Software as a medical device
An agile model for food and drug administration (FDA)-regulated software in health care
Over the last decade, software has begun to permeate and transform virtually every industry—and health care is no exception.
- A digital revolution in health care
- What is software as a medical device
- FDA’s SaMD transformation progress
- Principles and solutions for a new regulatory framework
- Framework components for regulating SaMD
A digital revolution in health care
The software that drives market disruptors, including smartphones, social media, and the sharing economy, has fundamentally changed the way we live, work, and play. It's also powering game-changing developments in exponential medicine, including 3D printing, point-of-care diagnostics, robotics, bioinformatics, synthetic biology, genomics, and more.
Software is changing how clinicians practice medicine, how consumers manage their own health, and how patients and providers interact. One revolutionary development in digital health technology is software that can perform complex medical functions— software as a medical device (SaMD). SaMD can diagnose conditions, suggest treatments, and inform clinical management.
What is software as a medical device (SaMD)?
SaMD is software that performs one or more medical functions. While the software may be embedded in a piece of hardware (as is often the case) it's the software itself that performs the medical function.
The international medical device regulators forum (IMDRF), of which the US FDA is a member, describes SaMD as software that may work on general-purpose (non-medical) computing platforms; may be used in combination with other products including medical devices; and may interface with other medical devices or other general-purpose hardware and software that provide input to SaMD.1
Software that is integral to the function of hardware—for example, software that helps an MRI's magnets turn or animates an X-ray control panel—isn't SaMD. Neither is software that simply retrieves information, organizes data, or optimizes processes.
What is and is not SaMD?
Software that can determine the proper drug dose for a patient, given personalized patient data
Software that operates a pacemaker
Software that can detect and diagnose a stroke by analyzing MRI images
Software that drives or controls an infusion pump’s motors
Software that can track the size of a mole over time and determine the risk of melanoma
Electronic health record systems
Software that draws on data from other digital devices to determine risk factors associated with epileptic seizures
Software in the machines that assemble medical devices
FDA’s SaMD transformation progress
Over the last five years, the FDA has begun work to develop and clarify risk-based policies to better communicate requirements and align its regulatory approach with the evolving nature of digital devices.
In mid-2017 the FDA announced its digital health innovation action plan2 and began implementing plan commitments by hiring digital health staff, launching its digital health software precertification pilot program3 (Pre-Cert pilot program), and releasing three new guidance documents—two of which distinguish between device types that are low-risk and, therefore, no longer required to undergo pre-market review,4 and one which outlines new guidelines for evaluating SaMD applications.5
The release of the digital action plan and subsequent efforts by the FDA to modernize SaMD regulation have sparked discussion in the news media and across the SaMD ecosystem, and different players have weighed in on these recent developments.
The FDA's Pre-Cert pilot program aims to develop a new approach for a risk-based and accelerated review of digital health products by "looking first at the software developer or digital health technology developer, not the product."6
Since launching the program, the FDA has selected nine pilot participants representing a diverse range of SaMD developers; started collecting data to evaluate organizational excellence key performance indicators (KPIs) and measures; conducted initial site visits with pilot participants; and held a two-day public workshop—"Fostering digital health innovation: Developing the software precertification program"— in January 2018 to engage "the 10th pilot participant" (the larger SaMD community) in the Pre-Cert pilot program.7
FDA Pre-Cert Pilot Program companies
- Apple (Cupertino, California)
- Fitbit (San Francisco, California)
- Johnson & Johnson (New Brunswick, New Jersey)
- PEAR Therapeutics (Boston, Massachusetts)
- Phosphorus (New York, New York)
- Roche (Basel, Switzerland)
- Samsung (Seoul, South Korea)
- Tidepool (Palo Alto, California)
- Verily (Mountain View, California)
Source: Food and drug administration, "FDA selects participants for new digital health software pre-certification pilot program"
Principles and solutions for a new regulatory framework
Ideally, the new regulatory framework for software as a medical device would include ongoing collaboration among key stakeholders: SaMD developers seeking product approvals, the FDA, and the patients who stand to benefit from new digital health technologies. A secure, cloud-based, integrated online collaboration capability could house the Regulatory Development Kit (RDK), FDA Pre-Cert, and real-world data (RWD) capability and enable organizations to securely submit applications to the FDA.
That agency, in turn, could use it to conduct the regulatory review, notify organizations of their application status, and share regulatory decisions. The capability could be accessible to all SaMD ecosystem stakeholders. Each user would have a unique ID and password, allowing proprietary data to be protected and limited to those who should have access, and making other data that is of interest to the general public available to all. For example, a SaMD developer alone would have access to its Pre-Cert application and be able to track its SaMD application on its path to market, while all users could have access to data on which SaMDs have been approved, and whether there have been adverse patient events.
Framework components for regulating SaMD
The RDK, FDA Pre-Cert, and the Multi-Stakeholder Real World Data Capability—comprise the core components of the proposed framework for modernizing SaMD regulation.
Regulatory Development Kit
Enter the RDK. The FDA has been considering creating an RDK to help digital health technology developers easily understand and meet the agency's regulatory requirements. As such, it could be useful to outfit the RDK with a module that functions similar to a software program that guides individuals through a step-by-step process to complete their federal and state income tax forms—in this case, the RDK could guide users through the regulatory process.
The RDK could contain tools to clarify requirements and expectations at each stage of the process; provide templates to accelerate development of required documentation; and supply answers to frequently asked questions about data standardization, security requirements, and legal and clinical information. The RDK also could contain an expert-monitored wiki for users to share leading practices. In short, the RDK could provide the health care industry with a simple, user-friendly guide to the SaMD regulatory process, thus encouraging future product innovation and proliferation.
An FDA Pre-Cert program to facilitate expedited SaMD approvals—is inspired by the transportation security administration (TSA) Pre✓ model. The FDA Pre-Cert Program would be a risk-based, expedited, and predictable approval process for organizations that demonstrate a commitment to a culture of quality and organizational excellence (CQOE). Entry into this new pathway would be contingent on the SaMD developer providing access to key pieces of pre- and post-market information to provide continued confidence in the product's safety, efficacy, and performance. Two factors could be used to determine the pre- and post-market requirements for each SaMD review:
- The SaMD organization's standing in the FDA Pre-Cert program; and
- The risk categorization of the SaMD being evaluated.
Organizations that demonstrate a commitment to organizational excellence could expect to spend relatively less (or no) time in pre-market review than their non-Pre-Cert peers with similarly risky products; however, higher-risk products may have more requirements than lower-risk ones.
The multi-stakeholder real-world data (RWD) Capability
One of SaMD's important characteristics is that products connect to the Internet and have the potential to continuously collect valuable RWD, including clinical and nonclinical patient information, administrative data about the SaMD's operating system, patient-reported health outcomes data, customer satisfaction data, geospatial data, and software-defect data. SaMD can analyze the collected data to iterate on the device, helping make it more accurate, intelligent, and patient-centered.
Some RWD, such as app store customer reviews, are publicly available but need to be consolidated into a format that is conducive to analysis. Other RWD may include proprietary information about the SaMD's algorithm, making it important to restrict access. Also, sensitive patient information must be protected. Central to the SaMD data collection, analysis, and management could be development of a technical RWD capability stood up by the joint efforts of multiple stakeholders.
What is TSA Pre✓ ?
To improve the efficiency of airport security, TSA developed a Pre✓ program. Obtaining TSA Pre✓ certification requires individuals to share more personal information than an airline passenger normally would; the process includes a background check, fingerprinting, and an in-person interview.
In return, passengers with Pre✓ approval proceed through a separate (and usually, shorter) security line and receive less scrutiny (i.e., they are not required to remove shoes and belts, and present laptops and liquids for inspection).1
As SaMD technology becomes cheaper, more accessible, and more sophisticated, it is likely to play an increasingly important role in health care delivery, personalized medicine, and medical research. To realize its full benefit, however, regulation of these products will need to radically change to accommodate new SaMD manufacturers and the technology’s rapid evolution, and to harness SaMD’s ability to capture RWD to create a collaborative, innovative SaMD community.
The FDA has made recent, significant progress in addressing the issue of software regulation in health care, with the goal of standing up a new regulatory process for SaMD by the end of 2018.8 Still, the success of this regulatory transformation will require input and contributions from the larger SaMD ecosystem.
In this report, we have outlined one potential framework for the overall regulatory transformation of digital health, but a great deal of work lies ahead. We call upon the larger SaMD ecosystem to contribute their thought leadership and expertise to the following efforts:
|Capability||Proposed next steps|
|RDK||Create and contribute to an open SaMD community that develops a draft RDK—including software development tools, techniques, code, training guides, best practices for organizational governance and quality systems, and mechanisms for curating content.|
|FDA Pre-Cert||Develop consensus on the appropriate menu of KPIs and measures for evaluating an organization’s CQOE score, Pre-Cert level, and overall commitment to excellence.|
|Develop consensus on what data would be required for those companies eligible for Pre-Cert.|
|Develop methodologies for testing potential KPI measures against their ability to predict the excellence outcomes of patient safety, clinical responsibility, high product quality, cybersecurity consciousness, and proactive culture.|
|Develop methodologies to ensure Pre-Cert doesn’t prioritize large companies over small companies and start-ups.|
|Develop an automated audit process to validate that KPIs and measures provided by organizations are accurate and substantiated.|
|RWD capability||Identify the core RWD elements to which FDA should require access from SaMD developers for device post-market surveillance, as well as RWD elements that could be leveraged directly by the FDA from its internal sources, patient sources, and publicly available sources.
|Create an RWD business model that builds trust between the SaMD ecosystem participants and delivers the right incentives to participate (e.g., more data equals lower regulatory hurdles; leads to accelerated market entry).|
|Develop a secure, encrypted RWD capability for the FDA to access and review selected RWD across SaMD organizations and from other public or private sources.|
|Other||Create a prototype for the online integrated collaboration capability to continue to test out and improve the concepts described in this paper.
|Explore ways to infuse continuous learning in the new SaMD regulatory process to improve organizational excellence to elevate the bar for quality products.|
|Attend public workshops and provide perspectives for consideration to the FDA.|
1 FDA, “Software as a medical device: Clinical evaluation,” December 8, 2017, and IMDRF, “SaMD: Key definitions,” December 9, 2013.
2 FDA, “Digital health innovation action plan,” accessed January 10, 2018.
3 FDA, “Digital health software precertification (Pre-Cert) program,” accessed January 10, 2018.
4 FDA, “Clinical and patient decision support software,” December 8, 2017, and FDA, “Changes to existing medical software policies resulting from section 3060 of 21st Century Cures Act,” December 8, 2017.
5 FDA, “SaMD: Clinical evaluation,” December 8, 2017, and FDA, “Statement from FDA Commissioner Scott Gottlieb, M.D., on advancing new digital health policies to encourage innovation, bring efficiency and modernization to regulation,” December 7, 2017, and FDA, “The least burdensome provisions: Concept and principles,” December 15, 2017.
6 FDA, “Digital health innovation action plan,” accessed January 10, 2018
7 FDA, “Software precertification pilot status update,” accessed February 13, 2018.
8 Bakul Patel, “Fostering digital health innovation: Developing the software precertification program,” FDA Public Workshop, January 30–31, 2018.