Reporting of medical device adverse events by healthcare facilities

The 2017-18 Senate Inquiry into the Number of women in Australia who have had transvaginal mesh implants and related matters highlighted the need for rapid information sharing between healthcare facilities and the TGA to address safety concerns with medical devices. Reporting requirements applied only to manufacturers and sponsors, leaving gaps that delayed detection of long-term safety issues.

The Senate Inquiry reported that there were potentially critical safety signals remaining undetected, delaying responses to emerging risks and increasing the potential for further patient harm.

From 1 July 2023 – 31 June 2024, 92.4% of medical device-related reports received were submitted by medical device manufacturers and sponsors. In the same period, only 7.6% of adverse event reports were received from other sources, including healthcare facilities, clinicians and consumers. This small percentage is despite healthcare facilities often being the first place an adverse event is observed.

Implementing mandatory reporting by healthcare facilities allows for greater systematic data collection and analysis of medical device-related adverse events. It may assist with quicker identification of issues across Australia and timely interventions, and it aligns with other changes being implemented by us as set out in the Medical devices reforms: An Action Plan for Medical Devices. It supports information sharing and helps ensure that health professionals receive timely updates on medical device risks, improving patient safety.

The new mandatory reporting requirements for healthcare facilities aim to improve early signal detection of potential issues with medical devices, facilitate faster action, and reduce the impact on patient safety.

From 21 March 2026, all Australian healthcare facilities must provide us with reports of medical device adverse events, including:

• Private hospitals
  • means a hospital in respect of which there is in force a statement under subsection 121‑5(8) of the Private Health Insurance Act 2007 that the hospital is a private hospital.
• Public hospitals
  • means a hospital in respect of which there is in force a statement under subsection 121‑5(8) of the Private Health Insurance Act 2007 that the hospital is a public hospital.
• Day hospital facilities (both public and private)
  • Hospital has the meaning given by subsection 121‑5(5) of the Private Health Insurance Act 2007.
  • a day-hospital facility is prescribed in Therapeutic Goods Legislation Amendment (Australian Unique Device Identification Database and Other Measures) Regulations 2025 (the Regulations).

Mandatory reporting requirements do not apply to facilities that fall outside of the Therapeutic Goods Act 1989 or the declared facilities in the Private Health Insurance Act 2007, such as general practices or residential aged care facilities.

Chief Executive Officers (or equivalent) of healthcare facilities are responsible for reporting the adverse events, as set out in legislation. Failure to comply may result in civil penalties.

Existing requirements for manufacturers and sponsors will not change and they are still required to report adverse events directly to us. Further information on requirements for manufacturers and sponsors is available on our website.

Reporting of adverse events from hospitals in some states and territories and in some private health groups may be centralised via the relevant state health department or private health group head office prior to submission to us. More information can be found at Appendix A.

Mandatory reporting by healthcare facilities vs the medical device Incident Reporting and Investigation Scheme (IRIS) system

There are differences in the way we will use the data received from healthcare facilities compared to the data received from sponsors and healthcare professionals.

Medical device adverse event reports from the two reporting streams are entered and kept in two different databases, the Incident Reporting and Investigation Scheme (IRIS) and the Adverse Signal Detection and Event Reporting (ASDER) system. Assessment of the reports is in accordance with the intent of the reporting stream, as outlined below.

Reports submitted by consumers and health professionals are made on a voluntary basis via an online web form. Medical device sponsors are required to report adverse events, and this data is submitted via a sponsor portal. Reports from these channels are received and managed under IRIS. These reports require more details to be provided about the device and clinical observation than the level of detail required as part of reports from healthcare facilities. Reports received in IRIS are reviewed by us and shared with sponsors (other than details noted to be confidential by the reporter).

Reports received from healthcare facilities under the new mandatory reporting requirement will be a complementary data stream, known as ASDER, used for signal detection purposes. They can be submitted as regular batch reports and will not be reviewed individually. Data from ASDER may help to inform the prioritisation and investigation processes for reports received through IRIS from healthcare professionals, consumers and sponsors or as a part of our post market reviews of devices of a kind. When combined, reports from all sources produce signals which assist us to identify emerging safety issues and make decisions on where further action may be required.

While some duplication of reports may occur through the IRIS and ASDER systems this is expected and will be managed appropriately. Identification of any emerging safety issues will consider duplication as part of its analysis.

The new mandatory reporting requirements apply to healthcare facilities. We continue to encourage voluntary reporting via IRIS.

Implementation of the mandatory reporting requirements will occur in a staged way, starting with a voluntary reporting period. Reporting of the most serious adverse events will commence first before expanding to other types of adverse events. This will allow time for healthcare facilities to establish their operating processes and for interoperable data systems to be developed. It also allows for any initial challenges identified during the voluntary reporting period to be addressed in future stages.

There are four stages to the mandatory reporting requirements:

• Voluntary reporting period: 21 March 2025 – 20 March 2026
• Stage 1: 21 March 2026 to 31 March 2028
• Stage 2: 1 April 2028 to 31 March 2030
• Stage 3: 1 April 2030 onwards.

We classify medical devices based on the potential for harm that may occur from use of a device. Adverse events relating to use of a high-risk medical device will be mandatory to report in the initial stages due to the likelihood of their involvement in the most serious adverse events. However, we recommend you focus on the event outcome rather than device classification when reporting.

Although you do not need to provide the medical device classification when reporting to us, if you want to confirm the classification of a medical device involved in an adverse event, each medical device and their classification can be found in the publicly available ARTG certificate for the device and can also be obtained from the procurement team within your healthcare facility. An overview of medical device classifications can be found on our website.

Dates for each stage of mandatory reporting are stipulated in the Regulations; however, healthcare facilities are not prohibited from reporting events associated with any class of medical device to us. The staged dates specify the minimal requirements for each reporting period. To support ease of reporting, we strongly encourage facilities to report all adverse events involving medical devices, regardless of event outcome or device classification.

Further details on reporting requirements and the timelines are outlined below.

Voluntary reporting period

To support stakeholders with implementation readiness, a 12-month voluntary reporting period commenced on 21 March 2025. This is to allow healthcare facilities time to build reporting capability and take necessary steps to meet the requirement ahead of Stage 1. This may include:

• development, testing, and refinement of IT systems and processes
• development of education materials
• staff training.

During the voluntary reporting period, we will support stakeholders by providing feedback regarding format and data quality of reports, against the regulatory requirements.

Stage 1

Commencing 21 March 2026, healthcare facilities will be required to report all adverse events resulting in death, serious injury or serious deterioration associated with high-risk medical devices. High-risk medical devices include:

• Class III medical devices
• Class 4 in vitro diagnostic (IVD) medical devices

However, facilities can report adverse events involving lower risk medical device classifications and near misses or treatment outcomes during Stage 1.

Examples of reportable adverse events in Stage 1

Angiographic balloon catheter

A patient had an emergency surgery (angioplasty) to treat a blocked coronary artery (heart attack). The cardiologist inserted an angiographic balloon catheter to dilate the artery, but the balloon ruptured. A fragment of the balloon became trapped in the artery, worsening the blockage. The patient had open heart surgery to attempt to fix the blockage, but it was too late, and the patient passed away.

Artificial heart valve

During an elective procedure to implant an artificial heart valve (transcatheter aortic), the valve fails to fully expand and function when deployed so the clinician retrieves it and attempts to insert a second valve. This prolongs the procedure, and the additional manipulation of the vessels results in rupture of the aorta (a large vessel), resulting in an emergency conversion to open heart surgery. The surgery was unsuccessful, and the patient passed away.

IVD Cytomegalovirus test

A patient for organ donation had their blood tested for Cytomegalovirus (CMV) before proceeding to organ donation. The donor’s blood tested as CMV negative, so the liver and kidneys were donated to patients who were also CMV negative. All three patients who received the organs developed CMV and became very sick or died. It is likely that the organ donor patient was in fact CMV positive and there was a false negative result from the IVD used to test for CMV.

Stage 2

Commencing 1 April 2028, mandatory reporting requirements will be expanded to include medium risk medical devices resulting in death, serious injury or serious deterioration as well as near miss adverse events. This means all adverse events and near adverse events involving the following classes of medical devices will need to be reported to us:

• Class IIa, Class llb and Class III medical devices
• Class 3 and Class 4 IVD medical devices

This requirement is in addition to the requirements of Stage 1. Healthcare facilities can choose to report these events and treatment outcomes from Stage 1.

An example of a reportable adverse event in Stage 2

Volumetric infusion pump

A nurse programmed a volumetric infusion pump to deliver a medication dose to the patient over four hours. Upon reviewing the patient, the nurse discovered the pump had delivered the medication much faster than programmed. Rapid infusion of the medication has the potential to cause many side effects but fortunately the patient did not experience any on this occasion.

Stage 3

Commencing 1 April 2030, mandatory reporting will further expand from the above outcomes and reportable medical devices to also include treatment for serious injury. This means all adverse events, near adverse events and provisions of treatment involving the above classes of medical devices will need to be reported to us. This is the final stage of implementation.

An example of a reportable adverse event in Stage 3

Automatic internal cardiac defibrillator

A patient was diagnosed with an abnormal heart rhythm and had an automatic internal cardiac defibrillator (AICD) inserted. Six months later he was admitted to a different hospital with pneumonia. While an inpatient at the second hospital, he had another heart rhythm event however the device did not activate. The event was managed by the staff and the patient survived. When tested, the AICD device had an abnormally low battery for only 6 months of use.

You do not need to be certain that a medical device was involved in an adverse event to report it. You do not need to have completed an investigation to report. You should report on suspicion of medical device involvement.

At the time of an adverse event there may not be sufficient information to determine whether the device caused an incident or adverse event. An event is reportable even when there is insufficient information to attribute the cause to a medical device. It is acknowledged that the causal factors behind an occurrence may be multifactorial and not known at the time, and in some case may never be known.

Incidents that must be reported to us include:

Adverse events

Occurrences involving a medical device where:

• a patient, healthcare provider, user or other person has died
• there has been a serious injury or serious deterioration in the condition of a patient, healthcare provider, user or other person, including:
  • a life-threatening illness or injury
  • permanent impairment of a body function
  • permanent damage to a body structure
  • a condition necessitating medical or surgical intervention to prevent permanent impairment of a body function or permanent damage to a body structure.

An example of an adverse event

Immunoassay test

A patient was tested for syphilis during pregnancy using an immunoassay test. The test result came back negative. This result was a false negative which meant that the patient was not treated for their syphilis infection. The infection crossed to the unborn baby and led to a foetal death in utero.

Near adverse events (near misses)

Occurrences involving a medical device that might have led to a death or serious injury if, for example, the timely intervention of a healthcare practitioner is the only reason a death or serious injury did not occur. For an event to be defined as a near adverse event, it is sufficient that:

• an event associated with the device occurred; and
• if the event occurred again, it might lead to death or serious injury as outlined above.

Examples of near adverse events (near misses)

Endoscope

Before an endoscopic procedure, the surgeon discovers that parts of the coating material on the endoscope device are peeling off and if the scope was used, these could detach and remain within the patient. A different scope is used instead.

Automated external defibrillator

An automated external defibrillator (AED) is undergoing a routine pre-shift functional check and fails to deliver a shock when prompted. As there was no patient involvement and this was detected prior to the device being used in a live scenario this is a near miss and should be reported.

Monitoring system

A continuous patient monitoring system is displaying an error message instead of the patient’s oxygen saturation (Sp02). However, the hospital ward also has portable oxygen saturation probes and one of these devices is attached to the patient to ascertain their Sp02.

Surgical stapler

A surgical stapler is being used to close an abdominal wound after an open surgical procedure. The stapler repeatedly fails to fire the staples, and the wound instead has to be closed with surgical sutures.

Provision of treatment

Occurrences where a health practitioner provides treatment to a person in the facility where the use of a reportable medical device has resulted in serious deterioration in the health of the person, regardless of whether the device was originally used or implanted in the same facility or elsewhere.

Examples of provision of treatment

Computed tomography (CT) scan

A patient was given cancer treatment based on the results of an abdominal computed tomography (CT) scan. Days later, after a minor car accident, they had another CT scan in a different hospital. The cancer on the second scan looked very different from expectations and the team concluded that the first CT reporting software was measuring the size of the cancer incorrectly. The patient was overtreated for the cancer because of an inaccurate diagnosis which may have been caused by an issue with the first CT scanner.

Gastric balloon

A patient presents to the emergency department of a public hospital with abdominal pain, nausea and dry retching. They have a gastric balloon in their stomach for weight management and it has failed to deflate at the end of its lifecycle and pass through the gastrointestinal tract to be excreted via a bowel motion. It became stuck and caused symptoms of gastric outlet obstruction which required the patient to have an emergency endoscopy to retrieve the device and relieve the obstruction. Even though the balloon was implanted at a different hospital, this event requires reporting to the TGA.

Two detailed scenarios and report examples can be found at Appendix B.

Medical devices are defined in Section 41BD of the Therapeutic Goods Act 1989 as any instrument, apparatus, appliance, software, implant, reagent, material or other article used in health care. This includes any component parts or accessories, including software. In-vitro diagnostics are also medical devices. More information on medical devices can be found on our website.

In the following section, we will outline:

• where to make a report
• when to report
• what to report
• exemptions to reporting

Where to make a report

Healthcare facilities will be required to submit individual or batch reports via the new medical device Adverse Signal Detection and Event Reporting (ASDER) system.

We continue to welcome voluntary reporting through IRIS on the TGA website by healthcare providers or other individuals, and encourage this to be used for more urgent or unusual incidents.

Adverse Signal Detection and Event Reporting (ASDER) system

The ASDER system has been developed to facilitate reporting from healthcare facilities. ASDER is a secure SharePoint site for reports to be submitted to us. Access to the ASDER system will have a phased rollout over the coming months to complete the process of onboarding each facility (or centralised location). We will contact your facility or central report, to register system users and ensure there are no access issues over the coming months. All facilities will be contacted prior to the reporting becoming mandatory in March 2026. If you have not been contacted by Thursday 14 November 2025, please email the ASDER systems team at MDST@health.gov.au. A system user guide will be made available to facilities during their registration phase.

When submitting reports via ASDER, reporters will receive automated submission validation via email. Reporters can also seek further feedback and assistance if required.

Reporting of adverse events from public hospitals in some states and territories may be centralised via the relevant state health department prior to submission to us. For private hospitals, reporting may be centralised through the private hospital group. If centralisation applies to your facility, further information should be provided to you regarding these arrangements. Please see Appendix A for more information and contact your jurisdictional health department if you have any questions.

Future IT Solution

We are also developing a future IT solution for long-term use. Further information regarding this will be made available as implementation progresses. We will notify you of any changes to report submission processes well in advance should they occur.

We will not accept faxed or scanned documents.

When to report

Reports must be submitted to us within:

• 10 days - for reports on medical device related adverse events that resulted in death or serious deterioration (required from Stage 1, 21 March 2026). The 10-day period begins from the day of death or the day the serious deterioration in the health of the person was first identified within a healthcare facility.

Examples for reports to be submitted within 10 days

Keyhole surgery

A previously well patient was having a keyhole surgical procedure to remove their appendix when their heart stopped beating in theatre. An urgent scan demonstrated air in the right side of the heart which had blocked blood flow. The patient was resuscitated and sent to Intensive Care Unit (ICU) for further care. It is possible that this was a device related incident with the air having come via an intravenous line or via the laparoscope (thin, tube-like device with a camera on the end) inserted into the patient during the procedure. The event, including at least the most suspected device to be involved, should be reported within ten days because of the serious deterioration, even if the cause is unclear or the hospital-level investigation has not been concluded.

Mechanical ventilator

A patient with severe pneumonia and respiratory failure is intubated and being mechanically ventilated in the intensive care unit. The ventilator being used on the patient randomly shuts down and ceases to provide therapy without any warning signs or an audible alarm. The staff do not notice immediately, and the patient quickly becomes hypoxic and goes into cardiac arrest.

Spinal Cord Stimulator

A patient presents to the emergency department with evidence of an infection surrounding an implanted Spinal Cord Stimulator (SCS) device. After running some tests, the medical staff discover that the infection has spread to the blood stream and the patient requires urgent admission to hospital for treatment with intravenous antibiotics and removal of the source of infection, the SCS device.

• 45 days - for reports on medical device related near misses and treatment related incidents (required from Stage 2, 1 April 2028). The 45-day period begins from the date of intervention (for near misses) or the date the treatment was provided for serious deterioration. We encourage healthcare facilities to submit batch reports on the first business day of each month for consistency and ease of processing.

Examples of reports to be submitted within 45 days

Continuous glucose monitor

The patient was wearing a continuous glucose monitor (CGM) which indicated that the patient’s blood glucose level was very high. The nurse double-checked using a finger prick test and found the blood glucose was in the normal range. The CGM was giving an inaccurate result. Treating the CGM result might have led to low blood glucose. This was a near miss.

Metal-on-metal hip implant

A patient returned to the hospital three years after a hip replacement with return of pain. Imaging of the hip revealed metallosis and inflammation around the hip joint. Surgery was scheduled for Category I (within 30 days) replacement of the metal-on-metal implant. This should be reported within 45 days of the surgical treatment taking place.

Surgical mesh device

A patient has a procedure to insert a surgical mesh device to treat an inguinal hernia. At his 3 month follow up visit in the surgical outpatient clinic, he reports pain and a lump at the surgical site. On examination, it is discovered that the mesh has migrated from its original position and is no longer holding the defect together. The patient undergoes a revision surgery to replace the mesh. The revision surgery should be reported to us within 45 days.

Failure to submit reports within specified timeframes could be considered as non-compliance with legislative requirements.

The above reporting timeframes are the minimum required to meet the legislative requirements. Healthcare facilities may opt to report more frequently than these timeframes to us.

You only need to report to us once. If a report has been submitted to us via IRIS, the same report does not need to be submitted via mandatory reporting. As a result, there may be incidents reported via IRIS that will therefore be missing from mandatory reporting to centralised health departments or private health groups. A report received through either IRIS or from a centralised health department or group will meet the legislative requirement for the facility to report. Reports submitted via IRIS still need to be made within the reporting timeframes for mandatory reporting outlined above. Further information can be found in the mandatory reporting by healthcare facilities vs the medical device Incident Reporting and Investigation Scheme (IRIS) system section of this guidance.

What to report

When making a report to us, you must provide the information outlined in Table 1. This information reflects the mandated requirements described in the Regulations; Therapeutic Goods Legislation Amendment (Australian Unique Device Identification Database and Other Measures) Regulations 2025.

In some specific circumstances, such as reports of death, serious deterioration, or near misses, additional information must be provided (Table 2).

Additional optional data can be provided in reports. The optional data fields are included in the report examples and report template Excel documents. This is optional information as it does not have to be supplied to fulfill the legislative requirements.

Questions about additional optional fields beyond these can be directed to MDST@health.gov.au.

We anticipate that medical device adverse event report data will be extracted from the healthcare facility’s existing incident management systems (IMS).

Two detailed medical device adverse event report examples can be found at Appendix B.

Exemptions

Legislation requires that the Chief Executive Officer (CEO) (however described) of a healthcare facility reports serious adverse events to the TGA within specified timeframes.

A report does not need to be made to us if an adverse event has already been reported to:

• the CEO of the Australian Commission for Safety and Quality of Healthcare (the Commission); or
• the head (however described) of a Department of a State or Territory that has responsibility for matters relating to health.

Reporting of adverse events from public hospitals in some states and territories may be centralised via the relevant state health department prior to submission to us. Please contact your jurisdiction’s health department to find out arrangements for your jurisdiction. More information can be found at Appendix A. 

Note: Healthcare facilities are strongly encouraged to report all complaints and adverse events to the sponsor of the medical device, as this supports prompt action and ongoing device safety. Please note that reporting to the sponsor does not replace the mandatory obligation to report the event to us.

If an adverse event has been submitted to the Commission or your state or territory health department, you are not required to also report it to us. However, it is important that healthcare facilities create and retain records and documentation that clearly demonstrate when the event was identified and confirm that it was reported to us, the Commission or their state or territory health department within the required timeframes. You may be required to provide these records to us upon request to demonstrate that your facility meets your reporting obligations.

In this section we will outline:

• what happens to the reports submitted to us?
• risk assessment outcomes, and
• what are the penalties for not reporting?

What happens to the reports submitted to us?

Adverse event data received from healthcare facilities will be used for signal detection purposes. Reports will be entered into a data base and assessed as part of our trend analysis processes. We may contact the person who submitted the report to us or an appointed facility representative if more information is required for a detected safety signal.

If a new, urgent or unusual adverse event occurs we encourage you to contact us straight away and report via IRIS. If you have reported an adverse event via IRIS, you are not required to submit the same report via mandatory reporting.

Risk assessment outcomes

Following a risks-based approach, if a safety signal is detected we may complete a risk-based assessment of the adverse event report/s to determine the appropriate actions required. Serious adverse events are prioritised for investigation. Assessments and investigations can result in several outcomes:

• No action required: If we determine the adverse event is not of significant concern to public health, (e.g., if the incident is isolated, or appropriate preventative measures are in place to reduce the risk of further adverse events), no regulatory action will be taken. These incidents are entered into a data base and assessed as part of a broader trend analysis. However, should there be an increase in reports for certain device categories, further investigation may be undertaken.
• Regulatory or non-regulatory action required to address risk: If it is determined the adverse event or signal presented by trends of multiple events is a significant risk to public health (e.g., there are a large number of reports or the impact is significant), further investigation will be undertaken and may result in action. This may include communicating with various stakeholders, enforcing product information changes, limiting the use of the device, conducting additional post-market studies, or cancelling the product from the Australia Register of Therapeutic Goods (ARTG).

Penalties for not reporting

The Therapeutic Goods Amendment (2022 Measures No.1) Act 2023 (No.10, 2023) - Schedule 1 outlines that a person contravenes their mandatory reporting of medical device related adverse events requirements if:

1. the person is required to give a report to the Secretary in accordance with this section; and
2. the person fails to comply with the requirement.

The maximum civil penalty applied is 30 penalty units, applies per report, per breach. For the purposes of compliance, ‘report’ refers to individual adverse events. Therefore, ongoing non-compliance of multiple adverse events has potential to result in a significantly higher total penalty. Note: if a batch report includes multiple reportable incidents, each individual incident is treated as a separate report for the purposes of compliance.

Penalties will not be applied during the 12-month voluntary reporting period from 21 March 2025 until 20 March 2026. The Therapeutic Goods (Medical Devices) Regulations has now specified the dates that mandatory reporting is in force. Each facility is strongly recommended to put in place processes and procedures to ensure full compliance with the legislated requirements within the specified timeframes.

Contact our support team at MDAE.Support@health.gov.au with any queries or feedback.

For any questions relating to how to submit and validate reporting data, please contact our medical device adverse events systems team at MDST@health.gov.au.

The appendices are available to download below.

• Appendix A: State and territory centralised or de-centralised reporting approaches for public healthcare facilities.
• Appendix B: Medical device adverse event report examples.