FDA clarifies enforcement priorities for medical device clinical decision support software.
Developments in medical software can save lives. Software can identify patients addicted to opioids, customize sunscreen recommendations, and alert parents to bring their sick child to the emergency room—that is, if the software passes the regulatory hurdles needed to show it is safe and effective.
But if medical software were to be left completely unregulated, patients could be misdiagnosed or given improper treatment based on faulty software predictions. For example, health care providers may input patient data incorrectly, either by mistake or in an effort to increase the fees that they can charge, which if left undetected, can cause inaccurate recommendations and inadequate treatment.
To balance these patient safety concerns with the benefits of medical innovations, the U.S. Food and Drug Administration (FDA) recently released a draft guidance clarifying the types of medical software that it will treat as an enforcement priority. In the draft guidance, issued this past fall, the agency explained that it is adopting a “risk-based” framework to regulate clinical decision support (CDS) software. The framework is intended to help health care professionals make individualized clinical diagnoses and treatment decisions for their patients.
The 2019 draft guidance comes two years after FDA released an initial draft guidance to help the industry determine which software products would be regulated as medical devices. The industry criticized the 2017 draft for being too ambiguous and suggesting that all CDS software would be closely regulated.
In response to industry comments, the updated 2019 draft guidance emphasized that the agency plans to regulate CDS software based on the product’s safety risks, rather than target all CDS software that meet the criteria of a medical device under the Federal Food, Drug, and Cosmetic Act (FDCA).
In a press release for FDA’s recent guidance, Amy Abernethy, Principal Deputy Commissioner, said that the goal of the framework is to prioritize patient safety while also recognizing that overregulation could stifle advancements in medical software and clinical support. The updated draft guidance emphasized that the agency will evaluate each software’s patient safety risk, a change which distinguished the draft from FDA’s 2017 version.
The agency’s need for guidance first developed after the 21st Century Cures Act was passed, amending the FDCA to exclude certain types of software from the definition of a “medical device.” The industry needed guidance to clarify which software met the criteria of a medical device because the normal regulatory classification imposes additional requirements that developers must meet before they can sell their software.
The 2017 guidance had been intended to clarify where FDA “sees its role in digital health,” then-FDA Commissioner Scott Gottlieb said at the time. That earlier guidance was supposed to explain what types of CDS software qualify as medical devices and would be subject to regulation following the Cures Act. But the earlier guidance focused on helping developers determine if their software could be classified as a medical device. FDA did not emphasize its enforcement priorities or differentiate CDS software by each product’s patient safety risks.
In 2018, the Clinical Decision Support Coalition—a group comprising software firms, health care providers and payers, and clinical societies that provide feedback on CDS regulation—argued that the 2017 guidance would lead to overregulation. The group was concerned that software developers would pull their products from the market because they could not meet the regulatory requirements imposed on medical devices.
Other commentators have recognized FDA’s important need to protect patients but have suggested that the agency regulate according to the software’s safety risks rather than the software’s status as a medical device.
FDA acknowledged these concerns in its recently updated draft guidance. It explained that it will give a priority to CDS software that is used to treat patients with “serious” or “critical” conditions—where timely diagnosis and treatment is crucial to reversing the condition or preventing long-term disability or death. For example, software that uses type 2 diabetic patients’ data to alert them to potential triggers and recommend lifestyle changes would need to comply with device regulations under the FDCA or be subject to enforcement action because the technology is monitoring a “serious condition.”
The agency will also focus on software that provides practitioners with clinical recommendations but does not allow providers to review the basis for the recommended treatment or test. This includes technology, such as some types of artificial intelligence, where the provider does not know the inputs or formula that lead the software to make its recommendation. In cases where the inputs are unknown, providers cannot evaluate the merits of the software’s recommendation, creating a greater need for regulatory oversight.
Regulatory requirements for software that is used to treat and manage non-serious conditions, where there is no risk of irreversible harm to the patient or public, will not be an enforcement priority, according to FDA. For example, software that provides patients with information about their prescription drugs and reminds them when to take their medication would qualify as a medical device under the FDCA. But FDA is not planning to enforce compliance for developers of this type of technology because there is little risk of patient harm.
By clarifying enforcement priorities in its recent guidance, FDA says that it is aiming to promote innovation. “We want to encourage developers to create, adapt and expand the functionalities of their software,” Abernethy said in the press release accompanying the recent draft guidance.
Abernethy stated that overall the updated draft guidance attempts to “strike the right balance” between addressing patient safety concerns and promoting new CDS software. Whether it does so will depend on what actual impact the draft guidance has on the industry, and that remains to be seen.
