There has been a lot of discussion surrounding medical device software and how it should be regulated. Concern about software of this nature will continue to rise to the forefront of conversations because there will be an increasing number of these products in the marketplace. The 21st Century Cures Act specifically addresses which types of medical device software will be exempt from regulation. Section 3060, Clarifying Medical Software Regulation, identifies five categories of medical software that will not be regulated as medical devices by the FDA due to their potential low level of risk to patients.
The software categories that may be excluded from device regulation include:
- Administrative & Operational Software: that provides administrative support of a healthcare facility, such as that for appointment scheduling, health benefit eligibility and processing financial records. While this software is included in the provision, it was not considered a medical device to begin with.
- Wellness Apps: for maintaining or encouraging a healthy lifestyle that is unrelated to the diagnosis, cure, mitigation, prevention, or treatment of a disease or condition. This is consistent with FDA’s General Wellness and Mobile Medical Applications guidance documents.
- Electronic Patient Record Software: provided that it is only intended to transfer, store, convert formats or display the equivalent of a medical chart. There are some caveats to this exception, however:
- Records must be created, stored, transferred or reviewed by healthcare professionals;
- Records must be part of health information technology certified under section 3001(c)(5) of the Public Health Service Act; and
- The software must not be intended to interpret or analyze patient data or images for the diagnosis, cure, mitigation, prevention, or treatment of a disease or condition.
- Software for transferring, storing, converting formats, or displaying data and results: unless it is intended to interpret or analyze the data, results or findings. This reinforces the FDA’s exemption of Medical Device Data Systems (MDDS) from regulation, as indicated in the guidance document “Medical Devices Data Systems, Medical Image Storage Devices, and Medical Image Communications Devices” issued on February 9, 2015.
- Decision Support Software: that is intended to acquire, process or analyze a medical image or a signal from a diagnostic device for the purpose of:
- displaying, analyzing, or printing medical information about a patient or other medical information (such as clinical practice guidelines);
- supporting or providing recommendations to a healthcare professional about prevention, diagnosis or treatment of a disease or condition; and
- enabling the healthcare professional to independently review the basis for such recommendations rather than relying on the software when making diagnostic and treatment decisions.
In the event that a medical device consists of multiple functions that include:
- At least one software function that meets the criteria outlined above (A-E), or that otherwise does not meet the definition of a device under section 201(h); and
- At least one function that does not meet the criteria above and that otherwise meets the definition of a medical device under section 201(h),
The FDA Doesn’t Give Up All Regulatory Control
The Cures Act clarifies that if the software function for categories C-E would be reasonably likely to have serious adverse health consequences, including:
- The likelihood and severity of patient harm if the software were not to perform as intended;
- The extent to which the software function is intended to support the clinical judgment of a healthcare professional; and
- Whether there is a reasonable opportunity for a healthcare professional to review the information or treatment recommended by the software;
then, it may fall under the FDA’s enforcement discretion. This allows the FDA to retain regulatory control over software based on its potential for and severity of harm.
Understanding what it all Means
Several of the categories described above have been on the medical device software scene for a while, with official guidance documents already in place. One question the Cures Act raises is its impact on decision support software, namely because this is the greatest change from what the industry has experience with (see category 5 above).
For clarity’s sake, the Cures Act introduces the notion that if a physician has access to information that was used by a software to generate a recommendation, and he is able to confirm the basis for that recommendation, then the software is considered to be supporting the physician in his decision making process. Therefore, the FDA may not regulate this software.
For example, if a diagnostic device, such as a Sphygmomanometer (standing blood pressure machine), uses software to capture blood pressure data, then the device (including its software) is regulated as a Class II device. The Cures Act has not changed this. Now, imagine that additional software is used to obtain patient results from the Sphygmomanometer over a period of time. The software analyzes the data and provides treatment recommendations to the physician. The physician reviews the raw data (e.g., blood pressure) captured by the software and performs his own analysis, as well; therefore, he is not exclusively relying on the software for treatment decision making prior to creating a treatment plan for the patient. Because the physician makes his own decision from the data, even though the software provides a recommendation, then this software is considered clinical decision support software.
Risk presented by the software may trump freedom from regulation, however. If the risk assessment identifies that serious adverse health consequences could occur based on the use of the software, then we can anticipate that it will be difficult to exclude this software from device regulation.
It is still too early to tell with certainty how and when the provisions of the Cures Act will be implemented, as well as how much FDA enforcement discretion will be applied. In the coming year, we anticipate that the FDA will make announcements, determinations and propose guidance based on their interpretations of the law.
What Does the Future Hold for Medical Device Software?
Moving forward, the Secretary of Health and Human Services, after consulting with agencies and offices of the Department of Health and Human Services involved in health information technology, will publish a report, including input from outside experts that examines information available regarding risks and benefits to health related to the software functions described above. The report will summarize findings regarding the impact of such software on patient safety, including best practices to promote safety, education and competency related to such functions. The first report must be published no later than December 2018, with subsequent reports every two years afterward.
This means that at least every two years, we must take note of whether changes relating to medical device software are made.