Software as a medical device

A digital revolution in health care

The software that drives market disruptors, including smartphones, social media, and the sharing economy, has fundamentally changed the way we live, work, and play. It's also powering game-changing developments in exponential medicine, including 3D printing, point-of-care diagnostics, robotics, bioinformatics, synthetic biology, genomics, and more.

Software is changing how clinicians practice medicine, how consumers manage their own health, and how patients and providers interact. One revolutionary development in digital health technology is software that can perform complex medical functions— software as a medical device (SaMD). SaMD can diagnose conditions, suggest treatments, and inform clinical management.

Back to top

What is software as a medical device (SaMD)?

SaMD is software that performs one or more medical functions. While the software may be embedded in a piece of hardware (as is often the case) it's the software itself that performs the medical function.

The international medical device regulators forum (IMDRF), of which the US FDA is a member, describes SaMD as software that may work on general-purpose (non-medical) computing platforms; may be used in combination with other products including medical devices; and may interface with other medical devices or other general-purpose hardware and software that provide input to SaMD.¹

Software that is integral to the function of hardware—for example, software that helps an MRI's magnets turn or animates an X-ray control panel—isn't SaMD. Neither is software that simply retrieves information, organizes data, or optimizes processes.

What is and is not SaMD?

Back to top

FDA’s SaMD transformation progress

​Over the last five years, the FDA has begun work to develop and clarify risk-based policies to better communicate requirements and align its regulatory approach with the evolving nature of digital devices.

In mid-2017 the FDA announced its digital health innovation action plan² and began implementing plan commitments by hiring digital health staff, launching its digital health software precertification pilot program³ (Pre-Cert pilot program), and releasing three new guidance documents—two of which distinguish between device types that are low-risk and, therefore, no longer required to undergo pre-market review,⁴ and one which outlines new guidelines for evaluating SaMD applications.⁵

The release of the digital action plan and subsequent efforts by the FDA to modernize SaMD regulation have sparked discussion in the news media and across the SaMD ecosystem, and different players have weighed in on these recent developments.

The FDA's Pre-Cert pilot program aims to develop a new approach for a risk-based and accelerated review of digital health products by "looking first at the software developer or digital health technology developer, not the product."⁶

Since launching the program, the FDA has selected nine pilot participants representing a diverse range of SaMD developers; started collecting data to evaluate organizational excellence key performance indicators (KPIs) and measures; conducted initial site visits with pilot participants; and held a two-day public workshop—"Fostering digital health innovation: Developing the software precertification program"— in January 2018 to engage "the 10^th pilot participant" (the larger SaMD community) in the Pre-Cert pilot program.⁷

Back to top

Principles and solutions for a new regulatory framework

​Ideally, the new regulatory framework for software as a medical device would include ongoing collaboration among key stakeholders: SaMD developers seeking product approvals, the FDA, and the patients who stand to benefit from new digital health technologies. A secure, cloud-based, integrated online collaboration capability could house the Regulatory Development Kit (RDK), FDA Pre-Cert, and real-world data (RWD) capability and enable organizations to securely submit applications to the FDA.

That agency, in turn, could use it to conduct the regulatory review, notify organizations of their application status, and share regulatory decisions. The capability could be accessible to all SaMD ecosystem stakeholders. Each user would have a unique ID and password, allowing proprietary data to be protected and limited to those who should have access, and making other data that is of interest to the general public available to all. For example, a SaMD developer alone would have access to its Pre-Cert application and be able to track its SaMD application on its path to market, while all users could have access to data on which SaMDs have been approved, and whether there have been adverse patient events.

Back to top

Framework components for regulating SaMD

The RDK, FDA Pre-Cert, and the Multi-Stakeholder Real World Data Capability—comprise the core components of the proposed framework for modernizing SaMD regulation.

Regulatory Development Kit
Enter the RDK. The FDA has been considering creating an RDK to help digital health technology developers easily understand and meet the agency's regulatory requirements. As such, it could be useful to outfit the RDK with a module that functions similar to a software program that guides individuals through a step-by-step process to complete their federal and state income tax forms—in this case, the RDK could guide users through the regulatory process.

The RDK could contain tools to clarify requirements and expectations at each stage of the process; provide templates to accelerate development of required documentation; and supply answers to frequently asked questions about data standardization, security requirements, and legal and clinical information. The RDK also could contain an expert-monitored wiki for users to share leading practices. In short, the RDK could provide the health care industry with a simple, user-friendly guide to the SaMD regulatory process, thus encouraging future product innovation and proliferation.

FDA Pre-Cert
An FDA Pre-Cert program to facilitate expedited SaMD approvals—is inspired by the transportation security administration (TSA) Pre✓ model. The FDA Pre-Cert Program would be a risk-based, expedited, and predictable approval process for organizations that demonstrate a commitment to a culture of quality and organizational excellence (CQOE). Entry into this new pathway would be contingent on the SaMD developer providing access to key pieces of pre- and post-market information to provide continued confidence in the product's safety, efficacy, and performance. Two factors could be used to determine the pre- and post-market requirements for each SaMD review:

1. The SaMD organization's standing in the FDA Pre-Cert program; and
2. The risk categorization of the SaMD being evaluated.

Organizations that demonstrate a commitment to organizational excellence could expect to spend relatively less (or no) time in pre-market review than their non-Pre-Cert peers with similarly risky products; however, higher-risk products may have more requirements than lower-risk ones.

The multi-stakeholder real-world data (RWD) Capability
One of SaMD's important characteristics is that products connect to the Internet and have the potential to continuously collect valuable RWD, including clinical and nonclinical patient information, administrative data about the SaMD's operating system, patient-reported health outcomes data, customer satisfaction data, geospatial data, and software-defect data. SaMD can analyze the collected data to iterate on the device, helping make it more accurate, intelligent, and patient-centered.

Some RWD, such as app store customer reviews, are publicly available but need to be consolidated into a format that is conducive to analysis. Other RWD may include proprietary information about the SaMD's algorithm, making it important to restrict access. Also, sensitive patient information must be protected. Central to the SaMD data collection, analysis, and management could be development of a technical RWD capability stood up by the joint efforts of multiple stakeholders.

Back to top

Next steps

As SaMD technology becomes cheaper, more accessible, and more sophisticated, it is likely to play an increasingly important role in health care delivery, personalized medicine, and medical research. To realize its full benefit, however, regulation of these products will need to radically change to accommodate new SaMD manufacturers and the technology’s rapid evolution, and to harness SaMD’s ability to capture RWD to create a collaborative, innovative SaMD community.

The FDA has made recent, significant progress in addressing the issue of software regulation in health care, with the goal of standing up a new regulatory process for SaMD by the end of 2018.⁸ Still, the success of this regulatory transformation will require input and contributions from the larger SaMD ecosystem.

In this report, we have outlined one potential framework for the overall regulatory transformation of digital health, but a great deal of work lies ahead. We call upon the larger SaMD ecosystem to contribute their thought leadership and expertise to the following efforts:

Back to top

¹ FDA, “Software as a medical device: Clinical evaluation,” December 8, 2017, and IMDRF, “SaMD: Key definitions,” December 9, 2013.
² FDA, “Digital health innovation action plan,” accessed January 10, 2018.
³ FDA, “Digital health software precertification (Pre-Cert) program,” accessed January 10, 2018.
⁴ FDA, “Clinical and patient decision support software,” December 8, 2017, and FDA, “Changes to existing medical software policies resulting from section 3060 of 21st Century Cures Act,” December 8, 2017.
⁵ FDA, “SaMD: Clinical evaluation,” December 8, 2017, and FDA, “Statement from FDA Commissioner Scott Gottlieb, M.D., on advancing new digital health policies to encourage innovation, bring efficiency and modernization to regulation,” December 7, 2017, and FDA, “The least burdensome provisions: Concept and principles,” December 15, 2017.
⁶ FDA, “Digital health innovation action plan,” accessed January 10, 2018
⁷ FDA, “Software precertification pilot status update,” accessed February 13, 2018.
⁸ Bakul Patel, “Fostering digital health innovation: Developing the software precertification program,” FDA Public Workshop, January 30–31, 2018.