Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

FDA Regulation of Mobile Health


Published on

It can come as a bit of a shock to people in the
consumer electronics, IT and telecommunications
industries that FDA might regulate certain equipment like cell phones that companies are planning to put at the center of connected health services. My goal is to outline the factors that FDA considers when deciding whether to regulate such equipment.

Published in: Business, Health & Medicine
  • Be the first to comment

FDA Regulation of Mobile Health

  1. 1. FDA REGULATION OF MOBILE HEALTH mobi health news© Copyright June 2010 Chester Street Publishing, Inc. All Rights Reserved.
  2. 2. Contents 1 About the Author 2 Letter from the Editor 3 FDA May Regulate Certain Mobile Phones, Accessories 6 Step-by-step: FDA wireless health regulation10 How to get FDA to clear a mobile health appI7 Should mHealth companies want FDA regulation?22 How to Avoid mHealth Regulation29 Washington signals possible FDA regulation of mHealth32 Will the FDA regulate mHealth care providers?37 The Dynamic Future of FDA Regulation of mHealth
  3. 3. About the Author Bradley Merrill Thompson Bradley Merrill Thompson is a shareholder in the law firm of Epstein Becker & Green, P.C. There he counsels medical device and other life science companies on a wide range of FDA regulatory, reimbursement and clinical trial issues. At the firm, Mr. Thompson leads the Medical Device Regulatory Practice, the Clinical Trials Practice and the Connected Health Practice, and serves on the firm’s Health & Life Sciences Steering Committee. For trade associations, Mr. Thompson has served as counsel to AdvaMed for payment issues, as General Counsel to the Combination Products Coalition, and for 17 years as General Counsel and Secretary for the Indiana Medical Device Manufacturers Council. Connected Health Practice: In EBG’s Connected Health Practice, Mr. Thompson focuses on the federal regulatory requirements—FDA, reimbursement, privacy and others—that impact remote monitoring, mobile health, HIT and device interoperability. The firm’s Connected Health Practice brings together a multidisciplinary team of attorneys and consultants trained and experienced in Medicare and private insurance payment, regulatory, scientific, IT, clinical, and security disciplines. Mr. Thompson serves as outside counsel to Continua Health Alliance, conducts educational programs on connected health regulation and blogs for Teaching, Writing and Serving: Mr. Thompson has taught food & drug law at Indiana University School of Law- Indianapolis and Columbia Law School. He also serves on the editorial boards for Medical Device & Diagnostic Industry (1993-present), Food & Drug Law Journal (2007 – present) and BNA’s Medical Device Law & Industry Report (2007-present) Mr. Thompson also serves as Co-Chair of the Food & Drug Law Committee of the Administrative Law Section of the American Bar Association, and as Chair of the Medical Device Committee of FDLI. Mr. Thompson has written extensively on the topics of medical device regulation, including a book entitled FDA’s Regulation of Medical Devices (Interpharm Press, 1995). He has co-authored chapters in “Off-Label Communications: A Guide to Sales and Marketing Compliance” published by FDLI (2008-2009) and in a book entitled “Guide to Medicare Coverage Decision- making and Appeals” published by the American Bar Association (2002). Honors: Mr. Thompson was included in 100 Notable People in the Medical Device Industry (Medical Device & Diagnostics Industry, June 2004), has earned an AV rating in Martindale Hubble (its highest rating), has been named a “SuperLawyer” in Indiana, has been elected as a Fellow in the American Bar Foundation and is listed in Chambers USA: A Guide to America’s Leading Business Lawyers. Education: Mr. Thompson received his B.A. cum laude, and an M.B.A. from the University of Illinois and his J.D. cum laude from the University of Michigan Law School. Page 1
  4. 4. Letter from the Editor One morning last summer I got my first email from Brad. He wrote that he and a couple of colleagues had just conducted a day-long seminar on regulatory topics for the Vancouver gathering of the Continua Health Alliance. One session was a case study of FDA regulation of a mobile health platform. “Is that the kind of topic that interests you?” Brad had asked. For the next year -- about every six weeks -- I would receive the latest chapter in Brad’s FDA regulation series. It pulled from FDA workshop meetings, political speeches, questions posed by mHealth luminaries, and Brad’s vast wealth of knowledge regarding FDA policies. Brad’s series of articles quickly proved to be the some of the most talked about features published in MobiHealthNews’ weekly newsletter. At Brad’s request, and with great pleasure, we at MobiHealthnews have compiled the series on mHealth regulation into this free special report for our readers. I am confident it will quickly become a seminal text for the budding mobile health industry. Our heartfelt thanks to Brad for taking the time to provide direction for navigating these otherwise murky regulatory waters. Brian Dolan Editor, MobiHealthNews mobi health newsPage 2
  5. 5. I. FDA May Regulate Certain Mobile Phones, AccessoriesIt can come as a bit of a shock to people in theconsumer electronics, IT and telecommunicationsindustries that FDA might regulate certain equipmentlike cell phones that companies are planning to put atthe center of connected health services. My goal is tooutline the factors that FDA considers when decidingwhether to regulate such equipment.Defining a medical device Components Vs. AccessoriesThe natural place to start is with the definition of a In the area of mobile health technology, it’s importantmedical device. Since it is so central to the analysis, to understand that an accessory or a component ofI’m going to quote the statute verbatim. Section 201(h) a medical device is itself a regulated medical device.of the Federal Food, Drug, and Cosmetic Act defines a Further, the difference between an accessory and amedical device as: component is who buys it. End-users buy accessories, while manufacturers buy components. Thus the exact“… an instrument, apparatus, implement, machine, same piece of equipment could be either an accessorycontrivance, implant, in vitro reagent, or other similar or a component depending on the target purchaser.or related article, including any component, part, oraccessory, which is … [either] intended for use in That makes a big difference in terms of applicablethe diagnosis of disease or other conditions, or in the regulatory requirements. Components are exemptcure, mitigation, treatment, or prevention of disease, from most FDA regulatory requirements, with thein man or other animals … [or] intended to affect the regulatory burdens being borne by the finishedstructure or any function of the body of man or other device manufacturer. Accessories, on the other hand,animals.” since they go right to the end user, must meet the FDA requirements before they leave the hands ofSo at a high-level, we look for two things: (1) a device the accessory manufacturer. These differences arewith (2) a medical intended use. The first prong of summarized in Figure 1 on the next page.the test — that there must be an actual product —means FDA doesn’t regulate, for example, medical The level of regulation imposed by FDA on accessoriesprocedures. The thing in question must be a thing, and and components is determined by the parent device tonot information or something else intangible. Software which they relate. So if the accessory relates to a highcan be a medical device if it’s written on computer risk device, say an implantable cardiac defibrillator, itmedia, as opposed to printed on paper. The media will be subject to a high level of regulation even if thewith the code written on it is enough of a “thing” for accessory is relatively benign in and of itself.FDA to regulate. Page 3
  6. 6. Having decided that the product meets the “thing” Columbia Law School, and I generally begin thetest, determining the intended use of the article can be session by taking out a popsicle stick. To employ amuch more difficult. As a preliminary matter, in the case study, I tell the students that I’m the CEO of adefinition above you can see that the so-called medical company that makes these sticks, and I want to knowuses are very broad, and include some conditions whether I have to comply with FDA regulations. Atpeople may not ordinarily consider medical. For that point I encourage them to ask questions of me inexample, equipment used for exercise could become my hypothetical role as CEO, and then ultimately toa medical device if the claims take on more of a advise me.therapeutic nature instead of simply suggesting If they have done their homework, they will startgeneral fitness. So if the piece of fitness equipment to ask me how I promote the stick. In my answers,is specifically advocated for use in the treatment of I’m pretty coy at first, simply explaining that I sellobesity or rehabilitation of cardiac patients, it can sticks and what my customers do with them is theirbecome a medical device. Further, the definition is not business. I explain that my labeling for the productlimited to disease, but also relates to articles that affect merely identifies the product as a stick without goingthe structure or function of the body (for example, into its possible uses.pregnancy). Moreover, devices that merely monitora body function, with no therapeutic effect, can fall Hopefully my students have read enough to knowinto the device category if the intended use suggests a that the regulations define “intended use” as: “thehealth-related purpose. objective intent of the persons legally responsible for the labeling of devices. The intent is determined by such persons’ expressions or may be shown by the circumstances surrounding the distribution ofDetermining “intended use” the article. This objective intent may, for example, be shown by labeling claims, advertising matter, orFiguring out the actual intended use of the article oral or written statements by such persons or theirdepends entirely on the facts. I teach this topic at representatives. It may be shown by the circumstancesFigure 1. Types of Devices Finished Stand alone Device Accessory Component A medical device in finished form, An article intended for use in or An article intended for use in or Definition ready to use perhaps with with a finished medical device, with a finished medical device, accessories, intended for sale to intended for use by the end user intended for use by a the end user manufacturer FDA Clearance Yes, unless exempt Yes, unless exempt No required? GMPs No, but quality must satisfy Yes, unless exempt Yes, unless exempt required? finished device manufacturerPage 4
  7. 7. that the article is, with the knowledge of such personsor their representatives, offered and used for a purposefor which it is neither labeled nor advertised. …” Sowhat I say in my labeling is not the last word, butultimately what matters is the totality of what I havedone to promote the article and to some extent what Iknow about how my customers are using it.Eventually my students start asking me about what If it is a medical device, what next?trade shows I attend, what types of magazines I useto advertise the sticks, what my salesmen say to This analysis only answers the threshold question ofcustomers, and what I know about the actual usages of whether an article is a medical device. If it turns outthe sticks. And it turns out, in my hypothetical, I know to be a regulated article, a second step is to figure outthat many of my customers are using them as pediatric the degree of that regulation. A fair number of medicaltongue depressors, I promote them in advertisements devices are exempt from FDA premarket clearance,in hospital journals, and at least some of my salesmen and others are exempt from the obligation to employmight encourage their use as tongue depressors. So good manufacturing practices. The risks associatedeventually my students come to the view that my with the intended use determine the level of regulatorysimple popsicle sticks might in fact qualify as medical requirements, including validation and other designdevices and be subject to FDA regulation. rigor that FDA would require.Advice for wireless health start-ups Not the end of the worldCompanies engaged in making mobile phones (or Merely being a medical device is by no meansrelated articles or software apps) need to go through the end of the world, just the starting point forthe same analysis to figure out if they are selling the analysis. Companies need to be mindfulmedical devices. They need to look first and foremost of these consequences as they develop theirto the labeling and other promotional materials they promotional programs for hardware anduse, but then also consider how they promote the software in this mobile health space. FDA isproducts. In this regard, it’s important to remember almost certainly looking.that we’re looking for either an intended use directlyas a medical device, or an intended use as an accessoryto a medical device. It’s more likely a cell phone orrelated software might end up as a regulated accessory,than a stand alone medical device. Page 5
  8. 8. II. Step-by-step: FDA wireless health regulationIn the last chapter I outlined the triggers that could of the orthopedic devices, for example, are in one partcause an ordinary mobile phone to become an FDA- of the regulations. So you might get lucky and find oneregulated medical mobile phone. In this chapter I will that directly describes your product. A quick searchoutline the FDA requirements that would apply to a of the regulations revealed that the word “computer”mobile phone that crosses that line. appears in 225 regulations, “software” in 431 and “network” in 43. There is, for example, a classification To summarize the last chapter “FDA may regulate for remote medication management systems in 21 certain mobile phones, accessories”, a mobile CFR 880.6315. phone could become a regulated medical device if the manufacturer, through its words and deeds, But if you can’t find one that directly describes your conveys an intention that the phone be used product, perhaps it’s because FDA considers your in medical applications. I also pointed out that product to be merely an accessory to a “parent” medical devices come in at least three different device. I’ll give you an example. In 2009 FDA cleared flavors: (1) standalone medical devices, (2) an updated version of the Polytel glucose meter accessories and (3) components to such devices. accessory, which is a small module that plugs into the port of a glucose meter, receives data from the meter and transfers it wirelessly to an Internet capablePremarket clearance or approval communication device like a cell phone or an APT. In clearing the device, FDA agreed with its classificationIn contrast to components that are simply sold to in 21 CFR 862.1345, which covers all glucose testanother manufacturer, standalone medical devices and systems, including the “parent” glucose meters.accessories sold to end users may require some formof premarket clearance or approval. Once you know Step two. Read the second half of theyou have an FDA-regulated device or accessory, here’s classification regulation to see how FDAhow you figure that out, following a five-step process. regulates that particular article. Step one. Figure out the most appropriate FDA will assign each product into one of three classification for your product. classifications, cleverly called class I, II and III. Class I devices represent the least risk, while classThere is a bit of both art and science to this. FDA III represent the greatest. Associated with thosehas published about 1700 classification regulations. classifications are specific regulatory requirements.Each of those regulations has a description or Many class I devices will be exempt from premarket“identification” of the types of devices covered by that clearance, and some products will be exempt fromregulation. FDA has a searchable database of these other regulatory requirements that I’ll describe in aregulations accessible through their website. minute. Some class I and most class II devices require filing a premarket notification (or 510(k)) with FDA.Some articles of hardware and software are so These submissions are manageable documents thatimportant that FDA has separately classified them, compare the new device to those lawfully on theand you can find them directly through searching. The market. The specific data requirements are discussedregulations are organized by clinical application so all below.Page 6
  9. 9. The highest risk devices-class III-usually requirepremarket approval (PMA) from FDA, which can Step four. Consider your options.cost millions. Most IT devices can avoid that, unlessthey are an accessory to a high risk device. If your Even once you know how a device is classified and thedevice is classified as an accessory, it is subject to all of specific regulatory requirements, you may well havethe regulatory requirements applicable to the parent options for how you get marketing clearance. Let’s saydevice. your device is in class II, and some sort of premarket notification or so-called 510(k) is required. 510(k)s Step three. Research the requirements. come in lots of different flavors, including traditional, special and abbreviated. For some, as an alternativeFDA has published scads of guidance documents to filing at the FDA, you can seek to have your deviceon its website that cover many different aspects of reviewed by an independent third-party who thenthe technologies they regulate. There are guidance certifies its review to the FDA. Going through each ofdocuments on using wireless technologies, off-the- those options is beyond the scope of this article, butshelf software, and specific medical technologies such it’s important to understand that you have options. Ias blood glucose meters. It’s important you find all of have tried to illustrate the major options inthese so-called “special controls” because you’ll need Diagram 1 make sure that your product complies with thosetechnical standards.Diagram 1. Some Major Pathways to Market for IT Devices Is it a device or an Unregulated Petition for accessory to a by FDA Re-classi cation device? No yes de novo 510(k) It is PMA Does a classi cation automatically regulation cover it? Not Class III Covered Traditional 510(k) Covered Special 510(k) Exempt What options are Abbreviated 510(k) available for gaining 510(k) marketing clearance 510(k) or approval? 3rd Party Review PMA Page 7
  10. 10. Step five. Determine the type of evidence needed for FDA clearance.Even more choices need to be made here. The amount In addition to the premarket clearance or approvaland type of data needed to secure approval depends question, devices must comply with other FDAdirectly on the types of claims you want to make. In requirements, as described in the next section.many cases, you might have the option to merely makea “tool” claim: a claim that your product simply doesa specific function. In the accessory example I gaveabove regarding the Polytel product, the company Quality system requirementsmakes a tool claim that its article merely connects onemedical device to the Internet. The other big hurdle is ensuring compliance with the quality system regulations. As the name suggests, theseYou might also wish to make an outcome type claim: requirements are focused on ensuring manufacturersa claim that your device will help treat or diagnose a produce quality products commensurate with thespecific disease or condition. For example: “Using this risks associated with using the device. So the exactdevice to transmit your blood glucose readings to your nature of the quality system will depend on thephysician typically allows for better control of diabetes intended use of the article. For companies that are ISOand will help you wean yourself of dependency on 13485 certified, becoming compliant with the qualityinsulin.” system regulations is mostly a matter of creating documentation systems so that you can prove yourThe types of data you need to provide FDA will compliance. More substantial changes are required ifdepend on which type of claim you make and indeed the company is only ISO 9001 certified.on the exact wording of the claim. Typically, you couldsupport a tool type claim with bench testing or other These quality system regulations apply cradle-to-grave,non-clinical evaluation. Basically you need to prove so the minute you begin the design process, the designthat your tool works. If you choose to make outcome- controls must be observed. Design Controls specifybased claims, you’ll need to prove that the device the process used and the records to be created duringindeed achieves those outcomes. That’s much harder, the design, development, and manufacturing scale-and requires testing in a clinical setting. up of a device. They extend all the way to postmarket issues such as complaint handling, risk management,If you are following the 510(k) pathway, the and failure analysis and feedback to the design andfundamental standard is whether your device is manufacturing organizations.substantially equivalent to other lawful devices. Somost submissions follow a comparative format where In the medical device world, component suppliersthe submitter compares his device to others in the are exempt from these regulatory requirementsmarketplace. (though sometimes they are contractually required).Page 8
  11. 11. That doesn’t mean the components need not be high Other regulatory requirementsquality, but rather it means that the finished devicemanufacturer has the regulatory burden of assuring FDA has a variety of other requirements thatthe quality of the components it uses. While this may apply, including such things as registeringcould mean incoming inspections of raw materials, manufacturing facilities, listing the productscomponents and subassemblies, it more often means manufactured, specific requirements for investigatingthat a device manufacturer must apply all necessary the safety and effectiveness of an unapproved device,controls on a supplier-by-supplier basis to make sure export and import restrictions, and labeling andthat any controls the supplier is missing, the device advertising requirements. FDA also has a variety ofmanufacturer provides. requirements that apply to postmarket distribution to ensure that products can be identified and traced back.Adverse event reportingAs kind of a belt and suspenders, in addition to From hererequiring premarket review of the product andimposing quality system requirements, FDA expects There is no doubt that these requirements cancompanies to be vigilant for reports of people getting be quite burdensome. But to state the obvious,hurt or products malfunctioning. In some cases thousands of companies have found it possiblethose incidents might rise to the level of needing to and worthwhile to enter the medical devicebe reported to FDA. These so-called Medical Device realm. In the coming chapters, I will explore theReports are time sensitive (an assessment is due in a unique aspects of FDA regulation of software,matter of days or weeks), and require the company a business assessment of whether entering theto have in place systems for reviewing all relevant FDA-regulated realm is worthwhile, optionsincoming information to assess the potential of each for staying out of regulated territory, and somereport to be categorized as an Adverse Event. If the thoughts on where future FDA regulation couldcompany decides to take corrective action, in some go in this space.cases the company needs to notify FDA. Page 9
  12. 12. III. How to get FDA to clear a mobile health app(I would like to thank John Murray of FDA, ScottThiel of Roche Diagnostics and Russ Gray of theAnson Group for their comments on a draft of thischapter. The views expressed — right or wrong — areonly the author’s and should not be attributed to thecommenters.) Most people in the wireless health industry have heard by now that FDA has started to can be divided into three categories: (1) standalone clear applications for cell phones with medical devices, (2) accessories and (3) components. indications. A widely-reported example is AirStrip Standalone are those devices that are intended to OB, cleared to deliver patient waveform data — directly provide the diagnostic or treatment, while including fetal heartbeat and maternal contraction accessories are sold directly to end-users and work patterns — in virtual real-time directly from with standalone devices. Components, in contrast, the hospital labor and delivery unit to a doctor’s are purchased by manufacturers of standalone or mobile wireless device, specifically to an iPhone accessory devices for incorporation before sale. Mobile or a Blackberry. Other software developers are device (e.g. cell phone apps) can be an accessory, as probably interested to learn when FDA clearance opposed to a component, if they are sold or even given is required, and what it takes to accomplish that directly to the end-user: the patient. They can also FDA clearance. In this chapter, I’ll address both of be standalone if they do not connect physically or those questions at a high-level. virtually to any device other than the mobile device platform. In the first chapter I outlined the factors FDA considers generally when deciding which products Understanding that is important because determines need to be regulated and which fall outside of the the regulatory requirements that apply. If the app is scope of a medical device regulation. In Chapter designed, for example, to facilitate the downloading 2, I outlined the basic steps for getting a medical of information from a blood glucose meter, the device cleared by FDA. This chapter will focus on app and maybe even the software environment are the unique aspects of those two questions in the accessories and will be regulated in the same manner context of mobile device apps. as the blood glucose meter. The classification and most of the requirements for the submission to FDA will be dictated by how the parent standalone deviceSoftware Roles is regulated. So, the Airstrip OB app is regulated as part of a perinatal monitoring system generally, justFrom those two prior chapters, it’s important to as the sensors and other hardware that gather theremember that medical devices, including software, information.Page 10
  13. 13. Some apps will not be simply enablers of transmitting So the following is just my personal observationsdata from a medical device, but will actually serve about how FDA regulates software in practice, as Ia standalone purpose. From the prior two chapters, can glean from watching FDA enforcement actions,remember that it’s the claims the software developer/ podium policy, and the informal statements FDA hasseller choose to make, within reason, that triggers made in concept papers.FDA regulation in the first place, and the degree ofthat regulation when it comes to obtaining clearance.Once you properly figure out which of the three rolesthe software plays, you can figure out its regulatory Unregulated Softwarestatus. Typically that’s one of the following threechoices: In its explanation surrounding the agency’s proposed classification of Medical Device Data Systems published in 2008, FDA explains: Software that does NOT meet the legal It is FDA’s long-standing practice to not regulate those definition of a device and is not regulated by manual office functions that are simply automated FDA. for the ease of the user (e.g., office automation)… For example, the report-writing functions of a Software that does meet the legal definition of a device but is currently not actively computer system that allow for the manual (typewriter regulated, and FDA is unlikely to require like) input of data by practitioners would not be… pre-market review. [regulated] because these systems are not directly connected to a medical device. In addition, software Software that does meet the definition of a that merely performs library functions, such as device and FDA is actively regulating and storing, indexing, and retrieving information not would require a pre-market review. specific to an individual patient, is not considered to be a medical device. Examples include medical texts or the Physician’s Desk Reference on CD-ROM that are indexed and cross-referenced for ease of use.Except for a few specific exempt device typesidentified in the classification regulations, that middle FDA goes on to say it won’t regulate “software thatcategory isn’t today a regulatory classification you’ll allows a doctor to enter or store a patient’s healthfind defined in any FDA records. Fortunately or history in a computer file.” On its face, that descriptionunfortunately, depending on your perspective, FDA of unregulated software is somewhat narrowly written.has been very reluctant over the last dozen years to That is not surprising since FDA always takes andefine with any real precision its policy on which expansive view of its jurisdiction, and is not likely totypes of software must undergo premarket review and concede much ground in that regard.clearance, or even approval. The agency has held openpublic meetings and floated concept papers, and more Beyond that passage, I would add that there are tworecently has proposed a limited device classification key features for most unregulated software.for medical device data systems, but by and large hasnot with any certainty clarified its policy on when The data are entered manually; they are not inputtedsoftware trips the premarket requirement. directly from any machine that touches the patient Page 11
  14. 14. or a patient specimen. That’s important to avoidbecoming an accessory to a medical device.Depending on how inputted, the output amounts In that policy, there are two categories of softwaresimply to providing the stored data back to the patient products that were technically regulated but alsoor professional. The system does not automatically considered exempt from the major requirements:guide the diagnosis, nor does it guide any other (1) general purpose articles as defined in a regulationinstrument. In other words the software does not and (2) software that involves competent humancontain any algorithms that provide clinical-like intervention. Unfortunately FDA never got aroundfunctions that go beyond what FDA often refers to as to actually codifying the competent humanlibrary functions. It merely displays the data for the intervention exemption. In its classification process,user to read and interpret. FDA has adopted certain general purpose or low risk exemptions that cover software, such as laboratoryMany mobile device apps do indeed fit this category of information management systems (LIMS) (21 CFRunregulated software. But it is important to remember 862.2100) used as calculators or data processingto conduct an honest evaluation of the intended use modules for clinical use.of your product. The evaluation should focus on theclinical intended use of the product and less on the About 7 years after FDA published the 1989technical characteristics of your software or your draft policy, it appeared FDA was moving towardsystem. In FDA’s eyes, your software product does not formalizing its computer product policy. In additionhave to provide a complete cure, mitigation, treatment, to publicly announcing that intention, FDA hostedor prevention of disease to meet the legal definition a large meeting in Washington and invited manyof a device. If your software is intended to provide stakeholders to discuss what the policy should be. Inany part of cure, mitigation, treatment, or prevention preparing for that meeting, FDA drafted a summaryof disease, FDA will probably consider it a device. of what it considered to be its then existing policyUnderstanding the limits on the unregulated category on computer products. Those workshop materialsis probably best explained, though, by looking at the explained that much of the software the agency wasother two categories. seeing constituted accessories to medical devices, and the competent human intervention concept was only intended to apply to truly standalone software. The agency also argued that the conceptRegulated Software Exempt from of what constitutes competent human interventionPremarket Clearance had become increasingly complex and difficult to administer. FDA observed:Since the late 1980s, FDA has been publicly declaringthat there exists a category of software that technically In general, to permit competent human intervention,qualifies as a medical device but for which FDA has no the software decision process must be completelyintention of requiring the submission of a premarket clear to the user, with a reasonable opportunity fornotification or approval application. For those who challenging the results. There must also be adequateare really interested in this topic, it probably makes time available for reflection on the results.the most sense to start with the “FDA Policy for theRegulation of Computer Products, 11/13/89 Draft”.Page 12
  15. 15. But again, FDA never followed through to adopt a new This category is only available as an exemption fromregulation or policy. premarket clearance so long as the data set is intended for professional use and does not produce irreversibleIn early 2008, departing somewhat from the 1989 data compression.approach, FDA proposed a new category of softwarethat would fit within this general category of regulated Based on the following preamble from the proposedsoftware exempt from premarket clearance. They MDDS rule, I would suggest that through this processproposed to call the new category medical device data FDA is seriously rethinking its software (MDDS), and they defined it to include: Since 1989, the use of computer-based products and software-based products as medical devices has grown exponentially. In addition, device interconnectivity The electronic transfer or exchange of medical device data from a medical device, without and complexity have grown in ways that could altering the function or parameters of any not have been predicted in 1989. This growth connected devices. For example, this would and expansion have created new considerations include software that interrogates a ventilator for elements of risk that did not previously exist. every 15 minutes and transfers information FDA realized that the Draft Software Policy was about patient CO2 levels to a central patient not adequate to address all of the issues related to data repository; the regulation of computer based and software- The electronic storage and retrieval of medical based medical devices. Based on this history and device data, without altering the function or the complexity and diversity of computer software, parameters of connected devices. For example, FDA decided it would be impractical to prepare one this would include software that stores ‘‘software’’ or ‘‘computer’’ policy that would be able historical blood pressure information for later to address all the issues related to the regulation of review by a healthcare provider; computer- and software based medical devices. The electronic display of medical device data, without altering the function or parameters While FDA has proposed the MDDS category, as of of connected devices. For example, this would this writing the agency has not adopted it in final include software that displays the previously form. During the interim, however, it seems to be stored electrocardiogram for a particular the best guidance available for deciding whether a patient; premarket clearance is required. The electronic conversion of medical device data from one format to another format in accordance with a preset specification. For example, this would include software that Dividing Line Between Software converts digital data generated by a pulse Requiring Premarket Notification And Not oximeter into a digital format that can be printed. Examples of medical device data In defining medical device data systems, FDA was systems that would be used in the home are systems that periodically collect data from merely trying to define one relatively narrow, cohesive glucose meters or blood pressure devices for type of data set that the agency would regulate but later review by a healthcare provider. exempt from premarket notification. However, that is Page 13
  16. 16. only one example, and it is not meant in any way to The amount of time available before using thebe the only example of software that would be treated information provided by the medical softwareas regulated but exempt. Indeed my understanding device, i.e., the time until a therapeutic or additional diagnostic intervention must beis that the agency plans to publish future proposals implemented by the health care provider afterdefining other regulated – exempt and nonexempt– the results of the software have been provided.categories. Example: Is the device an EKG reading and analysis package whose output is “SHOCKBut what are software companies supposed to do in NOW” or does it provide a proposed readingthe meantime? What else fits within this regulated but with notation that the rhythm itself should beexempt category? The unfortunate answer is that this checked?represents a huge gray area. The best anyone can do Whether the data output is provided oris look at a variety of risk factors to figure out which manipulated in a novel or non-traditionalside of the premarket clearance line again a piece of manner, or whether decision trees within thesoftware falls. Based on FDA comments and actions software depart from customary use. Example:over the last 20 years, I would propose the following Do the system’s algorithms, parameters,list of factors be considered: internal decision trees, or other output manipulations depart from customary use or traditional data presentation? Whether the software is intended or Whether the medical software device provides designed to provide any real time, active, or individualized patient care recommendations, online patient monitoring functions. e.g., whether the software suggests or recommends specific treatment for a specific patient. Example: How specific is the software The capability to display, create, or detect output with regard to particular patients? alarm conditions, or actually sound an Is the software providing general advice or alarm, or the capability to create alarms information, like a library, article, or textbook, that are not already present from the or is the software designed to provide a specific connected medical devices. recommendation for a specific patient whose individual data have been entered as input? The seriousness of the particular disease or condition which the medical software Whether the mechanism by which the medical device is intended to diagnose, cure, software device arrives at a decision is hidden mitigate, treat or prevent and how or transparent, i.e., does the product use the software contributes to the user’s undisclosed parameters or internal decision decision-making for diagnosis or clinical trees or other mechanisms that are not management of the patient. Example: available for review by the health care provider. Is it software designed to call attention Example: How transparent is the software to imminent hazard conditions or is it manipulation to the intended user community? software that provides long-term storage Included in transparency is the extent to which for diagnostic information? limitations on the process are made known to the user, such as data contraction, deletion, editing, or simplification. Also, how are comparisons made to normative databases and how are normative databases created?Page 14
  17. 17. Does the product provide new capabilitiesor intended uses for the user?Until FDA decides to further clarify the middle meter and regulated to the same degree. As anothercategory of regulated but exempt from premarket example, if the app is designed to help with medicationnotification, a practical consideration of those factors management, there is a specific classification forshould help the company decide whether in FDA’s such software in 21 C.F.R. § Sec. 880.6315. This caneyes the software is risky enough to require premarket obviously get very complex in an interconnectedclearance. As I said, you won’t find that in any existing system, perhaps on a wireless network, but that’s tooFDA guidance or regulation. That’s just based on much for this report.practical observation. Usually in the context of clearing an app, FDA will check to ensure that the software manufacturer is complying with any published special controls. The special controls are typically stated in FDA guidanceSoftware Requiring FDA Pre-market documents and include, for example:ClearanceIn the second chapter, I outlined generally the Guidance for Industry – Wireless Medicalapproach for securing FDA clearance. In the case Telemetry Risks and Recommendationsof software, the first step is identifying the mostappropriate classification from among the roughly Guidance for Industry, FDA Reviewers and1700 classification regulations. The word software is Compliance on Off-The-Shelf Software Use incontained in 431 different regulations, so it’s not an Medical Deviceseasy task. General Principles of Software Validation;Remember that software that accessorizes a medical Final Guidance for Industry and FDA Staffdevice is classified with that medical device. So if a cellphone app allows for the downloading of blood glucose Guidance for the Content of Premarketdata, the app is classified with the blood glucose Submissions for Software Contained in Medical Devices Cybersecurity for Networked Medical Devices Containing Off-the-Shelf (OTS) Software Device-specific guidance (e.g. glucose monitors) Page 15
  18. 18. The submission will need to be based on an And of course, before you can actually bring theappropriate level of validation for the software. If the product to market, you will need to make sure thatapp is an accessory, the parent device determines your manufacturing meets the FDA requirementsthe level of validation required. If not an accessory, for quality systems. In the case of software, thoseto determine the validation required, you will need requirements are acutely felt in the development stageto figure out whether FDA classifies the software as as the software needs to be developed under special“major”, “moderate” or “minor” “level of concern.” FDA design controls and in the post-launch stage as the manufacturer deals with product recalls, updates, event reporting, product lifecycle management and so It’s major if the software directly affects the forth. patient or anyone else such that a failure could result in death or serious injury It’s moderate if the injuries would be non- serious Conclusion An app’s risk and the associated “level” determine: Those are the basic FDA requirements that apply to bringing an app or other piece of software to market in the mHealth field. the depth and degree of hazard analysis Undoubtedly, to those not accustomed to the and mitigation that is expected FDA regulated world, those hurdles might seem high. In the next chapter, we’ll tackle the the depth and degree of documentation benefits and burdens of going through those admittedly rigorous FDA requirements from a what needs to be submitted vs. merely business standpoint. In particular we’ll focus on documented the competitive advantages that can be derived from entering the regulated space, weighed the rigor applied to the verification and against the cost of achieving those advantages. validation of the software the degree to which the device manufacturer’s software development process is scrutinizedPage 16
  19. 19. IV. Should mHealth companies want FDA regulation?(I would like to thank Dr. Deepak Ayyagari of SharpLaboratories of America and Dane Stout of the AnsonGroup for their comments on a draft of this chapter. Theviews expressed, right or wrong, are only the author’sand should not be attributed to the commenters.) At the risk of insulting my new friends in Silicon of artificial restraints on competition, especially those Valley, I submit that traditionally-unregulated IT from the government. In the IT industry, cooperation companies may want to adopt a different view around the development of industry standards sets the of federal regulation. Over the last couple years, rules of engagement for the market, and then everyone I’ve had the opportunity to observe firsthand the competes intensely based on those rules and execution culture clash as free-spirited, libertarian Silicon of their business plan. Innovation can flourish, with Valley meets Rockville, Maryland, the home of the upstarts appearing and challenging big, established decidedly more buttoned-down U.S. Food & Drug companies’ dominance of any particular portion of Administration. Rather than fleeing in fear of the the business. The big companies accept it because they federal bureaucracy, I would argue that at least are moving aggressively too; adjacent markets can some IT companies should consider embracing be pretty attractive if it appears there is money to be federal regulators. Well, maybe start with at least made by offering a faster, better, cheaper alternative shaking hands. to the current market leaders. The goal of unrestricted competition is great, and undoubtedly benefits In the first chapter, I started off by explaining the customers in terms of producing products that they scope of FDA regulation, and then in the second want at the best possible prices. and third chapters explained how companies could comply with FDA regulation in the cell phone However, as IT companies consider entering the accessory and software app fields. With that basic health market, they need to appreciate the differences. framework behind us, in this chapter we will In traditional IT and telecommunications markets, explore the burdens and benefits of entering FDA if a product doesn’t work, such as a server crashing, regulated territory. Yes, I said benefits. people can become really annoyed when they can’t check their email from their mobile phone every second. Inconvenient and somewhat costly, for sure, but all will be forgiven once the server is back upIt’s Okay to Consider the Benefits of and running. If it happens with any frequency, theFederal Regulation Limiting Competition company that produced the technology will get a reputation for poor reliability, and may go out ofAs I’ve learned recently working with Silicon Valley business.companies, IT companies generally seem to lovenothing more than a good, competitive, bare-knuckled But companies in the health space that producefight with their competitors, and abhor the first hint products, using many of the same components as Page 17
  20. 20. what goes into the email server, face a much different space affects both the company’s cost structure andproblem set. If their product doesn’t work consistently opportunities to earn a higher return. For a specificand reliably, they can hurt people, or even cause company, this would require a fairly detailed analysis,their deaths. So we don’t, and can’t, rely simply on but let me provide you with an overview here.competition to weed out the good from the bad. To conduct this analysis, I’ve chosen the competitiveInstead, we regulate them. strategy framework developed by Prof. Michael Porter at the Harvard Business School. It’s familiarThat’s more than just a legal framework: that’s a to many and reasonably well-suited to assessing thephilosophy for how the marketplace in health works. impact of a regulatory scheme on a business. In aYou can think of federal regulation as just a bunch of pair of roughly 500 page books, Prof. Porter detailshealth and safety laws that prescriptively require that an entire methodology for considering a company’syou do this and not do that, but it’s more accurate to strategic options in light of the markets and businessthink about federal regulation as saying we only want environment in which they operate. I’ll focus on twocompanies willing to invest the significant resources tools he uses in his analysis.required to get the product right the first time theyenter the market, and to take the risk of failure tomeet high standards of safety and effectiveness. FDA Regulatory Impact on the ValueTo put it in business school terms, federal regulation Chainamounts to a significant barrier to entry for the healthmarkets. And that is quite deliberate. FDA law means In his value chain tool, Prof. Porter focuses on thedon’t enter this business unless you’re willing to do individual firm, and how the firm creates value. Init right. And, as classic economic theory suggests, Diagram 1 below, Prof. Porter shows conceptuallycompanies that are willing and able to invest the along the bottom the sequence of steps necessaryadditional resources required and take greater risk to produce a product, and in the rows at the top theget rewarded with greater return. That’s as it should overhead necessary for the firm to, to protect the public from unsafe protects and tofurther the public health by encouraging companiesto invest in medical innovation. In that later regard,FDA law rewards innovation in a manner similar to Diagram 1. Value Chain Activitiesthe patent laws. We simply do not want all companiesto be able to make health care products. We choose to firm infrastructureimpose much higher standards in that field, and for human resource management m arcompanies willing and able to meet those standards gi technological development nwe allow them to earn a potentially higher return. procurement service operations marketing outbound & sales n logistics inbound logisticsBenefits and Burdens of FDA Regulation gi ar mLet’s bring it down from the 100,000 ft. view and getmore specific about how entering FDA-regulated source: Michael Porter, competitive advantagePage 18
  21. 21. The specific activities that the company selects to FDA Approval. One of the most challenging stepsengage in directly determine its profit margin. Certain of FDA regulation is securing premarket clearanceactivities are high-value and produce higher margins, or approval; there is no “beta testing” allowed inwhile others not surprisingly are lower. A firm’s healthcare. You can’t offer someone the chance to signcompetitive advantage derives from its ability to select up for a discount if they help you test the product firstand execute the most highly value-added functions. to see if it works as you intended. For an innovative device, that requires substantial effort to design andMuch more could be said, but let’s move on to look then test the device to ensure that it meets its intendedat how FDA regulation impacts the value chain. use safely and effectively, and perhaps highly regulatedTo convey this impact at a high-level, I’ve drawn clinical trials. In the diagram, I suggest that the effectsthe intensity map included as Diagram 2 below. of this requirement are felt as a part of validation andTo understand an intensity map, think National design controls, as well as in the regulation of theGeographic magazine and a map showing population claims that can be made.density through colors. I’ve borrowed that approachhere to show the intensity of FDA regulation on each Marketing regulation. In addition to FDA rulesof the different elements of the value chain analysis. regarding securing approval of specific claims, other federal and state regulators impose stringentThis is a bit subjective, so others might disagree. I also requirements on the marketing function. Thusmade an assumption that the company has a basic ISO federal regulation is perhaps most intensely felt in9001 type quality system already. the marketing function of the company. Again, this will feel quite foreign in Silicon Valley, where battlesHere’s how I came up with the intensities depicted. between “Marketectures” wage almost daily. “Cloud”Diagram 2. FDA impact on value chain activities Validation firm infrastructure FDA requirements will be very similar to ISO Training human resource management m systems ar gi technological development Design Controls n procurement Supplier Controls FDA requirements will be more stringent Complaints Quality Controls service and Purchasing Validations In Process Regulation operations marketing Shipping outbound controls & sales Claims n logistics AEs inbound logistics FDA requirements gi ar will be far more m demanding than ISO Page 19
  22. 22. pitches regulated by FDA would require detailed In their analysis of the opportunity health marketsatmospheric reporting of the composite gases in the present, many companies go no further than, as well as an accurate forecast of how the cloud But this is exactly where some companies shouldwill impact the weather, good or bad. persevere in their assessments, and consider the dynamics of the medical device market place.In the postmarket servicing function, companies inthe medical device field must adopt systems designedto vigilantly watch for and report any problems,and take perhaps significant corrective action when FDA Regulatory Impact on Competitiveproblems arise. ForcesIn the quality system area, companies that are certified In Diagram 3 below, Prof. Porter depicts the fiveto ISO standards will have the most new work to do in forces that in his model drive the industry dynamics.the design control and validation areas. Those five forces include:In the modest impact category, the quality system 1. The threat that new companies will enterrequirements will require that the device manufacturer the markettake greater measures to assure the quality of inputs 2. The threat that new products will becomebeing supplied. This will include periodic auditing of substitutes for the marketed productssuppliers to ensure their systems are robust enough.The wide spread decision to outsource and off-shore 3. The bargaining power of supplierscustomer service functions, prevalent in IT, wouldhave to be considered in light of these requirements. 4. The bargaining power of customersThey could still be done, but doing so could takelonger, be more involved, and actually end up costing 5. The competitive rivalry within the industry itself.more than keeping it in-house. Diagram 3. Five Forces: Impact of FDA RegulationThe changes necessary in the actual production of theproducts are perhaps least burdensome for a companythat is ISO compliant. threat of newIn general, all of those measures: entrants Impose added cost. Lengthen lead times in product development. bargaining bargaining power of competitive power of suppliers rivalry Add complexity. buyers Can be difficult to implement from a cultural standpoint for a company unaccustomed to that environment because they require threat of discipline and rigor. substitute products And of course multiply the paperwork.Page 20
  23. 23. The degrees of those threats and powers determine the ability of the company to earn a profit. With regardto the threat that new companies will enter the market, Prof. Porter identifies several barriers to entry, andone of them is government policy or regulation.Assessing the five competitive forces, in some cases the analysis reveals some interesting opportunities. Indiagram 3, again using an intensity map where darker yellow represents more competition, I suggest whereI perceive the greatest sources of competition to reside for the medical device industry generally.In the industries regulated by FDA, the greatest competition tends to be from established firms in thesame industry. This is true for the simple reason that entering the regulated industry often requires a verysignificant investment to create the innovations and establish the manufacturing systems necessary toproduce them, as well as considerable lead time to get through the FDA clearance or approval process.Thus the threat of new entrants is lower than the competition created by existing firms that have well-established systems in place for bringing new regulated products to market. Indeed a company’s ability tocope with the regulated environment becomes a key asset, determining competitive advantage.There is an important limitation to this, however. Companies that follow the premarket clearance route,if they don’t have patent or other intellectual property protection for their products, might find thatother established device companies can quickly follow them through the FDA clearance process. This issometimes referred to as a first mover disadvantage. Further, the laws administered by the FDA do notcreate any private cause of action that an individual company can use to force competitors to abide by thelaw. FDA is solely responsible for enforcement of its laws, and if the agency isn’t paying attention or simplydoesn’t have the needed resources, less reputable competitors might get away with taking shortcuts. Page 21
  24. 24. V. How to Avoid mHealth Regulation Strategies for mHealth Companies Wishing to Avoid FDA Regulation(I would like to thank Leah Kendall ofEpsteinBeckerGreen and Dane Stout of the AnsonGroup for their comments on a draft of this chapter.The views expressed, right or wrong, are only theauthor’s and should not be attributed to anyone else.) Most people know the difference between tax think of it as all or nothing. In other words, a company avoidance and tax evasion. Tax avoidance is is either a manufacturer of medical devices and subject the lawful planning of such things as charitable to the full panoply of FDA requirements, or they’re not contributions to minimize taxes, while tax evasion and likewise are not subject to any FDA restrictions. is the unlawful and usually deceitful actions taken But that’s not an accurate depiction. to hide income. In this chapter, I will share some tips for the avoidance of FDA regulation, not the Instead, companies should think of FDA regulation as evasion of FDA regulation. a continuum. Diagram 1 on the next page illustrates the two extremes and a few of the cases in between. The first three chapters in this report dealt with understanding the scope and nature of FDA On the far right side, the diagram depicts the regulation for mHealth, and the fourth chapter traditional manufacturer of finished medical devices advanced the notion that IT companies wanting to that is indeed subject to all of the FDA requirements make money in health ought to consider entering for medical devices. Even here, though, there are the FDA-regulated zone. Nonetheless, subjecting different levels of FDA requirements depending on the your company to FDA regulation is not for novelty and risk associated with a particular device. As everyone, so this chapter is designed to help those outlined in the second chapter, devices are classified who have decided to stay out of the production into three different classifications, and the types and of FDA-regulated finished medical devices. In burdens of FDA regulations vary considerably. Class particular, I explain four ways to connect to health III medical devices include such things as pacemakers, markets, and the pluses and minuses of each such embody the greatest risk and thus must meet the most approach. demanding requirements. Class I devices include such things as tongue depressors and have very minimal FDA requirements. Indeed, most class I devices do not even need to be approved by FDA, and the quality system requirements might be very basic. ManyThe Binary Misunderstanding mHealth devices might fall into class I or class II. All of this was covered in much greater detail in theSome IT companies new to the health field seem to second chapter in this report.misunderstand the nature of FDA regulation, andPage 22
  25. 25. Four Ways to Connect to The Health Market While Reducing or Avoiding FDA Requirements Before I go through the four strategies, it probably goes without saying that each one is predicated onOn the far left side, the diagram includes unregulated the company fully implementing the strategy in goodarticles such as personal computers that contain no faith. Anything less potentially becomes FDA lawmedical references at all and over which FDA has no evasion, rather than avoidance. Okay, so here they are:regulatory authority. It’s the stuff in the middle that isinteresting for mHealth purposes. Strategy 1: avoid medical devices and theirThe cases in the middle include, for example, accessories.companies that merely make components for othersto use in manufacturing medical devices, distributors About now you’re wondering whether this article isof finished product that have no control over the worth reading, but stick with me for a second, there’spromotional claims or the design specifications of the a more subtle and profound observation to be made.device, and contract manufacturers that make finished In your mind, go back to the very first chapter on themedical devices at the direction of another company. scope of FDA regulation. I went through an exampleThese different functional responsibilities all have of a stick, and how it could be either a popsicle sticknarrower sets of FDA requirements that apply to them, or a pediatric tongue depressor, depending on whatdirectly or indirectly. It’s important to understand the claims the company chooses to make. My point isrange of possible relationships before talking about that in many cases, the design of the product doesways to reduce or avoid FDA requirements, and not determine its regulatory status, but rather theexactly what that means. promotional claims determine its status. So if yourDiagram 1. Continuum of Potential Involvement in the Device Industry 1 2 3 4 5 6 7 8 No FDA Good Full FDA Reach Distribution Full FDA Compliance Practices & Compliance 510(k) Inspections Marketing Full FDA by Finished Compliance Full FDA GMP Compliance Device Compliance But Often MFR Compliance PMA Exempt Finished Component Contract Finished Class I And Kit Part rt Medical Class III Medical Suppliers Device Finished Medical Device MFR Medical Device MFR Unregulated Medical Device Finished MFR Article Device MFR Class II MFR Distributors, That uses Medical Retailers Contractors for Device & Servicers Compliance MFR Page 23
  26. 26. company can reach its commercial objectives without A number of startups in mHealth have come up withmedical claims, and if the product has legitimate and very innovative business plans that put them squarelymaterial nonmedical uses, you might be able to avoid in the gray area between medical and nonmedicalFDA regulation by avoiding medical claims. intended uses. For example, there are companies developing strategies for remote monitoring of people,A simple cell phone provides another example. A rather than their disease or condition. There arecell phone can be promoted merely as a cell phone, gray areas between wellness programs and diseaseand no FDA compliance issues will arise. But if the programs where FDA needs to give industry clearermanufacturer of the cell phone starts to make claims guidance. Obesity, as a disease, is often difficult tothat the phone is suitable specifically for healthcare distinguish from general physical conditioning.applications, the cell phone manufacturer runs the Unfortunately, I suspect we will all need to feel ourvery real risk of turning its simple phone into a way along in the dark for the time being.regulated medical device. Finally, to employ this strategy, the maker of theRemember from the first chapter that the equipment must be duly diligent in avoiding makingmanufacturer might get into trouble making claims medical claims. That means it needs to have somethat its product is specifically intended to accompany a level of compliance and training systems in place tomedical device. That may very well make the product ensure, for example, that sales representatives do notan accessory to the medical device, which makes go rogue. Even unauthorized sales activity can comeit a regulated device. Again, claims are pivotal in back to haunt the company if the government decidesdetermining whether something is an accessory or that the company wasn’t careful enough in managingnot. its people.In the last couple years as I’ve been watching what’scoming out of Silicon Valley, I’m seeing a tremendous Strategy 2: avoid controlling the productnumber of hardware and software products that specifications or the claims made.probably could be sold as unregulated articles, butwhere the manufacturer, possibly quite inadvertently, Most FDA requirements, including the need to obtainis making claims that would cause FDA to regulate FDA clearance or approval, and the responsibility forthem. FDA is stretched pretty thin these days, so reporting adverse experiences fall on the companythey aren’t watching everything coming out of the IT that owns and controls the product specifications andindustry, but someday I suspect FDA will get more the claims made. Because most of the risk of a medicalactive in this space. device stems from its design and the claims made about it, whoever controls those two features has mostThere are limits to this strategy. I can’t make a of the FDA compliance responsibilities. So, if you don’tpacemaker, for example, and try to pass it off as a want those responsibilities, don’t own or control thosesimple, generic piece of electrical equipment. In two features of the device.designing the pacemaker, I’ve done too much to makethe design specific to a medical use to later disclaim Some examples probably would help. In most cases, athat use. Remember intended use is judged by contract manufacturer does not control the productwords, actions, and in some cases, inaction. If you’re specifications or the claims made about the product.interested in this strategy, you ought to go back and That’s true even if the contract manufacturer producesreview the first chapter of this report. finished product and drop ships it to the ultimatePage 24
  27. 27. purchaser on behalf of the specification owner. In discussed. Even though the article is a finished one,that case, FDA looks to the specification owner for if it is bundled together with another product beforecompliance with most of the agency’s requirements, it is sold to the end user, the company that does theeven if the specification owner never even touches the bundling has responsibility for ensuring that eachdevice. product in the bundle has the requisite regulatory compliance. Sometimes the supplier for the article toIndeed, ownership of the product and the control of be bundled will undertake compliance with the FDAthe specifications and labeling determine regulatory requirements itself, and sometimes the bundler takesresponsibility instead of who in fact engaged in the that job. But because the bundler is considered to owndesign process or wrote the label. Companies often the specifications of the bundle and whatever claimsask a contract manufacturer to help with the design are made for the bundle, it generally has the ultimateprocess, or enlist the services of an engineering firm. regulatory responsibility.None of that matters. The only thing that mattersis who, at the end of the day, owns the product and Let’s take, for example, a common cell phone,controls the specifications and the label for the hypothetically call it a mePhone. If the cell phoneproduct. manufacturer makes no medical claims about it, the cell phone manufacturer will have no direct FDAThis control rule is also the basis for organizations responsibilities. But let’s say a blood glucose metersuch as distributors and retailers to pass regulatory manufacturer claims, in promotional materials, “ourresponsibility up the chain of distribution to meter will pair with the mePhone to download datawhichever entity controls the specifications and the for analysis on our special app.” Arguably the bloodlabeling. Although distributors and retailers have glucose meter manufacturer has made the mePhonelimited FDA responsibilities, the responsibilities and the app into components of its medical devicefor seeking FDA clearance and ensuring the quality system. So the blood glucose meter manufacturerof the product remain with whoever controls the may, for example, either need to prove through a riskspecifications and labeling. assessment that mePhones available in the market place will remain suitable for that intended use, orComponents suppliers similarly avoid much of the need to enter into an agreement with the mePhoneonerous elements of FDA regulation. If a company maker such that the two companies, throughmakes an article that is incorporated into a finished cooperation and control, will ensure the futuremedical device, the maker of that component is not compatibility of the two devices. I’ve kept this simpledirectly subject to FDA regulatory requirements but in real life these facts are usually much morefor premarket clearance or even the quality complex.system requirements. Instead, the finished devicemanufacturer is obliged to have in place supplier I want to underscore something I said earlier:controls sufficient to ensure the quality of the almost none of the organizations in this section arecomponents it uses. These controls might include, for completely outside of FDA’s jurisdiction. They all haveexample, periodic inspections of suppliers. some, albeit perhaps minor, FDA responsibilities. Even distributors and retailers have to ensure theirAnother strategy is to supply finished medical devices promotion remains consistent with the approvedto a firm that will co-package its own device with labeling, and their facilities appropriately safeguardyours. From a regulatory standpoint, this is essentially the integrity of the products. Components suppliers,the same as the component supplier scenario just while technically exempt from the quality system Page 25