Leveraging the FDA’s Digital Health Policies for COVID-19 Solutions

• December 08, 2020

• Ty Kayam , Microsoft
• Ryan Johnson , Fredrikson & Byron PA

Digital health solutions are becoming very useful during the COVID-19 pandemic. These solutions may be deployed in various ways, such as for the dissemination of public health information, following the spread of the virus, or tracking the wellbeing of individuals. There is no shortage of use cases for digital health solutions, and given the importance of distancing, now may be a good time for innovators to consider technology-based solutions related to the pandemic.

This Bulletin is intended to explain the oversight of the Food and Drug Administration (FDA) over digital health solutions and identify types of solutions that may be developed and deployed without significant regulatory hurdles. In addition, for digital health solutions that may be considered higher risk by the FDA, the Bulletin identifies legal pathways to authorization that may be leveraged during the COVID-19 pandemic.

FDA Oversight over Digital Health

In general, the FDA has oversight over “devices”[1] under the Food, Drug, and Cosmetic Act (FDCA). Software may be a device on its own or may be a component, part, or accessory of a medical device, subject to FDA oversight. Software functions associated with a medical device are called “device software functions” and can be in the form of Software as a Medical Device (SaMD) or Software in a Medical Device (SiMD).[2] In addition, device software functions intended for use on mobile applications or platforms are referred to as “mobile medical apps.” Both device software functions and mobile medical apps are considered digital health solutions, and the FDA focuses on the functionality of the solution, rather than the platform when determining its oversight authority.

The FDA did not historically exercise its full oversight authority in the area of digital health. Rather, it took a risk-based approach. In December 2016, the 21st Century Cures Act codified this approach by clarifying that the term “device” excludes five types of software functions; uses related to: (1) administrative support of a health care facility; (2) maintaining a healthy lifestyle; (3) electronic patient records; (4) transfer, storage, conversion, or display of medical device, imaging, and laboratory data; and (5) certain kinds of clinical decision support software.

Some regulations explicitly exempt certain devices from FDA’s oversight authority. For instance, general purpose software intended for broad, non-medical use (e.g. word processing software) or software used in research, teaching, or analysis that is not intended for commercial distribution are exempt from most requirements for devices under the FDCA regulations adopted by the FDA.[3]

In certain circumstances, although a solution meets the definition of a device, the FDA exercises enforcement discretion and chooses not to regulate the solution. As an example, the FDA has stated that it intends to exercise enforcement discretion for software functions that automate simple tasks for health care providers or that help patients self-manage their disease or conditions without providing specific treatment or treatment suggestions.[4]

In sum, the FDA actively regulates digital health solutions if the solution meets the definition of a medical device unless an exemption applies or the FDA chooses to exercise its enforcement discretion.

FDA Regulation of Digital Health Solutions During COVID-19

On March 26, 2020, the FDA issued guidance entitled, “Digital Health Policies and Public Health Solutions for COVID-19,” which identified various types of solutions that will not be regulated by the agency.[5] Specifically, the guidance identifies the following types of solutions as ones that are not regulated by the FDA:

• Solutions intended for use by governmental public health officials for communication purposes, including communications with individuals who may have been exposed to COVID-19;[6]
• Solutions designed for public health surveillance, such as general purpose location tracking or contact tracing;[7]
• Solutions that provide educational information about COVID-19;[8]
• Solutions that provide patients with commonly used reference information related to COVID-19, including solutions that are patient-specific so long as they are intended for patient awareness, education, and empowerment;[9]
• Solutions that provide individuals who are self-quarantining with information about their health conditions or treatments;[10] and
• Videoconferencing software even when intended for use in telemedicine.[11]

In addition, the FDA specifies that it will exercise enforcement discretion for the following types of software functions:

• Use of patient characteristics, such as age, gender, and behavioral risk factors, to provide patient-specific screening, counseling, or preventative recommendations from established authorities;[12]
• Offering a checklist of common signs and symptoms to provide a list of possible medical conditions and advice when to consult a provider;[13]
• Guiding a user through a questionnaire of signs and symptoms to provide a recommendation on the most appropriate type of health care facility;[14]
• Initiation of a call to a pre-specified nurse or emergency number using broadband or cellular technology;[15] and
• Enabling a patient or caregiver to send an alert or emergency notification to first responders.[16]

The FDA will not actively regulate COVID-19-related digital health solutions with the foregoing functionalities, as they are considered lower risk. Note, however, that the FDA can revoke or modify its enforcement discretion at any time.

Emergency Use Authorization for High Risk Devices

There are certain devices that the FDA considers higher-risk and, for such devices, the FDA has expressed interest in engaging with manufacturers through the Emergency Use Authorization (EUA) process.[17] During the current public health emergency, a solution may be considered for an EUA if the benefits of the product outweigh the risks when used to diagnose, prevent, or treat COVID-19.[18] In making this assessment, the FDA reviews the totality of the scientific evidence available for consideration.

At a high level, the EUA stems from the Pandemic and All-Hazards Preparedness Reauthorization Act of 2013 (PAHPRA), which equips the FDA with authority to support emergency preparedness and response. Under this authority, the FDA is able to authorize products called medical countermeasures (MCMs), including devices, to be used in an emergency to diagnose, treat, or prevent serious or life-threatening illnesses caused by a chemical, biological, radiological, or nuclear (CBRN) agent, including emerging infectious disease threats.

The FDA recommends that EUA requests include a well-organized summary of the available scientific evidence regarding the product's safety and effectiveness, risks and benefits, and any available, approved alternatives to the product.[19] According to the FDA, the exact type and amount of data needed to support an EUA may vary depending on the nature of the declared emergency or threat of emergency and the nature of the candidate product.[20] The FDA expects material to be provided in a reviewable form and sufficiently complete to permit substantive review.[21] The FDA has the authority to seek additional data and information to ensure the statutory requirements for an EUA are satisfied.[22] The extent of, and timelines for, review of such submissions will be determined on a case-by-case basis and will depend on the nature of the submission, the circumstances of the emergency, and the workload of the review staff.[23] The FDA strongly encourages sponsors to contact the appropriate FDA center before submitting a formal request for an EUA.[24]

The EUA can be used for MCMs, including devices, to obtain waivers from requirements and bring the solution to market. Note, however, EUAs based on a public health emergency are no longer effective after the emergency declaration has been lifted.

Product Liability for Digital Health Solutions

The risk of product liability claims should also be considered when introducing a digital health solution related to COVID-19 to the market. For medical devices broadly, product liability claims may arise due to a design defect, manufacturing defect, marketing defect, or failure to warn. In addition, claims may also be brought under the theories of strict liability, breach of warranty, misrepresentation, or fraud. The product liability risk of each digital health solution differs on a case-by-case basis. As such, developers of digital health solutions should generally assess the types of claims that could arise during the development of the solution and consider implementing certain risk mitigation strategies such as insurance coverage and contractual terms.

It may be worth noting that during the COVID-19 public health emergency, the Public Readiness and Emergency Preparedness (PREP) Act allows for protections against product liability claims for certain kinds of solutions. Passed in December 2005, the PREP Act provides the Secretary of the Department of Health and Human and Services (HHS) with the ability to issue a declaration providing immunity for certain countermeasures that are necessary to respond to a public health emergency. On March 17, 2020, HHS Secretary Azar issued a declaration under the PREP Act to provide liability immunity for activities related to countermeasures against COVID-19,[25] including for devices authorized for emergency use under an EUA.[26] For these countermeasures, the PREP Act provides immunity under federal and state law for “loss caused by, arising out of, relating to, or resulting from the administration to or the use by an individual of a covered countermeasure.”[27]

In other words, in the case of a higher-risk digital health solution for which the EUA process can be used, the PREP Act acts as protection against claims of product liability. However, for any other digital health solution, product liability considerations should be factored in during product development or commercialization of the solution.

ARTICLE TAGS

• Health Information and Technology Practice Group
• Coronavirus Pandemic Hub
• Health Information
• Life Sciences