Skip to main content
MDA · Act 737 s.40 · MDA/GD/0014 (1st Edition, May 2020)

MDA mandatory problem reporting (adverse event reporting).

If a device registered in Malaysia is involved in an incident, in Malaysia or abroad, its manufacturer or authorised representative must report it to MDA: within 48 hours for a serious public health threat, 10 days for a death or serious deterioration in health (or one that could happen if it recurred), and 30 days for other device failures or labelling problems. Here is what counts, who reports, what is exempt and what MDA expects afterwards.

01 MDA Registration02 GDPMD + Licensing03 ISO 13485 QMS04 MDSAP05 CE / FDA Export
Short answer

Reporting deadlines under section 40 of Act 737.

IncidentReport to MDA withinLegal basis
A serious threat to public health48 hours from discoverys.40(1)(c)
Led to death or a serious deterioration in the health of a patient, user or other person, or could do so if it recurred10 days from discoverys.40(1)(b)
Related to device failure, deterioration in effectiveness, or inadequate labelling or instructions for use30 days from discoverys.40(1)(a)
Investigation report with the Annex B form30 days after the MPR (extension on request)MDA/GD/0014 §4.3

Under MDA/GD/0014 the clock starts as soon as any person at the manufacturer or its authorised representative, including sales staff, becomes aware of the incident. The duty applies only to devices registered in Malaysia, and covers incidents inside and outside Malaysia. Not reporting is an offence under section 40(2): a fine of up to RM200,000, up to two years’ imprisonment, or both.

Who reports what

EstablishmentDuty under MDA/GD/0014 and MDA/GD/0011
Local manufacturer or authorised representativeReports to MDA when the criteria are met, investigates, takes corrective action and submits the investigation report
Importer or distributorReports any incident it learns of to the manufacturer or AR immediately, and passes on complaints that are reportable events
Several manufacturers’ devices used togetherEach manufacturer or AR submits its own report

The manufacturer and AR must set up communication channels with everyone else in the supply chain so that reports, investigations and any field corrective action reach them. “Immediately” means without any delay that cannot be justified. A foreign manufacturer’s reports go through its Malaysian AR, which holds the registration.

Is it reportable? The three criteria

An incident is reportable when all three apply (MDA/GD/0014, section 3.2.1):

  1. an incident has occurred;
  2. the medical device is associated with the incident; and
  3. it led to death, a serious deterioration in health, a serious threat to public health, or no harm but might lead to death or serious injury if it recurred.

A serious deterioration in health includes a life-threatening illness or injury, permanent impairment of a body function or permanent damage to a body structure, or a condition that needs medical or surgical intervention to prevent either. Near-misses count: harm may have been avoided only by luck or by staff stepping in. Where several devices and drugs are involved and the link is unclear, assume the device may have caused or contributed to the incident. In doubt, report.

  • IVDs usually cause indirect harm: misdiagnosis, delayed diagnosis or treatment, inappropriate treatment, or transfusion of inappropriate materials, often from false results or inadequate calibration or quality control. These are reportable. See IVD registration.
  • Use error is reportable when it caused death, a serious deterioration in health or a serious public health threat, when the manufacturer sees a significant change in its trend or pattern, or when it triggers a field corrective action. Other use errors are handled in the quality system, and a decision not to report must be justified and documented.
  • Off-label use is not reported by the manufacturer.
  • Trend reports are required when known, labelled side effects become more frequent or more severe in a way that could lead to death or serious deterioration in health.

When no report is needed

MDA/GD/0014 section 5 lists five conditions, each with MDA’s own examples:

ConditionMDA example
The user always finds the deficiency before useSterile packaging visibly damaged, so the device was not used
The only cause was an exceeded service life or shelf life, and the failure mode is not unusualDefibrillator pads past their labelled shelf life
A protection against a fault worked as designed and nobody was harmedAn infusion pump stops but gives the correct alarm, with no injury
An expected, foreseeable side effect that is labelled and clinically acceptedA known, documented nickel allergy reaction
The risk of death or serious harm was quantified as negligible in a full risk assessment, and none occurredA pacemaker software bug with a negligible, documented probability of harm

Two further exclusions: incidents with devices under clinical investigation are outside the scope of MDA/GD/0014, and an overseas incident needs no Malaysian report if it was reported to that country’s regulator and a field corrective action was taken there and on all affected devices in Malaysia (regulation 5(7) of the 2019 Duties and Obligations Regulations).

What the report contains

Annex A of MDA/GD/0014 is the template for the online report; the layout can vary, but every field is mandatory. It asks for:

  • where the incident happened (in Malaysia, with the type of facility, or which country);
  • the device’s class, Malaysian registration number, name, brand and manufacturer, and whether it is available in Malaysia;
  • affected batch, lot or serial numbers and expiry dates;
  • the report category, the date of the incident and the date your establishment became aware of it;
  • the incident type, a description, the operator, how the device was being used and where it is now;
  • any immediate action taken, such as advice to stop use or quarantine;
  • when the investigation report will follow: within 30 days, or a requested 90, 120 or 150 days.

The investigation form (Annex B) records the findings, root cause, corrective and preventive action, whether the incident leads to a field corrective action or a recall in Malaysia, whether it was reported to other regulators, and patient outcome. It must be submitted with a written investigation report or MDA will not accept it. If users or third parties may have erred, review the labelling and instructions for use for inadequacy. When the investigation leads to action in the field, follow MDA’s recall and field corrective action process.

The records that make reporting possible

  • Complaint handling (Act 737 s.39, MDA/GD/0011, June 2020): give users a standard complaint form, appoint dedicated personnel, record oral complaints, assess each one for reportability, and keep records for 5 years plus the device’s projected useful life.
  • Distribution records (Act 737 s.37, MDA/GD/0012, June 2020): kept for 2 years after supply (or after export shipment), or for the projected useful life if longer. For implants, record the facility, patient where possible and implantation date. These records let you find every affected unit quickly.
  • Change of ownership: post-market obligations continue after a model is discontinued. If they move to another company through a merger or acquisition, tell MDA and give it the new contact details as soon as possible.

MDA’s Post Market Division evaluates mandatory problem reports, field corrective action reports and recall reports, and tests devices already on the market. Under MDA/GD/0067 (January 2024), MDA can share information on events that have led, or are highly likely to lead, to a serious public health threat with other ASEAN regulators through the ASEAN Secretariat. A serious incident in Malaysia can therefore reach the regulators in your other ASEAN markets. Distributors also cover complaint and incident handling in their GDPMD quality system.

Jawapan ringkas · Bahasa Malaysia

Berapa lama tempoh untuk membuat laporan masalah mandatori (MPR) kepada MDA?

Di bawah seksyen 40 Akta 737: dalam masa 48 jam jika insiden merupakan ancaman serius kepada kesihatan awam, 10 hari jika ia menyebabkan kematian atau kemerosotan serius kesihatan (atau boleh berbuat demikian jika berulang), dan 30 hari bagi kegagalan peranti atau kelemahan label. Pengilang atau wakil sah (AR) yang melapor; pengimport dan pengedar perlu memaklumkan mereka dengan segera. Laporan siasatan perlu dihantar dalam 30 hari selepas MPR. WhatsApp 010-206 2070.

FAQ

Frequently asked questions

What is MDA mandatory problem reporting?
Mandatory problem reporting (MPR) is the duty under section 40 of the Medical Device Act 2012 (Act 737) to report incidents involving a medical device to the Medical Device Authority. The ASEAN Medical Device Directive calls it adverse event reporting. MDA’s guidance is MDA/GD/0014, Mandatory Problem Reporting, First Edition (May 2020), read with regulation 5 of the Medical Device (Duties and Obligations of Establishments) Regulations 2019.
What are the MDA mandatory problem reporting deadlines?
Act 737 section 40(1) counts from discovery: 48 hours for an incident that is a serious threat to public health; 10 days for an incident that led to death or a serious deterioration in health, or could do so if it recurred; and 30 days for an incident related to device failure, deterioration in effectiveness, or inadequate labelling or instructions for use. Under MDA/GD/0014 the clock starts as soon as anyone at the manufacturer or authorised representative, including sales staff, becomes aware of the incident.
Who submits the report: the distributor or the authorised representative?
The manufacturer or its authorised representative reports to MDA when the reporting criteria are met. Importers and distributors must report any incident that comes to their attention to the manufacturer or AR immediately (MDA/GD/0014, section 3.3.1). If two or more devices from different manufacturers were used together, each manufacturer or AR submits its own report.
Do incidents outside Malaysia have to be reported?
Yes, if the device is registered in Malaysia. The duty covers incidents inside or outside Malaysia. The exception, under regulation 5(7) of the 2019 Duties and Obligations Regulations, is an overseas incident that was reported to that country’s regulator and for which a field corrective action was taken there and on all affected devices placed in the Malaysian market.
What if we are not sure the incident is reportable?
Report it. MDA/GD/0014 says there should be a predisposition to report rather than not in case of doubt, and that a report is still due within the deadline when reportability is uncertain. Do not hold the report back to gather more information: the initial report should contain what is immediately available. Reporting is not an admission of liability, and written reports may carry a disclaimer saying so.
When is the investigation report due?
Within 30 days after the mandatory problem report, with the completed investigation form (Annex B of MDA/GD/0014) attached. MDA may grant more time if the establishment asks; the reporting form lets you request 90, 120 or 150 days, or longer with a justification. MDA evaluates the report and, if the report and the action taken are satisfactory, informs the establishment in writing that the matter is closed.
What is the penalty for not reporting?
Contravening section 40(1) of Act 737 is an offence. On conviction the establishment is liable to a fine not exceeding RM200,000, imprisonment for a term not exceeding two years, or both (section 40(2)).

Facing a device incident now?

Send us what happened, the device and its registration number, and when your team first heard of it. We will tell you whether it is reportable and which deadline applies, then draft the report and the investigation follow-up for MDA.

WhatsApp