About the Author: Bradley Merrill Thompson is a member of the firm at Epstein Becker & Green, P.C. There, he counsels medical device, drug, and combination product companies on a wide range of FDA regulatory, reimbursement, and clinical trial issues. The opinions in this piece are Thompson's and don't necessarily reflect the opinions of MobiHealthNews or HIMSS.
As a pro bono project, together with several friends in medical device regulatory affairs, I am traveling to eight major universities around the country this spring talking with entrepreneurs about the FDA regulatory issues associated with bringing artificial intelligence into healthcare applications. Our goal is to help startups figure out the regulatory path ahead of them, to open the door to more innovation that can hopefully save lives.
Through these discussions, we are learning that many startups are confused about the scope of what FDA regulates in the software space. Prior to our arrival, these entrepreneurs use FDA’s website to try to understand the agency’s requirements. But unfortunately, FDA’s website is full of false and misleading information that has led many of them to incorrect conclusions about whether their products are regulated.
With only a little effort, I found at least 10 FDA documents on its website that include wrong information. Some are incorrect because they fail to reflect the changes in the law from the 21st Century Cures Act enacted in 2016, while others are misleading because they state that FDA regulates something which, in fact, FDA does not as a result of so-called “enforcement discretion.”
If the agency truly wants to help spur innovation, my modest proposal is that FDA start by correcting the information on its website.
Background: Implementing statutory changes
Without trying to turn you into a law student, I need to explain the basic U.S. legal framework. Our system of law is hierarchical, with different levels of authority. And each level must conform to the authority above it. It’s important to understand this because it means that when Congress changes a statute, the agencies are then responsible for changing their regulations and guidance to conform to the new statute. So here are the four basic levels:
- Constitution. In the United States, the power ultimately belongs to the people. The Constitution is the supreme law of the land, and the ability to change the Constitution resides with the people. All other laws must conform to the Constitution.
- Statutes. Congress has the power to legislate statutes. But statutes must conform to the Constitution.
- Regulations. Federal agencies have the power to promulgate regulations, but the regulations must conform to the congressionally-enacted statutes.
- Agency Guidance. Federal agencies have the power to explain and interpret their regulations, and they do so in the form of guidance. But guidance must conform to the agency’s regulations and congressional statutes. Guidance documents actually have no legal power in and of themselves, but they do play a very important role by offering insight into how the agency interprets its authorities.
Impact of statutory changes
As already noted, when a statute changes, all of the legal authorities below that statute in the hierarchy need to be revised to conform to the statutory change. Obviously the more fundamental and broader the statutory change, the more changes likely need to be made to the regulatory and guidance levels.
Unfortunately, this is not some simple task. It requires judgment to identify erroneous statements and correct them. Typically this isn’t a matter of deleting entire documents, because documents often contain complex interwoven requirements that include some requirements unaffected by the changes above. Instead, updating regulations and guidance documents to properly reflect statutory changes requires careful legal analysis.
The problem: False or misleading FDA regulations and guidance
As I explained above, in connection with our visits to university startups, I reviewed FDA’s website to identify incorrect regulations and guidance. In my review, I focused on those that were outdated following section 3060 of the 21st Century Cures Act, as well as those regulations that are the subject of FDA enforcement discretion regarding software. I found lots of examples, but I thought I would share 10 to illustrate my point.
The following FDA regulations and guidance documents are false or misleading in important ways.
1. Regulation: Sec. 880.6310 Medical device data system
The regulation explains that a medical device data system (MDDS) is a device intended to transfer, store, convert formats or display medical device data, without controlling or altering the functions or parameters of any connected medical devices. An MDDS device may include software or hardware. According to the regulation, FDA regulates such products as class I medical devices.
But that’s not true for two different reasons. First, for software, the 21st Century Cures Act removed such software from FDA oversight. And second, FDA itself has stated that as a matter of enforcement discretion it will not regulate the remaining products which would include hardware or hardware/software combinations. When a website user views the regulation, the user is given no indication of that.
2. Regulation: Sec. 862.2100 Calculator/data processing module for clinical use, also sometimes referred to as Laboratory Information Management Systems
These products include a calculator/data processing module for clinical use that is intended to store, retrieve, and/or process laboratory data. The regulation says that FDA oversees such products as class I medical devices.
But the 21st Century Cures Act has removed such products from FDA oversight.
3. Regulation: Sec. 868.1890 Predictive pulmonary-function value calculator
This category includes a “device used to calculate normal pulmonary-function values based on empirical equations,” and includes such things as a burn calculator. FDA regulates these products in class II, subject to performance standards.
But under the 21st Century Cures Act, if this product is designed to provide the healthcare professional user with the ability to review the underlying information such that the user doesn’t have to rely on the software, the software can fall outside of FDA oversight.
4. Regulation: Sec. 890.5050 Daily activity assist device
This category includes a modified adaptor or utensil that is intended for medical purposes to assist a patient to perform a specific function. That language includes medication reminders, product code NXQ, defined as “a device intended for medical purposes to provide alerts to patients or healthcare providers for pre-determined medication dosing schedules. The device may incorporate wireless communication.” The regulation states that FDA regulates such products as class I medical devices, exempt from some of the general controls.
In the Mobile Medical App guidance, buried in footnote 27, FDA declares that these medication reminders are no longer actively regulated. If someone only read the regulation and the product code, they would think that it’s actively regulated. According to FDA and other writings, that’s true whether or not the software at issue is a mobile medical app.
5. Regulation: Sec. 892.2010 Medical Image Storage Device
A medical image storage device is a device that provides electronic storage and retrieval functions for medical images. Examples include devices employing magnetic and optical discs, magnetic tape, and digital memory. By regulation, FDA regulates these products as class I medical devices
But that regulation is now wrong, under the 21st Century Cures Act. They are not medical devices at all. The regulation needs to be removed.
6. Guidance document: General Wellness: Policy for Low Risk Devices
This guidance document lays out FDA’s view regarding when products used to support general wellness should be excluded from active regulation under a policy of enforcement discretion. It is an elaborate document, with many elements, and addresses what FDA considers to be medical devices that are not high enough risk to merit active regulation.
The 21st Century Cures Act includes a provision that in some ways is much simpler than the guidance, but also declares that wellness related products that meet the new statutory definition are not medical devices at all. The guidance needs to be updated to indicate that at least a portion of the wellness products are not medical devices at all.
FDA published a separate guidance document on December 8, 2017 concerning “Changes to Existing Medical Software Policies Resulting from Section 3060 of the 21st Century Cures Act,” expressing the agency’s general thoughts on the changes that will be necessary. However, FDA has not done anything publicly to amend the General Wellness guidance itself. The General Wellness guidance does include the cover sheet warning described above.
7. Guidance document: Mobile Medical Applications
While this document was published most recently in 2015, it is now outdated in several important respects.
- The guidance sets forth FDA’s 2015 policy on when mobile medical applications qualified as medical devices. But in 2016 the 21st Century Cures Act changed fundamentally the scope of FDA’s oversight of software, and removed from FDA regulation several items that FDA had placed in enforcement discretion in that guidance document.
- The 2015 guidance also discusses the FDA’s 2015 view on when software might constitute an accessory, but that view has now become outdated in light of the 2017 FDA guidance on Medical Device Accessories – Describing Accessories and Classification Pathways.
- Further, the guidance addressed clinical decision support and articulated the agency’s 2015 standard for regulating such software, and that likewise has become outdated under the 21st Century Cures Act.
- And finally, the FDA has also said that it wants to comprehensively revise the Mobile Medical App guidance document because the agency is now actively using the guidance to determine when any software might be regulated, not just mobile medical apps.
8. Guidance document: Off-The-Shelf Software Use in Medical Devices
FDA itself has said that section 3.2.2 of this guidance is out-of-date because it characterizes laboratory information management systems as medical devices, when now, under the 21st Century Cures Act, that is no longer true.
9. Guidance document: Medical Device Data Systems, Medical Image Storage Devices, and Medical Image Communications Devices
Like the MDDS regulation discussed above, this guidance needs to be modified. This guidance document purports to place a wide variety of software used to store, transfer, display and convert medical device data into enforcement discretion. In light of the 21st Century Cures Act, that is no longer accurate. Such software is now not a medical device at all. Hardware is a different story.
10. FDA Report to Congress: 2014 FDASIA Report
You might wonder why I have included a report to Congress here. Unfortunately, FDA chose to put some important exclusions for clinical decision support software that the agency considered to be in enforcement discretion into this congressional report. This probably means that these explanations are not found by many entrepreneurs. But there are also many regulatory affairs experts in industry who have used this report for guidance when trying to discern FDA’s oversight of clinical decision support.
In fact, in the 2017 draft guidance on Clinical and Patient Decision Support Software, FDA seems to reference and preserve these other explanations that are outside of the guidance document. On page 11, FDA states:
"There are many types of software intended to support health care professionals that are not affected by … the 21st Century Cures Act… or this guidance. Some of these, such as software that perform calculations routinely used in clinical practice, are devices for which FDA maintains its existing policy of not intending to enforce compliance with applicable regulatory requirements."
I interpret that as saying that some software is excluded from FDA regulation by statute, but that the agency intends to continue its practice of enforcement discretion for software the agency identifies on its own, not excluded by statute. FDA further adds to the confusion by not collecting all of the information in one place, and making sure that it is consistent with the congressional statute. FDA says that it plans to amend the mobile medical app guidance after finalizing the CDS guidance, whenever that is.
FDA knows about the problem but hasn’t yet fixed It
With regard to the 2016 software amendments found in the 21st Century Cures Act, FDA knows full well it needs to make changes, but is simply not doing it.
I’m about to be fairly critical of FDA, and before I do that, I want to make sure that I am stating this with appropriate balance. I know a lot of people at FDA, and I consider them among the finest people I know. They are smart, hard-working, full of integrity and care deeply about the health of the public. And I also believe they are earnestly looking for ways to increase medical technology innovation, and the agency’s precertification program is one of the most creative and novel ideas I’ve ever heard. But on this issue — the issue of correcting out of date information on the agency’s website — FDA’s performance is not acceptable. And part of what makes this so disturbing is that the agency is fully aware of the problem and that’s not enough for the agency to act.
During an August 1, 2017 discussion of the Digital Health Innovation Action Plan, FDA said that it would withdraw certain regulations and amend others to implement the 21st Century Cures Act in 2017. But then 2017 came and went.
On the slide below, on the right-hand side FDA notes the need to change its regulations in 2017. On the left-hand side, the agency notes its plans with regard to guidance documents. Significantly, the slide does not even mention the need to change the guidance documents I listed above. FDA was only focused on new guidance, not correcting old guidance.
In a May 10, 2018 presentation, through icons, FDA’s slides suggested the agency was on target to make those changes in 2018.
Yet 2018 came and went, and still no updates to the regulations.
With regard to FDA’s guidance documents, the agency never even bothered to express a timetable for updating the old guidance documents, just publishing the new. As already mentioned, FDA has flagged several of the guidance documents that need to change, and identified at a high level the changes that need to be made, but that’s where the effort stalled out.
Merely identifying the documents that need to change means that it is all too easy for entrepreneurs to get ahold of an outdated document and not understand its inaccuracies. While FDA has added a cover sheet with a warning that the guidance is in some unspecified ways out of date, if the entrepreneur isn’t familiar with the statute, it is easy to not understand what’s wrong with the document.
To be fair, in a sense FDA started the process of amending the existing guidance documents, but did so in a strange and frankly improper way. Rather than publish proposed changes to the guidance documents that need to be updated, FDA published one proposed guidance document that announced that the agency would eventually make changes to the existing guidance documents. I gather they did that because somehow it’s cheaper to publish one proposed guidance for comment rather than several, even though the agency will ultimately need to publish revisions to the existing guidance documents.
But in the land of FDA guidance, that was a horrible mistake, because FDA tends to leave draft guidance as draft for endless periods of time. FDA has been known to leave guidance in draft form for more than a decade. In this instance, apparently now we need to wait for FDA to finalize the draft guidance that covers all of the updates needed to FDA’s guidances resulting from the 2016 legislation, and then wait for FDA to actually make the changes to the affected existing guidances. So potentially for years, those out-of-date existing guidances will sit on the FDA’s website — being misread — until the agency gets around to doing something about it.
As already mentioned, there is a second issue, in addition to the need to update regulations and guidance to conform to the new statute. FDA has decided not to enforce certain existing regulations. The agency expresses that decision in the form of a guidance document that declares that the regulation is subject to what the agency calls “enforcement discretion.” But to an entrepreneur who finds only the regulation, there isn’t even a warning that the regulation is not being enforced. The wisdom of FDA’s use of enforcement discretion is something I challenge in a separate blog post.
Why outdated information on FDA’s website is a problem
I suspect most of you don’t need to read this section; it is intuitively obvious why erroneous information on FDA’s website is a problem. But I’m going to address it anyway.
If someone like an entrepreneur, or even an experienced attorney or regulatory consultant, finds those regulations or guidance documents through a Google search or otherwise, they have no reasonable warning that the regulation is incorrect.
Further, with the existing guidance documents, their only clue that something is wrong is a terse warning on a cover sheet that something in the guidance document is not right. It’s up to the reader to then read the statute or find the new guidance document and figure out what’s wrong with the old guidance documents.
I can’t understand how anyone at FDA thinks that’s good government. Instead of directly fixing the half dozen or so outdated existing guidance documents, they left those guidances on the website and instead published a new one that describes the range of problems with those existing documents. To my way of thinking, it is better to revise incorrect laws, than to layer on additional laws to counteract them. FDA should not have come out with a new guidance to explain how to interpret the existing guidances. The agency should’ve simply directly proposed amendments to the outdated regulations and guidances.
The impact on innovation is quite serious. If FDA took the relatively simple step of updating its regulations and guidance, entrepreneurs at startup companies could help themselves by reading the documents directly, rather than hoping that some lawyer is willing to help them pro bono. Incorrect information means that the entrepreneurs may decide not to pursue worthwhile innovations because they erroneously conclude that the law would impose burdensome FDA regulation on the project, or the startups may proceed to implement a quality system and pursue expensive clinical trials specifically designed for FDA clearance, when FDA does not, in fact, regulate the product.
Frankly even if an entrepreneur consults an attorney like me before heading down the wrong path, it’s ridiculous that they should have to pay money just to help them understand that the agency’s website is out-of-date in several fundamental ways. This is why, with a group of friends, I am teaching these university seminars — and publishing this article — in an effort to educate more entrepreneurs.
The root cause of the problem
So (1) if there’s a problem, and (2) if that problem is hurting a lot of people, and (3) if FDA knows about the problem and its negative impact, why isn’t the agency solving it? It’s important in a case like this to dig a little deeper to figure out exactly why this is happening. Surely no one thinks that leaving incorrect documents on the website for several years is the best approach. There must be a reason why the agency is doing this.
For context, it’s important to understand that FDA does not like this particular section of the 21st Century Cures Act. For transparency, I represented the Clinical Decision Support (or CDS) Coalition, a group of companies and other organizations that wanted a clear and rational dividing line between regulated and unregulated CDS. For years we urged FDA to adopt as a dividing line the principle of transparency. As we explained it to FDA, transparency means that if a piece of software is transparent (i.e. not a black box), and more specifically if the healthcare professional user can see the data inputs and understand how the software is calculating its recommendations, the healthcare professional remains firmly in control of the decision-making and we argued the software should not be FDA-regulated.
FDA agreed that transparency reduces risk, but did not agree that it should a dividing line between regulated and unregulated CDS. So off to Congress we went. And Congress, through a bipartisan effort, agreed with us and added section 3060 to the 21st Century Cures Act. But FDA clearly did not like the idea of transparency as a basis for regulation and indeed they resisted the idea that any legislation was necessary for this topic.
Now, three years later, if you ask the agency why they are waiting so long to publish changes to their guidance and regulations, they will likely tell you it’s a question of money and manpower. I’m told that modifying regulations and guidance documents requires going through an extensive process that requires a myriad of signatures within the agency and at OMB. And FDA says we’d rather spend the money on other things.
I’ve got several problems with that.
First, I believe there is money that could be redirected without impairing other programs. It simply is not that expensive to update the regulations and guidance compared to the overall FDA budget.
When an organization the size of FDA says that it doesn’t have the money for something this small, what it really means is that the requested action isn’t a priority for the agency. If the agency wanted to get it done, it would be done. It’s apparently not bothering anyone at FDA that the congressional statute is not being implemented in a timely way.
Second, FDA’s failure to prioritize this need underestimates the negative impact on innovation of having a website that is so misleading to the engineers and clinicians who are trying to start new businesses. As I’ve explained, with some friends I’m going to eight universities to talk to startups about when FDA compliance is required for software that uses artificial intelligence. It’s very sad to me to learn how many people are utterly confused by the information on FDA’s website.
Third, government agencies charged with regulating important areas of commerce and enforcing criminal laws have an obligation to correctly implement and clearly explain the laws they enforce, in a timely way. It’s hard to think of anything more central to the mission of the agency.
This post is dripping with irony when I observe that the FDA has false and misleading information on its website. The words “false and misleading” come right out of the Federal Food, Drug and Cosmetic Act, and establish the standard that companies must meet for information they post on their websites. For the agency to permit its own website to include false and misleading information for years, at the same time bringing enforcement actions against companies they accuse of the same thing, is unacceptable.
Fourth, if the problem is that the guidance development process is too bureaucratic and that’s part of the reason that the cost is high, FDA should fix that. For government to work effectively, agencies must be able to efficiently amend out-of-date laws. FDA staff has been complaining for years that the guidance development process is too bureaucratic, yet no one does anything about it. I’m not sure who FDA is expecting will come in and fix that process for them.
Conclusion
FDA is spending a tremendous amount of time and energy on its proposed precertification program for software, and frankly I’m glad that the agency is interested in improving innovation. But as compared to the time and money that it has taken and will continue to take to implement that program, it would be a very modest step indeed for the agency to simply correct the information on its website.
This is not the first time we have faced the problem of FDA putting inadequate priority on guidance development. Back in the 1990s, FDA preferred not to put guidance in any formal writing, but rather simply announce its interpretations during speeches or in industrywide letters. FDA also preferred not to ask for public comment, and frankly liked the flexibility of the more chaotic system. In 1994, I had to file a citizen's petition asking the agency to adopt what we would later call Good Guidance Practices. It seems the time has come for FDA to take a new look at how it develops and communicates policy in order to make sure that it is giving timely and accurate information to the regulated community. The current system is simply not working well — and would-be innovators are paying the price.
