The U.S. Food & Drug Administration (FDA) issued a proposed guidance on August 8, 2016, regarding software changes to medical devices.  The proposed guidance relates to requirements for submitting medical device software changes to the FDA for approval.  The final document will provide assistance to medical device companies and the FDA for determining when changes to software or firmware for a medical device require FDA clearance.  The medical devices covered include 510(k)-cleared devices and preamendments devices subject to 510(k).

The FDA’s proposed guidance explains that premarket notifications are generally submitted for commercially-distributed medical devices undergoing significant changes in design.  Such changes include modifications that “could significantly affect the safety or effectiveness of the device” or a “major change or modification in the intended use of the device.”  The proposed guidance relates to software changes and is an update to the original guidance issued in 1997 regarding changes to existing devices.

The “software” subject to the proposed guidance is defined as “electronic instructions used to control the actions or output of a medical device, to provide input to or output from a medical device, or to provide the actions of a medical device.”  This includes software embedded in a device, software that is an accessory to another device, and “software that is intended to be used for one or more medical purposes that performs these purposes without being part of a hardware medical device.”

The FDA provides a flow chart for assisting with the determination, see below.  Issues addressed in the determination include changes related to: strengthening cyber security; meeting specifications of the most recently cleared device; introducing or affecting hazardous situations; creating new risk control measures; and affecting clinical functionality or intended use of the device.  Additional factors to consider beyond those in the flow chart and some examples of modifications are provided in the draft guidance as well.

The proposed guidance notes that in some cases a new 510(k) is not necessary, and that existing Quality System (QS) requirements may suffice.  Such QS requirements mandate, among other things, that the manufacturer maintains records, for production upon request, regarding such changes and the processes used to determine the changed device meet the design specifications.  Further, the proposed guidance does not apply to software for which the FDA has previously said it will not enforce compliance, including some mobile apps used with medical devices.

Some observers think the proposed guidance will help with improving cybersecurity of connected medical devices.  The public may provide comments to the FDA on the proposed guidance until November 7, 2016: comments may be submitted electronically here.