Regulatory Records Primer Part 1: Decoding the Requirements for Medical Device Manufacturers

Regulatory Records Primer Part 1:  Decoding the Requirements for Medical Device Manufacturers
Records, either paper or electronic, play a vital 
role in FDA’s ability to confirm that procedures 
have been appropriately implemented 


The Quality System Regulation (QSR) is premised on the theory that the development, implementation, and maintenance of procedures designed to carry out the requirements of the regulation will assure the safety and effectiveness of medical devices.  Therefore, it is easy to see the importance of the records required to document the implementation of those quality system procedures.

One of the basic themes of the Quality System Inspection Technique (QSIT) (used during inspections of medical device manufacturers) is the “Establish Test.”  The QSR requires many procedures to be “established” and defines “establish” as “define, document (in writing or electronically), and implement.”  

Records play a vital role in FDA’s ability to confirm that procedures have been appropriately implemented and, on a broader scope, that an adequate and effective quality system has been established and maintained by the firm being inspected.

General Requirements


21 CFR 820.180 states that all records required by the QSR must be maintained at the manufacturing establishment or another location that is reasonably accessible to responsible officials of the manufacturer and to employees of the FDA designated to perform inspections.  Such records, including those not stored at the inspected establishment, must be made readily available for review and copying by FDA employee(s).  FDA interprets “copying” to include printing of computerized records, as well as photocopying.
FDA expects that records required by the QSR be available during the course of an inspection.  If a manufacturer maintains records at a remote location, those records would be expected to be produced for inspection on the next working day, or two at the latest.

Legibility and Storage

21 CFR 820.180 requires that the records required by the QSR be legible and stored to minimize deterioration and prevent loss.  In addition, records stored in automated data processing systems must be backed up.  Depending on the medium used to store the records, this may require firms to maintain obsolete technology in order to retrieve them.


21 CFR 820.180(a), Confidentiality, states records deemed to be confidential by the manufacturer may be marked to aid FDA in determining whether information may be disclosed under the Public Information Regulation (21 CFR Part 20).  This does not necessarily mean FDA will consider all records stamped as “Confidential” to be confidential. 

Retention Period

21 CFR 820.180(b), Record Retention Period, states that all records required by the Quality System Regulation be retained for a period of time equivalent to the design and expected life of the device, but in no case less than two years from the date of release for commercial distribution by the manufacturer.  All records, including Quality System Records, are subject to this requirement.  FDA believes this is necessary because manufacturers may need such records when performing investigations.


21 CFR 820.180(c), Exceptions, explains that the requirements of 21 CFR 820.180 do not apply to the reports of 21 CFR 820.20(c) Management Review, 21 CFR 820.22 Quality Audit, and supplier audit reports used to meet the requirements of 21 CFR 820.50(a) Evaluation of Suppliers, Contractors, and Consultants.  However, the requirements do apply to procedures established under these sections.
The intent of 21 CFR 820.180(c) is to describe the types of records FDA (as a matter of policy) will not request to review or copy during a routine inspection.  However, 21 CFR 820.180(c) requires that upon request of a designated FDA employee, a manufacturer’s employee in management with executive responsibility must certify in writing that the management reviews and quality audits required by the QSR (and supplier audits where applicable) have been performed and documented, the dates on which they were performed, and that any required corrective action has been undertaken.  FDA investigators (through their supervisors) must consult with CDRH prior to requesting this certification.

Device Master Records

21 CFR 820.181, Device Master Record, requires each manufacturer to maintain Device Master Records (DMRs).  The term “Device Master Record” is defined in 21 CFR 820.3(j) and means a compilation of records containing the procedures and specifications for a finished device.  The Device Master Record may include or refer to the location of this information.
Each manufacturer must ensure that each DMR is prepared and approved in accordance with the requirements of 21 CFR 820.40 Document Controls because FDA believes the controls are necessary to assure consistency and continuity within the DMR.  21 CFR 820.181 requires each DMR to include or refer to the location of specific information:
  • Device Specifications:  Device specifications including appropriate drawings, composition, formulation, component specifications, and software specifications.
  • Production Process Specifications:  Production process specifications including the appropriate equipment specifications, production methods, production procedures, and production environmental specifications.
  • Quality Assurance Procedures:  Quality assurance procedures and specifications including acceptance criteria and the quality assurance equipment to be used.
  • Packaging and Labeling Specifications:  Packaging and labeling specifications, including methods and processes used.
  • Installation, Maintenance, and Servicing:  Installation, maintenance, and servicing procedures and methods.

Contrasting DMR with DHF

The Device Master Record is set up to contain or reference the procedures and specifications that are current on the manufacturing floor for the manufacturing of a particular device or family of devices.  The Design History File, however, is meant to be more a historical file documenting the progression of the device design activities (the design history) for utilization during investigations and continued design efforts.
Regarding software, software specifications include software source code.  The final software specifications that are transferred to production for a particular device or family of devices should be located or referenced in the Device Master Record, while any earlier version should be located or referenced in the Design History File.
Requirements for validation and verification pertaining to device processing may be better kept in the DMR than in the DHF.  However, the documentation of such verification or validation activities relating to processes that are performed for several different devices or families of devices can be placed or referenced in the location that best suits the manufacturer. 
FDA believes it is more important that a manufacturer maintains, stores, and retrieves information in a workable manner than keep the information in particular files.

Store and Retrieve

21 CFR 820.181 provides the option for the DMR to “…include, or refer to the location…” of its contents.  Again, FDA believes it is more important that the manufacturer store and retrieve information in a workable manner, than keep such information in particular files.

Device History Records

21 CFR 820.184 requires manufacturers to maintain Device History Records (DHRs).  The term “Device History Record” is defined in 21 CFR 820.3(i) and means a compilation of records containing the production history of a finished device. 
A DHR represents a batch, lot, or unit and demonstrates that the devices were manufactured in accordance with the Device Master Records and the requirements of the quality system regulation.  The DHR may include of refer to the location of this information. 
Basically, the DHR provides the information necessary to document the production history of a particular batch, lot, or unit; this is different from the Design History File, which provides the information necessary to document the design history of the devices.
The DHR must include or refer to the location of:
  • The dates of manufacture
  • The quantity manufactured
  • The quantity released for distribution
  • The acceptance records that demonstrate that the device was manufactured in accordance with the DMR
  • The primary identification label and labeling used for each production unit
  • Any device identification and control numbers used

Current Criteria

Basically, the DHR consists of records of the production history of a device batch, lot, or unit.    The DHR should reflect the requirements of the documents contained within the most current version of the Device Master Record.  FDA has seen instances where the acceptance records contained within the Device History Record did not reflect the most current acceptance criteria contained in the Device Master Record.


FDA believes that the requirement that the DHR contain the primary label and labeling used for each production unit, coupled with the labeling controls in 21 CFR 820.120, should help ensure that proper labeling is used and, hopefully, decrease the number of recalls due to improper labeling.

Identification and Traceability

The provision for documenting “… any device identification(s) and control number(s) used” does not add any requirement for identification or traceability not already expressed in 21 CFR 820.60 Identification and 820.65 Traceability.


Since DHRs are required by the QSR, they must be reviewed for adequacy and approved by a designated individual(s) in accordance with 21 CFR 820.40, Document Controls.

Quality System Record

21 CFR 820.186 requires manufacturers to maintain a Quality System Record (QSR).  The term “Quality System Record” is defined in 21 CFR 820.186 and includes or refers to the location of procedures and the documentation of activities required by the QSR that are not specific to a particular device or family of devices, including, but not limited to the records required by 21 CFR 820.20, Management Responsibility.  Each manufacturer must ensure that the QSR is prepared and approved in accordance with 21 CFR 820.40 Document Controls.

QSR Not Specific to Device

There is a distinction between the Quality System Record and the Device Master Record.  The documents contained or referred to in the Device Master Record relate to the specific current device or family of devices being manufactured.  On the other hand, the Quality System Record contains or refers to the location of procedures and documentation of activities that are not specific to a particular type of device.
Basically, 21 CFR 820.186 Quality System Record separates the procedures and documentation of activities that are not specific to a particular type of device or family of devices from the device specific records contained within the DMR.

QSR and DMR Data

Although the specific instruments (and procedures) required to measure quality features of the device should be included or referenced in the DMR, the general calibration procedures for those instruments can be included or referenced in the QSR.

Complaint Record

21 CFR 820.198 requires manufacturers to maintain complaint files and to establish procedures for receiving, reviewing, and evaluating complaints.  The term “complaint” is defined in 21 CFR 820.3(b) and means any “written, electronic, or oral communication that alleges deficiencies related to the identity, quality, durability, reliability, safety, effectiveness, or performance of a device after it is released for distribution”. 
Issues relating to nonconformities identified prior to distribution are handled through the company’s systems for the control of nonconforming product and corrective and preventive action.  After a device is released for distribution any communication alleging deficiencies are initially handled through the company’s complaint handling system and may eventually be handled through other systems (e.g., CAPA) as well.
There is a lot of specific detail in 21 CFR 820.198 Complaint Files; however, due to the significance of complaint handling activities, FDA believes the amount of detail in 21 CFR 820.198 is appropriate. 21 CFR 820.198(a) sets forth the general requirement that manufacturers must maintain complaint files. Manufacturers must also establish and maintain procedures for receiving, reviewing, and evaluating complaints by a formally designated unit. 
Complaint handling procedures must ensure that:
  • All complaints are processed in a uniform and timely manner
  • Oral complaints are documented upon receipt
  • Complaints are evaluated to determine whether the complaint represents an event which is required to be reported to FDA under 21 CFR Part 803 (Medical Device Reporting)

Complaint Evaluation

21 CFR 820.198(b) requires manufacturers to review and evaluate all complaints to determine whether an investigation is necessary.  When no investigation is made, the manufacturer must maintain a record that includes the reason no investigation was made and the name of the individual responsible for the decision not to investigate.

Initial Evaluation

The “…review and evaluation …” of complaints required by 21 CFR 820.198(b) is the initial review and evaluation of the complaints to determine if the complaints are “valid.”  This evaluation is not the same as the complaint investigation required by 21 CFR 820.198(c) and 820.198(d).
This initial evaluation is performed to determine:
  • If the information is truly a complaint
  • If a complaint investigation is necessary (in the event that the complaint is valid)


21 CFR 820.198(c) requires manufacturers to investigate complaints involving the possible failure of a device, its labeling, or packaging to meet any of its specifications unless an investigation has already been performed for a similar complaint and another investigation is not necessary.  In other words, duplicate investigations are not required if the manufacturer can show that the same type of failure or nonconformity has already been investigated. Since 21 CFR 820.198(b) requires a manufacturer to document the reason no investigation was made, reference to the previous complaint investigation should be included in the justification.

Reportable Complaints (Under MDR Regulation)

21 CFR 820.198(d) requires manufacturers to designate an individual(s) to promptly review, evaluate, and investigate any complaint that represents an event which must be reported to FDA under the Medical Device Reporting Regulation (21 CFR Part 803).  Complaints involving events that must be reported as MDRs must be maintained in a separate portion of the complaint files or otherwise clearly identified.

Corrective/Preventive Actions

Since the requirements for investigations under 21 CFR 820.100 Corrective and Preventive Action require that nonconforming product discovered before or after distribution be investigated to the degree commensurate with the significance and risk of the nonconformity, firms may elect to “link” complaint investigations into their corrective and preventive action system.  Otherwise, complaint investigation procedures must ensure that they have integrated the necessary elements of 21 CFR 820.100 so that when product nonconformities are identified, the requirements of 21 CFR 820.198 and 21 CFR 820.100 are met.

Complaint Records

21 CFR 820.198(e) requires when an investigation is made under 21 CFR 820.198, a record of the investigation must be maintained by the formally designated unit identified in 21 CFR 820.198(a).  The record of investigation must include:
  • The name of the device
  • The date the complaint was received
  • Any device identification(s) and control number(s) used
  • The name, address, and phone number of the complainant
  • The nature and details of the complaint
  • The dates and results of the investigation
  • Any corrective action taken
  • Any reply to the complainant

Additional Information
In addition to the information required in 820.198(e), records of investigations conducted as required by 820.198(d) must include a determination of:
  • If the device failed to meet specifications
  • If the device was being used for treatment or diagnosis
  • The relationship, if any, of the device to the reported incident or adverse event

Design History File

21 CFR 820.30, Design Controls, requires that each manufacturer establish and maintain a Design History File (DHF) for each type of device.  The DHF must contain or reference the records necessary to demonstrate that the design was developed in accordance with the approved design plan and the requirements of the QSR.  Formal Design Control and Design History File requirements, both a part of GMPs, were instituted by the FDA in 1996-1997.
Not only are these requirements "must dos" because of regulations but they serve companies in the retention of their IP (intellectual property) via the proper documentation of development and changes and via the creation of false starts records, blind alleys and similar development "dead ends.”
The Design History File is a critical document for a medical device and is a record of a series of documents that explain the design history of a medical device.  In other words, it is a documentation of the way by which the inputs that went into the medical device manufacture worked in a preset process to arrive at the final product.  DHF requirements are an important component of the DHF.
The DHF, a strict requirement from the FDA, is essentially meant to show conformance with design controls as specified under 21 CFR 820.30.  The DHF is there to show that the inputs that were specified for a product were met by the resulting product, and also how it got there under conditions of control, once a start date has been established. In other words, it eventually proves design control elements.
The parameters or elements of the DHF requirements that need to be fulfilled are:
  • Design planning
  • Design input
  • Design output
  • Design changes
  • Design reviews
  • Design verification
  • Design validation
  • Design transfer
  • Design History File

The DHF serves as a long-term memory for the company so that successive generations of workers may understand the history of how the device was developed, what decisions were made and for what reason.

Leslie (Les) Schnoll, J.D., MBA, M.S., RAC, CQP has extensive experience in quality assurance, quality control, auditing, regulatory compliance, management, and microbiology in the medical device, pharmaceutical, and clinical/pre-clinical industries.

He is the principal of Quality Docs, LLC, providing quality and regulatory services to the FDA-regulated and Arizona Department of Health-regulated industries. He is also currently an Instructor in the Master of Science in Regulatory Affairs for Drugs, Biologics, and Medical Device program in the College of Professional Studies at Northeastern University and a Faculty Associate at Arizona State University, College of Nursing and Health Innovation, in the MS Regulatory Science and Health Safety Program. He was most recently the Vice President, Quality Assurance and Regulatory Affairs with the J.T. Posey Company and has held executive positions at ThermoGenesis, Theravance, Solectron, Hill-Rom, Gliatech, Cyberonics, Southern Research Institute, KPMG Quality Registrar, and Dow Corning Corporation. Les has conducted various training programs, audits, and systems development in the United States, Canada, Europe, South America, Russia, Australia, and the Pacific Rim. He may be reached at (623) 889-5707 or Visit his website at