Background of the Medical Software Functions Exclusion
Most of those in the industry do not question whether the FDA has the authority to regulate software that qualifies as a device. However, there are many intricacies in the definitions of the 21st Century Cures Act – which, in 2016, amended the definition of medical devices in the FD&C Act. Importantly, the Cures Act excluded these medical software functions from the definition of device: software functions intended
- for administrative support of a health care facility,
- for maintaining or encouraging a healthy lifestyle,
- to serve as electronic patient records,
- for transferring, storing, converting formats, or displaying data, or
- to provide limited clinical decision support.
Now, as required by the Cures Act, the FDA has put out a call for comment asking for input on the risks and benefits to health of the software functions excluded from the device definition under the Act. See the FDA’s announcement here: Development of 21st Century Cures Act Section 3060 Required Report: Request for Input. Stakeholders are invited to share ideas for “best practices to promote safety, education, and competency” for these non-device software functions. Comments are due by July 13, 2020.
Implications of Excluding Medical Software from the Device Definition
The current call for comment on the Cures Act only deals with the five aforementioned non-device software functions, but whenever a particular category is “exempted” from regulations it may be tempting to use less rigor in developing that software. However, whether or not software is formally considered a device, best practice is to continue to follow relevant standards. For example, even if a company is not bound by ISO 14971, it would only be beneficial for them to consider reasonably foreseeable use and misuse when designing their product.
Maintaining compliance even when the law does not require it has two readily apparent benefits. First, if the device definition changes (something that is always possible, especially after a change in administration or a call for comment), and a previously un-regulated product becomes regulated, the compliant company will be in the best position possible. Secondly, it demonstrates integrity by the company (something that the FDA looks for in its Excellence Appraisals in the Pre-Cert Program, and that a court may take into consideration when evaluating the risk mitigation a company took in designing their product).
It is always good to remember that software developers are free to exceed the bare minimum of safety! A change in the device definition does not necessarily mean there should be a change in the way a company guards against risk in that device.
For more general information about the 21st Century Cures Act, see some of our previous posts: Medical Device Section 21st Century Cures Act, 21st Century Cures Act – SCPR SW Impact Analysis, 21st Century Cures Act – Medical Device Summary.
