8/8/2019 mHealth News Report FDA Regulation of Mobile Health
1/51
healthnewsmobi
FDAREGULATION OFMOBILEHEALTH
Copyright June 2010 Chester Street Publishing, Inc. All Rights Reserved.
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
2/51
Contents
About the Author
Letter from the Editor
FDA May Regulate Certain Mobile Phones, Accessories
Step-by-step: FDA wireless health regulation
How to get FDA to clear a mobile health app
Should mHealth companies want FDA regulation?
How to Avoid mHealth Regulation
Washington signals possible FDA regulation of mHealth
Will the FDA regulate mHealth care providers?
The Dynamic Future of FDA Regulation of mHealth
1
2
3
6
10
I7
22
29
32
37
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
3/51
Bradley Merrill Tompson is a shareholder in the law rm o Epstein Becker &
Green, P.C. Tere he counsels medical device and other lie science companies
on a wide range o FDA regulatory, reimbursement and clinical trial issues.
At the rm, Mr. Tompson leads the Medical Device Regulatory Practice, the
Clinical rials Practice and the Connected Health Practice, and serves on the
rms Health & Lie Sciences Steering Committee. For trade associations, Mr.
Tompson has served as counsel to AdvaMed or payment issues, as General
Counsel to the Combination Products Coalition, and or 17 years as General
Counsel and Secretary or the Indiana Medical Device Manuacturers Council.
Connected Health Practice: In EBGs Connected Health Practice,
Mr. Tompson ocuses on the ederal regulatory requirementsFDA,
reimbursement, privacy and othersthat impact remote monitoring, mobile
health, HI and device interoperability. Te rms Connected Health Practice
brings together a multidisciplinary team o attorneys and consultants trained
and experienced in Medicare and private insurance payment, regulatory,
About the Author
scientic, I, clinical, and security disciplines. Mr. Tompson serves as outside counsel to Continua Health Alliance,
conducts educational programs on connected health regulation and blogs or Mobihealthnews.com.
eaching, Writing and Serving: Mr. Tompson has taught ood & drug law at Indiana University School o Law-Indianapolis and Columbia Law School. He also serves on the editorial boards or Medical Device & Diagnostic
Industry (1993-present), Food & Drug Law Journal (2007 present) and BNAs Medical Device Law & Industry Report
(2007-present) Mr. Tompson also serves as Co-Chair o the Food & Drug Law Committee o the Administrative Law
Section o the American Bar Association, and as Chair o the Medical Device Committee o FDLI. Mr. Tompson has
written extensively on the topics o medical device regulation, including a book entitled FDAs Regulation o Medical
Devices (Interpharm Press, 1995). He has co-authored chapters in O-Label Communications: A Guide to Sales and
Marketing Compliance published by FDLI (2008-2009) and in a book entitled Guide to Medicare Coverage Decision-
making and Appeals published by the American Bar Association (2002).
Honors: Mr. Tompson was included in 100 Notable People in the Medical Device Industry (Medical Device &Diagnostics Industry, June 2004), has earned an AV rating in Martindale Hubble (its highest rating), has been named a
SuperLawyer in Indiana, has been elected as a Fellow in the American Bar Foundation and is listed in Chambers USA: A
Guide to Americas Leading Business Lawyers.
Education: Mr. Tompson received his B.A. cum laude, and an M.B.A. rom the University o Illinois and his J.D. cum
laude rom the University o Michigan Law School.
Bradley Merrill Thompson
Page 1
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
4/51
Letter from the Editor
One morning last summer I got my rst email rom
Brad. He wrote that he and a couple o colleagues
had just conducted a day-long seminar on regulatory
topics or the Vancouver gathering o the Continua
Health Alliance. One session was a case study o FDA
regulation o a mobile health platorm.
Is that the kind o topic that interests you? Brad had
asked.
For the next year -- about every six weeks -- I would
receive the latest chapter in Brads FDA regulation
series. It pulled rom FDA workshop meetings, political
speeches, questions posed by mHealth luminaries, and
Brads vast wealth o knowledge regarding FDA policies.
Brads series o articles quickly proved to be the
some o the most talked about eatures published in
healthnewsmobi
Page 2
MobiHealthNews weekly newsletter.
At Brads request, and with great pleasure, we at MobiHealthnews have compiled the series on mHealth
regulation into this ree special report or our readers. I am condent it will quickly become a seminal
text or the budding mobile health industry.
Our heartelt thanks to Brad or taking the time to provide direction or navigating these otherwise
murky regulatory waters.
Brian Dolan
Editor, MobiHealthNews
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
5/51
MobiHealthNews.com
It can come as a bit o a shock to people in the
consumer electronics, I and telecommunications
industries that FDA might regulate certain equipment
like cell phones that companies are planning to put at
the center o connected health services. My goal is to
outline the actors that FDA considers when deciding
whether to regulate such equipment.
Dening a medical device
Te natural place to start is with the denition o a
medical device. Since it is so central to the analysis,
Im going to quote the statute verbatim. Section 201(h)
o the Federal Food, Drug, and Cosmetic Act denes a
medical device as:
an instrument, apparatus, implement, machine,
contrivance, implant, in vitro reagent, or other similar
or related article, including any component, part, or
accessory, which is [either] intended or use in
the diagnosis o disease or other conditions, or in the
cure, mitigation, treatment, or prevention o disease,
in man or other animals [or] intended to aect the
structure or any unction o the body o man or other
animals.
So at a high-level, we look or two things: (1) a device
with (2) a medical intended use. Te rst prong o
the test that there must be an actual product
means FDA doesnt regulate, or example, medical
procedures. Te thing in question must be a thing, and
not inormation or something else intangible. Soware
can be a medical device i its written on computer
media, as opposed to printed on paper. Te media
with the code written on it is enough o a thing or
FDA to regulate.
FDA May Regulate Certain Mobile Phones,Accessories
I.
Components Vs. Accessories
In the area o mobile health technology, its important
to understand that an accessory or a component o
a medical device is itsel a regulated medical device.
Further, the dierence between an accessory and a
component is who buys it. End-users buy accessories,
while manuacturers buy components. Tus the exact
same piece o equipment could be either an accessory
or a component depending on the target purchaser.
Tat makes a big dierence in terms o applicable
regulatory requirements. Components are exempt
rom most FDA regulatory requirements, with the
regulatory burdens being borne by the nished
device manuacturer. Accessories, on the other hand,
since they go right to the end user, must meet the
FDA requirements beore they leave the hands o
the accessory manuacturer. Tese dierences are
summarized in Figure 1 on the next page.
Te level o regulation imposed by FDA on accessories
and components is determined by the parent device to
which they relate. So i the accessory relates to a high
risk device, say an implantable cardiac debrillator, it
will be subject to a high level o regulation even i the
accessory is relatively benign in and o itsel.
Page 3
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
6/51
MobiHealthNews.com
Having decided that the product meets the thing
test, determining the intended use o the article can be
much more dicult. As a preliminary matter, in the
denition above you can see that the so-called medical
uses are very broad, and include some conditions
people may not ordinarily consider medical. Forexample, equipment used or exercise could become
a medical device i the claims take on more o a
therapeutic nature instead o simply suggesting
general tness. So i the piece o tness equipment
is specically advocated or use in the treatment o
obesity or rehabilitation o cardiac patients, it can
become a medical device. Further, the denition is not
limited to disease, but also relates to articles that aect
the structure or unction o the body (or example,
pregnancy). Moreover, devices that merely monitora body unction, with no therapeutic eect, can all
into the device category i the intended use suggests a
health-related purpose.
Determining intended use
Figuring out the actual intended use o the article
depends entirely on the acts. I teach this topic at
Columbia Law School, and I generally begin the
session by taking out a popsicle stick. o employ a
case study, I tell the students that Im the CEO o a
company that makes these sticks, and I want to know
whether I have to comply with FDA regulations. At
that point I encourage them to ask questions o me inmy hypothetical role as CEO, and then ultimately to
advise me.
I they have done their homework, they will start
to ask me how I promote the stick. In my answers,
Im pretty coy at rst, simply explaining that I sell
sticks and what my customers do with them is their
business. I explain that my labeling or the product
merely identies the product as a stick without going
into its possible uses.
Hopeully my students have read enough to know
that the regulations dene intended use as: the
objective intent o the persons legally responsible
or the labeling o devices. Te intent is determined
by such persons expressions or may be shown by
the circumstances surrounding the distribution o
the article. Tis objective intent may, or example,
be shown by labeling claims, advertising matter, or
oral or written statements by such persons or their
representatives. It may be shown by the circumstances
Finished Stand alone Device Accessory Component
Definition
A medical device in finished form,
ready to use perhaps withaccessories, intended for sale tothe end user
An article intended for use in orwith a finished medical device,
intended for use by the end user
An article intended for use in orwith a finished medical device,
intended for use by amanufacturer
FDA Clearancerequired?
Yes, unless exempt Yes, unless exempt No
GMPs
required?Yes, unless exempt Yes, unless exempt
No, but quality must satisfy
finished device manufacturer
Figure 1. Types of Devices
Page 4
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
7/51
MobiHealthNews.com
that the article is, with the knowledge o such persons
or their representatives, oered and used or a purposeor which it is neither labeled nor advertised. So
what I say in my labeling is not the last word, but
ultimately what matters is the totality o what I have
done to promote the article and to some extent what I
know about how my customers are using it.
Eventually my students start asking me about what
trade shows I attend, what types o magazines I use
to advertise the sticks, what my salesmen say to
customers, and what I know about the actual usages othe sticks. And it turns out, in my hypothetical, I know
that many o my customers are using them as pediatric
tongue depressors, I promote them in advertisements
in hospital journals, and at least some o my salesmen
might encourage their use as tongue depressors. So
eventually my students come to the view that my
simple popsicle sticks might in act qualiy as medical
devices and be subject to FDA regulation.
Advice for wireless health start-ups
Companies engaged in making mobile phones (or
related articles or soware apps) need to go through
the same analysis to gure out i they are selling
medical devices. Tey need to look rst and oremost
to the labeling and other promotional materials they
use, but then also consider how they promote the
products. In this regard, its important to remember
that were looking or either an intended use directly
as a medical device, or an intended use as an accessory
to a medical device. Its more likely a cell phone or
related soware might end up as a regulated accessory,
than a stand alone medical device.
If it is a medical device, what next?
Tis analysis only answers the threshold question o
whether an article is a medical device. I it turns outto be a regulated article, a second step is to gure out
the degree o that regulation. A air number o medical
devices are exempt rom FDA premarket clearance,
and others are exempt rom the obligation to employ
good manuacturing practices. Te risks associated
with the intended use determine the level o regulatory
requirements, including validation and other design
rigor that FDA would require.
Not the end of the world
Merely being a medical device is by no means
the end o the world, just the starting point or
the analysis. Companies need to be mindul
o these consequences as they develop their
promotional programs or hardware and
soware in this mobile health space. FDA is
almost certainly looking.
Page 5
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
8/51
MobiHealthNews.com
o the orthopedic devices, or example, are in one part
o the regulations. So you might get lucky and nd one
that directly describes your product. A quick search
o the regulations revealed that the word computer
appears in 225 regulations, soware in 431 and
network in 43. Tere is, or example, a classication
or remote medication management systems in 21
CFR 880.6315.
But i you cant nd one that directly describes your
product, perhaps its because FDA considers your
product to be merely an accessory to a parent
device. Ill give you an example. In 2009 FDA clearedan updated version o the Polytel glucose meter
accessory, which is a small module that plugs into
the port o a glucose meter, receives data rom the
meter and transers it wirelessly to an Internet capable
communication device like a cell phone or an AP. In
clearing the device, FDA agreed with its classication
in 21 CFR 862.1345, which covers all glucose test
systems, including the parent glucose meters.
FDA will assign each product into one o three
classications, cleverly called class I, II and III.
Class I devices represent the least risk, while class
III represent the greatest. Associated with those
classications are specic regulatory requirements.
Many class I devices will be exempt rom premarket
clearance, and some products will be exempt romother regulatory requirements that Ill describe in a
minute. Some class I and most class II devices require
ling a premarket notication (or 510(k)) with FDA.
Tese submissions are manageable documents that
compare the new device to those lawully on the
market. Te specic data requirements are discussed
below.
In the last chapter I outlined the triggers that could
cause an ordinary mobile phone to become an FDA-
regulated medical mobile phone. In this chapter I will
outline the FDA requirements that would apply to a
mobile phone that crosses that line.
Premarket clearance or approval
In contrast to components that are simply sold to
another manuacturer, standalone medical devices and
accessories sold to end users may require some orm
o premarket clearance or approval. Once you knowyou have an FDA-regulated device or accessory, heres
how you gure that out, ollowing a ve-step process.
Tere is a bit o both art and science to this. FDA
has published about 1700 classication regulations.
Each o those regulations has a description or
identication o the types o devices covered by thatregulation. FDA has a searchable database o these
regulations accessible through their website.
Some articles o hardware and soware are so
important that FDA has separately classied them,
and you can nd them directly through searching. Te
regulations are organized by clinical application so all
Step-by-step: FDA wireless health regulationII.
Step one. Figure out the most appropriateclassication for your product.
Step two. Read the second half of theclassication regulation to see how FDA
regulates that particular article.
o summarize the last chapter FDA may regulate
certain mobile phones, accessories, a mobile
phone could become a regulated medical device
i the manuacturer, through its words and deeds,
conveys an intention that the phone be used
in medical applications. I also pointed out that
medical devices come in at least three dierent
favors: (1) standalone medical devices, (2)
accessories and (3) components to such devices.
Page 6
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
9/51
MobiHealthNews.com
Even once you know how a device is classied and thespecic regulatory requirements, you may well have
options or how you get marketing clearance. Lets say
your device is in class II, and some sort o premarket
notication or so-called 510(k) is required. 510(k)s
come in lots o dierent favors, including traditional,
special and abbreviated. For some, as an alternative
to ling at the FDA, you can seek to have your device
reviewed by an independent third-party who then
certies its review to the FDA. Going through each o
those options is beyond the scope o this article, butits important to understand that you have options. I
have tried to illustrate the major options in
Diagram 1below.
Te highest risk devices-class III-usually require
premarket approval (PMA) rom FDA, which can
cost millions. Most I devices can avoid that, unless
they are an accessory to a high risk device. I yourdevice is classied as an accessory, it is subject to all o
the regulatory requirements applicable to the parent
device.
FDA has published scads o guidance documents
on its website that cover many dierent aspects o
the technologies they regulate. Tere are guidance
documents on using wireless technologies, o-the-shel soware, and specic medical technologies such
as blood glucose meters. Its important you nd all o
these so-called special controls because youll need
to make sure that your product complies with those
technical standards.
Is it a device or an
accessory to a
device?
Does a classication
regulation cover it?
What options are
available for gaining
marketing clearance
or approval?
Unregulated
by FDA
It is
automatically
Class III
Exempt
510(k)
PMA
Petition for
Re-classication
de novo 510(k)
PMA
510(k)
3rd Party Review
Traditional 510(k)
Special 510(k)
Abbreviated 510(k)
yes
Covered
No
NotCovered
Diagram 1. Some Major Pathways to Market for IT Devices
Step three. Research the requirements.
Step four. Consider your options.
Page 7
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
10/51
MobiHealthNews.com
Even more choices need to be made here. Te amount
and type o data needed to secure approval depends
directly on the types o claims you want to make. In
many cases, you might have the option to merely make
a tool claim: a claim that your product simply does
a specic unction. In the accessory example I gave
above regarding the Polytel product, the company
makes a tool claim that its article merely connects onemedical device to the Internet.
You might also wish to make an outcome type claim:
a claim that your device will help treat or diagnose a
specic disease or condition. For example: Using this
device to transmit your blood glucose readings to your
physician typically allows or better control o diabetes
and will help you wean yoursel o dependency on
insulin.
Te types o data you need to provide FDA will
depend on which type o claim you make and indeed
on the exact wording o the claim. ypically, you could
support a tool type claim with bench testing or other
non-clinical evaluation. Basically you need to prove
that your tool works. I you choose to make outcome-
based claims, youll need to prove that the device
indeed achieves those outcomes. Tats much harder,
and requires testing in a clinical setting.
I you are ollowing the 510(k) pathway, the
undamental standard is whether your device is
substantially equivalent to other lawul devices. So
most submissions ollow a comparative ormat where
the submitter compares his device to others in the
marketplace.
In addition to the premarket clearance or approval
question, devices must comply with other FDA
requirements, as described in the next section.
Quality system requirements
Te other big hurdle is ensuring compliance with the
quality system regulations. As the name suggests, these
requirements are ocused on ensuring manuacturers
produce quality products commensurate with the
risks associated with using the device. So the exact
nature o the quality system will depend on the
intended use o the article. For companies that are ISO
13485 certied, becoming compliant with the quality
system regulations is mostly a matter o creating
documentation systems so that you can prove yourcompliance. More substantial changes are required i
the company is only ISO 9001 certied.
Tese quality system regulations apply cradle-to-grave,
so the minute you begin the design process, the design
controls must be observed. Design Controls speciy
the process used and the records to be created during
the design, development, and manuacturing scale-
up o a device. Tey extend all the way to postmarket
issues such as complaint handling, risk management,
and ailure analysis and eedback to the design and
manuacturing organizations.
In the medical device world, component suppliers
are exempt rom these regulatory requirements
(though sometimes they are contractually required).
Step ve. Determine the type of evidenceneeded for FDA clearance.
Page 8
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
11/51
MobiHealthNews.com
Tat doesnt mean the components need not be high
quality, but rather it means that the nished device
manuacturer has the regulatory burden o assuring
the quality o the components it uses. While this
could mean incoming inspections o raw materials,
components and subassemblies, it more oen means
that a device manuacturer must apply all necessary
controls on a supplier-by-supplier basis to make surethat any controls the supplier is missing, the device
manuacturer provides.
Adverse event reporting
As kind o a belt and suspenders, in addition to
requiring premarket review o the product and
imposing quality system requirements, FDA expectscompanies to be vigilant or reports o people getting
hurt or products malunctioning. In some cases
those incidents might rise to the level o needing to
be reported to FDA. Tese so-called Medical Device
Reports are time sensitive (an assessment is due in a
matter o days or weeks), and require the company
to have in place systems or reviewing all relevant
incoming inormation to assess the potential o each
report to be categorized as an Adverse Event. I the
company decides to take corrective action, in some
cases the company needs to notiy FDA.
From here
Tere is no doubt that these requirements canbe quite burdensome. But to state the obvious,
thousands o companies have ound it possible
and worthwhile to enter the medical device
realm. In the coming chapters, I will explore the
unique aspects o FDA regulation o soware,
a business assessment o whether entering the
FDA-regulated realm is worthwhile, options
or staying out o regulated territory, and some
thoughts on where uture FDA regulation could
go in this space.
Other regulatory requirements
FDA has a variety o other requirements that
may apply, including such things as registering
manuacturing acilities, listing the products
manuactured, specic requirements or investigating
the saety and eectiveness o an unapproved device,
export and import restrictions, and labeling andadvertising requirements. FDA also has a variety o
requirements that apply to postmarket distribution to
ensure that products can be identied and traced back.
Page 9
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
12/51
MobiHealthNews.com
(I would like to thank John Murray o FDA, Scott
Tiel o Roche Diagnostics and Russ Gray o the
Anson Group or their comments on a draf o this
chapter. Te views expressed right or wrong are
only the authors and should not be attributed to the
commenters.)
Software Roles
From those two prior chapters, its important to
remember that medical devices, including soware,
How to get FDA to clear a mobile health appIII.
can be divided into three categories: (1) standalonedevices, (2) accessories and (3) components.
Standalone are those devices that are intended to
directly provide the diagnostic or treatment, while
accessories are sold directly to end-users and work
with standalone devices. Components, in contrast,
are purchased by manuacturers o standalone or
accessory devices or incorporation beore sale. Mobile
device (e.g. cell phone apps) can be an accessory, as
opposed to a component, i they are sold or even given
directly to the end-user: the patient. Tey can also
be standalone i they do not connect physically or
virtually to any device other than the mobile device
platorm.
Understanding that is important because determines
the regulatory requirements that apply. I the app is
designed, or example, to acilitate the downloading
o inormation rom a blood glucose meter, the
app and maybe even the soware environment are
accessories and will be regulated in the same manner
as the blood glucose meter. Te classication and
most o the requirements or the submission to FDA
will be dictated by how the parent standalone device
is regulated. So, the Airstrip OB app is regulated as
part o a perinatal monitoring system generally, just
as the sensors and other hardware that gather the
inormation.
Most people in the wireless health industry
have heard by now that FDA has started to
clear applications or cell phones with medicalindications. A widely-reported example is AirStrip
OB, cleared to deliver patient waveorm data
including etal heartbeat and maternal contraction
patterns in virtual real-time directly rom
the hospital labor and delivery unit to a doctors
mobile wireless device, specically to an iPhone
or a Blackberry. Other soware developers are
probably interested to learn when FDA clearance
is required, and what it takes to accomplish that
FDA clearance. In this chapter, Ill address both othose questions at a high-level.
In the rst chapter I outlined the actors FDA
considers generally when deciding which products
need to be regulated and which all outside o the
scope o a medical device regulation. In Chapter
2, I outlined the basic steps or getting a medical
device cleared by FDA. Tis chapter will ocus on
the unique aspects o those two questions in the
context o mobile device apps.
Page 10
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
13/51
MobiHealthNews.com
Some apps will not be simply enablers o transmitting
data rom a medical device, but will actually serve
a standalone purpose. From the prior two chapters,
remember that its the claims the soware developer/
seller choose to make, within reason, that triggers
FDA regulation in the rst place, and the degree o
that regulation when it comes to obtaining clearance.
Once you properly gure out which o the three roles
the soware plays, you can gure out its regulatory
status. ypically thats one o the ollowing three
choices:
Soware that does NO meet the legaldenition o a device and is not regulated by
FDA.
Soware that does meet the legal denition
o a device but is currently not actively
regulated, and FDA is unlikely to require
pre-market review.
Soware that does meet the denition o a
device and FDA is actively regulating and
would require a pre-market review.
Except or a ew specic exempt device types
identied in the classication regulations, that middle
category isnt today a regulatory classication youll
nd dened in any FDA records. Fortunately or
unortunately, depending on your perspective, FDA
has been very reluctant over the last dozen years to
dene with any real precision its policy on whichtypes o soware must undergo premarket review and
clearance, or even approval. Te agency has held open
public meetings and foated concept papers, and more
recently has proposed a limited device classication
or medical device data systems, but by and large has
not with any certainty claried its policy on when
soware trips the premarket requirement.
So the ollowing is just my personal observations
about how FDA regulates soware in practice, as I
can glean rom watching FDA enorcement actions,
podium policy, and the inormal statements FDA has
made in concept papers.
Unregulated Software
In its explanation surrounding the agencys proposed
classication o Medical Device Data Systems
published in 2008, FDA explains:
It is FDAs long-standing practice to not regulate thosemanual oce unctions that are simply automated
or the ease o the user (e.g., oce automation)
For example, the report-writing unctions o a
computer system that allow or the manual (typewriter
like) input o data by practitioners would not be
[regulated] because these systems are not directly
connected to a medical device. In addition, soware
that merely perorms library unctions, such as
storing, indexing, and retrieving inormation not
specic to an individual patient, is not considered tobe a medical device. Examples include medical texts or
the Physicians Desk Reerence on CD-ROM that are
indexed and cross-reerenced or ease o use.
FDA goes on to say it wont regulate soware that
allows a doctor to enter or store a patients health
history in a computer le. On its ace, that description
o unregulated soware is somewhat narrowly written.
Tat is not surprising since FDA always takes an
expansive view o its jurisdiction, and is not likely toconcede much ground in that regard.
Beyond that passage, I would add that there are two
key eatures or most unregulated soware.
Te data are entered manually; they are not inputted
directly rom any machine that touches the patient
Page 11
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
14/51
MobiHealthNews.com
or a patient specimen. Tats important to avoid
becoming an accessory to a medical device.
Depending on how inputted, the output amounts
simply to providing the stored data back to the patientor proessional. Te system does not automatically
guide the diagnosis, nor does it guide any other
instrument. In other words the soware does not
contain any algorithms that provide clinical-like
unctions that go beyond what FDA oen reers to as
library unctions. It merely displays the data or the
user to read and interpret.
Many mobile device apps do indeed t this category o
unregulated soware. But it is important to rememberto conduct an honest evaluation o the intended use
o your product. Te evaluation should ocus on the
clinical intended use o the product and less on the
technical characteristics o your soware or your
system. In FDAs eyes, your soware product does not
have to provide a complete cure, mitigation, treatment,
or prevention o disease to meet the legal denition
o a device. I your soware is intended to provide
any part o cure, mitigation, treatment, or prevention
o disease, FDA will probably consider it a device.Understanding the limits on the unregulated category
is probably best explained, though, by looking at the
other two categories.
Regulated Software Exempt from
Premarket Clearance
Since the late 1980s, FDA has been publicly declaring
that there exists a category o soware that technically
qualies as a medical device but or which FDA has no
intention o requiring the submission o a premarket
notication or approval application. For those who
are really interested in this topic, it probably makes
the most sense to start with the FDA Policy or the
Regulation o Computer Products, 11/13/89 Dra.
In that policy, there are two categories o soware
products that were technically regulated but alsoconsidered exempt rom the major requirements:
(1) general purpose articles as dened in a regulation
and (2) soware that involves competent human
intervention. Unortunately FDA never got around
to actually codiying the competent human
intervention exemption. In its classication process,
FDA has adopted certain general purpose or low risk
exemptions that cover soware, such as laboratory
inormation management systems (LIMS) (21 CFR
862.2100) used as calculators or data processingmodules or clinical use.
About 7 years aer FDA published the 1989
dra policy, it appeared FDA was moving toward
ormalizing its computer product policy. In addition
to publicly announcing that intention, FDA hosted
a large meeting in Washington and invited many
stakeholders to discuss what the policy should be. In
preparing or that meeting, FDA draed a summary
o what it considered to be its then existing policyon computer products. Tose workshop materials
explained that much o the soware the agency was
seeing constituted accessories to medical devices,
and the competent human intervention concept
was only intended to apply to truly standalone
soware. Te agency also argued that the concept
o what constitutes competent human intervention
had become increasingly complex and dicult to
administer. FDA observed:
In general, to permit competent human intervention,
the soware decision process must be completely
clear to the user, with a reasonable opportunity or
challenging the results. Tere must also be adequate
time available or refection on the results.
Page 12
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
15/51
MobiHealthNews.com
Te electronic transer or exchange o medicaldevice data rom a medical device, without
altering the unction or parameters o anyconnected devices. For example, this wouldinclude soware that interrogates a ventilatorevery 15 minutes and transers inormationabout patient CO\2\ levels to a central patientdata repository;
Te electronic storage and retrieval o medicaldevice data, without altering the unction orparameters o connected devices. For example,this would include soware that storeshistorical blood pressure inormation or laterreview by a healthcare provider;
Te electronic display o medical device data,without altering the unction or parameterso connected devices. For example, this wouldinclude soware that displays the previouslystored electrocardiogram or a particularpatient;
Te electronic conversion o medical devicedata rom one ormat to another ormat in
accordance with a preset specication. Forexample, this would include soware thatconverts digital data generated by a pulseoximeter into a digital ormat that can beprinted. Examples o medical device datasystems that would be used in the home aresystems that periodically collect data romglucose meters or blood pressure devices orlater review by a healthcare provider.
Tis category is only available as an exemption rom
premarket clearance so long as the data set is intended
or proessional use and does not produce irreversible
data compression.
Based on the ollowing preamble rom the proposed
MDDS rule, I would suggest that through this process
FDA is seriously rethinking its soware policy.
Since 1989, the use o computer-based products and
soware-based products as medical devices has grown
exponentially. In addition, device interconnectivity
and complexity have grown in ways that could
not have been predicted in 1989. Tis growthand expansion have created new considerations
or elements o risk that did not previously exist.
FDA realized that the Dra Soware Policy was
not adequate to address all o the issues related to
the regulation o computer based and soware-
based medical devices. Based on this history and
the complexity and diversity o computer soware,
FDA decided it would be impractical to prepare one
soware or computer policy that would be able
to address all the issues related to the regulation ocomputer- and soware based medical devices.
While FDA has proposed the MDDS category, as o
this writing the agency has not adopted it in nal
orm. During the interim, however, it seems to be
the best guidance available or deciding whether a
premarket clearance is required.
Dividing Line Between Software
Requiring Premarket Notication And Not
In dening medical device data systems, FDA was
merely trying to dene one relatively narrow, cohesive
type o data set that the agency would regulate but
exempt rom premarket notication. However, that is
But again, FDA never ollowed through to adopt a new
regulation or policy.
In early 2008, departing somewhat rom the 1989approach, FDA proposed a new category o soware
that would t within this general category o regulated
soware exempt rom premarket clearance. Tey
proposed to call the new category medical device data
systems (MDDS), and they dened it to include:
Page 13
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
16/51
MobiHealthNews.com
Whether the soware is intended ordesigned to provide any real time, active, oronline patient monitoring unctions.
Te capability to display, create, or detect
alarm conditions, or actually sound analarm, or the capability to create alarmsthat are not already present rom theconnected medical devices.
Te seriousness o the particular diseaseor condition which the medical sowaredevice is intended to diagnose, cure,mitigate, treat or prevent and howthe soware contributes to the usersdecision-making or diagnosis or clinical
management o the patient. Example:Is it soware designed to call attentionto imminent hazard conditions or is itsoware that provides long-term storageor diagnostic inormation?
Te amount o time available beore using theinormation provided by the medical sowaredevice, i.e., the time until a therapeutic oradditional diagnostic intervention must beimplemented by the health care provider aer
the results o the soware have been provided.Example: Is the device an EKG reading andanalysis package whose output is SHOCKNOW or does it provide a proposed readingwith notation that the rhythm itsel should bechecked?
Whether the data output is provided ormanipulated in a novel or non-traditionalmanner, or whether decision trees within thesoware depart rom customary use. Example:Do the systems algorithms, parameters,internal decision trees, or other outputmanipulations depart rom customary use ortraditional data presentation?
Whether the medical soware device providesindividualized patient care recommendations,e.g., whether the soware suggests orrecommends specic treatment or a specicpatient. Example: How specic is the sowareoutput with regard to particular patients?
Is the soware providing general advice orinormation, like a library, article, or textbook,or is the soware designed to provide a specicrecommendation or a specic patient whoseindividual data have been entered as input?
Whether the mechanism by which the medicalsoware device arrives at a decision is hiddenor transparent, i.e., does the product useundisclosed parameters or internal decisiontrees or other mechanisms that are not
available or review by the health care provider.Example: How transparent is the sowaremanipulation to the intended user community?Included in transparency is the extent to whichlimitations on the process are made known tothe user, such as data contraction, deletion,editing, or simplication. Also, how arecomparisons made to normative databases andhow are normative databases created?
only one example, and it is not meant in any way to
be the only example o soware that would be treated
as regulated but exempt. Indeed my understanding
is that the agency plans to publish uture proposals
dening other regulated exempt and nonexemptcategories.
But what are soware companies supposed to do in
the meantime? What else ts within this regulated but
exempt category? Te unortunate answer is that this
represents a huge gray area. Te best anyone can do
is look at a variety o risk actors to gure out which
side o the premarket clearance line again a piece o
soware alls. Based on FDA comments and actions
over the last 20 years, I would propose the ollowinglist o actors be considered:
Page 14
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
17/51
MobiHealthNews.com
Guidance or Industry Wireless Medical
elemetry Risks and Recommendations
Guidance or Industry, FDA Reviewers andCompliance on O-Te-Shel Soware Use in
Medical Devices
General Principles o Soware Validation;
Final Guidance or Industry and FDA Sta
Guidance or the Content o Premarket
Submissions or Soware Contained in
Medical Devices
Cybersecurity or Networked Medical Devices
Containing O-the-Shel (OS) Soware
Device-specic guidance (e.g. glucose
monitors)
Does the product provide new capabilities
or intended uses for the user?
Until FDA decides to urther clariy the middle
category o regulated but exempt rom premarket
notication, a practical consideration o those actors
should help the company decide whether in FDAs
eyes the soware is risky enough to require premarket
clearance. As I said, you wont nd that in any existing
FDA guidance or regulation. Tats just based on
practical observation.
Software Requiring FDA Pre-marketClearance
In the second chapter, I outlined generally the
approach or securing FDA clearance. In the case
o soware, the rst step is identiying the most
appropriate classication rom among the roughly1700 classication regulations. Te word soware is
contained in 431 dierent regulations, so its not an
easy task.
Remember that soware that accessorizes a medical
device is classied with that medical device. So i a cell
phone app allows or the downloading o blood glucose
data, the app is classied with the blood glucose
meter and regulated to the same degree. As another
example, i the app is designed to help with medication
management, there is a specic classication or
such soware in 21 C.F.R. Sec. 880.6315. Tis can
obviously get very complex in an interconnected
system, perhaps on a wireless network, but thats too
much or this report.
Usually in the context o clearing an app, FDA will
check to ensure that the soware manuacturer is
complying with any published special controls. Te
special controls are typically stated in FDA guidance
documents and include, or example:
Page 15
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
18/51
MobiHealthNews.com
Te submission will need to be based on an
appropriate level o validation or the soware. I the
app is an accessory, the parent device determines
the level o validation required. I not an accessory,
to determine the validation required, you will need
to gure out whether FDA classies the soware as
major, moderate or minor level o concern.
Its major i the soware directly aects thepatient or anyone else such that a ailure
could result in death or serious injury
Its moderate i the injuries would be non-
serious
An apps risk and the associated level
determine:
And o course, beore you can actually bring the
product to market, you will need to make sure that
your manuacturing meets the FDA requirements
or quality systems. In the case o soware, those
requirements are acutely elt in the development stage
as the soware needs to be developed under special
FDA design controls and in the post-launch stage as
the manuacturer deals with product recalls, updates,
event reporting, product liecycle management and so
orth.
Conclusion
Tose are the basic FDA requirements that
apply to bringing an app or other piece o
soware to market in the mHealth eld.Undoubtedly, to those not accustomed to the
FDA regulated world, those hurdles might
seem high. In the next chapter, well tackle the
benets and burdens o going through those
admittedly rigorous FDA requirements rom a
business standpoint. In particular well ocus on
the competitive advantages that can be derived
rom entering the regulated space, weighed
against the cost o achieving those advantages.
the depth and degree o hazard analysis
and mitigation that is expected
the depth and degree o documentation
what needs to be submitted vs. merely
documented
the rigor applied to the verication and
validation o the soware
the degree to which the device
manuacturers soware development
process is scrutinized
Page 16
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
19/51
MobiHealthNews.com
Should mHealth companies want FDA regulation?IV.
(I would like to thank Dr. Deepak Ayyagari o Sharp
Laboratories o America and Dane Stout o the Anson
Group or their comments on a draf o this chapter. Te
views expressed, right or wrong, are only the authors
and should not be attributed to the commenters.)
Its Okay to Consider the Benets of
Federal Regulation Limiting Competition
As Ive learned recently working with Silicon Valley
companies, I companies generally seem to love
nothing more than a good, competitive, bare-knuckled
ght with their competitors, and abhor the rst hint
o articial restraints on competition, especially those
rom the government. In the I industry, cooperation
around the development o industry standards sets the
rules o engagement or the market, and then everyone
competes intensely based on those rules and execution
o their business plan. Innovation can fourish, with
upstarts appearing and challenging big, established
companies dominance o any particular portion o
the business. Te big companies accept it because they
are moving aggressively too; adjacent markets can
be pretty attractive i it appears there is money to be
made by oering a aster, better, cheaper alternative
to the current market leaders. Te goal o unrestricted
competition is great, and undoubtedly benets
customers in terms o producing products that theywant at the best possible prices.
However, as I companies consider entering the
health market, they need to appreciate the dierences.
In traditional I and telecommunications markets,
i a product doesnt work, such as a server crashing,
people can become really annoyed when they cant
check their email rom their mobile phone every
second. Inconvenient and somewhat costly, or sure,
but all will be orgiven once the server is back upand running. I it happens with any requency, the
company that produced the technology will get a
reputation or poor reliability, and may go out o
business.
But companies in the health space that produce
products, using many o the same components as
At the risk o insulting my new riends in Silicon
Valley, I submit that traditionally-unregulated I
companies may want to adopt a dierent view
o ederal regulation. Over the last couple years,
Ive had the opportunity to observe rsthand the
culture clash as ree-spirited, libertarian Silicon
Valley meets Rockville, Maryland, the home o the
decidedly more buttoned-down U.S. Food & Drug
Administration. Rather than feeing in ear o the
ederal bureaucracy, I would argue that at least
some I companies should consider embracing
ederal regulators. Well, maybe start with at least
shaking hands.
In the rst chapter, I started o by explaining the
scope o FDA regulation, and then in the second
and third chapters explained how companies could
comply with FDA regulation in the cell phone
accessory and soware app elds. With that basic
ramework behind us, in this chapter we will
explore the burdens and benets o entering FDA
regulated territory. Yes, I said benets.
Page 17
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
20/51
MobiHealthNews.com
what goes into the email server, ace a much dierent
problem set. I their product doesnt work consistently
and reliably, they can hurt people, or even cause
their deaths. So we dont, and cant, rely simply on
competition to weed out the good rom the bad.
Instead, we regulate them.
Tats more than just a legal ramework: thats a
philosophy or how the marketplace in health works.
You can think o ederal regulation as just a bunch o
health and saety laws that prescriptively require that
you do this and not do that, but its more accurate to
think about ederal regulation as saying we only want
companies willing to invest the signicant resources
required to get the product right the rst time theyenter the market, and to take the risk o ailure to
meet high standards o saety and eectiveness.
o put it in business school terms, ederal regulation
amounts to a signicant barrier to entry or the health
markets. And that is quite deliberate. FDA law means
dont enter this business unless youre willing to do
it right. And, as classic economic theory suggests,
companies that are willing and able to invest the
additional resources required and take greater riskget rewarded with greater return. Tats as it should
be, to protect the public rom unsae protects and to
urther the public health by encouraging companies
to invest in medical innovation. In that later regard,
FDA law rewards innovation in a manner similar to
the patent laws. We simply do not want all companies
to be able to make health care products. We choose to
impose much higher standards in that eld, and or
companies willing and able to meet those standards
we allow them to earn a potentially higher return.
Benets and Burdens of FDA Regulation
Lets bring it down rom the 100,000 . view and get
more specic about how entering FDA-regulated
space aects both the companys cost structure and
opportunities to earn a higher return. For a specic
company, this would require a airly detailed analysis,
but let me provide you with an overview here.
o conduct this analysis, Ive chosen the competitive
strategy ramework developed by Pro. Michael
Porter at the Harvard Business School. Its amiliar
to many and reasonably well-suited to assessing the
impact o a regulatory scheme on a business. In a
pair o roughly 500 page books, Pro. Porter details
an entire methodology or considering a companys
strategic options in light o the markets and business
environment in which they operate. Ill ocus on two
tools he uses in his analysis.
FDA Regulatory Impact on the Value
Chain
In his value chain tool, Pro. Porter ocuses on the
individual rm, and how the rm creates value. In
Diagram 1 below, Pro. Porter shows conceptually
along the bottom the sequence o steps necessary
to produce a product, and in the rows at the top theoverhead necessary or the rm to unction.
source: Michael Porter, competitive advantage
technological development
human resource management
firm infrastructure
procurement
inbound
logistics
operations
outbound
logistics
marketing
&
sales
service
margin
margin
Diagram 1. Value Chain Activities
Page 18
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
21/51
MobiHealthNews.com
technological development
human resource management
firm infrastructure
procurement
inbound
logistics
operations
outbound
logistics
marketing
&sales
service
Design Controls
margin
margin
Complaints
and
AEs
Supplier Controls
Training
Validation
Purchasing
controls
Claims
Regulation
InProcess
QualityControls
Shipping
Validations
Te specic activities that the company selects to
engage in directly determine its prot margin. Certain
activities are high-value and produce higher margins,
while others not surprisingly are lower. A rms
competitive advantage derives rom its ability to select
and execute the most highly value-added unctions.
Much more could be said, but lets move on to look
at how FDA regulation impacts the value chain.
o convey this impact at a high-level, Ive drawn
the intensity map included as Diagram 2 below.
o understand an intensity map, think National
Geographic magazine and a map showing population
density through colors. Ive borrowed that approach
here to show the intensity o FDA regulation on each
o the dierent elements o the value chain analysis.
Tis is a bit subjective, so others might disagree. I also
made an assumption that the company has a basic ISO
9001 type quality system already.
Heres how I came up with the intensities depicted.
FDA Approval. One o the most challenging steps
o FDA regulation is securing premarket clearance
or approval; there is no beta testing allowed in
healthcare. You cant oer someone the chance to sign
up or a discount i they help you test the product rst
to see i it works as you intended. For an innovativedevice, that requires substantial eort to design and
then test the device to ensure that it meets its intended
use saely and eectively, and perhaps highly regulated
clinical trials. In the diagram, I suggest that the eects
o this requirement are elt as a part o validation and
design controls, as well as in the regulation o the
claims that can be made.
Marketing regulation. In addition to FDA rules
regarding securing approval o specic claims,other ederal and state regulators impose stringent
requirements on the marketing unction. Tus
ederal regulation is perhaps most intensely elt in
the marketing unction o the company. Again, this
will eel quite oreign in Silicon Valley, where battles
between Marketectures wage almost daily. Cloud
Diagram 2. FDA impact on value chain activities
FDA requirements will
be very similar to ISOsystems
FDA requirements will
be more stringent
FDA requirements
will be far moredemanding than ISO
Page 19
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
22/51
MobiHealthNews.com
Impose added cost.
Lengthen lead times in product development.
Add complexity.
Can be dicult to implement rom a culturalstandpoint or a company unaccustomedto that environment because they requirediscipline and rigor.
And o course multiply the paperwork.
In their analysis o the opportunity health markets
present, many companies go no urther than this.
But this is exactly where some companies should
persevere in their assessments, and consider the
dynamics o the medical device market place.
FDA Regulatory Impact on Competitive
Forces
In Diagram 3 below, Pro. Porter depicts the ve
orces that in his model drive the industry dynamics.
Tose ve orces include:
pitches regulated by FDA would require detailed
atmospheric reporting o the composite gases in the
cloud, as well as an accurate orecast o how the cloud
will impact the weather, good or bad.
In the postmarket servicing unction, companies inthe medical device eld must adopt systems designed
to vigilantly watch or and report any problems,
and take perhaps signicant corrective action when
problems arise.
In the quality system area, companies that are certied
to ISO standards will have the most new work to do in
the design control and validation areas.
In the modest impact category, the quality systemrequirements will require that the device manuacturer
take greater measures to assure the quality o inputs
being supplied. Tis will include periodic auditing o
suppliers to ensure their systems are robust enough.
Te wide spread decision to outsource and o-shore
customer service unctions, prevalent in I, would
have to be considered in light o these requirements.
Tey could still be done, but doing so could take
longer, be more involved, and actually end up costing
more than keeping it in-house.
Te changes necessary in the actual production o the
products are perhaps least burdensome or a company
that is ISO compliant.
In general, all o those measures:
bargainingpower ofsuppliers
competitive
rivalry
threat ofnew
entrants
bargaining
power ofbuyers
threat ofsubstituteproducts
1. Te threat that new companies will enterthe market
2. Te threat that new products will becomesubstitutes or the marketed products
3. Te bargaining power o suppliers
4. Te bargaining power o customers
5. Te competitive rivalry within the industryitsel.
Diagram 3. Five Forces: Impact of FDA Regulation
Page 20
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
23/51
MobiHealthNews.com
Te degrees o those threats and powers determine the ability o the company to earn a prot. With regard
to the threat that new companies will enter the market, Pro. Porter identies several barriers to entry, and
one o them is government policy or regulation.
Assessing the ve competitive orces, in some cases the analysis reveals some interesting opportunities. In
diagram 3, again using an intensity map where darker yellow represents more competition, I suggest where
I perceive the greatest sources o competition to reside or the medical device industry generally.
In the industries regulated by FDA, the greatest competition tends to be rom established rms in the
same industry. Tis is true or the simple reason that entering the regulated industry oen requires a very
signicant investment to create the innovations and establish the manuacturing systems necessary to
produce them, as well as considerable lead time to get through the FDA clearance or approval process.
Tus the threat o new entrants is lower than the competition created by existing rms that have well-
established systems in place or bringing new regulated products to market. Indeed a companys ability to
cope with the regulated environment becomes a key asset, determining competitive advantage.
Tere is an important limitation to this, however. Companies that ollow the premarket clearance route,
i they dont have patent or other intellectual property protection or their products, might nd that
other established device companies can quickly ollow them through the FDA clearance process. Tis is
sometimes reerred to as a rst mover disadvantage. Further, the laws administered by the FDA do not
create any private cause o action that an individual company can use to orce competitors to abide by the
law. FDA is solely responsible or enorcement o its laws, and i the agency isnt paying attention or simply
doesnt have the needed resources, less reputable competitors might get away with taking shortcuts.
Page 21
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
24/51
MobiHealthNews.com
How to Avoid mHealth RegulationV.
(I would like to thank Leah Kendall o
EpsteinBeckerGreen and Dane Stout o the Anson
Group or their comments on a draf o this chapter.
Te views expressed, right or wrong, are only the
authors and should not be attributed to anyone else.)
The Binary Misunderstanding
Some I companies new to the health eld seem to
misunderstand the nature o FDA regulation, and
Strategies for mHealth Companies Wishing to Avoid FDA Regulation
think o it as all or nothing. In other words, a company
is either a manuacturer o medical devices and subject
to the ull panoply o FDA requirements, or theyre notand likewise are not subject to any FDA restrictions.
But thats not an accurate depiction.
Instead, companies should think o FDA regulation as
a continuum. Diagram 1 on the next page illustrates
the two extremes and a ew o the cases in between.
On the ar right side, the diagram depicts the
traditional manuacturer o nished medical devices
that is indeed subject to all o the FDA requirementsor medical devices. Even here, though, there are
dierent levels o FDA requirements depending on the
novelty and risk associated with a particular device. As
outlined in the second chapter, devices are classied
into three dierent classications, and the types and
burdens o FDA regulations vary considerably. Class
III medical devices include such things as pacemakers,
embody the greatest risk and thus must meet the most
demanding requirements. Class I devices include such
things as tongue depressors and have very minimalFDA requirements. Indeed, most class I devices do
not even need to be approved by FDA, and the quality
system requirements might be very basic. Many
mHealth devices might all into class I or class II.
All o this was covered in much greater detail in the
second chapter in this report.
Most people know the dierence between tax
avoidance and tax evasion. ax avoidance is
the lawul planning o such things as charitablecontributions to minimize taxes, while tax evasion
is the unlawul and usually deceitul actions taken
to hide income. In this chapter, I will share some
tips or the avoidance o FDA regulation, not the
evasion o FDA regulation.
Te rst three chapters in this report dealt with
understanding the scope and nature o FDA
regulation or mHealth, and the ourth chapter
advanced the notion that I companies wanting tomake money in health ought to consider entering
the FDA-regulated zone. Nonetheless, subjecting
your company to FDA regulation is not or
everyone, so this chapter is designed to help those
who have decided to stay out o the production
o FDA-regulated nished medical devices. In
particular, I explain our ways to connect to health
markets, and the pluses and minuses o each such
approach.
Page 22
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
25/51
MobiHealthNews.com
Finished
Class IMedical
DeviceMFR
Contract
MedicalDevice
MFR
Component
And Kit PartSuppliers
Unregulated
ArticleMFR
GMP
Compliance
Full FDA
ComplianceBut Often
Exempt
Inspections
by FinishedDevice
MFR
Good
DistributionPractices &
MarketingCompliance
No FDA
ReachFull FDA
Compliance
1 2 3 4 5 6
Full FDA
Compliance510(k)
7 8
Finished
Class IIIMedical
DeviceMFR
Full FDA
CompliancePMA
e ca
DeviceMFR
Device
MFRMedical
DeviceDistributors,
Retailers& Servicers
Finished
MedicalDevice
MFRThat uses
Contractors for
Compliance
Finished
Class IIMedical
DeviceMFR
Diagram 1. Continuum of Potential Involvement in the Device Industry
Four Ways to Connect to The Health
Market While Reducing or Avoiding FDA
Requirements
Beore I go through the our strategies, it probably
goes without saying that each one is predicated onthe company ully implementing the strategy in good
aith. Anything less potentially becomes FDA law
evasion, rather than avoidance. Okay, so here they are:
Strategy 1: avoid medical devices and their
accessories.
About now youre wondering whether this article is
worth reading, but stick with me or a second, theres
a more subtle and proound observation to be made.
In your mind, go back to the very rst chapter on the
scope o FDA regulation. I went through an example
o a stick, and how it could be either a popsicle stick
or a pediatric tongue depressor, depending on what
claims the company chooses to make. My point is
that in many cases, the design o the product does
not determine its regulatory status, but rather the
promotional claims determine its status. So i your
On the ar le side, the diagram includes unregulated
articles such as personal computers that contain no
medical reerences at all and over which FDA has no
regulatory authority. Its the stu in the middle that is
interesting or mHealth purposes.
Te cases in the middle include, or example,
companies that merely make components or others
to use in manuacturing medical devices, distributors
o nished product that have no control over thepromotional claims or the design specications o the
device, and contract manuacturers that make nished
medical devices at the direction o another company.
Tese dierent unctional responsibilities all have
narrower sets o FDA requirements that apply to them,
directly or indirectly. Its important to understand the
range o possible relationships beore talking about
ways to reduce or avoid FDA requirements, and
exactly what that means.
Page 23
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
26/51
MobiHealthNews.com
company can reach its commercial objectives without
medical claims, and i the product has legitimate and
material nonmedical uses, you might be able to avoid
FDA regulation by avoiding medical claims.
A simple cell phone provides another example. Acell phone can be promoted merely as a cell phone,
and no FDA compliance issues will arise. But i the
manuacturer o the cell phone starts to make claims
that the phone is suitable specically or healthcare
applications, the cell phone manuacturer runs the
very real risk o turning its simple phone into a
regulated medical device.
Remember rom the rst chapter that the
manuacturer might get into trouble making claimsthat its product is specically intended to accompany a
medical device. Tat may very well make the product
an accessory to the medical device, which makes
it a regulated device. Again, claims are pivotal in
determining whether something is an accessory or
not.
In the last couple years as Ive been watching whats
coming out o Silicon Valley, Im seeing a tremendous
number o hardware and soware products thatprobably could be sold as unregulated articles, but
where the manuacturer, possibly quite inadvertently,
is making claims that would cause FDA to regulate
them. FDA is stretched pretty thin these days, so
they arent watching everything coming out o the I
industry, but someday I suspect FDA will get more
active in this space.
Tere are limits to this strategy. I cant make a
pacemaker, or example, and try to pass it o as a
simple, generic piece o electrical equipment. In
designing the pacemaker, Ive done too much to make
the design specic to a medical use to later disclaim
that use. Remember intended use is judged by
words, actions, and in some cases, inaction. I youre
interested in this strategy, you ought to go back and
review the rst chapter o this report.
A number o startups in mHealth have come up with
very innovative business plans that put them squarely
in the gray area between medical and nonmedical
intended uses. For example, there are companies
developing strategies or remote monitoring o people,
rather than their disease or condition. Tere aregray areas between wellness programs and disease
programs where FDA needs to give industry clearer
guidance. Obesity, as a disease, is oen dicult to
distinguish rom general physical conditioning.
Unortunately, I suspect we will all need to eel our
way along in the dark or the time being.
Finally, to employ this strategy, the maker o the
equipment must be duly diligent in avoiding making
medical claims. Tat means it needs to have somelevel o compliance and training systems in place to
ensure, or example, that sales representatives do not
go rogue. Even unauthorized sales activity can come
back to haunt the company i the government decides
that the company wasnt careul enough in managing
its people.
Strategy 2: avoid controlling the product
specications or the claims made.
Most FDA requirements, including the need to obtain
FDA clearance or approval, and the responsibility or
reporting adverse experiences all on the company
that owns and controls the product specications and
the claims made. Because most o the risk o a medical
device stems rom its design and the claims made
about it, whoever controls those two eatures has most
o the FDA compliance responsibilities. So, i you dont
want those responsibilities, dont own or control those
two eatures o the device.
Some examples probably would help. In most cases, a
contract manuacturer does not control the product
specications or the claims made about the product.
Tats true even i the contract manuacturer produces
nished product and drop ships it to the ultimate
Page 24
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
27/51
MobiHealthNews.com
purchaser on behal o the specication owner. In
that case, FDA looks to the specication owner or
compliance with most o the agencys requirements,
even i the specication owner never even touches the
device.
Indeed, ownership o the product and the control o
the specications and labeling determine regulatory
responsibility instead o who in act engaged in the
design process or wrote the label. Companies oen
ask a contract manuacturer to help with the design
process, or enlist the services o an engineering rm.
None o that matters. Te only thing that matters
is who, at the end o the day, owns the product and
controls the specications and the label or the
product.
Tis control rule is also the basis or organizations
such as distributors and retailers to pass regulatory
responsibility up the chain o distribution to
whichever entity controls the specications and the
labeling. Although distributors and retailers have
limited FDA responsibilities, the responsibilities
or seeking FDA clearance and ensuring the quality
o the product remain with whoever controls the
specications and labeling.
Components suppliers similarly avoid much o the
onerous elements o FDA regulation. I a company
makes an article that is incorporated into a nished
medical device, the maker o that component is not
directly subject to FDA regulatory requirements
or premarket clearance or even the quality
system requirements. Instead, the nished device
manuacturer is obliged to have in place supplier
controls sucient to ensure the quality o thecomponents it uses. Tese controls might include, or
example, periodic inspections o suppliers.
Another strategy is to supply nished medical devices
to a rm that will co-package its own device with
yours. From a regulatory standpoint, this is essentially
the same as the component supplier scenario just
discussed. Even though the article is a nished one,
i it is bundled together with another product beore
it is sold to the end user, the company that does the
bundling has responsibility or ensuring that each
product in the bundle has the requisite regulatory
compliance. Sometimes the supplier or the article to
be bundled will undertake compliance with the FDA
requirements itsel, and sometimes the bundler takes
that job. But because the bundler is considered to own
the specications o the bundle and whatever claims
are made or the bundle, it generally has the ultimate
regulatory responsibility.
Lets take, or example, a common cell phone,
hypothetically call it a mePhone. I the cell phone
manuacturer makes no medical claims about it, the
cell phone manuacturer will have no direct FDA
responsibilities. But lets say a blood glucose meter
manuacturer claims, in promotional materials, our
meter will pair with the mePhone to download data
or analysis on our special app. Arguably the blood
glucose meter manuacturer has made the mePhone
and the app into components o its medical device
system. So the blood glucose meter manuacturer
may, or example, either need to prove through a risk
assessment that mePhones available in the marketplace will remain suitable or that intended use, or
need to enter into an agreement with the mePhone
maker such that the two companies, through
cooperation and control, will ensure the uture
compatibility o the two devices. Ive kept this simple
but in real lie these acts are usually much more
complex.
I want to underscore something I said earlier:
almost none o the organizations in this section arecompletely outside o FDAs jurisdiction. Tey all have
some, albeit perhaps minor, FDA responsibilities.
Even distributors and retailers have to ensure their
promotion remains consistent with the approved
labeling, and their acilities appropriately saeguard
the integrity o the products. Components suppliers,
while technically exempt rom the quality system
Page 25
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
28/51
MobiHealthNews.com
regulations, oen must nonetheless ensure that they
are not selling adulterated components or use in
medical equipment.
Over the last several years, I have read a dizzying array
o corporate agreements that provide or various kindso collaborations like these between companies. Some
o them are ashioned as supply agreements, while
others look like contract manuacturing agreements,
and yet others look like intellectual property license
agreements.
As a regulatory lawyer, when I read these agreements,
oen Im asked to make a judgment as to who has
the FDA regulatory responsibilities. And sometimes,
honestly, it just isnt clear. Ive read agreements whereall the specications and promotional claims have
to be mutually agreed upon between two parties. In
other cases, one party maintains a general level o
control over the specications and claims, while the
other party is able to exercise wide latitude within
certain limits. In those cases, where it is genuinely
unclear which party has the FDA responsibilities
under the regulations, I believe FDA permits the
parties to speciy in the agreement who has those
responsibilities, so long as that division is reasonable
to resolve the gray area. So my advice: have your
regulatory lawyer work closely with your corporate
lawyer to make sure that your various collaboration
agreements speciy a reasonable and your intended
division o labor on the regulatory compliance side.
Strategy 3: contract out the hard stuff.
Even i your company markets what is admittedly a
medical device and controls the specications and the
promotional claims so that your company is clearly
regulated by FDA, that doesnt mean your company
itsel must do the hard stu. Te regulatory work can
generally be contracted out, even i the regulatory
responsibility has to remain with the specication
owner.
It probably wont surprise anyone to know that there
are whole industries designed to conduct various
responsibilities o medical device specication owners
in compliance with FDA requirements. For example,
there are clinical research organizations that can
do all o the clinical research, soup to nuts, and oneo their main selling points invariably is that they
take responsibility or the FDA compliance or that
unction. Tere are regulatory consultants who can
quite ably prepare premarket submissions. Tere are
contract manuacturers who specialize in producing
product under FDA quality system requirements,
and there are other consultants who can help bring
the specication owners acilities up to code, so to
speak. Tere are design organizations well-versed in
conducting the design process in compliance withFDA design controls. Bottom line: i theres some
eature o FDA regulatory compliance that makes you
nervous, theres probably a whole industry out there
quite willing to help you do it.
Tat said, it bears repeating that you can contract
out the work but not the responsibility. I your
organization is the one that controls the specications
and the labeling, your organization will bear ultimate
responsibility or FDA compliance. As a practical
matter, i you choose to contract out any o that work,
it means you have the obligation to be duly diligent
in selecting the right qualied rm to help you do
the work, and providing reasonable oversight or the
unction. So the hando isnt complete.
Strategy 4: sell a service or be a user, not a
product producer.
Tis strategy is sometimes risky, but sometimes it
can work. FDAs jurisdiction is very clear: the agency
regulates products. In the very rst article, I discussed
the need or a physical product that is the subject o
FDA regulation. FDA does not regulate services, nor
do they regulate the practice o medicine.
Page 26
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
29/51
MobiHealthNews.com
Tat circumstance has led some proessions to be able
to do things that product manuacturers and sellers
cannot. For example, clinical laboratories routinely
develop their own clinical tests that they use with their
own customers. For decades, FDA has taken a nearly
hands-o approach to that practice, saying that clinicallabs are suciently regulated under a dierent piece
o legislation, the Clinical Laboratory Improvement
Amendments o 1988. Likewise, pharmacists who are
regulated under state pharmacy laws have a certain
latitude to compound drugs. In these cases, FDA has
decided that these are proessional service businesses
rather (already regulated by others) than the sellers o
devices or drugs.
Conceptually, it may be possible to position certainhealthcare services as services, rather than the sale
o products. But be mindul that this is not simply
converting outright sales to rentals. Tat makes no
dierence to FDA. Further, as you might guess, i
a particular operation starts to look too much like
manuacturing, FDA will regulate it. My only point
is that healthcare proessionals have a certain latitude
to provide services to their patients without FDA
intrusion. Te sixth chapter in this report will discuss
this latitude specically.
The Trade-offs
As Milton Freidman observed, there aint no such
thing as a ree lunch. Each o these strategies involves
trade-os, and Ive tried to depict those at a high-level
in Diagram 2 below.
As with some o my other diagrams, this one refects
subjective judgments concerning the magnitude o
the benets and burdens associated with a ew o the
strategies. Ive used blue stars to depict eatures wheremore is better, and Ive used black stars to indicate
attributes where less is better.
So, i we look in the column or FDA regulated
articles (#8 or class III), we see my assessment that
the potential prot margins are the greatest and the
product lie cycle length is the longest and barriers to
entry are the greatest, but on the negative side internal
Diagram 2. Trade-offs
FDA
Regulated
8
Contractout tasks
5
Componentsupplier
2
Notregulated
1
Profit
margins
Product life
cycle length
Internal over
head costs
Barriers to
entry
Page 27
8/8/2019 mHealth News Report FDA Regulation of Mobile Health
30/51
MobiHealthNews.com
overhead costs are the greatest. I chose to characterize
product liecycle length as good simply because it
means the company has a longer time in which to
recoup its investment. I realize some I companies
like the short product liecycles because they consider
speedy new product innovation to be a competitive
advantage or the rm.
On the other end o the spectrum, I indicate that
unregulated articles normally have much lower prot
margins and shorter product liecycles and ewer
barriers to entry, but lower overhead costs. However,
Im sure everyone can think o examples where thats
not true. In some cases companies are able to develop
patent protection around truly novel technologiesand earn tremendous prot margins over the ull
length o the patent lie. Further, the development o
those innovative products might be a tremendously
high cost. But Im treating those as the exception,
not the rule. Perhaps Im wrong, but in the consumer
electronics area, it seems as though competition is
erce and technologies quickly become commoditized
despite whatever patent protections might be available.
In the middle you nd compromises between thosetwo extremes. In scenario 5 where the company
simply contracts out certain dicult tasks, the prot
margins go down correspondingly as the costs o
contracting go up, but the company still benets rom
some barriers to entry and earns a comparatively
better prot margin than the ar right side o that
table. Likewise, component suppliers oen enjoy ewer
barriers to entry and have comparably lower prot
margins to the nished medical device manuacturers,
but they also ace a lower cost structure.
Tere is a quantitative basis or this judgment that
bears noting. According to Tomson Reuters, medical
equipment manuacturers enjoy an average ve-year
gross margin o 59%, compared with 45.8% or the
S&P500. Recent research coming rom the Deloitte
Center or the Edge, which has studied the business
Conclusion
Tis chapter is meant to give you a high-level
understanding o some broad strategies oravoiding or at least reducing your companys
FDA compliance obligations. Within each o
these broad strategies are multiple variations
that raise complexities well beyond the scope
o this chapter. Te last strategy, selling services
or being a user o products, is complicated
enough that it deserves its own chapter. Te
next chapter will ocus on hospitals and other
providers o care that might employ their own
tailored technology to diagnosing, monitoring
or treating patients, and the corresponding FDA
obligations that may apply.
climate or US industries over the past orty years,
calculates the average return on assets (ROA) or the
entire U.S. economy had allen to almost one-quarter
o its 1965 levels by 2008, while perormance in the
Health Care industry has run contrary to the trend.
Tat occurred while the ROA in healthcare rose rom
1.7 percent in the early 1970s to 3.8 percent in the
same period, nearly doubling.
Ch