// WHITE PAPER
Medical devices are developed to prevent, diagnose, treat, and rehabilitate medical conditions safely and effectively, offering benefits for both patients and clinicians. Those benefits can only be safely delivered if medical device teams understand the potential risks associated with a device when placed in the hands of end users. Risks may not always be obvious and can emerge from several sources, including labeling and instructions, training materials, interface layout and ergonomics, related tasks in a workflow, and the environment of use.
An example of unrealized risk can be found in a myriad of cases reported to the FDA: during a nebulizer treatment, a patient’s oxygen tubing became disconnected, and IV tubing was inadvertently connected to the nebulizer in its place. The patient inhaled a moderate amount of IV fluid before a respiratory therapist identified the misconnection. Thankfully the patient survived, but the FDA classified this type of event as having a high potential for harm. The takeaway from such examples is not to blame “user error” because someone connected the wrong tube; the design allowed two unrelated systems to connect in a way that caused harm. A Use-Related Risk Analysis (URRA) helps development teams identify these potential risk pathways early enough to reduce them through design.
Design lesson: unrelated delivery systems should not be able to physically connect.
Image credit FDA.gov
This guide is for medical device teams and human factors practitioners seeking practical advice for creating and maintaining a URRA. Use the guide to influence design decisions, formative evaluation, critical task identification, and human factors validation.
What is the URRA
The URRA is a living document used in the medical device design process to identify foreseeable user errors, hazards, and potential harm when operating a device or drug-delivery product. FDA guidance places the URRA at the center of its recommended risk-based approach to human factors, helping teams identify and address use-related risks while supporting regulatory submissions. However, if a medical device team doesn’t give the URRA serious attention until the human factors validation stage of development, the analysis has begun too late to serve its intended purpose. Validation protocols may expose some issues, but decisions the analysis should have informed such as workflow, controls, displays, alarms, labeling, and training have already been made.
A useful URRA starts early, evolves with the design, and maintains traceability from users and their tasks to inform possible use errors, hazardous situations, harms, controls, and evidence. The true value is not the documentation itself (although the document serves a useful reference) but the decisions made possible by the risk analysis.
Download our URRA Template
A practical, structured template for identifying use-related risks, critical tasks, and risk controls throughout medical device development.
The URRA captures the traceability chain
The URRA guides analysis and captures traceability from Intended user + use scenario + task → possible use error → hazardous situation → potential harm → severity and critical-task decision → risk control → evidence that the control works.
The URRA starts with users, workflows, and tasks
Teams cannot identify potential use errors if they do not understand the context of use. Begin the analysis with intended user groups, relevant capabilities and limitations, use environments, training assumptions, and interface elements. Then break workflows down into tasks at a level where an incorrect action or omission has a clear consequence.
The FDA describes task analysis as systematically breaking down a medical device use case into discrete sequences of tasks. For each task, consider what the user has to perceive, understand, decide, and do. Then look at what could go wrong, what might contribute to the error, what the consequences would be, and where the design could reduce the risk. The FDA also identifies contextual inquiry, interviews, expert or heuristic review, prior studies, complaint files, known problems with similar devices, recalls, and safety communications as possible inputs to the process.
User research and cognitive task analysis can therefore be an important step in understanding how tasks are actually performed, what information people rely on, which workarounds exist, and how time pressure, lighting, noise, interruptions, protective equipment, or handoffs impact interactions.
The level of granularity for tasks is a judgment call. “Administer therapy” as an example, is too broad to expose where perception, decision-making, or action can fail. Stating “Confirm the selected concentration before starting delivery” better lends itself to analysis because the team can identify what correct confirmation requires and what happens if the wrong value is accepted. Overly granular task breakdowns can take things too far: splitting every physical motion into a row is unhelpful. Use the level of granularity that exposes a distinct error, consequence, control, or test need..
Effective URRA task descriptions are specific enough to expose meaningful risks and controls without fragmenting the workflow into unnecessary detail.
Keep use error, hazardous situation, and harm distinct
Several URRA fields sound interchangeable but are not. A hazard is a potential source of harm. A hazardous situation is the circumstance or context in which a person, property, or the environment is exposed to one or more hazards. A harm is the resulting injury or damage. A use error is an action or omission different from what the manufacturer expected that produces a different result from what the user expected and could result in harm.
Consider a hypothetical medication delivery interface where a key task is to select and confirm a concentration. One possible use error is selecting an adjacent concentration and confirming it without recognizing the mismatch. The resulting hazardous situation is that the patient is exposed to the wrong concentration. The potential harm depends on how different the dosage is from the intended concentration. The interface layout, confirmation logic, labeling, and use environment may all contribute; “user selected wrong value” does not help in identifying a root cause.
This approach and language keeps the analysis from blaming the operator. The team's questions should focus on what features of the interface, task, users, environment, or organizational context made an error possible and what can change to reduce or eliminate the risk.
The FDA recommends evaluating reasonably foreseeable misuse, including use by unintended but foreseeable users, to the extent possible. It distinguishes that from abnormal use, which is a “conscious, deliberate act or omission beyond further reasonable interface-related risk control”.
Separating the user’s action, the circumstances of exposure, and the resulting harm helps teams trace risk without treating “user error” as the root cause.
Controls need design logic and evidence
The current FDA guidance presents the ISO 14971 risk-control options in order of preference and effectiveness:
1. Inherent safety by design;
2. Protective measures in the device or manufacturing process; and
3. Information for safety, including labeling and training.
Design can remove an error-prone interaction, prevent incompatible connections, improve detectability, automate unreliable steps, and constrain dangerous selections. Guards, interlocks, warning screens, and alerts are possible protective measures. Labeling and training can support safe use, but the FDA notes their limits: information may not be available when needed, people must remember it, and training can be forgotten.
The URRA should show what design controls were considered, why the selected control is appropriate, and how effectiveness will be evaluated. Controls can also create new tasks or risks: a confirmation dialog may prevent one error while encouraging automatic clicking. Each control also needs follow-up: did it reduce the intended risk, and did it introduce any new use-related risks?
Order of preference and effectiveness presented in FDA's 2026 human-factors guidance, with attribution to ISO 14971.
Update the URRA as evidence and the design change
The URRA can also help teams decide where formative evaluation will be most useful. That may include unfamiliar or difficult tasks, challenging use conditions, vulnerable user groups, or controls that depend heavily on perception and understanding.
FDA guidance notes that formative evaluation can uncover previously unrecognized hazards and use errors, identify new critical tasks, evaluate controls, inform labeling and training, and shape validation. FDA guidance also recommends iterating on the design and evaluating changes until the interface is ready for validation. After each study, update the relevant tasks, use errors, contributing factors, hazardous situations, harms, severity decisions, controls, and evidence links. The URRA should show what the team learned, what changed, and whether its critical-task determinations still hold. Review our article FDA Human Factors Guidance for Medical Devices: What Changed in 2026 and Why it Matters for more details on the latest guidance.
The FDA's May 2026 guidance calls the URRA a living document and provides three Human Factors Submission Categories to help companies determine the amount of human factors documentation required for a medical device marketing submission.
For a Category 3 submission involving a modified device, FDA recommends a comparative URRA covering tasks associated with relevant use scenarios, risk acceptability, and the rationale for whether changes warrant new validation data. Whatever the submission category, comparative analysis is useful when a change could affect use. Follow the workflow beyond the changed screen, control, accessory, or label: a new default can alter what users notice later, and several small revisions can have a cumulative effect.
Research findings, design changes, new users or environments, labeling and training revisions, complaints, post-market information, and problems with analogous devices should all be triggering events for updates. Assign the URRA an owner, version history, review triggers, and links to controlled evidence so the current analysis remains connected to the current design.
Critical tasks connect the URRA to validation
The FDA defines a critical task as one that, if performed incorrectly or not performed at all, would or could cause serious harm to the patient or user. The guidance recommends categorizing tasks according to potential harm severity, and the FDA considers severity more meaningful when deciding where HFE/UE work is needed because the probability of use error can be difficult to determine.
A low estimated probability does not make a task noncritical when incorrect performance or omission could cause serious harm. Define each harm-severity level and apply the definitions consistently. Determine whether a task is critical by asking whether incorrect performance or omission could cause serious harm, not by relying on an arbitrary risk-priority-number cutoff.
Critical tasks then help define validation scope. FDA recommends that human factors validation represent intended users, include all critical tasks, use the final interface, and reproduce actual conditions sufficiently to support generalization to real use. The URRA identifies the relevant users and environments, critical performance and knowledge tasks, natural use scenarios, controls under evaluation, and evidence needed to detect use errors, close calls, and difficulty.
Note that the URRA does not itself prove that the final interface is safe and effective. Rather, validation tests the final design and its controls under representative conditions. The results of validation tests are then returned to risk management for root-cause and risk analysis.
URRA readiness check
Before finalizing the validation protocol, confirm that:
Intended users, environments, workflows, and the complete interface are represented
Tasks are specific enough to connect errors with consequences
Known problems and formative findings are incorporated
Use errors, contributing factors, hazardous situations, and harms remain distinct
Critical tasks follow documented severity logic
Controls trace to design outputs and effectiveness evidence
Task identifiers connect risk analysis, formative evidence, and validation
The URRA matches the final interface, labeling, and training.
Remember, if a risk analysis starts late, documenting errors without workflow evidence, defaulting to training as a safeguard, treating “user error” as a root cause, or losing traceability weakens both the analysis and the validation strategy. A well-maintained URRA helps the team identify where interactions can create risk early enough to do something about it. The final submission table is simply a record of that work.
This article provides general educational information and is not legal or regulatory advice. Consult applicable regulations, current guidance, recognized standards, device-specific requirements, and qualified regulatory counsel for your situation.
Order of preference and effectiveness presented in FDA's 2026 human-factors guidance, with attribution to ISO 14971.
HF Designworks can help medical device teams build and maintain URRAs grounded in real-world use, traceable risk controls, and evidence from formative and validation testing. If your team is developing or modifying a device, contact us to discuss how we can strengthen your use-related risk analysis and human factors strategy.
Sources
U.S. Food and Drug Administration. (2026, August 3). Applying human factors and usability engineering to medical devices: Guidance for industry and Food and Drug Administration staff.
U.S. Food and Drug Administration. (2026, May 29). Content of human factors information in medical device marketing submissions: Guidance for industry and Food and Drug Administration staff.
U.S. Food and Drug Administration. (2026, May 25). IEC 62366-1 Edition 1.1 2020-06 consolidated version: Medical devices—Part 1: Application of usability engineering to medical devices [Recognized consensus standard, Record No. 41235].
U.S. Food and Drug Administration. (2026, May 25). ISO 14971 Third Edition 2019-12: Medical devices—Application of risk management to medical devices [Recognized consensus standard, Record No. 41349].
Contact
HF Designworks, Inc.
PO Box 19911
Boulder, CO 80308
(720) 362-7066