Recent Developments in Regulation of Software as a Medical Device

By Andrea Berenbaum and Noel Courage[1]

The digital health technology sector has undergone rapid expansion in recent years, and its growth is forecasted to continue. One noteworthy class of technology in this sector is software as a medical device (SaMD). SaMD has been defined by the International Medical Device Regulators Forum (IMDRF) as “software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device.”[2] However, it is not always straightforward to distinguish between SaMD and other software such as medically-related non-SaMD[3].

As new innovations emerge and the field continues to evolve, some medical device regulators are working to adapt their policies and processes to uphold safety and efficacy, while also better aligning with the rapid design, development and modification cycle associated with SaMD. There is also a need for clarity as to what software fits within the definition of SaMD. This article provides an overview of a few of the recent developments in this regard, with a focus on Health Canada, the Canadian regulator for medical devices.

Health Canada announced earlier this year that it is establishing a new Digital Health Review Division “to allow for a more targeted pre-market review of digital health technologies, to adapt to rapidly changing technologies in digital health, and to respond to fast innovation cycles”[4]. SaMD is considered a “key area of focus”[5] under this new initiative.

Like other medical device products, SaMD are currently regulated by Health Canada using a risk-based classification system governed by the provisions of the Canadian Food and Drugs Act[6] and Medical Devices Regulations[7]. Schedule I to the Regulations sets out the rules for sorting a medical device into one of four classes, where Class I devices are perceived to represent the lowest risk and Class IV devices are perceived to represent the highest risk. There are two sets of risk-based classification rules in Schedule I; one for in vitro diagnostic devices (IVDDs) and another for non-IVDDs.

Regulatory obligations vary by class. For example, under the Canadian regulatory regime, medical devices in Classes II, III and IV generally require a medical device license to be imported, sold or advertised for sale whereas those in Class I are exempt from this requirement. Additionally, the information required in the application for a medical device license varies depending on class, with more onerous information requirements correlating with increased perceived risk.

Given the varying obligations depending on class, it is important to stakeholders that there be clarity and certainty in how the rules of Schedule I of the Regulations are applied to new digital health technologies such as SaMD. Encouragingly, Health Canada appears to have recognized this and has developed a draft guidance document intended to provide a definition of SaMD and guidance as to how SaMD may be classified[8]. A Scientific Advisory Panel has been engaged to solicit feedback on the draft guidance prior to external consultation as well as provide comments on the future of medical device software including SaMD and Health Canada’s regulatory approach.

While the draft guidance is not yet publically available, the questions considered by the panel shed some light on potential future directions. For example, Health Canada was seeking feedback on whether SaMD should be regulated within the current regulatory framework or alternatively whether the regulatory framework should be modified or even a new framework created to address SaMD[9]. It is still very early in the consultation process and it will be of interest to watch for the public release of draft guidance as well as the record of proceedings of the panel which met earlier this year.

The US Food and Drug Administration (FDA) is also in the process of developing a new regulatory model to assess medically-related software such as SaMD. As a part of its Digital Health Innovation Action Plan, the FDA recently released an updated working model for its Software Precertification Pilot Program[10]. This program is envisioned by the FDA as a voluntary pathway more tailored to suit software technologies than the existing regulatory regime and only applies to SaMD. In contrast to the existing regulatory regime for medical devices, in which, similar to Canada, the obligations and procedures depend primarily on the classification of the medical device, the new program would use an organization-based approach comprising precertification of SaMD manufacturers. The FDA will update the working model based on comments received from the public with the intent of developing a version by December 2018 that can be used in pilot testing in 2019. 

Companies making SaMD should keep on top of regulatory developments because the clear trend appears to be to try to accelerate the regulatory path to approval.

This article contains excerpts from a previous article that was published by the authors in FDA Flash! The Official Blog of the AIPLA FDA Committee.