[co-author: Julian Klein*]

On June 21, 2023, the U.S. Food and Drug Administration (“FDA”) issued a warning letter to Zyto Technologies, Inc. (“Zyto”), citing Zyto’s promotion of its Hand Cradle Galvanic Skin Response (“GSR”) device and associated software for uses outside the scope of the device’s 510(k) clearance.[1] This warning letter is one of only a handful issued this year to medical-device manufacturers, and comes shortly after FDA issued a warning letter to iRhythm Technologies, which we wrote about, for touting uses for a remote monitoring device which were, in FDA’s opinion, outside the scope of the product’s 510(k) clearance.[2] These enforcement actions indicate that FDA is keeping a close eye on the promotion of software-enabled medical devices, especially when that promotion suggests a function that has not been approved and/or cleared by FDA for the device.

How Does Zyto’s Device Function?

The Zyto Hand Cradle device scans a patient’s palm to measure the patient’s GSR, which reflects changes in the skin’s electrical and sweat gland activity in response to physiological activation. These measurements are then fed to Zyto’s proprietary software to identify so-called “stressors” and “balancers.” Importantly, as FDA noted in the warning letter, the software’s library of stressors includes Alzheimer’s disease and Human Immunodeficiency Virus (“HIV”), Parkinson’s disease, and melanoma, and that the software identifies balancers that represent specific treatments, mitigations, and preventative measures for a given stressor. As stated in the June 21 warning letter, FDA deems the software to be a medical device component, subject to the same level of regulation as the Hand Cradle device, because, under the Food, Drug, and Cosmetic Act (“FDCA”), the software is “intended for use in the diagnosis of disease or other conditions or in the cure, mitigation, treatment, or prevention of disease.”[3]

What Are FDA’s Concerns?

Deviation from Cleared Intended Use

Pursuant to the Zyto Hand Cradle 510(k) clearance, FDA cleared the device for the intended use of “measurement of galvanic skin response,” but not for the identification of stressors and balancers.[4] Accordingly, FDA found that the Hand Cradle device is adulterated under FDCA section 501(f)(1)(B) because Zyto has not obtained permission (in the form of either premarket approval, investigational device exemption, or 510(k) clearance) to commercialize the product for diagnostic and/or treatment purposes (i.e., the identification of stressors and balancers).

According to FDA, this was not the first time the issue was brought to Zyto’s attention. In an earlier warning letter, issued to Zyto on June 11, 2015, FDA gave the company notice that the associated software was intended to be used in tandem with the Hand Cradle and was, thus, a component of the device requiring 510(k) clearance, which had not, and still has not, been obtained. Despite a follow-up warning given by FDA during a regulatory meeting in August, 2015, Zyto continued to promote the device and software together on the company website with the following description of intended use: “[t]he ZYTO Hand Cradle measures the user’s galvanic skin response and sends that data directly to the ZYTO software for analysis … [t]he GSR data is correlated and compared with Virtual Items in the software database.”[5] Not only did Zyto continue to promote the diagnostic capabilities (i.e., capabilities beyond the FDA-cleared “measurement of galvanic skin response”), it also added disease claims back into the software’s library, indicating that the product was capable of detecting and treating diseases such as Alzheimer’s, HIV, Parkinson’s, and Melanoma. FDA found that citing these specific diseases in promotional materials for the product presented an even more significant deviation from the device’s pre-cleared intended use, which was limited to GSR measurement.

Inadequate Quality Controls

FDA found Zyto’s promotion of uses outside the scope of the Hand Cradle’s 510(k) clearance to be especially problematic because Zyto had not taken the appropriate measures to ensure that these new indications (i.e., diagnostic and treatment outputs) were safe and effective for consumer use though requisite quality controls. Specifically, FDA found that the Hand Cradle and associated software were adulterated due to failure to conform with the Current Good Manufacturing Practice (“CGMP”) requirements set forth in FDA’s Quality System Regulation (“QSR”),[6] as detected during a December 2022 inspection. Namely, Zyto failed to establish QSR-required policies and procedures, and provided certain verifications and validations about the product without completing the requisite testing.

FDA also cited Zyto’s failure to establish procedures for corrective and preventive action; adequately establish procedures for complaint handling; adequately establish a procedure to ensure Device History Records are maintained to demonstrate the device is manufactured in accordance with the Device Master Record; and develop, maintain, and implement written labeling procedures to control Unique Device Identifier labeling activities.

Additionally, FDA called-out Zyto’s failure to conduct verification and validation testing, which violates both FDA’s QSR requirements and Zyto’s own Standard Operating Procedure (“SOP”). Despite the fact that Zyto had presented information to FDA which verified and validated the interaction between the software and the Hand Cradle hardware, and even defined testing procedures supposedly used to verify the user-interface requirements, Zyto was not able to provide any documented evidence that the requisite testing was ever performed. Further, Zyto’s files showed that it had begun, but had never completed, the requisite design testing, despite the fact it had been marketing the product since “at least 2019.”

Finally, FDA expressed concern that Zyto had directed users to utilize the Hand Cradle to mirror the functionality of the Zyto Tower—an in-house device used for the transmission, interpretation, and creation of the virtual library items, including the stressor and balancer outputs—without implementing any of the requisite verification or validation procedures.

What Can Industry Participants Learn from This Enforcement Action?

Ultimately, FDA took issue with Zyto’s promotion of the Hand Cradle device for uses beyond the scope of its 510(k) clearance—i.e., diagnostic and treatment capabilities—when it was cleared for the limited purpose of measuring the user’s GSR. As FDA noted, promoting the device for these capabilities represents a “major change or modification” to its intended use, which poses a threat to user safety that was amplified by Zyto’s failure to perform the requisite testing to ensure safety and efficacy.

This device system appears to have been an enforcement priority for FDA after Zyto failed to obtain 510(k) clearance for the software products as a “component,” despite the warning letter recommending that Zyto do so nearly eight years ago. Zyto’s failure to obtain clearance for the associated software also seems to have been especially poignant, as the main issue cited by FDA (i.e., promotion of the device for uses outside the scope of its 510(k) clearance) arose primarily from the software component, which interprets the GSR readings and provides the diagnostic and treatment outputs at issue.

So-called “intended use creep” has been an enforcement priority for FDA this year, as evidenced by this second warning letter FDA has issued to a medical device software company for the promotion of capabilities outside of the scope of the intended use cleared by FDA, as well as failure to adequately test those capabilities. As mentioned above, iRhythm received a similar warning in May of this year, citing violations stemming from (i) promotion of a remote monitoring device for a new group of consumers without having clearance for that consumer group, and (ii) modification of the device’s software—a device component—without testing to ensure safety and efficacy as required for a new 510(k) submission.

The fact that two of only a handful of medical device warning letters issued by FDA this year focus on the promotion of device software functions outside the scope of FDA clearance suggests a heightened focus on medical device software, in particular. Specifically, FDA is closely scrutinizing the addition of, and/or modification to, software that supports a device, as this has the potential to alter the functionality of the device itself and may jeopardize user safety if it is not developed and commercialized through the proper channels, especially if the software incorporates diagnostic and/or treatment capabilities. Product development teams should be familiar with the scope of a product’s intended use under an FDA marketing approval and/or clearance, and should remain vigilant about conducting testing and seeking expanded approval and/or clearance when the scope of the intended use is exceeded by new or modified product capabilities.

*Julian Klein is a summer associate in the firm’s New York office.

FOOTNOTES

[1] Warning Letter: ZYTO Technologies, Inc., FDA.Gov, https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/zyto-technologies-inc-652316-06212023.

[2] Warning Letter: iRhythm Technologies, Inc., FDA.Gov, https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/irhythm-technologies-inc-643474-05252023.

[3] 21 C.F.R. §321(h).

[4] See 510(k) Clearance No. K111306, FDA.Gov (Aug. 30, 2011), https://www.accessdata.fda.gov/cdrh_docs/pdf11/K111308.pdf.

[5] See Hand Cradle GSR Device, Zyto, https://zyto.com/hand-cradle-gsr-device.

[6] See 21 C.F.R. §820.