product) is warranted. Not every complaint requires a CAPA — complaints that are isolated events with no identifiable device deficiency or systemic cause may be closed without CAPA. Document the CAPA/no-CAPA decision with reasoning.

Closure: Close complaints with documented resolution, including the investigation findings, MDR determination, CAPA reference (if applicable), and customer response (if applicable).

Common FDA 483 Observations in Complaint Handling

Complaint handling is consistently in the top five sources of FDA 483 observations in medical device inspections. Understanding the most common findings allows you to proactively address systemic weaknesses before they appear in your inspection record.

Failure to capture all complaints: FDA investigators will compare complaint records against service records, sales team notes, customer support logs, and social media feedback to identify events that should have been captured as complaints but were not. Training customer-facing personnel to recognize and document complaints is a process discipline issue, not just a procedure issue.

Inadequate investigation: Investigations that are closed with conclusory statements ("device functioned as designed") without objective evidence supporting the conclusion are a common finding. FDA expects that investigations are completed against a documented procedure and that the investigation record contains enough evidence to support the conclusion.

Failure to evaluate for MDR reportability: Every complaint investigation must document an MDR evaluation, including the determination (reportable or not reportable) and the reasoning. Missing MDR evaluations — even when the event is genuinely not reportable — are a 483 finding because the evaluation must be documented regardless of outcome.

Delayed investigations: FDA expects complaint investigations to be completed within defined timeframes documented in your procedure. Systematic late closures, particularly for potential MDR-reportable events, are a significant finding that can result in Warning Letters.

Inadequate complaint procedure: Procedures that do not define investigation requirements, MDR evaluation requirements, or documentation requirements for each stage of complaint handling fail to meet §820.198 requirements. Procedures must be comprehensive enough that a new employee could follow them and produce a compliant investigation.