Software in Medical Devices, by MD101 Consulting

Scope of the draft guidance

The scope of the draft is Health IT systems and Picture Archiving and Communication Systems (PACS). But only the server side.

Some Picture Archiving and Communication Systems (PACS) are in the scope of this draft guidance: those that are PACS servers for storing and communicating images, without any other purpose, and are of class I.
The scope of this draft guidance is not PACS Viewers (classification 21 CFR 892.2050) which are of class II, and are subject to 510k procedure.

This draft guidance excludes also IT systems that are in the scope of 21.CFR 892.9 and 21.CFR.880.9, namely those with functions riskier that data storage and communication, like active patient monitoring.

The new rule

This draft guidance establishes a new rule:

The FDA does not intend to enforce compliance with the regulatory controls, including registration and listing, premarket review, postmarket reporting and quality system regulation for manufacturers of these types of devices.

This draft guidance brings more problems that it withdraws, in its current state:

• This is a preliminary version. It could change in the coming months: either simply withdrawn, or heavily modified,
• In the meantime, manufacturers shall continue to be compliant with FDA rules for class I systems, without knowing what will be the status of such systems in a few months,
• Only requirements about registration and listing, premarket review, postmarket reporting, and QSR, are mentioned,
• Other requirements like labelling, Medical Device Recall and some others are not mentioned. We don't know what FDA position is about those ones.

Big change

However, if the final version of this guidance confirms the position of the FDA, this will be a welcomed relaxation of the US regulations about Health IT systems!
Imagine that you can design Health IT systems without QSR controls!

FDA position and EU position

Another way to see this new position of FDA is to compare it with EU regulations about Health IT.
FDA position converges gradually towards EU position. According to MEDDEV 2.1/6 EU guidance about standalone software, Health IT systems are not medical devices.

Regulatory strategy and software architecture

We have here the case where regulatory strategy can have an impact on software architecture.
It could become interesting to split IT systems in two or three tiers (or as many tiers as you need), like:

• Client
• Risky services server, like diagnosis aid,
• Other services server, like communication,
• Storage server, like RDMBS.

Controversial thoughts

This draft guidance is published after the final guidance about mobile medical apps. This draft guidance also edits the mobile medical apps guidance, by changing the examples given for mobile medical apps.
If you have a look at FDA public calendar in december 9-13 2013 and in december 16-20 2013, you'll notice that official of Apple and Google met FDA officials. The subject of FDA-Apple meeting is clearly mobile medical apps.
My controversial thought is: Apple and Google are putting the pressure on the FDA, in order to offer cloud storage services for health data, like quantify-self data, without being subject to FDA general or special controls.

Don't take what I write for granted!

Acknowledgment

And thanks to Elsmar Cove forum. That was the first website to publish something about this: http://elsmar.com/Forums/showthread.php?t=64399
EDIT: elsmar cove forums is dead, see RIP elsmar cove.