Software is used extensively in medical devices for gathering, monitoring, and transmitting data to healthcare professionals and clinical technicians. Although software can be an extremely useful tool as a medical device, there are growing concerns with regards to the safety and risk associated with how sensitive data is stored and who administers the “health advice”. Software as a medical device whether through an app or program is not currently being regulated which is a major concern for the FDA (Food and Drug Administration) and Health Canada respectively.

For example, a glucose monitoring device used for measuring blood glucose level for diabetic patients has integrated software that provides the user with suggestions on how a user can manage their glucose level and overall health. The FDA and Health Canada are working on developing a regulatory framework to monitor the risk-based safety measures such as data privacy and the type of medical advice or suggestions the software provides to the user.

US FDA Software Regulations

The FDA has recently taken action to address these data concerns by releasing a “Digital Health Software Precertification Program.” The program will help provide more streamlined and efficient regulatory oversight of software-based medical devices. The FDA intends to seek software organizations to submit a De Novo Request or 510(k) submission for software as a medical device (SaMD). The program will help the FDA to decide whether it should advise other regulatory authorities to implement a similar approach for an efficient regulatory framework for software used in the application of medical devices. The FDA is working on developing the framework to monitor the life cycle of the product from its pre-market development stage to post-market performance of the device and its continued excellence.

The pilot program launched by the FDA has defined a Software as a Medical Device (SaMD) as “software that is intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device.” The FDA will utilize the De Novo classification process as the pathway in the pilot program. The FDA will then determine whether a company that produces software products meets the following criteria:

• Excellence Appraisal will be based on five excellence principles: patient safety, product quality, clinical responsibility, cybersecurity responsibility, and proactive culture. The two levels of precertification will be based on how a company meets the excellence principles and whether it has demonstrated a track record in delivering safe and effective software products
• Review Pathway Determination for premarket review of their products which is a risk-based framework
• Streamlined Premarket Review Process to ensure the safety and effectiveness of the software device before it is introduced in the market
• Real-World Performance which is typically to access how the software product is performing with patients to support the regulatory status of continued safety, effectiveness and performance of the device

Health Canada Software Regulations

While the FDA has laid out the framework for SaMD, Health Canada has released a draft guidance document on the SaMD and is seeking comments from stakeholders to better understand and address the concerns on how to comply with governing statutes and regulations.

Health Canada classifies medical devices into four different classes depending on the risk factor involved in the intended use of the device. Class I represents the lowest risk and Class IV represents the highest risk. The software functionality is considered when determining the risk classification. However, in the case where the classification of the product is unclear, the final decision rests with Health Canada.

Health Canada had defined software as a medical device in the draft guidelines as:

• SaMD is intended to be used for one or more medical purposes as outlined in the Canadian regulation
• SaMD performs the purposes without being part of a hardware medical device

Health Canada has laid down a few inclusion and exclusion criteria to serve as a foundation for an analysis to be carried out. Currently, Health Canada will only be regulating software that is sold within the meaning of the Act, which generally requires the transfer of ownership of a device from one party to another. For example, this would include downloading software from an online store to a mobile device. As per the regulation, software developers producing a SaMD under their own name or trademark will be considered as manufacturers.

The classification grid at this stage is not very clear and there are multiple questions on how this new regulation will impact small businesses. How will a software developer who is creating the algorithm for providing parameters for a health condition classify it? Software is updated frequently for better quality and efficiency that are beneficial to the public but by introducing this regulatory burden to address the safety of the updates, it will get more complicated for a lower class medical device manufacturer to incorporate these updates (e.g. code review, continuous integration) to the software, which will give rise to quality concerns.

Canada and U.S Medical Device Regulatory Services at dicentra:

• Regulatory strategic planning and product classification
• Liaison with regulatory agencies and respond to regulatory agency questions
• Health Canada Medical Device License (MDL) registration
• Health Canada Medical Device Establishment License (MDEL)
• Organize and manage meeting(s) with the regulatory agencies
• Resolve regulatory compliance issues
• Label review for compliance

If your company requires expert advice on any of the above areas of regulatory consulting please feel free to contact us and one of our Regulatory Affairs Consultants will connect with you.