FDA Software Precertification Program

by Jaclyn Greenberg

Forging Ahead into the New Digital Health Frontier: FDA Releases Working Model of Software Precertification Program

Words like “nimble” and “agile” are not often associated with regulatory pathways or the FDA. But when the ever-changing, iterative universe of digital health is the subject of oversight, the decades-old, hardware-based device framework quickly appears as a square hole vying for a round peg. Change is required, and adaptability is crucial. FDA Commissioner Scott Gottlieb acknowledged as much on April 26, 2018, when he announced the working model of its Software Precertification Program alongside other plans in development.

Many will recall that the program was initially announced last summer, as part of the FDA’s Digital Health Innovation Action Plan. Shortly afterwards, the FDA named nine digital health and technology leaders, of varying size and expertise, to participate in a pilot program to help the agency define a standard of “organization excellence” and other key performance indicators that will inform the precertification process. After the developers opened their doors to the agency, everyone met in January at a public workshop to discuss the working results of the pilot. At that time, the FDA articulated five “excellence principles”—product quality, patient safety, clinical responsibility, cybersecurity responsibility, and proactive culture—by which a developer will be evaluated.

The Working Model

The first draft of the model confirms that these five principles underpin the precertification process. More generally, as we already knew, the program will evaluate the software developer, rather than a particular product.

At present, the program is limited to FDA-regulated Software as a Medical Device (SaMD), which means “software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device.” The term SaMD was defined by the International Medical Device Regulators Form (IMDRF) and formally adopted by the FDA in recent guidance.

Once a developer earns precertification, its products will be entitled to a fast-track premarket process. Depending on the risk-status of the technology, premarket review may not be required at all, or if it is, it will be streamlined. Think of the program as the regulatory equivalent of TSA pre-check.

The draft contemplates that the program will comprise four parts:

  1. Appraisal based on those five “culture of quality and organization excellence” principles and precertification
  2. Review pathway determination
  3. Streamlined premarket review (if review is required at all)
  4. Real world performance

In his announcement, Commissioner Gottlieb emphasized that the working model is a “high-level draft of what will be several iterations” of the first-of-its kind program. The crucial next step, he emphasized, is further input from developers, patients, providers, and members of the public.

Initial Reaction

Crucial indeed. The devil is in the details and many, if not most, remain to be fleshed out. As observed at the January workshop, participants struggled with applying the agency’s excellence principles to their own business activities, and the agency acknowledged the need to better tailor the model. Questions about translating the principles into practice abound. Some have also raised a red flag about the increase in the FDA’s authority that will necessarily accompany precertification. Consider especially the fact that real world performance data (the fourth component) is contemplated as postmarket surveillance and feedback into the precertification process. Then there is the open question about the legal authority for the model. As much is acknowledged in the draft, which states “[o]nce we determine the elements for [the Program], we will then consider the appropriate mechanisms for establishing the program, including FDA’s current statutory and regulatory authorities.” Other weighty issues to be resolved include reconciling the developer-based model with the existing product-based regulatory framework, and ensuring that the international risk-based standards upon which the model is based can carry over to the American regime.

Building a Precedent for Future Regulation

Further, with such a fundamental shift in how regulated products go to market—evaluating the business, not the product (sort of)—other digital health and medical device companies (not to mention other regulated industries) will be watching closely for carryover potential. The program may be limited to SaMDs today, but a faster regulatory pathway will surely be on everyone else’s wish list tomorrow.

Software developers, digital health organizations, medical device companies, and their consultants have an opportunity right now to engage in the development of the working model, and to make sure that the many unresolved questions are answered in a way that meaningfully reflects their businesses, products, and objectives—and which assures safety and effectiveness to the standard we all expect of these life-changing products. The FDA is seeking comments on the working model until May 30, 2018, and it intends to launch the first version of the program by the end of this year.

Let’s take the FDA up on its invitation to take a seat at the table, and help create a regulatory regime that is equipped to deal with a reality where the only constant is change.


FDA Software Precertification Program

Executive Insight

Mitchell Parrish, JD, RAC, CIP, VP of Legal and Regulatory Affairs

There are no subtle tweaks to regulations that address what digital health has become and where it is going. The FDA has to think big to stay lockstep with digital health innovation and the proposed precertification program represents this thinking.

Tags: , , , , ,