Many digital health products are regulated by the U.S. Food and Drug Administration (FDA) as medical devices or, when used in conjunction with a specific drug or biological product, as combination products requiring clearance or approval from the agency prior to marketing.
Regulation of standalone devices
The FDA regulates medical devices products, including software applications, that are intended for use in the treatment or diagnosis of individual patients. The agency interprets this definition quite broadly, including, for example, regulation of tools used for capturing medically-oriented data (e.g., ECG data) or tools used for screening healthy persons for disease. For product comprised only of software, changes enacted under the 21st Century Cures Act recently exempted certain functions from the definition of a medical device, such as simple transfer and display of existing medical device data and certain clinical decision support functions. For products not exempted by these recent changes, the key to determining whether the product falls into the definition of a medical device is the intended use, which is determined by the intent of the manufacturer as evidenced by the design of the product and the labeling.
FDA’s regulatory framework for medical devices is a risk-based approach, whereby the risk posed by a device dictates the level of regulatory scrutiny to which it is subject. The agency has established three device classes. Class I devices present the lowest risk of harm to patients or users. Due to this low risk of harm, most class I devices have been exempted by regulation from marketing authorization (i.e., FDA clearance or approval) requirements. However, such devices must still comply with certain general post-market FDA requirements. Class II devices represent an intermediate level of risk. This class includes a wide range of products, some of which have also been exempted from the marketing authorization requirements. Those that have not been exempted, however, must receive FDA clearance prior to marketing under section 510(k) of the Federal Food, Drug and Cosmetic Act (FD&C) Act. Such clearance is granted when submitted information establishes that a proposed device is “substantially equivalent” to a “predicate device,” which is usually another legally marketed class I or class II device that has the same intended use and similar indications for use and technological characteristics. Finally, class III devices include high-risk products such as life sustaining, life supporting, or implantable devices or novel devices that do not have predicate on which to base substantial equivalence and doesn’t warrant down classification to class I or II. Manufacturers must obtain FDA authorization to market class III devices via a pre-market approval (PMA) application.
In the digital health space in particular, it is worth noting that FDA applies a policy of “enforcement discretion” (i.e., does not enforce the applicable regulatory requirements) to certain products that, while they constitute medical devices per the FD&C Act definition, are considered to present little risk and, therefore, are not the subject of active regulation by FDA. This includes, for example, product types articulated in the Agency’s 2015 final guidance, Mobile Medical Applications: Guidance for Industry and Food and Drug Administration Staff1 and general wellness products described in the 2016 final guidance, General Wellness: Policy for Low Risk Devices, and patient decision support tools described in the 2017 draft guidance Clinical and Patient Decision Support Software: Draft Guidance for Industry and Food 5 and Drug Administration Staff. Manufacturers and developers must make careful, strategic decisions about whether their products fall into any of the relevant enforcement discretion categories.
Absent a policy of enforcement discretion clearly applicable to a particular product, companies must evaluate FDA precedent for regulation of similar products and/or engage in dialogue with the agency about the most appropriate regulatory pathway. There are a number of possible options for discussing regulatory issues with the agency, including informal communications and pre-submissions, among others. Initial discussions with the agency should be approached strategically and after the manufacturer of the product has made an initial assessment of the most appropriate regulatory pathway for the product.
Regulation of combination products
If a digital health tool (e.g., a smart inhaler or a digital pill) is used in conjunction with a prescription drug or biological product, and both the digital health tool and the drug/biological product are essential to achieve their intended use, the U.S. FDA will regard the two components as a combination product, likely with a drug primary mode of action. Often the agency looks to whether the products are copackaged or whether the drug or biological product can be delivered without the digital tool. Regulation as a combination product requires that the system (drug/biologic and digital tool) obtain FDA approval via the Agency’s process for a new drug application (NDA) or biologics license application (BLA).
Once a digital tool has FDA clearance or approval (either as a standalone medical device or as part of a combination product) there are a series of post-market obligations that must be considered. For a standalone medical device, this includes considerations such as compliance with FDA’s Quality System Regulation, adverse event reporting, and adherence to labeling and promotional requirements, among others. For combination products, manufacturers must additionally adhere to requirements applicable to drugs and biologic products. For example, any safety data collected by the digital health tool must be considered as part of the pharmacovigilance requirements for the drug/ biological product. These requirements may affect how a company chooses to structure their access to patient/ consumer data. To the extent the sponsor becomes aware of identifiable adverse events, the sponsor must report them to FDA pursuant to applicable regulations. If a sponsor receives anonymized adverse event information from the digital health tool, the sponsor may be unable to submit individual case safety reports, but the sponsor should analyze trends in the data and as appropriate, disclose these trends in periodic reports, or proactively bring them to the agency’s attention.
While both standalone device products and combination products must adhere to FDA’s requirements for labeling and promotional claims, it is worth noting that combination products warrant additional consideration. Written, printed, or graphic materials or sales representative statements that promote the digital health component, the drug component, or the combination would be considered promotional labeling, subject to FDA’s standards for promotional labeling for drugs and biological products. In general, these standards require that promotional claims be consistent with the FDA approved prescribing information, claims be consistent with the FDA-approved labeling for the drug or biological product and supported by substantial evidence (typically, two adequate and well-controlled studies) or evidence that is significantly appropriate or statistically sound. Similarly, communications with patients or health care providers mediated by the digital health tool (e.g., adherence messages) would generally be subject to the same standards. Given FDA’s standards for promotional claims, it is unclear whether efficacy, safety, quality of life, or other types of data collected by the digital health component of a combination product during regular commercial use would be sufficiently rigorous to serve as the basis for promotional product claims. However, it may be more possible that such data could be incorporated into the development of health care economic information claims, if the data are related to an approved indication, supported by competent and reliable scientific evidence, and otherwise compliant with the criteria for health care economic information claims in section 502(a) of the FDCA and FDA guidance.
This post is a feature from our recently published Digital Health Issues Guide.
