FDA's Latest Twist On Digital Health Oversight Brings Big Shift

• Jurisdiction: United States,Federal
• Law Firm: Cooley LLP
• Subject Matter: Food, Drugs, Healthcare, Life Sciences, Biotechnology & Nanotechnology
• Author: Ms Sonia Nath, Wyatt Kernell and Zimu Yang
• Published date: 11 January 2023

Facing novel, swiftly evolving technologies in the digital health space, the US Food and Drug Administration has been trying to balance fostering innovation with providing reasonable assurance of safety and effectiveness under a regulatory framework for devices that dates back to 1976. Major changes impacting digital health companies came with the passage of the 21st Century Cures Act in 2016, which carved out certain categories of software from FDA oversight. Since then, the FDA has issued numerous guidance documents providing details on these carve outs, as well as the agency's general approach to regulating digital health technologies.

In its early digital health guidance documents, the FDA sought to harmonize its thinking with that of the international community, but it also announced specific areas of enforcement discretion for low-risk devices. On September 28, 2022, however, the FDA issued three new final guidance documents in the digital health space - on clinical decision support (CDS) software, mobile medical applications and medical device data systems - as well as a report summarizing its findings on the Software Precertification (Pre-Cert) Pilot Program. The FDA's recent efforts signal that the agency is moving toward more oversight of digital health companies. With more than 500 medical device approvals and clearances involving artificial intelligence (AI) and machine learning (ML) under its belt, the agency has a better understanding of the regulatory pressure points for these products, and in response, it has updated its current thinking on how it can regulate software as a medical device, given the Cures Act carve outs.

The most significant revision to the FDA's current interpretation of the Cures Act is the recently finalized guidance on CDS software, in which the agency provides a more detailed interpretation of several statutory elements. On December 15, 2022, the FDA also updated its Digital Health Policy Navigator, a tool developed by the agency's Digital Health Center of Excellence, to help industry understand the Cures Act analyses, including the non-device CDS exemption. Below, we've analyzed the practical implications of the most significant of these changes.

CDS software guidance

Per the Cures Act, software functions that meet the following four criteria are not devices under the Federal Food, Drug, and Cosmetic Act (FDCA):

1. It is not intended to acquire, process, or analyze a medical image or a signal from an in vitro diagnostic device, or a pattern or signal from a signal acquisition system.
2. It is intended for the purpose of displaying, analyzing, or printing medical information about a patient or other medical information (such as peer-reviewed clinical studies and clinical practice guidelines).
3. It is intended for the purpose of supporting or providing recommendations to a healthcare professional about prevention diagnosis, or treatment of a disease or condition.
4. It is intended for the purpose of enabling a healthcare professional to independently review the basis for recommendations that the software presents, but not rely primarily on those recommendations to make a clinical diagnosis or treatment decision regarding an individual patient.¹

While the agency cites this same statutory language in previous CDS draft guidance documents, as well as the newly issued final guidance document, the FDA's new interpretation as explained in the final guidance includes parameters not specifically delineated by the statute.

Three key takeaways from the final CDS guidance

The final CDS guidance on its face appears to be significantly different from the previous draft guidance. Some changes, however, are more to form than substance. For example, rather than include a table indicating that CDS software that provides outputs focused on caregivers or patients does not qualify for the non-device CDS carve out and is instead subject to enforcement discretion, the FDA refers readers to its other Cures Act guidance documents announcing enforcement discretion policies for low-risk devices, such as its mobile medical applications guidance or general wellness policy for low-risk devices. Similarly, the International Medical Device Regulators Forum (IMDRF) framework is now referenced only in passing,² although several principles from that framework, such as the reference to intended use based on "label and instructions for use" (rather than FDA's broader intended use regulation³), remain. The FDA acknowledges in this final CDS guidance that while the IMDRF provides "additional information regarding risk categorization and considerations that may apply to certain software functions," it no longer embraces this framework as the foundation for the FDA's revised current thinking as it did in the previous draft guidance.⁴ Beyond these changes intended to streamline the guidance, there are three areas where the agency's current interpretation appears to narrow the non-device CDS exemption, particularly when compared to the 2019 draft guidance and the plain statutory language.

FDA's current interpretation restricts non-device CDS inputs

The final guidance includes newly announced definitions for "medical image," "signal" and "pattern" as those terms are used in Criterion 1. "Medical image" includes not only those images generated by medical imaging systems to view...