Commentary: FDA’s website has wrong information about the scope of its software regulation — and that's a big problem

Ironically, the agency that goes after companies for false and misleading claims is making them about its own policies.
By Bradley Merrill Thompson
Some false or misleading guidances on FDA's website.

The problem: False or misleading FDA regulations and guidance

As I explained above, in connection with our visits to university startups, I reviewed FDA’s website to identify incorrect regulations and guidance. In my review, I focused on those that were outdated following section 3060 of the 21st Century Cures Act, as well as those regulations that are the subject of FDA enforcement discretion regarding software. I found lots of examples, but I thought I would share 10 to illustrate my point.

The following FDA regulations and guidance documents are false or misleading in important ways.

1. Regulation: Sec. 880.6310 Medical device data system

The regulation explains that a medical device data system (MDDS) is a device intended to transfer, store, convert formats or display medical device data, without controlling or altering the functions or parameters of any connected medical devices. An MDDS device may include software or hardware. According to the regulation, FDA regulates such products as class I medical devices. 

But that’s not true for two different reasons. First, for software, the 21st Century Cures Act removed such software from FDA oversight. And second, FDA itself has stated that as a matter of enforcement discretion it will not regulate the remaining products which would include hardware or hardware/software combinations. When a website user views the regulation, the user is given no indication of that.

2. Regulation: Sec. 862.2100 Calculator/data processing module for clinical use, also sometimes referred to as Laboratory Information Management Systems

These products include a calculator/data processing module for clinical use that is intended to store, retrieve, and/or process laboratory data. The regulation says that FDA oversees such products as class I medical devices.

But the 21st Century Cures Act has removed such products from FDA oversight.

3. Regulation: Sec. 868.1890 Predictive pulmonary-function value calculator

This category includes a “device used to calculate normal pulmonary-function values based on empirical equations,” and includes such things as a burn calculator. FDA regulates these products in class II, subject to performance standards.

But under the 21st Century Cures Act, if this product is designed to provide the healthcare professional user with the ability to review the underlying information such that the user doesn’t have to rely on the software, the software can fall outside of FDA oversight.

4. Regulation: Sec. 890.5050 Daily activity assist device

This category includes a modified adaptor or utensil that is intended for medical purposes to assist a patient to perform a specific function. That language includes medication reminders, product code NXQ, defined as “a device intended for medical purposes to provide alerts to patients or healthcare providers for pre-determined medication dosing schedules. The device may incorporate wireless communication.” The regulation states that FDA regulates such products as class I medical devices, exempt from some of the general controls.

In the Mobile Medical App guidance, buried in footnote 27, FDA declares that these medication reminders are no longer actively regulated.  If someone only read the regulation and the product code, they would think that it’s actively regulated.  According to FDA and other writings, that’s true whether or not the software at issue is a mobile medical app.

5. Regulation: Sec. 892.2010 Medical Image Storage Device

A medical image storage device is a device that provides electronic storage and retrieval functions for medical images. Examples include devices employing magnetic and optical discs, magnetic tape, and digital memory.  By regulation, FDA regulates these products as class I medical devices

But that regulation is now wrong, under the 21st Century Cures Act.  They are not medical devices at all. The regulation needs to be removed.

6. Guidance document: General Wellness: Policy for Low Risk Devices

This guidance document lays out FDA’s view regarding when products used to support general wellness should be excluded from active regulation under a policy of enforcement discretion.  It is an elaborate document, with many elements, and addresses what FDA considers to be medical devices that are not high enough risk to merit active regulation.

The 21st Century Cures Act includes a provision that in some ways is much simpler than the guidance, but also declares that wellness related products that meet the new statutory definition are not medical devices at all.  The guidance needs to be updated to indicate that at least a portion of the wellness products are not medical devices at all. 

FDA published a separate guidance document on December 8, 2017 concerning “Changes to Existing Medical Software Policies Resulting from Section 3060 of the 21st Century Cures Act,” expressing the agency’s general thoughts on the changes that will be necessary. However, FDA has not done anything publicly to amend the General Wellness guidance itself. The General Wellness guidance does include the cover sheet warning described above.

7. Guidance document: Mobile Medical Applications

While this document was published most recently in 2015, it is now outdated in several important respects.

  • The guidance sets forth FDA’s 2015 policy on when mobile medical applications qualified as medical devices. But in 2016 the 21st Century Cures Act changed fundamentally the scope of FDA’s oversight of software, and removed from FDA regulation several items that FDA had placed in enforcement discretion in that guidance document. 
  • The 2015 guidance also discusses the FDA’s 2015 view on when software might constitute an accessory, but that view has now become outdated in light of the 2017 FDA guidance on Medical Device Accessories – Describing Accessories and Classification Pathways.
  • Further, the guidance addressed clinical decision support and articulated the agency’s 2015 standard for regulating such software, and that likewise has become outdated under the 21st Century Cures Act. 
  • And finally, the FDA has also said that it wants to comprehensively revise the Mobile Medical App guidance document because the agency is now actively using the guidance to determine when any software might be regulated, not just mobile medical apps.

8. Guidance document: Off-The-Shelf Software Use in Medical Devices

FDA itself has said that section 3.2.2 of this guidance is out-of-date because it characterizes laboratory information management systems as medical devices, when now, under the 21st Century Cures Act, that is no longer true.

9. Guidance document: Medical Device Data Systems, Medical Image Storage Devices, and Medical Image Communications Devices

Like the MDDS regulation discussed above, this guidance needs to be modified. This guidance document purports to place a wide variety of software used to store, transfer, display and convert medical device data into enforcement discretion. In light of the 21st Century Cures Act, that is no longer accurate. Such software is now not a medical device at all. Hardware is a different story.

10. FDA Report to Congress: 2014 FDASIA Report

You might wonder why I have included a report to Congress here. Unfortunately, FDA chose to put some important exclusions for clinical decision support software that the agency considered to be in enforcement discretion into this congressional report. This probably means that these explanations are not found by many entrepreneurs. But there are also many regulatory affairs experts in industry who have used this report for guidance when trying to discern FDA’s oversight of clinical decision support.

In fact, in the 2017 draft guidance on Clinical and Patient Decision Support Software, FDA seems to reference and preserve these other explanations that are outside of the guidance document. On page 11, FDA states:

"There are many types of software intended to support health care professionals that are not affected by … the 21st Century Cures Act… or this guidance. Some of these, such as software that perform calculations routinely used in clinical practice, are devices for which FDA maintains its existing policy of not intending to enforce compliance with applicable regulatory requirements."

I interpret that as saying that some software is excluded from FDA regulation by statute, but that the agency intends to continue its practice of enforcement discretion for software the agency identifies on its own, not excluded by statute. FDA further adds to the confusion by not collecting all of the information in one place, and making sure that it is consistent with the congressional statute. FDA says that it plans to amend the mobile medical app guidance after finalizing the CDS guidance, whenever that is.