Written and maintained by CASRAI Editorial Board
Last updated
This page describes products and general use; it is not medical advice. It summarizes a federal regulation for clinic staff, buyers and students. It is not legal advice.
Short answer: medical device tracking is a US Food and Drug Administration (FDA) requirement, set out in 21 CFR Part 821, that obliges a manufacturer to be able to locate specific devices from the factory to the patient. It applies only to a Class II or Class III device that meets one of three criteria and for which FDA has issued a tracking order to that manufacturer. Most devices are never tracked under Part 821.
What is medical device tracking (21 CFR 821)?
Part 821, titled Medical Device Tracking Requirements, implements section 519(e) of the Federal Food, Drug, and Cosmetic Act. Its stated aim is that tracked devices can be traced from the manufacturing facility, through distributors, retailers, rental firms, device user facilities and licensed practitioners, to the patient. That traceability is what makes remedies such as patient notification and device recall workable (21 CFR 821.1(b)). FDA describes the purpose in plain terms: to let manufacturers promptly locate devices in commercial distribution, so that tracking information can support notifications and recalls in the case of serious risks to health.
The regulation took effect on August 29, 1993. Since February 19, 1998, tracking is no longer automatic for any class of device: FDA has discretion to order manufacturers of certain Class II or Class III devices to start a tracking program down to the patient level (FDA, Medical Device Tracking page).
Which devices are tracked?
A device becomes a “tracked device” only when two things are true. First, it is a Class II or Class III device that meets one of these criteria (21 CFR 821.1(a)):
- its failure would be reasonably likely to have serious adverse health consequences;
- it is intended to be implanted in the human body for more than 1 year; or
- it is a life-sustaining or life-supporting device used outside a device user facility.
Second, FDA must issue a tracking order to the manufacturer. Under 21 CFR 821.20, a manufacturer must track such a device “if FDA issues a tracking order,” and FDA issues the order when it responds to a premarket notification or premarket approval application. FDA notes that Part 821 does not contain the current list of tracked devices; that list is kept in FDA’s tracking guidance, so check the FDA page rather than the regulation text when you need to know whether a particular product is on it.
Two definitions in 821.3 narrow the criteria. A device “intended to be implanted for more than 1 year” is one meant to continuously assist, restore or replace the function of an organ system or structure, and excludes devices intended for temporary purposes or for explantation in 1 year or less. A life-sustaining or life-supporting device used outside a device user facility is one intended for use outside a hospital, nursing home, ambulatory surgical facility, or diagnostic or outpatient treatment facility; physicians’ offices are not device user facilities. For background on how devices are defined, see what a medical device is, and for the premarket routes that trigger orders, 510(k) data and the PMA database.
Who must do what? Roles, duties and deadlines
The regulation splits responsibility by role. The manufacturer carries the primary burden, and its legal responsibility cannot be changed by contract (821.1(b)-(c)). The table below sets out each role’s core duty and time limit as written in the regulation.
| Role (21 CFR 821.3) | Who it covers | Core duty | Time limit |
|---|---|---|---|
| Manufacturer | Includes importers, repackers and relabelers | Adopt a tracking method; keep records; maintain a written standard operating procedure (SOP); audit the system (821.25) | Give FDA the location of a device held for distribution within 3 working days of a request; give FDA patient-level or multiple-distributor data within 10 working days of a request |
| Distributor | Moves the device toward the final or multiple distributor without repackaging or relabeling it | On acquiring the device, promptly give the manufacturer its name and address, the device identifier, date received and who it came from (821.30(a)) | “Promptly” |
| Final distributor | Distributes a tracked device for a single patient, including licensed practitioners, retail pharmacies and hospitals | On sale or distribution to or for the patient, promptly give the manufacturer the device identifier, patient details (unless the patient has refused), dates and physician details (821.30(b)) | “Promptly” |
| Multiple distributor | Any device user facility, rental company or other entity distributing a life-sustaining or life-supporting device used by more than one patient | Keep written records each time the device is distributed for use by a patient (821.30(c)) | 5 working days for a manufacturer request; 10 working days for an FDA request |
All distributors must also make required records available to the manufacturer for audit on written request, and may petition for an exemption or variance under 821.2 (821.30(d)-(e)).
What data does a tracking record contain?
For a device used by a single patient, 21 CFR 821.25(a)(2) lists, among other items: a unique device identifier (UDI), lot number, batch number, model number or serial number (or another identifier needed for effective tracking); the ship date; the patient’s name, address, telephone number and social security number if available, unless the patient has refused release; the date the device was provided to the patient; the prescribing physician and, if different, the physician regularly following the patient; and, if applicable, explant, death, return or disposal details. Part 821 accepts several kinds of identifier, so lot and serial controls matter here; see lot numbers.
Records, audits and retention
- Written SOP. A manufacturer must have a written SOP for collecting, maintaining and auditing tracking data, including how missing data is recorded and how changes to the system are logged, and must make it available to FDA on request (821.25(c)).
- Audits. The SOP must include a quality assurance audit for each tracked device product at not less than 6-month intervals for the first 3 years of distribution and at least once a year after that, using statistically relevant sampling to check data accuracy and test how the system performs (821.25(c)(3)).
- Retention. Records are kept for the useful life of each tracked device, meaning the time it is in use or in distribution for use. A record may be retired once the device is no longer in use, has been explanted or returned to the manufacturer, or the patient has died (821.60).
- If a business closes. A person who permanently discontinues business must notify FDA and provide a complete set of tracking records; others who take over the right to make or distribute tracked devices take over the tracking responsibility (821.1(d)).
Tracking sits alongside other postmarket and quality duties. The manufacturer-side quality system is covered in 21 CFR Part 820 and surveillance planning in post-market surveillance plans.
Patient privacy and the right to refuse
A patient receiving a tracked device may refuse to release, or refuse permission to release, their name, address, telephone number, social security number or other identifying information for tracking (821.55(a)). Records submitted to FDA are protected from public disclosure to the extent permitted by FDA’s disclosure rules, and identifiers may be shared with a manufacturer, other covered person or physician when the health or safety of the patient requires it, under an agreement not to disclose further (821.55(b)-(c)).
Common mistakes
- Assuming every implant or Class III device is tracked. Meeting a criterion is not enough; a tracking order is required (821.20).
- Using the regulation as the device list. FDA states Part 821 does not contain the current list of tracked devices.
- Treating the manufacturer as solely responsible. Distributors, final distributors and multiple distributors have their own duties, and failing to comply misbrands the device and is a prohibited act under the Act (821.1(c)).
- Handing responsibility to a contractor and considering it settled. Outside organizations may help, but the manufacturer’s legal responsibility cannot be altered by contract (821.1(b)).
- Treating a patient’s refusal as a gap to fill. The regulation gives the patient that right (821.55(a)).
Frequently asked questions
What is 21 CFR 821?
It is the part of the US Code of Federal Regulations, Title 21, that sets FDA’s medical device tracking requirements: which devices can be ordered tracked, what manufacturers and distributors must record and report, how long records are kept, and how patient privacy is handled.
Do all medical devices have to be tracked?
No. Only Class II or Class III devices that meet one of the three criteria and are the subject of an FDA tracking order must be tracked (821.1(a), 821.20).
How quickly must tracking information be produced?
A manufacturer must be able to give FDA the location of a device held for distribution within 3 working days of a request, and patient-level or multiple-distributor information within 10 working days (821.25(a)). A multiple distributor must respond within 5 working days to the manufacturer or 10 working days to FDA (821.30(c)(2)).
Is device tracking the same as a unique device identifier?
No. Tracking is the system of records that follows a device to the patient. A UDI is one kind of identifier that tracking records can use; the regulation also accepts lot, batch, model or serial numbers or another identifier needed for effective tracking (821.25(a)(2)(i)). The UDI itself is defined by reference to 21 CFR 830.20 (821.3(o)).
Can a patient decline to give their information?
Yes. A patient may refuse to release identifying information for tracking purposes (821.55(a)).
Sources
- 21 CFR Part 821, sections 821.1, 821.3, 821.20, 821.25, 821.30, 821.55 and 821.60, Electronic Code of Federal Regulations text as published by the Legal Information Institute, law.cornell.edu/cfr/text/21/part-821, checked 2026-10-31.
- US Food and Drug Administration, Medical Device Tracking, fda.gov/medical-devices/postmarket-requirements-devices/medical-device-tracking, checked 2026-10-31.
