FDA Final Guidance on Medical Apps

The proliferation of smart phone and tablet health applications, aimed at both patients and providers, inevitably led to concern about regulations.  Given that the Food and Drug Administration has historically had an interest in regulating software that it believes affects health care, it had faced significant pressure to give health care mobile app developers and deployers guidance on its regulatory approach to these products.  After an extended period of consideration and outside comment, the FDA has finalized its guidance in this area.   (FDA Guidance)    The FDA basically said health apps fall into three categories:  those that are not within the definition of a medical device; those that are within the definition but pose a low risk to the public; and those that are medical devices and whose functionality suggests that if they don’t work as intended there is a risk to patient safety.  The FDA does not intend to regulate the second group but will regulate the third one.  The FDA to some extent drew on past guidances examining software in a health care context and noted that for mobile software there can be unique considerations like limitations of screen size and the effect on medical images.  The guidance defines a mobile platform as a commercial off-the-shelf device, with or without a wireless capability, that are handheld in nature.  And a mobile application is software that can be run on a mobile platform or that runs on a server but interacts with a mobile platform.

A mobile medical application is a mobile app that is a device under the FDA Act and is either used as an accessory to a regulated medical device or to transform a mobile platform into a regulated mobile device.  A device under FDA law is basically anything tangible, or intangible in the case of software, that is intended for use in the diagnosis, treatment or prevention of disease or conditions or intended to affect the structure or any function of the body.  The focus is on intended functionality.  But the second important step is that even if the intended function makes a mobile app a device, the level of regulation, if any, depends on the risk posed by the app.  The regulations apply only to manufacturers and entities that only distribute, like the iTunes store run by Apple, are not manufacturers, so they are all breathing big sighs of relief.  Phone manufacturers have to be a little careful because they might be regulated if they advertise or market their phones as intended for medical device-type use.

Another important caveat is that the guidance does not apply to software that performs patient-specific analysis to aid or support clinical decision-making.  There are a number of mobile apps that purport to do this and while they are not covered by the guidance, that is because these will almost always be considered medical devices that pose potentially serious risks and therefore are subject to FDA review and approval.  For items that are mobile medical applications, the FDA views them as subject to the general device classifications of class I, class II and class III, which requires premarket approval.  The FDA identified three primary types of mobile medical applications for which it intends to exercise more intensive oversight:  ones that are an extension of one or more other medical devices by connecting to that other device and controlling it or communicating or analyzing data from the device (examples like display of data from beside monitors are given in the guidance); apps that turn the mobile platform into a medical device similar to those currently regulated by the FDA (like a glucose monitor attachment or stethoscope attachment); and apps that perform patient specific analysis or recommendations (like computer-aided image processing software).

Although they fall within the definition of a mobile medical application, the FDA identified several other types of apps which it does not intend to actively regulate, including wellness type apps, coaching apps, tools to track health information, apps that allow EHR or PHR access and apps that allow simple medical calculations.  These categories include the vast majority of all health apps.  The line will be crossed when a system is designed to provide specific analysis and clinical recommendations for a patient.  The guidance contains a lot of specific information about various types of apps and whether they are considered mobile medical applications and if so, how they will be regulated, particularly in the appendices, where many examples are given.  It should at least give the industry a good sense of what will and won’t be regulated.