How Will the FDA and the EU Regulate my Mobile Medical App?

Vice President of Global Regulatory Affairs, Theorem Clinical Research

Introduction

Just two years ago there were more than 100,000 health-related apps available for download just from Apple’s iTunes Store and Google’s Play Store. This year, it is estimated that more than a third or 500 million of the estimated 1.4 billion global smartphone users will have installed some type of mobile medical application. These numbers are expected to continue their explosive growth with more than 50 percent of the 2018 projected smartphone population of 3.4 billion expected to have downloaded at least one mobile health application. While most of the early health-related apps were educational in nature, were intended to track exercise or weight loss, or provided motivation/instruction for weight loss or smoking cessation, the kinds of apps also have expanded.

More recently, application designers have begun to take advantage of the enhanced computing power of later model smartphones, tablets and other devices and their improved visual displays to create new categories of portable medical devices. Not surprisingly, with the burgeoning advancement of technology and the growing patient trend for self-diagnosis and treatment, regulators have begun to scrutinize mobile medical apps. The approach taken by regulators in the U.S. and the EU show striking similarities. This article will focus principally on the FDA’s Mobile Medical Application Guidance initially issued in Sept. 2013 and was recently updated and re-released on February 9, 2015 to be consistent with FDA’s related Guidance on Medical Device Data Systems, Medical Image Storage Devices and Medical Image Communication Devices. While an equivalent formal guidance has not been published by EU regulators, comparisons of the regulatory controls for mobile medical apps between the two regions will be discussed.

The FDA Guidance and EU Corollary Approach

FDA and European regulators recognize the potential benefits that mobile medical applications can provide to help patients gain access to useful information and manage their own health and wellness.

The mobile medical app industry is moving very quickly with new tools being adopted almost as quickly as they can be developed. The FDA’s guidance is intended to provide a framework without unduly restricting medical application development.

FDA and EU regulatory authorities will exert their oversight of mobile medical apps consistent with their respective legislative and regulatory frameworks covering medical devices. That is to say, a mobile medical app will first need to fall under the relevant statutory definition of a medical device before the authorities will exercise oversight. For the purposes of this white paper, I will paraphrase and create a sort of “straw man” definition of a medical device to facilitate our review. A medical device is generally an instrument, apparatus, appliance, machine or contrivance intended for use in the diagnosis, cure, treatment, mitigation or prevention of disease. This is a narrowly constructed definition for a medical device that admittedly ignores certain finer distinctions of both EU and U.S. law, which are unnecessary to, and would only complicate, our further examination of this topic in this white paper.

The FDA has decided to implement a three-tiered approach in considering mobile medical applications: medical devices that the FDA will regulate; medical devices for which the FDA will exert enforcement discretion; and apps that do not meet the definition of a medical device.

Apps as Devices the FDA Will Regulate

Given the immensity of the present mobile app marketplace and the explosive growth projected in the short term, it appears prudent that the FDA is taking a tailored, risk-based approach to focus its regulatory attention on those mobile medical apps that meet the statutory definition of a medical device and are also intended to be used as an accessory to a regulated medical device or transform a mobile platform into a regulated device. Some notable examples include: mobile apps that connect to a medical device for the purpose of controlling the operation of the device (e.g., an app that alters infusion pump settings), apps that display, transfer, convert or store patient-specific data from a connected device (e.g., apps that transmit patient data to a central nursing station), and apps that transform a mobile platform into a medical device (e.g., apps that use a sensor or lead to measure ECG). Appendix C of the FDA’s guidance provides a lengthy and detailed list of many such devices that will draw the greatest oversight from the FDA.

In choosing this approach, the FDA will focus its limited resources on apps whose functionality could pose a risk to patients if they were to fail to operate as intended. The FDA urges manufacturers of mobile apps that might fit the definition of a device to follow the Quality System Regulation (QSR) in designing and developing their mobile apps. QSR includes the requirement for good manufacturing practices. In addition, the requirements for a relevant premarket submission, depending upon device classification, would also apply. The FDA’s guidance (Appendix D)  provides a very nice overview of the relevant regulatory requirements for medical devices including medical device facility and device listing requirements, investigational device exemption requirements, labeling requirements, adverse event reporting, QSR and others.

Apps as Devices but FDA Will Exert Enforcement Discretion

Many mobile apps that may meet the regulatory definition of a device but pose minimal risk to patients will be afforded FDA enforcement discretion, meaning that the FDA will not expect manufacturers to submit premarket review applications or to register and list their apps with the agency. The FDA will exert enforcement discretion for apps, among others, that organize and track a patient’s health information or that help patients self-manage their disease without providing treatment suggestions, apps that automate simple tasks for health care providers or apps that provide access to personal health records or electronic health record systems. A comprehensive list of detailed examples can be found in Appendix B of the guidance.

Apps That Aren’t Medical Devices

Mobile medical apps that do not meet the statutory definition of a medical device will not be regulated by the FDA. Apps that merely provide access to electronic copies of medical texts or reference materials or general patient education materials are not considered devices and therefore not subject to FDA regulation. Likewise, educational tools for use by health care providers for medical training purposes are not considered medical devices. Mobile apps that automate general office procedures and are not intended for the diagnosis or treatment of disease would also not be considered medical devices. From an EU perspective, these types of apps do not achieve a therapeutic or diagnostic effect “in or on the human body” as required by the medical device definition under the EU Medical Device Directive.

Therefore, these apps that solely log, record or track general health and wellness information, even though related to maintaining general health and wellness, are not considered to be devices in either the EU or the U.S.

Finally, the FDA’s mobile medical app policy and the EU’s directive do not apply to mobile apps that function merely as an electronic health record.

Conclusion

FDA and EU regulators have expressed their interest in directly regulating only those mobile medical apps that meet their respective statutory definitions of a medical device AND present potential risks to patients. This tempered approach will allow for a focused oversight on a very small subset of the ever-growing mobile medical app marketplace. The FDA’s guidance provides a framework for answering most questions that a manufacturer might have regarding the level of regulatory control that will be applied to mobile medical apps. The FDA recognizes that its guidance does not expressly discuss every possible mobile medical app and has provided for multiple contact points - phone, email, online, letter, etc. - for manufacturers to inquire further about their specific app and the regulatory controls that will be applied.

Kamerow, D. BMJ 2013:347:f6009