Commentary: Why FDA’s software precertification program may be bad for business

Epstein Becker & Green's Bradley Merrill Thompson says the FDA's much-touted program is riddled with unseen costs and unanswered questions.
By Bradley Merrill Thompson

The price
This is an incredibly complex program FDA is proposing, and while certainly the devil will be in the details, I want to speak it a little bit higher level. In broad terms, the price industry must pay can already be found in two features of the program.
1. The excellence appraisal. If you’ve read anything about the program, you know that the key feature of the program is to shift FDA review from focusing exclusively on the product, to focusing primarily on the company and less on the product. The argument is that if FDA can trust that the company will reliably produce safe and effective software medical devices, the agency does not need to focus as much on the product itself.  Makes sense. But here’s the kicker. As they operate today, the vast majority of existing medical device companies would not qualify to participate in the program

At a recent meeting with FDA on the program, I asked a rather direct question. I’m not going to use the name of the FDA fellow, because I was asking for a candid personal assessment. So this is not in any way an official FDA position. But understand this is a guy who would know very well the answer to this question.
Here’s how I framed my question: "Use as your reference point all of the companies that have received 510(k) clearance or PMA approval for a medical device presently. In other words, I’m talking about the existing medical device companies that make class II or class III medical devices. What percentage of those companies do you think would qualify under the agency’s new standard for having a Culture of Quality and Organizational Excellence? Of course I’m asking for estimation, and I’m not focused on specific percentages, but is it only the very elite – say roughly the top 10 percent – or is it meant to be everyone above average – meaning in the top 50 percent – or is it supposed to simply exclude the really clumsy – meaning the top 90 percent?"
After much back and forth where he was uncomfortable with the question, I got a direct reply: as of right now it would only be very few. But he quickly added, which is fair, that anyone can aspire to be in that category and can improve their organization in order to qualify. But the goal of this program is frankly to encourage medical device software industry to substantially improve their Culture of Quality and Organizational Excellence.
I think we need to understand that fundamental premise: this standard is meant to be aspirational.  So through the adoption of this program FDA hopes to raise the Culture of Quality and Organizational Excellence at medical device software companies. That’s part of what FDA gets out of this, and companies need to understand that the vast majority of companies are not where FDA wants them to be. 
Frankly I’m not too troubled by this, because companies can assess whether they could achieve the required standard once the specific standard becomes clearer. This is just a question of a willingness to invest. By far the more concerning price is the price to be paid once the software product is on the market through the precertification program.
2. Postmarket decision-making. This is the one that scares the bejeebers out of me. 

From my own experience I know that while everyone wants FDA to clear their products as quickly as possible, by far the bigger issues with FDA have been around whether a product needs to be recalled or a notification sent to customers. Recall decisions are in many ways just as subjective, if not more subjective, than approval decisions. Companies and FDA are often on a different page, and the consequences can be life or death for a company. Recalls are not just expensive to execute, but they can completely destroy a brand. So while you have to get on the market, you also need to stay on the market to have a successful company. The latter, in my opinion, is often a bigger financial issue.
Understanding how a product is performing in the marketplace clinically is something that typically requires some context. Companies that live and breathe with their customers and who study every aspect of their product have a much better understanding of that context than either FDA or, for that matter, individual customers. The problem is, when data are shared without that context, FDA and customers may react in an emotional way.
So here are the challenges with the precertification program with regard to postmarket decision-making that could easily make this entire program a bad deal for industry.
A. Collecting and sharing real-world data with FDA. The agency will use this data in evaluating whether the company is properly managing the product during the postmarket phase, including recalls and other corrective actions. 

Right now recalls are at least in theory voluntary. If FDA wants to force a recall, it needs to go through a somewhat elaborate process and frankly the agency rarely does that. To be sure, FDA can lean on a company and threaten adverse publicity.
But while it is already quite difficult to resist, the precert program would make it much more so. The current concept is for the program to give FDA the authority to not just informally lean on a company, but to tell the company that FDA will remove the company from the precert program if they do not comply with the agency’s directive.
Indeed, it may be worse than that. If a company doesn’t conduct a recall or other corrective action on its own without being told by the FDA to do so, if the FDA ultimately later concludes that the company should have taken action, the agency can remove the company from the precert program.  It’s also possible that by the company voluntarily entering the precert program, they are legally agreeing to do whatever FDA says.
FDA acknowledges that it is looking for better leverage to tell companies what to do in the marketing of their products, and this is the tool the agency has identified. Given the costs and market implications, this is what scares me most. But it doesn’t stop there.
B. Sharing data with the public. While FDA hasn’t decided exactly what it wants to do here, a major premise of the precert program is transparency to the public to gain public confidence. This means requiring companies to share a much higher level of information about their marketed products with the public. This will be done on the agency’s terms, not the company’s.  More precisely, it will be done according to the law which includes the Freedom of Information Act. Industry needs to understand that once a document is in FDA’s possession, the agency literally cannot refuse to share that information publicly unless the information falls within an exemption such as constituting confidential commercial information or trade secrets. It’s unclear how those exemptions would apply to data in these instances. 

The information presumably includes clinical performance data regarding the device, but also could include a variety of other information on, for example, product usage patterns, utilization of tech support, frequency of bugs reported and fixed, and even information that was part of the original excellence appraisal regarding the company, including KPIs that relate to the company’s “culture of proactivity.” And it is far from clear how the public would get appropriate context regarding the information that is shared. This is potentially just as bad as having FDA manage the company’s postmarket decision-making.