FDA Issues Proposed Guidance for Changes to Medical Device Software
The U.S. Food & Drug Administration (FDA) issued a proposed guidance on August 8, 2016, regarding software changes to medical devices. The proposed guidance relates to requirements for submitting medical device software changes to the FDA for approval. The final document will provide assistance to medical device companies and the FDA for determining when changes to software or firmware for a medical device require FDA clearance. The medical devices covered include 510(k)-cleared devices and preamendments devices subject to 510(k).
The FDA’s proposed guidance explains that premarket notifications are generally submitted for commercially-distributed medical devices undergoing significant changes in design. Such changes include modifications that “could significantly affect the safety or effectiveness of the device” or a “major change or modification in the intended use of the device.” The proposed guidance relates to software changes and is an update to the original guidance issued in 1997 regarding changes to existing devices.
The “software” subject to the proposed guidance is defined as “electronic instructions used to control the actions or output of a medical device, to provide input to or output from a medical device, or to provide the actions of a medical device.” This includes software embedded in a device, software that is an accessory to another device, and “software that is intended to be used for one or more medical purposes that performs these purposes without being part of a hardware medical device.”
The FDA provides a flow chart for assisting with the determination, see below. Issues addressed in the determination include changes related to: strengthening cyber security; meeting specifications of the most recently cleared device; introducing or affecting hazardous situations; creating new risk control measures; and affecting clinical functionality or intended use of the device. Additional factors to consider beyond those in the flow chart and some examples of modifications are provided in the draft guidance as well.
The proposed guidance notes that in some cases a new 510(k) is not necessary, and that existing Quality System (QS) requirements may suffice. Such QS requirements mandate, among other things, that the manufacturer maintains records, for production upon request, regarding such changes and the processes used to determine the changed device meet the design specifications. Further, the proposed guidance does not apply to software for which the FDA has previously said it will not enforce compliance, including some mobile apps used with medical devices.
Some observers think the proposed guidance will help with improving cybersecurity of connected medical devices. The public may provide comments to the FDA on the proposed guidance until November 7, 2016: comments may be submitted electronically here.
Expedited Access Program Begins For Medical Devices
On April 15th, the U.S. Food and Drug Administration (FDA) began its Expedited Access Program (EAP), which is designed to get certain medical devices to market sooner. Under the EAP program, device sponsors collaborate early with Center for Devices and Radiological Health (CDRH) staff to put together a Data Development Plan with the agency.
Jeffrey Shuren, director of the CDRH, states that the EAP is a way “to speed qualifying devices to patients with life-threatening or irreversibly debilitating conditions without compromising FDA’s high standards for safety and effectiveness.” Shuren goes on to say that “Under the EAP, FDA may accept a greater degree of uncertainty if it is sufficiently balanced by other factors, including the probable benefits to having earlier access to the device.”
To participate in EAP, a device sponsor must submit to the FDA a request for EAP designation. Factors the FDA considers when making benefit-risk determinations for devices subject to premarket approval applications (PMA) are discussed here.
To receive EAP designation, a device must meet three criteria:
(1) the device is intended to treat or diagnose a life-threatening or irreversibly debilitating disease or condition;
(2) the device meets at least one of the following criteria: (i) no appropriate alternative treatment or means of diagnosis exists, (ii) the device represents a breakthrough technology that provides a clinically meaningful advantage over existing legally marketed technology, (iii) the device offers significant, clinically meaningful advantages over existing legally marketed alternatives, or (iv) the availability of the device is in the best interest of patients; and
(3) the sponsor submits an acceptable draft Data Development Plan.
FDA Proposal Will Require Additional Testing Requirements for AEDs
The FDA issued a proposed order on March 22nd that, if finalized, could potentially toughen the approval process for manufacturers of automated external defibrillators (AEDs). Under the proposed order, manufacturers will now be required to submit a pre-market approval application (PMA) or notice of completion of a product development protocol (PDP). AEDs are used to prevent cardiac arrest in patients by delivering an electrical shock to re-establish normal cardiac rhythms. According to an article by The New York Times reporting on the proposed order:
There have been 45,000 reports of the devices failing or malfunctioning since 2005. . . . The vast majority of them were due to manufacturing problems, . . . but some were because of improper maintenance, like battery failure. Manufacturers have recalled the devices 88 times in that period.
The article notes that while the new regulations would typically require manufacturers to conduct expensive and time-consuming clinical trials, many of the nine U.S. manufacturers of AEDs have already collected the necessary data, according to Dr. William Maisel, the chief scientist at the FDA’s Center for Devices and Radiological Health. For these manufacturers, Dr. Maisel stated that the cost of complying with the new regulations would rise from about $5,000 to about $220,000.
Share
