The Therapeutic Goods Administration (TGA) recently issued a consultation paper outlining proposed regulatory reforms for software which is used as a medical device in its own right. Software of this kind is known as “Software as a Medical Device” or “SaMD”.
What is SaMD?
SaMD operates on a general computing platform (including mobile devices) and is used for a purpose consistent with the definition of a “medical device” in the Therapeutic Goods Act 1989. A SaMD product could be an “app” which is used by a clinician, for example, to analyse medical images and provide information to assist in the diagnosis and/or treatment of a disease. SaMD may be contrasted with software which is embedded in and controls a physical medical device.
Existing regulatory problems to be addressed
The proposed reforms seek to address several regulatory problems in this area.
Classifying SaMD products
Under the currently regulatory framework, medical devices are classified based on the potential for them to cause harm to patients. This assessment is based on the interaction of a physical device with a patient. Medical devices with higher risks are subject to more ongoing regulatory scrutiny. The only existing regulation relating to medical device software concerns software which is associated with physical devices. It provides the following:
If a medical device is driven, or influenced, by an item of software, the software has the same classification as the medical device.
The consultation paper states the problem with this regulation is that it does not capture software which is not associated with a physical device – such as SaMD. In the case of SaMD, there is no interaction between a patient and a physical device – the software is the device.
Under the current regulatory framework, SaMD products can only be classified as Class I. This means supporting evidence for SaMD products is not currently scrutinised by the TGA.
The International Medical Devices Regulators Forum (IMDRF) has published SaMD guidelines which have informed the TGA’s proposed new classification system. Under the proposed system, SaMD products will be classified as Class III (highest risk), Class IIa or Class IIb (lowest risk), based on the application of the following three factors:
- The significance of the information provided by the SaMD in the healthcare decision.
- The context in which the information will be used.
- The state of the healthcare situation or condition.
Under the proposed system, for example, a SaMD product which provides information used to make a direct diagnosis of a disease in a critical situation where the disease is fatal or debilitating in a short timeframe, would be classified as Class III. Whereas if a SaMD product provides information which is used to merely screen a patient to determine the need for further assessment, the product would be classified as Class IIb. Under the new classifications, all SaMD products will require regulatory oversight.
Exemption for imports for personal use
Under an existing regulatory exemption, an individual in Australia may lawfully import a medical device not on the Australian Register of Therapeutic Goods (ARTG) for personal use. If a device is not on the ARTG, there is no local Sponsor for the device and the TGA does not have the same powers to monitor the safety, quality and performance of the device over time, or to enforce product recalls for public health and safety reasons.
Under this regulatory exemption, SaMD products are being freely downloaded by millions of Australians for personal use without regulatory oversight. The consultation paper states this does not reflect the original intention of the exemption.
Under the proposed reforms, the personal use importation exemption will no longer apply to SaMD products. All SaMD products will need to be included on the ARTG and have a local Sponsor (with responsibilities to the TGA in relation to the product). It may be possible for overseas developers to enter into developments with certain App stores (or similar), for example, to potentially satisfy the requirement of having a local Sponsor.
“Essential principles” for SaMD products
The term “essential principles” refers to the regulatory requirements for the assessment of safety and performance of medical devices. Sometimes international standards are used to demonstrate that a medical device complies with the applicable essential principles. The existing regulatory problem in this area is that the “essential principles” do not refer to software. This means it may be unclear to SaMD developers what the applicable requirements are under Australian law.
The TGA proposes to add further details to the essential principles reflecting good software development and security, including requiring the features, capabilities and risks of the relevant computing platform to be taken into account during design and to require developers to adopt best practice cyber security principles.