David Babaian, JD, LLM

by David Babaian

What’s in a Name? New FDA Guidance on Digital Health and Software

That which we call a device / By any other word would cure as effectively? Shakespeare notwithstanding, do you know anymore what software constitutes a regulated medical device?

Amending section 520 of the Food, Drug, and Cosmetic Act (21 U.S.C. 360j) by adding paragraph (o), the 21st Century Cures Act excluded five specific software functions from the definition of a medical device, necessitating changes to existing guidance documents. The Food and Drug Administration (FDA) recently released three guidance documents—two draft and one final—on digital health and software, specifically impacting clinical decision support (CDS) software, general wellness devices, mobile medical applications (MMAs), medical device data systems (MDDSs), and software as a medical device (SaMD). This blog addresses the implications related to four of the five software functions, as detailed in the draft guidance “Changes to Existing Medical Software Policies Resulting from Section 3060 of the 21st Century Cures Act.”


Software Designed for Administrative Support

First, paragraph (o) provides explicit recognition that software intended for administrative support of a health care facility is excluded from the definition of a device. This had no major impact on the FDA’s position on the regulation of such functions. The only change you may notice is that the FDA’s guidance on off-the-shelf devices will now omit description of Laboratory Information Management Systems (LIMS)—previously 510(k)-exempt, Class I devices.


Software Encouraging a Healthy Lifestyle

Second, paragraph (o) excludes software intended for maintaining and encouraging a healthy lifestyle.  This also will not result in a substantial deviation for the agency’s practice. The FDA had indicated its intent to exercise enforcement discretion over such devices, but has now removed such functions from the guidance on general wellness devices. Accordingly, the pertinent guidance document will be revised to only cover software with an intended use that relates to the role of healthy lifestyle with helping to reduce the risk or impact of certain chronic diseases or conditions and where it is well understood and accepted that healthy lifestyle choices may play an important role in health outcomes for the disease or condition. The FDA concluded that such function relates to the mitigation or prevention of disease and, therefore, remains a device. Still, the FDA reiterated its intent to continue to exercise enforcement discretion when such functions present low risk to the safety of users or others.1 Ultimately, software marketed with a healthy lifestyle claim is no longer an FDA-regulated device, as long as the claim is unrelated to the diagnosis, cure, mitigation, prevention, or treatment of a disease or condition (e.g., a mobile app that is intended to manage stress, maintain good cardiac health, or alert user/healthcare provider of unhealthy diet is no longer a device).

Related, some mobile medical applications over which the FDA formerly exercised enforcement discretion will now be re-designated as examples not meeting the definition of a medical device—namely those intended to track, evaluate, or make behavioral suggestions related to developing or maintaining general fitness, health, or wellness.


Software Serving as Electronic Patient Records

Third, paragraph (o) removes software intended to serve as electronic patient records, i.e., those for transferring, storing, converting, or displaying electronic patient records—essentially equivalent functions of a paper medical chart—from FDA oversight. There are three criteria that must be met in order for software to qualify as software intended to serve as electronic patient records:

  • Such records were created, stored, transferred, or reviewed by health care professionals (HCPs) or by individuals working under their supervision;
  • Such records are part of IT certified by the Office of the National Coordinator for Health Information Technology (ONC) Health IT Certification Program; and
  • Such software functions are not intended for interpretation or analysis of patient records, including medical image data, for the purpose of the diagnosis, cure, mitigation, preventions, or treatment of a disease or condition.

Of note, the FDA explained that Personal Health Records (PHRs) maintained by patients or non-HCPs are also not devices,2 and the FDA signaled its intent to exercise enforcement discretion if only criterion 2 is not met. As is the general trend for systems integration, the FDA cautioned that standard Electronic Health Records (EHRs) may contain software that could constitute one or more medical devices and portended future guidance on expectations for the regulated components embedded within multifunctional software.

Consequently, the MMA guidance will be revised to exclude from the examples of devices apps that merely enable access to ONC-certified EHRs or that help patients communicate potential medical conditions to HCPs, over which the FDA had previously exercised enforcement discretion.

Focusing a light on the nature of the changes, the FDA specifically revised language describing a function that is no longer categorized as a device by replacing “assessing” with “documenting.” Thus, in order not to be considered a device, the software must be a simple conduit through which health information is recorded and transferred, without independent analysis or interpretation.


Software That Transfers, Stores, Converts Formats of, or Displays Data and Results Without Analysis or Interpretation

Similarly, the fourth exclusion under paragraph (o) precludes the FDA from regulating as a device software that transfers, stores, formats, or displays data and results. Importantly, software that, in addition to the above functions, also analyzes or interprets data remains a device under FDA authority. As such, the FDA explained that functions intended to generate alarms or alerts, prioritize multi-patient displays, or provide notifications or flags contain an analytical or interpretive step that bring such software under the FDA’s purview. Still, the FDA signaled the intention not to enforce regulatory requirements for low risk software functions that do not result in immediate clinical action by a caregiver.

The guidance document governing MDDSs will be revised with an updated definition of such data systems: “software, electronic, or electrical hardware that is intended to provide one or more of the above functions, whether or not the use is for immediate clinical action, without controlling or alerting the functions or parameters of any collected medical devices.” Moreover, examples will be relabeled, substituting the prohibitive benchmark of “active patient monitoring”3 in favor of analysis and interpretation of data.

Additionally, as for MMAs specifically, apps that also meet the definition of MDDSs are no longer devices. Yet display of medical images directly from a Picture Archiving and Communication System (PACS) and remote display from bedside monitors will now fall within the FDA’s enforcement discretion, so long as no alerts are relied upon to take immediate clinical action.

The following example will be added to the MMA guidance, as a function over which the FDA will also exercise enforcement discretion:

“Software tools that analyze stored clinical information to flag patient results based on specific clinical parameters (e.g., out of range results, potential drug interactions, opportunities for complementary tests, create disease registries, summarize patient specific information in an integrated report, and/or track a patient’s treatment or disease outcome) provided that the analysis performed by these software is not intended for immediate clinical action and does not represent a unique interpretation function but rather summarizes standard interpretation of individual variables that healthcare practitioners could do themselves.”

This adds another qualifying standard, namely “a unique interpretation,” for which commenters have requested additional clarity.

Finally, the “Guidance for the Submission of Premarket Notifications for Medical Image Management Devices” will be withdrawn as inconsistent with the new scope of what constitutes a medical device.

In conclusion, the resulting changes to FDA’s regulatory framework by in large impact minimally regulated products or those over which the FDA had already elected to exercise enforcement discretion. Still, the additional clarity and freedom to operate are welcome consequences and should foster continued growth in the burgeoning market for such healthcare technologies.


Executive Insight

Mitchell Parrish, JD, RAC, CIP, VP of Legal and Regulatory Affairs

Considering the breadth of the FDA’s new draft and final guidance, there is plenty for multiple audiences to consider. One audience includes developers of software or applications intended to promote a healthy lifestyle. The new applicable guidance signals the FDA’s view that these products are the electronic equivalent of dietary supplements. Just as dietary supplements can avoid being classified as a drug thereby reducing regulatory burden, software or applications can do the same. This is so long as their marketing claims are unrelated to the diagnosis, cure, mitigation, prevention, or treatment of a disease or condition.



1 This was, however, a missed opportunity to explicitly indicate that the FDA would not assess compliance with parts 812, 50, and 56 for clinical investigations involving such devices.

2 Multiple commenters have requested greater clarity and consistency around this issue, in one instance urging the FDA to make explicit that non-device PHRs could include the function of sharing data with an HCP, so long as that data does not form the primary basis for treatment decisions.

3 The term “active” incorporates “any device that is intended to be relied upon in deciding to take immediate clinical action.”

Tags: , , , , , ,