The Food and Drug Administration (FDA) issued two guidance documents last week clarifying its approach to certain health-related software in response to the addition of Section 520(o) to the Food, Drug and Cosmetic Act, which excludes certain software functionalities from the definition of a device, by the 21st Century Cures Act (Section 3060).

The draft guidance Clinical and Patient Decision Support Software defines, distinguishes and provides examples of those clinical decision support software (CDS) that are not medical devices as a result of the exclusion in Section 520(o)(1)(E), those CDS that FDA will continue to regulate as medical devices, and those software devices that are not CDS and will be subject to FDA oversight. Additionally, though not addressed in the Cures Act, the guidance defines and describes Patient Decision Support Software, for which FDA will exercise enforcement discretion.

In keeping with the Cures Act, the guidance provides that any software that acquires, processes or analyzes a medical image, a signal from an in vitro diagnostic device, or a pattern or signal from a signal acquisition system and is intended to provide diagnostic, prognostic and predictive functionalities is not CDS and will continue to be a regulated medical device. As a consequence, in vitro diagnostic tests and software that measure and assess physiological data, use complicated or non-public algorithms to analyze and interpret or generate new data and medical imaging will be regulated as devices.

In contrast, software that analyzes, displays or prints information about specific patients (e.g., allergies, symptoms, treatments, test results) or medical information (e.g., clinical practice guidelines, product labeling agency recommendations) intended to support a medical professional’s diagnosis, prevention or treatment decision and that allows independent review of the basis for the recommendation, so that the software is not intended to replace the medical professional’s decision, are not medical devices. If independent review of the recommendation is not available (e.g., due to non-public information or expertise not available to the intended user), such that the manufacturer intends the health care professional to primarily rely upon the device's recommendation, then the software is regulated CDS. In order for CDS to be considered not a device, the software must clearly explain its intended use, the intended user (i.e., type of professional), the inputs upon which the recommendation is based (e.g., age, gender) and the rationale behind the recommendation. In other words, "allowing independent review" means that average medical professionals for whom the device is intended could otherwise come to the conclusion on their own using common tools of the profession, such as practice guidelines or generally accepted clinical practice, that are identified and easily accessible. The guidance provides several instructive examples of software devices that will continue to be the focus of FDA oversight (both CDS and non-CDS) and those that are not medical devices.

FDA also took this opportunity to define its position on Patient Decision Support Software (PDS), for which it will exercise enforcement discretion, though PDS is not excluded from the definition of device by the Cures Act. The definition of PDS generally parallels that of CDS that is not a medical device, and is meant to capture those low risk devices that support decisions of non-professionals while permitting them to independently evaluate the sources underlying the recommendations. Such sources must be identified, easily understandable and publicly available to the intended user, in this case, the patient (for example, software that recommends an appropriate cold medicine based on a patient’s symptoms).

The draft guidance Changes to Existing Medical Software Policies Resulting from Section 3060 of the 21st Century Cures Act details how previously published FDA guidances relating to medical software will be revised to address the remaining Section 520(o) exclusions from the definition of device. Examples contained in Off-The-Shelf Software Use in Medical Devices, General Wellness: Policy for Low Risk Devices, Medical Mobile Applications and Medical Device Data Systems, Medical Image Storage Devices, and Medical Image Communications Devices will be re-categorized, revised or newly created to align with Cures Act and clarify FDA's enforcement position. In addition, the guidance Submission of Premarket Notifications for Medical Image Management Devices Changes is withdrawn as some of the software functions described therein no longer meet the definition of a medical device.

Interestingly, FDA did not just acquiesce in the Congressional mandate to not treat certain software functionalities as medical devices, but instead took the opportunity in both guidances to add even more low risk software functionalities to devices for which FDA will exercise enforcement discretion. This position aligns with FDA's overall willingness to take a more risk-based approach to devices in general and to digital health in particular. The changes reflected in the guidances may come as a relief for some software developers that have been attempting to determine whether their telehealth-type or other low risk digital health software will be subject to FDA oversight. Companies in the development or pre-submission stage should carefully examine the examples in the guidance to re-evaluate the regulatory pathway needed for their software functionalities.