Software-based medical devices tend to develop more quickly than typical hardware-based medical devices; so, in response, the FDA has turned to an agile regulatory model for software as a medical device (“SaMD”). The FDA describes the Software Precertification Program as a voluntary pathway, with tailored assessments of the safety and effectiveness of software technologies. Rather than solely considering organizations’ Quality Management Systems, the Software Precertification Program envisions an FDA or accredited third party broad assessment of an organization. The assessment would consider the quality of the software design, testing, clinical practices, performance monitoring, and post-market data collection of safety and effectiveness. The FDA intends for pre-certified organizations to have their lower risk SaMD products exempted from premarket review, and their higher risk SaMD products to experience faster review.
The laudable goal of the program is to have less burdensome regulatory oversight, achieved by assessing organizations’ processes for quality and transparency. For manufacturers with a “culture of quality and organizational excellence,” precertification provides efficient regulatory oversight over SaMD. The safety, effectiveness, and performance of such an organization’s SaMD would be verified in order to build stakeholder confidence that pre-certified organizations have demonstrated their ability to create, maintain, and improve SaMD. The FDA intends for the program to be open to any size organization developing medical devices that could be subject to FDA oversight. Note, however, that non-device software functions are not within the scope of the program – for example, software functions that are intended for administrative support, electronic patient records, or the display of data.
The Precertification Program evaluates “organizational excellence” based on five culture of quality and organizational excellence (“CQOE”) principles: product quality, patient safety, clinical responsibility, cybersecurity responsibility, and proactive culture. Organizations would be well-served to demonstrate excellent development, testing, and maintenance of high quality SaMD; as well as providing a safe patient experience throughout. Clinical responsibility requires addressing patient issues like labeling and human factors, plus responsible clinical evaluations. And, an evaluation will consider an organization’s proactiveness – in regard to cybersecurity issues, as well as general proactiveness over surveillance, user needs assessment, and continuous learning.
The four key, interdependent program components are:
- Excellence Appraisal and Precertification. In considering whether an organization is one that can produce safe and effective SaMD products, the FDA works through five elements:
- Eligibility
- Application
- Appraisal
- Status determination
- Maintenance and monitoring
An organization is likely to be eligible if they show domains where excellence commitments are observable, and if the organization tracks key indicators to ensure their activities are performing. The FDA recently clarified that the “business unit,” or the boundaries of the organization, should be clearly defined by the organization before it is considered for precertification. The precertification application should describe the business unit and the organization’s portfolio of software products.
Then, in the appraisal process, the FDA will assess whether an organization has demonstrated how its specific processes of product development are aligned with the “Excellence Principles.” Organizations should aim for macro-level excellence principles like leadership and transparency, as well as micro-level excellence throughout the work environment and development process. An organization exemplifying excellence would have strategic direction from the top, with leaders sharing relevant information with all stakeholders to build confidence. Appropriate resources should be allocated across all lifecycle processes, and the infrastructure should be supportive of risk management that is focused on patient safety. The FDA envisions tight control over outsourced processes, as well as clearly articulated software configuration and requirements management. The design and development prong should ensure safe, effective, and secure SaMD, with verification and validation that assures the software meets operational requirements. Finally, even after smooth deployment, there should be maintenance that preserves the integrity of software by protecting modifications from any new hazards. The FDA intends to evaluate an organization based on objective, observable evidence of their Key Performance Indicators (“KPIs”) that meet the aforementioned elements. The appraisal process may be followed by site visits, interviews, or other methods wherein organizations could provide measurements of how their practices fulfill each element.
The FDA’s stated intent for the varying levels of certification is to distinguish between organizations that have successfully marketed and maintained products, and those that have not. Aggregate appraisal results for each excellence principle would inform precertification status determination. However, an organization does not necessarily have to max out each element – the FDA intends to ask whether more than one measure shows concordance to the elements. Precertification Level One allows inexperienced organizations that have demonstrated all five excellence principles to market their lower-risk software without review, while their higher-risk software would receive streamlined review. Level two allows organizations with a track record of successful marketing and maintenance of products (who have also demonstrated all five excellence principles) to market certain lower- and moderate-risk software without review, with streamlined review for other types of software.
- Review Pathway Determination. This component of the Precertification Program aims to develop a risk-based framework so organizations may determine the appropriate premarket review pathway for their particular SaMD products. Risk categorization is crucial, and is based on an organization’s precertification status, precertification level, and the SaMD’s risk category. An organization should be ready to proffer the elements necessary for identifying modifications (core functionality and device description of the SaMD) and the elements necessary to give confidence in the SaMD (organizational excellence and real-world performance information).
In a recent update to the precertification guidance, the FDA indicated that the risk of a SaMD can be understood by a clear definition statement about the intended medical purpose of the SaMD. The statement should explain how the SaMD meets the definition of a medical device (i.e., whether the device is intended to treat or diagnose, drive clinical management, or inform clinical management). An understanding of the risk of a SaMD is also based upon the description of the SaMD’s core functionality, which should identify critical features of the SaMD and why they are significant in regard to the information the SaMD provides for the healthcare decision.
- Streamlined Premarket Review Process. A pre-certified organization will be considered for streamlined review after a successful excellence appraisal and determination that their SaMD product meets the requirement for FDA review. The FDA’s stated intent is to “conduct an interactive review supported by automated analysis, where appropriate,” as well as to “provide a decision on the marketing of the pre-certified organization’s SaMD product within a shorter timeline than other premarket review processes.”
An organization undergoing the review process should be prepared for an interactive review of supporting information – like clinical evaluation results and risk management for the device’s intended use. If an organization’s SaMD is not authorized for market, the FDA would conduct an after-action review to identify gaps in the evidence submitted. The organization could help determine a plan for future resubmission; however, if an organization frequently failed streamlined review their precertification status would likely be reassessed.
The FDA seeks to make review as least burdensome as possible, in terms of the amount and type of information required in premarket review. Organizations should be sure to provide the main product-specific elements that are typical of a premarket notification submission, but not necessarily all of the items listed are needed for every product.
- Real-World Performance (“RWP”). Finally, the RWP component seeks to develop performance data domains and analytic methodologies for Precertification Program activities. The FDA has indicated they intend to monitor the post-launch trends of product-specific performance (not necessarily raw data).
Organizations should proactively monitor RWP data, because they can use that data to support product claim modifications, changes in intended use, or expansions of product functionality. There are at least three types of data domains that organizations can track: real-world health analytics (ex: human factors and usability, clinical safety, health benefits), user experience analytics (ex: user satisfaction, issue resolution, user engagement and feedback), and product performance analytics (ex: cybersecurity and product performance).
Organizations using RWP data should divulge what RWP data elements are being collected to monitor the safety and effectiveness of SaMD, and how often the data is collected. Plus, organizations should have a methodology for using RWP analytics as inputs into the precertification appraisal, and thresholds triggering the need for review of the precertification status. Overall, monitoring of RWP will result in increased public confidence in the Precertification Program, and increased responsiveness to emerging issues.
Crisis Prevention and Recovery LLC provides SoftwareCPR®, ValidationCPR, and RegulatoryCPR services and can help you with remediation as well as proactive efficient processes and has participated in the FDA Pilot Precertification on a consulting basis. Contact us at 781-721-2921, www.softwarecpr.com, or email office@softwarecpr.com for more information.
