We are all aware of the concept of a “Medical Device”. Do we really know what it means? Most people think of these as items we purchase from manufacturers – and generally think in terms of medical peripherals that interface with the patient (such as video otoscopes, vital signs monitors, etc). But even simple devices – like wooden sticks – can be medical devices. It depends significantly on the labeling and intention of the device.
A “medical device” has a very specific meaning to the FDA. Most importantly – it is the “intended use” of the device that determines if it is a medical device.
So – the topics for today’s presentation relate the US Government’s role in regulating medical devices. The topics will include a short history of the regulations that empower the FDA to regulate medical devices, a review of the classifications of medical devices, and specific topics that apply to the manufacturing processes and inspection of manufacturers.
The FDA has been now been “regulating” medical devices for more than 60 years.
The FDA, located with DHHS, has 6 centers reporting to the Commissioner. This is a simplified diagram – showing only 2 of the 6 centers The office charged most with the oversight of medical devices is the CDRH, which has multiple offices of which 2 are shown here – the Office of Compliance and the Office of Device Evaluation.
The Center for Devices and Radiological Health (CDRH) regulates most of the medical devices in the U.S. All these devices fall within 16 major medical specialities, shown on the next slide.
Note that these panels match many of the “specialities” that telehealth programs align their case loads with.
Returning to the authorizing legislation for the FDA … known as the “The Act” … this provide some key areas for regulation by the FDA. While this was a critical piece of legislation, it suffered from some weaknesses.
These weakness or limitations were mostly related to limited control of the design and manufacturing processes for medical devices. No testing or approval mechanism was regulated for device manufacturers – a situation we cannot imagine today.
Since 1938, the role of the FDA and it’s authority has expanded and adjusted to meet the changing regulatory, health care, and technology landscape. This slide shows legislative changes that have impacted the role of the FDA. There are many more such pieces of legislation – and only a few recent rules are listed here. (I find it interesting that the 2 most recent legislative acts both have the word “Modernization” in them). Note that the MDA of 1976 provided FDA with the authority to regulate devices during most phases of their development, testing, production, distribution, and use. The SMDA of 1990 expanded this to add such things as design validation, recall authority, tracking requirements, and civil penalties.
The MDA of 1976 effectively required the FDA to classify all devices. All devices that were being marketed prior to the MDA of 1976 became known as “preamendment” devices – and were “grandfathered” into acceptance. This is important, as a part of the “clearance” of new medical devices is to relate the functionality and safety of new devices to these “preamendment” devices. Overall – the classification scheme adopted by the FDA is related to the risk posed by devices.
The Food and Drug Administration Modernization Act (FDAMA), 1997 further modified these classifications and the regulations concerning them. The FDA was better able to focus on the devices posing the greatest risk to patients, and to exempt “less risky” devices from a length review process. Class 1 devices – the least risky – are generally exempt from premarket notification to the FDA, and outside reviewers can be used to accelerate the review process for lower risk devices.
The FDA recognize 3 classes of devices. Class I devices pose the least risk to patients – whereas Class III pose the greatest risk. Generally – Class II devices are those which do not fall within Class I or III. Examples within each category are shown here on the slide.
FDA regulations place specific types of controls on the design and manufacturing of each medical devices. The controls depend on the classification of the device. Class I devices are mostly exempt from premarket notification (510(k)) – but are required to comply with something known as “General Controls”. Note that General Controls apply to all Classes. Class II devices must additionally comply with Special Controls and, in most cases, have premarket notification. Class II devices must obtain premarket APPROVAL. Note that the word “Approval” is reserved for Class III devices. Class II devices can be CLEARED – but are not approved as the FDA does not require the thorough scientific studies of these devices that would allow them to approve the device. The plot shows the % of devices which fall into each category.
General controls are required for all medical devices. Some of this is simply filling out a one-page form. But without question – the toughest part of this requirement is meeting the Good Manufacturing Practices. This is a host of regulations that we will discuss later in this talk.
Special controls only apply to Class II devices – and vary from device to device. Some of these apply to broad categories of devices – such as radiological devices.
Premarket notification – a key component of the regulation of most Class II devices - is often called a “510(k)”. A 510(k) requires locating an already “cleared” device that is substantially equivalent to the proposed device. That predicate device can be a “preamendment device” from before 1976, or can be a more recent device which was cleared based on a preamendment predicate device. Regardless – the FDA must be convinced that the new device is substantially equivalent to the predicate device by performing similar functions with similar technology and without posing new safety concerns to the patient.
Where does the term “510(k) come from? It is from the body of the Title 21 CFR – actually Section 510k – that specifies the requirement for premarket notification.
A 510(k) has to be submitted and cleared by the FDA whenever a new device is introduced and the device needs premarket notification. Significant changes to the device require resubmission of a new 510(k). This is one reason that medical products do not have frequent or wholesale changes – the cost in terms of resources and time can be quite high.
A 510(k) is a lengthy document with multiple parts. This list shows some of the topics areas that need to be covered in the 510(k).
This is the continuing list of what is required to complete a 510(k). A significant portion of the 510(k) is devoted to design specifications and to risk analysis / mitigation strategies.
The cost for having the FDA review a 510(k) submission is not high – about $3,000 to $4,000 depending on the size of your company. The major cost is preparing the document and conforming to the Good Manufacturing Processes that are required. It is possible to pay about twice this amount to get an outside reviewer to review the 510(k). This is not available for all categories of Class II devices - -but may provide a faster path through the review process. Note that the 510(k) process appears to be completed in about 90-100 days, but it can take much much longer.
Class III devices require a Premarket Approval (PMA) to be reviewed and approved by the FDA prior to marketing the device. This is a thorough scientific review process to ensure the safety and effectiveness of the device. This is because Class III devices pose the greatest risk to patients. Note that the APPROVAL process for a PMA typically requires more than a year.
The cost for submitting a PMA to the FDA is huge compared to a 510(k) … and again the much greater cost is what it takes the organization to conduct the studies, trials, etc. that are components of the PMA.
When can you market a medical device? Note that marketing is based on the FDA’s definition of marketing, which may differ from your own. In general – you cannot take firm orders or contracts for any medical devices until you have satisfied the FDA regulatory process.
It is important to realize that software can be a medical device. The term “device” does not just apply to hardware.
Software – as a medical device – is either a standalone device, a component, or an accessory. It is not always clear which one applies – but the FDA has provided guidelines related to all 3 concepts.
Standalone devices are neither components or accessories. Some telehealth software could easily fall into this category based on the examples provided above, although it is not clear how the FDA looks at telehealth applications.
Software components are fairly easy to understand – for example the software inside an infusion pump. The device cannot exist without that software to function.
Software may also be an accessory to a hardware device – and is often marketed or included by a manufacturer different from the hardware manufacturer. This concept encompasses a lot of software being developed for telehealth purposes – as the software is designed to integrate with medical devices and is often used for simple purposes – such as capturing images.
Perhaps the greatest hill to climb for existing programs is to become compliant with the Quality System Regulations of the FDA.
Without compliance with QSR – from design through manufacturing and distribution – manufacturers are not allowed to distribute products in the U.S or other markets.
QSR is a phrase that is often used interchangeably with GMP or cGMP. The only difference is that QSR is actually the application of cGMP to medical devices.
Returning to the earlier discussion of Title 21 and the regulations that empower the FDA to operate … it is important to recognize that Title 21, Chapter I has many parts numbered 1-1299. Only one of these parts specifies QSR.
Part 820 of Chapter I, Title 21 specifies the Quality System Regulation. This also shows some examples of other parts that also apply to medical device manufacturers.
Part 820 (QSR) has 15 Subparts, shown here. It is interesting just to look at the broad scope of what FDA covers in QSR. It is not just the manufacturing of the device – but everything from Design to Production to Records to Packaging etc. Within each Subpart, the FDA has multiple areas that are covered. We will just look at the details within 2 of these Subparts – those for Quality Systems Requirements and the Design Controls.
The Subpart specific to Quality System Requirements establishes management oversight of processes, training needs for staff, audits, and the prioritization of quality within the organizations.
The Subpart specific to Design Controls specifies a lot of details that need to be met during the design process. This is a simplified views of the Design Controls – but they are fairly rigid in terms of using clearly documented design processes, reviews, verification and validation of requirements.
Why does the FDA care about Design Controls? Poor device design accounted for a large share of device recalls. In general, poor design causes a ripple effect throughout the lifecycle of a product.
The 1-10-100 rule suggests that the cost of design defects are least when the defect is prevented during the design phase – and greatest when it occurs in a product released to a customer. Recognizing that the FDA is attempting to minimize risk to the patient – it makes sense that they would want to see better design controls to catch errors before they reach the patient.
How different is the FDA regulatory process from other “quality” approaches such as ISO 9000. Obviously, the greatest difference is that FDA is required by Federal Law – whereas ISO 9000 is required by market forces. FDA is very specific about the role of management – more so than ISO 9000. ISO 9000 does not specify requirements for failure reporting and other characteristics related to the safety of the patient from the medical device. Lastly – the FDA is focused on the safety of the device and much less on the other aspects of running a business – such as Personnel, Finance, etc. ISO 9000 has full control over these areas of business.
When do we , as telehealth programs, step over some line and become Medical Device manufacturers. It is not always clear – and may happen inadvertantly. The yellow box shows text from the User’s Manual of a well used telehealth device that implies you will be responsible for assuring IEC 606.1.1 compliance for their devices in combination with other devices. How many really know what that means, let alone have tried to establish this compliance.
Are you affected by FDA regulations. Certainly they have impacted the devices you purchase for your programs. But do you need to be “more aware” of these regulations? Much of what is required by the FDA is good business sense and very reasonable. Compliance takes time – but once implemented can lead to significant reduction in wasted effort and greater efficiencies within the organization. You may want to take a few minutes to answer the above questions, and see if you need to learn more.
These are some web sites that would be helpful to get additional information. In addition, many books are available through distributors including Amazon.com that provide a wealth of information on the FDA and the regulatory process.
Critical Issues in Telemedicine Technology I FDA Regulations Medical Device Manufacturing UL/CE/IEC Standards Case studies for telehealth products. HIPAA
A. Stewart Ferguson, PhD
Director of Telehealth / AFHCAN
Alaska Native Tribal Health Consortium
Douglas J. McClure
When does a Popsicle Stick become a Medical Device ?
TITLE 21--FOOD AND DRUGS
CHAPTER I--FOOD AND DRUG ADMINISTRATION
DEPARTMENT OF HEALTH AND HUMAN SERVICES
SUBCHAPTER H - MEDICAL DEVICES
PART 880 -- GENERAL HOSPITAL AND PERSONAL USE DEVICES
Subpart G -- General Hospital and Personal Use Miscellaneous Devices
Sec. 880.6230 Tongue depressor.
(a) Identification. A tongue depressor is a device intended to displace the tongue to facilitate examination of the surrounding organs and tissues.
(b) Classification. Class I (general controls). The device is exempt from the premarket notification procedures in subpart E of part 807 of this chapter, subject to the limitations in § 880.9. If the device is not labeled or otherwise represented as sterile, it is also exempt from the current good manufacturing practice regulations in part 820 of this chapter, with the exception of § 820.180, with respect to general requirements concerning records, and § 820.198, with respect to complaint files.
[45 FR 69682-69737, Oct. 21, 1980, as amended at 66 FR 38806, July 25, 2001]
The term “device” means an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article, including any component, part, or accessory which is
recognized in the national Formulary, or the US Pharmacopoeia, or any supplement to them,
intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man or other animals, or
intended to affect the structure or any function of the body of man or other animals, and which does not achieve its primary intended purposes through chemical action within or on the body of man or other animals …
The Food and Drug Administration (FDA) is charged with protecting American consumers by enforcing the Food, Drug and Cosmetic Act of 1938.
The FDA is located within DHHS:
$1 billion budget
Costs each American $3 / year.
Drugs, biologics and medical devices are among the $1 trillion worth of products regulated by the FDA.
Oversight over 1 in every 4 dollars spent by American Consumers
FDA Organization Department of Health & Human Services Food and Drug Administration Office of the Commissioner Center for Devices & Radiological Health Center for Biologics Evaluation & Research Office of Compliance Office of Device Evaluation
Ensures safety and effectiveness of medical devices, including diagnostic products, and requires manufacturers to register with the FDA
Introduced concept of premarket notifications, approvals, predicate devices, and performance standards.
Safe Medical Devices Act (SMDA), 1990
Requires reporting of any medical device causing or contributing to the death, serious illness, or injury of a patient
Requires manufacturers to conduct post-market surveillance of implanted devices.
Food and Drug Administration Modernization Act (FDAMA), 1997
Establishes framework for efficient premarket review. Changed device tracking, reporting, PMAs, 510(k)s, required FDA to identify recognized standards, and instituted new approaches to labeling claims and intended uses.
Medical Device Fee and Modernization Act, 2002
Allows FDA to collect fees to review medical device submissions
Each person who proposes to begin delivery for introduction into interstate commerce for commercial distribution of a device intended for human use shall, at least ninety days before making such introduction or delivery, report to the Secretary (in such form and manner as the Secretary shall by regulation prescribe) –
(1) the class in which the device is classified
(2) action taken by such person to comply with requirements applicable to the device
Courtesy of Dan Olivier, Certified Software Solutions, Inc.
The FDA describes a standalone medical software device as software that is neither a component nor an accessory which “is intended to receive medically related data as input and to output (relay) the results to a health care practitioner or other user.” 
Examples of standalone software devices include:
software that records medical information for later recall, analysis or action by a health care practitioner, or
software designed to assist a health care practitioner in arriving at a diagnosis of a particular patient. 
 FDA Software Policy Workshop, FDA Regulation of Medical Device Software – Background Information, Points for Discussion, p. 3, August 28, 1995.
“ Without documentation of the existence of quality processes and the verification that the processes are executed during product development, new healthcare products will not gain approval in the United States or be able to be sold in major overseas markets.” E. Whitmore, Development of FDA-Regulated Medical Products, American Society for Quality, 2004.
FDA’s management responsibility is more clearly defined and specific than ISO 9000.
ISO 9000 has no requirements for failure reporting, recall, safety or effectiveness.
FDA has limited control over the Personnel, Finance, Sales, and Marketing departments
ISO 9000 expects these to be fully controlled
Are Telehealth Programs becoming unintentional manufacturers of Medical Devices? Any person who connects external equipment to signal input and signal output parts or other connectors has formed a system and is therefore responsible for the system to comply with the requirements of IEC 601-1-1. Text from a Users Manual