United States: Digital Health: Significant FDA Policy Developments In 2022

In 2022, FDA retreated from a flexible approach to its regulation of digital health in two key areas: (1) its PreCertification Program for software as a medical device (SaMD) and (2) its guidance on Clinical Decision Support (CDS). In both cases, FDA's proposed flexible approach was tampered down — in the first case by a lack of authority to implement a more flexible model for premarket clearance of software changes and, in the second, by a desire to provide clarity to industry on how FDA plans to enforce requirements for CDS software.

On September 26, 2022, the U.S. Food and Drug Administration (FDA) released its final report discussing the Agency's findings from the Software Precertification (Pre-Cert) Program. The release of this report marks the completion of the Pre-Cert Program and FDA's backing away from its vision of a streamlined software product review.

Pre-Cert Program – FDA's Vision

The Pre-Cert Program was launched as a pilot program at the end of 2017 with the intention of developing a streamlined premarket review process for software as a medical device (SaMD). Under the Pre-Cert Program, FDA would determine whether a company meets certain quality standards for software design, validation and maintenance and if so, "pre-certify" the company. Precertified companies would then be able to introduce software changes and iterations under tailored regulatory controls (and without necessarily submitting a new 510(k) notification). In some cases for low-risk devices, precertified companies would not be required to submit a premarket submission at all. FDA would rely on postmarket data for assurance that the software device remains safe and effective during its product lifecycle and to support new uses of the device.

The program's intent was to leverage a company's demonstrated culture of quality and product postmarket performance to replace the traditional 510(k) submission for certain product changes. The program's four essential components reflect the total lifecycle of the product: (1) Excellence Appraisal; (2) Review Determination; (3) Streamlined Review; and (4) RealWorld Performance.

Throughout 2018, FDA solicited feedback from stakeholders, which continued into 2019. In early 2019, the Agency released the Working Model version 1.0⁸⁷, Test Plan⁸⁸, and Regulatory Framework⁸⁹, followed by a mid-year update⁹⁰ that disclosed learnings on the Excellence Approval component. In late 2020, the Agency released an update on the status of the Pre-Cert Program with key learnings and next steps pertaining to Excellence Appraisal, Streamlined Review, and collection of Real-World Performance data.⁹¹

Key Findings – An Unworkable Program

Ultimately, FDA found that the Agency could not implement the Pre-Cert Program under its current statutory authority. From its inception, the pilot Program materials noted that the current regulatory framework was not flexible enough to meet the pace of technological advancements in the medical device software industry.92 Although FDA was not specific about how it lacks authority to implement the program, the program garnered criticism for its departure from statutory requirements for the premarket approval process, device classification, and post-market surveillance.

First, the streamlined approval process set forth in the Pre-Cert Program may not meet specific requirements for premarket notification and submissions under the Federal Food, Drug and Cosmetic Act (FDCA) and its implementing regulations. Second, FDA's oversight of devices has traditionally been front-loaded to premarket review with comparatively limited post-market surveillance. The PreCert Program attempts to shift this paradigm to rely more heavily on real-world performance data in a post-market setting — at least for low-risk devices.

In executing the pilot, FDA also encountered numerous challenges, such as limitations on the types of devices available for consideration and an inability to require participants to submit information that was not already required under existing statute.⁹³ FDA found that the de novo submission-based approach outlined in the Test Plan was not optimal because it is limited to devices with no substantially equivalent predicate device. In addition to the limitation on devices available for consideration, FDA also was challenged by an inability to require participants to submit information that was not already required under existing statute.⁹⁴ Although pilot participants voluntarily submitted data and engaged with the program, FDA found that the results were difficult to harmonize into consistent, repeatable methodologies.⁹⁵

Nonetheless, the Program did provide FDA with insights into how companies design, develop, and manage SaMD digital health products.⁹⁶ These insights helped FDA validate methods that could work for regulatory oversight and where further development is needed.⁹⁷ For example, one gap for further development included the creation of a clearer description of what elements should be evaluated during Excellence Appraisals.⁹⁸ FDA was able to evaluate and devise a list of nine Key Performance Indicators (KPIs) that could be used in the future to assess organizational excellence.⁹⁹

What's Next for SaMD

Based on the Agency's findings, FDA still thinks that the best method for regulating SaMD is an organization-based approach.¹⁰⁰ FDA needs a more agile regulatory framework that would allow for flexibility to regulate SaMD under a framework that is geared toward continual improvement, and not static product design phases (i.e., the more traditional device development model). To do that, FDA needs congressional help.

Until then, FDA will continue to develop guidance documents and other policies under its current regulatory framework to improve efficiency of its regulatory oversight over SaMD.¹⁰¹ This flexible approach could signal an intent to not actively enforce 510(k) submission requirements for low-risk software and changes to such software, or maybe a potential down-classification, or 510(k) exemption, for certain categories of lowrisk software. Either way, companies with solid software quality excellence records, and robust post-market data on the safety and quality of iterative changes to the software, may see room for continued development of novel software without intense scrutiny from FDA.

II. FDA LIMITS ENFORCEMENT DISCRETION FOR CLINICAL DECISION SUPPORT SOFTWARE

On September 22, 2022, FDA issued its Final Guidance on Clinical Decisions Support Software. ¹⁰² The Final Guidance narrows FDA's interpretation of the exemption criteria for clinical decision support ("CDS") software resulting in the inclusion of software functions as "devices", which were previously exempted. In addition, FDA has also excluded from exemption software functions intended to support time-critical decision-making, and is now silent on its riskbased enforcement discretion policies for CDS functions that may meet the definition of "device".

CDS – Brief Overview

Clinical decision support (CDS) software is software that is intended to provide health care providers and patients with knowledge and person-specific information, intelligently filtered or presented at appropriate times, to enhance health and health care. Section 3060(a) of the 21st Century Cures Act (the Cures Act), which was signed into law in December 2016, amended the definition of "device" in the Federal Food, Drug, and Cosmetic Act (FDCA), to exclude certain software functions, including low-risk CDS. ¹⁰³, ¹⁰⁴

Specifically, the FDCA now excludes from the definition of device CDS that meets all of the following four criteria:

1. not intended to acquire, process, or analyze a medical image or a signal from an in vitro diagnostic device or a pattern or signal from a signal acquisition system;
2. intended for displaying, analyzing, or printing medical information (such as peer-reviewed clinical studies and clinical practice guidelines);
3. intended for supporting or providing recommendations to a health care professional (HCP) about prevention, diagnosis, or treatment of a disease or condition; and
4. intended for enabling such HCP to independently review the basis for such recommendations (so that it is not the intent that such HCP rely primarily on any of such recommendations to make a clinical diagnosis or treatment decision regarding an individual patient).

CDS Final Guidance – Limited Enforcement Discretion

While FDA final guidance documents typically do not depart in significant ways from draft guidance documents, FDA's final CDS guidance represents a step back from its prior enforcement discretion policy.¹⁰⁵ Interestingly, the Final Guidance: (1) eliminated an entire section of the draft guidance that contained numerous examples of CDS for which FDA would exercise enforcement discretion, and (2) removed the discussion of the International Medical Device Regulators Forum (IMDRF) framework for regulating software as a medical device (SaMD).

FDA previously released two draft versions of the CDS guidance, the first in 2017¹⁰⁶ and the second in 2019. ¹⁰⁷ In the 2019 draft guidance, FDA provided many examples of software that met the definition of CDS, but for which FDA intends to exercise enforcement discretion. The examples in the 2019 draft guidance addressed commenters' requests for enforcement discretion over "low impact" CDS that were intended for patients (and hence, did not meet the fourth criterion). FDA also incorporated risk-based principles set forth in the IMDRF framework, which sought to promote international consensus on the regulation of SaMD.¹⁰⁸

The Final Guidance eliminated entirely the examples of enforcement discretion and the discussion of the IMDRF framework. FDA did so in an attempt to provide clarity on what it considers to be regulated CDS. While the elimination of the IMDRF framework generally does resolve ambiguity, the elimination of the enforcement discretion examples prompts questions over whether FDA intends to exercise discretion over low-risk CDS intended for patients. The Final Guidance also introduces new considerations for the third criterion that effectively narrow categories of CDS that could be exempt. In particular, FDA introduced a new element of whether the CDS is intended to support a time-critical decision (e.g., an emergent care scenario).

What's Next for CDS

We think the Agency will continue to strike a balance between permitting innovations in CDS, among other digital health products, to flourish and asserting its enforcement authority. The Agency has made strides in the past few years to learn from industry, and it will continue to look for opportunities to partner with industry to shape policy moving forward. Although the Final Guidance may limit FDA's view of exempt CDS, we think that FDA will likely continue its hands-off approach to low-risk CDS, even if the CDS is patient-focused. FDA will continue to actively regulate medium-risk and high-risk CDS, especially those that interprets medical images (e.g., CT scans) and those that lack transparency in their underlying algorithms.

Footnotes

87. Developing the Software Precertification Program: A Working Model v1.0 (Jan. 2019), Food and Drug Administration. Available at: https://www.fda.gov/ media/119722/download ("Working Model v1.0").

88. Software Precertification Program: 2019 Test Plan (Jan. 2019), Food and Drug Administration. Available at: https://www.fda.gov/media/119723/download.

89. Software Precertification Program: Regulatory Framework for Conducting the Pilot Program within Current Authorities (January 2019), Food and Drug Administration. Available at: https://www.fda.gov/media/119724/download ("Regulatory Framework").

90. Software Precertification Program 2019 Mid-Year Update (July 2019), Food and Drug Administration. Available at: https://www.fda.gov/media/129047/ download.

91. Developing the Software Precertification Program: Summary of Learnings and Ongoing Activities (Sept. 2020), Food and Drug Administration. Available at: https://www.fda.gov/media/142107/download.

92. See Scott Gottlieb, M.D., FDA Announces New Steps to Empower Consumers and Advance Digital Healthcare, U.S. Food & Drug Administration (July 27, 2017), available at FDA Announces New Steps to Empower Consumers and Advance Digital Healthcare | FDA.

93. Id. at 3.

94. Id. at 3.

95. Id. at 3-4.

96. Id. at 4.

97. See id. at 8-12.

98. Id. at 10.

99. Id. at 11.

100. Pre-Cert Report at 4-5.

101. Id. at 4..

102. FDASIA Health IT Report | Proposed Strategy and Recommendations for a Risk-Based Framework (2014) U.S. Food and Drug Administration. Available at: https:// www.fda.gov/media/87886/download (accessed: December 2, 2022).

103. 21st Century Cures Act (2016) Congress.gov. Available at: https://www.congress.gov/114/plaws/publ255/PLAW- 114publ255.pdf (Accessed: November 28, 2022). (the "Cures Act").

104. CDS is not always excluded from the device definition under the Cures Act. Only when a CDS function also meets the fourth criterion of section 520(o) (1)(E), is the CDS function excluded from the definition of a device.

105. Clinical Decision Support Software Guidance for Industry and Food and Drug Administration Staff (2022) Food and Drug Administration. Available at: https:// www.fda.gov/media/109618/download (Accessed: November 28, 2022). (the "final guidance").

106. Clinical and Patient Decision Support Software Draft Guidance (2017) Regulations.gov. Food and Drug Administration. Available at: https://www.regulations. gov/document/FDA-2017-D-6569-0002/comment (Accessed: November 28, 2022). (the "2017 draft guidance").

107. Clinical Decision Support Software: Draft Guidance for Industry and Food and Drug Administration Staff (2019) Regulations.gov. Food and Drug Administration. Available at: https://www.regulations.gov/document/FDA-2017- D-6569-0041 (Accessed: November 28, 2022). (the "2019 draft guidance").

108. "Software as a Medical Device": Possible Framework for Risk Categorization and Corresponding Considerations (2014) International Medical Device Regulators Forum. Available at: https://www.imdrf.org/sites/default/files/docs/imdrf/final/technical/imdrf-tech-140918-samd-framework-risk-categorization-141013.pdf (Accessed: November 28, 2022).

To view the full article, click here.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.