If you've ever been on the receiving end of an FDA inspection, you know the moment the investigator asks for your Device History Records. Everything stops. Your team scrambles. Someone starts hunting through shared drives, paper binders, and email threads trying to reconstruct a complete picture of how a finished device was made. If that picture has gaps missing lot numbers, unsigned records, superseded procedures you're looking at a Form 483 observation at best, and a Warning Letter at worst.
The DHR is one of the most consequential documents in medical device manufacturing. It's not complicated in theory, but in practice, it's where a lot of quality systems quietly break down. This guide covers everything you need to know: what a DHR is, what it must contain, how it differs from a DMR, where companies go wrong, and how the right systems can make DHR compliance a non-issue rather than a recurring source of stress.
What Is a DHR?
A Device History Record (DHR) is the compiled set of records that demonstrates a finished medical device was manufactured in accordance with its approved specifications. Think of it as the proof of execution the documented evidence that your team followed the procedures, used the right materials, performed the required tests, and produced a device that meets release criteria.
The DHR requirement for medical device manufacturers in the United States is codified in 21 CFR Part 820.184, part of the FDA's Quality System Regulation (QSR), which is now being harmonized with ISO 13485 under the updated Quality Management System Regulation (QMSR). Under this regulation, each manufacturer must maintain a DHR for each batch, lot, or unit of finished device produced.
In short: the DMR tells you how to build the device. The DHR proves you actually built it that way.
DHR vs. DMR: What's the Difference?
This is one of the most commonly confused distinctions in medical device quality, and it's worth getting exactly right especially because FDA investigators expect you to know it cold.
The Device Master Record (DMR) is the blueprint. It contains all the specifications, procedures, and instructions required to manufacture a device: component drawings, material specs, manufacturing procedures, quality standards, labeling requirements, and packaging specifications. The DMR tells your team how to make the device.
The Device History Record (DHR) is the proof. It contains the actual records generated during production that demonstrate the device was made according to the DMR. Where the DMR is forward-looking and prescriptive, the DHR is retrospective and evidentiary.
| DMR | DHR | |
|---|---|---|
| What it is | The blueprint | The proof |
| Contains | Specifications, procedures, instructions | Records generated during manufacturing |
| Purpose | Define how to make the device | Demonstrate the device was made correctly |
| Regulatory basis | 21 CFR 820.181 | 21 CFR 820.184 |
| Created | Before manufacturing begins | During and after manufacturing |
Both are required. Both will be reviewed during an FDA inspection. And critically, they must align if your DHR references procedures or specifications that don't match the current version of your DMR, you have a compliance problem regardless of whether the device itself is fine.
What Must Be Included in a DHR?
Under 21 CFR 820.184, the DHR for each batch, lot, or unit must contain or reference the location of the following information:
1. Dates of Manufacture
The DHR must include the dates on which the device or lot was manufactured. This sounds simple, but "dates of manufacture" should be interpreted broadly including key production milestones, not just a start and end date. Clear date documentation matters when reconstructing the timeline of a production run during a complaint investigation or CAPA.
2. Quantity Manufactured
How many units were produced in the batch or lot. This figure establishes the universe of devices that could be affected if a nonconformance or complaint arises, and it's essential for any recall scope analysis.
3. Quantity Released for Distribution
This is distinct from the quantity manufactured. Not every unit that enters production will pass inspection and be released. Your DHR must clearly document how many units were ultimately released, and this number must reconcile with your acceptance records and nonconformance documentation.
4. Acceptance Records
These are the records that document each required inspection and test incoming component inspection, in-process checks, final device testing and confirm whether each was passed or failed. Acceptance records are the core evidentiary layer of the DHR. They must clearly identify what was tested, who performed the test, what equipment was used, what the acceptance criteria were, and what the result was.
5. Primary Identification Label and Labeling Used
The actual label (or an exact copy) applied to the device, along with any other labeling (IFU, packaging inserts) included with the finished product. This documents what was actually used in production not just what the DMR says should be used. Label version mismatches are a common source of DHR nonconformances.
6. Device Identification
Each DHR must include a unique identifier for the batch, lot, or individual unit typically a lot number, batch number, serial number, or Unique Device Identifier (UDI). UDI requirements have added a layer of specificity here, particularly for implantable and higher-risk devices, where individual unit traceability is required.
7. Relevant Equipment Identification
Where required by your quality procedures, the DHR should identify the specific equipment used during manufacturing, including calibration status at the time of use. This is especially important for equipment that directly affects product quality sterilization equipment, measurement tools, automated assembly systems.
DHR Requirements Under FDA Regulations
The primary regulatory basis for DHRs in the United States is 21 CFR Part 820.184, which sits within the broader Quality System Regulation framework. The QSR has governed medical device manufacturing in the U.S. since 1996, but the regulatory landscape is currently evolving.
The QMSR Transition
In 2024, the FDA finalized the Quality Management System Regulation (QMSR), which harmonizes the existing QSR with ISO 13485:2016 the international standard for medical device quality management systems. The QMSR became effective in February 2026, meaning manufacturers are now operating under an updated framework that more explicitly aligns U.S. requirements with international expectations.
Under the QMSR, the DHR concept persists and remains a required output of your quality management system. If your organization is ISO 13485 certified, you're already familiar with the equivalent requirement under Section 7.5.8 of that standard, which requires manufacturers to maintain records that demonstrate the device has been manufactured in accordance with requirements functionally the same as the DHR.
EU MDR Considerations
For manufacturers placing devices on the European market, the EU Medical Device Regulation (EU MDR 2017/745) has its own traceability and record-keeping requirements under Article 10 and Annex I. While the EU MDR doesn't use the term "DHR" explicitly, the underlying requirement comprehensive records demonstrating conformity throughout the manufacturing process maps closely to the DHR concept. Companies operating globally should ensure their DHR documentation strategy satisfies both FDA and EU MDR requirements simultaneously, ideally through a single, unified quality management system.
The Core Compliance Principle
Regardless of which regulatory framework applies to your organization, the fundamental DHR principle is the same: your records must be complete, accurate, and retrievable at any time. FDA investigators don't give credit for records that exist somewhere but can't be produced on demand. If you can't demonstrate where your DHRs are stored, who has access to them, how they're organized, and how you ensure they're complete before product release, you have a vulnerability.
Common DHR Mistakes and How to Avoid Them
Most DHR failures aren't the result of bad intentions. They're the result of systems or the absence of systems that allow small gaps to accumulate until an inspection or complaint makes them visible. Here are the most common failure patterns.
Incomplete Records at Time of Release
The most fundamental DHR mistake is releasing product before the DHR is complete. This happens when different parts of the DHR acceptance records, label documentation, equipment logs are generated by different teams and compiled manually after the fact. By the time someone realizes a record is missing, the product may already be in distribution.
The fix is a defined DHR completion checklist that serves as a release gate. No unit or lot is released without a verified, complete DHR. This requires clarity about who owns each DHR element and a documented process for compilation and review.
Paper-Based Systems With No Audit Trail
A paper DHR binder might technically contain all the required records, but it has no audit trail. You can't prove who accessed it, whether anything was added or removed after the fact, or whether the signatures are authentic. FDA investigators are increasingly sophisticated about the limitations of paper-based quality systems, and a DHR with no electronic audit trail is an inherent vulnerability.
Electronic records maintained under a Part 11-compliant system provide the audit trail that paper simply cannot. Every access, every edit, every signature is timestamped and attributed automatically.
Version Control Failures
A DHR that references Version 3.1 of a manufacturing procedure, when the approved version in the DMR at the time of production was 3.0, is a nonconformance even if the actual difference between those versions was inconsequential. Version control failures in DHRs are surprisingly common, particularly in organizations where procedures are managed separately from production records.
The underlying cause is almost always a disconnected system: procedures live in one place, production records live somewhere else, and no one is enforcing that the version used matches the version approved. Integrated document control systems that link procedures to the records that reference them eliminate this failure mode.
Records Stored Across Disconnected Systems
Many growing medical device companies cobble together a DHR from records stored in different systems: inspection records in a spreadsheet, label documentation in a shared drive, equipment logs in a CMMS, test results in an email thread. When an investigator or auditor asks to see the DHR for Lot 2024-0047, pulling together a complete, coherent record from five different systems is time-consuming, error-prone, and a visible demonstration that your quality system lacks integration.
Centralizing DHR records or at least maintaining a single index that clearly references the location of every required element is essential as your manufacturing volume grows.
No Clear Ownership
Every DHR needs a clear owner: someone who is responsible for ensuring it's complete, accurate, and approved before product release. In organizations without this clarity, DHR completion falls through the cracks because everyone assumes someone else is handling it.
Define the role, document the responsibility in your SOPs, and make DHR review a formal step in your product release procedure.
How DHRs Relate to Your Broader Quality System
The DHR doesn't exist in isolation. It's one output of a quality management system that spans design controls, supplier management, production controls, complaint handling, and CAPA. Understanding how DHRs connect to the rest of your QMS is important both for compliance and for getting real operational value out of your records.
CAPA and Nonconformance: When a nonconformance or complaint is identified, the DHR for the affected lot becomes a primary investigation tool. The quality of your CAPA process is directly limited by the quality of your DHRs if your production records are incomplete or difficult to access, your root cause analysis will be too.
Supplier Management: Components included in a finished device must be traceable back to a specific supplier lot and incoming inspection record. This traceability typically lives in the DHR. If a supplier delivers a nonconforming component that makes it through to a finished product, the DHR is what allows you to identify the scope of the problem.
Complaint Handling: When a complaint is filed, the DHR for the relevant device is one of the first documents reviewed. A complete, organized DHR makes complaint investigations faster and more defensible. An incomplete one makes them slower and more expensive.
FDA Inspections: Investigators conducting a quality system inspection will routinely sample DHRs as part of their review of production and process controls. A clean, well-organized DHR is one of the clearest signals that your quality system is functioning as designed.
This is why the DHR can't be treated as a standalone paperwork exercise. It's the downstream output of your entire manufacturing quality system, and its quality reflects the quality of everything that feeds into it.
How Software Can Help You Manage DHRs Compliantly
As manufacturing volume grows, managing DHRs manually becomes increasingly risky and resource-intensive. The right quality management and document control software transforms DHR compliance from a reactive scramble into a systematic, audit-ready process.
What to Look for in a System
Audit Trail: Every action on every record creation, editing, approval, access should be automatically logged with a timestamp and user attribution. This is a requirement under 21 CFR Part 11 for electronic records, and it's the foundation of a defensible DHR.
Version Control: Your system should enforce that only current, approved versions of procedures and specifications are referenced in production records. Version mismatches should be impossible, not just discouraged.
Electronic Signatures: Part 11-compliant e-signatures eliminate the authentication problems that come with wet signatures on paper records, and they integrate directly into approval workflows rather than requiring a separate signing step.
Role-Based Access: Not everyone needs to be able to edit a DHR. Role-based access controls ensure that the right people can create and edit records, the right people can review and approve them, and everyone else can only view with their access logged.
Workflow Automation: DHR completion checklists, review routing, and release approval workflows should be automated rather than managed manually. When the system enforces the process, the process gets followed.
Integration Across Functions: Ideally, your document control system, QMS, and production records exist in the same platform or are genuinely integrated, not just loosely connected. This is what eliminates the multi-system DHR problem described earlier.
How Kivo Supports DHR Compliance
Kivo's Document Management System and Quality Management System are built on a single, unified platform not separate products patched together. This means your SOPs, manufacturing procedures, acceptance records, training records, and approval workflows all live in the same environment, with the same audit trail, the same version control, and the same access controls.
Kivo is Part 11 compliant, SOC 2 and ISO 9001 certified, and pre-validated meaning you don't have to spend months validating the system before you can use it. The validation documentation is delivered as part of your implementation, reducing the burden on your quality team and getting you to compliance faster.
For life sciences teams that are tired of managing DHRs across disconnected systems or that have experienced firsthand what an incomplete DHR looks like during an inspection Kivo provides the infrastructure to do it right the first time, every time.
DHR Frequently Asked Questions
What is the difference between a DHR and a DMR? The Device Master Record (DMR) contains the specifications and procedures for how a device should be manufactured. The Device History Record (DHR) contains the actual records generated during manufacturing that prove the device was made according to those specifications. The DMR is the blueprint; the DHR is the proof of execution.
Is a DHR required by the FDA? Yes. 21 CFR 820.184 requires medical device manufacturers to maintain a DHR for each batch, lot, or unit of finished device. Under the updated QMSR (effective February 2026), this requirement continues in harmonized form with ISO 13485.
How long must DHRs be retained? Under 21 CFR 820.180, records must be retained for a period equivalent to the design and expected life of the device, but in no case less than two years from the date of release for commercial distribution. Many manufacturers retain DHRs longer, particularly for implantable devices or devices with extended useful lives.
What triggers a DHR audit or review? FDA investigators routinely sample DHRs during quality system inspections (QSI) as part of their review of production and process controls. DHRs are also reviewed in response to complaints, recalls, MDR reportable events, and CAPA investigations. There is no specific trigger required your DHRs should be audit-ready at all times.
Does ISO 13485 require a DHR? ISO 13485:2016 Section 7.5.8 requires manufacturers to maintain records demonstrating that devices have been produced in accordance with requirements which is functionally equivalent to the FDA's DHR requirement. Organizations certified to ISO 13485 should ensure their production records satisfy both the international standard and any applicable national regulatory requirements.
Can DHRs be maintained electronically? Yes, and for most growing manufacturers, electronic DHRs are strongly preferable to paper. Electronic records maintained under a Part 11-compliant system provide the automatic audit trail, version control, and access logging that paper cannot. FDA accepts electronic records under 21 CFR Part 11, provided the system meets the applicable requirements.
Conclusion
The Device History Record is, at its core, a promise kept in writing: the promise that every device you released was built the way it was supposed to be built, tested the way it was supposed to be tested, and documented in a way that proves it. When that documentation is complete, organized, and retrievable, the DHR becomes a source of confidence for your team, for your auditors, and for the patients who ultimately depend on your devices.
When it isn't, the DHR becomes a liability that shows up at exactly the wrong moments.
Getting DHR compliance right isn't just about checking boxes for the FDA. It's about building a quality system that generates trustworthy evidence as a natural output of good manufacturing practice not as a retroactive exercise in paperwork assembly. The teams that get this right are the ones with integrated systems, clear ownership, and the discipline to treat records as a real-time reflection of their processes, not an afterthought.
If your current DHR process relies on manual compilation, disconnected systems, or paper binders, it's worth asking honestly: would you be ready if an investigator walked in tomorrow? If the answer is uncertain, Kivo can help. Schedule a demo to see how our unified DMS and QMS platform supports compliant, audit-ready device history records from day one.
