On September 26, 2019, the FDA issued two revised guidance documents addressing its evolving approach to the regulation of digital health technologies. These guidances primarily describe when digital health solutions will or will not be actively regulated by FDA as a medical device. In parallel, FDA also updated four previously final guidance documents to ensure alignment with the new approaches being adopted by the Agency.
As background, FDA issued draft guidance documents in December 2017 that sought to implement section 520(o)(1) of the Federal Food, Drug, and Cosmetic Act (“FDCA”), which was enacted by Congress in the 21st Century Cures Act of 2016 (the “Cures Act”). Those guidance documents raised a number of issues that we discussed on this previous alert.
After receiving comments from stakeholders, the Agency responded by issuing: (i) a revised draft guidance document for clinical decision support (CDS) software (“Clinical and Patient Decision Support Software” or the “CDS Draft Guidance”) and (ii) a final guidance document for other software functions exempted by the Cures Act (“Changes to Existing Medical Software Policies Resulting from Section 3060 of the 21st Century Cures Act” or the “Software Policies Guidance”).
Here are key takeaways on FDA’s newly-issued guidance:
- The Agency now classifies decision support software intended for use by both healthcare professionals (HCP) and patients as “clinical decision support” or “CDS” software. Previously the Agency used the term CDS software only for software intended for healthcare professionals, whereas “patient decision support” or “PDS” software was intended for patients or caregivers. FDA now considers all decision support software to be CDS and distinguishes between: (1) “Non-Device CDS,” which must meet the Cures Act criteria, including an intended use by HCPs and (2) “Device CDS,” which includes all CDS intended for use by patients, as well as HCP-facing CDS that do not meet the Cures Act criteria. But the Agency will exercise enforcement discretion for (in other words, not regulate) certain Device CDS intended for use by both HCPs and patients to inform management of non-serious healthcare situations or conditions.
- FDA incorporates the International Medical Device Regulators Forum (“IMDRF”) Software as a Medical Device Risk Categorization Framework into the Agency’s approach regulating CDS software. FDA utilizes the IMDRF framework for two purposes:
- First, FDA utilizes the framework to define when software functions do not meet the Cures Act criteria for Non-Device CDS because they go beyond “supporting or providing recommendations,” stating that software functions that drive clinical management or treat or diagnose are not CDS. This application raises some potential issues given that the IMDRF language does not align fully with the statutory language in the Cures Act.
- Second, FDA utilizes the framework to define those lower-risk Device CDS that are subject to enforcement discretion, as contrasted to those Device CDS – specifically Device CDS intended to address serious and critical situations or conditions – that remain subject to regulation as a device.
- The new guidance documents address dynamic digital health solutions, such as those that incorporate artificial intelligence and machine learning, and bioinformatics software. FDA’s initial draft guidance documents did not discuss these technologies.
- In the final Software Policies Guidance, FDA notes that the regulation of software functions that provide for alarms, alerts and flags should be considered under the CDS Draft Guidance and may not always be subject to enforcement discretion. The CDS Draft Guidance proposes to continue enforcement discretion for certain low-risk notifications, but an “alarm” or an “alert” that a healthcare provider or caregiver relies on to make a treatment decision remains subject to FDA regulatory oversight.
- FDA clarifies that hardware is not exempt from the definition of a medical device under the Cures Act, i.e., hardware that is intended for Cures Act functions, such as general wellness or to transfer, store, and display device data, are not excluded from the definition of a device. However, many of these products are subject to enforcement discretion under FDA’s other guidances.
- It remains unclear how the new guidance documents relate to or align with FDA’s other digital health initiatives, including the Agency’s proposed frameworks on prescription drug-use-related software (PDURS) and real-world evidence, the discussion paper for artificial intelligence/machine learning (AI/ML)-based software, or the Software Precertification (Pre-Cert) Pilot Program. The CDS Draft Guidance explicitly says that the document does not address Device CDS that is part of a combination product or the labeling requirements for CDS disseminated by or on behalf of a drug or biologic sponsor.
In conjunction with the two revised Cures Act guidances, FDA also updated the following guidances:
- Policy for Device Software Functions and Mobile Medical Applications
- General Wellness: Policy for Low Risk Devices
- Medical Device Data Systems, Medical Image Storage Devices, and Medical Image Communications Devices; and
- Off-The-Shelf Software Use in Medical Devices.
By issuing another draft guidance on CDS software, rather than finalizing the previous draft guidance, FDA signals its desire to receive additional stakeholder input before setting policies around CDS software. This also means that it could be many months, or even years, before we see final FDA guidance around CDS software.
Companies who are marketing, developing, partnering, or investing in digital health solutions will want to review the new guidance documents and consider how any changes to FDA’s approach will affect their product portfolios. Companies should consider submitting comments on the CDS Draft Guidance, as well as the Software Policies Guidance given some of the issues noted above. For the CDS Draft Guidance, the FDA docket is open for comments until December 26, 2019.