Digital health: software as a medical device

Regulating software as a medical device

With huge technological advances being made in the delivery of health products and services, it is crucial to keep an eye on any regulatory movement. This is particularly important in the case of software, which is both incorporated into medical devices and may in and of itself hold the status of medical device.

The Therapeutic Goods Administration (TGA) has recently published guidance on the regulation of software as a medical device (SaMD) in Australia.

The regulation of SaMD products in Australia is based on risk. The level of oversight by the TGA varies according to the risk the TGA assesses a product poses to patients and healthcare professionals.

Recently, concerns have been raised that many SaMD products have been classified as low risk, even though their potential risk for patients and healthcare professionals may be higher. To address this issue, the TGA will soon be consulting on changes to the Therapeutic Goods Regulations.

The TGA is also currently reviewing the regulatory framework for SaMD in Australia. The purpose of the review is to ensure the framework meets international standards, and extends beyond health risks to patients and healthcare professionals to address potential harms to the wider public.

In particular, the TGA is seeking to ensure the regulatory framework is harmonious with technical documents published by the International Medical Device Regulators Forum (of which the TGA is a founding member).

(As an aside – the TGA is also seeking comments from interested parties on draft regulatory guidance and information materials concerning medical device cyber security. Responses are required by close of business on 14 February 2019.)

When is software a medical device?

The Therapeutic Goods Act 1989 (Cth) (the Act) defines a medical device quite broadly as: “any instrument, apparatus, appliance material or other article (whether used alone or in combination, and including the software necessary for its proper application)” that provides assistance for, and is designed for use by, humans for a number of purposes such as the diagnosis, prevention or treatment of a disease, injury or disability or for conception control (section 41BD).

According to the TGA, examples of software that satisfy this definition include smart phone apps that calculate insulin doses based on a person’s blood glucose levels ,and software that uses information about a patient to make a diagnosis.

On the other hand, while SaMD products may be used with (or in) computers, mobile phones or tablets, these devices are not considered medical devices in their own right.

The TGA has clarified that mobile apps and software that simply provide information, or are tools to implement and manage a healthy lifestyle, will not be regulated under the Act. It can, however, be a fine line.

Combination of software, accessories and computing platforms

Applications that require the use of physical accessories (ie sensors that plug into the platform, speakers or a camera) that are connected to, or embedded in, the platform will be considered a medical device. The TGA gives the example of a glucose meter that plugs into a smart phone to display and store results. Together, the meter, smartphone and app form a medical device where the app is regulated as part of the glucose meter device.

Software that is an integral part of the device

Medical device software that is an integral part of a physical device is considered to be part of that medical device and is not regulated separately.

Applications that control a medical device

Applications that have the ability to control or adjust a medical device through Bluetooth or WiFi are considered to be SaMD products, and are regulated at the same risk classification level as the medical device they control.

What does this mean in practice?

SaMD products must be included on the Australian Register of Therapeutic Goods (ARTG) before they are supplied in Australia. Unless they are classified as Class 1 (the lowest risk classification), manufacturers of SaMD products must obtain Conformity Assessment certification in order to be registered on the ARTG.

However, all medical devices – regardless of classification – must meet the Essential Principles for safety and performance. These principles, among other things, prescribe the suitability of the device for its intended purpose, the assurance of long-term safety in the design and production of the device as well as various principles in respect of materials used in, and construction of, the device.

The lesson for developers (and others)

Designers, developers and manufacturers of SaMD products need to be alert to the possibility that their products may be classified and regulated as SaMD.

They should also familiarise themselves with their registration, certification and compliance obligations in that event, and ensure that these are met.