SITUATIONAL: Medical Device Compliance
Device Event Causality: When “User Error” Is Really a Design Failure
FDA recall data shows that true user error accounts for under 1% of device recalls, yet misuse attributable to poor design and unclear labelling is substantially higher. This situational guide examines how causality is determined, why classification matters for regulatory strategy, and what device teams must do differently when the investigation reveals the user was not the root cause.
Note: The device events and investigation scenarios described in this article draw on patterns identified in FDA MAUDE data, published recall analyses, and industry research. Specific device names and facility details are illustrative. All regulatory citations are drawn from publicly available FDA guidance and federal regulation.
Situation Overview
<1%
Recalls Attributed to Pure User Error
FDA recall records from 2014 to 2023 show user error accounts for under 1% of total cases, while software UI design flaws alone account for over 5%.
FDA Recall Database, 2024
40%
Class I Recalls Potentially Misclassified
A study of Class I recalls from 2014 to 2018 found that approximately 40% of cases may have merged device design defects with component or quality failures under incorrect root cause categories.
FDA Recall Analysis, 2019
84.5%
Surgical Robot Malfunctions Instrument-Linked
MAUDE analysis of robotic surgical systems found 84.5% of malfunctions linked to instruments, with patient injuries occurring in 15.6% of events.
PubMed, 2021
The Decision That Starts Every Investigation: Who or What Is at Fault?
When a medical device is involved in a patient adverse event, the investigation team faces a question that is simultaneously regulatory, clinical, and commercial: was the event caused by a device defect, by user error, or by a design that made user error predictable? The answer determines whether a manufacturer files a Medical Device Report (MDR) under 21 CFR Part 803, initiates a voluntary recall, redesigns the device, revises labelling, or retains the current device and retrains users.
The classification of cause is not neutral. A root cause attributed to user error protects the device from redesign obligations and from the scrutiny of a field safety corrective action. A root cause attributed to device defect or design error triggers post-market obligations, may require a 510(k) supplement or PMA amendment, and can result in enforcement action if the manufacturer was aware of the failure mode. The stakes of getting causality wrong (in either direction) are significant.
1. What Recall Data Reveals About Real Causality
FDA recall records from 2014 to 2023 provide the most comprehensive publicly available dataset on why medical devices are removed from market. The picture they paint challenges the common assumption that devices fail primarily because users mishandle them.
Software and UI Design Failures: 5.44% of All Recalls
Software-related issues, including user interface design flaws, account for 5.44% of all recalls and nearly 46% of recalls tied specifically to software errors. Many events coded as user error trace directly to interfaces that predictably lead operators to incorrect actions.
FDA Recall Database Analysis, 2024
True User Error in Recalls: Under 1%
Recalls attributed solely to user error made up only approximately 0.93% of total cases in the 2014 to 2023 dataset. This is not because users never make mistakes. It reflects that design-attributable misuse is classified differently, and that purely operator-caused events rarely meet the threshold for a manufacturer recall.
FDA Recall Database, 2024
Class I Recall Misclassification: 40% of Cases
A peer-reviewed analysis of Class I recalls (2014 to 2018) found that approximately 40% of cases may have been misclassified, typically merging distinct root causes (design defect, manufacturing non-conformance, and component failure) into a single category that masked the true driver of the safety risk.
FDA, Medical Device Recall Data
2. MAUDE Data: What Adverse Event Reports Show
The FDA’s Manufacturer and User Facility Device Experience (MAUDE) database captures voluntary and mandatory MDR reports from manufacturers, importers, and device user facilities. Unlike recall data, which reflects manufacturer-initiated actions, MAUDE shows events as reported from the field before investigation and root cause determination are complete.
Key Investigative Insight: MAUDE event narratives frequently describe outcomes (the breakage, the injury, the malfunction) without establishing whether the cause was device-attributable or user-attributable. Root cause determination requires a separate investigation process. Treating MAUDE event descriptions as root cause determinations is a common and consequential error in post-market surveillance programmes.
3. Case Study: Rhinolaryngoscopes in MAUDE (2016 to 2023)
The rhinolaryngoscope dataset illustrates how complex the user error versus device defect distinction becomes with instruments that require technique-sensitive handling and multi-step reprocessing.
Rhinolaryngoscope MAUDE Event Distribution (2016 to 2023): 2,591 Total Reports
Breakage
40.8%
Linked to both material fatigue and user-applied excessive force during insertion or manipulation.
Fluid Leaks
24.4%
Commonly associated with reprocessing failures, including inadequate high-level disinfection steps or seal degradation from improper technique.
Poor Image Quality
18.0%
Related to both component degradation and user-contributed factors such as lens contamination from inadequate cleaning.
Source: JMIR Human Factors, 2025
The investigation challenge with rhinolaryngoscopes is that the same outcome (breakage) can result from material defects in the instrument body or from user-applied force that exceeds the device’s specified operating parameters. Without a thorough root cause investigation that includes IFU review, maintenance records, operator interview, and physical device inspection, the event cannot be correctly attributed.
4. Case Study: Robotic Surgery Systems and the Instrument Attribution Problem
A published analysis of robotic surgical system MAUDE reports revealed a pattern that illustrates why simple user error versus device defect categorisation is inadequate for complex systems.
System Malfunction Profile
84.5% linked to instrument components. 81.7% occurring intraoperatively. Patient injury in 15.6% of events.
PubMed, 2021
Injury Causality Split
Device malfunction: 6.6% of events. Operator misuse: 18%. Procedure-related complications: 15.6%.
PubMed, 2021
The Attribution Challenge
“Operator misuse” at 18% of injury events does not mean operator negligence. It frequently reflects inadequate training, IFU clarity failure, or task complexity that exceeded the operator’s supported capability.
5. Why Causality Classification Has Regulatory Consequences
FDA’s regulatory framework for post-market adverse events treats causality classification as a material determination. Under 21 CFR Part 803, manufacturers are required to submit an MDR when they become aware that a device may have caused or contributed to a serious injury or death. “May have” is a low threshold: it does not require certainty of causation. It requires only that causation cannot be ruled out.
Source: 21 CFR Part 803, eCFR.gov | FDA MDR Guidance
6. Human Factors Engineering: When User Error Is a Design Failure
FDA’s guidance on human factors engineering makes explicit what many device investigators miss: if a device’s design predictably leads users to make a specific error, that error is a design failure, not a user failure. The user may have done something wrong, but the root cause is that the device did not adequately support correct use.
Four Human Factors Failure Patterns That Generate “User Error” MDRs
Confusing control layout. Buttons, switches, or modes that are not differentiated by shape, position, or colour in a way that prevents wrong-device or wrong-setting selection. The user selects the wrong mode because the interface does not visually distinguish high-risk from routine selections.
Ambiguous prompts and alerts. Alarm messages that do not clearly communicate urgency level, required action, or the consequence of ignoring. Users dismiss or delay response to alerts because the alert itself does not convey actionable information.
Multi-step reprocessing without error-proofing. High-level disinfection workflows that require a specific sequence of steps without visual confirmation at each stage. A study found that fewer than 20% of physicians followed all recommended reprocessing steps, a rate that reflects a workflow design failure rather than individual negligence.
Inadequate IFU for the clinical environment. Instructions for use written for a controlled lab environment that are then applied in a fast-moving clinical setting without adaptation. Users deviate from the IFU not out of carelessness but because the IFU does not reflect the conditions of real use.
FDA, Applying Human Factors and Usability Engineering to Medical Devices, 2016
7. What Device Teams Must Do Differently
The implications of accurate causality classification are operational, not just regulatory. A team that consistently misattributes design-induced misuse to user error will not redesign the device, will not revise the IFU, and will not conduct the usability testing needed to identify the failure mode. The same event will recur.
Root Cause Investigation Protocol
Every adverse event involving potential user contribution requires a structured root cause investigation that distinguishes device-attributable factors (design, manufacture, labelling) from operator-attributable factors (training gap, protocol deviation). The investigation must not default to user error without documented evidence that the device performed to specification under actual use conditions.
FDA, 21 CFR Part 803
Usability Testing Before and After Events
Formative and summative usability studies required by FDA’s HFE guidance are not one-time pre-market exercises. Post-market adverse events that suggest user interaction failure should trigger a usability review of the specific task sequence involved. If the event is reproducible in a simulated use study, the design is implicated regardless of what the field report coded.
FDA HFE Guidance, 2016
Training That Feeds Back Into Design
Retraining users after a use-error event is a necessary short-term action, but it is not a corrective action if the design flaw remains. CAPA systems must capture whether training addresses a user knowledge gap (valid corrective action) or whether it is being used to cover a design deficiency that should be corrected at the source. Regulators will distinguish between the two.
21 CFR Part 820 / QMSR, FDA
Key Takeaways for Medical Device Regulatory, Quality, and Clinical Teams
True User Error Is Rare in Recall Data
Under 1% of FDA recalls are attributed solely to user error. When “user error” appears in adverse event reports, it frequently reflects design-induced misuse rather than operator negligence.
Root Cause Classification Has Regulatory Consequences
Whether an event is attributed to device defect, design-induced misuse, or pure operator error determines MDR obligations, CAPA requirements, and whether the device requires a design correction or a 510(k) change.
Design-Induced Misuse Is a Device Failure
Under FDA’s HFE framework, if a device predictably leads users to make an error, that error is attributable to the design. Classifying it as user error does not protect the manufacturer and will not prevent recurrence.
MAUDE Reports Are Not Root Cause Determinations
MAUDE event narratives describe outcomes, not causes. Treating the event description as the root cause is a surveillance error. Proper post-market surveillance requires systematic investigation before causality is assigned.
Retraining Is Not a CAPA for a Design Deficiency
Regulators will distinguish between training that addresses a documented knowledge gap and training used to cover a design failure. CAPAs that rely on retraining without design correction will not close cleanly on inspection.
Post-Market HFE Studies Are Triggered by Use-Error Events
An adverse event that suggests user interaction failure should trigger a post-market usability review. If the error is reproducible in simulated use testing, the device design is implicated regardless of how the field report classified the event.
Frequently Asked Questions
When is a manufacturer required to file an MDR for a use-error event?
Under 21 CFR Part 803, a manufacturer must submit an MDR within 30 days of becoming aware that a device may have caused or contributed to a serious injury or death. The threshold is “may have”: causation does not need to be confirmed. If a use-error event involved the device and resulted in a serious injury, an MDR is likely required even before root cause is determined. A 5-day report is required if the event presents a public health risk requiring immediate action.
What is the difference between use error and misuse under FDA’s framework?
FDA distinguishes use error (an action or omission that was not intended by the user and produces a different result than intended) from misuse (using a device in a way not intended by the manufacturer). Use errors are within scope of the intended use and are the focus of human factors engineering. Misuse: using a device for an unintended purpose or population: is generally outside the manufacturer’s design obligation, though the boundary is often contested in post-market investigations.
Can attributing an event to user error reduce a manufacturer’s regulatory liability?
Only if the attribution is accurate and defensible. If FDA determines during an inspection that a manufacturer systematically attributed design-induced misuse to user error to avoid design correction obligations, that finding can support a Warning Letter, a consent decree, or an injunction. The investigation file must show that the device was tested under actual use conditions and that the design met its specifications before user error can be validly assigned.
How does FDA’s HFE guidance change the investigation process?
FDA’s 2016 guidance on applying human factors and usability engineering to medical devices establishes that use errors occurring during foreseeable use of a device in its intended environment are within the manufacturer’s responsibility. When an adverse event involves a use error, the HFE guidance requires the manufacturer to evaluate whether the device design supported correct use. Simulated use testing, task analysis, and review of IFU clarity are all within scope of a thorough post-market HFE review.
What does the MAUDE database actually show about causality?
MAUDE contains event reports as filed, not root cause determinations. The narrative describes what happened as reported by the facility or manufacturer at the time of filing. Root cause is typically determined through a separate CAPA investigation that may take weeks or months. MAUDE data is useful for trend surveillance and signal detection but cannot be used as a causality dataset without applying structured root cause methodology to individual events.
What are the most common human factors failures that generate use-error adverse events?
The four most frequently cited in FDA warning letters and 483 observations are: confusing control interfaces that do not differentiate high-risk actions; alarm designs that do not communicate urgency or required action; multi-step reprocessing workflows without step-by-step error-proofing; and IFUs written for controlled conditions that do not reflect actual clinical use environments. Each of these is a design failure, not an operator failure, when the resulting error was foreseeable.
How should a CAPA be structured when both device and user factors contributed?
A CAPA for a mixed-causality event must address both contributing factors separately. The device-attributable portion requires a design or manufacturing corrective action with verification of effectiveness. The user-attributable portion requires a training or procedural corrective action. Combining both under a single “user retraining” CAPA is insufficient and will not pass FDA CAPA audit criteria. The effectiveness check must demonstrate that both the device and user risk factors have been adequately controlled.
Government and Regulatory Sources
Government and Regulatory Sources
- 21 CFR Part 803: Medical Device Reporting, eCFR.gov: mandatory MDR requirements for manufacturers, importers, and device user facilities.
- FDA. (2016). Applying Human Factors and Usability Engineering to Medical Devices: framework for determining when use errors are design-attributable.
- FDA. Medical Device Reporting (MDR): How to Report Medical Device Problems: reporting thresholds, timelines, and supplemental report requirements.
- FDA Medical Device Recall Database: source for recall frequency, recall class, and root cause category data cited in this article.
- FDA MAUDE Database: Manufacturer and User Facility Device Experience: adverse event report search for device-specific signal surveillance.
- 21 CFR Part 820 / QMSR: Quality Management System Regulation, eCFR.gov: CAPA requirements applicable to post-market corrective actions for device and use-error events.
Research and Industry Sources
- Raza et al. (2021). Analysis of Adverse Events in Robotic Surgery from the FDA MAUDE Database, PubMed: source for 84.5% instrument-linked malfunction finding and injury causality split data.
- JMIR Human Factors. (2025). Rhinolaryngoscope MAUDE Event Analysis: source for rhinolaryngoscope event distribution: 40.8% breakage, 24.4% fluid leaks, 18% image quality.
Related VelSafe Articles
Related VelSafe Articles
VelSafe Compliance Training
Device Causality Done Right Protects Patients and Manufacturers
Accurate root cause determination is the foundation of effective post-market surveillance, defensible MDR filings, and CAPAs that actually close. VelSafe covers FDA device compliance, human factors engineering, and post-market obligations for medical device regulatory and quality teams.
Browse Situational Articles
