Language selection

Government of Canada / Gouvernement du Canada

Search

Handling complaints about medical devices (GUI-0065): Step-by-step guide 

On this page

How to handle complaints

In this section, you will find a template for receiving, documenting, investigating, responding to and closing complaints. The template gives details about each of the steps involved in the 5-stage process.

You may:

Whichever choice you make, you must still meet the requirements of the Food and Drugs Act and Medical Devices Regulations (regulations).

To ensure your procedure(s) include needed tasks, consult the checklist for complaint-handling procedures.

Stage 1: Collect and screen

In Stage 1, your procedures should describe how you collect, screen, document and forward complaints for preliminary assessment.

Step 1: Identify who reports complaints and how

Your procedure(s) should identify:

People who report a complaint tend to be:

Channels for reporting complaints include such things as:

Step 2: Identify who receives complaints

You should choose a qualified person or unit to do the first review of incoming reports about a medical device. Your procedure(s) should direct staff to bring complaints or problems with a device to this single person or unit.

Step 3: Review and screen all complaint-related communications

The responsible person or unit must decide if the information meets the definition of a complaint. Your procedure(s) should outline the criteria for what qualifies as a complaint.

The person contacting your company might not identify their reason for contacting you as a complaint when, in fact, it is a complaint. For example, the reason for contacting you might be to:

Or the person might identify something as a complaint when it's not. For example:

Your procedure(s) should also call for a qualified person or group to review, on a regular basis, what is not reported as a complaint, including:

The person or group should review the information to determine whether there is evidence that the:

Step 4: Ask for the affected device

Once the responsible person or unit identifies an incoming report as a complaint, they should:

Getting the affected device will make it easier to examine and test the device (or recreate the problem with a sample from the same lot) during the root cause investigation. The device label and packaging also contain information that can help you track the lot or batch from which it came.

Your procedure(s) should reflect the requirement to get the affected device. They should also include instructions on:

Step 5: Document complaints

The responsible person or unit must document the complaint. Your procedure(s) should identify:

The information you collect should identify:

You can find suggestions for what information to collect in the checklist for collecting complaint information.

The person reporting the complaint should send you complete information about the complaint. It is your responsibility to follow up with any missing information. You will need to confirm that the complaint report includes the information required for preliminary assessment and investigating the complaint.

You should use a standard complaint form, log or a database to document complaint information. If you have a complaint log, you may be able to use the log to:

In some cases, a customized form may be more effective than a standard form. For example, if you have various types of devices with known or expected failure modes, use a customized form to collect details that are relevant for a specific device type.

Your procedure(s) should include a copy of the most current complaint form(s). If you use a log or database, the procedure(s) should:

Step 6: Forward for preliminary assessment

The responsible person or unit must forward the complaint to a person or group within your company responsible for doing a preliminary assessment. Your procedure(s) must set a time limit for forwarding the incoming complaint after receiving it. This time limit must be determined based on the initial risk identified. The requirement for reporting incidents to Health Canada (10 days and 30 days) should be taken into account when establishing these timeframes. For example, if you receive a complaint related to the failure of a device that has led to a death, you are required to submit an incident report to Health Canada within 10 days after becoming aware of that incident. In this case, the time limit for forwarding this complaint must be less than 10 days.

If the level of risk associated with the affected device is unknown, you should choose a period based on the highest level of risk. Doing so will ensure you assess the complaint as soon as possible. Your procedure(s) should specify a measurable time frame (for example, in x hours or x days) rather than "immediately" or "as soon as possible".

Stage 2: Preliminary Assessment

In Stage 2, your procedure(s) should describe how you review and assess the complaint by performing a preliminary risk assessment and identify whether to put interim measures in place, notify the manufacturer or send preliminary and final incident reports to Health Canada where applicable.

Step 1: Review the complaint

You must designate a qualified person or unit to verify incoming reports identified as a complaint in Stage 1. Incoming reports are reviewed to determine if the complaint is valid according to the definition provided in your procedure(s).

Note that you must document all actions you take at each step. Your procedure(s) should specify how to determine if the incoming report is a valid complaint.

Other important considerations include:

Your procedure(s) should provide a timeframe for confirming that the complaint is valid. Be aware that manufacturers and importers have strict timelines for submitting incident reports to Health Canada.

If you decide that a complaint does not require an investigation, you must document:

Your procedure(s) should specify the criteria by which this type of decision is made. You can skip to Stage 5 to close the complaint file.

Step 2: Perform a preliminary risk assessment

Your procedure(s) should require a preliminary risk assessment of any complaints related to the safety or performance of a device. They should also address who is responsible to identify the risk and specify an appropriate timeframe to complete this task.

Risk is a combination of the likelihood that harm will occur and the severity of that harm.

The preliminary risk assessment is carried out through the following 3 steps:

  1. review and analyze available information on the complaint
  2. identify the potential hazards (known or new hazards)
  3. estimate the risks associated with the identified hazards

Further action may be required if the risk associated to the hazard is unknown. Unknown hazards should be treated at a higher risk level with shorter actionable time frames until the risk of the hazard can be determined and mitigated.

Identifying hazards and assigning level of risks is a key part of managing medical device complaints. Risks may arise from hazards created through the use of the device or through defects that compromise its safety and performance.

There are factors to consider when estimating the risks of potential hazards. Health Canada uses a risk analysis framework for estimating the risk levels of hazards.

Factors to consider when estimating risk

Estimating risk is a key step in the risk management process. It involves assessing each hazardous situation to determine the likelihood that the hazard will occur and the degree of harm that will result if it does.

Consider the following factors when estimating risk:

More information sources and data for estimating risks can be found in ISO 14971.

Risk Evaluation

You will need to estimate and assign a level of risk to the affected device. The timeframe for taking action should be linked to the assigned risk level. There are many ways to assign risk level(s), such as treating everything as high risk or high/low or high/medium/low. You may also consider adopting the risk estimation approach that Health Canada uses. Our framework classifies risk into 3 categories based on probability and severity.

Make sure that your assigned risk levels are clearly defined and have timeframes for key actions required.

If you are a private-label manufacturer, importer or distributor

Some of your actions or activities may be contributing to or causing the problem. This is why you should always review post-market activities, such as shipping and storage, to see whether they might have played a role in the problem.

For example, if you do not have adequate shipping controls in place, test kits which are temperature-sensitive could freeze during shipping and produce inaccurate test results.

You may need to contact your supplier or the manufacturer if you are uncertain of the risk caused by your action, such as the lack of shipping controls. You are responsible for taking action based on their response, if necessary.

Step 3: Put interim risk control measures in place

Once the responsible person or unit has done the preliminary risk assessment, you must consider whether interim risk control measures are needed. Your procedure(s) should help you:

Scenario:

You are an importer who has received complaints from several health care facilities about the failure of a specific lot of a device. Failure poses a critical risk (Type I). You immediately contact the manufacturer. You also quarantine the devices you have in inventory. Then, you proceed with a recall, notifying all your customers who received this affected lot to cease further distribution and putting the devices from that lot aside. You want them to avoid using the devices until the manufacturer can further investigate.

If you are the manufacturer

To reduce the risk to end-users, you must communicate these control measures to the other parties in the medical device distribution chain, as needed (for example, private-label manufacturer, importer and/or distributor).

If you are a private-label manufacturer, importer or distributor

You must notify the manufacturer (step 4) about the control measures you have put in place. If the manufacturer asks you to put control measures in place, you must confirm that you have done so.

Step 4: Notify the manufacturer

If you are the manufacturer, skip this step. Proceed to Step 5.

Once you have completed your preliminary risk assessment and put interim risk control measures in place (when necessary), you must notify the manufacturer as soon as possible about the complaint. If you are a distributor, you may not have direct contact with the manufacturer. You may need to contact your importer or supplier from whom you purchased the medical device.

Your procedures should specify how to notify and what information to provide to the manufacturer or supplier, such as:

The manufacturer can then begin to investigate the cause of the problem. The manufacturer may also agree to a timeframe for providing you with the results of the investigation that could impact your activities.

Note: Although the manufacturer is ultimately responsible for the safety and effectiveness of the medical device, you also are responsible for the devices you sell in Canada. If the manufacturer is unwilling or unable to conduct an investigation, you should take action to control the risks. This might involve recalling the device.

If you are a private-label manufacturer or importer

You should consult with the manufacturer when the risk to health is unclear. The manufacturer may assist you in completing the incident report to Health Canada, when applicable.

Step 5: Send Health Canada an incident report (if applicable)

If you are a distributor, skip this step. Proceed to Stage 4.

You must review all complaints with safety or performance issues to determine whether it is an incident that needs to be reported to Health Canada. Your procedures must direct you to check each complaint against the criteria in section 59 of the regulations.

If the incident meets the criteria, under subsection 60(1) of the regulations you must send a preliminary incident report to Health Canada:

Your procedures should indicate these timeframes for reporting to Health Canada. You need to assess a complaint early enough to ensure that you can meet the deadline for reporting to Health Canada. For this reason, you may choose to carry out the evaluation while you perform the preliminary risk assessment.

Subsection 60(2) of the regulations outlines what information to include in the report.

You must also send a final incident report to Health Canada once the incident is closed. You may send both the preliminary and final reports at the same time, if you have all required information within the reporting timeframe(s).

Reportable incidents may be submitted to Health Canada using the following form:

Note: To better understand and comply with the reporting requirements, consult:

If you are the manufacturer

You must inform the importer or private-label manufacturer when you send Health Canada an incident report. This way, the importer or private-label manufacturer will know that they must also submit an incident report to Health Canada.

Stage 3: Investigate

If you are an importer, distributor or private-label manufacturer and you rely on the manufacturer to carry out root cause investigations, you may skip to Stage 4.

Note: If your actions or activities contributed to or led to the problem, you may need to conduct an investigation.

You must designate a qualified person or unit to investigate complaints. Your procedure(s) should specify that the person or unit must have the training, experience and knowledge to understand:

Step 1: Decide whether to investigate

Once you are notified of a complaint and have received information about it, the person or unit(s) responsible must decide if an investigation is necessary. To do so, they should review:

If the qualified person or unit decides further investigation is needed, proceed to Step 2.

If the qualified person or unit decides further investigation is not needed:

Your procedure(s) must specify the criteria on which this type of decision should be based.

Step 2: Determine root cause

The purpose of this type of investigation is to:

Once the qualified person or unit decides an investigation is needed, they must try to determine the root causes of the problem.

Your procedure(s) should direct the qualified person or unit to:

The qualified person or unit starts by reviewing the results obtained in step 1 (deciding whether to investigate.) The review aims to identify factors that may have contributed to the problem or areas where further focus or questions are needed. The tools or methods you can use to identify the root cause of a problem include:

Step 3: Analyze risk

Once you have identified a potentially unacceptable and/or previously unknown risk, your qualified person or unit must conduct a complete risk analysis. Your procedure(s) should specify that a risk analysis is a requirement.

A detailed risk analysis will produce more accurate results than a preliminary risk assessment in Stage 2. A detailed analysis considers several factors, including the results of the root cause investigation. A preliminary assessment is conducted soon after a complaint is received and so may rely on limited information.

A risk assessment is the umbrella term for analyzing and evaluating the risk associated with a hazard or event. The term combines the risk analysis and the risk evaluation of steps 3 and 4.

The purpose of analyzing the risk identified during the root cause investigation is to:

For more guidance on risk management, consult:

Step 4: Evaluate risk

Once the qualified person or unit has analyzed the risks, they must evaluate the level of risk associated with the affected device. The purpose of the evaluation is to determine whether the level of risk is acceptable. Your procedure(s) should:

ISO 14971 is a recognized standard for managing risks of medical devices. Under this standard, the manufacturer must develop a risk management plan for each Class II to IV device manufactured. This plan defines the scope of the risk management activities and establishes risk acceptability criteria.

To evaluate risk, the qualified person or unit compares the newly estimated risks of the hazard (Step 3: Analyze risk) with the criteria for risk acceptability in the risk management plan. If an underlying hazard had already been identified in the risk management file for the device, the qualified person or unit reviews the associated risk estimate to determine if it is still valid and the risk is still acceptable or not.

Note: While you do not have to use ISO 14971, you must meet the safety and effectiveness requirements in the regulations. These requirements include taking steps to identify, eliminate or reduce risks associated with the device during its design and manufacturing stages. Thus, you should have something like a risk management plan and risk management file in place.

The qualified person or unit will conclude whether the risk is acceptable, not acceptable or the root cause cannot be identified as part of the risk evaluation.

Potential risk is acceptable

If deemed "acceptable", you must decide whether to put measures in place that will:

If you decide:

Potential risk is not acceptable

If the qualified person or unit concludes that the affected device poses a potential unacceptable risk, proceed to step 5.

Unable to identify the root cause

If the qualified person or unit cannot identify the root cause, such as when there is limited information available about the reported problem, skip to Stage 5.

Your procedure(s) should direct the qualified person or unit to communicate the conclusions and rationale to the importer, distributor or private-label manufacturer who reported the problem, if your findings will have an impact on the other party's activities. You should communicate with the other parties within the timeframe specified by your procedures or agreed to with the complaint reporter. Of course, you are entitled to keep proprietary information, such as trade secrets, confidential.

Step 5: Develop and select risk control measures

If the level of risk is not acceptable, the qualified person or unit must put control measures in place to eliminate or reduce the risk to an acceptable level. Your procedure(s) should call for the qualified person or unit to:

Note: If a change to a Class III or IV device is significant, you must submit an application to amend your medical device licence (and include a pre-market review). To see what counts as a significant change, consult:

Risk control measures include:

Note: Corrective and preventive actions can affect the design or production methods used to make a device. They can also affect the testing, parts, packaging, labelling or other aspects of a finished device.

Be aware, some risk control measures may be considered a notifiable action and require you to report a foreign risk notification to Health Canada. More information on this is found in Stage 4 Step 3.

Stage 4: Correct and prevent

As the manufacturer, you are responsible for taking the lead in carrying out any risk control measures. If you are an importer, distributor or private-label manufacturer, you must assist the manufacturer, as needed.

Your procedure(s) must describe how you take action to address an unacceptable risk or an issue related to device quality or compliance and how to report foreign risk notification to Health Canada where applicable.

Step 1: Carry out corrections

If you are the manufacturer

Once the risk control measures have been approved by your senior management, you must carry them out promptly. Your procedure(s) should:

Note: You may carry out corrections either before or at the same time as corrective or preventive actions.

Scenario of malfunctioning devices, Part I

You are a manufacturer who has received many complaints about a device malfunctioning during use. You investigate the root cause of the problem and realize that the malfunction is due to a defective electrical part. Your risk analysis shows that the malfunction poses a critical risk to patients. Therefore, you must take immediate action to reduce the risk, so you:

*Note that the action taken in the first bullet would meet the definition of a recall in Canada.

If you are an importer, distributor or private-label manufacturer

In most cases, the manufacturer will start the process to address the risk associated with the device problem. Once the manufacturer contacts you, you must carry out any corrections within your control promptly and without delay. Your procedure(s) should:

Step 2: Carry out corrective and preventive actions

If you are the manufacturer

You must carry out any corrective and preventive actions promptly. Your procedure(s) should:

Scenario of malfunctioning devices, Part II

You discovered that the manufacturer of the defective electrical part lacked good manufacturing controls. You also found that incoming device testing at your end failed to detect the defective part (it turns out you had calibration problems with your testing equipment).

To correct and prevent the problem from reoccurring, you decide to find a new parts supplier. You also put a calibration program in place for the testing equipment. But you do not stop with these corrective actions. You also:

By being proactive, you will prevent the same problem from happening with other devices.

If you are an importer, distributor or private-label manufacturer

Once the manufacturer contacts you, you must carry out any corrective and preventive actions within your control promptly. Your procedure(s) should direct you to document any corrective and preventive actions the manufacturer plans to or asks you to carry out.

Step 3: Send Health Canada a foreign risk notification (if applicable)

If you are a distributor, skip this step and proceed to step 4.

Manufacturers and importers of Class II to IV devices and holder of an authorization under sections 68.12 (Class II to IV that is not a medical device for an urgent public health need) or subsection 83(1) of the regulations are required to report actions that meet criteria for foreign risk notification that occurs outside of Canada.

You must review all corrective and preventative actions to determine whether it needs to be reported to Health Canada as a foreign risk notification. Your procedures must direct you to check each action taken against the criteria in subsection 61.2(2) of the regulations.

A foreign risk notification report must be submitted to Health Canada within 72 hours after the authorization holder receives or becomes aware of information that a notifiable action has taken place in response to a serious risk as per subsection 61.2(3). Your procedure(s) should indicate this timeframe for reporting to Health Canada.

Reportable incidents may be submitted to Health Canada using the following form:

Note: To better understand and comply with the reporting requirements, consult:

If you are the manufacturer

You must inform the importer or private-label manufacturer when you send Health Canada a foreign risk notification. This way, the importer or private-label manufacturer will know that they must also submit a foreign risk notification to Health Canada.

Step 4: Evaluate the effectiveness of actions taken

If you are the manufacturer

You must assign a qualified person or unit responsible for assessing all actions taken to address the problem. This evaluation determines if the actions address:

Residual risk is risk remaining after risk control measures have been implemented. Risk-benefit analysis (RBA) is done to see whether the medical benefits of the device outweigh any residual risk.

Your procedure(s) should:

Note: If the medical benefits of the device outweigh the residual risk, you may not need to take further action. But if the residual risk outweighs the benefits of the device, you must:

Once done, you must evaluate the results again. Repeat this step until the evaluation shows that you have done enough to address any risk, quality and compliance issues.

If you are an importer, distributor or private-label manufacturer

You must evaluate the effectiveness of the corrective and preventive actions and report the results to the manufacturer. The manufacturer must review the need for more actions before the complaint can be closed. Your procedure(s) should define your role in evaluating the outcome of corrective and preventive actions.

Stage 5: Close the complaint

In Stage 5, your procedure(s) should describe how you review and close a complaint.

Step 1: Review the complaint-handling process

You must assign a qualified person or unit (could be someone who was not involved in handling the complaint) the responsibility to review the process for handling complaints. The person would ensure all needed steps and actions to resolve the complaint have been completed. The review must be completed before the complaint file can be closed.

The review can be triggered by any of the following events:

Note: Your complaint records must be complete. They must describe all actions taken, including the rationale and evidence for decisions and evaluations.

Your procedure(s) should identify the criteria or the steps needed to close the complaint file and ensure that you:

Step 2: Notify parties involved, including sending a final incident report to Health Canada (if applicable)

If you are the manufacturer

Once you have reviewed the process for handling complaints, you must share the conclusions and any outcomes with the parties involved (for example, change instructions for use or change in part supplier). You must also give them a chance to provide feedback. Involved parties may include:

Your procedure(s) should define what data must be reported and to whom.

If feedback from any affected party shows that more actions are needed, you should continue the investigation.

If you are an importer, distributor or private-label manufacturer

You must review the conclusions and outcomes and consider if more action or a notice to other parties is needed. Your procedure(s) should direct you to:

Note: If the manufacturer is not willing to provide detailed records, a summary of the investigation may be acceptable.

If you are an importer or private-label manufacturer

If you have submitted a preliminary incident report, you must also submit a final incident report to Health Canada. Your procedure(s) should specify this requirement.

Step 3: Get approval

You must appoint a qualified individual to review and approve the closure of the complaint file. Your procedure(s) should:

Step 4: Keep records

You must keep a complete record of any investigations as well as the preliminary risk assessment. The records must comply with the requirements under the regulations for:

To ensure your records are complete and comply with the regulations, refer to the checklist for complaint-handling records.

Note: If you are a manufacturer Class II, III or IV medical devices, you must also meet the requirements of ISO 13485:2016.

How long you keep your records is critical to the risk management process and the history of problems associated with the device. The regulations do not specify how long to keep complaint records. However, you should keep them long enough to be able to identify any problems that are developing.

The appearance of problems with a specific device or a group of devices may occur over a long period of time due to several factors, such as the level of use. You should retain complaint records while the device is still on the market, even if it's no longer being manufactured or distributed.

Your procedure(s) should:

Step 5: Review trends

You must review all medical device complaints on a regular basis to detect trends in real or potential failure modes of the device. Analyzing complaint data trends helps management detect patterns of failures and evaluate the effectiveness of your corrective and preventive actions. Your procedure(s) should require you to review all device complaints and specify the frequency of your trending process (for example, every 6 months).

In addition, if you are the manufacturer

Complaint data and trends should also be used to revisit initial risk analysis (for example, Failure Mode Effect and Analysis) to confirm if new hazards have been identified and if initial estimates of hazard probability are accurate. Many risk analysis methods use inductive reasoning. Post-market data to supplement initial assumptions will result in safer medical devices and lower rates of post-market events.

The continued monitoring of risks after a medical device is authorized for sale in Canada is essential. Manufacturers of Class II to IV devices are expected to prepare summary reports and complete issue-related analyses of safety and effectiveness.

Note: To better understand and comply with the requirements of submitting summary reports:

Page details

2025-12-24