Medical Device Regulations & Software as a Medical Device

EU Chapter 12: Medical Device National Particularities

Objective #1: Understand the importance of national transpositions for (1) product labeling language requirements
- CE marking is required to commercialize products in the European Economic Area (EEA), which includes:
  - EU member states
  - EFTA members
- Labeling content should be developed with consideration for the intended user.
- MDR/IVDR introduced new requirements for labels:
  - Indelible: Must not fade, smudge, or become illegible during the device’s normal use, storage, or transportation.
    - Important for reusable/capital equipment that may undergo routine cleaning.
  - Easily legible: The font, size, and clarity of the text must make it easy for users to read quickly and accurately.
  - Clearly comprehensible: The information must be presented in a way that’s understandable to the intended user, avoiding technical jargon or complex terminology.
    - Consideration should be given to the user’s technical knowledge, experience, education, and training.
    - May affect terminology used.
- Under the new regulations (IVDR/MDR), the phrasing of translation requirements has been tightened.
- Required to provide translation in 27 languages (the 24 official EU languages, as well as the official languages of Iceland, Liechtenstein, and Norway).
- May have different national implementations.
  - Ex.: In Belgium, language requirements are determined by whether the user is a layperson (requiring all languages) or a healthcare professional (information may be provided in English).

Objective #1: Understand the importance of national transpositions for: (2) competent authority notification

Under the directives (MDD, AIMDD, IVDD), medical devices are also subject to local registration and notification requirements which vary based on:
- Country
- Product Type
- Classification
EU MDR/IVDR introduced EUDAMED, which will be implemented in a phased approach
- EUDAMED aims to streamline the device registration process by providing a single, EU-wide platform for registering actors, devices, and related information (certificates)
- Assumption that once EUDAMED is fully functional/implemented most of the country-specific registration requirements will be removed.
Examples:
- Spain requires that the Medicines Agency be notified when Class IIa, IIb, and III devices are placed on the Spanish market for the first time
- In Italy all devices, including Class I, must go through a local device registration process
EUDAMED contains:
- UDI & Device registration
- Vigilance & PMS
- Actor registration
- Certificates & Notified Bodies
- Market surveillance
- Clinical Investigations & Performance Studies
EUDAMED is live, but not yet required
EUDAMED is not yet functional for MDR / IVDR compared to MDD / AIMDD / IVDD

Intl. Chapter 10, 11

Chapter 10 - Objective #1: Understand the main requirements for the development of active implantable medical devices.

Active: The device relies on electrical energy or some other power source than that directly generated by the human body or gravity.
Implantable: The device is totally or partly introduced, surgically or medically, into the human body or by medical intervention into a natural orifice and is intended to remain in place for a certain period, typically longer than 30 days.
Examples:
- Implantable pulse generators (cardiac pacemakers, defibrillators)
- Implantable stimulators ((deep) brain stimulators, bladder stimulators, nerve stimulators)
- Implantable drug administration devices
- S-ICD System Subcutaneous Implantable Defibrillator

Objective #1: Understand the main requirements for the development of active implantable medical devices.

ISO 13485 Medical devices – Quality management systems- Requirements for regulatory purposes
ISO 14971 Medical devices – Application of risk management to medical devices
2 main horizontal standards
ISO 14708-1 Implants for surgery – Active implantable medical devices – Part 1: General requirements for safety, marking and for information to be provided by the manufacturer
- Has a more extensive series of collateral standards for specific device types
- Not harmonized in the EU
- FDA has recognized two of it’s collateral standards (14708-5 (circulatory support devices), and -3 (implantable neurostimulators))
EN 45502-1 Active implantable medical devices – Part 1: General requirements for safety, marking and information to be provided by the manufacturer
- Provides comprehensive set of requirements to consider for AIMD development and manufacturing, as well as references to other recommended standards
- EN 45502-2-1: cardiac pacemakers
- EN 45502-2-2: implantable defibrillators
- EN 45502-2-3: cochlear and auditory brainstem implants
3 Harmonized Collateral standards
Harmonized in the EU under AIMDD 90/384/EEC, not yet harmonized under EU MDR 2017/745
General Standards: Other regulatory authorities may expect compliance to EN 45502-1 or ISO 14708-1 (and their applicable collateral standards) even though they don’t recognize the standards officially
Global Considerations

Objective #1: Understand the main requirements for the development of active implantable medical devices.

Biocompatibility
- ISO 10993 series defines specific analysis or testing requirements and guidance most relevant to implantable devices
Packaging
- ISO 11607 provides guidance on requirements for materials, sterile barriers and packaging systems, and process validation
Sterilization
- ISO 14937 provides general requirements for characterization of a sterilizing agent and the development, validation, and routine control of a sterilization process
  - ISO 11135 for Ethylene Oxide sterilization
  - ISO 11137 for radiation sterilization
  - ISO 11138 for steam sterilization
- Electronic assemblies may not be able to withstand the temperatures required for an effective steam sterilization process
- May introduce leachables/residuals unwanted for implants
Heat & Mechanical Safety
- EN 45502-1 provides relevant references to testing standards for mechanical-related risks (e.g., vibration, flexural stress, mechanical shock/fatigue)
- Requires that AIMDs under normal and single fault conditions don’t have a surface temperature higher than the average body temperature (limit of 2 oC)
Markings
- EN 45502-1 & EN 980 provides the required series of markings to be included, and applicable symbols to be used
- US: symbols without text are not accepted, but marking are required
Usability
- Clinical validation conducted for an AIMD’s recommended surgical technique:
  - Usability validation of the surgical instructions’
  - AIMD/surgical technique should be developed to minimize outcome variations
- Consideration should be given to device explantation (/removal)
Key considerations/ relevant standards in the AIMD development process
- Except for their intended function, AIMDs shall be electrically neutral when in contact with the body
  - Consideration of electrostatic discharge
- Should be immune to electrical influences from external electromagnetic fields
Electrical Safety

Objective #1: Understand the main requirements for the development of active implantable medical devices. Additional considerations for AIMDs

Consideration of future medical needs: Magnetic Resonance Imaging (MRI) and Other Medical Treatments
- Subject the patient and potentially the AIMD to a strong magnetic field
- ISO/TS 10974 provides guidance on the testing/marking required to ensure patients are protected from RF-induced heating, mechanical movement, implant malfunction, and effect on MRI image
- Risk Management should consider effect of other medical treatments which may expose the patient to:
  - Ultrasound
  - High-power electrical fields
  - Electrical shock
IEC 60601:
- AIMDs are outside the scope of 60601, however it can provide useful guidance during the risk management process
Radiofrequency Communication:
- Requires risk assessment to be inclusive of inherent risks of wireless communication devices (e.g., immunity to interference, protection from malware attacks, etc.)
- FDA’s Guidance for Radio-Frequency Wireless Technology in Medical Devices
- In some countries, the device would require additional approval/registration from the government authority responsible for managing communications with the RF spectrum example
  - Australia must comply with the Australian Communications and Media Authority radio spectrum licensing requirements and display the C-Tick approval mark

Objective #1: Understand the main requirements for the development of active implantable medical devices.

The key difference between a low-risk medical device and an AIMD submission is the level of detailed information provided rather than the type of information required
Takeaway: Two formatting styles:
- Global Harmonization Task Force (GHTF) Summary Technical Documentation (STED)
- ASEAN Common Submission Dossier Template (CSDT)
Organization Format
Main information types expected:
- Device Description
  - High-level design documentation, main technologies, functional principles, specifications, and external accessories, surgical tools or programming equipment used with the AIMD
- Labeling
  - IFU, surgical instructions, packaging labels and any other information accompanying the AIMD
- Risk Analysis
  - ISO 14971, main documents of the risk management file (RMP, HA, FMEA, etc.) & post market risk documentation (PMS & PMCF)
- Verification & Validation
  - Summary of design verification & validation (incl. protocols and reports), clinical documentation demonstrating device’s effectiveness
- Manufacturing
  - Description of the manufacturing process (high-level flow chart) and critical processes’ validation information (including sterilization)
Basic Principles for Regulatory Approval of an AIMD:

Objective #2: Understand the unique country-specific requirements established by regulatory bodies around the world for the market authorization of these devices.

Country Specific Requirements:
- EU
  - AIMDD (superseded)
    - Inclusive of accessories, software, or multiple devices acting together as a system to achieve the intended medical purpose
    - AIMDD Annex 2 main requirements:
      - ISO 13485 certified QMS
      - Product design examination (with evidence that Annex 1 Essential Requirements have been met)
      - Declaration of Conformity
    - AIMDD + MDD
  - EU MDR (beginning May 26, 2021)
    - Did not cause significant AIMD specific changes aside from reclassification as a Class III device (including accessories)
    - No grandfathering provisions, require a full re-evaluation and initial audit
    - Most AIMDs are categorized as Class III devices (most highly regulated class)
- US
  - Subject to premarket approval (PMA) requirements, which must be approved by FDA prior to marketing the device
  - PMA should contain data/information on nonclinical laboratory studies and clinical investigations which allows FDA to determine whether to approve/disapprove the application
  - Any changes affecting the device’s safety or effectiveness must be submitted to the FDA via a PMA supplement
  - Changes not affecting device safety or effectiveness are notified to FDA through an annual report

Objective #2: Understand the unique country-specific requirements established by regulatory bodies around the world for the market authorization of these devices.

Country Specific Requirements:
- Canada
  - Most AIMDs are considered Class IV
  - Highest risk classification
  - Inclusive of: active devices intended to control the treatment of a patient’s condition through a closed-loop system
  - Class IV Application content is consistent with GHTF STED format, and should include:
    - Implant registration cards,
    - Marketing history (+Adverse Events),
    - Materials identification + specifications
    - Quality plan and control methods
- Australia
  - AIMDs have their own class (Class AIMD) in accordance with regulation Schedule 2 Rule 5.7(1)
  - AIMD accessories are classified in their own right
  - To market an AIMD the manufacturer must demonstrate both the device and its manufacturing process conform to Therapeutic Goods Regulations’ requirements
  - QMS in accordance with ISO 13485 (audited by either TGA, EU NB, or MDSAP certification)
  - Device dossier with content as per the GHTF STED format
- Brazil
  - RDC No. 185 Annex II describes medical device classification
  - Corresponds to EU rule classifications under MDD
  - AIMDs categorized as Class IV
  - All medical devices imported/distributed within Brazil must be registered with ANVISA (National Health Surveillance Agency)
  - May be required to provide (not an exhaustive list, but instead highlighting unique items to Brazil):
    - INMETRO certificate
    - Device manufacturer letter authorizing a Brazilian company to hold the registration and distribute the device
    - IFU in Portuguese
  - All manufacturing locations must comply with Brazilian GMP requirements (RDC N o 16, similar to ISO 13485)

Objective #3: Learn to understand and apply the scope of different medical device definitions to determine whether software is regulated as a medical device.

Software can be an integrated part of a medical device, or it can affect the use of a medical device in some way. A standalone piece of software also can be a medical device.
Software allows medical devices to perform complicated tasks and acquire and process complex information about a patient condition.
IMDRF Software as a medical device (SaMD) - “Software intended to be used for one or more medical purposes without being part of a hardware medical devices”
- Can be in vitro (IVD)
- Capable on running in general purpose computing platforms
- Is not necessary for a hardware medical device
- May be used in combination with other products
- May be interfaced with other medical devices
- Includes mobile apps
Unregulated Software
- Software for general purposes when used in a healthcare setting
- If software does not perform an action on data, or performs an action limited to storage, archival, communication, “simple search,” or lossless compression, it is not a medical device

Objective #4: Gain insight into specific regulatory issues associated with software.

Software that falls under the perspective jurisdictions medical device definition is regulated as a medical device.
Medical Device definitions, although there are varying wording between jurisdictions, generally encompass products intended to be used in the treatment, mitigation, diagnosis, monitoring, or prevention of disease or abnormal physical conditions
Since medical device definition are high level criteria that broadly cover forms, presentations, and scope of intended use, relying solely on the definition would mean as substantial level of granularity would be lacking in determining whether certain software should be qualified as a medical device
Regulatory Bodies have found it necessary to publish specific guidelines related to software qualification and classification, providing clarity on software types that would be regulated as medical devices in their jurisdictions
US FDA Guidances
- Off-the-Shelf (OTS) Software Guidance
- Guidance for the Content of Premarket Submissions for Software Contained in Medical Devices
- Clinical Decision Support Software Guidance
EU MEDDEV
- MEDDEV 2.1/6 – Standalone Software as a Medical Device

Objective #5: Learn about the important national and international guidelines for software as a medical device, particularly in US and EU law.

US
- Any software that meets the legal definition of a device (FD&C Act Section 201(h)) is deemed a device and is known as medical device software.
- FDA states the software functions must meet all four of the following statutory criteria to be excluded from the device definition:
  - Not intended to acquire process or analyze a medical image or a signal from an in vitro diagnostic device or a pattern or signal from a signal acquisition system
  - Intended for the purpose of displaying, analyzing or printing medical information about a patient or other medical information
  - Intent for the purpose of supporting or providing recommendations to a health care professional about prevention diagnosis or treatment of a disease or condition.
  - Intended to enable such healthcare professional to independently review to the basis for the recommendations their software presents and not intended for the healthcare professional to rely primarily on any of these recommendations to make a clinical diagnosis or treatment decision regarding an individual patient
EU MDR
- Standalone Software – Software that would first need to have a medical purpose be qualified as a medical device. Only intended purpose as described by the product manufacturer is relevant for any device’s qualifications and classification as a medical device
- Software as a medical device (SaMD) - “Software intended to be used for one or more medical purposes without being part of a hardware medical devices”
  - Can be in vitro (IVD)
  - Capable on running in general purpose computing platforms
  - Is not necessary for a hardware medical device
  - May be used in combination with other products
  - May be interfaced with other medical devices
  - Includes mobile apps
EU IVDR
- Software is regulated under the EU IVDR if it qualifies as a medical device in the above definition and moreover intended to be used in in vitro for the combination of specimens including blood and tissue donations derived from the human body solely or principally for the purpose of providing information:
  - Concerning a physiological or pathological state
  - Concerning a congenital abnormality
  - To determine a potential recipients
  - To monitor therapy therapeutic measures

Objective #6: Learn about software design and quality system requirements.

Developing Compliant Medical Software
- In both the EU and US regulation impose rules on software development and they do with medical device design and risk management in general.
- In both the US and EU all software components must be under design control and/or purchasing control including:
  - Design validation that includes software validation and risk analysis
  - Potential supplier, contractor and consultant evaluation and selection based on their ability to meet specified requirements including quality requirements.
- Quality System, Post-Market Surveillance and Corrective Action
  - Software development lifecycle process should be built into the QMS
  - SOPs should cover the entire software lifecycle from software requirement specs to software retirement
  - Software quality control should be accomplished by version control and regression testing prior to software release
  - Software correction should be accomplished with the QMS (control of non-conforming material process)
  - Corrective and preventive action (CAPA) should be taken without delay using the QMS CAPA process
- Personal health data
  - US: HIPPA sets standards for the exchange of personal health information among covered entities and business associates a covered entity is a healthcare provider so such physician and includes insurance companies and healthcare clearing houses.
  - EU: General Data Protection Regulation (GDPR) compliance applies to orgs established within or outside the EU that process EU residents’ personal data. GDPR sets standards for entire industries that deal with consumer data while HIPAA only applies to the relationship among covered entities and business associates