By Ropes & Gray LLP's Life Sciences / FDA Regulatory Practices
Additional Guidance Documents Planned on Clinical Decision Support Software, Application of Quality Systems to Software, and Wireless Safety
On July 21, 2011, the Food and Drug Administration ("FDA") issued a draft guidance document describing how it intends to apply its regulatory authority to certain software applications intended for use on mobile platforms, which the agency terms "mobile medical applications" or "mobile medical apps." FDA believes that mobile medical apps pose the same or similar safety risks as currently regulated devices performing the same functions. Accordingly, a mobile medical app manufacturer, which includes a person that initiates specifications for an app, will be subject to the medical device regulation. Under the draft guidance, parties to a software development agreement can define their respective regulatory obligations by contract.
Mobile Medical Apps
The draft guidance defines a "mobile app" as a software application that runs on a mobile platform, such as an iPhone®, BlackBerry®, smart phone, or tablet computer. A mobile medical app is a mobile app that meets the definition of "device" in the Federal Food, Drug, and Cosmetic Act and is either an accessory to a regulated medical device or transforms a mobile platform into a regulated medical device.
Mobile medical apps do not include apps that:
- Are electronic medical textbooks, teaching aids, or reference materials;
- Are used as decision tools or make suggestions related to developing or maintaining general health and wellness (e.g., dietary tracking logs, exercise suggestions);
- Automate general office operations such as billing or appointments;
- Act as generic aids to assist users but are not commercially marketed for a specific medical indication (e.g., an app that uses the mobile platform as a magnifying glass but not specifically for medical purposes);
- Function as electronic health record ("EHR") or personal health record ("PHR") systems.
The draft guidance groups mobile medical apps into four main categories:
- Mobile apps that display, store, or transmit patient-specific medical device data are considered medical device data systems ("MDDS") subject to class I device requirements.
- Mobile apps that control a connected medical device are subject to the device requirements applicable to the connected device. A physical connection between the mobile platform and the device is not required.
- Mobile apps that transform the mobile platform into a medical device are subject to the device requirements applicable to the added medical device functionality. For example, an app using sensors on a mobile platform to act as an electronic stethoscope renders the app's manufacturer subject to the regulatory requirements for electronic stethoscopes.
- Mobile apps that create alarms, recommendations, or new information by analyzing or interpreting medical device data (whether electronically collected or manually entered) are subject to the device requirements of the connected device providing the data.
FDA specifies that mobile medical apps also include apps that provide for input of patient-specific information and then use formulae or processing algorithms to output a patient-specific result, diagnosis, or treatment recommendation to be used in clinical practice. The draft guidance does not specify how such apps will be classified; some manufacturers could face significant challenges in identifying a path to market and obtaining marketing approval or clearance for these types of apps.
Mobile Medical App "Manufacturer"
The draft guidance explains that a medical device "manufacturer" is any person or entity that manufactures mobile medical apps in accordance with existing FDA regulations on Medical Device Reporting (adverse event reporting), device establishment registration and listing, and correction and removal reporting (recall reporting). Under these regulations, "manufacturer" includes any person or entity that creates, designs, labels, re-labels, modifies, or creates a software system from multiple components. This could include a person or entity that creates a mobile medical app from commercial off the shelf software. It also includes persons or entities that create the original idea for a mobile medical app by initiating product specifications, unless another entity assumes all responsibility for manufacturing and distributing the mobile medical app, in which case the other entity would be the "manufacturer." This appears to be the first time that FDA has said publicly that parties to a software development agreement can define their respective regulatory obligations by contract.
Implications For FDA Regulation of Software Applications Generally
The draft guidance represents FDA's continuing effort to grapple with the complex challenges surrounding regulation of rapidly evolving software technology. In 1989, FDA drafted an overarching policy for the agency's regulation of software that took a largely hands-off approach, but the impracticality of regulating all medical software under a single, comprehensive policy ultimately led FDA to withdraw it in 2005. FDA is now actively working to address whether and how medical and health software should be regulated. FDA's draft guidance signals that the agency is listening to industry's calls for greater regulatory clarity in this area.
The draft guidance comes five months after FDA issued a final rule on February 15, 2011 classifying MDDS as class I devices. The draft guidance clarifies how mobile medical apps relate to MDDS by explaining that mobile medical apps that display, store, or transmit patient-specific medical device data in its original format are MDDS.
Despite the issuance of the MDDS rule and the draft guidance on mobile medical apps, FDA has not addressed how it intends to regulate EHR or PHR software. As Ropes & Gray reported in April 2009, FDA created an internal working group specifically to address the regulation of EHR systems. However, both the MDDS rule and the draft guidance on mobile medical apps exclude EHR and PHR software from their respective scopes. At least for now, FDA continues to exercise its enforcement discretion regarding such products.
The draft guidance states that it does not address classification and submission requirements related to clinical decision support software, the application of quality systems to software, and wireless safety considerations. FDA states that it intends to address these topics through separate guidance.
FDA will be accepting comments on the draft guidance until October 19, 2011.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
