Maps to
QMSR / ISO 13485: §820.184
ISO 13485: §4.2.3 / 4.2.5
Requirement text
Records shall be maintained to provide evidence of conformity and effective QMS operation.
What changed
Part 820 section 820.184 required a Device History Record (DHR) and had scattered records requirements throughout the regulation (820.180 General Requirements, 820.184 Device History Record, 820.186 Quality System Record). The QMSR replaces this fragmented approach with ISO 13485's unified records control framework in sections 4.2.3 and 4.2.5, supplemented by QMSR-specific provisions in 820.35.
ISO 13485 section 4.2.3 addresses the Medical Device File concept, which is distinct from Part 820's Device History Record. The Medical Device File contains or references documents generated during the design and manufacturing process for each device type or device family — specifications, validation records, labeling, production processes. Section 4.2.5 then covers control of quality records more broadly, requiring documented procedures for identification, storage, protection, retrieval, retention time, and disposition.
The key structural change is that ISO 13485 requires a single, documented procedure defining how all records are controlled. Part 820 scattered records requirements across multiple sections without requiring a unified records management procedure. Many Part 820 companies have training record requirements in one SOP, batch record requirements in another, complaint record requirements in a third, with no overarching records management procedure tying them together. Under ISO 13485, this must be consolidated.
The practical distinction between 4.2.3 (Medical Device File) and 4.2.5 (Control of Records) matters: the Medical Device File is a product-specific compilation that demonstrates the device meets requirements, while records control is the organizational procedure ensuring all records across all processes are properly managed. Companies need both — a procedure for managing records generally, and a defined structure for compiling product-specific evidence files.
Atomic constraints
- •Records must be legible and retrievable
- •Retention periods must be defined
- •Storage conditions must be specified
- •Protection from damage and deterioration required
- •A documented procedure must establish controls for identification, storage, protection, retrieval, retention time, and disposition of all QMS records per ISO 13485 clause 4.2.5.
- •The medical device file (MDF) must be established and maintained for each device type, containing or referencing documents demonstrating conformity to requirements for design and development, production, and post-production per ISO 13485 clause 4.2.3.
- •The medical device file must include or reference device descriptions, labeling, specifications, manufacturing processes, measurement and monitoring procedures, installation and servicing procedures, and risk management records.
- •Records must remain legible throughout the defined retention period and be readily retrievable upon request.
- •Retention periods must be at minimum the expected lifetime of the medical device, ensuring records remain available throughout the product's service life.
Common gaps
No Unified Records Management Procedure
moderateRecords requirements are embedded within individual SOPs (training SOP says 'maintain training records,' CAPA SOP says 'maintain CAPA records') but there is no overarching procedure defining how records are identified, stored, protected, retrieved, retained, and disposed of across the entire QMS.
Medical Device File Concept Not Implemented
moderateThe organization maintains a Device History Record (production batch records) per Part 820.184 but does not have a Medical Device File per ISO 13485 4.2.3 that compiles or references all documents for a device type — design specifications, verification/validation records, labeling, risk management file, and production process descriptions.
Record Retrieval Not Demonstrated
moderateRecords exist but cannot be reliably retrieved within a reasonable timeframe. Paper records are filed inconsistently, electronic records are spread across multiple systems without a search mechanism, and there is no defined retrieval process or target retrieval time.
Records not 'Readily Retrievable'
moderateRecords are stored in a 'remote warehouse' or 'offline drive' that takes 24+ hours to retrieve. ISO 13485 §4.2.5 requires them to be 'readily retrievable' (usually within 1-2 hours for an audit).
Missing retention rationale
minorThe QMS states 'Retain for 5 years' but doesn't define the 'Lifetime of the device' as a baseline. ISO 13485 §4.2.5 requires the retention period to be linked to the device lifetime.
Evidence signals
- •
FILE_EXISTS
(Record.*Retention|Record.*Storage|Archiv|Record.*Procedure)
- •
CONTENT_MATCH
Does this document describe record storage, retention periods, or record protection procedures?
Audit defense
Record control for our QMS is defined in [your document ID]. All QMS records are legible, protected from deterioration, and retrievable within defined timeframes. Retention periods are established for each record type per ISO 13485 4.2.5.