Who Pays to Fix Year 2000 Problems?

Medical Device & Diagnostic Industry Magazine
MDDI Article Index

An MD&DI August 1998 Column

FDA compliance and product liability concerns are part of the equation in determining who should bear the costs of correcting year 2000–deficient devices.

During the past year, the so-called year 2000 problem has generated much attention. A variety of medical devices rely on computer software that uses and/or generates dates in algorithms, calculations, or recordkeeping, and these devices typically have been programmed to recognize the year by the last two digits. Since it was presumed that the year occurs in the twentieth century, such devices may have difficulty handling the turn of the century. For example, in the year 2000, a device might mistake the year "00" for the year 1900. Other date-related problems could occur, such as the use of certain dates (for example, 9/9/99) to flag specific computer actions or the failure to accurately address leap years (there will be a February 29, 2000). Depending on the type of medical device, these kind of errors could have trivial consequences or could create a risk of serious injury to a patient.

Every manufacturer whose device relies on computer systems and software applications, including embedded microprocessors, must at least consider whether its device has a year 2000 problem and what could go wrong. Because repairs could be time-consuming and expensive, manufacturers also should carefully review both FDA and product liability requirements when determining who should cover the costs of correction.

WHAT FDA SAYS

As might be expected, FDA is scrutinizing the year 2000 problem and its potential adverse effects on patient health. In June 1997, the agency wrote to all manufacturers informing them of the potential problem and indicating the general scope of their obligation to address it. Last year FDA began posting more-detailed information about the problem on its Web site, which is updated periodically. Finally, FDA recently issued a draft guidance document.¹ Public comment on this guidance has been solicited. However, the general outline of FDA's policies is already clear.

Manufacturers Must Take Corrective Action. FDA has concluded that only manufacturers have sufficiently detailed knowledge of their devices' designs and production and quality control processes to effectively evaluate the potential for risk to patients from a year 2000 problem. Consequently, the agency intends to hold manufacturers responsible for conducting a systematic review of their devices and identifying through hazard and safety analysis those that pose a risk of injury to patients by the improper processing of dates.

According to FDA, a manufacturer's obligation to conduct a year 2000 review arises under the old GMP regulation and the new quality system regulation. These regulations require that manufacturers investigate and correct problems that cause a device to operate out of specifications under expected conditions of use.² FDA considers the use of a device after January 1, 2000, to be within expected conditions of use. FDA's position is that a manufacturer's responsibility extends to entire lines of equipment and software, not just currently produced or supported products.

FDA has said, however, that it would like manufacturers to concentrate their resources on repairing or removing from the marketplace those devices that, if unable to correctly process dates, could pose a risk to patient health. The agency will not require manufacturers to undertake costly remedial action to correct date problems that would not result in real health consequences. As an example, FDA would not expect companies to repair a device that merely generates records that will be reviewed by humans, since a year of "00" is not likely to be confused with similar records from 1900.

FDA has reminded manufacturers that computer-assisted design, production, and quality control processes also may have year 2000 problems that need to be corrected prior to the new century in order to ensure a continuing ability to comply with GMP requirements.

Corrective Action Will Not Be Classified as a Recall. FDA also has said that a manufacturer's removal or correction of a marketed product to address a year 2000 problem will not be treated as a recall under FDA's voluntary recall regulation (21 CFR 7) if it is undertaken solely to correct a date-related problem and is completed prior to December 31, 1999.

Corrective Action Must Be Reported. When a correction is made to a device to reduce a risk to health or to remedy a violation of the Federal Food, Drug, and Cosmetic Act (FD&C Act) that may present a risk to health, FDA's corrections and removal regulation requires manufacturers to report such actions to the agency.³ This regulation became effective May 17, 1998. Under the corrections and removal regulation, a manufacturer that corrects a year 2000 problem (either in the field or after removal) will have to report the corrective action if it is undertaken to reduce a risk to health. After the turn of the century, the action also could be reportable if it is done to remedy a year 2000 problem that may present a risk to health, since the device's failure to operate within specifications as a result of the year 2000 date change would likely render it violative of the FD&C Act in FDA's view.

Modified Devices Do Not Need Premarket Submissions. FDA will not require a premarket approval (PMA) supplement for year 2000—modified Class III devices if other aspects of device performance remain the same and no new design features are added. Likewise, the manufacturers of devices cleared by the premarket notification (510(k)) process are not required to submit a new 510(k) if the year 2000 repair does not significantly affect safety and effectiveness (although the change should be described in any future submissions for a significant change to the device). Manufacturers are, however, obligated to use appropriate design controls and validation when making corrective changes. It is also essential to maintain appropriate documentation that can be used, if necessary, to demonstrate to an FDA inspector that proper controls and validation were used.

FDA intends to require future 510(k) submissions and PMA applications to provide assurance that products can accurately perform date recording and computations into the next century.

Manufacturers Can Voluntarily Report Year 2000 Compliance to FDA. FDA does not believe it will be necessary or efficient to require by regulation that manufacturers report to the agency the year 2000 status of their products. However, in January 1998, the Department of Health and Human Services sent a letter to biomedical equipment manufacturing firms requesting that they voluntarily provide information on the year 2000 compliance status of their products. This information is being made available on FDA's year 2000 Web pages.

PRODUCT LIABILITY'S ROLE

Product liability law is rife with uncertainty, in part because the law can vary from state to state, and juries are notoriously unpredictable. Nonetheless, a manufacturer whose device injures a patient as a result of a year 2000 problem runs a significant risk of being held legally responsible. A plaintiff would likely have several potentially viable theories of recovery.^4–6 First, the manufacturer might be held negligent if it failed to exercise reasonable care when designing the device and the improper design caused the plaintiff's injury. It is up to the jury to decide whether the care exercised by the manufacturer was "reasonable."

Second, a manufacturer could be deemed negligent for failing to take corrective action and/or warn users after becoming aware of a year 2000 problem. The duty to warn can be a continuing obligation, so that a manufacturer that learns about a risk for the first time after the device has already been shipped may well be obligated to seek out distributors and customers to provide them with an appropriate warning. The widespread knowledge of the year 2000 problem and FDA's specific warnings could be considered sufficient to create a presumption that all manufacturers knew (or should have known) of the problem.

Third, a manufacturer might be held liable if the device is found to be unreasonably dangerous because of a year 2000 problem. In a majority of jurisdictions, the issue would be whether the risk of harm outweighed the benefit of the device. If the device has a year 2000 problem that could have been easily remedied and the potential for injury was sufficiently serious, a jury could view the risk as exceeding the device's benefit. A device also could be deemed unreasonably dangerous on the basis of inadequate warning to the user about the year 2000 problem. Again, it is up to the jury to determine whether the manufacturer's warning was "adequate."

Finally, a manufacturer may have offered an express or implied warranty that is breached by a year 2000 problem. In most states, a patient injured by the device as a result of the breach of warranty will have a right to sue for damages.

These four theories are probably not the only possible avenues of recovery. Regardless of the plaintiff's particular theory of liability, the fact finder in most cases will likely view the manufacturer as the party in the best position to know whether its device has a year 2000 problem, how device performance might be affected (i.e., the risk of injury), and how to repair the problem. Consequently, if a patient is injured, a fact finder may well conclude that the manufacturer should be held liable for failing to fix the problem and/or warn the user. To the extent that manufacturers have received advance notice of the need to address the year 2000 problem, such cases could even be candidates for punitive damages.

SO WHO PICKS UP THE TAB?

Must manufacturers bear the entire cost of year 2000 repairs? Some manufacturers have sought to shift at least some of the burden to device users by establishing a manufacturing cutoff date. That is, device owners are asked to pay for repairs for devices made prior to a certain year, and the manufacturer takes responsibility for devices manufactured in later years. Other companies are seeking to hold suppliers responsible if the implicated computer software was not generated in-house. Most likely, the ultimate pattern of burden-sharing for year 2000 repairs will result from the complex interaction of a number of factors, including FDA compliance obligations, the terms of contracts and warranties, the parties' relative bargaining power, and product liability considerations.

One important factor in the bargaining process between manufacturers and device users will be FDA's position on the manufacturers' responsibility for the cost of repairs. Section 518 of the FD&C Act gives FDA authority to require manufacturers to repair, replace, or refund the purchase price of defective devices if the agency finds that a device presents an unreasonable risk of substantial harm to the public health. FDA has rarely invoked this authority, partly because manufacturers often agree to conduct a voluntary recall in situations that might warrant an FDA action under section 518. FDA also has additional remedial authority regarding repair and replacement for products subject to the electronic production radiation control program, which FDA has used more frequently.⁷

FDA's guidance document indicates that the agency will impose mandatory recalls only when the threshold for action under section 518 has been satisfied (i.e., when there is an unreasonable risk of substantial harm to the public health). Otherwise, manufacturers are free to negotiate a resolution with device users, subject to contractual and customer relations considerations. However, FDA also has adopted the view that devices not operating within specifications and capable of causing patient injury because of a year 2000 problem are adulterated and/or misbranded under the FD&C Act, which makes manufacturers responsible for bringing such devices into compliance, at least when patient health and safety are threatened. Any failure to do so could subject manufacturers to the full range of FDA's enforcement powers, including, in the most egregious circumstances, product seizure and civil and criminal penalties.

Product liability also must be considered in the negotiations over who pays the cost of repairs. The bottom line is that manufacturers generally are held responsible for revising or removing from the market products that pose a real risk to patient health. For example, suppose a manufacturer aggressively warns users about a year 2000 problem that could injure patients but refuses to repair its devices unless the user pays the cost. The manufacturer argues that its obligation is satisfied by having passed on the warning and that any patient injuries are the responsibility of device users.

If a patient or device user is injured, this argument probably would not hold up in court. First, the manufacturer could still be held liable on a negligent design or design defect theory, despite issuing a warning. Second, as a practical matter, an injured patient will probably sue both the manufacturer and the device user. It seems quite likely that most juries will view the patient as the innocent victim of the defendants' squabble over repair costs. Worse, the jury might conclude that the manufacturer was wrong for not taking full responsibility for the repair cost in the first place.

GETTING STARTED

All manufacturers should review their computerized devices to determine if a year 2000 problem exists. If the answer is yes, a corrective action plan should be drafted. Although corrective actions for year 2000 problems will not legally be considered a recall if completed by December 31, 1999, manufacturers should approach the situation in the same way as they would a recall. It would be especially beneficial to follow the voluntary recall guidelines set forth in 21 CFR 7. These guidelines will enable manufacturers to establish an effective program that FDA would likely find acceptable if the agency were to review the manufacturer's actions. In addition, such a program will help reduce product liability exposure by providing evidence that the manufacturer acted responsibly to address its year 2000 problem. To preserve privilege and confidentiality to the extent possible, manufacturers may wish to involve legal counsel in the process.

A particularly important step in the year 2000 review is to perform a hazard and safety analysis to estimate the likelihood and severity of any harm a patient would sustain as a result of a year 2000 problem. A good way to assess potential harm is to complete CDRH's health hazard evaluation form, which FDA uses to assign recall classifications (Class I, II, or III).⁸ Assessments should consider all date errors that might lead to device failure or to incorrect records potentially affecting future diagnosis or treatment. Based on this assessment, manufacturers with more than one product should explicitly rank their products based on the severity of risk to patient health, then prioritize their resources accordingly when taking corrective actions.

CONCLUSION

The question of whether the manufacturer or customer must bear the repair cost to cure a year 2000 problem is a matter of contract and negotiation between the parties. As a matter of FDA compliance and product liability law, however, manufacturers are ultimately likely to be held responsible for ensuring that their devices are repaired when patients could be at risk, which would include covering the cost.

As a final precaution, manufacturers should post their year 2000 information on both their own and FDA's Web sites. Dissemination of year 2000 information on the World Wide Web will be a low-cost way for manufacturers to underscore their commitment to resolving year 2000 problems as expeditiously as possible. A willingness to take such steps can only help improve a manufacturer's reputation with FDA and its customers and should help reduce product liability exposure.

REFERENCES

1. http://www.fda.gov/cdrh/yr2000/yr2000.html.

2. Code of Federal Regulations, 21 CFR 820.100, 820.198.

3. Code of Federal Regulations, 21 CFR 806.10.

4. Douthwaite G, Jury Instructions on Medical Issues, sect 10-2, 10-4, 10-7, 10-10.

5. Sherman P, Product Liability for the General Practitioner, sect 1.10, 1.15, 7.10–13, 1981 and supp 1997.

6. Am Law Prod Liab, 3d 89:4.

7. FD&C Act, subchap J and sect 535(f).

8. To obtain a copy of the Center for Devices and Radiological Health Office of Compliance health hazard evaluation worksheet, contact the agency at 301/594-4692.

Jeffrey K. Shapiro is an attorney specializing in food and drug law at the law firm of Hogan & Hartson in Washington, DC.

Illustration by Jean-Francois Allaux

Copyright ©1998 Medical Device & Diagnostic Industry