This week, the U.S. Food and Drug Administration (FDA) released its Final Guidance on Mobile Medical Applications, revamping its Draft Guidance and evidencing careful review and consideration of the 130 stakeholder comments it received on its Draft Guidance. The long-awaited Mobile Medical App Final Guidance may signify a win for industry, as FDA’s decision to regulate only a small portion of mobile apps—“mobile medical applications”—made by mobile app developers fitting the definition of a “mobile medical app manufacturer” appears to represent an even more hands-off approach than what was initially suggested in the 2011 Draft Guidance. This is good news for companies making mobile platforms themselves, as well as Internet providers and third parties that offer mobile medical apps for sale, but that are not involved in the design, development or manufacturing of those apps. This is also good news for makers and marketers of FDA-regulated products in both the drug and device areas that have been reluctant to forge ahead in the software space on patient tools in their direct-to-consumer (DTC) offerings, since educational patient tools are generally exempted or given enforcement discretion.
While FDA went to great lengths in its Final Guidance to clarify its regulatory treatment of various types of mobile apps, the overarching message delivered by FDA in its Final Guidance remains largely unchanged from the Draft Guidance: the agency will focus its regulatory oversight on a small subset of mobile apps whose functionalities present the greatest risk to patient safety if the apps were to not function as intended. According to the Final Guidance, FDA intends to regulate only the subset of mobile apps that constitute “mobile medical apps”—mobile apps that meet the definition of a medical device under Section 201(h) of the Federal Food, Drug and Cosmetic Act (FD&C Act) and are intended: (1) to be used as an accessory to a regulated medical device; or (2) to transform a mobile platform into a regulated medical device. FDA explains in its Final Guidance that this category includes a range of devices from mobile apps that display medical device data to mobile apps that control the delivery of insulin on an insulin pump, as well as Medical Device Data Systems (MDDS). Specifically, “mobile medical apps” subject to FDA regulatory oversight, including the requirements for premarket clearance or approval (depending upon the app’s classification as a medical device), include:
- mobile apps that are an extension of one or more medical devices by connecting to such devices for purposes of controlling the device(s) or displaying, storing, analyzing or transmitting patient-specific medical device data;
- mobile apps that transform the mobile platform into a regulated medical device by using attachments, display screens or sensors, or by including functionalities similar to those of currently regulated medical devices; and
- mobile apps that become a regulated medical device (software) by performing patient-specific analysis and providing patient-specific diagnosis or treatment recommendations.
However, as outlined in the Draft Guidance, the agency recognizes a category of mobile apps that are not medical devices and, therefore, not subject to FDA jurisdiction; the Final Guidance provides an illustrative list of such mobile apps. More importantly, in the Final Guidance, FDA announces an intent to exercise enforcement discretion with respect to a newly identified category of low-risk mobile apps that may meet the definition of a medical device, and provides an illustrative list of such mobile apps. This newly announced regulatory approach means that FDA will not enforce requirements such as registration and listing, Quality System regulation and adverse event reporting for the majority of mobile apps in existence today. Examples of the types of mobile apps for which FDA plans to exercise its enforcement discretion include apps that:
- supplement clinical care and assist patients with self-management of disease or conditions without providing patient-specific treatment or treatment suggestions;
- provide simple tools to log, track and organize health information;
- provide easy access to patients’ health conditions beyond simply providing an e-copy of a medical reference (e.g., drug-allergy look-up tools);
- communicate potential medical conditions to health care providers;
- perform simple calculations routinely used in clinical practice (e.g., BMI calculators); and
- enable individuals to interact with personal health record or electronic health record systems.
Below, we have summarized takeaways, open questions remaining and what the Final Guidance ultimately means for stakeholders:
- Manufacturers of “mobile medical apps” must meet the regulatory requirements (or controls) associated with the applicable device classification, including FDA’s Quality System regulation. Class I devices must meet General Controls (establishment registration and medical device listing; Quality System regulation; labeling requirements; medical device reporting; premarket notification (unless exempted); reporting corrections and removals; and Investigational Device Exemption (IDE) requirements for clinical studies of investigational devices). Controls for Class II devices are General Controls, Special Controls (controls specifically established for particular categories of devices) and, for most devices, premarket notification. Controls on Class III devices are General Controls and premarket approval.
- FDA’s decision to exercise enforcement discretion on low-risk mobile apps that may constitute medical devices is a win for industry because manufacturers of a large number of mobile apps will not be subject to FDA registration and listing, Quality System regulation, adverse event reporting or more onerous premarket notification or clearance requirements—even if the mobile app meets the definition of a medical device. The addition of this category effectively clarifies a number of gray areas left by the Draft Guidance and should help industry to better ascertain where their mobile apps fall on the regulatory spectrum. Ultimately, we see this category as likely to incentivize industry to develop and manufacture mobile apps that fall in this category, so as to avoid FDA regulatory compliance requirements. However, mobile app manufacturers should understand that this is not a renunciation by FDA of its jurisdiction over such apps, but an exercise of discretion as to whether to enforce regulatory requirements over a category of products potentially subject to its jurisdiction. Furthermore, in its Final Guidance, FDA strongly recommends that manufacturers of all mobile apps that may meet the definition of a medical device follow the Quality System regulations contained within 21 C.F.R. Part 820 in the design and development of their mobile medical apps. Currently, this is merely an agency recommendation and not a requirement. We note that FDA’s decade-old Final Guidance titled “General Principles of Software Validation” still represents the guiding validation principles that software developers and manufacturers should follow today.
- The Final Guidance is also a win for health care professionals and practices that utilize home-grown software in patient care that was built in-house. The definition of “mobile medical app manufacturers” explicitly excludes licensed practitioners who develop apps solely for use in their professional practice, and who do not label or otherwise promote the apps for use by others. This is good news for providers who have been wondering whether software programs developed internally by their doctors (and used exclusively and internally by those doctors or those doctors’ practices) will be regulated as medical devices.
- Mobile apps that perform simple calculations routinely used in clinical practice and other apps that are generally tailored for clinical use will not be regulated by FDA under its exercise of enforcement discretion.
- Release of the Final Guidance may encourage the development of DTC tools for a host of patient disease education, tracking and symptom assessment apps over which FDA will not be exercising regulatory oversight.
- One area that the Final Guidance explicitly excludes from its purview is clinical decision support (CDS) software. The door that FDA has left open by avoiding discussion of CDS software in the Final Guidance is potentially significant, as it gives FDA an opportunity to pull back into its regulatory regime and enforcement purview mobile apps with CDS functionality, depending on the regulatory treatment FDA ultimately gives those systems. Although the agency has indicated its plans to address this in a separate guidance, CDS systems remain in a gray area and manufacturers still are without clear-cut pathways to market for these products. Although not yet officially defined, FDA has described CDS software as any software, whether designed as a mobile app, web-based service or desktop application, that uses an individual’s information from various sources and converts that information into new information (e.g., into electronic health record systems) that is intended to support a clinical decision. In fact, FDA is working on a separate guidance document that addresses CDS software. Without further guidance from FDA, it remains unclear how the agency will regulate CDS software and, at this time, there is no clear-cut pathway applicable to all CDS products. Mobile app developers need to be aware that, despite the latitude displayed in the Final Guidance, they may still be subject to FDA regulation, depending on how FDA defines CDS functionality and software and how FDA approaches regulation of such software.
- FDA has indicated plans to develop a new website to respond to inquiries, and on which the agency will continually post new examples of apps that will not be actively regulated. This fluid communication from FDA to industry is encouraging; hopefully, FDA will expeditiously establish such a repository of information for stakeholders. The Centers for Medicare & Medicaid Services adopted a similar frequently asked questions portal for industry questions related to Sunshine Act implementation that has proven an effective means for getting industry questions answered. Mobile medical app developers can also send any questions to mobilemedicalapps@fda.hhs.gov. In addition, FDA encourages mobile medical app manufacturers to search FDA’s public databases, including the Product Classification and 510(k) Premarket Notification databases, to help determine the level of regulation that may be applicable to specific devices or functionalities. Additionally, FDA encourages manufacturers to contact the agency with questions or to obtain more information regarding the regulatory status of their mobile medical apps.
Finally, note that the release of the Final Guidance also coincides with the Federal Trade Commission’s (FTC) plan to focus its advertisement enforcement oversight on mobile apps (including mobile medical apps), mobile disclosures, online advertising and other nontraditional endorsements and testimonials. The FTC has indicated that mobile apps are among the top priorities on FTC’s enforcement agenda, as the FTC continues to scrutinize disease claims and the level of evidence needed to substantiate such claims. Another concern raised by smartphones and mobile apps is that small screen sizes often compromise (or exclude) the presentation of necessary disclosures to prevent advertisements from being deceptive. Companies should consult FTC’s updated guidelines on .com Disclosures issued earlier this year to ensure that their advertising adheres to FTC’s recommendations.
The release of the Final Guidance on Mobile Medical Applications provides long-awaited and much-needed clarity for mobile app developers. Many mobile app developers can breathe a collective sigh of relief knowing that FDA has moved a large number of products from potential regulation to outside of its regulatory oversight. This perhaps signals recognition by the agency that it would be impossible to police such a large number of mobile apps in the electronic marketplace. It remains to be seen how soon it will be before FDA begins to ramp up its enforcement efforts, but one thing is clear—FDA has given the industry notice that regulatory compliance is expected for apps falling into the subset of “mobile medical apps” that FDA has defined. It would be prudent for companies having apps that fall within this category currently on the market to immediately begin efforts to bring those apps into compliance and to ensure documentation of those efforts should FDA contact the company prior to completion of those efforts.
This advisory is published by Alston & Bird LLP to provide a summary of significant developments to our clients and friends. It is intended to be informational and does not constitute legal advice regarding any specific situation. This material may also be considered attorney advertising under court rules of certain jurisdictions.