About the Author: Bradley Merrill Thompson is a member of the firm at Epstein Becker & Green, P.C. There, he counsels medical device, drug, and combination product companies on a wide range of FDA regulatory, reimbursement, and clinical trial issues. The opinions in this piece are Thompson's and don't necessarily reflect the opinions of MobiHealthNews or HIMSS.
FDA’s concept of a precertification program for software has certainly caught the attention of senior management at many companies. I’m hearing stories of unbridled enthusiasm for the idea. I describe it as a “concept” because, of course, it hasn’t been created yet. A year and a half after floating the idea and more than a year since the formal, public drafting process began, FDA has only circulated very high level concept papers.
As companies wait for more details, for several reasons they need to be just a little bit cynical about what they’re hearing, and become more active in trying to shape what the program ultimately turns out to be in some very key dimensions that could make or break the program.
Reasons to be cynical
I try hard not to let my old age make me too cynical. But some skepticism is healthy. To understand why I am skeptical here, I would encourage you to search the Twittersphere, LinkedIn posts, and summaries of speeches reported in the trade press to see what FDA is publicly saying about the program. If you’ve been around FDA for a while, you will be amazed. In the more than 30 years I’ve been practicing medical device law, I have never seen anything like this. The agency is on a full throttle sales mission from the Commissioner on down trying to convince the entire world that this precertification program is the best thing since sliced bread.
Ask yourselves, why? Why would FDA be engaged in such a concerted and resource-intensive push that is more akin to launching a new line of tennis shoes than it is traditional policymaking? Do you really think it’s because FDA wants to make business more profitable for medical device companies? If you do, I have a bridge in London I’d like to sell you. No, FDA stands to gain a lot from the precertification program, and you need to understand what they get in order to assess whether it’s a good deal for industry.
Beyond just the extraordinary promotion by FDA, industry also needs to understand that there is a method to the agency’s sales process. Any salesman will recognize it. I was reminded of it in May when I was negotiating the purchase of a rug in Egypt. The salesman wanted to talk with my wife and me about all the different rugs they had, and work with us to narrow it down as to whether the rug was to be wool or silk, large or small, the type of pattern and so forth. When I repeatedly asked during that process about the price of the various options, he repeatedly deferred me, saying that he would have to talk to his manager and that we would surely work that out at the end.
When selling, you never lead with the price. First you get your customer to fall in love with the product, and then you present the price. Industry has not yet heard the price of the precertification program.
Selling points
So FDA started the development of its precertification program with the selling points, and has everyone in industry excited primarily about three potential benefits:
- FDA has said that it will review fewer initial launches of new software products. Exactly which ones will be reviewed and which ones will not has not been shared with the public. But they’ve told us it will be great and we will love it.
- FDA has said that for the products they will review, the review will cover fewer topics. They haven’t said how many fewer, or how much quicker the review will be, but they have told us it will be great and we will love it.
- FDA has said that they will review fewer changes to marketed software medical devices. They haven’t said which changes they will review and which ones they won’t, but they have told us it will be great and we will love it.
Pretty exciting stuff, in theory. Well over a year into the drafting process, we just don’t know what FDA will do or how much better it will be.
The price
This is an incredibly complex program FDA is proposing, and while certainly the devil will be in the details, I want to speak it a little bit higher level. In broad terms, the price industry must pay can already be found in two features of the program.
1. The excellence appraisal. If you’ve read anything about the program, you know that the key feature of the program is to shift FDA review from focusing exclusively on the product, to focusing primarily on the company and less on the product. The argument is that if FDA can trust that the company will reliably produce safe and effective software medical devices, the agency does not need to focus as much on the product itself. Makes sense. But here’s the kicker. As they operate today, the vast majority of existing medical device companies would not qualify to participate in the program.
At a recent meeting with FDA on the program, I asked a rather direct question. I’m not going to use the name of the FDA fellow, because I was asking for a candid personal assessment. So this is not in any way an official FDA position. But understand this is a guy who would know very well the answer to this question.
Here’s how I framed my question: "Use as your reference point all of the companies that have received 510(k) clearance or PMA approval for a medical device presently. In other words, I’m talking about the existing medical device companies that make class II or class III medical devices. What percentage of those companies do you think would qualify under the agency’s new standard for having a Culture of Quality and Organizational Excellence? Of course I’m asking for estimation, and I’m not focused on specific percentages, but is it only the very elite – say roughly the top 10 percent – or is it meant to be everyone above average – meaning in the top 50 percent – or is it supposed to simply exclude the really clumsy – meaning the top 90 percent?"
After much back and forth where he was uncomfortable with the question, I got a direct reply: as of right now it would only be very few. But he quickly added, which is fair, that anyone can aspire to be in that category and can improve their organization in order to qualify. But the goal of this program is frankly to encourage medical device software industry to substantially improve their Culture of Quality and Organizational Excellence.
I think we need to understand that fundamental premise: this standard is meant to be aspirational. So through the adoption of this program FDA hopes to raise the Culture of Quality and Organizational Excellence at medical device software companies. That’s part of what FDA gets out of this, and companies need to understand that the vast majority of companies are not where FDA wants them to be.
Frankly I’m not too troubled by this, because companies can assess whether they could achieve the required standard once the specific standard becomes clearer. This is just a question of a willingness to invest. By far the more concerning price is the price to be paid once the software product is on the market through the precertification program.
2. Postmarket decision-making. This is the one that scares the bejeebers out of me.
From my own experience I know that while everyone wants FDA to clear their products as quickly as possible, by far the bigger issues with FDA have been around whether a product needs to be recalled or a notification sent to customers. Recall decisions are in many ways just as subjective, if not more subjective, than approval decisions. Companies and FDA are often on a different page, and the consequences can be life or death for a company. Recalls are not just expensive to execute, but they can completely destroy a brand. So while you have to get on the market, you also need to stay on the market to have a successful company. The latter, in my opinion, is often a bigger financial issue.
Understanding how a product is performing in the marketplace clinically is something that typically requires some context. Companies that live and breathe with their customers and who study every aspect of their product have a much better understanding of that context than either FDA or, for that matter, individual customers. The problem is, when data are shared without that context, FDA and customers may react in an emotional way.
So here are the challenges with the precertification program with regard to postmarket decision-making that could easily make this entire program a bad deal for industry.
A. Collecting and sharing real-world data with FDA. The agency will use this data in evaluating whether the company is properly managing the product during the postmarket phase, including recalls and other corrective actions.
Right now recalls are at least in theory voluntary. If FDA wants to force a recall, it needs to go through a somewhat elaborate process and frankly the agency rarely does that. To be sure, FDA can lean on a company and threaten adverse publicity.
But while it is already quite difficult to resist, the precert program would make it much more so. The current concept is for the program to give FDA the authority to not just informally lean on a company, but to tell the company that FDA will remove the company from the precert program if they do not comply with the agency’s directive.
Indeed, it may be worse than that. If a company doesn’t conduct a recall or other corrective action on its own without being told by the FDA to do so, if the FDA ultimately later concludes that the company should have taken action, the agency can remove the company from the precert program. It’s also possible that by the company voluntarily entering the precert program, they are legally agreeing to do whatever FDA says.
FDA acknowledges that it is looking for better leverage to tell companies what to do in the marketing of their products, and this is the tool the agency has identified. Given the costs and market implications, this is what scares me most. But it doesn’t stop there.
B. Sharing data with the public. While FDA hasn’t decided exactly what it wants to do here, a major premise of the precert program is transparency to the public to gain public confidence. This means requiring companies to share a much higher level of information about their marketed products with the public. This will be done on the agency’s terms, not the company’s. More precisely, it will be done according to the law which includes the Freedom of Information Act. Industry needs to understand that once a document is in FDA’s possession, the agency literally cannot refuse to share that information publicly unless the information falls within an exemption such as constituting confidential commercial information or trade secrets. It’s unclear how those exemptions would apply to data in these instances.
The information presumably includes clinical performance data regarding the device, but also could include a variety of other information on, for example, product usage patterns, utilization of tech support, frequency of bugs reported and fixed, and even information that was part of the original excellence appraisal regarding the company, including KPIs that relate to the company’s “culture of proactivity.” And it is far from clear how the public would get appropriate context regarding the information that is shared. This is potentially just as bad as having FDA manage the company’s postmarket decision-making.
Other costs yet to be identified
While in my opinion those are the big ones, there are a variety of additional costs that industry should consider once they are known – and frankly try to influence in the meantime. They include:
1. What is the scope of software FDA plans to regulate? In recent conversations with FDA, the agency has indicated that because the precertification program is so darn good, the agency will no longer need to exempt any further categories of low risk software from FDA regulation. I honestly don’t understand that, because it was my sense that class I products would not be in the precert program. Why would they be, if premarket clearance is not required for class I products, what’s the benefit for those products of participating? The statute provides a process where the agency can conclude that software is of such low risk, it can be exempted from medical device requirements.
For the last seven years, FDA has been saying that it would deregulate low risk clinical decision support software. But when the time came to announce the agency’s specific plans last December in a new guidance on CDS, the agency changed its mind and only implemented the transparency provisions of the 21st Century Cures Act. That is a direct reversal from what the agency committed to doing after the 2012 FDASIA legislation. FDA had issued a report in 2012 under FDASIA saying that it would deregulate low risk CDS. FDA’s stated reason for the recent reversal: the precert program is going to be so darn good we don’t need to exempt low risk products from FDA regulation. To be clear, FDA is not saying that it will rescind prior declarations of enforcement discretion. Instead FDA seems to be saying that they will not expand the exemptions as they previously had promised Congress.
2. How will this program impact FDA’s ability to inspect medical device establishments? The precertification program involves a much broader set of issues than are covered in part 820 quality system requirements. FDA is a regulatory agency, and it must be able to validate the company’s compliance with any regulatory program. So given that the focus of the excellence appraisal is much broader and covers a range of issues such as the proactivity culture at the company among employees (whatever that is), FDA inspections will have to be much broader than they have been. Presently the agency is limited by section 704 of the Federal Food, Drug and Cosmetic Act to only those records that are necessary to validate compliance with FDA requirements such as the quality system. What does FDA have in mind for future inspections?
3. What will be the continuing obligations of the company to comply with the part 820 quality system requirements, adverse event reporting, recalls and corrective action reporting and other regulatory requirements beyond just the premarket review requirements? Presumably all of those obligations will remain, but FDA has not said.
4. How will the precertification program administration, and in particular the excellence appraisals, be staffed? Not only is there a staffing shortage at FDA, but these issues are not the traditional fodder of engineers and scientists. These are issues that traditionally someone with a business background would evaluate. They address organizational management best practices. FDA has indicated that it would likely use third parties to conduct the excellence appraisals. But we need to know more about that. FDA says that one of the motivations for pursuing the precertification program is preparing for the ever increasing volume of software needing to be reviewed. FDA seems to think that the precertification program will ultimately be less labor-intensive than the current system. That may be true ultimately, but it also involves a shift in the skills required.
5. Which raises the question of user fees. The excellence appraisals will be labor-intensive for FDA. How much is this going to cost?
FDA, in full sales mode, is telling us that we should trust the agency that the greater speed and efficiency of the streamlined review process will more than make up for any burden from collecting postmarket real world data and always doing what the agency says in terms of corrective action. But honestly I don’t think the agency understands just how dangerous the agency’s proposed approach to postmarket regulatory controls will be. The agency believes it is always right and reasonable in what it asks companies to do in the way of recalls and other postmarket corrective actions. They don’t understand just how vehemently people in industry disagree with many of those judgments.
Path forward
Many folks are interested in timing, and FDA says that it plans to have version 1.0 done by the end of this calendar year, and then to spend 2019 testing the new system with the nine pilot program participants to see how well it works. So companies have this fall to offer perspectives on the design of the program, and the sooner the better. It becomes much more difficult to have your ideas considered after an initial draft is created.
But more fundamentally, I’d like to suggest that there is a significant question regarding the implementation of this program that FDA is treating lightly. And that is the process of determining exactly what legal authority is required for this program. FDA keeps deferring that topic – much like a rug salesman defers the issue of price – until the program is fully developed. But quite honestly, given what FDA has already said publicly about the high-level contours of the program, it is clear that the program will require at least a new regulation promulgated by the agency and more likely a new statute enacted by Congress.
The Clinical Decision Support Coalition – which I represent – did a legal analysis that the coalition submitted to FDA. But for these purposes, I’d like to explain intuitively why a statute is likely going to be necessary. FDA’s main defense as to why a statutory change may not be necessary is the argument that participation in this program will be voluntary. Consider these two scenarios:
- You represent a patient group. Your group is concerned that this new program will allow medical devices onto the market that are not appropriately safe and effective as required by the existing statute. If FDA says, “Don’t worry, companies will only participate on a voluntary basis,” does that reassure you? Does that make the program legal under the statute? The statute prescribes the 510(k) process, the de novo process, the PMA process, and the classification process all in considerable detail. Does the voluntary nature of the program make the new precertification process somehow compliant with those specific statutorily-prescribed requirements?
- Let’s say that you work for a company that has been denied access into the precertification program because your company does not meet the requirements – in FDA’s view – for the excellence appraisal. But let’s say that one or two of your direct competitors do make it into the program. Let’s say that the program is successful in greatly expediting the pathway to market. Your competitor starts kicking your butt in the marketplace. They come out with two or three new innovative products in the time it takes you to get one through the traditional 510(k) process for one iteration. You raise a legal concern to FDA about why you were excluded, but FDA says, “Don’t worry, your competitor is only participating in the program on a voluntary basis.” Are you satisfied? Do you think they’ve complied with the statute?
I’m not suggesting that a statutory change will be necessary just because I’m an old fuddy-duddy lawyer. In addition to following the law, I think it’s actually a good thing, because I think companies need to know what their rights are in such an important new program. Properly understood, this program is not simply voluntary, but it is a fundamental amendment to the FDA’s process for classifying medical devices and market access. It creates a new pathway to market when Congress has already specifically identified all of the legal pathways to market. And companies that don’t use the new process are going to be penalized in the marketplace.
A statutory amendment would represent a chance for all stakeholders including industry to get some clarity and precision from FDA in terms of how the program works, what the advantages and disadvantages will be, and what their legal rights will be. I know FDA will say that it prefers flexibility, and it wants to learn over time. There is validity to that position. Certainly the statute will have to be carefully crafted to preserve appropriate flexibility. But there are also lines that FDA should commit to observing. This is a criminal statute. It also is a statute that defines how competitors can compete in the medical device space while protecting the public health.
We need to be governed by laws, and not just people. That’s true both because power can be abused and also the people who govern us change over time.
