Agency expands enforcement discretion, focusing its oversight on a discrete subset of mobile apps that present the greatest risk to patients.

On September 23, the U.S. Food and Drug Administration (FDA or the Agency) issued the final version of its controversial guidance document on mobile medical applications (the Final Guidance),^[1] confirming that FDA views such products to be within its regulatory authority. Although the Final Guidance removes any doubt as to whether FDA intends to regulate mobile medical apps, it also makes clear that FDA intends to exercise its regulatory authority judiciously when there is minimal risk to patients. For example, although the definition of regulated “mobile medical apps” in the Final Guidance mirrors that set forth in the draft guidance issued in July 2011 (the Draft Guidance),^[2] the Final Guidance expands the apps subject to enforcement discretion (i.e., not actively regulated by FDA), limiting FDA’s active regulation to those mobile apps that present the highest level of risk. The Final Guidance also includes expanded guidelines for the types of entities that are not subject to regulatory oversight.

Although the Final Guidance includes new and expanded guidance on those apps not subject to active FDA regulation, app developers may still face difficulties in determining exactly where FDA draws the line between regulated and unregulated mobile apps.

Key points from the Final Guidance are described below.

What is a regulated entity?

The Final Guidance states that FDA intends to regulate manufacturers of mobile medical apps, including, for example, any entity that initiates specifications for a mobile medical app or creates, designs, labels, remanufactures, or modifies a mobile medical app. However, the Final Guidance emphasizes that FDA does not intend to regulate entities that merely distribute or sell mobile medical apps (e.g., via app stores), nor will the Agency regulate manufacturers of general-purpose mobile platforms (e.g., tablet computers and smartphones), provided that such manufacturers do not label or promote their products for medical device functions. The Final Guidance also confirms that FDA generally does notintend to regulate licensed practitioners (e.g., physicians) that create mobile medical apps solely for use in their professional practices, including, for example, use by other physicians within the same group practice.

What is a mobile medical app?

Like the Draft Guidance, the Final Guidance defines a “mobile medical app” as a mobile app that (1) meets the definition of a “device” in section 201(h) of the Federal Food, Drug, and Cosmetic Act (FD&C Act) and (2) is intended either to be used as an accessory to a “regulated medical device” or to transform a mobile platform into a “regulated medical device.” Although the definition of “mobile medical app” remains unchanged, FDA updated the definition of a “regulated medical device” to make clear that novel medical devices are included in the scope of that term, even if not previously cleared, approved, or classified by FDA.

What mobile medical apps are subject to regulatory oversight?

The Final Guidance identifies general categories of apps that are subject to active regulation, along with specific examples, both within the body of the guidance and in an appendix. The categories of apps subject to regulation include the following:

• Mobile apps that connect to an existing medical device for the purposes of controlling its operation, function, or energy source

• Mobile apps that display, transfer, store, or convert patient-specific medical device data from a connected medical device

• Mobile apps that transform the mobile platform into a regulated medical device

• Mobile apps that perform patient-specific analysis and provide patient-specific diagnosis or treatment recommendations

What mobile medical apps will be subject to FDA enforcement discretion?

FDA intends to exercise enforcement discretion for certain mobile apps that may meet the definition of a “device” under the FD&C Act but that present low risk to patients’ safety if the apps fail to function as intended. As with the discussion for regulated apps, the Final Guidance includes both general categories of apps subject to enforcement discretion and specific examples. The categories of apps subject to enforcement discretion include apps that do the following:

• Provide or facilitate supplemental clinical care, by coaching or prompting, to help patients manage their health in their daily environment

• Provide patients with simple tools to organize and track their health information

• Provide easy access to information related to patients’ health conditions or treatments

• Are specifically marketed to help patients document, show, or communicate to providers potential medical conditions

• Perform simple calculations routinely used in clinical practice

• Enable individuals to interact with personal health record (PHR) systems or electronic health record (EHR) systems

Notwithstanding the expanded guidelines on which apps are subject to enforcement discretion, there is still likely to be uncertainty as to where FDA draws the line between those apps subject to enforcement discretion and those that are actively regulated. For example, app developers may face difficulties in determining whether their apps would be viewed as performing “simple calculations routinely used in clinical practice” (and subject to enforcement discretion) versus performing a patient-specific analysis to provide a diagnosis or treatment recommendation (and subject to active FDA regulation). Additionally, the categories and examples provided by FDA likely will not cover every possible type of mobile medical app. Thus, although the guidance provides improved clarification, some uncertainty remains.

What about stand-alone clinical decision support software?

At a September 23 briefing announcing the Final Guidance, Dr. Jeffrey Shuren, Director of FDA’s Center for Devices and Radiological Health (CDRH), stated that clinical decision support (CDS) software will be addressed separately in the congressionally mandated plan for a regulatory framework for health information technology, including mobile medical apps, which is due to Congress by January 2014.

Although the Final Guidance confirms that it “does not address the approach for software that performs patient-specific analysis to aid or support clinical decision-making,” the scope of this exclusion remains ambiguous. FDA provides no clarification on what types of apps would be viewed as CDS software outside the scope of the Final Guidance. Moreover, FDA’s inclusion of mobile apps that “perform[ ] patient-specific analysis and provid[e] patient-specific diagnosis, or treatment recommendations” as regulated mobile medical apps seems to be at odds with the Agency’s purported exclusion of CDS software from the Final Guidance.

_{[1]. View the Final Guidance here.}

_{[2]. For more information on the Draft Guidance, view our July 28, 2011 LawFlash, “New FDA Draft Guidance on Mobile Medical Apps Provides Some Clarity, But Raises Many More Questions,” available here.}