Examples of Presently Regulated CDS
As we mentioned, FDA currently regulates a number of CDS products. Here are a few examples:
- Accessory software: Any software marketed to complement the functionality of a medical device, for example taking blood glucose data and trending it.
- Calculators: FDA has already identified numerous calculators that it considers to fall within CDS including calculators for BMI, radiation dose, and medication. This means a website that simply calculates a patient's BMI might be subject to FDA's quality systems regulations.
- Medication Reminders: Software that reminds patients of what type of medication to take and when may be currently regulated.
- Advanced Analytics: FDA regulates websites or computer programs that perform advanced analytics on medical device data, such as medical images or electrophysiological signals. For example, a website that performs immunohistochemical image analysis for diagnostic or therapeutic purposes may be regulated.
- Data Transmitters: These software devices transmit or receive all sorts of medical data, including laboratory information, medical images, and other medical device data.
- Storage Devices:An example of a regulated storage device would a database that is used to archive medical device data, such as heart rate and blood pressure measurements obtained from a Holter monitor. As noted above, storage of general health information in an electronic health record seems to fall outside of the FDA's scope-at least for now.
- Data converters: FDA regulates software that converts medical data, even if the conversion process is well-known. So, for example, software that converts medical data archived in a regulated storage device into XML or PDF might be regulated. Likewise, software that takes high-fidelity medical images and compresses them for mobile viewing may be regulated.
- Display devices: FDA regulates products that display medical data. In some sense this might be considered data conversion or analytics, but unlike advanced analytical programs or high-tech converters, the agency regulates display devices that are not that advanced-simply graphing trends of medical data is a regulated function.
For each of these, the degree of FDA oversight depends on the relevant risk factors described above.
Present FDA proposal
FDA will publish its proposed guidance on CDS next year, potentially in the spring. In the September 2011 hearing, FDA gave its clearest explanation to date regarding what it expects to include in the CDS category. The agency identified three factors as helping to define CDS:
- Information, entered into the database either manually or automatically, gathered from any source, including:
- Data from a medical device
- Environmental data (e.g., pollen count, temperature, etc.)
- Demographic data (e.g., age, sex, socio-economic status, etc.)
- Converted by any means including:
- Algorithms (fixed or iterative)
- Database look-ups or comparisons
- Rules or associations
- That produces actionable information, presumably intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease.
Wow, that's not a very limited definition. We believe that the word "actionable" in the third part primarily is intended to mean that the information is patient-specific, allowing it to be acted on. The definition is also different in a number of important ways from the historical approach, and we identify those differences in the final section on the open issues to be resolved.
We believe FDA plans to take a risk-based approach, stratifying the different functions and types of CDS by risk. We predict their approach will look something like this:
In this diagram, the high-risk stuff that FDA chooses to regulate is all in red, while the really benign stuff FDA decides to leave alone is in green. The orangish yellow area is no man's land, where FDA will choose to leave it in limbo while the agency evaluates future data to decide whether or not to regulate that territory.
You also will note that within the red territory, under its statute FDA will stratify the software into three categories based on risk. The lowest risk category, which in device law is referred to as Class I, does not require FDA clearance or approval, but rather must be developed under an FDA-specified quality system. The highest level, Class III, is reserved for those medical devices that carry with them the greatest risk, like pacemakers. They require premarket approval. Class II, in the middle, requires a lesser clearance from FDA, referred to as premarket notification or 510(k) (named after the statutory section that creates that path to market).