The registration is published, the first units ship to Colombia, and a few weeks later the manufacturer gets a question it didn’t plan for: who is your tecnovigilancia responsible, and where is your institutional program? In Colombia, post-market surveillance for medical devices isn’t a paragraph in the registration dossier. It’s a standing program that the manufacturer or importer has to run in the country, with a named person, written procedures and fixed reporting clocks.
I am Julio Martinez-Clark, CEO of bioaccess®. We act as the in-country registration holder and importer for medical device manufacturers in Latin America, and this is one of the questions sponsors ask me most often after an INVIMA approval. This page covers what the rule says, the deadlines that matter, what the holder actually has to set up, and the checklist I use before the first commercial unit is implanted or used.
One-sentence answer
Under Ministry of Health Resolution 4816 of 2008, every manufacturer and importer of medical devices in Colombia must run an institutional tecnovigilancia program with a designated responsible person registered with INVIMA, report serious adverse events and incidents to INVIMA within 72 hours, send consolidated quarterly reports of non-serious events, notify INVIMA within 72 hours of international safety alerts on devices it sells in Colombia, and notify product withdrawals that put patients at risk.
What the rule actually says
The legal basis
Colombia’s National Tecnovigilancia Program is set out in Resolution 4816 of 2008 of the then Ministry of Social Protection, issued under Article 61 of Decree 4725 of 2005, the decree that also governs device registration (registro sanitario). INVIMA’s legal compilation publishes the full text. The resolution applies to INVIMA, the departmental and district health secretariats, manufacturers and importers, health service providers, independent professionals and device users.
The definitions that drive the clock
Article 2 separates events from incidents, and serious from non-serious:
- Serious adverse event: an unintended event that could have led to death or serious deterioration of the health of the patient, operator or anyone involved, as a consequence of using a medical device.
- Serious adverse incident: a potential risk of unintended harm that could have led to death or serious deterioration of health, but did not, because of chance, the intervention of a health professional or another person, or a safety barrier.
- Immediate reports are the reports that relate a serious event or a serious incident to a particular device. Everything non-serious goes into periodic reporting.
The incident definition is the one manufacturers coming from other systems tend to underestimate. A near miss that a nurse caught still counts if it could have caused serious harm.
The obligations on manufacturers and importers
Article 9, item 1 lists what manufacturers and importers must do:
- Design and implement an institutional tecnovigilancia program that keeps continuous track of adverse events and incidents the devices it sells may cause, so it can identify, record, evaluate and manage the reports.
- Designate at least one competent professional as responsible for the program.
- Report adverse events and incidents to INVIMA on the terms of the resolution.
- Take the preventive and corrective actions that apply, plus any that INVIMA requires, immediately.
- Tell INVIMA about international alerts on devices it sells or has sold that may still be in use, and the actions taken.
- Cooperate with and answer INVIMA’s safety requests quickly, within the time INVIMA sets.
What the institutional program must contain
Article 10 sets the minimum content of the program:
- A designated tecnovigilancia responsible.
- A report form for adverse events with medical devices, or INVIMA’s own form.
- A data management system that protects the integrity, accuracy, reliability, consistency and confidentiality of the information and lets you follow safety problems over time.
- A Tecnovigilancia Manual: the institutional document that defines the devices under surveillance, the concepts of events and incidents, the surveillance and report-collection strategy, the analysis of results, and reporting to the manufacturer and the authority. Procedures must be documented and approved by the tecnovigilancia responsible and by management.
Article 11 requires every actor to tell INVIMA who its designated responsible is. That person becomes the program’s contact with INVIMA. Article 12 makes the responsible person accountable for recording, analyzing and managing every event, recommending immediate preventive measures, telling INVIMA immediately about serious cases, and sending the quarterly periodic reports.
The deadlines
| What happened | What the holder must do | Deadline | Source |
|---|---|---|---|
| Serious adverse event or serious adverse incident | Immediate report to INVIMA with the information listed in Article 14 | Within 72 hours of the event or incident | Art. 15 |
| Non-serious adverse events | Consolidated periodic report with the preventive measures taken, to INVIMA or the health secretariat as applicable | Quarterly | Arts. 16 and 17 |
| International alert from the parent company or any health agency on a device sold in Colombia | Notify INVIMA | Within 72 hours of learning of the alert | Art. 20 |
| Total or partial withdrawal of product from the market that poses a risk to patients | Notify INVIMA | No fixed hour count in the resolution; notify as the withdrawal happens | Art. 19 |
| INVIMA asks for an investigation of an event | Manufacturer carries out the investigation; INVIMA monitors and can request more information until satisfied | As INVIMA sets | Art. 26 |
The quarterly report was voluntary for the first 48 months after the resolution was issued and has been mandatory since then (Art. 16, paragraph). It isn’t optional today.
What a periodic report has to include
Article 17 sets the minimum content: patient age and sex; date of the event, main diagnosis, outcome and a description; the device’s generic and trade name, manufacturer, lot or serial number, model, software version where relevant, registro sanitario number, distributor or importer, and where the device was being used; whether the provider told the manufacturer or importer; actions taken and corrective or preventive measures; an internal report code; and the reporting institution, the tecnovigilancia responsible’s name, date and contact details. Article 21 makes clinical-record information in these reports confidential and limits its use to health surveillance.
Implantables
Article 31 makes traceability mandatory for implantable devices under Decree 4725 of 2005: each implant’s record has to be completed and kept in the patient’s clinical record at each facility so the device can be followed if needed. If your product is an implant, your distribution records have to let you trace every lot or serial number to the facility that received it. Otherwise a field action becomes guesswork.
What INVIMA can do
If evaluation of the safety reports shows that a device puts patients, operators or third parties at risk, even when used as indicated and properly maintained, Article 32 lets INVIMA order seizure or freezing of the product, or prohibit or restrict its use, on top of the sanitary measures available under Law 9 of 1979 and Decree 4725 of 2005.
Where sponsors get caught
- Assuming the foreign manufacturer’s complaint system is enough. The resolution puts the program on the manufacturer or importer in Colombia. If you sell through a local holder or importer, that company needs its own program, manual and registered responsible, and it needs a contractual line to your complaint-handling and vigilance team that works inside 72 hours.
- Missing the international-alert clock. A field safety notice issued in the US or anywhere else starts a 72-hour clock in Colombia from the moment the importer learns of it (Art. 20). Your global vigilance team has to copy the Colombian holder on the same day, not at the next monthly call.
- Treating the distributor as the holder. A distributor that resells your device isn’t automatically the party INVIMA holds responsible for the registration. I wrote about that split in registration holder vs. distributor, and the Colombia specifics are in Colombia INVIMA registration holder and importer of record.
- No traceability for implants. If you can’t map serial numbers to facilities, you can’t run a targeted recall and you can’t answer INVIMA’s questions quickly.
- Changing holders without moving the program. When a registration moves to a new holder, the tecnovigilancia responsibilities and the open case history have to move with it. See transferring a device registration to a new holder.
From first-in-human study to commercial product
Most of our sponsors meet Colombia first through an early feasibility or first-in-human study. During a clinical investigation, adverse events are handled under the study’s own framework: the protocol, the ethics committee and INVIMA’s clinical research approval. That process is described in our guide to first-in-human approval in Colombia. Resolution 4816 is about devices placed on the market. The practical lesson is to plan the move: the safety data and the people who handled it during the study are the best starting point for the post-market program, but the program, the manual and the registered responsible have to exist before the first commercial unit is used.
My checklist before the first commercial unit ships
- Name the tecnovigilancia responsible at the Colombian holder or importer, and tell INVIMA who it is (Art. 11).
- Approve the Tecnovigilancia Manual and procedures, signed by the responsible person and by management (Art. 10).
- Adopt INVIMA’s report form or an institutional form with the same fields (Art. 14).
- Set up a case log that can produce the Article 17 quarterly report without rework.
- Write the 72-hour paths into the quality agreement between manufacturer and holder: serious events (Art. 15) and international alerts (Art. 20), with named contacts and backups on both sides.
- Agree on how withdrawals and field actions are decided and notified to INVIMA (Art. 19).
- For implants, confirm lot and serial traceability down to the receiving facility (Art. 31).
- Diary the quarterly report dates for the first year, and check the first one goes out on time.
FAQ
Who has to report adverse events with medical devices in Colombia?
Manufacturers and importers, health service providers, independent health professionals, device users and anyone who learns of an adverse event or incident (Art. 13). For a foreign manufacturer, the practical owner is the Colombian holder or importer running the institutional program.
How fast must a serious adverse event be reported to INVIMA?
Within 72 hours of the event or incident, using the report form and the information in Article 14 (Art. 15).
Are non-serious events reported?
Yes. They’re consolidated and sent quarterly with the preventive measures taken (Arts. 16 and 17). The quarterly report became mandatory 48 months after the resolution was issued.
Does a recall abroad matter in Colombia?
Yes. Importers must notify INVIMA within 72 hours of learning of an international alert from the parent company or any health agency that involves a device they sell in Colombia (Art. 20).
How bioaccess® helps
We act as registration holder and importer for device manufacturers entering Colombia and the rest of Latin America, and we set up and run the local post-market duties that come with that role. The Colombia registration pathway is on our Colombia INVIMA market access page, and the full program is at bioaccess® market access.
Source: Ministry of Social Protection Resolution 4816 of 2008, Articles 2, 9 to 17, 19 to 21, 26, 31 and 32, as published in INVIMA’s legal compilation. This page is general regulatory information, not legal advice for a specific product.