Makers of medical devices, from heart valves to drug pumps, are required to tell the U.S. Food and Drug Administration whenever they learn that a product may have injured someone. Those reports are usually available to patients and their doctors.

But a Star Tribune analysis of recently obtained data shows that the FDA has accepted late reports that cover hundreds of thousands of incidents, sometimes years after the fact, and has created a program that lets device makers keep the details out of view.

For example, the FDA let Illinois-based Baxter International put 75,000 unreported malfunctions of its Colleague drug pump into a confidential report while publicly disclosing only a single, brief summary. The FDA kept the number of events confidential until the Star Tribune challenged that decision.

European medical device maker ConvaTec got permission to summarize hundreds of malfunctions of a fecal incontinence system three years late, even though U.S. regulators had twice warned the company for failing to disclose problems.

Medtronic, the med-tech giant that operates from offices in Fridley, got permission to summarize more than 1,000 incidents in patients who got its Infuse bone graft. Medtronic previously had been warned four times in five years for not reporting problems with its products.

The FDA gets so many reports beyond the usual 30-day deadline that it has created a “retrospective summary reporting program” for them. No written description of the program is available on the FDA’s website, no law explicitly authorizes it and there is virtually no public paper trail of its existence.

The Star Tribune reported on Medtronic’s Infuse summary in April. Additional analysis since then shows that the FDA has allowed retrospective summaries dating to 2005 from at least two dozen medical device makers, comprising more than 130,000 overdue “adverse events,” as the FDA calls them.

That total jumped to more than 300,000 last month after the Star Tribune successfully challenged FDA decisions that kept some adverse event totals confidential by classifying them as corporate trade secrets. The FDA allowed one summary to be filed without including how many events there were.

Dr. David Challoner, who led an Institute of Medicine team that studied adverse-event reporting problems in 2011, said he had never heard of retrospective summary reporting.

“That’s a loophole you’ve identified,” Challoner said. “It should not happen. The fact that [overdue adverse event reports] can be reported in summary, without details, is inappropriate and, at least in my understanding of the basic congressional intent of reporting, outside the boundaries.”

The FDA declined interview requests. Via e-mail, spokespeople said the summaries involve issues that are already well-understood by the medical community. Demanding additional documentation would waste resources and clog the public reporting system for adverse events, the FDA said, while doing little to protect the public.

Baxter said the malfunctions it reported under the program with the Colleague pumps did not involve injuries or have any patient impact. Medtronic said the FDA takes retrospective reports only if a company can show that the old events they cover don’t contain new safety information.

It is difficult for outsiders to assess whether there is anything new or concerning in the summary reports, because virtually all the information is invisible to the public.

Often, the devices featured in the past-due summaries are controversial. Baxter’s Colleague pump was recalled from the market. Device makers have also submitted late reports on vaginal mesh implants that are subject to extensive patient litigation.

The average summary report came in three years late, according to the Star Tribune’s analysis.

Critics see two problems. First, the secret summaries leave doctors, patients and researchers without a complete record of adverse events, unless they go through a Freedom of Information process that can take more than a year.

“Whenever you have thousands of reports and you list them as one ... that’s not transparency at all,” said Madris Tomes, a former FDA official who left the agency to found a search engine that tracks device performance, called Device Events. “Physicians might change their minds if they knew how many problems there really were.”

Second, giving companies the ability to privately summarize large numbers of events, well after the legal deadline, could give them a way to hide safety issues.

“Part of me is glad that these companies are offering this stuff up to the FDA, even if it is old and should have been reported sooner,” said Joyce Greenleaf, regional inspector general of the U.S. Health and Human Services’ Boston office. “But I worry that it may create an incentive to put everything in [a retrospective report], or an old complaint file.”

A 2009 audit by Greenleaf’s office concluded that the FDA rarely penalizes manufacturers and hospitals that submit adverse-event reports late.

U.S. Sen. Al Franken, D-Minn., who serves on the Health, Education, Labor and Pensions Committee, said the FDA should minimize the use of summary reports.

“The current medical device reporting system is flawed, and that’s in part because of lax enforcement of existing rules exacerbated by retrospective summary reporting,” Franken said.

FDA procedures

Federal law does allow the FDA to set up special reporting arrangements in some situations.

A program called Alternative Summary Reporting lets companies file quarterly summaries of common device complications that are well-understood and expected to happen with predictable frequency. Rules are posted on the FDA’s website.

Retrospective summary reporting is different. An FDA spokeswoman said retrospective reports involve material that turns up during “a retrospective review of a firm’s complaint file.”

The reports might cover service technician logs or old call-center activity. They could come when one company acquires another and finds unreported problems in its files. Or they can happen when a company re-scans old records after a warning from the FDA to change its reporting process.

FDA exemptions coordinator William Huff spoke at a California device industry seminar in 2012. The program for the private event described retrospective summaries as being “for those in the unfortunate circumstance of finding that they have not reported (Medical Device Reports) as required, and the number of MDRs is significant.” The FDA declined to make Huff available.

His PowerPoint slides from the 2012 seminar lay out informal guidelines: Companies file written requests for reporting exemptions that include the number of late adverse events, explanations why they were not reported on time, when they occurred and a list of events. A single “marker report” goes in the public record.

Seeking the reports

The reports are difficult to obtain, because full details are available only through a lengthy Freedom of Information Act process.

It took 13 months for the Star Tribune to receive information it sought on Medtronic’s Infuse implant. To even know what to ask for, you must first ferret out the marker reports.

A Star Tribune analysis that used Tomes’ search tool revealed that Medtronic has filed retrospective reports for 27 separate devices. Other industry leaders, including Johnson & Johnson and Baxter, have repeatedly used the program.

Some industry observers believe summarizing injuries and malfunctions lets device companies skirt federal law.

Sarah Sorscher, an attorney at Public Citizen’s Health Research Group, could not recall the FDA collecting fines from device companies that did not file adverse event reports on time. “So the stakes are very low if they neglect to do so,” she said.

Former Republican U.S. Sen. David Durenberger of Minnesota, co-sponsor of a 1990 law that guides how the FDA tracks devices once they reach the market, said he does not remember any allowance for retrospective summaries of overdue injury reports.

“I find it hard to believe that the law provides for reporting [injuries and malfunctions] and leaves that kind of a loophole,” Durenberger said. “It defies what I intended. … If there’s no penalty, there’s no law.”

Types of events

Some retrospective summary reports appear innocuous, like a 2012 summary of 233 toothbrush breakages. But retrospective summaries have also covered problems with devices that have significant safety risks.

Details provided under the Freedom of Information Act show that a Medtronic study of the company’s Infuse spinal implant documented more than 100 patients who had complications after use of Infuse in the neck, including about 40 reports of difficulty swallowing. Information Medtronic filed with the FDA in 2013 shows the company had those reports in hand in October 2007. Nine months later, after receiving injury reports from other sources, the FDA warned the public that using Infuse in the neck can cause dangerous swelling near a person’s airway.

Medtronic spokesman Eric Epperson said the reports do not mean that Infuse caused the problem.

LifeScan, a Johnson & Johnson subsidiary, reported 186,000 potential malfunctions in two diabetic blood meters in two summary reports on a single day in 2006. Johnson & Johnson initially said that retrospective summary reporting did not exist, but later acknowledged the program after the Star Tribune pointed out its reports. A company spokeswoman said the potential malfunctions “were for a variety of different issues” that occurred from “late 2005 to mid-2006” and had not been reported to the FDA.

Former FDA enforcement officer Jeffrey Gibbs thinks some adverse events go unreported because of ambiguous government rules. “There are times when industry and the FDA will disagree” about whether a particular injury or malfunction should have been reported, he said.

Gibbs does not think device makers view retrospective summary reporting as a free pass. Noncompliant companies risk FDA warning letters and enforcement actions, he said.

But Challoner believes companies may have a strong financial incentive not to report adverse events on popular products. He said his Institute of Medicine team found many cases where events that did not fit the company’s “PR message” were not reported.

“Everybody who’s in a position to identify or question an adverse or unexpected clinical event is motivated not to report it,” Challoner said, “everyone except the patient who has a question about what the hell is going wrong.”