Edward J. Palmer and Kristin M. Mortenson
July 14, 2020
The FDA has relaxed regulatory oversight for some digital health devices that treat certain psychiatric disorders during the COVID-19 pandemic, but what does this mean for companies seeking to launch devices and apps in this space?
Introduction
It’s no secret that the COVID-19 pandemic has resulted in significant changes to how everyone conducts rudimentary life activities, from going to the bank and the grocery store to seeing the doctor. The spread of this novel coronavirus has forced upon us the acceptance of videoconferencing and remote technology tools as replacements for in-person meetings, including visits to physicians.
In a matter of months, consumer adoption of “telehealth” has skyrocketed from 11 percent of US consumers in 2019 to 46 percent of consumers in the first half of 2020, as the need to cancel in-person healthcare visits and to stay safe at home have increased. At the same time, loss of jobs, the devastatingly unfortunate loss of lives, and dealing with illnesses of family members directly (or indirectly) resulting from COVID-19 have put added strain on the wellbeing of our communities.
Not surprisingly, the FDA recognized the sudden need to address accessibility challenges for the onslaught of new mental health patients as well as for those dealing with ongoing psychiatric disorders in this “new normal” detached society. In April of 2020, the FDA issued a guidance document titled “Enforcement Policy for Digital Health Devices for Treating Psychiatric Disorders During the Coronavirus Disease 2019 (COVID-19) Public Health Emergency”, in order to express their intent to relax regulatory oversight on some digital health and Software as a Medical Device (SaMD) technologies for certain conditions during the pandemic.
What does this guidance document mean for manufacturers of digital mental health devices and apps in regard to product development, regulatory planning, and market launch? Read on, as we analyze and highlight major takeaways from this FDA guidance.
What types of devices are covered by the Guidance and what is out of scope?
The title of the document indicates that “digital health devices” are the focus of the guidance from the FDA. But this requires further definition as the range of devices and software potentially covered is vast.
Section III. Scope of the guidance indicates the following as “in scope”, and thus the FDA does not intend to enforce applicable regulatory requirements for these devices/products during the COVID-19 public health emergency:
Computerized Behavioral Therapy (CBT) devices as defined in 21 CFR 882.5801 for certain lower-risk psychiatric conditions
Variations of CBT devices and other devices intended to treat patients with psychiatric conditions that do not fall under 21 CFR 882.5801
Low-risk general wellness and digital health products
Examples of products and devices that are out-of-scope of the guidance, and thus must still meet applicable regulatory requirements during the pandemic, include the following:
CBT devices previously cleared through 510(k) which are being modified and would require subsequent regulatory review
Products that are relied upon as the primary source of diagnosis or treatment decision making
Devices that are not considered low-risk because the underlying psychiatric condition may pose harm to the patient without urgent or immediate clinical intervention (for example, suicidality)
Examples of products that are out-of-scope of the guidance since they’re not FDA-regulated anyway:
General wellness software that is not a medical device per section 201(h) of the FD&C Act, for example, software that promotes relaxation, stress relief, good sleep, etc. The 21st Century Cares Act removed this type of software from the definition of a medical device, and thus the FDA has stated they do not intend to regulate this type of software.
Software for videoconferencing for telehealth applications, as it is not a medical device.
Which regulations were relaxed by the Guidance?
The guidance states that the following regulations will not be enforced by the FDA during the COVID-19 public health emergency for new medical devices:
510(k) submission under 21 CFR 807.81
Reports of corrections and removals under 21 CFR 806 (“product recalls”)
Registration and listing under 21 CFR 807
Unique Device Identification (UDI) requirements under 21 CFR 830 and 21 CFR 801.20 (also note that on June 30, 2020, the FDA issued a guidance relaxing the UDI requirements for certain Class I and unclassified devices)
Special controls for computerized behavioral therapy devices under 21 CFR 882.5801
What am I still responsible for as an FDA-regulated software company?
In addition to doing the work of designing and developing the software for your digital health device, being an FDA-regulated company means that everything is clearly documented. This does not change as a result of the guidance.
Though the FDA has relaxed regulatory oversight on the aforementioned digital health devices for treating certain psychiatric disorders during the COVID-19 public health emergency, that does not mean you are exempt from following all applicable pre-market/pre-submission (i.e. 510(k)) and specific post-market/post-clearance activities required by law. It is imperative that companies continue to self-regulate and follow current good manufacturing practices and quality system regulations during this public health emergency.
Take the following as examples of activities you must still perform (not an exhaustive list), regardless of applicability of the guidance to your product:
Establishment of a quality system and compliance with its processes throughout the entire lifecycle of your product (note that without registration and listing per 21 CFR 807, it is difficult for the FDA to enforce the Quality System Regulation but that does not exempt you from following it).
Creation of a risk management file per ISO 14971 in order to establish the risk level of the device you are creating and mitigate any unacceptable risk. This will, at minimum, help determine whether you can take advantage of the guidance for temporary regulatory relief.
Assessment of cybersecurity risks and plans to address vulnerabilities when they arise.
Product and software design verification and validation activities in order to demonstrate you have designed your product correctly and that it provides a safe and effective therapy model as intended.
Creation of proper labeling. If your product is a tablet/smartphone app, labeling requirements must be designed directly into the app itself.
Complaint handling regulations that are under the QSR. If there are customer reports of malfunctions that caused injuries (or could lead to injuries from the use of the product), it is of course good business practice to respond, and it is certainly expected that swift action be taken to resolve those issues.
Medical Device Reporting (MDR). If a new company chooses to not complete registration and listing per 21 CFR 807 under the guidance, then that company will not be able to submit under eMDR. Notwithstanding, in the case of adverse events occurring with your product, you are still required to notify the FDA per 21 CFR 803.
How long will the Guidance be in effect and what happens after the public health emergency is over?
The short and unfortunate answer is “no one knows”.
The incredible uncertainties surrounding how the COVID-19 pandemic will play out and how the FDA will react to the ever-changing public health landscape are the cause of this. It is very likely, though, that the FDA will signal its intentions through future guidance documents regarding how and when they plan to bring products and devices marketed during validity of the guidance back into their scope of regulatory oversight. That being said, it is unknown when this will occur or exactly how the FDA will treat these products and devices in the future. Certain types of digital health products and software have experienced significantly less scrutiny from the FDA in the last few years, and there is a possibility the FDA will make at least some of the changes in this guidance permanent.
Simply put, device manufacturers should assume that they must perform all development, testing, documentation, quality, and regulatory activities as if the public health emergency didn’t exist and the FDA was operating under normal circumstances. But, if your product can address the sudden need for change in methods of treatment of certain lower-risk psychiatric disorders, take advantage of the temporary regulatory oversight reprieve the FDA is giving you to get your product to market faster.
Edward J. Palmer has nearly 20 years of medical device product development experience on a wide variety of projects and is the principal of Palmer Wireless Medtech (www.palmerwirelessmedtech.com). He holds a bachelor's degree in Electrical Engineering from the University of Minnesota, Twin Cities. Areas of expertise include systems / electrical / software engineering and project leadership for digital health and medical device product development.
Kristin Mortenson has over 30 years of industry experience in both design, development (15 years) and quality and regulatory assurance (15 years) across wide-range of both class II and class III medical device products. Areas of expertise include European technical documentation submissions for CE mark, FDA IDE, 510(K), PMA / supplement submissions, project management, risk management, mechanical / electrical, software and system verification and validation strategies and studies, GLP and non-GLP animal studies, as well as quality system design, deployment and auditing.