Regulation of Software

Rob Higgins

2

DEVICES: PERSPECTIVE

• 500,000 + devices on market

• 1/25 has an implant

• £11 billion UK

• £200 million maintenance

• > £460 million negligence

3

Directives for Medical Devices

3 Directives:

• Active Implantable Medical Devices (90/385/EEC) Powered implants

• Medical Devices (93/42/EEC) Most other devices

• In Vitro Diagnostics (98/79/EC)In Vitro Diagnostic Products

Summary of Directives

• Single market provision, based on mutual recognition and removal of national measures

• specify essential requirements

• introduce controls covering the safety, performance, specification, design, manufacture and packaging of devices

• specify requirements for assessment of clinical investigation protocols

Summary of Directives (Cont)

• specifies requirements for the evaluation of any adverse incidents that occur (Vigilance)

• introduces a system of classifying devices, and applies a level of control which is matched to the degree of risk inherent in the device

• introduces the concept of Notified Bodies who check and verify that manufacturers and devices meet the relevant requirements

• Introduces a system of registration of medical devices

Manufacturer

• Reviews and complies with relevant Essential Requirements

• Implements systems

• If applicable applies to Notified Body for Assessment, test

• Makes Declaration of Conformity

• If applicable registers product with relevant Competent Authority

• Applies the CE Marking

• Operates Post Market Surveillance and Vigilance

Notified Body

Pre Market :• Assessment against the particular Annex(es) for Specified Product

Range• Issues Annex Approval(s)• Batch Review of Highest Risk IVD Products

Post Market :• Ongoing Surveillance (if QA Annex)• Approves Changes • Co-Regulator

Competent Authority

Notified Bodies : Initial Designation : Ongoing Surveillance

Pre Market : Registration : Clinical Investigation : Review of TSE Summary Reports

Post Market : Vigilance

Throughout : Enforcement

9

Risk Classification

• Low Risk – Class IPlasters, Walking Sticks, Wheelchairs, Stethoscopes, Medicine

Spoons, Administration Sets, Syringes, Re-usable Surgical Instruments

• Medium Risk – Class IIa and IIbNeedles, Dental Filling Materials, Contact Lenses and Solutions,

Diagnostic and Monitoring Equipment, Condoms, Infusion Pumps, Blood Bags, Haemodialysis Concentrates, Hearing Aids, Ventilators, Incubators, Surgical Lasers, Anaesthetic Machines, Nebulisers

• High Risk – Class III and active implantablesPacemakers, Cochlear Implants, Breast Implants, Devices containing

Medicinal Substances, Devices containing Animal Materials, Cardiovascular and Devices, Neurological Implants, Absorbable Sutures

10

EU REGULATORY SYSTEM

compliance ERssafety, performance Notified Body

• quality systems• design dossier• clinical data (literature, C/I)

accreditaudit

CompetentAuthority

European market post market surveillance serious adverse events

investigation action

11

EU MARKET

compliance with all EssentialRequirements covering safety and performance

Definition

“software… intended by the manufacturer to be used for human beings for the purpose of:•diagnosis, prevention, monitoring, treatment or alleviation of disease, •diagnosis, monitoring, treatment, alleviation of or compensation for an injury or handicap,•investigation, replacement or modification of the anatomy or of a physiological process, •control of conception….”

12

Apps

The words and phrases listed below are all likely to contribute to a determination by the MHRA that the app they were associated with is a medical device:

amplify analysis interpret

alarms calculates controls

converts detects diagnose

measures monitors

13

Apps (Cont)

Decision support or decision making software that applies some form of automated reasoning, such as a simple calculation, a decision support algorithm or a more complex series of calculations, e.g. dose calculations, symptom tracking, clinicians guides. These are the types of software most likely to fall within the scope of the medical devices directives.

This includes software which provides personalised guidance based on information it has about a specific individual and makes use of data entered by them, provided by point of care devices or obtained via health records.

14

Apps (Cont)

Apps acting as accessories to medical devices such as in the measurement of temperature, heart rate, blood pressure and blood sugars could be a medical device as are programmers for prosthetics.

Software that monitors a patient and collects information entered by the user, measured automatically by the app or collected by a point of care device may qualify as a medical device if the output affects the treatment of an individual.

15

Apps (Cont)

Software that provides general information but does not provide personalised advice, although it may be targeted to a particular user group, is unlikely to be considered a medical device.

Software that is used to book an appointment, request a prescription or have a virtual consultation is also unlikely to be considered a medical device if it only has an administrative function.

16

Apps (Cont)

Some decision support software may not be considered to be a medical device if it exists only to provide information to enable a healthcare professional to make a clinical decision as they ultimately rely on their knowledge. However, if the software or app performs a calculation or interprets or interpolates data and the healthcare professional does not review the raw data, then this software may be considered a medical device.

17

Validation and Verification

It is essential that appropriate validation and verification activities are performed ie

Pre – clinical testing

Clinical Evaluation including, if necessary, clinical investigations

18

19

ESSENTIAL REQUIREMENTS

“the devices must be designed in such a way that….they will not compromise the clinical condition or SAFETY of patients…...provided that any RISKS which may be associated with their use constitute acceptable RISKS when weighed against the benefits…”

MDD: Annex 1

…..devices must achieve the performanceintended by the manufacturer…..

Classification

• All software is considered to be ‘active’

• Implementing rule 2.3 - Software, which drives a device or influences the use of a device automatically falls into the classification of that device.

• Rule 9 - Active therapeutical devices are generally Class IIa – however if potentially hazardous then Class IIb.

20

Classification (Cont)

• Rule 10 - Active devices intended for diagnosis are generally Class IIa – however if potentially hazardous then Class IIb.

• Rule 12 - All other Active Devices are class I.

• Rule 14 - All devices used for contraception or the prevention of the transmission of sexually transmitted diseases are in Class IIb.

21

Post Market Surveillance

Manufacturers have a responsibility to implement an effective post-market surveillance system to ensure that any problems or risks associated with the use of their device once freely marketed are identified early, reported to competent authorities, and acted upon. This is known as the medical devices vigilance system.

22

23

Rob.higgins@mhra.gsi.gov.uk