Passage of the 21st Century Cures Act (Cures Act) on December 13, 2016, amended the definition of a “device” under the Federal Food, Drug, and Cosmetic Act (FDCA) to exclude certain types of CDS software from FDA’s regulatory purview. FDA then issued two draft versions of a guidance document explaining its interpretation of this 21st Century Cures Act exclusion, first in December 2017 and then in September 2019. On September 28, 2022, FDA issued the long-awaited final version of this guidance, Clinical Decision Support Software (CDS Guidance).
Echoing the draft guidances, FDA’s CDS Guidance states that clinical decision support software functions are excluded from the definition of a medical device (they qualify as “non-device CDS”) so long as they meet the four criteria set forth in the Cures Act:
-
Does not acquire, process, or analyze images or signals;
-
Displays, analyzes, or prints medical information about a patient or other medical information;
-
Supports or provides recommendations to a health care professional (HCP) about prevention, diagnosis, or treatment of a disease/condition; and
-
Allows the HCP to independently review the basis of the software’s recommendation or output, so that it is not the intent for the HCP to rely primarily on the software in making clinical decisions for individual patients.
However, the guidance added further nuances to how FDA interprets these criteria, suggesting that the Agency aims to regulate a greater number of CDS products. Additionally, there is no longer an explicit category for enforcement discretion, as there had been in the draft guidance for CDS products which were deemed sufficiently low-risk that FDA would not make the determination as to whether they constituted medical devices, or regulate them.
With numerous clients asking us to help them better understand the implications of the final guidance, we reached out to FDA’s Digital Health Mailbox to seek clarification on certain elements of the CDS Guidance and its interface with another key FDA software guidance, document, the Policy for Device Software Functions and Mobile Medical Applications (MMA Guidance). The Agency kindly offered a teleconference to clarify its position, and we had a valuable discussion with personnel from the Agency’s Digital Health Policy team in February 2023.
We asked FDA primarily about two types of software functions for which we felt the regulatory status was unclear pursuant to issuance of the final CDS Guidance:
-
simple calculations that are routinely used in clinical practice and may even be available publicly, such as mean arterial pressure or body mass index (BMI); and
-
other single outputs that are not limited to calculations.
Regarding the former, we sought clarification from FDA as to whether transparent and commonly used calculations fell under enforcement discretion per the MMA Guidance or could be considered “non-device CDS” under the final CDS Guidance. Regarding the latter, the final guidance stated that CDS software that issues a single, specific treatment output or directive, as opposed to a list of options, is generally not considered to meet the third criterion for non-device CDS, because it is susceptible to automation bias and is directing the HCP more than supporting or providing recommendations. However, this development troubled much of industry, which broadly felt that the provision of a specific recommendation is what imparts clinical value and return on investment to CDS tools. Accordingly, we sought to better understand where FDA intends to draw the line on regulating these types of singular outputs.
FDA initially provided one critical clarification, which was that the narrower scope of the final CDS Guidance was intended to track the Cures Act provisions more directly and thereby limit the ability for certain entities to take advantage of loopholes and avoid warranted regulation, rather than to broadly expand FDA’s regulatory oversight. Along the same lines, the Agency noted that despite the removal of an explicit enforcement discretion category from the final CDS Guidance, CDS products may still qualify for enforcement discretion under FDA’s other existing software guidance documents; the various policies are meant to work together. Thus, if a software function does not meet the definition of non-device CDS under the CDS Guidance, it should still be evaluated under the MMA Guidance to see whether it may qualify for enforcement discretion. For example, automating calculations that are found in medical textbooks is still under enforcement discretion even though there is one output.
FDA further clarified that it will continue to take a risk-based approach to enforcement in this space. Specifically, FDA noted that a few types of single outputs (e.g., simple drug-drug interaction flags) are excluded from the definition of a device per the guidance, and additionally reassured us that if an HCP can easily follow where a recommendation comes from – even if it is a specific output – this would likely not be an enforcement priority. To that end, software functions which may not qualify as non-device CDS (based on the single output limitation) are unlikely to face FDA scrutiny, even if they do not formally qualify for enforcement discretion, if the basis for their recommendations are an established clinical guideline (or FDA-approved labeling) that is disclosed to the HCP and they do not lead the HCP to deviate notably from routine clinical practice. In such cases, FDA believes the risk is low and therefore the need to expend enforcement resources is not great. The Agency stopped short of explicitly defining what type of recommendation would go too far to avoid active regulation, but did caution that the farther the deviation from a clinical guideline and/or standard practice, the more likely it is that FDA would want to review the function.
In sum, while the final guidance did impose some additional stringency on CDS products – with some manufacturers now having to determine the appropriate regulatory pathway for software they had previously concluded was unregulated – the fundamental principles guiding reasonable arguments for enforcement discretion remain applicable. We look forward to continuing to work with our clients in this space to develop their strategies and, where needed, gain greater clarity from FDA on specific products.
Please contact the authors or the Hogan Lovells attorneys with whom you regularly work for guidance regarding your CDS products.
Authored by Kelliann Payne, Suzanne Levy Friedman, and Greg Kass.
