An Act of Courage: FDA accountability in medical device software
 

On January 7, 2009, a group of physicians and scientists in the U.S. Food and Drug Administration’s Center for Devices and Radiological Health (FDA – CDRH) committed an act of extreme bureaucratic courage. Bypassing multiple layers in the chain of command, “airing dirty laundry in public,” and evoking the long taboo “corruption” word, these CDRH employees sent a lengthy letter to John Podesta, head of the Obama transition team, charging that the FDA was putting the nation’s health at risk through inadequate policies and procedures.

One key paragraph begins:
“The purpose of this letter is to inform you that the scientific review process for medical devices at FDA has been corrupted and distorted by current FDA managers, thereby placing the American people at risk. … This letter provides an inside view of the severely broken science, regulation and administration at the Center for Devices and Radiological Health (CDRH) that recently forced FDA physicians and scientists to seek direct intervention from the U.S. Congress.”

The specific complaints and concerns focused on two major themes:

• that top CDRH managers were “stacking” expert review panels, allowing disqualification of scientists for arbitrary reasons and ordering “physicians and scientists to ignore FDA Guidance Documents”
• an antiquated policy of waiving clinical testing for devices that related to “predicates”, even if those predicates had never been adequately tested. The end result was the revelation that many medical devices in widespread use in the United States had been approved without ever being subject to efficacy clinical testing, and that some of those devices had even bypassed safety clinical testing.

The procedural question, indicting top FDA management for perceived undue influence, was easily dealt with, as the Obama administration used the governmental transition to permit top FDA and CDRH personnel to resign or retire. The predicate policy issue is more complex and is the subject of an ongoing revision of FDA guidelines for approving medical devices.

The process
Prior to any forthcoming revisions, manufacturers of medical devices seeking to market their products in the United States must file a 510(k) form with the FDA. As a part of the filing, the organization requests classification of the device as a Class I (non-invasive, simple device such as bandage or a scalpel); Class III (invasive device clearly requiring clinical testing for safety and efficacy, such as a pacemaker or aortic stent); or Class II (the in-between situation). It is the Class II devices that are most controversial. And the most controversial issue associated with those devices relates to the validation of computer software.

In an attempt to avoid the onerous clinical testing requirements of a pre-market approval application (PMA) associated with all Class III devices, manufacturers of Class II products generally cite a “predicate device”, arguing that the new product is a variant on a device already on the market. But, predicates pre-dating the 1976 testing requirements for medical devices may never have been subjected to clinical tests, and subsequent predicates may have been given exception through cascading reference to pre-test predicates themselves. The result is a confusing situation in which untested devices may cite other untested devices as evidence of their safety and efficacy.

Since few pre-1976 medical devices utilized any software at all (or only the most primitive of software), predicates cited by computerized device manufacturers may well be focused on functional similarities unrelated to automation elements. As a result, complex computerized devices may have been subject only to basic function testing, without any review of product effectiveness or long term safety.

The solution
The FDA is now in the process of revising medical device regulations and guidelines, in part as a response to the house cleaning following the January 2009 letter. While those new procedures are not yet released for comment and are likely to be revised over the next year, some basic changes are clearly in the cards.

The use of a 510k application alone, without any testing, is likely to be reserved for the most basic of products. Even these products are likely to be subject to safety clinical testing (perhaps through a 505(b)2-like procedure of reference to published and refereed studies).

Class II is likely to be squeezed and condensed as all but the most basic Class I devices are subject to efficacy clinical testing (along with safety testing). Organizations citing predicate devices are likely to be asked to provide for review the clinical tests of those predicates: predicates for which clinical test results are not available are likely to be disqualified.

Finally, software-driven devices will be subject to three kinds of tests:

• tests of the functionality and reliability of the automation elements (validation)
• tests for device safety, including long term safety
• either tests of the device effectiveness or review of cited predicate’s clinical results (acceptable when the predicates closely parallel the new device in function and design).

Summary
Whether or not the circumstances among managers and directors of FDA were as described and presented by the authors of that infamous letter, the reality of change regarding the Center for Devices and Radiological Health is upon us. The previous industry standard of chaining predicate approvals as the basis for new approvals for medical devices will be modified. Where prior testing was not accomplished, the chain will be broken and appropriate testing will be required. This will benefit all who use new medical devices in the future.

Sandy Weinberg is an associate professor of health care management and Ron Fuqua is an assistant professor of health care management at Clayton State University. They may be reached at editor@ScientificComputing.com