Compliance Zen

Should FDA Regulate Medical Apps?

This week, Congress is holding hearings on FDA's plan to oversee and regulate medical apps for smartphones as medical devices. As I wrote back in my Medical Apps, FDA and Patient Data Integrity posting, the regulation of medical apps is a perilous road for FDA to take given the agency's track record when it comes to technology and innovation.

Congress is using the device tax as the leitmotif, but in reality, this three-day hearing is really about whether FDA should even be tackling medical apps right now. Today, the agency can barely get a handle on its current responsibilities to oversee approximately 25% of the entire US economy. Adding the ultra fast-paced landscape of medical apps to FDA's regulatory plate seems to lie somewhere between a foolhardy power grab and a tragically noble safety effort.

According to Clinical Innovation & Technology, there are already 27,000 medical app products on the marketplace today, most of which are either free or less than a few dollars in cost. An additional 500 new medical apps are launched each day. Even if every FDA employee, from Commissioner Hamburg all the way down to the agency's latest summer intern, were to instantly (*poof*) turn into expert "FDA medical app reviewers," the agency does not have enough human beings to review all the apps on the market today much less keep pace with all the new, daily medical app product launches and nor the countless updated revisions to earlier released apps.

For a medical app to go through the FDA 510(k) process takes 3-18 months of FDA review and costs a company hundreds of thousands of dollars. So far, only 80 apps have gone through the approval process.

And to what end?  What known, quantifiable, tangible public health and safety risks are being eliminated or mitigated?

What are the Public Health Risks?

For the vast majority of these apps - at least 90-95% - there are no public-wide health or safety risks not already covered under other rules such as false advertising (FTC) or market mechanics (bug-ridden apps tend not to get used very much). These are the apps geared toward you and me (i.e., the general public).

For the tiny sliver of apps for whom intended users are professional, trained medical personnel - doctors, nurses, clinicians, etc. - the risk is not direct harm to the patient; the risk is that the data within the app will become corrupted somewhow and not allow an accurate reading, an accurate diagnoses, an accurate display of trends, etc.

And its these professional, clinical apps that pose a risk - not to public health and safety - but to the ability of healthcare professionals to rely upon medical apps as helpful tools, just as the healthcare professional relies upon an office computer or Microsoft Word or the fax machine or a sharps disposal bin. FDA does not regulate these as devices...does it?

Oh wait, FDA does regulate sharps trash bins as medical devices (we'll save that for a future post).

A Simple, Common Sense Regulatory Approach to Medical Apps

Last year, Sweden's Medical Products Agency (Sweden's "FDA") published a very reasonable, balanced regulatory view with their guide on how medical software falls under the EU health regulations such as the EU GMPs and EU Annex 11. Sweden clarifies that smartphone medical apps do not - and will not ever - fall under the category of actual medical devices unless the smartphone or tablet is specifically converted into a medical device to be used largely for the detection, diagnoses and/or treatment of medical conditions (such as a smartphone specifically into a patient monitoring device).

Under that rubric, only apps strictly designed for healthcare professionals, clinical settings and/or dedicated to patient monitoring and reporting (to healthcare professionals) would fall into FDA's purview. You can download an English translation of Sweden's simple, common sense approach to regulating medical apps here.

Congress and FDA would best serve the public by adopting such a common sense approach, at least for now until actual risks materialize enough to justify heavier regulatory oversight.

Implementing heavy FDA oversight of medical apps as medical devices in the US today will only verify Winston Churchill's wry observation, "Americans can always be counted on to do the right thing...after they have exhausted all other possibilities."

3D Printing and Nanobots - FDA Challenges Ahead

Among many products, the US Food and Drug Administration (FDA) regulates medical devices such as stents and prosthetics. FDA regulations - and compliance - are predicated on an assumption that medical device production is an involved undertaking that requires expertise, monies, and physical manufacturing.

Yet, what would happen - is happening right now - if anyone can make a fully functional, complex medical device at home in about an hour?

3D Printing of Medical Devices

Late last year, two folks collaborating from opposite sides of the planet created an articulating prosthetic hand using only a cheap 3D printer.

Then, they went one step further – they uploaded the design specs on the internet so anyone can download, make and use this 3D printer prosthetic hand today.  (*Note - this news story has embedded videos to watch as well so you can see the fully articulate hand in action.) The device design is now in the public domain.

Most prosthetics are Class I devices today, requiring only an FDA quality system (21 CFR 820)  and compliance with the medical device reporting rules (21 CFR 803); a 510(k) is not required. Sounds straightforward when such devices are designed and made in traditional manufacturing firms. But using this public domain specification, anyone with access to the internet and a 3D printer can make this Class I device.

So…is every person who prints one of these now an FDA-regulated manufacturer?

FDA rules, regulations and statutes are predicated on an assumption that in order to start a business – in order to design and sell a product – there are significant fixed costs involved, investors may need to be sought, expensive expertise to obtained, and so on.

Now though, all one needs is a cheap 3D printer and an internet connection to download, make and use a fully articulate, Class I medical device prosthetic.

The times they are a changing.

Beyond just the FDA QSR and MDR rules, the new unique device identifier (UDI) regulation will be phased in over the next six year. 3D printed prosthetics – and other Class I devices – will need their own UDI as of 2019, if not sooner. How will this work if anyone can make their own fully functional, Class I device with a 3D printer? Keep in mind – this fully articulate, 3D printed prosthetic is just the first of future medical devices made onsite, at any site, in real-time with 3D printing.

In February 2012, a woman received an impantable replacement jaw made from a 3D printer. Presumably, any hospital could make such an implantable device on the fly, in real-time, fitted to each individual patient’s characteristics. Fabulous from a healthcare perspective but a real challenge in the context of regulations that date back to last century. Will this mean each hospital in the US has to seek its own UDI? Has to have its own quality system and device adverse event reporting programs?

FDA has an overwhelming workload now. Imagine in a few years when wide-spread 3D printing allows real-time, patient-side creation of almost any type of medical device, from prosthetics to implants, at any hospital, doctor's office or home.

Nanobots and the UDI Rule

It’s only going to get worse, though. A colleague of mine is working to commercialize injectable nanobots that scour arteries for plaque and other problems, and then, within 30 days, completely dissolve. Other firms are drawing up plans for similar nanobots to tackle digestive system issues and so on.

Thankfully for the agency, these nanobot based devices are almost a decade away. And the clinical trials will undoubtedly be highly scrutinized.

Here are just two questions injectable (or injestable) nanobots raise:

1. Are these devices or drugs or combination products?
2. How do you apply a UDI to something the eye cannot discern and that will disappear in 30 days?

Fundamentally, the challenge facing FDA – and facing all of us in compliance and quality – is that scientific and technologic progress is far outstripping FDA’s ability – much less any organization's ability – to understand its implications enough to be able to craft reasonable regulations and practical SOPs and policies. This is a challenge that will get far worse before it gets better.

When I give FDA compliance training and workshops to business execs and scientists, I make a point to note that regulation in the US today takes at least 8 years to go from blank sheet of paper to reality (note that the UDI rule was drafted long before Congress actually passed the authorizing FDAAA statute in 2007). The UDI rule took almost a decade to come to fruition in Congress and then be written so as to go into place this year...and with 3D printing (much less imminent nanobot devices), the UDI rule is already outdated before it formally takes effect.

How can FDA handle 3D printed devices, nano-technology medicines and other new advances?

FDA has little choice left but to regulate through guidance. Guidance documents can take less than a year to publish. And for those of us who provide expert regulatory intelligence and quality systems advice to clients, we’ve also noticed that FDA is increasingly reliant as well upon using Warning Letters to explain rules and requirements; see the recent push of late for FDA records management requirements in warning letters and this year's Ben Venue Laboratories consent decree.

Implications for Firms Today

Firms need to proactively manage the gathering and synthesizing of FDA regulatory intelligence, incorporating and applying it into their quality systems and product planning. Relying upon a regulation written before Y2K to tell you what to do in this era of social media, iPhones and 3D printing is akin to relying on a fax machine to quickly send a document. This is why FDA officials of late have cautioned against relying on former FDA officials whose last stint with the agency was twenty years ago; too much has changed since the 1990s.

Those firms large enough to dedicate a team of personnel to regulatory intelligence and its application will manage just fine over the 5-10 years, but what of firms that don’t have that kind of manpower and money? How will firms with more needs than personnel keep up with new FDA expectations and clarifications from guidance documents, warning letters, consent decrees, and even web-based FAQs?

Stay up with FDA guidance, warning letters and FAQs to avoid enforcement and new product delays.

Small to midsized firms should look to some type of outside service. Consider asking an industry expert with a good reputation to provide you regulatory intelligence services (if you need help determining how to get a good a consultant, follow the tips in this article). Ask the trusted compliance expert to provide ongoing review, analysis and suggestions stemming from “recent and newly published relevant FDA guidance documents, warning letters, consent decrees, and FAQs.” Be sure to scope out the service appropriately. Don’t ask for a weekly update if you only plan on incorporating suggestions on a quarterly basis. Most clients I deal with want advice on a monthly or quarterly basis. A good rule of thumb is to expect the expert to spend approximately 12-20 days a year providing you analysis and suggestions from relevant FDA items. Work this out for the consultant’s hourly rate or a fixed fee.

Another option, albeit much less tailored, is to subscribe to a regulatory intelligence newsletter or a quality systems newsletter such as Cerulean’s SmarterCompliance. Keep in mind that published newsletters have a large readership and so you may not find every issue to be of immediate impact. Make sure the newsletter offers a money-back guarantee of some sort so that if you cannot find anything of any value over a handful of issues, you can at least get some monies back.

FDA regulatory intelligence is only as good as its applicability. Talk with your quality system consultant or regulatory intelligence expert on how best to apply the ongoing advice in your organization; he or she should have some level of insight into what works best in day-to-day practice.

From the Pharma Contracting and Outsourcing Conference

This past week I was invited to speak at the Contract Pharma Contracting and Outsourcing Conference in New Jersey, where I spoke on how to sell compliance to senior management.

All too often we assume that compliance is an essential requirement when choosing a critical supplier. And the yet, when cost becomes the deciding factor, compliance becomes compromised or even forgotten for the sake of the bottom line.

Given that more people are hurt each year by toilets than receive FDA warning letters or FDA-483s, the threat of FDA enforcement is hardly a credible compliance encouragement. And so I opened day two of the conference by speaking on how lean FDA compliance can:

• save money
• enable greater revenue and profitability
• simplify compliance
• and generate easy metrics to both support those results and prove effective compliance to FDA.

I was followed by Addam Reynolds, a Consumer Safety Officer with FDA's New Jersey district office who spoke on recent FDA inspectional findings and trends. Mr. Reynolds summarized a number of trends in FDA-483s, comparing the previous year to this one. I've reproduced two of his summary tables below.

As we looked at the data, Mr. Reynolds made several explanatory comments of what was behind the numbers.

First, many of the new investigators now with FDA are well-versed in laboratory and manufacturing operations. A number of new hires have come from those laid off by the pharma industry - an irony not lost on attendees. With increased familiarity of modern-day manufacturing and laboratory settings comes increased scrutiny. Thus the increases in citations for noncompliance with 21 CFR 211.63 and 211.160(b)(4). Mr. Reynolds noted that "Firms are either not qualifying their equipment and instruments at all, or are not doing it right."

Second,the number of citations for 21 CFR 211.68(b), controls over computerized systems, is, in Mr. Reynolds insight to FDA thinking, "really about data integrity and data security." This continues FDA's special enforcement of Part 11 as a rule governing electronic data and records integrity; an enforcement approach that was officially announced in 2010. As Mr. Reynolds noted, most Part 11-relevent 483s happen because firms continue having systems "with little to no data integrity controls."

As I've written about extensively, been interviewed on, and consulted on, Part 11 is less about validating computers per se, and more about ensuring data integrity. To that point, validation is simply a means to an end. The most recent issue of my client newsletter, SmarterCompliance #68, explains in-depth how to use data mapping as a technique to simplify and streamline Part 11 compliance.

The rest of Contract Pharma's conference featured more excellent speakers on various contracting and supplier management issues, including site selection criteria, what to do when your CMO goes bankrupt, and more. If you've not attended this two-day conference before, I encourage you to do so next September. Attendees and speakers are focused on frank conversations about overcoming real-world challenges. I'll be there speaking. I'm thinking of doing something on parallels between choosing a puppy and choosing a supplier - lessons learned and puddles cleaned.

If you're looking for more lean compliance events, check my upcoming workshops and speaking events page on my website. In the near term, I'll be speaking:

• September 25 - webinar on overseeing and verifying Part 11 compliance of your records at critical suppliers
• October 3 - Part 11 enforcement today for OTC manufacturers
• October 11 - webinar on best practices for quality system management reviews (a new requirement under the new EU GMPs Chapter 1 going into effect in January)

I hope you'll join me at one of these events.

 

From the Medtech QA/RA Global Conference

New European medical device regulations are due within 18 months. The new rules will update the current Medical Device Directives (MDDs) for the 21st century, and close the gaps so brutally uncovered by the PIP scandal and the metal-on-metal issues. Industry is proactively adjusting their quality systems and regulatory compliance programs while key executives are encouraging EU regulators to avoid US-style over-regulation.

These were the principle themes infusing the two-day Medtech QA/RA Global Access 2012 conference hosted by the Irish Medical Device Association (IMDA) in Galway, Ireland last week. With over 250 medical technology companies calling Ireland home, including 11 of the top 13 device firms in the world, Ireland has become Europe's center of excellence for devices. And IMDA's Medtech meeting is Ireland's flagship conference.

Much of Day One was devoted to discussions of the planned MDD revisions, with speakers from the European Commission, the European Parliament, the Irish Medicines Board (IMB), Eucomed (the Advamed of Europe), and industry. Europe encourages "responsible innovation" by relying more upon vigorous postmarket surveillance, inspections and adverse event reporting rather than any pre-approval scheme such as the FDA's 510k. Instead, the EU has only pre-market assessments and the CE mark. IMB's Ann O'Conner noted that 65% of vigilence reporting leads to product recall and removal. This state of affairs, with its regulatory burden primarily on the postmarket stage, allows for rapid inclusion of new technology, and new scientific and engineering innovation, an approach I advocated in my latest book, Get to Market Now.

The EU's new MDDs will require a number of elements that are outlined in Global Hamonization Task Force (GHTF) guidelines such as:

• Summary technical evaluation document (STED);
• Unique device identifiers; and
• Adoption of the GHTF's four risk categories for medical devices.

For readers of my client newsletter, SmarterCompliance, adoption of GHTF guidelines should come as no surprise. FDA is moving to GHTF inclusion as well, albeit a bit more slowly than Europe. Whether FDA's "slowly but surely" pace of harmonized rule adoption will inadvertently put US-based device makers at a disadvantage on the global marketplace remains to be seen. European parliamentary elections are scheduled for June 2014, so expect the new MDDs to be in place by then if not sooner.

In addition to a high-level presentation by FDA on "possible, eventual 510k updates," the rest of Day One was taken up with surveys of the state of device regulations in India, China, Russia, the Middle East and North Africa.

Day Two of the conference saw speakers delve more deeply into practical implications and challenges behind the new rules. One set of challenges will be the new clinical rules in the updated MDDs. The IMDA is hosting a two-day conference later this year to address the new EU clinical evidence rules.

I had the privilege of presenting on elements of a defensible record-keeping program for complaint handling and medical device reporting. The message I had for attendees was two-fold:

First, it is clear that complaint handling records and complaint files hold both regulatory and legal risks. Focusing only on quality system compliance can leave a firm vulnerable to disgruntled customers increasingly willing to file a lawsuit to get monetary compensation. Thus, quality auditors must also assess the content of complaint records to help minimize risk to their companies.

Second, complaints can come into a device company through more than just "official" channels. Whether a complaint is made to the saleswoman manning a conference booth or to the company vice-president speaking to a patient advocacy group, each person dealing with the public must receive some level of complaint handling training.

As with any in-person compliance speech or workshop I provide, I gave attendees handouts to help with both of these issues:  an internal quality auditor checklist for reviewing complaint files and a list of complaint documentation do's and dont's.

The next IMDA Medtech conference is scheduled for 2014 just as the new EU MDDs come into force. It promises to be an exciting event, so keep an eye out for announcements.

In the meantime, consider attending some of these events where I'll be offering advice on optimizing your quality system and regulatory compliance programs:

• June 14 teleconference on defensible documents
• June 22 speech on the role of IT departments in effective regulatory compliance
• July 25 teleconference on effectively managing an FDA inspection
• July 31 workshop on 21st century supplier management and qualification

More upcoming lean compliance events can be found on my upcoming events page on the Cerulean website.