mHealth News Report FDA Regulation of Mobile Health

8/8/2019 mHealth News Report FDA Regulation of Mobile Health

1/51

healthnewsmobi

FDAREGULATION OFMOBILEHEALTH

Copyright June 2010 Chester Street Publishing, Inc. All Rights Reserved.


2/51

Contents

About the Author

Letter from the Editor

FDA May Regulate Certain Mobile Phones, Accessories

Step-by-step: FDA wireless health regulation

How to get FDA to clear a mobile health app

Should mHealth companies want FDA regulation?

How to Avoid mHealth Regulation

Washington signals possible FDA regulation of mHealth

Will the FDA regulate mHealth care providers?

The Dynamic Future of FDA Regulation of mHealth

1

2

3

6

10

I7

22

29

32

37


3/51

Bradley Merrill Tompson is a shareholder in the law rm o Epstein Becker &

Green, P.C. Tere he counsels medical device and other lie science companies

on a wide range o FDA regulatory, reimbursement and clinical trial issues.

At the rm, Mr. Tompson leads the Medical Device Regulatory Practice, the

Clinical rials Practice and the Connected Health Practice, and serves on the

rms Health & Lie Sciences Steering Committee. For trade associations, Mr.

Tompson has served as counsel to AdvaMed or payment issues, as General

Counsel to the Combination Products Coalition, and or 17 years as General

Counsel and Secretary or the Indiana Medical Device Manuacturers Council.

Connected Health Practice: In EBGs Connected Health Practice,

Mr. Tompson ocuses on the ederal regulatory requirementsFDA,

reimbursement, privacy and othersthat impact remote monitoring, mobile

health, HI and device interoperability. Te rms Connected Health Practice

brings together a multidisciplinary team o attorneys and consultants trained

and experienced in Medicare and private insurance payment, regulatory,

About the Author

scientic, I, clinical, and security disciplines. Mr. Tompson serves as outside counsel to Continua Health Alliance,

conducts educational programs on connected health regulation and blogs or Mobihealthnews.com.

eaching, Writing and Serving: Mr. Tompson has taught ood & drug law at Indiana University School o Law-Indianapolis and Columbia Law School. He also serves on the editorial boards or Medical Device & Diagnostic

Industry (1993-present), Food & Drug Law Journal (2007 present) and BNAs Medical Device Law & Industry Report

(2007-present) Mr. Tompson also serves as Co-Chair o the Food & Drug Law Committee o the Administrative Law

Section o the American Bar Association, and as Chair o the Medical Device Committee o FDLI. Mr. Tompson has

written extensively on the topics o medical device regulation, including a book entitled FDAs Regulation o Medical

Devices (Interpharm Press, 1995). He has co-authored chapters in O-Label Communications: A Guide to Sales and

Marketing Compliance published by FDLI (2008-2009) and in a book entitled Guide to Medicare Coverage Decision-

making and Appeals published by the American Bar Association (2002).

Honors: Mr. Tompson was included in 100 Notable People in the Medical Device Industry (Medical Device &Diagnostics Industry, June 2004), has earned an AV rating in Martindale Hubble (its highest rating), has been named a

SuperLawyer in Indiana, has been elected as a Fellow in the American Bar Foundation and is listed in Chambers USA: A

Guide to Americas Leading Business Lawyers.

Education: Mr. Tompson received his B.A. cum laude, and an M.B.A. rom the University o Illinois and his J.D. cum

laude rom the University o Michigan Law School.

Bradley Merrill Thompson

Page 1


4/51

Letter from the Editor

One morning last summer I got my rst email rom

Brad. He wrote that he and a couple o colleagues

had just conducted a day-long seminar on regulatory

topics or the Vancouver gathering o the Continua

Health Alliance. One session was a case study o FDA

regulation o a mobile health platorm.

Is that the kind o topic that interests you? Brad had

asked.

For the next year -- about every six weeks -- I would

receive the latest chapter in Brads FDA regulation

series. It pulled rom FDA workshop meetings, political

speeches, questions posed by mHealth luminaries, and

Brads vast wealth o knowledge regarding FDA policies.

Brads series o articles quickly proved to be the

some o the most talked about eatures published in

healthnewsmobi

Page 2

MobiHealthNews weekly newsletter.

At Brads request, and with great pleasure, we at MobiHealthnews have compiled the series on mHealth

regulation into this ree special report or our readers. I am condent it will quickly become a seminal

text or the budding mobile health industry.

Our heartelt thanks to Brad or taking the time to provide direction or navigating these otherwise

murky regulatory waters.

Brian Dolan

Editor, MobiHealthNews


5/51

MobiHealthNews.com

It can come as a bit o a shock to people in the

consumer electronics, I and telecommunications

industries that FDA might regulate certain equipment

like cell phones that companies are planning to put at

the center o connected health services. My goal is to

outline the actors that FDA considers when deciding

whether to regulate such equipment.

Dening a medical device

Te natural place to start is with the denition o a

medical device. Since it is so central to the analysis,

Im going to quote the statute verbatim. Section 201(h)

o the Federal Food, Drug, and Cosmetic Act denes a

medical device as:

an instrument, apparatus, implement, machine,

contrivance, implant, in vitro reagent, or other similar

or related article, including any component, part, or

accessory, which is [either] intended or use in

the diagnosis o disease or other conditions, or in the

cure, mitigation, treatment, or prevention o disease,

in man or other animals [or] intended to aect the

structure or any unction o the body o man or other

animals.

So at a high-level, we look or two things: (1) a device

with (2) a medical intended use. Te rst prong o

the test that there must be an actual product

means FDA doesnt regulate, or example, medical

procedures. Te thing in question must be a thing, and

not inormation or something else intangible. Soware

can be a medical device i its written on computer

media, as opposed to printed on paper. Te media

with the code written on it is enough o a thing or

FDA to regulate.

FDA May Regulate Certain Mobile Phones,Accessories

I.

Components Vs. Accessories

In the area o mobile health technology, its important

to understand that an accessory or a component o

a medical device is itsel a regulated medical device.

Further, the dierence between an accessory and a

component is who buys it. End-users buy accessories,

while manuacturers buy components. Tus the exact

same piece o equipment could be either an accessory

or a component depending on the target purchaser.

Tat makes a big dierence in terms o applicable

regulatory requirements. Components are exempt

rom most FDA regulatory requirements, with the

regulatory burdens being borne by the nished

device manuacturer. Accessories, on the other hand,

since they go right to the end user, must meet the

FDA requirements beore they leave the hands o

the accessory manuacturer. Tese dierences are

summarized in Figure 1 on the next page.

Te level o regulation imposed by FDA on accessories

and components is determined by the parent device to

which they relate. So i the accessory relates to a high

risk device, say an implantable cardiac debrillator, it

will be subject to a high level o regulation even i the

accessory is relatively benign in and o itsel.

Page 3


6/51

MobiHealthNews.com

Having decided that the product meets the thing

test, determining the intended use o the article can be

much more dicult. As a preliminary matter, in the

denition above you can see that the so-called medical

uses are very broad, and include some conditions

people may not ordinarily consider medical. Forexample, equipment used or exercise could become

a medical device i the claims take on more o a

therapeutic nature instead o simply suggesting

general tness. So i the piece o tness equipment

is specically advocated or use in the treatment o

obesity or rehabilitation o cardiac patients, it can

become a medical device. Further, the denition is not

limited to disease, but also relates to articles that aect

the structure or unction o the body (or example,

pregnancy). Moreover, devices that merely monitora body unction, with no therapeutic eect, can all

into the device category i the intended use suggests a

health-related purpose.

Determining intended use

Figuring out the actual intended use o the article

depends entirely on the acts. I teach this topic at

Columbia Law School, and I generally begin the

session by taking out a popsicle stick. o employ a

case study, I tell the students that Im the CEO o a

company that makes these sticks, and I want to know

whether I have to comply with FDA regulations. At

that point I encourage them to ask questions o me inmy hypothetical role as CEO, and then ultimately to

advise me.

I they have done their homework, they will start

to ask me how I promote the stick. In my answers,

Im pretty coy at rst, simply explaining that I sell

sticks and what my customers do with them is their

business. I explain that my labeling or the product

merely identies the product as a stick without going

into its possible uses.

Hopeully my students have read enough to know

that the regulations dene intended use as: the

objective intent o the persons legally responsible

or the labeling o devices. Te intent is determined

by such persons expressions or may be shown by

the circumstances surrounding the distribution o

the article. Tis objective intent may, or example,

be shown by labeling claims, advertising matter, or

oral or written statements by such persons or their

representatives. It may be shown by the circumstances

Finished Stand alone Device Accessory Component

Definition

A medical device in finished form,

ready to use perhaps withaccessories, intended for sale tothe end user

An article intended for use in orwith a finished medical device,

intended for use by the end user

An article intended for use in orwith a finished medical device,

intended for use by amanufacturer

FDA Clearancerequired?

Yes, unless exempt Yes, unless exempt No

GMPs

required?Yes, unless exempt Yes, unless exempt

No, but quality must satisfy

finished device manufacturer

Figure 1. Types of Devices

Page 4


7/51

MobiHealthNews.com

that the article is, with the knowledge o such persons

or their representatives, oered and used or a purposeor which it is neither labeled nor advertised. So

what I say in my labeling is not the last word, but

ultimately what matters is the totality o what I have

done to promote the article and to some extent what I

know about how my customers are using it.

Eventually my students start asking me about what

trade shows I attend, what types o magazines I use

to advertise the sticks, what my salesmen say to

customers, and what I know about the actual usages othe sticks. And it turns out, in my hypothetical, I know

that many o my customers are using them as pediatric

tongue depressors, I promote them in advertisements

in hospital journals, and at least some o my salesmen

might encourage their use as tongue depressors. So

eventually my students come to the view that my

simple popsicle sticks might in act qualiy as medical

devices and be subject to FDA regulation.

Advice for wireless health start-ups

Companies engaged in making mobile phones (or

related articles or soware apps) need to go through

the same analysis to gure out i they are selling

medical devices. Tey need to look rst and oremost

to the labeling and other promotional materials they

use, but then also consider how they promote the

products. In this regard, its important to remember

that were looking or either an intended use directly

as a medical device, or an intended use as an accessory

to a medical device. Its more likely a cell phone or

related soware might end up as a regulated accessory,

than a stand alone medical device.

If it is a medical device, what next?

Tis analysis only answers the threshold question o

whether an article is a medical device. I it turns outto be a regulated article, a second step is to gure out

the degree o that regulation. A air number o medical

devices are exempt rom FDA premarket clearance,

and others are exempt rom the obligation to employ

good manuacturing practices. Te risks associated

with the intended use determine the level o regulatory

requirements, including validation and other design

rigor that FDA would require.

Not the end of the world

Merely being a medical device is by no means

the end o the world, just the starting point or

the analysis. Companies need to be mindul

o these consequences as they develop their

promotional programs or hardware and

soware in this mobile health space. FDA is

almost certainly looking.

Page 5


8/51

MobiHealthNews.com

o the orthopedic devices, or example, are in one part

o the regulations. So you might get lucky and nd one

that directly describes your product. A quick search

o the regulations revealed that the word computer

appears in 225 regulations, soware in 431 and

network in 43. Tere is, or example, a classication

or remote medication management systems in 21

CFR 880.6315.

But i you cant nd one that directly describes your

product, perhaps its because FDA considers your

product to be merely an accessory to a parent

device. Ill give you an example. In 2009 FDA clearedan updated version o the Polytel glucose meter

accessory, which is a small module that plugs into

the port o a glucose meter, receives data rom the

meter and transers it wirelessly to an Internet capable

communication device like a cell phone or an AP. In

clearing the device, FDA agreed with its classication

in 21 CFR 862.1345, which covers all glucose test

systems, including the parent glucose meters.

FDA will assign each product into one o three

classications, cleverly called class I, II and III.

Class I devices represent the least risk, while class

III represent the greatest. Associated with those

classications are specic regulatory requirements.

Many class I devices will be exempt rom premarket

clearance, and some products will be exempt romother regulatory requirements that Ill describe in a

minute. Some class I and most class II devices require

ling a premarket notication (or 510(k)) with FDA.

Tese submissions are manageable documents that

compare the new device to those lawully on the

market. Te specic data requirements are discussed

below.

In the last chapter I outlined the triggers that could

cause an ordinary mobile phone to become an FDA-

regulated medical mobile phone. In this chapter I will

outline the FDA requirements that would apply to a

mobile phone that crosses that line.

Premarket clearance or approval

In contrast to components that are simply sold to

another manuacturer, standalone medical devices and

accessories sold to end users may require some orm

o premarket clearance or approval. Once you knowyou have an FDA-regulated device or accessory, heres

how you gure that out, ollowing a ve-step process.

Tere is a bit o both art and science to this. FDA

has published about 1700 classication regulations.

Each o those regulations has a description or

identication o the types o devices covered by thatregulation. FDA has a searchable database o these

regulations accessible through their website.

Some articles o hardware and soware are so

important that FDA has separately classied them,

and you can nd them directly through searching. Te

regulations are organized by clinical application so all

Step-by-step: FDA wireless health regulationII.

Step one. Figure out the most appropriateclassication for your product.

Step two. Read the second half of theclassication regulation to see how FDA

regulates that particular article.

o summarize the last chapter FDA may regulate

certain mobile phones, accessories, a mobile

phone could become a regulated medical device

i the manuacturer, through its words and deeds,

conveys an intention that the phone be used

in medical applications. I also pointed out that

medical devices come in at least three dierent

favors: (1) standalone medical devices, (2)

accessories and (3) components to such devices.

Page 6


9/51

MobiHealthNews.com

Even once you know how a device is classied and thespecic regulatory requirements, you may well have

options or how you get marketing clearance. Lets say

your device is in class II, and some sort o premarket

notication or so-called 510(k) is required. 510(k)s

come in lots o dierent favors, including traditional,

special and abbreviated. For some, as an alternative

to ling at the FDA, you can seek to have your device

reviewed by an independent third-party who then

certies its review to the FDA. Going through each o

those options is beyond the scope o this article, butits important to understand that you have options. I

have tried to illustrate the major options in

Diagram 1below.

Te highest risk devices-class III-usually require

premarket approval (PMA) rom FDA, which can

cost millions. Most I devices can avoid that, unless

they are an accessory to a high risk device. I yourdevice is classied as an accessory, it is subject to all o

the regulatory requirements applicable to the parent

device.

FDA has published scads o guidance documents

on its website that cover many dierent aspects o

the technologies they regulate. Tere are guidance

documents on using wireless technologies, o-the-shel soware, and specic medical technologies such

as blood glucose meters. Its important you nd all o

these so-called special controls because youll need

to make sure that your product complies with those

technical standards.

Is it a device or an

accessory to a

device?

Does a classication

regulation cover it?

What options are

available for gaining

marketing clearance

or approval?

Unregulated

by FDA

It is

automatically

Class III

Exempt

510(k)

PMA

Petition for

Re-classication

de novo 510(k)

PMA

510(k)

3rd Party Review

Traditional 510(k)

Special 510(k)

Abbreviated 510(k)

yes

Covered

No

NotCovered

Diagram 1. Some Major Pathways to Market for IT Devices

Step three. Research the requirements.

Step four. Consider your options.

Page 7


10/51

MobiHealthNews.com

Even more choices need to be made here. Te amount

and type o data needed to secure approval depends

directly on the types o claims you want to make. In

many cases, you might have the option to merely make

a tool claim: a claim that your product simply does

a specic unction. In the accessory example I gave

above regarding the Polytel product, the company

makes a tool claim that its article merely connects onemedical device to the Internet.

You might also wish to make an outcome type claim:

a claim that your device will help treat or diagnose a

specic disease or condition. For example: Using this

device to transmit your blood glucose readings to your

physician typically allows or better control o diabetes

and will help you wean yoursel o dependency on

insulin.

Te types o data you need to provide FDA will

depend on which type o claim you make and indeed

on the exact wording o the claim. ypically, you could

support a tool type claim with bench testing or other

non-clinical evaluation. Basically you need to prove

that your tool works. I you choose to make outcome-

based claims, youll need to prove that the device

indeed achieves those outcomes. Tats much harder,

and requires testing in a clinical setting.

I you are ollowing the 510(k) pathway, the

undamental standard is whether your device is

substantially equivalent to other lawul devices. So

most submissions ollow a comparative ormat where

the submitter compares his device to others in the

marketplace.

In addition to the premarket clearance or approval

question, devices must comply with other FDA

requirements, as described in the next section.

Quality system requirements

Te other big hurdle is ensuring compliance with the

quality system regulations. As the name suggests, these

requirements are ocused on ensuring manuacturers

produce quality products commensurate with the

risks associated with using the device. So the exact

nature o the quality system will depend on the

intended use o the article. For companies that are ISO

13485 certied, becoming compliant with the quality

system regulations is mostly a matter o creating

documentation systems so that you can prove yourcompliance. More substantial changes are required i

the company is only ISO 9001 certied.

Tese quality system regulations apply cradle-to-grave,

so the minute you begin the design process, the design

controls must be observed. Design Controls speciy

the process used and the records to be created during

the design, development, and manuacturing scale-

up o a device. Tey extend all the way to postmarket

issues such as complaint handling, risk management,

and ailure analysis and eedback to the design and

manuacturing organizations.

In the medical device world, component suppliers

are exempt rom these regulatory requirements

(though sometimes they are contractually required).

Step ve. Determine the type of evidenceneeded for FDA clearance.

Page 8


11/51

MobiHealthNews.com

Tat doesnt mean the components need not be high

quality, but rather it means that the nished device

manuacturer has the regulatory burden o assuring

the quality o the components it uses. While this

could mean incoming inspections o raw materials,

components and subassemblies, it more oen means

that a device manuacturer must apply all necessary

controls on a supplier-by-supplier basis to make surethat any controls the supplier is missing, the device

manuacturer provides.

Adverse event reporting

As kind o a belt and suspenders, in addition to

requiring premarket review o the product and

imposing quality system requirements, FDA expectscompanies to be vigilant or reports o people getting

hurt or products malunctioning. In some cases

those incidents might rise to the level o needing to

be reported to FDA. Tese so-called Medical Device

Reports are time sensitive (an assessment is due in a

matter o days or weeks), and require the company

to have in place systems or reviewing all relevant

incoming inormation to assess the potential o each

report to be categorized as an Adverse Event. I the

company decides to take corrective action, in some

cases the company needs to notiy FDA.

From here

Tere is no doubt that these requirements canbe quite burdensome. But to state the obvious,

thousands o companies have ound it possible

and worthwhile to enter the medical device

realm. In the coming chapters, I will explore the

unique aspects o FDA regulation o soware,

a business assessment o whether entering the

FDA-regulated realm is worthwhile, options

or staying out o regulated territory, and some

thoughts on where uture FDA regulation could

go in this space.

Other regulatory requirements

FDA has a variety o other requirements that

may apply, including such things as registering

manuacturing acilities, listing the products

manuactured, specic requirements or investigating

the saety and eectiveness o an unapproved device,

export and import restrictions, and labeling andadvertising requirements. FDA also has a variety o

requirements that apply to postmarket distribution to

ensure that products can be identied and traced back.

Page 9


12/51

MobiHealthNews.com

(I would like to thank John Murray o FDA, Scott

Tiel o Roche Diagnostics and Russ Gray o the

Anson Group or their comments on a draf o this

chapter. Te views expressed right or wrong are

only the authors and should not be attributed to the

commenters.)

Software Roles

From those two prior chapters, its important to

remember that medical devices, including soware,

How to get FDA to clear a mobile health appIII.

can be divided into three categories: (1) standalonedevices, (2) accessories and (3) components.

Standalone are those devices that are intended to

directly provide the diagnostic or treatment, while

accessories are sold directly to end-users and work

with standalone devices. Components, in contrast,

are purchased by manuacturers o standalone or

accessory devices or incorporation beore sale. Mobile

device (e.g. cell phone apps) can be an accessory, as

opposed to a component, i they are sold or even given

directly to the end-user: the patient. Tey can also

be standalone i they do not connect physically or

virtually to any device other than the mobile device

platorm.

Understanding that is important because determines

the regulatory requirements that apply. I the app is

designed, or example, to acilitate the downloading

o inormation rom a blood glucose meter, the

app and maybe even the soware environment are

accessories and will be regulated in the same manner

as the blood glucose meter. Te classication and

most o the requirements or the submission to FDA

will be dictated by how the parent standalone device

is regulated. So, the Airstrip OB app is regulated as

part o a perinatal monitoring system generally, just

as the sensors and other hardware that gather the

inormation.

Most people in the wireless health industry

have heard by now that FDA has started to

clear applications or cell phones with medicalindications. A widely-reported example is AirStrip

OB, cleared to deliver patient waveorm data

including etal heartbeat and maternal contraction

patterns in virtual real-time directly rom

the hospital labor and delivery unit to a doctors

mobile wireless device, specically to an iPhone

or a Blackberry. Other soware developers are

probably interested to learn when FDA clearance

is required, and what it takes to accomplish that

FDA clearance. In this chapter, Ill address both othose questions at a high-level.

In the rst chapter I outlined the actors FDA

considers generally when deciding which products

need to be regulated and which all outside o the

scope o a medical device regulation. In Chapter

2, I outlined the basic steps or getting a medical

device cleared by FDA. Tis chapter will ocus on

the unique aspects o those two questions in the

context o mobile device apps.

Page 10


13/51

MobiHealthNews.com

Some apps will not be simply enablers o transmitting

data rom a medical device, but will actually serve

a standalone purpose. From the prior two chapters,

remember that its the claims the soware developer/

seller choose to make, within reason, that triggers

FDA regulation in the rst place, and the degree o

that regulation when it comes to obtaining clearance.

Once you properly gure out which o the three roles

the soware plays, you can gure out its regulatory

status. ypically thats one o the ollowing three

choices:

Soware that does NO meet the legaldenition o a device and is not regulated by

FDA.

Soware that does meet the legal denition

o a device but is currently not actively

regulated, and FDA is unlikely to require

pre-market review.

Soware that does meet the denition o a

device and FDA is actively regulating and

would require a pre-market review.

Except or a ew specic exempt device types

identied in the classication regulations, that middle

category isnt today a regulatory classication youll

nd dened in any FDA records. Fortunately or

unortunately, depending on your perspective, FDA

has been very reluctant over the last dozen years to

dene with any real precision its policy on whichtypes o soware must undergo premarket review and

clearance, or even approval. Te agency has held open

public meetings and foated concept papers, and more

recently has proposed a limited device classication

or medical device data systems, but by and large has

not with any certainty claried its policy on when

soware trips the premarket requirement.

So the ollowing is just my personal observations

about how FDA regulates soware in practice, as I

can glean rom watching FDA enorcement actions,

podium policy, and the inormal statements FDA has

made in concept papers.

Unregulated Software

In its explanation surrounding the agencys proposed

classication o Medical Device Data Systems

published in 2008, FDA explains:

It is FDAs long-standing practice to not regulate thosemanual oce unctions that are simply automated

or the ease o the user (e.g., oce automation)

For example, the report-writing unctions o a

computer system that allow or the manual (typewriter

like) input o data by practitioners would not be

[regulated] because these systems are not directly

connected to a medical device. In addition, soware

that merely perorms library unctions, such as

storing, indexing, and retrieving inormation not

specic to an individual patient, is not considered tobe a medical device. Examples include medical texts or

the Physicians Desk Reerence on CD-ROM that are

indexed and cross-reerenced or ease o use.

FDA goes on to say it wont regulate soware that

allows a doctor to enter or store a patients health

history in a computer le. On its ace, that description

o unregulated soware is somewhat narrowly written.

Tat is not surprising since FDA always takes an

expansive view o its jurisdiction, and is not likely toconcede much ground in that regard.

Beyond that passage, I would add that there are two

key eatures or most unregulated soware.

Te data are entered manually; they are not inputted

directly rom any machine that touches the patient

Page 11


14/51

MobiHealthNews.com

or a patient specimen. Tats important to avoid

becoming an accessory to a medical device.

Depending on how inputted, the output amounts

simply to providing the stored data back to the patientor proessional. Te system does not automatically

guide the diagnosis, nor does it guide any other

instrument. In other words the soware does not

contain any algorithms that provide clinical-like

unctions that go beyond what FDA oen reers to as

library unctions. It merely displays the data or the

user to read and interpret.

Many mobile device apps do indeed t this category o

unregulated soware. But it is important to rememberto conduct an honest evaluation o the intended use

o your product. Te evaluation should ocus on the

clinical intended use o the product and less on the

technical characteristics o your soware or your

system. In FDAs eyes, your soware product does not

have to provide a complete cure, mitigation, treatment,

or prevention o disease to meet the legal denition

o a device. I your soware is intended to provide

any part o cure, mitigation, treatment, or prevention

o disease, FDA will probably consider it a device.Understanding the limits on the unregulated category

is probably best explained, though, by looking at the

other two categories.

Regulated Software Exempt from

Premarket Clearance

Since the late 1980s, FDA has been publicly declaring

that there exists a category o soware that technically

qualies as a medical device but or which FDA has no

intention o requiring the submission o a premarket

notication or approval application. For those who

are really interested in this topic, it probably makes

the most sense to start with the FDA Policy or the

Regulation o Computer Products, 11/13/89 Dra.

In that policy, there are two categories o soware

products that were technically regulated but alsoconsidered exempt rom the major requirements:

(1) general purpose articles as dened in a regulation

and (2) soware that involves competent human

intervention. Unortunately FDA never got around

to actually codiying the competent human

intervention exemption. In its classication process,

FDA has adopted certain general purpose or low risk

exemptions that cover soware, such as laboratory

inormation management systems (LIMS) (21 CFR

862.2100) used as calculators or data processingmodules or clinical use.

About 7 years aer FDA published the 1989

dra policy, it appeared FDA was moving toward

ormalizing its computer product policy. In addition

to publicly announcing that intention, FDA hosted

a large meeting in Washington and invited many

stakeholders to discuss what the policy should be. In

preparing or that meeting, FDA draed a summary

o what it considered to be its then existing policyon computer products. Tose workshop materials

explained that much o the soware the agency was

seeing constituted accessories to medical devices,

and the competent human intervention concept

was only intended to apply to truly standalone

soware. Te agency also argued that the concept

o what constitutes competent human intervention

had become increasingly complex and dicult to

administer. FDA observed:

In general, to permit competent human intervention,

the soware decision process must be completely

clear to the user, with a reasonable opportunity or

challenging the results. Tere must also be adequate

time available or refection on the results.

Page 12


15/51

MobiHealthNews.com

Te electronic transer or exchange o medicaldevice data rom a medical device, without

altering the unction or parameters o anyconnected devices. For example, this wouldinclude soware that interrogates a ventilatorevery 15 minutes and transers inormationabout patient CO\2\ levels to a central patientdata repository;

Te electronic storage and retrieval o medicaldevice data, without altering the unction orparameters o connected devices. For example,this would include soware that storeshistorical blood pressure inormation or laterreview by a healthcare provider;

Te electronic display o medical device data,without altering the unction or parameterso connected devices. For example, this wouldinclude soware that displays the previouslystored electrocardiogram or a particularpatient;

Te electronic conversion o medical devicedata rom one ormat to another ormat in

accordance with a preset specication. Forexample, this would include soware thatconverts digital data generated by a pulseoximeter into a digital ormat that can beprinted. Examples o medical device datasystems that would be used in the home aresystems that periodically collect data romglucose meters or blood pressure devices orlater review by a healthcare provider.

Tis category is only available as an exemption rom

premarket clearance so long as the data set is intended

or proessional use and does not produce irreversible

data compression.

Based on the ollowing preamble rom the proposed

MDDS rule, I would suggest that through this process

FDA is seriously rethinking its soware policy.

Since 1989, the use o computer-based products and

soware-based products as medical devices has grown

exponentially. In addition, device interconnectivity

and complexity have grown in ways that could

not have been predicted in 1989. Tis growthand expansion have created new considerations

or elements o risk that did not previously exist.

FDA realized that the Dra Soware Policy was

not adequate to address all o the issues related to

the regulation o computer based and soware-

based medical devices. Based on this history and

the complexity and diversity o computer soware,

FDA decided it would be impractical to prepare one

soware or computer policy that would be able

to address all the issues related to the regulation ocomputer- and soware based medical devices.

While FDA has proposed the MDDS category, as o

this writing the agency has not adopted it in nal

orm. During the interim, however, it seems to be

the best guidance available or deciding whether a

premarket clearance is required.

Dividing Line Between Software

Requiring Premarket Notication And Not

In dening medical device data systems, FDA was

merely trying to dene one relatively narrow, cohesive

type o data set that the agency would regulate but

exempt rom premarket notication. However, that is

But again, FDA never ollowed through to adopt a new

regulation or policy.

In early 2008, departing somewhat rom the 1989approach, FDA proposed a new category o soware

that would t within this general category o regulated

soware exempt rom premarket clearance. Tey

proposed to call the new category medical device data

systems (MDDS), and they dened it to include:

Page 13


16/51

MobiHealthNews.com

Whether the soware is intended ordesigned to provide any real time, active, oronline patient monitoring unctions.

Te capability to display, create, or detect

alarm conditions, or actually sound analarm, or the capability to create alarmsthat are not already present rom theconnected medical devices.

Te seriousness o the particular diseaseor condition which the medical sowaredevice is intended to diagnose, cure,mitigate, treat or prevent and howthe soware contributes to the usersdecision-making or diagnosis or clinical

management o the patient. Example:Is it soware designed to call attentionto imminent hazard conditions or is itsoware that provides long-term storageor diagnostic inormation?

Te amount o time available beore using theinormation provided by the medical sowaredevice, i.e., the time until a therapeutic oradditional diagnostic intervention must beimplemented by the health care provider aer

the results o the soware have been provided.Example: Is the device an EKG reading andanalysis package whose output is SHOCKNOW or does it provide a proposed readingwith notation that the rhythm itsel should bechecked?

Whether the data output is provided ormanipulated in a novel or non-traditionalmanner, or whether decision trees within thesoware depart rom customary use. Example:Do the systems algorithms, parameters,internal decision trees, or other outputmanipulations depart rom customary use ortraditional data presentation?

Whether the medical soware device providesindividualized patient care recommendations,e.g., whether the soware suggests orrecommends specic treatment or a specicpatient. Example: How specic is the sowareoutput with regard to particular patients?

Is the soware providing general advice orinormation, like a library, article, or textbook,or is the soware designed to provide a specicrecommendation or a specic patient whoseindividual data have been entered as input?

Whether the mechanism by which the medicalsoware device arrives at a decision is hiddenor transparent, i.e., does the product useundisclosed parameters or internal decisiontrees or other mechanisms that are not

available or review by the health care provider.Example: How transparent is the sowaremanipulation to the intended user community?Included in transparency is the extent to whichlimitations on the process are made known tothe user, such as data contraction, deletion,editing, or simplication. Also, how arecomparisons made to normative databases andhow are normative databases created?

only one example, and it is not meant in any way to

be the only example o soware that would be treated

as regulated but exempt. Indeed my understanding

is that the agency plans to publish uture proposals

dening other regulated exempt and nonexemptcategories.

But what are soware companies supposed to do in

the meantime? What else ts within this regulated but

exempt category? Te unortunate answer is that this

represents a huge gray area. Te best anyone can do

is look at a variety o risk actors to gure out which

side o the premarket clearance line again a piece o

soware alls. Based on FDA comments and actions

over the last 20 years, I would propose the ollowinglist o actors be considered:

Page 14


17/51

MobiHealthNews.com

Guidance or Industry Wireless Medical

elemetry Risks and Recommendations

Guidance or Industry, FDA Reviewers andCompliance on O-Te-Shel Soware Use in

Medical Devices

General Principles o Soware Validation;

Final Guidance or Industry and FDA Sta

Guidance or the Content o Premarket

Submissions or Soware Contained in

Medical Devices

Cybersecurity or Networked Medical Devices

Containing O-the-Shel (OS) Soware

Device-specic guidance (e.g. glucose

monitors)

Does the product provide new capabilities

or intended uses for the user?

Until FDA decides to urther clariy the middle

category o regulated but exempt rom premarket

notication, a practical consideration o those actors

should help the company decide whether in FDAs

eyes the soware is risky enough to require premarket

clearance. As I said, you wont nd that in any existing

FDA guidance or regulation. Tats just based on

practical observation.

Software Requiring FDA Pre-marketClearance

In the second chapter, I outlined generally the

approach or securing FDA clearance. In the case

o soware, the rst step is identiying the most

appropriate classication rom among the roughly1700 classication regulations. Te word soware is

contained in 431 dierent regulations, so its not an

easy task.

Remember that soware that accessorizes a medical

device is classied with that medical device. So i a cell

phone app allows or the downloading o blood glucose

data, the app is classied with the blood glucose

meter and regulated to the same degree. As another

example, i the app is designed to help with medication

management, there is a specic classication or

such soware in 21 C.F.R. Sec. 880.6315. Tis can

obviously get very complex in an interconnected

system, perhaps on a wireless network, but thats too

much or this report.

Usually in the context o clearing an app, FDA will

check to ensure that the soware manuacturer is

complying with any published special controls. Te

special controls are typically stated in FDA guidance

documents and include, or example:

Page 15


18/51

MobiHealthNews.com

Te submission will need to be based on an

appropriate level o validation or the soware. I the

app is an accessory, the parent device determines

the level o validation required. I not an accessory,

to determine the validation required, you will need

to gure out whether FDA classies the soware as

major, moderate or minor level o concern.

Its major i the soware directly aects thepatient or anyone else such that a ailure

could result in death or serious injury

Its moderate i the injuries would be non-

serious

An apps risk and the associated level

determine:

And o course, beore you can actually bring the

product to market, you will need to make sure that

your manuacturing meets the FDA requirements

or quality systems. In the case o soware, those

requirements are acutely elt in the development stage

as the soware needs to be developed under special

FDA design controls and in the post-launch stage as

the manuacturer deals with product recalls, updates,

event reporting, product liecycle management and so

orth.

Conclusion

Tose are the basic FDA requirements that

apply to bringing an app or other piece o

soware to market in the mHealth eld.Undoubtedly, to those not accustomed to the

FDA regulated world, those hurdles might

seem high. In the next chapter, well tackle the

benets and burdens o going through those

admittedly rigorous FDA requirements rom a

business standpoint. In particular well ocus on

the competitive advantages that can be derived

rom entering the regulated space, weighed

against the cost o achieving those advantages.

the depth and degree o hazard analysis

and mitigation that is expected

the depth and degree o documentation

what needs to be submitted vs. merely

documented

the rigor applied to the verication and

validation o the soware

the degree to which the device

manuacturers soware development

process is scrutinized

Page 16


19/51

MobiHealthNews.com

Should mHealth companies want FDA regulation?IV.

(I would like to thank Dr. Deepak Ayyagari o Sharp

Laboratories o America and Dane Stout o the Anson

Group or their comments on a draf o this chapter. Te

views expressed, right or wrong, are only the authors

and should not be attributed to the commenters.)

Its Okay to Consider the Benets of

Federal Regulation Limiting Competition

As Ive learned recently working with Silicon Valley

companies, I companies generally seem to love

nothing more than a good, competitive, bare-knuckled

ght with their competitors, and abhor the rst hint

o articial restraints on competition, especially those

rom the government. In the I industry, cooperation

around the development o industry standards sets the

rules o engagement or the market, and then everyone

competes intensely based on those rules and execution

o their business plan. Innovation can fourish, with

upstarts appearing and challenging big, established

companies dominance o any particular portion o

the business. Te big companies accept it because they

are moving aggressively too; adjacent markets can

be pretty attractive i it appears there is money to be

made by oering a aster, better, cheaper alternative

to the current market leaders. Te goal o unrestricted

competition is great, and undoubtedly benets

customers in terms o producing products that theywant at the best possible prices.

However, as I companies consider entering the

health market, they need to appreciate the dierences.

In traditional I and telecommunications markets,

i a product doesnt work, such as a server crashing,

people can become really annoyed when they cant

check their email rom their mobile phone every

second. Inconvenient and somewhat costly, or sure,

but all will be orgiven once the server is back upand running. I it happens with any requency, the

company that produced the technology will get a

reputation or poor reliability, and may go out o

business.

But companies in the health space that produce

products, using many o the same components as

At the risk o insulting my new riends in Silicon

Valley, I submit that traditionally-unregulated I

companies may want to adopt a dierent view

o ederal regulation. Over the last couple years,

Ive had the opportunity to observe rsthand the

culture clash as ree-spirited, libertarian Silicon

Valley meets Rockville, Maryland, the home o the

decidedly more buttoned-down U.S. Food & Drug

Administration. Rather than feeing in ear o the

ederal bureaucracy, I would argue that at least

some I companies should consider embracing

ederal regulators. Well, maybe start with at least

shaking hands.

In the rst chapter, I started o by explaining the

scope o FDA regulation, and then in the second

and third chapters explained how companies could

comply with FDA regulation in the cell phone

accessory and soware app elds. With that basic

ramework behind us, in this chapter we will

explore the burdens and benets o entering FDA

regulated territory. Yes, I said benets.

Page 17


20/51

MobiHealthNews.com

what goes into the email server, ace a much dierent

problem set. I their product doesnt work consistently

and reliably, they can hurt people, or even cause

their deaths. So we dont, and cant, rely simply on

competition to weed out the good rom the bad.

Instead, we regulate them.

Tats more than just a legal ramework: thats a

philosophy or how the marketplace in health works.

You can think o ederal regulation as just a bunch o

health and saety laws that prescriptively require that

you do this and not do that, but its more accurate to

think about ederal regulation as saying we only want

companies willing to invest the signicant resources

required to get the product right the rst time theyenter the market, and to take the risk o ailure to

meet high standards o saety and eectiveness.

o put it in business school terms, ederal regulation

amounts to a signicant barrier to entry or the health

markets. And that is quite deliberate. FDA law means

dont enter this business unless youre willing to do

it right. And, as classic economic theory suggests,

companies that are willing and able to invest the

additional resources required and take greater riskget rewarded with greater return. Tats as it should

be, to protect the public rom unsae protects and to

urther the public health by encouraging companies

to invest in medical innovation. In that later regard,

FDA law rewards innovation in a manner similar to

the patent laws. We simply do not want all companies

to be able to make health care products. We choose to

impose much higher standards in that eld, and or

companies willing and able to meet those standards

we allow them to earn a potentially higher return.

Benets and Burdens of FDA Regulation

Lets bring it down rom the 100,000 . view and get

more specic about how entering FDA-regulated

space aects both the companys cost structure and

opportunities to earn a higher return. For a specic

company, this would require a airly detailed analysis,

but let me provide you with an overview here.

o conduct this analysis, Ive chosen the competitive

strategy ramework developed by Pro. Michael

Porter at the Harvard Business School. Its amiliar

to many and reasonably well-suited to assessing the

impact o a regulatory scheme on a business. In a

pair o roughly 500 page books, Pro. Porter details

an entire methodology or considering a companys

strategic options in light o the markets and business

environment in which they operate. Ill ocus on two

tools he uses in his analysis.

FDA Regulatory Impact on the Value

Chain

In his value chain tool, Pro. Porter ocuses on the

individual rm, and how the rm creates value. In

Diagram 1 below, Pro. Porter shows conceptually

along the bottom the sequence o steps necessary

to produce a product, and in the rows at the top theoverhead necessary or the rm to unction.

source: Michael Porter, competitive advantage

technological development

human resource management

firm infrastructure

procurement

inbound

logistics

operations

outbound

logistics

marketing

&

sales

service

margin

margin

Diagram 1. Value Chain Activities

Page 18


21/51

MobiHealthNews.com

technological development

human resource management

firm infrastructure

procurement

inbound

logistics

operations

outbound

logistics

marketing

&sales

service

Design Controls

margin

margin

Complaints

and

AEs

Supplier Controls

Training

Validation

Purchasing

controls

Claims

Regulation

InProcess

QualityControls

Shipping

Validations

Te specic activities that the company selects to

engage in directly determine its prot margin. Certain

activities are high-value and produce higher margins,

while others not surprisingly are lower. A rms

competitive advantage derives rom its ability to select

and execute the most highly value-added unctions.

Much more could be said, but lets move on to look

at how FDA regulation impacts the value chain.

o convey this impact at a high-level, Ive drawn

the intensity map included as Diagram 2 below.

o understand an intensity map, think National

Geographic magazine and a map showing population

density through colors. Ive borrowed that approach

here to show the intensity o FDA regulation on each

o the dierent elements o the value chain analysis.

Tis is a bit subjective, so others might disagree. I also

made an assumption that the company has a basic ISO

9001 type quality system already.

Heres how I came up with the intensities depicted.

FDA Approval. One o the most challenging steps

o FDA regulation is securing premarket clearance

or approval; there is no beta testing allowed in

healthcare. You cant oer someone the chance to sign

up or a discount i they help you test the product rst

to see i it works as you intended. For an innovativedevice, that requires substantial eort to design and

then test the device to ensure that it meets its intended

use saely and eectively, and perhaps highly regulated

clinical trials. In the diagram, I suggest that the eects

o this requirement are elt as a part o validation and

design controls, as well as in the regulation o the

claims that can be made.

Marketing regulation. In addition to FDA rules

regarding securing approval o specic claims,other ederal and state regulators impose stringent

requirements on the marketing unction. Tus

ederal regulation is perhaps most intensely elt in

the marketing unction o the company. Again, this

will eel quite oreign in Silicon Valley, where battles

between Marketectures wage almost daily. Cloud

Diagram 2. FDA impact on value chain activities

FDA requirements will

be very similar to ISOsystems

FDA requirements will

be more stringent

FDA requirements

will be far moredemanding than ISO

Page 19


22/51

MobiHealthNews.com

Impose added cost.

Lengthen lead times in product development.

Add complexity.

Can be dicult to implement rom a culturalstandpoint or a company unaccustomedto that environment because they requirediscipline and rigor.

And o course multiply the paperwork.

In their analysis o the opportunity health markets

present, many companies go no urther than this.

But this is exactly where some companies should

persevere in their assessments, and consider the

dynamics o the medical device market place.

FDA Regulatory Impact on Competitive

Forces

In Diagram 3 below, Pro. Porter depicts the ve

orces that in his model drive the industry dynamics.

Tose ve orces include:

pitches regulated by FDA would require detailed

atmospheric reporting o the composite gases in the

cloud, as well as an accurate orecast o how the cloud

will impact the weather, good or bad.

In the postmarket servicing unction, companies inthe medical device eld must adopt systems designed

to vigilantly watch or and report any problems,

and take perhaps signicant corrective action when

problems arise.

In the quality system area, companies that are certied

to ISO standards will have the most new work to do in

the design control and validation areas.

In the modest impact category, the quality systemrequirements will require that the device manuacturer

take greater measures to assure the quality o inputs

being supplied. Tis will include periodic auditing o

suppliers to ensure their systems are robust enough.

Te wide spread decision to outsource and o-shore

customer service unctions, prevalent in I, would

have to be considered in light o these requirements.

Tey could still be done, but doing so could take

longer, be more involved, and actually end up costing

more than keeping it in-house.

Te changes necessary in the actual production o the

products are perhaps least burdensome or a company

that is ISO compliant.

In general, all o those measures:

bargainingpower ofsuppliers

competitive

rivalry

threat ofnew

entrants

bargaining

power ofbuyers

threat ofsubstituteproducts

1. Te threat that new companies will enterthe market

2. Te threat that new products will becomesubstitutes or the marketed products

3. Te bargaining power o suppliers

4. Te bargaining power o customers

5. Te competitive rivalry within the industryitsel.

Diagram 3. Five Forces: Impact of FDA Regulation

Page 20


23/51

MobiHealthNews.com

Te degrees o those threats and powers determine the ability o the company to earn a prot. With regard

to the threat that new companies will enter the market, Pro. Porter identies several barriers to entry, and

one o them is government policy or regulation.

Assessing the ve competitive orces, in some cases the analysis reveals some interesting opportunities. In

diagram 3, again using an intensity map where darker yellow represents more competition, I suggest where

I perceive the greatest sources o competition to reside or the medical device industry generally.

In the industries regulated by FDA, the greatest competition tends to be rom established rms in the

same industry. Tis is true or the simple reason that entering the regulated industry oen requires a very

signicant investment to create the innovations and establish the manuacturing systems necessary to

produce them, as well as considerable lead time to get through the FDA clearance or approval process.

Tus the threat o new entrants is lower than the competition created by existing rms that have well-

established systems in place or bringing new regulated products to market. Indeed a companys ability to

cope with the regulated environment becomes a key asset, determining competitive advantage.

Tere is an important limitation to this, however. Companies that ollow the premarket clearance route,

i they dont have patent or other intellectual property protection or their products, might nd that

other established device companies can quickly ollow them through the FDA clearance process. Tis is

sometimes reerred to as a rst mover disadvantage. Further, the laws administered by the FDA do not

create any private cause o action that an individual company can use to orce competitors to abide by the

law. FDA is solely responsible or enorcement o its laws, and i the agency isnt paying attention or simply

doesnt have the needed resources, less reputable competitors might get away with taking shortcuts.

Page 21


24/51

MobiHealthNews.com

How to Avoid mHealth RegulationV.

(I would like to thank Leah Kendall o

EpsteinBeckerGreen and Dane Stout o the Anson

Group or their comments on a draf o this chapter.

Te views expressed, right or wrong, are only the

authors and should not be attributed to anyone else.)

The Binary Misunderstanding

Some I companies new to the health eld seem to

misunderstand the nature o FDA regulation, and

Strategies for mHealth Companies Wishing to Avoid FDA Regulation

think o it as all or nothing. In other words, a company

is either a manuacturer o medical devices and subject

to the ull panoply o FDA requirements, or theyre notand likewise are not subject to any FDA restrictions.

But thats not an accurate depiction.

Instead, companies should think o FDA regulation as

a continuum. Diagram 1 on the next page illustrates

the two extremes and a ew o the cases in between.

On the ar right side, the diagram depicts the

traditional manuacturer o nished medical devices

that is indeed subject to all o the FDA requirementsor medical devices. Even here, though, there are

dierent levels o FDA requirements depending on the

novelty and risk associated with a particular device. As

outlined in the second chapter, devices are classied

into three dierent classications, and the types and

burdens o FDA regulations vary considerably. Class

III medical devices include such things as pacemakers,

embody the greatest risk and thus must meet the most

demanding requirements. Class I devices include such

things as tongue depressors and have very minimalFDA requirements. Indeed, most class I devices do

not even need to be approved by FDA, and the quality

system requirements might be very basic. Many

mHealth devices might all into class I or class II.

All o this was covered in much greater detail in the

second chapter in this report.

Most people know the dierence between tax

avoidance and tax evasion. ax avoidance is

the lawul planning o such things as charitablecontributions to minimize taxes, while tax evasion

is the unlawul and usually deceitul actions taken

to hide income. In this chapter, I will share some

tips or the avoidance o FDA regulation, not the

evasion o FDA regulation.

Te rst three chapters in this report dealt with

understanding the scope and nature o FDA

regulation or mHealth, and the ourth chapter

advanced the notion that I companies wanting tomake money in health ought to consider entering

the FDA-regulated zone. Nonetheless, subjecting

your company to FDA regulation is not or

everyone, so this chapter is designed to help those

who have decided to stay out o the production

o FDA-regulated nished medical devices. In

particular, I explain our ways to connect to health

markets, and the pluses and minuses o each such

approach.

Page 22


25/51

MobiHealthNews.com

Finished

Class IMedical

DeviceMFR

Contract

MedicalDevice

MFR

Component

And Kit PartSuppliers

Unregulated

ArticleMFR

GMP

Compliance

Full FDA

ComplianceBut Often

Exempt

Inspections

by FinishedDevice

MFR

Good

DistributionPractices &

MarketingCompliance

No FDA

ReachFull FDA

Compliance

1 2 3 4 5 6

Full FDA

Compliance510(k)

7 8

Finished

Class IIIMedical

DeviceMFR

Full FDA

CompliancePMA

e ca

DeviceMFR

Device

MFRMedical

DeviceDistributors,

Retailers& Servicers

Finished

MedicalDevice

MFRThat uses

Contractors for

Compliance

Finished

Class IIMedical

DeviceMFR

Diagram 1. Continuum of Potential Involvement in the Device Industry

Four Ways to Connect to The Health

Market While Reducing or Avoiding FDA

Requirements

Beore I go through the our strategies, it probably

goes without saying that each one is predicated onthe company ully implementing the strategy in good

aith. Anything less potentially becomes FDA law

evasion, rather than avoidance. Okay, so here they are:

Strategy 1: avoid medical devices and their

accessories.

About now youre wondering whether this article is

worth reading, but stick with me or a second, theres

a more subtle and proound observation to be made.

In your mind, go back to the very rst chapter on the

scope o FDA regulation. I went through an example

o a stick, and how it could be either a popsicle stick

or a pediatric tongue depressor, depending on what

claims the company chooses to make. My point is

that in many cases, the design o the product does

not determine its regulatory status, but rather the

promotional claims determine its status. So i your

On the ar le side, the diagram includes unregulated

articles such as personal computers that contain no

medical reerences at all and over which FDA has no

regulatory authority. Its the stu in the middle that is

interesting or mHealth purposes.

Te cases in the middle include, or example,

companies that merely make components or others

to use in manuacturing medical devices, distributors

o nished product that have no control over thepromotional claims or the design specications o the

device, and contract manuacturers that make nished

medical devices at the direction o another company.

Tese dierent unctional responsibilities all have

narrower sets o FDA requirements that apply to them,

directly or indirectly. Its important to understand the

range o possible relationships beore talking about

ways to reduce or avoid FDA requirements, and

exactly what that means.

Page 23


26/51

MobiHealthNews.com

company can reach its commercial objectives without

medical claims, and i the product has legitimate and

material nonmedical uses, you might be able to avoid

FDA regulation by avoiding medical claims.

A simple cell phone provides another example. Acell phone can be promoted merely as a cell phone,

and no FDA compliance issues will arise. But i the

manuacturer o the cell phone starts to make claims

that the phone is suitable specically or healthcare

applications, the cell phone manuacturer runs the

very real risk o turning its simple phone into a

regulated medical device.

Remember rom the rst chapter that the

manuacturer might get into trouble making claimsthat its product is specically intended to accompany a

medical device. Tat may very well make the product

an accessory to the medical device, which makes

it a regulated device. Again, claims are pivotal in

determining whether something is an accessory or

not.

In the last couple years as Ive been watching whats

coming out o Silicon Valley, Im seeing a tremendous

number o hardware and soware products thatprobably could be sold as unregulated articles, but

where the manuacturer, possibly quite inadvertently,

is making claims that would cause FDA to regulate

them. FDA is stretched pretty thin these days, so

they arent watching everything coming out o the I

industry, but someday I suspect FDA will get more

active in this space.

Tere are limits to this strategy. I cant make a

pacemaker, or example, and try to pass it o as a

simple, generic piece o electrical equipment. In

designing the pacemaker, Ive done too much to make

the design specic to a medical use to later disclaim

that use. Remember intended use is judged by

words, actions, and in some cases, inaction. I youre

interested in this strategy, you ought to go back and

review the rst chapter o this report.

A number o startups in mHealth have come up with

very innovative business plans that put them squarely

in the gray area between medical and nonmedical

intended uses. For example, there are companies

developing strategies or remote monitoring o people,

rather than their disease or condition. Tere aregray areas between wellness programs and disease

programs where FDA needs to give industry clearer

guidance. Obesity, as a disease, is oen dicult to

distinguish rom general physical conditioning.

Unortunately, I suspect we will all need to eel our

way along in the dark or the time being.

Finally, to employ this strategy, the maker o the

equipment must be duly diligent in avoiding making

medical claims. Tat means it needs to have somelevel o compliance and training systems in place to

ensure, or example, that sales representatives do not

go rogue. Even unauthorized sales activity can come

back to haunt the company i the government decides

that the company wasnt careul enough in managing

its people.

Strategy 2: avoid controlling the product

specications or the claims made.

Most FDA requirements, including the need to obtain

FDA clearance or approval, and the responsibility or

reporting adverse experiences all on the company

that owns and controls the product specications and

the claims made. Because most o the risk o a medical

device stems rom its design and the claims made

about it, whoever controls those two eatures has most

o the FDA compliance responsibilities. So, i you dont

want those responsibilities, dont own or control those

two eatures o the device.

Some examples probably would help. In most cases, a

contract manuacturer does not control the product

specications or the claims made about the product.

Tats true even i the contract manuacturer produces

nished product and drop ships it to the ultimate

Page 24


27/51

MobiHealthNews.com

purchaser on behal o the specication owner. In

that case, FDA looks to the specication owner or

compliance with most o the agencys requirements,

even i the specication owner never even touches the

device.

Indeed, ownership o the product and the control o

the specications and labeling determine regulatory

responsibility instead o who in act engaged in the

design process or wrote the label. Companies oen

ask a contract manuacturer to help with the design

process, or enlist the services o an engineering rm.

None o that matters. Te only thing that matters

is who, at the end o the day, owns the product and

controls the specications and the label or the

product.

Tis control rule is also the basis or organizations

such as distributors and retailers to pass regulatory

responsibility up the chain o distribution to

whichever entity controls the specications and the

labeling. Although distributors and retailers have

limited FDA responsibilities, the responsibilities

or seeking FDA clearance and ensuring the quality

o the product remain with whoever controls the

specications and labeling.

Components suppliers similarly avoid much o the

onerous elements o FDA regulation. I a company

makes an article that is incorporated into a nished

medical device, the maker o that component is not

directly subject to FDA regulatory requirements

or premarket clearance or even the quality

system requirements. Instead, the nished device

manuacturer is obliged to have in place supplier

controls sucient to ensure the quality o thecomponents it uses. Tese controls might include, or

example, periodic inspections o suppliers.

Another strategy is to supply nished medical devices

to a rm that will co-package its own device with

yours. From a regulatory standpoint, this is essentially

the same as the component supplier scenario just

discussed. Even though the article is a nished one,

i it is bundled together with another product beore

it is sold to the end user, the company that does the

bundling has responsibility or ensuring that each

product in the bundle has the requisite regulatory

compliance. Sometimes the supplier or the article to

be bundled will undertake compliance with the FDA

requirements itsel, and sometimes the bundler takes

that job. But because the bundler is considered to own

the specications o the bundle and whatever claims

are made or the bundle, it generally has the ultimate

regulatory responsibility.

Lets take, or example, a common cell phone,

hypothetically call it a mePhone. I the cell phone

manuacturer makes no medical claims about it, the

cell phone manuacturer will have no direct FDA

responsibilities. But lets say a blood glucose meter

manuacturer claims, in promotional materials, our

meter will pair with the mePhone to download data

or analysis on our special app. Arguably the blood

glucose meter manuacturer has made the mePhone

and the app into components o its medical device

system. So the blood glucose meter manuacturer

may, or example, either need to prove through a risk

assessment that mePhones available in the marketplace will remain suitable or that intended use, or

need to enter into an agreement with the mePhone

maker such that the two companies, through

cooperation and control, will ensure the uture

compatibility o the two devices. Ive kept this simple

but in real lie these acts are usually much more

complex.

I want to underscore something I said earlier:

almost none o the organizations in this section arecompletely outside o FDAs jurisdiction. Tey all have

some, albeit perhaps minor, FDA responsibilities.

Even distributors and retailers have to ensure their

promotion remains consistent with the approved

labeling, and their acilities appropriately saeguard

the integrity o the products. Components suppliers,

while technically exempt rom the quality system

Page 25


28/51

MobiHealthNews.com

regulations, oen must nonetheless ensure that they

are not selling adulterated components or use in

medical equipment.

Over the last several years, I have read a dizzying array

o corporate agreements that provide or various kindso collaborations like these between companies. Some

o them are ashioned as supply agreements, while

others look like contract manuacturing agreements,

and yet others look like intellectual property license

agreements.

As a regulatory lawyer, when I read these agreements,

oen Im asked to make a judgment as to who has

the FDA regulatory responsibilities. And sometimes,

honestly, it just isnt clear. Ive read agreements whereall the specications and promotional claims have

to be mutually agreed upon between two parties. In

other cases, one party maintains a general level o

control over the specications and claims, while the

other party is able to exercise wide latitude within

certain limits. In those cases, where it is genuinely

unclear which party has the FDA responsibilities

under the regulations, I believe FDA permits the

parties to speciy in the agreement who has those

responsibilities, so long as that division is reasonable

to resolve the gray area. So my advice: have your

regulatory lawyer work closely with your corporate

lawyer to make sure that your various collaboration

agreements speciy a reasonable and your intended

division o labor on the regulatory compliance side.

Strategy 3: contract out the hard stuff.

Even i your company markets what is admittedly a

medical device and controls the specications and the

promotional claims so that your company is clearly

regulated by FDA, that doesnt mean your company

itsel must do the hard stu. Te regulatory work can

generally be contracted out, even i the regulatory

responsibility has to remain with the specication

owner.

It probably wont surprise anyone to know that there

are whole industries designed to conduct various

responsibilities o medical device specication owners

in compliance with FDA requirements. For example,

there are clinical research organizations that can

do all o the clinical research, soup to nuts, and oneo their main selling points invariably is that they

take responsibility or the FDA compliance or that

unction. Tere are regulatory consultants who can

quite ably prepare premarket submissions. Tere are

contract manuacturers who specialize in producing

product under FDA quality system requirements,

and there are other consultants who can help bring

the specication owners acilities up to code, so to

speak. Tere are design organizations well-versed in

conducting the design process in compliance withFDA design controls. Bottom line: i theres some

eature o FDA regulatory compliance that makes you

nervous, theres probably a whole industry out there

quite willing to help you do it.

Tat said, it bears repeating that you can contract

out the work but not the responsibility. I your

organization is the one that controls the specications

and the labeling, your organization will bear ultimate

responsibility or FDA compliance. As a practical

matter, i you choose to contract out any o that work,

it means you have the obligation to be duly diligent

in selecting the right qualied rm to help you do

the work, and providing reasonable oversight or the

unction. So the hando isnt complete.

Strategy 4: sell a service or be a user, not a

product producer.

Tis strategy is sometimes risky, but sometimes it

can work. FDAs jurisdiction is very clear: the agency

regulates products. In the very rst article, I discussed

the need or a physical product that is the subject o

FDA regulation. FDA does not regulate services, nor

do they regulate the practice o medicine.

Page 26


29/51

MobiHealthNews.com

Tat circumstance has led some proessions to be able

to do things that product manuacturers and sellers

cannot. For example, clinical laboratories routinely

develop their own clinical tests that they use with their

own customers. For decades, FDA has taken a nearly

hands-o approach to that practice, saying that clinicallabs are suciently regulated under a dierent piece

o legislation, the Clinical Laboratory Improvement

Amendments o 1988. Likewise, pharmacists who are

regulated under state pharmacy laws have a certain

latitude to compound drugs. In these cases, FDA has

decided that these are proessional service businesses

rather (already regulated by others) than the sellers o

devices or drugs.

Conceptually, it may be possible to position certainhealthcare services as services, rather than the sale

o products. But be mindul that this is not simply

converting outright sales to rentals. Tat makes no

dierence to FDA. Further, as you might guess, i

a particular operation starts to look too much like

manuacturing, FDA will regulate it. My only point

is that healthcare proessionals have a certain latitude

to provide services to their patients without FDA

intrusion. Te sixth chapter in this report will discuss

this latitude specically.

The Trade-offs

As Milton Freidman observed, there aint no such

thing as a ree lunch. Each o these strategies involves

trade-os, and Ive tried to depict those at a high-level

in Diagram 2 below.

As with some o my other diagrams, this one refects

subjective judgments concerning the magnitude o

the benets and burdens associated with a ew o the

strategies. Ive used blue stars to depict eatures wheremore is better, and Ive used black stars to indicate

attributes where less is better.

So, i we look in the column or FDA regulated

articles (#8 or class III), we see my assessment that

the potential prot margins are the greatest and the

product lie cycle length is the longest and barriers to

entry are the greatest, but on the negative side internal

Diagram 2. Trade-offs

FDA

Regulated

8

Contractout tasks

5

Componentsupplier

2

Notregulated

1

Profit

margins

Product life

cycle length

Internal over

head costs

Barriers to

entry

Page 27


30/51

MobiHealthNews.com

overhead costs are the greatest. I chose to characterize

product liecycle length as good simply because it

means the company has a longer time in which to

recoup its investment. I realize some I companies

like the short product liecycles because they consider

speedy new product innovation to be a competitive

advantage or the rm.

On the other end o the spectrum, I indicate that

unregulated articles normally have much lower prot

margins and shorter product liecycles and ewer

barriers to entry, but lower overhead costs. However,

Im sure everyone can think o examples where thats

not true. In some cases companies are able to develop

patent protection around truly novel technologiesand earn tremendous prot margins over the ull

length o the patent lie. Further, the development o

those innovative products might be a tremendously

high cost. But Im treating those as the exception,

not the rule. Perhaps Im wrong, but in the consumer

electronics area, it seems as though competition is

erce and technologies quickly become commoditized

despite whatever patent protections might be available.

In the middle you nd compromises between thosetwo extremes. In scenario 5 where the company

simply contracts out certain dicult tasks, the prot

margins go down correspondingly as the costs o

contracting go up, but the company still benets rom

some barriers to entry and earns a comparatively

better prot margin than the ar right side o that

table. Likewise, component suppliers oen enjoy ewer

barriers to entry and have comparably lower prot

margins to the nished medical device manuacturers,

but they also ace a lower cost structure.

Tere is a quantitative basis or this judgment that

bears noting. According to Tomson Reuters, medical

equipment manuacturers enjoy an average ve-year

gross margin o 59%, compared with 45.8% or the

S&P500. Recent research coming rom the Deloitte

Center or the Edge, which has studied the business

Conclusion

Tis chapter is meant to give you a high-level

understanding o some broad strategies oravoiding or at least reducing your companys

FDA compliance obligations. Within each o

these broad strategies are multiple variations

that raise complexities well beyond the scope

o this chapter. Te last strategy, selling services

or being a user o products, is complicated

enough that it deserves its own chapter. Te

next chapter will ocus on hospitals and other

providers o care that might employ their own

tailored technology to diagnosing, monitoring

or treating patients, and the corresponding FDA

obligations that may apply.

climate or US industries over the past orty years,

calculates the average return on assets (ROA) or the

entire U.S. economy had allen to almost one-quarter

o its 1965 levels by 2008, while perormance in the

Health Care industry has run contrary to the trend.

Tat occurred while the ROA in healthcare rose rom

1.7 percent in the early 1970s to 3.8 percent in the

same period, nearly doubling.

Ch

Documents

mHealth News Report FDA Regulation of Mobile Health