Does the App Present a Risk to Patients if it Does Not Function as Intended?

On July 19, 2011, the U.S. Food and Drug Administration (FDA or the Agency) released a “Draft Guidance for Industry and Food and Drug Administration Staff” on “Mobile Medical Applications.” The draft announces FDA’s intention to regulate mobile applications (apps) that “either have traditionally been considered medical devices or affect the performance or functionality of a currently regulated medical device.” According to Jeffrey Shuren, MD, director of FDA’s Center for Devices and Radiological Health (CDRH), “[FDA’s] draft approach calls for oversight of only those mobile medical apps that present the greatest risk to patients when they don’t work as intended.”1 Although FDA acknowledged that this proposed approach “does not cover the majority of medical apps,”2 its scope is broad. Public comments on the draft Guidance may be submitted online or in writing through October 19, 2011.3

I. The Scope of the Draft Guidance

The draft Guidance defines three key terms:

  • “Mobile platforms” are “commercial off-the-shelf (COTS) computing platforms, with or without wireless connectivity, that are handheld in nature.” Examples include smartphones, tablet computers, and personal digital assistants (PDAs).
  • A “mobile application” or “mobile app” is a “software application that can be executed (run) on a mobile platform, or a web-based software application that is tailored to a mobile platform but is executed on a server.”
  • A “mobile medical application” or “mobile medical app” meets the definition of a device under section 201(h) of the Federal Food, Drug, and Cosmetic Act (FD&C Act),4 and either (a) “is used as an accessory to a regulated medical device”; or (b) “transforms a mobile platform into a regulated medical device.” Mobile medical applications are a subset of mobile applications.

A. Mobile Medical Apps

FDA currently intends to regulate mobile medical applications. FDA will determine whether a product is a mobile medical app based on its intended use.

The draft Guidance identifies uses/functions of both categories of mobile medical apps and provides examples of them:

  • Mobile apps that act as accessories to regulated medical devices:
    • Mobile apps that control the intended use, function, modes, or energy source of the connected medical device will be considered mobile medical apps. Examples include apps that provide the remote display of data from bedside monitors, the display of medical images from a Picture Archiving and Communications System (PACS), or transmit control signals to insulin pumps from a mobile platform.
    • Mobile apps that create alarms, recommendations, or new data by analyzing or interpreting medical device data will also be considered mobile medical apps.5 Examples include software that analyzes blood glucose readings to help manage diabetes and apps that activate an alarm based on changes in recorded arterial oxygen saturation levels and pulse rate.
  • Mobile apps that transform a mobile platform into a medical device:
    • Mobile apps can transform mobile platforms into medical devices by using attachments, display screens, or sensors. Examples include mobile apps that attach a blood glucose strip reader to a mobile platform to function as a glucose meter or use a built-in meter on a mobile platform to collect motion information on sleep apnea.
    • Mobile apps that allow the user to input patient-specific information can also transform a mobile platform into a medical device by using formulas or processing algorithms to generate a patient-specific result, diagnosis, or treatment recommendation that is targeted at either healthcare providers, consumers, or both. Examples include mobile apps that collect patient-specific responses to a questionnaire and compute a prognosis for a particular disease or condition, or calculate dosages for a specific medication or treatment.

Appendix A of the draft Guidance provides additional examples of mobile medical apps.

B. Products Excluded from Mobile Medical App Regulation

In the Guidance document, FDA identifies the following categories of mobile apps that it does not consider to be mobile medical apps:

  • Electronic textbooks or references. FDA excludes “[m]obile apps that are electronic ‘copies’ of medical textbooks, references, or teaching aids, or are solely used to provide clinicians with training . . . .” These apps do not contain patient-specific information, but could provide examples of a specific medical specialty or condition.
  • General health and wellness mobile apps. FDA also excludes “[m]obile apps that are solely used to log, record, track, evaluate, or make decisions or suggestions related to developing or maintaining general health and wellness” and that are not intended for curing, treating, diagnosing, or mitigating a specific disease, disorder, patient state, or “any specific, identifiable condition.” Examples include diet logs, dietary suggestions based on a calorie counter, exercise suggestions, and appointment reminders.
  • Office administration mobile apps. FDA excludes “[m]obile apps that only automate general office operations, [such as] billing, inventory, appointments, or insurance transactions.” Examples include apps that replace paper-based entry of patient histories and apps that determine insurance billing codes.
  • Generic aids. FDA further excludes “[m]obile apps that are generic aids that assist users but are not commercially marketed for” a medical use. Examples include a general magnifying glass app or a note-taking app.
  • Electronic or personal health records. Finally, FDA excludes from the definition of mobile medical apps any mobile apps that function only as electronic health records or personal health records.

FDA notes that the majority of these mobile apps automate common medical knowledge or allow individuals to selfmanage their disease or condition.6 FDA does not regulate these types of mobile apps. However, the Agency plans to monitor them to determine whether additional actions are necessary to protect the public health.

C. Regulated Entities

FDA states in the draft Guidance that mobile medical app manufacturers are responsible for their mobile medical apps’ compliance with FDA regulations. A “mobile medical app manufacturer” is “any person or entity that manufactures mobile medical apps in accordance with 21 C.F.R. Parts 803, 806, and 807.” This definition includes any person or entity that “initiates specifications, designs, labels, or creates, a software system or application in whole or from multiple software components.” FDA considers the following to be examples of mobile medical device manufacturing activities:

  • Creating, designing, labeling, remanufacturing, or modifying software systems, including off-the-shelf software, from multiple components to perform as a mobile medical app.
  • Providing mobile medical app functionality through a web service for use on a mobile platform.
  • Initiating specifications for mobile medical apps that are developed or manufactured by third parties, e.g., contract manufacturers, for commercial distribution.
  • Creating a mobile medical app for use on a mobile platform, or creating a mobile app to be supported by hardware attachments to a mobile platform that has a device intended use.

An individual or entity performing any of these functions is a mobile app manufacturer subject to FDA device regulatory requirements. On the other hand, FDA excludes from the definition of mobile medical app manufacturers “entities that exclusively distribute mobile medical apps, without engaging in manufacturing functions,” e.g., Android Market, iTunes Store, and BlackBerry App World.

FDA also excludes “mobile platform manufacturers,” e.g., smartphone manufacturers, that “solely distribute[] or market[ their] platform[s] with no device intended use.” Mobile platform manufacturers are considered “component manufacturers” (21 C.F.R. 820.3(c)) and are exempt from quality systems, registration, and listing requirements. Therefore, if an entity manufactures a smartphone which is able to run other entities’ mobile medical apps, but does not market the phone for medical use, the phone manufacturer is not a mobile medical app manufacturer.

II. Regulatory Approach

For mobile medical apps that are subject to FDA regulation, manufacturers should satisfy the criteria associated with the applicable device classification. If the mobile medical app, on its own, falls under a device classification, then the manufacturer is subject to those classification requirements. Accessories to medical devices generally have the same regulatory classification and are subject to the same requirements as their parent devices. However, FDA acknowledges that “this approach may not be well-suited for mobile medical apps that serve as an accessory to another medical device because of the wide variety of functions mobile medical apps can potentially perform.” Thus, the Agency is seeking comment on how it should regulate mobile medical apps that are accessories so that the apps’ “safety and effectiveness can be reasonably assured.” FDA states that mobile medical apps that add medical device functions to mobile platforms are subject to the classification requirements applicable to the added medical device functions.

FDA notes that some mobile medical apps meet the definition of a Medical Device Data System (MDDS).7 MDDSs are computer- or software-based devices that passively and electronically transfer, store, display or convert medical device data; these devices do not generate or analyze data. Mobile medical apps that meet the definition of MDDS would be regulated as MDDSs, i.e., they would be Class I devices that are exempt from 510(k) requirements.

FDA indicates that mobile medical app manufacturers are subject to the same regulatory requirements as other medical device manufactures. Applicable requirements include: device establishment registration and listing; investigational device exemptions (IDEs); labeling; premarket clearance or approval; Quality Systems Regulation (QSR), unless the device is 510(k) exempt; adverse event reporting; and corrections and removals. FDA expects distributors of mobile medical apps to cooperate with manufacturers in conducting corrections and removals.

FDA recommends that manufacturers of all mobile apps that may meet the definition of a device comply with the Quality Systems Regulation (21 C.F.R. Part 820) regarding design and development, even if the mobile app is not a mobile medical app. FDA points out that the majority of software-related device failures are due to design errors, e.g., failure to validate software prior to routine maintenance.

The draft Guidance does not address several related issues, such as wireless safety, classification and submission requirements for clinical decision support software, or the application of quality systems to software. FDA intends to address these issues in separate guidance documents.