What the FDA's new MDDS guidance means for you
The medical device world, like almost every other industry on Earth, gets more digitized by the day.
So it's no surprise to see industry bodies like the FDA updating their guidance documents to keep pace.
In September 2022, the FDA's "Medical Device Data Systems, Medical Image Storage Devices, and Medical Image Communications Devices" guidelines were updated from their original 2015 issuance to revise how so-called 'medical device data systems' (MDDS) and other digital medical systems are regulated - or not!
Let's dive into what the update means.
What is an MDDS?
Medical Device Data Systems (MDDS) are hardware or software products intended to transfer, store, convert the format of, or display medical device data.
A MDDS does not modify the data or its display, and it does not by itself control the functions or parameters of any other medical device. MDDS may or may not be intended for active patient monitoring.
The FDA's so-called MDDS Rule of 2011 reclassified MDDS from Class III (subject to premarket approval) to Class I (subject to general controls) medical devices.
The logic of the Rule was that while MDDS risks include inaccurate, incomplete, or untimely data operation, which could in some cases trigger incorrect patient diagnosis or treatment, the general controls mandated in FDA 21 CFR Part 820 were sufficient to guarantee their general safety and effectiveness.
MDDS were therefore low-risk medical devices, and regulated as such.
The 2022 update
Things have changed since the original MDDS Rule and the original MDDS guidelines.
In 2016, the 21st Century Cures Act narrowed the scope of the medical device, stripping away some software functions from the definition of what a medical device is, and how it should be regulated (or not regulated).
To reflect this change, the FDA's September 2022 guidelines now categorize MDDS into two types:
1. Device-MDDS
Hardware functions solely intended to transfer, store, convert formats, and display medical device data or results.
Device-MDDS are medical devices.
2. Non-Device-MDDS
Software functions solely intended to transfer, store, convert formats, and display medical device data or medical imaging data.
Non-Device-MDDS are not medical devices.
Examples of non-device-MDDS include software that supports:
- The electronic transfer or exchange of medical device data
Example: software that collects output from a ventilator about a patient’s carbon dioxide level and transmits the information to a central patient data repository - The electronic storage and retrieval of medical device data
Example: software that stores historical blood pressure information for later review by a healthcare provider - The electronic conversion of medical device data from one format to another in accordance with a preset specification
Example: software that converts digital data generated by a pulse oximeter into a digital format that can be printed - The electronic display of medical device data, which may include certain secondary or remote displays to medical devices that solely display data and results
Example: software that displays a previously stored electrocardiogram for a particular patient.
Looser regulatory requirements
Interestingly, although MDDS are now split into medical devices and non-medical-devices, the FDA doesn't necessarily intend to enforce medical device regulatory requirements for either group.
Even if your MDDS is a Device-MDDS, as long as it aligns with the hardware functions defined in 21 CFR 880.6310, 21 CFR 892.2010 or 21 CFR 892.2020, you won't need to perform the typical regulatory activities associated with a medical device, such as registration, listing, pre-market review, post-market reporting, or quality system compliance.
There are some exceptions to this, such as:
- Specialized medical display hardware devices for digital mammography, radiology, pathology, and ophthalmology
- Other specialized medical display hardware integral to the safe and effective use of a medical device hardware product, such as 3D displays in robotic surgery systems or displays built into ICU bedside monitors
But the overall change is clear: the majority of hardware medical device data systems will no longer be regulated as medical devices by the FDA.
What about multiple-function devices that contain an MDDS?
If a medical device includes at least one device function and at least one software function that is not a device, the FDA does not regulate the Non-Device-MDDS functions.
However, Non-Device-MDDS manufacturers may have to consider certain activities when incorporating their MDDS into a medical device.
Software within a medical device must be considered as any other off-the-shelf component of the device, and included in the risk file of the device. MDDS may have an impact on the safety and efficacy of the medical device as a whole, and thus have an impact on the user safety.
If a multiple function device product contains Device-MDDS functions, the FDA does not regulate the Device-MDDS functions either.
However, the FDA may assess the impact that the Non-Device-MDDS or Device-MDDS functions have on the safety and effectiveness of the overall device.
MDDS manufacturer responsibilities
The FDA still expects MDDS manufacturers to establish and maintain adequate design controls as part of their quality system, and will enforce design control requirements for currently marketed devices if there is a design change.
Even though design controls don't apply to non-device MDDS, following design controls and developing your software system in alignment with best practice for software development will only ensure that your product development activities meet the expectations of users and regulatory authorities.
Conclusion
The scope of what a medical device is has been narrowed, as digital and data systems become less the subjects of regulatory scrutiny and more of the operational, part-and-parcel furniture of the life science industry.
Besides a few high-risk examples, MDDS manufacturers no longer need to worry about treating their systems like medical devices from a regulatory and compliance perspective.
The need for direct FDA regulatory oversight has passed - but of course, airtight product quality and design controls remain as crucial as ever and should by no means be ignored.
