Summary

On December 7, 2017, the US Food and Drug Administration (FDA) published a highly anticipated draft guidance document that describes how the agency intends to exercise oversight over clinical decision support (CDS) software. Simultaneously, FDA also issued a draft guidance document that describes how the agency intends to revise four previously issued digital health final guidance documents for consistency with the 21st Century Cures Act, which amended the Federal Food, Drug, and Cosmetic Act’s definition of “device” to exclude software with several types of functions (including certain CDS functionalities). The key provisions and implications of these guidance documents are briefly summarized in this On the Subject.

In Depth

FDA has long expressed an interest in digital health products. The extent to which FDA should assert jurisdiction over digital health products, however, has been the subject of considerable debate. The debate has been particularly intense with respect to FDA’s oversight of clinical decision support (CDS) software.

In early December 2016, Congress weighed in by enacting section 3060 as part of the 21st Century Cures Act. Section 3060 expressly excludes several types of software from the Federal Food, Drug, and Cosmetic Act’s (FDCA) definition of a “device”—excluding such products from FDA’s regulatory jurisdiction—including products that meet all four of the following criteria:

1. Not intended to acquire, process or analyze a medical image or a signal from an in vitro diagnostic device or a pattern or signal from a signal acquisition system;
2. Intended for the purpose of displaying, analyzing or printing medical information about a patient or other medical information (such as peer-reviewed clinical studies and clinical practice guidelines);
3. Intended for the purpose of supporting or providing recommendations to a health care professional about prevention, diagnosis, or treatment of a disease or condition; and
4. Intended for the purpose of enabling such health care professional to independently review the basis for such recommendations that such software presents so that it is not the intent that such health care professional rely primarily on any of such recommendations to make a clinical diagnosis or treatment decision regarding an individual patient.

Almost one year later, on December 7, 2017, FDA issued (1) a draft guidance entitled Clinical and Patient Decision Support Software (the CDS Guidance) that outlines the agency’s interpretation of the four above-referenced criteria, and (2) a draft guidance entitled Changes to Existing Medical Software Policies Resulting from Section 3060 of the 21st Century Cures Act (the Technical Changes Guidance) that outlines how the agency intends to revise four final guidance documents for consistency with the 21st Century Cures Act provision, noted above, that excludes software specific functions from the FDCA’s definition of a device.

The CDS Draft Guidance

The CDS Guidance outlines FDA’s position with respect to the agency’s oversight of (1) CDS software intended for health care professionals and (2) patient decision support (PDS) software intended for patients and caregivers who are not health care professionals. The CDS Guidance is intended to identify the types of decision support software functionalities that (1) do not meet the definition of a device as amended by the 21st Century Cures Act, (2) may meet the definition of a device but for which FDA intends to exercise enforcement discretion, and (3) meet the definition of a device and are the focus of FDA’s regulatory oversight.

As an initial step, FDA provides its definition of CDS software—i.e., software with functions that meet the first three of the four above-listed criteria. FDA reiterates, however, that CDS software only falls outside the definition of a “device” if it meets the fourth of the above-referenced criteria, which requires the software to enable independent review of the basis for any recommendations (or outputs) by a health care provider.

Next, FDA provides guidance on its interpretation of each of the four above-referenced criteria. Specifically:

Based on the above, the CDS Guidance lists several examples of software that is not a device. In almost all of the examples, the agency includes the caveat that the recommendations provided by the software must be consistent with current clinical guidelines and consistent with FDA-approved drug labeling. For example, software that suggests a test based on a physician’s order is a CDS function that is not a device, provided the software’s suggestions are consistent with clinical guidelines. As another example, software that contains calculators for ordering total parenteral nutrition (TPN), such as software that recommends increased protein TPN for patients with active infections consistent with clinical practice, is not a device. Notably, software that provides health care professionals with recommendations on the use of a prescription drug that are consistent with FDA-required labeling are also not a device. However, software distributed by or on behalf of a sponsor for use with one or more of its drugs or biologics is not addressed in the CDS Guidance, and FDA noted that labeling and combination product requirements may be applicable. This statement is particularly relevant for many drug and biologics manufacturers who provide enhanced labeling, instructions for use or patient metrics through software or mobile applications. FDA appears to confirm without further explanation that certain types of software distributed with drugs or biologics may be subject to labeling and/or advertising regulations.

The agency further indicates that it intends to focus its oversight on CDS and other software functions that remain devices, including several types of software based on computed tomography (CT) or magnetic resonance (MR) images. For example, FDA will regulate software that analyzes CT images to compute and/or approximate fractional flow reserve because the software performs an image analysis that the user could not independently derive. For similar reasons, FDA will continue to regulate software that manipulates data from a CT scan, including software that provides 3D reconstruction to aid in the placement of catheters in lung tissue and markers in lung tissue to guide radiosurgery and thoracic surgery.

Enforcement Discretion for Certain PDS Software

Lastly, as noted above, the CDS Guidance describes a new subcategory of decision support software called PDS software that is subject to enforcement discretion. This category encompasses several types of general health and wellness functions that allow the intended user to obtain health recommendations and other information. To fall within enforcement discretion, FDA encourages developers to identify and present the supporting basis and rationale for any software recommendations in an understandable format. As is true for labeling, developers should take note that explanations for health care providers will likely be different than those issued to patients. Similar to CDS software, enforcement discretion does not apply to all PDS software. The CDS Guidance offers examples to assist stakeholders in appropriately classifying PDS software.

The Technical Changes Guidance to Implement the Cures Act

In the Technical Changes Guidance, FDA details the changes it intends to make to four existing guidance documents—General Wellness: Policy for Low Risk Devices, Mobile Medical Applications, Off-the-Shelf Software Use in Medical Devices, and Medical Device Data Systems, Medical Image Storage Devices, and Medical Image Communications Devices—to conform such documents to the requirements of section 3060 of the 21st Century Cures Act. FDA also announced its intent to withdraw its Guidance for the Submission of Premarket Notifications for Medical Image Management Devices.

The changes proposed to the above-referenced guidance documents primarily involve the movement of certain device functionalities from lists of products over which FDA intends to exercise enforcement discretion to lists of products that do not meet the definition of a device after the enactment of section 3060.

The guidance offers insights regarding FDA’s proposed approach to certain functions that were not explicitly addressed in prior guidance. For example, FDA affirms that electronic health records (EHRs) and personal health records (PHRs) are generally excluded from the definition of medical device, but notes that certain components or functions within EHRs and PHRs may be regulated as devices. FDA plans to address multifunction software in a separate guidance.

Implications

With the notable exception of the proposal to exercise enforcement discretion with respect to certain PDS software, the positions set forth in the CDS Guidance—and the examples provided therein—mirror previous FDA guidance and examples that pre-dated the 21st Century Cures Act. While the CDS Guidance confirms that the agency intends to take a similar approach to CDS as it has taken to mobile medical apps (MMAs), certain important questions remain unanswered, most notably:

• How will FDA regulate CDS software that relies on complex machine learning functionality?
• Will FDA acknowledge that enforcement discretion may be appropriate with respect to certain low risk CDS software?
• How does FDA plan to regulate multifunction software products that provide multiple intended uses and both regulated and potentially unregulated functions?

Stakeholders should consider submitting comments on these and other issues of interest to inform FDA’s consideration of the final guidance documents. The draft guidance documents are open for comment until February 6, 2018.