On October 25, 2017, FDA’s Center for Devices and Radiological Health (CDRH) issued two final guidance documents that provide FDA’s current thinking regarding whether a modification to a 510(k)-cleared device will require the submission of a new 510(k), or may be documented in a “letter to file” as part of the manufacturer’s quality system.  Such changes could include modifications to labeling, technology, or materials.  CDRH issued draft versions of these documents in August 2016.

The first guidance provides recommendations on medical device changes and modifications generally, while the second guidance focuses specifically on software changes and modifications.  The first guidance document supersedes the 1997 final guidance on 510(k) device modifications.  The software guidance is intended as a companion to the general guidance.

Deciding whether to submit a new 510(k) for a device modification is a significant and sometimes difficult issue for device manufacturers, which can have regulatory consequences if a decision to take the letter-to-file approach is challenged by FDA.  Accordingly, manufacturers of 510(k) devices should ensure that they clearly understand the principles described in these guidance documents and implement policies and practices that align with FDA’s recommendations.

The New Guidance Documents Are Not Intended to Implement Significant Changes in Policy

In both final guidance documents, CDRH clarifies that the goal is not to “implement significant policy changes to FDA’s current thinking on when submission of a new 510(k) is required.”  Rather, FDA’s new guidance documents retain the same basic paradigm for assessing modifications as the 1997 Guidance, but provide a revised flow chart, additional examples, and other clarifying information that will help manufacturers to decide whether a 510(k) or a letter to file is the appropriate pathway.  As stated by FDA, the guidance documents describe “in greater detail the regulatory framework, policies, and practices underlying such a decision.”  In many ways, the final guidances describe the policies used by FDA in practice since the 1997 guidance.

CDRH re-emphasizes the “least burdensome approach” in both final guidances by adding that its recommendations are “consistent with least burdensome principles,” and these principles are applied “in discussing the considerations that may affect the decision-making about when to submit a new 510(k) for a device change or modification.”

Like the 1997 guidance document, the 510(k) final guidance includes flow charts for each category of change: labeling; technology, engineering and performance; and materials.  It also includes a separate flow chart for in vitro diagnostic device changes.  Both the 510(k) and the software guidance documents provide examples applying the principles for making the 510(k) submission decision.

Key Guiding Principles

In both final guidances, CDRH provides manufacturers ten guiding principles to “bear in mind” when analyzing device or software modifications or changes.  Some of the key principles are outlined below:

• Intent. The threshold question in any new 510(k) analysis is whether the manufacturer is modifying the device with the intent to significantly affect the safety or effectiveness of the device. This could include an intent “to significantly improve clinical outcomes, to mitigate a known risk, [or] in response to adverse events.”  A “change intended to significantly affect the safety or effectiveness of the device is considered to be a change that ‘could significantly affect the safety or effectiveness of the device’” under 21 C.F.R. 807.81(a)(3)(i), and thus would require submission of a new 510(k).

• Risk-Based Assessment. If the change is not intended to significantly affect the safety or effectiveness of the device, the manufacturer should conduct a risk-based assessment of whether or not the change “could significantly affect the device’s safety or effectiveness, either positively or negatively.”  A manufacturer should consider whether a change could have unintended consequences that affect safety or device performance.  A new 510(k) is likely required when the risk-based assessment indicates (1) a new risk, or (2) a significantly modified existing risk.  FDA recommends that non-physical injuries, including psychological harm, be considered in this assessment.   The final guidances explain that a “new risk” is a “new hazard or hazardous situation that did not exist for the original device . . . and the pre-mitigation risk level associated with the new risk is not considered to be acceptable.”  A “significantly modified existing risk” includes a change to the risk score, risk acceptability category, or duration of the risk.

• Cumulative and/or Concurrent Changes. In completing the risk-based assessment, manufacturers should compare the changed device to the “original device,” which will usually be the device that was previously found to be substantially equivalent in their most recently cleared 510(k).  An original device could also be a preamendments device or a device granted marketing authorization through the de novo classification process.  Critically, if the manufacturer has previously made changes to the device without submitting a new 510(k), they still must compare the changes being considered to the original device.  If a manufacturer is making more than one concurrent change, each change requires a separate risk-based assessment.  A manufacturer should also conduct an assessment of the cumulative changes.  When there are many concurrent changes, the changes that do not trigger a new 510(k) can be immediately implemented in accordance with documentation requirements under the Quality System regulations.  But “[w]hen the cumulative effect of individual changes triggers the regulatory threshold for submission, the manufacturer should submit a new 510(k).”  In conducting this cumulative assessment, manufacturers should assess the new changes together with those changes that were previously made to the device but which did not trigger the need for a new 510(k).

• Testing (e., verification and validation activities). If a risk-based assessment concludes that a new 510(k) is not required, it is recommended that the manufacturer confirm this finding with verification and validation testing.  If such testing produces any “unexpected results,” the manufacturer should re-consider the conclusion about whether a 510(k) is needed.  A new 510(k) is required if the risk-based assessment concludes that a change or modification could significantly affect safety of effectiveness, even if verification and validation testing are completed without any unexpected results.

Software Guidance

The guidance specific to software changes applies to software that is embedded within or a component of a medical device, that is an accessory to another medical device, or that is intended to be used for one or more medical purposes that performs these purposes without being part of a hardware medical device.

The guidance advises manufacturers “to collectively evaluate the combination of both software and non-software changes” using both the general and software-specific modifications guidances.  A 510(k) is needed if applying either guidance results in that conclusion.

The guidance addresses a few specific categories of software changes.  For example, a change made solely to strengthen cybersecurity is not likely to require a new 510(k).  However, if the manufacturer becomes aware of any “incidental or unintended impacts” of the change, then the manufacturer should proceed with analysis under the remainder of the guidance. As another example, changes that could significantly affect clinical functionality or performance specifications “directly associated with the intended use of the device” would likely require submission of a 510(k).  It also provides guidance on changes to infrastructure, architecture, and the core algorithm.

The final software guidance has a few key differences from its draft counterpart:

• The draft guidance stated that “[t]his guidance, when finalized, is also intended to apply to situations when a legally-marketed existing device is the subject of a recall and a change in the device or its labeling is indicated.” The final guidance clarifies that the guidance also applies when an existing device is subject to a “correction” or “removal,” even if the correction or removal is not the result of a recall.  These additions slightly broaden the scope of the guidance’s applicability.

• The final guidance adds “patch” and “code change” to the examples of what constitutes a software modification that is considered a design change under the Quality System regulation.

• Both the draft and final software guidance discuss “reengineering” and “refactoring” as two common software maintenance techniques. In assessing whether a new 510(k) is required when these techniques are used, the final guidance states that in addition to considering the complexity of the change, manufacturers should also consider the change’s impact on risk controls or performance.  This addition reiterates the guidance’s overall emphasis on risk-based assessments.

***

As described above, given the importance of this issue, manufacturers of 510(k) devices should ensure that they fully understand the principles described in these guidance documents and implement practices that align with FDA’s recommendations.

Also authored by Allison Whelan.