How software came under device regulation
Digital health grew from health information systems used by trained staff into stand-alone apps for people without medical training that can connect to wearables, and technology companies have entered the device field. Device regulators harmonised how software as a medical device is defined and regulated, and the legislation that brings such software under device regulation has competing goals to balance and rules that keep having to adapt.
Digital health and the rise of health apps
The European Commission defines digital health, or digital health and care, as tools and services that use information and communication technologies to improve the prevention, diagnosis, treatment, monitoring and management of health and lifestyle. Three aspects are central to it: the data input, the analysis of those data to give robust and reliable health assessment outputs, and the ability to transfer both the input and the output between different hardware, often over wireless and mobile networks. These aspects, together with societal changes, have led to the ongoing rise of digital health, which aims to improve access to and quality of healthcare and to increase the overall efficiency of the health sector.
Crucial to that aim is the software that underpins the tools and services that analyse the data to support decisions on disease prevention, diagnosis, treatment, monitoring and management. So ensuring the appropriate design and quality of medical software algorithms, and their ongoing refinement, including artificial intelligence and machine learning software, is key to more informed healthcare decisions and improved patient care.
Early digital health focused on digitalised health information systems for managing and recording patient data, with services such as telecare, telehealth and health analytics for mining and analysing health record data. These were used by trained personnel, and although they contained software, it was integrated in medical hardware and so covered by the device regulatory framework.
Mobile health apps, stand-alone software installed on personal phones and tablets, then became fully established in digital health. From 500 apps in the first app marketplace in 2008, the field grew to about 150,000 mobile health apps on the major marketplaces in 2015 and to more than 300,000 in 2017. Unlike earlier digital health products, these apps can be developed on relatively low-cost platforms and marketed easily through app marketplaces. They were also developed to be used by people without medical training, to generate and analyse data and even to interconnect with unrestricted body sensors, monitoring devices and wearables.
Technology companies entering the device field
Major technology companies are entering the device field by investing in scientific knowledge and in partnerships with established healthcare companies and academic labs, which has the potential to ease the integration of new technologies into healthcare. Some of these collaborations also engage users or patients in the development process, such as Google's Project Baseline, Apple's ResearchKit and Apple's CareKit, an open-source framework that supports the development of applications for medical care. Technology companies are also driving the integration of mobile health apps with wearables, fitness bands, monitors, watches and rings to increase the quantity and quality of the data available. That integration also raises challenges for compliance with the EU Medical Devices Regulation (MDR) and the General Data Protection Regulation (GDPR), for cybersecurity and for patients' rights. The entry of technology companies will further drive mobile health and the incorporation of novel technologies into software as a medical device.
Harmonising the regulation of software
The boom of the internet, the ubiquity of the smartphone and exponential advances in software technology and applications have implications for the medical device industry and its regulation. Regulators across the world have been reshaping how devices reach the market, country by country or through collective initiatives. The Global Harmonization Task Force formed and then dissolved, based on the individual interests of countries.
To address the rapidly expanding field of mobile health, the US Food and Drug Administration released a draft guidance on mobile health applications for public comment in 2011. The device regulators of Australia, Brazil, Canada, China, the EU, Japan and the US, with the World Health Organization, established the International Medical Device Regulators Forum (IMDRF) to develop a harmonised approach to the regulation of medical devices, particularly stand-alone software. Its mission is to provide a globally harmonised message on the regulation of medical devices.
The IMDRF definition and guidance documents
The rapid growth of mobile health led to the IMDRF's internationally harmonised guidance for software as a medical device, covering definitions, risk classification, quality management and clinical evaluation. By the end of 2013, the IMDRF's Software as a Medical Device Working Group had released the first major regulatory document directed at mobile health, Software as a Medical Device (SaMD): Key Definitions (IMDRF/SaMD WG/N10FINAL:2013). It defines software as a medical device as software intended to be used for one or more medical purposes that performs these purposes without being part of a hardware medical device. Under that definition, such software must have as its intended purpose a medical use of diagnosis, prevention, monitoring, treatment or alleviation of disease or injury, need not be part of medical hardware, must be unable to drive medical hardware, and may be interfaced with medical hardware or be a module of it. A guidance document for categorising such software into four risk groups, I to IV, followed in 2014. A guidance document on the quality management system to be applied to such software, based on the standards ISO 9001 and ISO 13485, followed in 2015, and a guidance document on its clinical evaluation in 2017. All of these guidance documents were published while the Medical Device Directive was in force in the EU.
Software under the MDR
Mobile health products and their software have great potential to improve healthcare, but their performance against their claims, and patient safety, need to be ensured. So the IMDRF developed international standards for such software, and regulatory frameworks were updated to include software-specific requirements. The MDR specifically addresses software as a medical device, and it adopts aspects of the IMDRF approaches to definitions, classification, the implementation of a lifecycle quality management system and clinical evaluation. The MDR has significant implications for mobile health developers, who have to ensure compliance with its new requirements. Other jurisdictions around the world have been adapting their legislation to include software as a medical device.
What software legislation aims to balance
The primary goals of legislation that includes software as a medical device are to balance patient safety with timely access to innovative mobile health products, while ensuring the continuous monitoring of their risk and performance profile, with a focus on the MDR and on personal data protection, including cybersecurity.
Rules that keep having to adapt
The rapidly evolving technology, including the incorporation of artificial intelligence and machine learning and the integration of software as a medical device with sensors and monitors, will require regular adaptation of the regulations and guidance. Stakeholders, and software developers in particular, are encouraged to actively monitor developments in the field so that they can take the actions needed to stay compliant with the applicable regulatory framework.