FDA Gets Digital, Agency Issues Digital Health Policies on PCCP, Cybersecurity and Drug Development

In recent days, the U.S. Food and Drug Administration (FDA) has issued multiple policy documents relating to software and digital health. Two of them relate to software-based medical devices: draft guidance for predetermined change control plans (PCCPs) for artificial intelligence (AI)/machine learning (ML)-enabled device software, and final guidance issuing cybersecurity requirements for device authorization submissions. Another document is a framework addressing the use of digital health tools in the context of drug development. The comment periods for the digital health technologies framework and the draft guidance for AI/ML-enabled device software end on May 23, 2023, and July 3, 2023, respectively.

Using Digital Health Technologies in Drug Development

On March 23, 2023, as part of its commitment under the Prescription Drug User Fee Act (PDUFA VII), the FDA issued the Framework for the Use of Digital Health Technologies in Drug and Biological Product Development (the “Framework”). The Framework is part of the agency’s ongoing effort to focus on modernizing its approach to digital health technology (DHT) derived data in clinical drug development. Note that this initiative is not directly related to the regulation of digital health medical devices, although DHTs used for deriving data for drug development may also constitute regulated medical devices.

Key Takeaways

The Framework outlines a multifaceted DHT strategy that will include both internal programs to support DHT-related activities within the FDA and external programs to engage industry stakeholders in the development and use of DHTs. Specifically, the FDA has established a DHT Steering Committee consisting of members from the Center for Drug Evaluation and Research (CDER), the Center for Biologics Evaluation and Research (CBER), the Oncology Center of Excellence (OCE), the Office of the Commissioner, and the Center for Devices and Radiological Health (CDRH) and its Digital Health Center of Excellence (DHCoE) to support the implementation of the Framework.

The Framework outlines programs aimed at building the agency’s capacity and expertise on DHTs to support consistent policies:

• Building on technical expertise and training to enhance the agency’s internal knowledge. The FDA acknowledges the significance of AI and ML in drug development, including participant recruitment, site selection, clinical trials data collection and analysis, and safety monitoring.
• Facilitating consistency of evaluations across review divisions.
• Addressing statistical considerations in the analysis of DHT-derived data.
• Enhancing the agency’s IT capabilities to support the review of DHT-generated data.
• Hosting meetings with sponsors regarding the use of DHTs.
• Utilizing the agency’s Drug Development Tool Qualification Program to support the qualification of DHTs as drug development tools.
• Issuing additional guidance documents. This year, the FDA plans to publish (1) draft guidance for industry, investigators, and other stakeholders, Decentralized Clinical Trials for Drugs, Biological Products, and Devices and (2) draft guidance for industry, Regulatory Considerations for Prescription Drug Use-Related Software.
• Identifying at least three issue-focused demonstration projects to inform methodologies for efficient DHT evaluation in drug development.
• Continuing engagement with external organizations (e.g., technology companies, medical device manufacturers, health and wellness technology manufacturers, etc.) to facilitate meeting the agency’s outlined objectives.

By the end of the second quarter of fiscal 2023 year, the FDA plans to convene the first of five public meetings and workshops with key stakeholders to gain input on issues related to the use of DHTs in regulatory decision-making critical to drug and biological product development. Comments on the Framework must be submitted by May 23, 2023. Electronic comments can be submitted here.

PCCP Recommendations for AI/ML-enabled Device Software Functions

On March 30, 2023, the FDA issued draft guidance on Marketing Submission Recommendations for a Predetermined Change Control Plan for AI/ML-enabled Device Software Functions. The draft guidance is the first of several guidances that the FDA contemplates regarding the recent statutory change authorizing Predetermined Change Control Plans (PCCPs) for devices cleared under 510(k) or approved under premarket applications (PMAs). PCCPs authorized by the FDA will allow device sponsors to make changes to the device, consistent with the PCCP, which would otherwise require a new 510(k) or supplemental application for a PMA.1 Specifically, this draft guidance provides recommendations to include in PCCPs provided in marketing submissions for machine learning-enabled device software functions (ML-DSFs).

Key Takeaways

The agency highlights the importance of including PCCPs in marketing submissions to allow manufacturers to pre-specify intended modifications to an ML-DSF without requiring additional marketing submissions for each such modification. Specifically, the FDA identifies four primary components of a Modification Protocol where manufacturers should provide key information needed to evaluate the PCCP:

• Data management practices: The FDA anticipates that new data will be collected to support ML-DSF modifications and, therefore, manufacturers should outline how this data will be collected, annotated, curated, stored, retained, controlled and used by the manufacturer.
• Re-training practices: Manufacturers should identify the processing steps that are subject to change for each modification as well as the implementation methods.
• Performance evaluation: Performance evaluation methods for changes should describe the process that will be followed to validate that the modified ML-DSF will meet the specifications identified as part of a specific modification, in addition to maintaining the specifications that are not part of the modification but may be impacted.
• Update procedures: Manufacturers should describe how they will update their devices to implement the modifications, provide transparency to users and, if appropriate, update user training about the modifications and perform real-world monitoring.

The draft guidance also raises certain questions about the scope of changes that the FDA is likely to allow under a PCCP. In particular, while the statutory language is potentially more permissive, the draft guidance suggests that the agency may be disinclined to allow changes to indications for use, at least in certain cases.

On April 13, 2023, the FDA will host a webinar for stakeholders to learn more about the draft guidance. Comments on the draft guidance must be submitted by July 3, 2023. Electronic comments can be submitted here.

Cybersecurity Requirements in Medical Devices

On March 30, 2023, the FDA issued its final guidance, Cybersecurity in Medical Devices: Refuse to Accept Policy for Cyber Devices and Related Systems Under section 524B of the FD&C Act of the FD&C Act. The guidance is part of the 2023 Omnibus budget bill which amended the Federal Food, Drug and Cosmetic Act (FDCA) by adding section 524B, Ensuring Cybersecurity of Devices. The guidance outlines the recent statutory requirements relating to cybersecurity assurances that must be included in device submissions.

Key Takeaways

Under section 524B, sponsors making a submission or application of devices that meet the definition of a “cyber device” must now undergo the following steps to ensure that the device meets cybersecurity requirements:

• Submit a plan to monitor, identify and address postmarket cybersecurity vulnerabilities and exploits including coordinated vulnerability disclosure and related procedures.
• Design, develop and maintain processes and procedures to provide a reasonable assurance that the device and related systems are cybersecure, and make available postmarket updates and patches to address device vulnerabilities.
• Provide a software bill of materials (SBOM), including commercial, open-source and off-the-shelf software components.
• Comply with any other cybersecurity requirements the Secretary may mandate through regulation.

The guidance define a “cyber device” as one that includes: software validated, installed, or authorized by the sponsor as a device, or in a device that has the ability to connect to the internet and contains any technological characteristics that could be vulnerable to cybersecurity threats.

The requirement does not apply to device submissions before March 29, 2023. However, in order to provide a transition period, the FDA generally intends not to refuse to accept (RTA) premarket submissions for cyber devices that do not comply with section 524B until October 1, 2023. Rather, for those submissions, the agency intends to work collaboratively with submission sponsors through the review process.

1 The statutory provision authorizing PCCPs does not address de novo submissions, because the development of a new device classification, with special controls, pursuant to the de novo process, already provides sufficient authority for the FDA to address the availability of PCCPs for such a device. The draft guidance also recognizes the availability of PCCPs for de novo submissions.