The challenges of software medical device regulation. david.grainger@mhra.gov.uk
Introduction A brief history of software device regulation A look at the new device regulations 2
Current framework In Vitro Diagnostics Medical Device Directive 98/79/EC Medical Device Directive 93/42/EEC Active Implantable Medical Device Directive 90/385/EEC UK Medical Device Regulations 2002 3 The directives
What is a medical device? A thing, for use on humans, that the manufacturer says can be used for: Prevention of disease, Diagnosis, monitoring, treatment or alleviation of disease, an injury or handicap, Compensation for an injury or handicap, Investigation, replacement or modification of the anatomy or of a physiological process, Control of conception And doesn t act principally as a medicine. This intended use is determined by claims on the device, label, instructions or promotional material. 4
But I have a disclaimer! It should be noted that general disclaimers (for example this product is not a medical device ) are not acceptable if medical claims are made or implied elsewhere in the product labelling or associated promotional literature. Manufacturer needs to consider use that can be reasonably foreseen prior to placing a product on the market A device does not need to diagnose to be considered to be used for diagnosis. 5
Function creep! Adding extra functionality can change qualification as a device. e.g. The addition of QRISK calculator to a basic GP database will make the system a device. Can be managed by CE marking a module. 6
Can software be a device? 1993 - Medical Device Directive - 93/42/EEC Software on its own not specifically included. including the software necessary for its proper application Microsoft releases Windows 3.11, Office 4.0 and MS-DOS 6.0. DOOM released 1994 European guidance - MEDDEV 2.1/1 Distinction of software influencing Software related to the functioning of a medical device may be part of a device or a device in its own right if it is placed on the market separately from the related device. Macintosh System Software - System 1 7
Software as a device? 1998 IVD Medical Device Directive 98/79/EC This directive s definition of a medical device does not include software, only including the software necessary for its proper application IVDMD definition does not include mention of software. Win98 2007 Amending Directive 2007/47/EC (UK March 2010) Specifically adds software into the MDD definition of a medical device. Adds software specific Essential Requirement on validation & verification to the MDD only. iphone (1 st generation) 8
General medical devices In Vitro Diagnostics Medical Device Directive 98/79/EC Medical Device Directive 93/42/EEC Active Implantable Medical Device Directive 90/385/EEC UK Medical Device Regulations 2002 9 The directives
Recap on the current regulatory system The UK MDR implement the MDD into UK law MDD elements: Articles Essential requirements list Annex I The conformity route annexes II-VII Classification rules IX The rest clinical evaluation & other stuff! 10 The directives
Essential requirements Cover safety, design, construction, performance etc. Initially covered risk factors for physical devices. Are not always very specific! Briefly mention software: software must be validated according to the state of the art taking into account the principles of development lifecycle, risk management, validation and verification. Conformance with these can be demonstrated by the use of Harmonised standards. For software : EN 62304:2006 11 The directives
Classification rules Risk based classification system: I, IIa, IIb, III Rules based mainly on physical hazards / interactions: E.g. invasive devices, active devices No specific software rules. Software is considered to be an active device Implementing rule for software that drives or influences a device. Most standalone software will be class I unless performing direct diagnosis. 12 The directives
Conformity routes Depends on Class. Class I device manufacturers self declare. 13 The directives
Guidance: MEDDEVs (MEDical DEVice guidance) Scope, field of application, definition Standalone Software Classification of MD Clinical investigation, clinical evaluation Notified bodies Market surveillance - Vigilance Borderlines 14 The directives
The Borderlines & classification manual European committee that looks at borderline and classification issues for devices. Publishes its determinations. Contains a few software device examples: PACS A mobile application for processing ECGs A mobile application for the communication between patient and caregivers while giving birth A mobile medical application for viewing the anatomy of the human body Qualification of software for interpretation of a guideline Qualification and classification of software for delivery and management of cognitive remediation and rehabilitation programs Classification of software for information management and patient monitoring Mobile application for managing pictures of moles Mobile application for the assessment of moles 15 The directives
Revision of the directives Starting in 2012: extension of the scope of legislation, better supervision of independent assessment bodies, clear rights for economic operators, and stronger requirements for clinical evidence. Guidance written into the regulations. 16 The regulations
MDRs 2017 (Now in force) General and Active Implantable Medical Device Regulations 26 May 2020 (+ 2 if certified UK Law In Vitro Diagnostics Medical Device Regulations 26 May 2022 (+ 4 if certified) 17 The regulations
The new regulations Will apply to medical devices placed on the market or put into service from 26 May 2020. Will include any updates to existing software devices. (A new device will have been put into service.) Certified devices (by a Notified body) have up to an extra 2 years to be in compliance. 18 The regulations
Changes for software? In house developed devices will now be regulated a bit! Essential requirements updated and will now specifically cover security and unauthorised access. There is a specific software rule (Rule 11). Software used to take decisions with a diagnostic or therapeutic purpose will be at least class 2a. If your device is up classified from a class 1 device under the regs, you must remove it from the market until it is certified by a NB. Introduction of UDI labelling. Guidance has been incorporated into the regulations. 19 The regulations
In-house conditions Don t need to fully CE mark as long as: not transferred to another legal entity, manufacture and use of the devices occur under appropriate quality management systems, the health institution justifies that the target patient group's specific needs cannot be met, or cannot be met at the appropriate level of performance by an equivalent device available on the market, Appropriate documentation a technical file; the health institution has a publicly available declaration. 20 Article 5(5)
Rule 11 - Software Software intended to provide information which is used to take decisions with diagnosis or therapeutic purposes is classified as class IIa, except if such decisions have an impact that may cause: death or an irreversible [serious] deterioration of a person's state of health, in which case it is in class III; or a serious deterioration of a person's state of health or a surgical intervention, in which case it is classified as class IIb. Software intended to monitor physiological processes is classified as class IIa, except if it is intended for monitoring of vital physiological parameters, where the nature of variations of those parameters is such that it could result in immediate danger to the patient, in which case it is classified as class IIb. All other software is classified as class I. 21 Annex VIII
Rule 11 IMDRF approach? To treat or to diagnose Treating and diagnosing infers that the information provided by the SaMD will be used to take an immediate or near term action: To drive clinical management Driving clinical management infers that the information provided by the SaMD will be used to aid in treatment, aid in diagnoses, to triage or identify early signs of a disease or condition will be used to guide next diagnostics or next treatment interventions: To Inform clinical management Informing clinical management infers that the information provided by the SaMD will not trigger an immediate or near term action: Critical situation or condition Situations or conditions where accurate and/or timely diagnosis or treatment action is vital to avoid death, longterm disability or other serious deterioration of health of an individual patient or to mitigating impact to public health. IV III II Serious situation or condition Situations or conditions where accurate diagnosis or treatment is of vital importance to avoid unnecessary interventions (e.g., biopsy) or timely interventions are important to mitigate long term irreversible consequences on an individual patient s health condition or public health. III II I Non-Serious situation or condition Situations or conditions where an accurate diagnosis and treatment is important but not critical for interventions to mitigate long term irreversible consequences on an individual patient's health condition or public health. II I I 22
Rule 11? Significance of incorrect decision. Related to timescale of implementation of the diagnosis/treatment. High Prompt diagnosis or treatment Medium, Drives clinical management Low, Informs clinical management. (Everything else) Possible outcome of incorrect decision Critical situation or condition III IIb Serious situation or condition IIb IIa Non-serious situation or condition (everything else) 23
Unique Device Identification (UDI) 2D Bar code example Product code (device identification) Lot number Expiry date UDI two parts: (i) Device identifier (DI) - static data (01) GTIN = manufacturer and device identification (ii) Production identifier (PI) - dynamic data, including: (17) Expiry date (10) Lot number or (21) Serial number 24
UDI Software requirements UDI Device Identifier (model) & UDI Production Identifier (batch) A new UDI-DI shall be required whenever there is a modification that changes: (a) the original performance; (b) the safety or the intended use of the software; (c) interpretation of data. new or modified algorithms, database structures, operating platform, architecture or new user interfaces or new channels for interoperability Minor software revisions shall require a new UDI-PI and not a new UDI-DI. E.g. bug fixes (enhancements that are not for safety purposes, security patches or operating efficiency) 25 Annex VI 6.5
Importers & distributors Supply chain responsibilities: Shall verify that requirements are met: the device has been CE marked and that the EU declaration of conformity of the device has been drawn up; The device is accompanied by the information to be supplied by the manufacturer Manufacturer and Authorised representative identified Check that UDI requirement met Importers to add their details to the packaging/documentation. Contact manufacturer/ca if they believe the device is not in compliance. Record and pass on details of any complaints. 26 Articles 13,14 & 16
27 MDR applies from 26/5/2020!
Crown copyright 2017 About copyright All material created by the Medicines and Healthcare Products Regulatory Agency, including materials featured within these Medicines and Healthcare Products Regulatory Agency presentation notes and delegate pack, is subject to Crown copyright protection. We control the copyright to our work (which includes all information, database rights, logos and visual images), under a delegation of authority from the Controller of Her Majesty s Stationery Office (HMSO). The Medicines and Healthcare Products Regulatory Agency authorises you to make one free copy, by downloading to printer or to electronic, magnetic or optical storage media, of these presentations for the purposes of private research, study and reference. Any other copy or use of Crown copyright materials featured on this site, in any form or medium is subject to the prior approval of the Medicines and Healthcare Products Regulatory Agency. Further information, including an application form for requests to reproduce our material can be found at www.mhra.gov.uk/crowncopyright Material from other organisations The permission to reproduce Crown copyright protected material does not extend to any material in this pack which is subject to a separate licence or is the copyright of a third party. Authorisation to reproduce such material must be obtained from the copyright holders concerned. 28 28