A manufacturer sends an email on a Tuesday. It is polite, technical and short. A particular lot of cartridges, it says, may under certain conditions return results that read lower than the true value, and it should be quarantined and returned. There is a reference number, a lot number, and a line asking recipients to acknowledge receipt and take appropriate action. In a central laboratory, that email triggers a well-worn drill. Someone walks to the fridge, pulls the affected lot, tapes a bag over the analyser's reagent bay if needed, and logs the action. Containment takes minutes because everything lives in one place, on one machine, under one team.
Now imagine the same email landing on the desk of a point-of-care coordinator whose estate is a hospital plus fourteen wards, three community clinics, a prison healthcare unit, two GP practices and a homeless outreach van. The affected lot was ordered centrally eight months ago, split into part-boxes, and distributed to wherever ran low. Some of it was couriered between sites by a friendly healthcare assistant who was helping out. Nobody wrote that down. Two of the devices that used it are not connected to anything and store their results on a memory that gets overwritten. And the results those devices produced over the past several weeks have already been read, acted upon, and in some cases used to send a patient home.
Here is the thesis, stated without softening. When a reagent lot or a device is recalled, a laboratory quarantines one fridge and one analyser and is done. A distributed point-of-care service has to prove that every affected device, every affected lot, and every patient result produced while the fault was live has been found, acted on and documented. That is a categorically harder problem, and most services are not ready for it. The field safety notice is the moment your inventory, your connectivity and your governance are tested for real, with a regulator, a manufacturer and possibly a coroner watching.
Why containment is easy in a lab and brutal outside it
In the UK, the MHRA issues and oversees medical device safety communications, including field safety notices and recalls, and manufacturers issue field safety notices when they need to take corrective action on a device or consumable already in the field. The regulatory machinery is mature and it works. What the notice cannot do is find your devices for you. It tells you what is wrong and what to do; it assumes you know where your affected items are and what they touched. In a laboratory that assumption is safe. Across a distributed estate it is often false.
The laboratory is the easy case for a reason worth naming. It has physical concentration: the reagents are in one room, the analysers on one bench. It has controlled inventory: goods-in logs the lot, the fridge holds it, the middleware ties every result to the instrument and the reagent pack. It has connectivity: results flow to the laboratory information system with a timestamp, an operator and a device identifier attached, so a look-back is a database query, not a search party. Containment is fast because traceability was already built in before anyone needed it.
Point-of-care testing inverts every one of those advantages. The devices are everywhere, by design, because the whole point is to bring the test to the patient. The consumables are bought, split, shared and moved locally, often without a central record of which lot went where. Inventory is frequently a spreadsheet that was last accurate three reorders ago, or a cupboard that nobody counts. Connectivity is patchy: some devices upload every result with full metadata, others are effectively islands that print a slip and forget. And the results are not sitting in a queue waiting to be verified. They have already changed decisions, because immediacy is the reason the test exists. By the time the notice arrives, the horse has not only bolted, it has been ridden.
The four features that make POCT recalls uniquely hard
It is worth being precise about why this is harder than a laboratory recall, because each difficulty has a corresponding fix, and the fixes are the whole point.
Devices are everywhere and move
A laboratory analyser has an asset tag and a fixed location. A point-of-care device is portable by nature and portable in practice. Meters migrate between wards during surges, get borrowed, get left in a drawer, get replaced without the paperwork catching up. When a device fault is recalled, the first question, "where are all the affected units right now?", can genuinely be unanswerable for a service that has never kept a live register.
Consumables are bought and moved locally
Cartridges and strips are ordered in bulk, then dispersed. A part-box travels from a busy site to a quiet one. A locum brings their own stock. A ward runs short and raids the clinic down the corridor. NHS England guidance recognises that oversight of point-of-care consumables such as cartridges and strips, including for recalls, is needed and typically sits with the pathology or laboratory service. That ownership matters precisely because, without it, lot-level traceability evaporates the moment a box is opened and split.
Inventory is usually weak
Ask most services to produce, on demand, a list of every site holding a named lot number, and you will get a pause. The information exists somewhere: in delivery notes, in local cupboards, in people's heads. It is rarely in one queryable place, kept current. A recall turns that weakness from a background annoyance into an operational emergency, because the notice is lot-specific and your records are not.
Connectivity is patchy and results are already actioned
The look-back is the hardest part. A recall about results reading falsely low over a defined window forces the question: which patients were tested on an affected device with an affected lot during that window, and were any of them managed on the strength of a wrong number? For connected devices this is answerable. For unconnected ones it is archaeology: paper logs, printouts, memories. And unlike a laboratory result held in a queue, a point-of-care result has usually already done its work. Clinical review is not precautionary, it is remedial.
A recall is the one event that reads your whole governance back to you out loud. You do not get to revise your inventory after the notice arrives. You get to discover what it always was.
The trace-back chain you have to complete
Strip away the panic and a recall is a chain of questions, each of which must be answered before the next fully makes sense. The chain is the same whether the recall is trivial or catastrophic. What changes is whether your service can walk it in hours or is reduced to walking it in weeks, by phone, one site at a time.
Read that chain honestly against your own service and the gaps announce themselves. Can you list every site holding the named lot without ringing round? Can you name every device that ran it, and where those devices are today? Can you pull the patient results those devices produced during the fault window, or are some of them on an island that prints and forgets? Can you tell, for each affected result, whether it was acted upon and whether the action needs revisiting? And when it is all done, can you produce a single closure record that a regulator or a coroner would accept as proof, not just an assurance that you "dealt with it"?
Most services can complete part of the chain quickly and part of it not at all. The dangerous illusion is that the parts you can do fast reassure you, while the parts you cannot do at all are the ones that matter clinically. Quarantining the stock is the visible, satisfying bit. Finding the patient who was discharged on a falsely reassuring result is the bit that keeps you up at night, and it is exactly the bit that weak connectivity makes impossible.
Recall-readiness is just governance you can prove
The uncomfortable truth is that a recall does not create these problems. It reveals them. A service that cannot answer a recall in hours could not, on any ordinary Tuesday, tell you where all its devices are, which lots are in play, or which results came from which instrument. The recall simply attaches a deadline and an audience to a weakness that was there all along. This is why I argue that recall-readiness is not a niche disaster-planning exercise. It is a stress test of whether your point-of-care governance is real or merely documented.
Under a single quality management system, the standards already expect you to control your equipment, your reagents and your records. ISO 15189:2022 does not use the word "recall" as a magic spell, but it expects traceability, inventory control, and the ability to identify and manage nonconforming work. A recall is nonconforming work arriving from the outside at speed. If your management system genuinely delivers traceability, the recall is a bad afternoon. If it delivers only paperwork that describes traceability you do not actually have, the recall is the day the gap becomes visible to people who can act on it.
There is a governance dividend here worth naming. Everything that makes a recall survivable, a live device register, lot-level inventory, connected results, defined roles, is the same infrastructure that makes ordinary quality management easier every other day of the year. You are not building a recall capability. You are building a governed service, and recall-readiness is the proof that you did.
What a service needs to answer a recall in hours
If you run, coordinate or advise on a distributed point-of-care service, do not wait for the notice to find out where you stand. Build the capability now, while the stakes are hypothetical.
- Keep a live inventory of devices and lots. Maintain, and actually update, a register of every device, its location and its status, plus which consumable lots are held where. The test is simple: could you produce a list of every site holding a named lot number in minutes, without phone calls? If not, that is your first project, not your last.
- Connect what you can, and know what you cannot. Connectivity so that results carry a device identifier, an operator and a timestamp turns a look-back from a search party into a query. Where devices genuinely cannot connect, know exactly which ones they are and treat them as your highest-effort manual look-back, not as an afterthought you discover mid-recall.
- Define the roles before you need them. A recall has no time for ambiguity about who owns it. Name, in advance, who receives manufacturer and MHRA notices, who decides on quarantine, who leads the clinical look-back, who authorises patient recall, and who signs the closure. Vacant roles are found at the worst possible moment.
- Have a look-back method, written down. Decide in advance how you will identify affected patient results and the time window, how you will assess clinical impact, and who reviews borderline cases. A rehearsed method executed calmly beats a brilliant improvisation executed in panic.
- Rehearse it. Run a tabletop drill against a plausible, invented lot recall once a year. Walk the whole chain. The rehearsal will surface the unconnected device, the site that shares stock off the record, the role nobody owns. Better to find them in a drill than in a real notice with a clock running.
- Document closure as evidence, not assurance. The end state of a recall is not "we handled it". It is a record that shows the notice received, the lots and devices identified, the results reviewed, the patients managed, and the actions signed off, with dates and owners. That record is what protects patients, and it is what protects you.
Our consultancy helps services build exactly this capability, the live register, the connectivity map, the roles and the rehearsed look-back, before a notice arrives rather than during one. Our training, including the POCT fundamentals course, builds the traceability and quality thinking that makes a recall a procedure rather than a crisis. And practical starting points, including inventory and look-back scaffolding you can adapt, live in our resources.
The recall you can actually close
A recall is never really about the reagent. It is about whether your service was telling itself the truth on every ordinary day that led up to it. The manufacturer's email is short and calm because the manufacturer has done its part: it found the fault and raised the alarm. What happens next is yours. The service that can name every affected device, pull every affected result and produce a closure record a coroner would accept did not get lucky. It built the plumbing while nothing was on fire. The one that cannot is not unlucky either. It is simply meeting, in public and under pressure, the state its governance was always in. Build so that when the notice comes, you can close the recall. Because the recall nobody can close is the one that was never closed at all, only survived.