Policy paper

[Withdrawn] How a medical device information system might work in practice

Updated 18 July 2024

This was published under the 2019 to 2022 Johnson Conservative government

This policy paper was withdrawn on 18 July 2024

The Medicines and Medical Devices Act became law in February 2021.

See the Outcomes and Registries Programme and Outcomes and Registries Directions 2024 on the NHS England website.

1. Overview

We recognise that medical devices are not subject to the same comprehensive regulatory system of pre-market assessment as for medicines. We also recognise that because of the way devices are purchased, used and monitored, the system can be improved in how it deals with potential harm to patients from medical devices. This is principally true in relation to higher risk, implanted medical devices like heart stents, pacemakers and breast implants.

It is apparent there is a need for greater information to be captured and shared on medical devices that have been implanted into patients, in order to identify and respond rapidly to product safety concerns, making it possible to identify risks to patients of specific devices and enabling patients and clinicians to discuss any necessary interventions. We deeply sympathise with patients and their families who not only feel that they have suffered adverse outcomes, but who also feel that their voices were not heard. The government is determined that steps are taken to ensure that UK patients are able to access the best, most innovative devices available to support patient outcomes, but also that those devices are safe, it is possible to monitor their clinical effectiveness over the long-term and issues with safety are identified expediently.

The amendment we are making to the Medicines and Medical Devices Bill will facilitate tracking medical devices by their unique identifier, to a patient’s individual record. It will facilitate the capture and use of patient and procedure data on implanted medical devices to create over time a future system of clinical registries. Such a system would monitor the performance of devices and ensure patient outcomes can also be tracked. The longer term aim is to intervene earlier to prevent patient harm before it happens, by enabling the healthcare system to flag concerns, drive regulatory action where appropriate and use alternative and better devices and procedures to mitigate risk to UK patients. The information system, working to underpin this would allow clinicians to be alerted to identified issues with a specific medical device, by utilising data held by the Medicines and Healthcare products Regulatory Agency (MHRA) on medical devices available in the UK. And it could prompt an informed conversation between clinicians and patients. By giving NHS Digital the ability to require healthcare providers and other relevant organisations to input data into the information system, we can in future ensure that no patient in the UK falls through the gaps.

While the future registries system is established, we also want relevant data in the information system to be accessible and sharable, subject to appropriate safeguards, with those who need this information for specified reasons. This will be set out in regulations, including the tracing of patients where there is an implantable device recall or other significant safety concern to protect UK patient safety. This would require the relevant data from the information system to be shared with the NHS in England, NHSX and the Devolved Administrations. This information system will be established for purposes including those related to the safety and clinical effectiveness of medical devices and the safety of patients who have been treated by, or implanted with, a medical device. The data would be controlled and protected by NHS Digital under the regulations to be introduced, with safeguards in place to ensure that data protection remains paramount, as is currently the case for the other information systems NHS Digital operate under the Health and Social Care Act 2012.

We know it is important to get this right. Data about the devices and the patients they have been implanted into is critical to ensuring that we can avert or mitigate potential risks to safety of individuals. But it is important that we consider how this system works for clinicians and patients. We will undertake consultation with stakeholders on the design of the system, its supporting services and operational model and in particular, making sure there is appropriate clinical input, before we make any regulations under this Bill that set out the detail of how the information system will operate.

There are existing arrangements, such as the National Joint Registry (NJR) and the Breast and Cosmetic Implant Registry (BCIR), which capture data on specific implanted devices and patients, to improve outcomes and post-market surveillance. The NJR is an exemplar of registry best practice, due to the way in which it has been clinically-led, conducted engagement with patients and in the completeness of the data it captures. Our plan is that the medical device information system will evolve over time, develop in collaboration with existing registries and future registries to ensure a joined-up, transparent and integrated approach to use of data to improve outcomes and product safety in the future.

We know the ability to track implanted devices to patients has been the subject of significant interest and expert views. It is therefore absolutely right that we continue to take into account the informed opinions and expert advice of stakeholders as we go forward.

2. Data and safeguards

Any data captured and held under a medical device information system would be subject to rigorous safeguards. The Bill provides for regulations that will enable the Health and Social Care Information Centre, known as NHS Digital, the statutory safe haven of health and social care data in England, to establish and operate a UK-wide information system for purposes related to the safety and clinical effectiveness of medical devices. Under the Health and Social Care Act 2012, NHS Digital already collects and analyses healthcare data under directions from the Secretary of State and NHS England. NHS Digital analyses, publishes and disseminates that data subject to the highest information governance standards to protect the personal information of patients.

It is right that the information obtained under the medical device information system, is subject to the same standards – that it is GDPR compliant, that the information system is secure and that access to the data obtained under the system is for specific appropriate purposes, including patient and product safety.

It is intended that the information system is delivered in the same way as the other information systems operated by NHS Digital under the 2012 Act. This would provide for relevant data necessary to support analysis by NHS Digital and shared from the system with relevant organisations while protecting the details of sensitive information which would be restricted to those who absolutely need it for legitimate purposes.

For example, it may be necessary for NHS Digital to share information with the MHRA, so that the MHRA can act on ‘signals’ that a medical device or medical devices are causing concern. NHS Digital would only share the specific data required to achieve that purpose. It may be necessary for NHS Digital or others to analyse the data and understand trends, which may involve sharing relevant data with academics or research bodies to support product or patient safety outcomes or other healthcare research. NHS Digital would only analyse and share data that was needed, which would be anonymised unless NHS Digital or the recipient required identifiable data for a specific legitimate purpose and the recipient had a legal basis for this, such as where patients have explicitly consented to participate in research studies.

We would expect that the information collected and analysed under the system could be used, with safeguards, to ensure the effective use of data within the healthcare system. We would therefore specify through the regulations made under this Bill, the legitimate purposes for which data could be lawfully shared.

This information system, combined with the existing data collected and analysed by NHS Digital under the Health and Social Care Act 2012, could significantly improve outcomes. It could make the way in which devices are reviewed and tracked over the long term, and regulated, more transparent. If the MHRA were to trigger a device recall under the powers available to them elsewhere in the Bill, the system could enable this information to be made available in order to identify the patients affected with greater confidence than has been the case before. It may also reduce the burden on the NHS system, as achieving recall of a product now is a difficult endeavour which we would expect to be made simpler and easier in future. The system would allow improved understanding of the patient experience of devices, to be tracked and caught, integrated into post-market surveillance.

3. Access and analysis

This Bill seeks to improve the way in which medical devices are regulated. It provides clarity over the powers of enforcement available to the regulator, introduces a new ability for the Secretary of State to disclose information about a medical device when he or she considers there to be a risk to patient safety, and makes explicit what regulations could be used and how to update or amend the UK medical device regulations.

There are well-accepted limitations on the amount of pre-market assessment which can be conducted for devices, unlike medicines, given that evidence of their actual use by patients is critical to the overall assessment of their performance and clinical effectiveness. It is also acknowledged that the most effective way to ensure that the safe use of devices is to support the gathering of good-quality post-market data to identify risks and act on them rapidly. This means that merely enhancing pre-market assessment via regulatory change cannot eliminate all risk.

Clinicians, manufacturers, Notified Bodies and the MHRA already conduct important and ongoing post-market surveillance and vigilance to respond to information about the safety of medical devices when in use and take appropriate action to improve them. This includes auditing notified bodies, use of the Yellow Card System, issuing Medical Device Alerts to the healthcare service and the restricting or recalling of products. The regulatory system will continue to be improved by this government after we have concluded the transitional period in the UK’s departure from the European Union and have what has not been available to date: the essential regulatory autonomy to effect such change.

This amendment complements existing changes provided for under this Bill and our direction of travel. This devices information system would ensure that devices regulation is informed by analysis of how devices interact with patients. For example, if a cohort of patients with certain common characteristics or co-morbidities were flagged to have similar interactions with a device, this information could support how the MHRA regulate devices of that kind, for example, asking the device manufacturer to supply further information alongside a device under the powers available to the Secretary of State through this Bill such as safety notices provided at clause 18. If, for example, it was found that the way in which a device was implanted, affected the effectiveness of that device, this information could also feed the regulation of devices, ensuring that the information relevant to clinicians and patients was available to them when considering implanting a device.

NHS Digital and MHRA both engage academics and other experts to support their work. Information might be shared with academic groups in a safe, secure, lawful and appropriate way so that analysis and insights could be generated making effective use of expertise to improve the UK experience for patients, and the effectiveness of UK device regulation. Suitably anonymised information from the information system will be used by health regulators including the MHRA and National Institute for Health and Care Excellence (NICE) to improve their post-market surveillance of medical devices and to prevent harm to patients in the future through improvements and innovations in medical device technology, and by informing what is authorised for use, when, how and for what purpose.

Appropriate information held in the medical device information system will, at a future date and when in place, be made available to current and new clinical registries operating under a best practice model we are now exploring. This data would enable the registries to analyse the information to determine the safety and clinical effectiveness of medical devices linked to their clinical expertise and professional collaboration.

When device safety issues occur, the regulations will set out how the information system will support the track and trace of patients who have received implants and ensure that they receive appropriate medical treatment. This type of action might also take place in response to decisions of the MHRA.

Based upon analysis of information drawn from the registry, MHRA will be able to make decisions about regulatory action required. The registries and clinical specialists will also be able to take appropriate action, if this is required for patients.

We expect that the registries will provide information to the regulator (the MHRA) to help ensure that appropriate regulatory action is taken where standards for placement on the UK market are breached.

The regulations made under the Bill will set out how information would be shared, for what purposes and how information would flow between organisations.

4. Consultation

It is absolutely right that an area as important as this, takes into account the views and considerations of clinicians, patients and affected stakeholders. The regulations that will set out how the information system will operate and will be subject to the same requirement as any other regulation-making power in this Bill; it is subject to an obligation to consult before regulations are made, with whomever the Secretary of State considers appropriate. We feel that this is the right way of striking a balance between ensuring that all those who ought to be consulted on the way in which regulations are made, are, without inadvertently limiting consultation to a list relevant at this point in time, but which would necessarily change and evolve over time. It is our clear intention that critical to this is that the establishment of any information system has appropriate clinical input. It is right that the information system is supported by those affected, and we can indicate those groups we think will need to be consulted on the development of regulations, but we do not wish to proscribe ourselves to only consulting those groups.

As we continue to design the future system of registries and work with health and social care organisations to embed the data capture requirements that will enable it to function, we will consult in detail with the Devolved Administrations, the MHRA, the NHS across the UK, private providers and other key stakeholders to ensure that we get it right.

This information system is not seen in isolation. It is part of wider work to improve the collection of data across the NHS. As such, NHS Digital are already engaged with NHS England and other stakeholders to review all data collections, including existing registry and audit collections, to identify opportunities to streamline the data collected, amalgamating existing collections where appropriate to reduce burden of collection by provider organisations and to drive cost efficiencies. NHS Digital is also presently acting under a direction from the Secretary of State (the Surgical Devices and Implants Directions 2019) to create a medical devices information system for England.

5. International comparisons

UK registries are already considered to be exemplars on the global stage, such as the National Joint Registry. We already contribute to a number of multi-national collaborations in fields such as orthopaedics and vascular surgery; any improvement to data provision brought about by this information system will not only lead to improvements for UK patients, but also aid international efforts to improve patient safety and outcomes.

There are similar national systems in place in Denmark and the Netherlands. In the Netherlands, the National Implants Registry was created through legislation that came into force in July 2018. This required the application of a Unique Device Identifier (UDI) by suppliers to a device, and for hospitals to register and trace medical devices through their systems. In 2019, doctors became required to record data on implants in a patient’s Electronic Patient Dossier (EPD) and the National Implants Registry could collect this information from the EPD. In Denmark, the National Implant Register was created through legislation that came into force in July 2018. The legalisation required healthcare professionals to submit information on the patient (patient security number), device (UDI) and the hospital in which the clinical procedure took place to a national implant registry to facilitate patient track and trace.

However, the Medical Device Information System and the direction of travel it sets for the UK will be more comprehensive, as it is will look not only at device usage and traceability, but also clinical outcomes. We would expect the ability for NHS Digital to share appropriate information with organisations or for specified purposes to support the analysis necessary for regulators to engage in international efforts.

6. Definitions

There is no universally understood language in this area. We have therefore adopted the following distinctions to aid understanding, although, as definitions change over time, this is not specified on the face of the Bill: A register of medical devices provided for under the Medicines and Medical Devices Bill as introduced in February 2020, allows for the capture of information (master data) about medical devices available on the UK market. It is intended to hold the detail of manufacturers, which devices they have placed on the market and it would not contain the detail of patients, procedures or how those devices have been used. It would facilitate regulatory action by the MHRA and to identify products.

A registry is a combination of patient information, supplementary clinical information and information about a device. They are an organised system that continuously and consistently collects relevant data in conjunction with routine clinical care, evaluates meaningful outcomes and comprehensively covers the population defined by exposure to a particular medical device(s) at a reasonably generalised scale (for example, national, regional, health system) with a primary aim to improve the quality of patient care.

An information system is a system for the collection and analysis of information including linkage of information in it with other data held by NHS Digital. This will include the collection of information from registers or registries as required. In order to make effective use of data, it is necessary to have national-level data collection and linkage to enable the analysis of trends, and to ensure that effective use of data from other existing information systems can be made.