IMDRF Releases International Framework for Regulating Device Software

On October 14, 2014, the International Medical Device Regulators Forum (IMDRF) issued a final version of “Software as a Medical Device: Possible Framework for Risk Categorization and Corresponding Considerations” (“the Framework”).1 Intended to establish a shared foundation for regulating software as a medical device (SaMD) in member countries, the Framework provides criteria for categorizing SaMD and regulatory considerations for the SaMD lifecycle. Although the Framework does not alter current legal requirements in member countries, it does set the stage for further dialogue and suggests a shared understanding in regulatory approach towards SaMD.

Background

One of four current work items for IMDRF is regulation of software as a medical device. IMDRF’s SaMD Working Group, which is currently chaired by U.S. Food and Drug Administration (FDA) officials,2 intends to “develop documents that support innovation and timely access to safe and effective Software as a Medical Device . . . globally, provide opportunities to identify commonalities and develop approaches for appropriate regulatory controls, as well as promote prospective convergence in areas of advanced and innovative technologies in this topic area.”3 

The SaMD Working Group aims for convergence and common understanding among member states, and to establish a shared framework for regulators to incorporate into their medical device classification systems. This initiative contemplates three phases:

  • Phase I: SaMD Key Definitions (completed December 9, 2013)4
  • Phase II: SaMD Framework (completed September 18, 2014)
  • Phase III: Controls and Expectations for SaMD (ongoing, with informal input from stakeholders).

SaMD Framework

Under the Framework, the level of regulation for SaMD primarily turns on two factors: (i) criticality of the healthcare context and (ii) significance of the information provided by SaMD to a healthcare decision. The Framework identifies three levels of criticality:

  • Non-Serious: A non-serious situation or condition is one in which an accurate diagnosis or treatment is important, but not critical, for interventions
  • Serious: A serious situation or condition is one in which an accurate diagnosis or treatment is of vital importance inasmuch as it enables the health care provider to avoid unnecessary interventions
  • Critical: A critical situation or condition is one in which an accurate and/or timely diagnosis or treatment is vital or necessary to avoid death, long-term disability or other serious health consequence.

In turn, information provided by SaMD can have three effects:

  • To inform clinical management: When SaMD is used to inform health care providers of treatment options or to aggregate relevant data to provide health care providers with clinical information
  • To drive clinical management: When SaMD is used to identify early signs of a disease or condition, to aid in making a conclusive diagnosis or to aid in treatment by providing enhanced support in the safe and effective use of drugs or medical devices
  • To treat or diagnose: When SaMD is used to diagnose or treat a disease or condition.

The factors above influence the categorization of SaMD. The four categories are “based on the levels of impact on the patient or public health where accurate information provided by the SaMD to treat or diagnose, drive or inform clinical management is vital to avoid death, long-term disability or other serious deterioration of health, mitigating public health.”  Category I has the lowest level of impact; Category IV, the highest.

  • Category I (low impact): Includes SaMD that provides information to inform clinical management for a disease or condition in a non-serious situation or condition; SaMD that provides information to inform clinical management for a disease or condition in a serious situation or condition; and SaMD that provides information to drive clinical management of a disease or condition in a non-serious situation or condition. Example: SaMD that stores historical blood pressure information for a health care provider’s later review.
  • Category II (medium impact): Includes SaMD that provides information to inform clinical management for a disease or condition in a critical situation or condition; SaMD that provides information to drive clinical management of a disease or condition in a serious situation or condition; and SaMD that provides information to treat or diagnose a disease or condition in a non-serious situation or condition. Example: SaMD that calculates bolus insulin dose based on diabetic patients’ carbohydrate intake, pre-meal blood glucose and anticipated physical activity.
  • Category III (high impact): Includes SaMD that provides information to drive clinical management of a disease or condition in a critical situation or condition; and SaMD that provides information to treat or diagnose a disease or condition in a serious situation or condition. Example: SaMD that takes photos or monitors the growth of a skin lesion to provide a health care provider with supplemental information used to diagnose whether the skin lesion is benign or malignant.
  • Category IV (very high impact): Includes SaMD that provides information to treat or diagnose a disease or condition in a critical situation or condition. Example: SaMD that combines data from immunoassays to screen for mutable pathogens or a pandemic outbreak that can be highly communicable.

Implications

The SaMD Working Group is not seeking to achieve formal harmonization among participating countries. The Framework does, however, provide a common structure for member countries to apply to software products within the context of their medical device requirements. Notably, the IMDRF Framework’s classifications bear some similarity to the Health IT Framework,5 developed by the FDA in consultation with the Office of the National Coordinator for Health Information Technology (ONC) and the Federal Communications Commission (FCC), as required by the Food and Drug Administration Safety and Innovation Act of 2012 (FDASIA).

Generally speaking, sponsors of software products face significant challenges in assessing how generally applicable medical device requirements in countries across the globe will apply to their novel technologies. This uncertainty poses challenges in both jurisdictions with highly developed device regulatory systems and those with less developed device regulatory systems. Although it remains important to assess  the specific standards and requirements of each country or jurisdiction, this IMDRF Framework provides guidance as to how member countries intend to apply their laws.

Contact Information

If you have any questions concerning this alert, please contact:

Nathan A. Brown
nabrown@akingump.com
+1 202.887.4245
Washington, D.C.

Christin H. Carey
chcarey@akingump.com
+1 202.887.4257
Washington, D.C.


1 IMDRF, Final Document, Software as a Medical Device: Possible Framework for Risk Categorization and Corresponding Considerations (Sept. 18, 2014), available at http://www.imdrf.org/docs/imdrf/final/technical/imdrf-tech-140918-samd-framework-risk-categorization-141013.pdf.

2 Members include Australia, Brazil, Canada, China, Europe, Japan, the United States and a variety of stakeholders. See http://www.imdrf.org/workitems/wi-samd.asp.

3 IMDRF, Software as a Medical Device, http://www.imdrf.org/workitems/wi-samd.asp.

4 IMDRF Final Document, Software as a Medical Device: Key Definitions (Dec. 9, 2013), http://www.imdrf.org/docs/imdrf/final/technical/imdrf-tech-131209-samd-key-definitions-140901.pdf.

5 FDASIA Health IT Report: Proposed Strategy and Recommendations for a Risk-Based Framework (April 2014), available at http://www.fda.gov/downloads/aboutfda/centersoffices/officeofmedicalproducts
andtobacco/cdrh/cdrhreports/ucm391521.pdf