Digital Health Regulations: A Year In Review

This year has been a big year for digital health regulations, as increased ransomware attacks and advancements in software and mobile apps pressed the US Food and Drug Administration to update outdated regulations.

Medical device and diagnostics consulting firm Rational Quality Manager’s Allison Komiyama and Kevin Go hosted a webinar on 1 December summarizing the changes made to digital health regulations in 2022, as well as what medical device companies should look out for in 2023.

Digital Health Guidances In 2022

A majority of the FDA’s 2022 digital health guidance documents were released in the second half of year.

The guidance that made waves in the industry this year was the final Clinical Decision Support Software document, which deviated in many ways from its draft that was published in 2019, pre-pandemic.

Some companies had to re-evaluate whether their CDS products qualified as a device under the new guidance. The agency took a broader approach to regulating than what was in its jurisdiction, Foley and Lardner partner Kyle Faget told Medtech Insight in an interview. (Also see "Expert: New Guidance May Demand Clinical Decision Support Software Re-Evaluation" - Medtech Insight, 10 Oct, 2022.)

The FDA released a diagram on 28 September that accompanied the CDS guidance document to distill a lot of the device-qualification criterion, but it’s “a starting point before [sifting] through the guidance,” Go said.

The CDS guidance document, while high profile, was one of four guidance documents related to digital health regulation released on 28 September.

The Medical Device Data System final guidance was also released on that date, clarifying the FDA’s regulatory oversight over systems that don’t manipulate data or control devices, but store and present data. These devices do not require a demonstration of proof and safety. (Also see "FDA Official Lists Four Regulatory Considerations For Connected Combination Products" - Medtech Insight, 15 Nov, 2022.)

In April 2021, a rule from the FDA said that the agency won’t regulate these as devices; however, MDDS can be a component of medical devices. (Also see "US Regulatory Roundup, April 2021: Medical Software, FDA Remote Reg Assessments, Medtronic Recalls, And More" - Medtech Insight, 4 May, 2021.)

The FDA also finalized its Computer-Assisted Detection Devices Applied to Radiology Images and Radiology Device Data in Premarket Notification (510(k)) guidance to assist developers in premarket applications. The document also designated some medical image analyzers as class II, which is intended to help those specific manufacturers comply with special controls. (Also see "FDA Publishes Guidance On Radiology Images And Device Data For Submitting 510(k)s" - Medtech Insight, 4 Oct, 2022.)

This guidance also outlines what the FDA is expecting in terms of artificial intelligence and machine learning algorithms, Komiyama explained. Specifically, the FDA wants devices utilizing AI/ML to be locked, with no further changes made during or after clinical trials.

This guidance stresses the importance of biases and preventing dataset leakages from set to set.

And finally, also released on the big day of 28 September was a guidance update on policy for device software and mobile applications, which gave companies specifications to demine in software falls under FDA oversight.

The guidance defined the scope of the FDA’s regulations over types of device software and apps which include computing platforms, smart phones, tablets, mobile medical apps that connect or control medical devices, and some software.

As for drafts published in 2022, a cybersecurity draft guidance for medical devices was released 8 April in response to the growing number of ransomware attacks on hospitals. The document had been last updated was in 2018. (Also see "FDA’s Schwartz Says New Draft Cybersecurity Guidance Addresses Emerging Threats" - Medtech Insight, 12 Apr, 2022.)

The guidance urged companies to consider cybersecurity as a critical piece of the FDA’s quality system regulations. (Also see "FDA Issues Long-Awaited Guidance On Device Security For Premarket Submissions, Seeks Industry Feedback" - Medtech Insight, 8 Apr, 2022.)

Rapidly Advancing Software

The FDA wrapped up its five-year software pre-certification pilot program, which focused on approving the manufacturer instead of the product.

The agency conducted “excellence appraisals” of the program’s companies to approve them to make changes and updates to software after a device has been approved by the FDA. (Also see "Software Pre-Certification Program Highlights Needs For Legislative Change, FDA Says" - Medtech Insight, 27 Sep, 2022.)

However, this would require a legislative change, because current FDA regulations wouldn’t allow for the policies used in the pre-certification program to be implemented. (Also see "Regulating Software As A Medical Device Will Take Paradigm Shift, Former FDA Chief Counsel Says" - Medtech Insight, 14 Oct, 2022.)

Similar to the pre-certification’s excellence appraisals for medical software, AI and ML medical device software manufacturers are able to provide a pre-determined change control plan in their premarket submissions. These PCCPs are lists of predicted modifications and how a manufacturer would react and update their software accordingly. (Also see "Harmonization, Patient Trust Among Challenges In Regulating AI Devices" - Medtech Insight, 26 Oct, 2022.)

While this action plan was published in January 2021, AI and ML devices have been in headlines all year, making them topics of interest into 2023.

The crux of both of these programs relies on manufacturers trustworthiness and “excellence” to hopefully eliminate the need for PMAs for every subsequent update, saving time and possibly lives.

Digital Infrastructure

The FDA Customer Collaborations Portal was updated this year, easing the process of submitting and tracking premarket applications.

The CCP was only available through a pilot program until this year. (Also see "FDA Online Tracker Now Accepting Premarket Submissions" - Medtech Insight, 3 Aug, 2022.)

It also allows applicants to submit applications in both the eSTAR and eCopy formats. It also allows users to track the status of their applications, allowing more companies more transparency into FDA approval. (Also see "FDA Finalizes Electronic Submissions Guidance" - Medtech Insight, 21 Sep, 2022.)

“In the future, I know that they plan to [include] de novo applications as well as PMAS as a part of this, and possibly other pre-market submissions,” Komiyama said.

Finalized in a September guidance document, eSTAR is a program to simplify of the process of digitally submitting 510(k)s.   (Also see "FDA Finalizes Electronic Submissions Guidance" - Medtech Insight, 21 Sep, 2022.)

“Kevin and I geek out about this a lot because companies are like, ‘Oh, we're going to have to FedEx our applications,’” Komiyama said, but that isn’t the case with CCP.

The simplicity and usability is the real star of the platform. “It has this little drag and drop box, you drag it over, put the file there and upload it, and then you click the ‘Send’ button and it's gone to FDA,” she explained.

What’s Next?

Komiyama and Go recommend early adoption of the eSTAR platform, since it will be mandatory starting 1 October 2023.

“Even if you don't submit your file using eSTAR, it's a good practice to go through [the program] and even do sort of a checklist to see and make sure that you have everything,” Go said.

Under the 2022 guidances, they recommended double-checking device classifications so that “you're correctly identifying the level of regulatory oversight for your software functions,” Go said.

The digital health page from the FDA is a great resource to keep up to date on regulations and policy, they said.

Finally, Komiyama and Go urged companies to keep up to date on regulations.

“There's so many changes coming in 2023, and I'm sure there'll be ones that we didn't cover in this that FDA will just release anyway... that can really impact your regulatory strategy and submissions,” Go said.