Technovigilance in Colombia: What INVIMA Requires from Manufacturers and Importers

Post-market surveillance of medical devices, known in Colombia as technovigilance (tecnovigilancia), covers the activities meant to identify, collect, evaluate and manage information on adverse events and incidents linked to the use of these products. In Colombia, the National Technovigilance Program is coordinated by INVIMA and governed by Resolution 4816 of 2008.

For manufacturers and importers, the obligations include running an institutional technovigilance program, designating a lead and managing safety reports. The deadlines include reporting serious adverse events and incidents within 72 hours of their occurrence, filing consolidated quarterly reports of non-serious ones, and notifying recalls made because of health risks and certain international alerts.

These responsibilities need to be built into the regulatory and safety management of the medical devices sold in Colombia, according to the nature of each obligation and the rules that apply throughout the product’s life cycle.

According to INVIMA itself, around 81% of the medical devices sold in Colombia are imported, so much of the burden falls on companies that do not make the product but answer for it in the country.

What does Resolution 4816 of 2008 establish?

Resolution 4816 of 2008 regulates the National Technovigilance Program: it defines who takes part, how adverse events and incidents are classified, what institutional program each party must have, and the deadlines for reporting to INVIMA.

The program grew out of article 61 of Decree 4725 of 2005, which tasked the then Ministry of Social Protection with designing it with INVIMA’s support. Resolution 4816 of November 27, 2008 regulated it. It is still in force, but the Ministry of Health and Social Protection and INVIMA are reviewing the sanitary regime for medical devices through a draft decree that updates the regulatory framework. It is worth following its issuance and entry into force to see what changes in the National Technovigilance Program.

The current resolution defines it as a post-market surveillance system: identifying and evaluating the adverse events or incidents that devices present during use, quantifying the risk and taking public health measures. From a company’s point of view, it is the mechanism that lets it detect, investigate and manage risk signals related to the devices it sells. Depending on the findings, the information gathered can lead to investigations, corrective or preventive actions, field actions, health alerts or market withdrawals.

Its scope is limited to medical devices and biomedical equipment: medications fall under pharmacovigilance and in vitro diagnostic reagents under reagent vigilance (reactivovigilancia), each with its own requirements and notification channels. That split may change with the draft decree, which proposes bringing medical devices and in vitro diagnostic reagents under a single regime and leaves medications apart. Until the new rules are issued and take effect, the provisions that currently apply to each product category must be followed. If you are not sure which category your product falls into, start by confirming whether it is a medical device.

Who is required to report under technovigilance?

Resolution 4816 (article 6) structures the program in four levels. The national level is made up of the Ministry of Health and Social Protection and INVIMA, which runs the program operationally. The departmental and district level covers the health secretariats of those territorial entities. The local level is made up of medical device manufacturers and importers, healthcare providers and independent health professionals. There is a fourth: users and anyone who learns of an adverse event or incident, whom the regulation also requires to report it.

Article 9 of Resolution 4816 gives manufacturers and importers six duties:

• Run an institutional technovigilance program.
• Designate a competent professional as the program lead.
• Notify INVIMA of adverse events and incidents.
• Take preventive and corrective action immediately.
• Report international alerts on what they sell or have sold.
• Respond promptly to any INVIMA request about safety.

The supply chain matters too. According to INVIMA’s 2023 technovigilance guide, distributors pass non-serious events on to the importer or manufacturer, who includes them in its quarterly report, and report serious ones directly to INVIMA. If you are setting up the operation from scratch, first review what a medical device company in Colombia needs.

What must the institutional technovigilance program include?

Every manufacturer and importer must have its own institutional program. Article 10 of Resolution 4816 sets the minimum:

• A program lead.
• INVIMA’s adverse event reporting form.
• A data management system that protects the integrity and confidentiality of the information and allows each case to be followed over time.
• A Technovigilance Manual.

The Manual defines how the program works in practice: which devices are monitored, the concepts of adverse event and incident, the strategy for collecting and analyzing reports, and the flow toward the manufacturer and the health authority. The program’s procedures are approved by the technovigilance lead and the company’s management.

For the lead, the regulation asks for a competent professional whose designation is communicated to INVIMA (article 11). In practice, INVIMA also asks for two separate registrations: an active user account in the web application and enrollment in the National Technovigilance Network. The resolution describes the Network as voluntary, but in its 2020 notice to manufacturers and importers INVIMA warns that both registrations can be required at any time and that it asks for proof of both during its visits.

Then there is traceability. Article 63 of Decree 4725 of 2005 requires anyone who imports or sells devices to keep at least the trade name, the model, the serial or lot number, the purchase and shipping dates, and the identity of the first customer. Without that data there is no way to answer when INVIMA asks which institutions received a lot.

For implantable devices, article 31 of Resolution 4816 also requires the institution that implants the device to keep a record in the patient’s medical history, with data such as the lot number and the manufacturer. That record is what makes it possible to reach the patient if a lot turns out to be compromised.

Serious or non-serious: the classification that sets the deadline

Before reporting, you have to classify, because the deadline depends on it. Article 5 of Resolution 4816 distinguishes between an adverse event, when there was harm, and an adverse incident, when there could have been harm but chance, a person’s intervention or a safety barrier prevented it. Either one can be serious or non-serious.

A case is serious when it could have led to death or to a serious deterioration in the health of the patient, the operator or another person involved. The regulation considers serious deterioration to be:

• A life-threatening illness or injury.
• Damage to a body function or structure.
• A condition that requires medical or surgical intervention to prevent permanent damage.
• A permanent partial disability.
• A hospitalization or a longer hospital stay.
• A congenital malformation.

Two examples show the difference. An infusion pump is programmed with a higher dose than prescribed and the nurse notices before connecting it to the patient: there was no harm, but there could have been serious harm, so it is a serious adverse incident. An electrode leaves a mild redness that clears without treatment: a non-serious adverse event. For borderline cases, INVIMA’s 2023 guide includes a decision flowchart.

The classification of the case and the device’s risk class (I, IIA, IIB or III) are different scales that meet at two points. INVIMA uses the risk class when it evaluates immediate reports, and the resolution asks it to actively monitor IIB and III devices, controlled-technology biomedical equipment, devices new to the market, refurbished equipment and single-use devices that are reused.

Deadlines and channels for reporting to INVIMA

A serious case is reported to INVIMA within 72 hours on the FOREIA form; non-serious cases are consolidated in the RETEIM template and uploaded within the first 8 calendar days of the month after each quarter closes. International alerts go through the RISARH form within 72 hours of learning of them, and INVIMA asks for the same deadline for recalls.

Report	What it covers	Deadline	Channel
Immediate	Serious adverse event or incident	72 hours	Web application, FOREIA form
Periodic	Non-serious events and incidents, with the measures taken	First 8 calendar days of April, July, October and January	Web application, RETEIM template
Zero quarterly report	Quarter with no events or incidents	Same as the periodic report	Web application, zero report option
International alert	Alert from the parent company or a health agency	72 hours from when it becomes known	Web application, RISARH form
Product recall	Total or partial recall due to a health risk	72 hours from when it becomes known, according to INVIMA (the resolution sets no deadline)	Web application, RISARH form

There is a nuance on the 72 hours. Article 15 counts them from the occurrence of the event or incident; INVIMA’s 2020 notice and the recommendations in its 2023 guide count them from when the lead learns of the case. The prudent course is to report as soon as you know, without waiting for the full analysis: according to INVIMA’s 2020 notice, after the report the company has 15 business days to send the root cause analysis and the action plan.

The quarterly report has been mandatory since late 2012, when the 48 months during which the resolution left it voluntary ran out. According to INVIMA’s guide, the zero report serves to identify the parties that remain active in the program even if they had no cases, and INVIMA flags as late any report that arrives outside the eight calendar days.

How do you report an adverse event in INVIMA’s application?

Since 2012, adverse events and incidents involving medical devices must be notified through INVIMA’s technovigilance web application, and since July 1, 2018 INVIMA no longer accepts alerts, recalls or thefts on paper or by email. The path for a manufacturer or importer:

1. The lead requests a username and password in the application with a permanent corporate email address, because confirmations arrive there.
2. Separately, the lead enrolls in the National Technovigilance Network, which does not give access to the application.
3. Each serious case is reported on the FOREIA form, and the system returns a COL code for follow-up.
4. Non-serious cases are consolidated in the RETEIM template and uploaded in the quarterly bulk report module; if there were no cases, the zero quarterly report is used.
5. International alerts, recalls, safety notices and thefts go through the RISARH form.

To avoid rework, INVIMA stresses two points. If a clinic or hospital has already reported the case and has a COL code, the manufacturer or importer does not report it again. And the device must be identified with no gaps (name, sanitary registration or marketing authorization, brand, model, serial or lot number, software version, manufacturer and importer): INVIMA’s guide warns that leaving out that data leads to the report being voided or rejected.

Recalls, international alerts and thefts

If a manufacturer or importer recalls a product in whole or in part because it poses a health risk, it must notify INVIMA (article 19 of Resolution 4816) with the affected lots or serial numbers, the causes and their supporting documents, the recipients in Colombia and the recall actions, with their estimated time and final disposal. INVIMA can also order a product recall.

The notification does not condition the recall, which can go ahead without waiting for INVIMA. Recalls for reasons unrelated to safety or performance are not reported to the program; safety notices sent to users, on the other hand, are.

The importer also has an obligation of its own: within 72 hours of learning of it (article 20 of Resolution 4816), it must notify any international alert from the parent company or a health agency that involves devices it sells in Colombia. INVIMA reviews alerts from agencies such as the US FDA, Spain’s AEMPS and Brazil’s ANVISA every day, so an unreported alert can reach it another way.

Manufacturers and importers report thefts in the same application, within the RISARH family (recalls, safety notices, alerts and thefts); healthcare providers use a separate INVIMA form. INVIMA publishes thefts to recommend that no one buy the stolen equipment.

What happens if you do not report?

If a company fails to comply with Resolution 4816, INVIMA can start preventive and corrective actions and apply health measures under Law 9 of 1979 and Decree 4725 of 2005, without prejudice to criminal, civil or disciplinary sanctions (article 32).

The same article allows it to order the seizure or freezing of a device that poses a risk, or to prohibit or restrict its use. Decree 4725 of 2005 (article 80) also provides for warnings, fines, seizure, suspension or cancellation of the sanitary registration or marketing authorization, and temporary or permanent closure of the establishment.

INVIMA can also verify through visits the follow-up the company declares (article 26 of Resolution 4816). A program with a manual but without up-to-date quarterly reports, or with a lead who has left and whose user account no one updated, is hard to defend in that visit.

Before the next quarterly close

Five questions to review your program:

• Is the designated lead still with the company, communicated to INVIMA, enrolled in the National Network and holding an active user account in the application?
• Does the Technovigilance Manual reflect your current device portfolio?
• Do your distributors know whom to pass a non-serious event on to?
• Does someone periodically review alerts from the parent company and health agencies?
• Were quarters with no cases reported as zero within the eight calendar days?

These obligations add to other post-market reports INVIMA requires depending on the product, which we cover in our guide to post-market reporting obligations. For medical devices, the SPI Américas regulatory affairs team prepares the technovigilance reports INVIMA requires and follows up on them. If you need technovigilance support, write to us at contacto@spiamericas.com.