Medical Device Software Regulations (WIP)

The agency responsible for regulating medical devices is the Center for Devices and Radiological Health (CDRH). The CDRH is under the Food and Drug Administration (FDA), which is in turn under the cabinet-level department of Health and Human Services (HHS).

Here is a single sentence summary: a medical device is an item intended to treat or diagnose disease or affect the structure or function of the body that does not achieve its effect through chemical action.

A more detailed definition is given in Section 201(h) of the Food, Drug, and Cosmetic Act.

References

• Federal Food, Drug, and Cosmetic Act. See section 201(h) in the first few pages.
• How to Determine if Your Product is a Medical Device

Quoting the FDA, SaMD is,

Software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device.

Related to SaMD are:

1. Software in a medical device
2. Software used to produce a medical device

References

• Software as a Medical Device (SaMD)
• International Medical Device Regulators Forum - Software as a Medical Device (SaMD): Key Definitions

• 510(k) Premarket notification is used if the device can be shown to be similar to a similar predicate device
• De Novo is used for devices with no predicate, but which can provide “reasonable assurance of safety”
• Premarket approval is for high risk devices

References

• How to Study and Market Your Device - Step Two: Select and Prepare the Correct Premarket Submission
• Premarket Notification 510(k)
• De Novo Classification Request
• Premarket Approval (PMA)

A premarket submission refers to a request for review by the FDA for clearance, approval, or classification, referring to the appropriate market pathway for the device, i.e., 510(k), PMA, or De Novo, respectively. E.g., if a 510(k) submission is successful, it would be called cleared by the FDA but not approved, and a successful PMA would be called approved. Lastly, a 510(k) submission in full is called a premarket notification 510(k).

A quality system is used to show that a postmarket device continues to meet requirements.

References

• Quality System (QS) Regulation/Medical Device Good Manufacturing Practices

FDA guidance documents are not legally binding but describe current best practices towards conforming to FDA regulations, which are legally binding federal laws. On the other hand, standards provide a common language that can be used to show a device has certain properties or meets certain criteria. So, standards can ease the process by which a device is demonstrated to follow a guidance document or conform to a regulation.

Examples

• Regulation: 820.70 Production and process controls for quality system regulation of medical devices
• Guidance document: General principals of software validation; Final Guidance for Industry and FDA Staff
• Standard: IEC 62304 for medical software development life cycle requirements.

References

• What is the difference between the Federal Food, Drug, and Cosmetic Act (FD&C Act), FDA regulations, and FDA guidance?

The Health Insurance Portability and Accountability Act (HIPAA)

HIPAA defines covered entities as entities belonging to one of the three categories listed below.

• Health care providers
• Health plans
• Health care clearinghouses

An example in the health care provider category would be a medical doctor, and an example under the health plan category is a health insurance company. You can find the rest by following the link in the references below.

Innolitics is not a covered entity, and Innolitics’ clients are usually not covered entities.

References

• Covered Entities and Business Associates

Quoting the HHS,

A “business associate” is a person or entity that performs certain functions or activities that involve the use or disclosure of protected health information on behalf of, or provides services to, a covered entity.

To make a crude analogy, a covered entity is the front-end while business associates are the backend services with respect to PHI. HHS demands that both of these conform to HIPAA regulations.