FDA last week finalized a three-year-old proposal to down-classify Medical Device Data Systems to class I, or low-risk, medical devices exempt from pre-market review.

The Feb. 14 rulemaking means that companies making the systems will need to comply only with FDA registration, listing, adverse-event reporting and manufacturing quality requirements; they will not need to obtain clearance from FDA before placing a product on the market.

The MDDS category includes software systems that passively store data collected from medical devices. Examples include devices that collect and store data from a glucose meter for future use or that transfer lab results for display at a nursing station, FDA said in a Feb. 14 press release.

"This is the outer edges of FDA-regulated territory, and there will be some who think they shouldn't be in it" – attorney Brad Thompson

A data system falls within the MDDS category if it is intended for the transfer, storage, electronic conversion (in accordance with a preset specification) or electronic display of medical device data without controlling or altering the functions or parameters of any connected devices, according to FDA.

The data systems were previously in the class III, high-risk category, by default, because products like these did not exist prior to 1976, when the device amendments to the Food, Drug and Cosmetic Act were enacted.

In reality, the rulemaking does not constitute a big change from current practice. For years, FDA has recognized that rigorous safety and effectiveness reviews are not needed for MDDS devices and has chosen not to enforce pre-market approval requirements for the products.

And while FDA has not enforced registration, listing and manufacturing quality system requirements, either, it does not see the final rule as imposing a large burden.

"The agency believes all or nearly all firms in this industry have in place good business practices, including quality systems," FDA writes in the final rule.

FDA's annual device registration and listing fee is currently $2,179, rising to $2,364 in FY 2012. And for those companies that do not already have a quality system, FDA estimates the cost of establishing one at less than $20,000, plus around $143,000 per year for a full-time employee to manage the system.

Industry Reaction: Mix Of Relief, Dismay

FDA's down-classification decision is a relief to the medical device industry, which would have faced more burdensome requirements had the agency made MDDS subject to pre-market review.

Nevertheless, the rule may sting a bit for some entities not accustomed to being regulated by FDA – for example, information technology companies that design, install or market the systems.

"How you view it depends on where you sit," said Bradley Merrill Thompson, an attorney with the law firm Epstein Becker Green in Washington, D.C.

Broad-based software developers may feel the ruling is "written in somewhat sweeping terms and brings within the realm of FDA-regulated products a number of software systems that before now they were at least hoping weren't regulated by FDA," Thompson said.

"This is kind of the outer edges of FDA-regulated territory, and I'm sure there will be some who think they shouldn't be in it," he added.

Some Hospitals Seen As Device Manufacturers

Although the final rule holds to the overall intent of the 2008 proposal, a few policy details were changed and new language was added to clarify some points. (See " Also see "FDA To Industry: Proposed Software Reg Is Not As Bad As You Think" - Medtech Insight, 16 June, 2008. " – "The Gray Sheet" June 16, 2008.)

For example, where FDA's proposed rule would have required pre-market notification for systems indicated for use by people other than health care professionals, the final rule exempts all systems from pre-market notification regardless of who uses them. The agency warns, however, that this could change if FDA determines that non-professional use poses unreasonable risk.

Thompson said he was surprised at how emphatic the agency's stance is that hospitals fall within the scope of the new regulation if they create MDDS software or modify an existing MDDS product outside the original manufacturer's parameters.

In stakeholder comments on the proposal, some hospitals had asked to be excluded from regulation if they did not plan to market or sell MDDS devices, software or components.

Hospitals that modify an off-the-shelf MDDS product will be subject to registration, product listing and manufacturing quality requirements.

FDA clarified in its final rule that if a user makes modifications to an MDDS for the purpose of clinical practice or commercial distribution, "that user becomes a manufacturer under the MDDS rule, and as a result is subject to applicable device regulations, including registration and listing and the QS [Quality System] regulation."

If a user "reconfigures any other product into an MDDS for such purposes, that user would also be a device manufacturer subject to applicable regulations," FDA adds.

Hospitals that simply purchase and use off-the-shelf MDDS packages would not be regulated as manufacturers, FDA says.

Thompson noted that this is not the first time FDA has ruled that hospitals could be considered medical device manufacturers.

"We went through this exact same issue with the reprocessing of medical devices," he said.

More than a decade ago, the agency told hospitals they would fall under medical device regulations if they reprocessed, or cleaned, products designed as single-use devices. (See " Also see "SUD Reprocessing Guidance Retains Premarket Exemptions For Now" - Medtech Insight, 7 August, 2000. " – "The Gray Sheet" Aug. 7, 2000.)

At the time, FDA's message was, "'Look, we don't care if you're a hospital or a manufacturer,'" Thompson explained. "'If you're doing a manufacturing-type operation, we're going to regulate you.'"

"A lot of hospitals have been modifying software routinely for their own purposes without any thought, frankly, to what the FDA implications of that were" – attorney Brad Thompson

While the agency has made the user-as-manufacturer argument regarding other technologies, Thompson said he was not aware of FDA's saying this so clearly for software.

"I think a lot of hospitals have been modifying software routinely for their own purposes without any thought, frankly, to what the FDA implications of that were. I think this will be a bit of a shock to some of those hospitals."

Patient Monitoring Excluded From Ruling

The final rule clarifies that MDDS is not intended to be used in connection with active patient monitoring.

The agency also notes that billing systems or electronic health records that do not receive or transmit data from a medical device do not fall within the MDDS category.

And data systems that already fall within other FDA-regulated classifications, such as medical image management systems (MIMS) or picture archiving and communication systems (PACS), also fall outside the MDDS definition, the agency says.

The MDDS category itself is "really remarkably small," Thompson said, "because the software system has to be completely passive, just a repository of data."

But he said the category could grow as more and more electronic health records start receiving data directly from medical devices.

Thompson added that he is trying to help industry "think through existing software systems out there and figure out which ones fall within and which ones fall outside" the new regulation.

And for medical software that falls outside the MDDS rules, Thompson said, it is not always easy to determine whether "they're in unregulated territory, whether they're in class II or even class III. You just don't know."

The rule itself states that "data systems that include any uses beyond, or that are for intended uses different from, those identified for an MDDS will remain class III devices."

Thompson calls the ruling "just one piece of a much larger puzzle," which will ultimately clarify how FDA will regulate the larger area of medical software. He expects to see additional software classifications from FDA, though he could not predict how soon.

"Frankly, we'd like to know what the rules are for the other categories of software as well," he said.

"The implications of this are broader than MDDS," he said, because software does not qualify for the MDDS rule, if, for example, it performs any data analytics functions.

If the intent of the MDDS regulation is extended, Thompson predicted, a hospital creating more complex software using algorithms to influence how medical data is presented "could have a class II device on their hands, which would require pre-market notification."

In its ruling, the agency says it is impossible to make generalized determinations, absent more specific information, about which combinations of software would require pre-market review. It suggests that manufacturers contact FDA with questions.

FDA notes that other software with similar risk profiles, such as Medical Image Communication Systems, also falls within class I.

Compliance Requirements

MDDS manufacturers have 90 days, or until mid-May, to electronically register and list their products with FDA, and until April 2012 to implement a compliant quality system and procedures for adverse event reporting.

Hospitals and other software users, even those that do not act as manufacturers, are required to report device-related deaths and serious injuries related to MDDS errors, and are encouraged to include in the reports details about the role that malware or viruses may have played in an event.

By Monica Hogan

Device Data Systems Made Class I; Hospitals Could Face Regulation

More from Archive

More from Medtech Insight