Doctor using a touch screen


Software as a medical device

An agile model for food and drug administration (FDA)-regulated software in health care

​Over the last decade, software has begun to permeate and transform virtually every industry—and health care is no exception.

A digital revolution in health care

The software that drives market disruptors, including smartphones, social media, and the sharing economy, has fundamentally changed the way we live, work, and play. It's also powering game-changing developments in exponential medicine, including 3D printing, point-of-care diagnostics, robotics, bioinformatics, synthetic biology, genomics, and more.

Software is changing how clinicians practice medicine, how consumers manage their own health, and how patients and providers interact. One revolutionary development in digital health technology is software that can perform complex medical functions— software as a medical device (SaMD). SaMD can diagnose conditions, suggest treatments, and inform clinical management.

Back to top

What is software as a medical device (SaMD)?

SaMD is software that performs one or more medical functions. While the software may be embedded in a piece of hardware (as is often the case) it's the software itself that performs the medical function.

The international medical device regulators forum (IMDRF), of which the US FDA is a member, describes SaMD as software that may work on general-purpose (non-medical) computing platforms; may be used in combination with other products including medical devices; and may interface with other medical devices or other general-purpose hardware and software that provide input to SaMD.1

Software that is integral to the function of hardware—for example, software that helps an MRI's magnets turn or animates an X-ray control panel—isn't SaMD. Neither is software that simply retrieves information, organizes data, or optimizes processes.

What is and is not SaMD?


Not SaMD

Software that can determine the proper drug dose for a patient, given personalized patient data

Software that operates a pacemaker

Software that can detect and diagnose a stroke by analyzing MRI images

Software that drives or controls an infusion pump’s motors

Software that can track the size of a mole over time and determine the risk of melanoma

Electronic health record systems

Software that draws on data from other digital devices to determine risk factors associated with epileptic seizures

Software in the machines that assemble medical devices

digital lens

FDA’s SaMD transformation progress

​Over the last five years, the FDA has begun work to develop and clarify risk-based policies to better communicate requirements and align its regulatory approach with the evolving nature of digital devices.

In mid-2017 the FDA announced its digital health innovation action plan2 and began implementing plan commitments by hiring digital health staff, launching its digital health software precertification pilot program3 (Pre-Cert pilot program), and releasing three new guidance documents—two of which distinguish between device types that are low-risk and, therefore, no longer required to undergo pre-market review,4 and one which outlines new guidelines for evaluating SaMD applications.5

The release of the digital action plan and subsequent efforts by the FDA to modernize SaMD regulation have sparked discussion in the news media and across the SaMD ecosystem, and different players have weighed in on these recent developments.

The FDA's Pre-Cert pilot program aims to develop a new approach for a risk-based and accelerated review of digital health products by "looking first at the software developer or digital health technology developer, not the product."6

Since launching the program, the FDA has selected nine pilot participants representing a diverse range of SaMD developers; started collecting data to evaluate organizational excellence key performance indicators (KPIs) and measures; conducted initial site visits with pilot participants; and held a two-day public workshop—"Fostering digital health innovation: Developing the software precertification program"— in January 2018 to engage "the 10th pilot participant" (the larger SaMD community) in the Pre-Cert pilot program.7

FDA Pre-Cert Pilot Program companies

  • Apple (Cupertino, California)
  • Fitbit (San Francisco, California)
  • Johnson & Johnson (New Brunswick, New Jersey)
  • PEAR Therapeutics (Boston, Massachusetts)
  • Phosphorus (New York, New York)
  • Roche (Basel, Switzerland)
  • Samsung (Seoul, South Korea)
  • Tidepool (Palo Alto, California)
  • Verily (Mountain View, California)

Source: Food and drug administration, "FDA selects participants for new digital health software pre-certification pilot program"

Principles and solutions for a new regulatory framework

​Ideally, the new regulatory framework for software as a medical device would include ongoing collaboration among key stakeholders: SaMD developers seeking product approvals, the FDA, and the patients who stand to benefit from new digital health technologies. A secure, cloud-based, integrated online collaboration capability could house the Regulatory Development Kit (RDK), FDA Pre-Cert, and real-world data (RWD) capability and enable organizations to securely submit applications to the FDA.

That agency, in turn, could use it to conduct the regulatory review, notify organizations of their application status, and share regulatory decisions. The capability could be accessible to all SaMD ecosystem stakeholders. Each user would have a unique ID and password, allowing proprietary data to be protected and limited to those who should have access, and making other data that is of interest to the general public available to all. For example, a SaMD developer alone would have access to its Pre-Cert application and be able to track its SaMD application on its path to market, while all users could have access to data on which SaMDs have been approved, and whether there have been adverse patient events.

Back to top

Finger print

Framework components for regulating SaMD

The RDK, FDA Pre-Cert, and the Multi-Stakeholder Real World Data Capability—comprise the core components of the proposed framework for modernizing SaMD regulation.

Regulatory Development Kit
Enter the RDK. The FDA has been considering creating an RDK to help digital health technology developers easily understand and meet the agency's regulatory requirements. As such, it could be useful to outfit the RDK with a module that functions similar to a software program that guides individuals through a step-by-step process to complete their federal and state income tax forms—in this case, the RDK could guide users through the regulatory process.

The RDK could contain tools to clarify requirements and expectations at each stage of the process; provide templates to accelerate development of required documentation; and supply answers to frequently asked questions about data standardization, security requirements, and legal and clinical information. The RDK also could contain an expert-monitored wiki for users to share leading practices. In short, the RDK could provide the health care industry with a simple, user-friendly guide to the SaMD regulatory process, thus encouraging future product innovation and proliferation.

FDA Pre-Cert
An FDA Pre-Cert program to facilitate expedited SaMD approvals—is inspired by the transportation security administration (TSA) Pre✓ model. The FDA Pre-Cert Program would be a risk-based, expedited, and predictable approval process for organizations that demonstrate a commitment to a culture of quality and organizational excellence (CQOE). Entry into this new pathway would be contingent on the SaMD developer providing access to key pieces of pre- and post-market information to provide continued confidence in the product's safety, efficacy, and performance. Two factors could be used to determine the pre- and post-market requirements for each SaMD review:

  1. The SaMD organization's standing in the FDA Pre-Cert program; and
  2. The risk categorization of the SaMD being evaluated.

Organizations that demonstrate a commitment to organizational excellence could expect to spend relatively less (or no) time in pre-market review than their non-Pre-Cert peers with similarly risky products; however, higher-risk products may have more requirements than lower-risk ones.

The multi-stakeholder real-world data (RWD) Capability
One of SaMD's important characteristics is that products connect to the Internet and have the potential to continuously collect valuable RWD, including clinical and nonclinical patient information, administrative data about the SaMD's operating system, patient-reported health outcomes data, customer satisfaction data, geospatial data, and software-defect data. SaMD can analyze the collected data to iterate on the device, helping make it more accurate, intelligent, and patient-centered.

Some RWD, such as app store customer reviews, are publicly available but need to be consolidated into a format that is conducive to analysis. Other RWD may include proprietary information about the SaMD's algorithm, making it important to restrict access. Also, sensitive patient information must be protected. Central to the SaMD data collection, analysis, and management could be development of a technical RWD capability stood up by the joint efforts of multiple stakeholders.

Back to top

What is TSA Pre✓ ?

To improve the efficiency of airport security, TSA developed a Pre✓ program. Obtaining TSA Pre✓ certification requires individuals to share more personal information than an airline passenger normally would; the process includes a background check, fingerprinting, and an in-person interview.

In return, passengers with Pre✓ approval proceed through a separate (and usually, shorter) security line and receive less scrutiny (i.e., they are not required to remove shoes and belts, and present laptops and liquids for inspection).1

Power button