[co-author: Jessica Wheeler]*
On September 27, 2019, FDA issued a new draft guidance on Clinical Decision Support Software, supplanting its 2017 draft guidance, Clinical and Patient Decision Support Software. For background, CDS is software that "provides health care professionals (HCPs) and patients with knowledge and person-specific information, intelligently filtered or presented at appropriate times, to enhance health and health care."
Like the 2017 version, the 2019 guidance categorizes clinical decision software (CDS) functions into (i) non-device CDS, (ii) low-risk device CDS, for which FDA will exercise enforcement discretion and (iii) device CDS that will be the focus of FDA regulation. However, the 2019 guidance then goes on to introduce, with illustrative examples, FDA's use of the International Medical Device Regulators Forum (IMDRF) two-factor, risk-based framework to apply a risk-based approach in its regulatory oversight of CDS. The guidance also includes a robust discussion of software functions that are not CDS, but which also will be the focus of FDA oversight based on the IMDRF Framework (non-CDS devices). Both the 2017 guidance and the 2019 guidance start with the criteria (Criteria) in Section 520(o)(1)(E) of the FD&C Act, which excludes from the definition of device, certain software functions. Specifically, FDA considers a software function CDS if it meets Criteria 1 and 2, below, and is intended to support or provide recommendations about prevention, diagnosis or treatment (part of Criterion 3), but if the CDS also meets Criterion 4 it is not a device (non-device CDS) and, consequently, is not regulated by FDA:
- Not intended to acquire, process or analyze a medical image or a signal from an in vitro diagnostic device or a pattern or signal from a signal acquisition system
- Intended for the purpose of displaying, analyzing or printing medical information about a patient or other medical information (such as peer-reviewed clinical studies and clinical practice guidelines)
- Intended for the purpose of supporting or providing recommendations to a health care professional about prevention, diagnosis or treatment of a disease or condition
- Intended for the purpose of enabling such health care professionals to independently review the basis for such recommendations that such software presents so that it is not the intent that such health care professionals rely primarily on any of such recommendations to make a clinical diagnosis or treatment decision regarding an individual patient
The 2019 guidance then goes on to describe how, for software functions that do not meet all four criteria, i.e., those that are either device CDS or non-CDS devices (for example, functions intended to acquire or analyze images or intended to provide more than just recommendations, or those functions that do not enable review of the basis for the recommendations), FDA will employ the IMDRF Framework to determine the extent of its regulatory oversight. The IMDRF Framework, which applies to software as a medical device (SaMD) generally, assesses two major factors of increasing risk to determine the overall level of risk of an SaMD function: (i) the significance of the information provided by the SaMD (to inform clinical management, drive clinical management or treat/diagnose), and (ii) the state of the patient’s health or condition (non-serious, serious or critical) as follows:
Regulation of CDS
Applying the first IMDRF factor, CDS functions are those that are intended to inform clinical management only (F1), i.e., they provide recommendations or information not necessary to patient care decisions. As noted above, FDA has no authority to regulate non-device CDS that meet all four criteria of Section 520(o)(1)(E). How FDA regulates device CDS will depend upon the second factor—the patient’s status. FDA intends to exercise enforcement discretion for F1/C1 device CDS. On the other hand, FDA intends to focus its regulatory oversight on F1/C2 and F1/C3 device CDS.
Regulation of Non-CDS Devices
The 2019 guidance also addresses SaMD functions that drive clinical management (F2) or treat/diagnose (F3) and provides several examples of SaMD, including those that are intended to acquire, process or analyze images or signals, i.e., those that do not meet Criterion 1 of Section 520 (o)(1)(E). These SaMD are not CDS (non-CDS devices) because they go beyond simply supporting or providing recommendations (i.e., F2 are intended to be relied upon to guide next diagnostics or treatment decisions, and F3 to take immediate or near-term action). These non-CDS devices will be subject to FDA regulation, at least for now, regardless of patient condition. In other words, FDA intends to focus regulatory oversight also on SaMD in categories F2/C1C3 and F3/C1C3.
SaMD Functions Intended for Patient/Caregiver Use
Like the 2017 guidance, the 2019 guidance also addresses device CDS intended for patients and caregivers, though it does not use the "patient decision support software" nomenclature of the 2017 guidance and makes new regulatory distinctions based on the IMDRF risk factors. Specifically, FDA will exercise enforcement discretion for F1/C1 device CDS intended for patients, but only if the patient can independently evaluate the basis for the software's recommendations. F1/C1 device CDS intended for patients where the basis for the software's recommendation is not intended to be independently reviewed by the patient will be subject to FDA regulation. In addition, FDA will focus its regulatory oversight also on F1/C2 and F1/C3 device CDS intended for patients, regardless of whether the patient can independently evaluate the basis for the software's recommendation.
While the 2019 guidance does not radically change the 2017 guidance, it does bring device regulation closer to international standards and results in a more risk-based approach to regulation. Reference to the IMDRF Framework in the new guidance is not surprising, given its use by FDA in the digital health precertification pilot program to develop a risk-based approach to the level of premarket review of SaMD under the program and in FDA's proposed regulatory framework for artificial intelligence/machine learning software. However, the distinctions may create some ambiguity with respect to which functions merely inform clinical management and which functions tip the scale into driving clinical management. The 2019 guidance does provide a helpful table to determine how much regulation is appropriate, a more detailed analysis of each of the Section 520 (o)(1)(E) criteria and additional useful examples of each category of device.
Comments to this draft guidance are due December 26, 2019.
*Law Clerk at Stinson LLP.
