FDA Issues Final Guidance on Multifunctional Devices
On July 29, 2020, the U.S. Food and Drug Administration issued final guidance on the regulation of devices with multiple functions, Multiple Function Device Products: Policy and Considerations (“final guidance”). This guidance, which finalizes a draft issued April 27, 2018, implements a requirement of the 21st Century Cures Act (“Cures Act”) that prohibits FDA from directly regulating non-“device” software functions in digital health products. Like the draft, the final guidance covers more than just software functions, however, and instead addresses all products that include both device and non-device functions. Any manufacturer of a product that includes both device and non-device functions should therefore pay close attention to this guidance.
Key Updates to the Draft Guidance
The final guidance is largely similar to the draft version discussed in a previous Ropes & Gray alert, but provides further clarification regarding FDA’s expectations for device manufacturer risk assessment processes, including new language on assessing cybersecurity risks associated with non-device functions. The guidance also provides additional information on FDA’s expectations for premarket submissions for multiple function device products, including information on labeling claims addressing non-device functions. The guidance includes a new flow-chart illustrating how FDA will assess the impact of non-device functions on device functions when reviewing premarket submissions and a new discussion of modifications to previously approved or cleared multiple function device products.
Like the draft, the final guidance uses the term “multiple function device product” to refer to a product that contains at least one device and one non-device “function.” The final guidance defines a “function” as a distinct purpose of the product, which could be the product’s intended use or a subset of that intended use. A “device function” is a function that meets the definition of a device under section 201(h) of the Federal Food, Drug, and Cosmetic Act (“FDCA”), whereas an “other function” refers to a function of a product that does not meet the definition of device, meets the definition of device but is not subject to premarket review (e.g., is 510(k)-exempt), or meets the definition of device but is a function FDA has expressed its intention not to regulate as a matter of enforcement discretion.
The final guidance recommends that a manufacturer conduct a risk assessment to determine whether an “other function” has a negative or positive impact (or no impact) on the device function-under-review. Such an assessment must be documented as part of design validation under 21 CFR 820.30(g).
Section VI of the final guidance provides an overview of how FDA will assess the impact of an “other function” on a device function-under-review in the premarket review context. When evaluating such an “other function,” FDA will consider two questions:
- Is there an impact on the safety or effectiveness of the device function-under-review as a result of the “other function?”
- If there is an impact, could it result in increased risk or have an adverse effect on the performance of the device function-under-review?
These questions and relevant considerations for manufacturers are outlined in a flow-chart newly added in the final guidance. If a manufacturer determines that an “other function” impacts the safety and effectiveness of the device function-under-review, FDA recommends that the manufacturer evaluate that impact and address the “other function” in its hazard analysis. The existence of a relationship between the “other function” and the device function-under-review does not necessarily mean that there will be an impact on safety and effectiveness. FDA provides a list of detailed questions for manufacturers to consider when determining the impact of an “other function.”
If the “other function” has a positive impact on the function-under-review, manufacturers should identify the beneficial impact and confirm that there will be no adverse impact on the device function-under-review if the “other function” fails to operate as intended. If the “other function” will have a negative impact, manufacturers should identify whether there could be increased risk or adverse effects on performance due to the combination of the “other function” with the device function-under-review. FDA then provides examples of potential impacts to safety and impacts to effectiveness. Safety impacts are often associated with risk – for example, the “other function” could increase the severity of harm associated with a hazardous situation identified for the device function-under-review. Impacts to effectiveness typically impact the performance of the device, such as the responsiveness, usability, or efficiency of the device.
The final guidance adds specific recommendations that manufacturers’ design and risk assessment processes evaluate the cybersecurity risks of an “other function.” In so doing, FDA recommends that manufacturers assume that such other functions “may be employed (maliciously or unintentionally) to cause an adverse impact on the device function-under-review (e.g., as a result of a cyberattack).” FDA advises that, as a matter of device design, some level of separation of the device function-under-review from the “other function(s),” such as modular or separation architectures, may be necessary to mitigate cybersecurity risks. Additionally, FDA recommends that manufacturers employ software transparency methods such as a Software “Bill of Materials” to help identify dependencies between a device function-under-review and “other function(s)” and vulnerable software components in “other functions” that could impact device functions.
Content of Premarket Submissions
Section VII of the final guidance addresses the recommended contents of a premarket submission for a device function-under-review of a multiple function device.
In the draft guidance, FDA stated that if sponsors determined that there could be an adverse impact on the device function-under-review, they should undertake risk assessments and appropriate verification and validation testing to characterize safety and performance of the device function-under-review, and provide that information in their premarket submission. However, in the final guidance, FDA now recommends that manufacturers include in their premarket submission an impact assessment with information related to impacts of “other function(s)” if the impact could 1) adversely impact the device function-under-review or 2) positively impact the device function-under-review and this fact will be represented in the device function-under-review’s labeling (referred to as “labeled positive impact”).
According to the final guidance, a premarket submission for a device function-under-review should include the following:
- Indications for use: Sponsors should include only the indications for use of the device function-under-review. Sponsors should not include indications for use for any “other function” unless the sponsor would like positive impact to be considered in FDA’s assessment of the device function-under-review.
- Device description and description of functions: Sponsors should include a description of “other function(s)” that could have either an adverse impact or a labeled positive impact on the device function-under review, and should address how the device function-under-review is impacted by each of the “other function(s).” They may also describe “other functions” that do not have an impact or could have a positive impact not suggested in the labeling of the device-function-under review.
- Labeling: Sponsors should include a description of the “other function(s)” adequate to ensure appropriate use of the device. To comply with applicable statutes and regulations, it may also be necessary to include additional information or limitations associated with the “other function(s)” or other instructions appropriate for the device.
- Architecture and design: If either the device function-under-review or the “other function(s)” include software, the sponsor should include architecture and design documents appropriate to the software level of concern and should provide detail to understand how or if the “other function(s)” interact with or impact the device function-under-review.
- Device hazard analysis: This analysis should include results of the risk-based assessment of potential adverse or labeled positive impact of the “other function.” The risk-based assessment should document any risk mitigations used to reduce any increased risk or adverse effect on performance due to the combination of the “other function” and device function-under-review.
- Requirements and specifications: This should include detail to describe any expected relationship, utility, reliance, or interoperability with the “other function.”
- Performance testing: Performance testing should be conducted considering aspects of the “other function(s)” that have either an adverse or labeled positive impact on performance.
- Submission summary: FDA will provide a statement that describes the extent of the product’s assessment, such as with a statement in the applicable summary (e.g., 510(k) Summary or PMA Summary of Safety and Effectiveness Data (SSED)).
Modifications to “Other Function” of a Multiple Function Device Product
In the event that there is a modification to the “other function” of a multiple function device product, FDA recommends that manufacturers determine whether the change could significantly impact the safety or effectiveness of the device function that was the subject of FDA review. If there is potential for either adverse or labeled positive impact, FDA advises reviewing guidance regarding changes to existing 510(k)-cleared or PMA-approved devices to determine whether a new premarket submission is necessary. With regard to positive impacts, unless the impact is a labeled positive impact, FDA does not intend to enforce applicable premarket submission requirements. Sponsors should document the impact assessment and justification for determination of the impact of the modification of the “other function” on the device function-under-review in accordance with the sponsor’s quality system. To the extent that any modification to the “other function” is part of a combination product submitted under a drug or biologic product application type, the information related to the change should be submitted using the drug or biologic submission, if required.
Section IX of the final guidance discusses the application of other device and postmarket requirements. General control requirements apply to device functions subject to 510(k), PMA, de novo, or humanitarian device exemption (HDE) requirements, and to device functions that are 510(k)-exempt. For example, device functions in multiple function device products must comply with Quality System Regulation (21 CFR Part 820) and Medical Device Reporting requirements (21 CFR Part 803).
Lessons from the Guidance
The final guidance provides further clarification as to how FDA conceives of its authority to regulate multiple function devices consistent with the Cures Act. It clarifies requirements related to the impact assessment and provides recommendations regarding cybersecurity risk and modifications to “other functions.”
Companies that seek to develop multiple function device products should consider designing their product with a clear demarcation between the device and other functions and ensuring that they have robust cybersecurity procedures in place. Additionally, companies should carefully document any impact of the “other function” on the safety and effectiveness of the device function. Even if FDA does not require disclosure of all positive impacts in the premarket submission, this information will be important to ensure quality compliance.
Additionally, companies developing multiple function device products should consider whether any planned modifications to the “other function” may require a new premarket submission or, in the case of a combination product, a drug or biologic submission. Given the resources required to submit a new premarket submission, companies may prefer to structure modifications so as to avoid potentially impacting the device function-under-review.
- “Deciding When to Submit a 510(k) for a Change to an Existing Device” Guidance, https://www.fda.gov/regulatory-information/search-fda-guidance-documents/deciding-when-submit-510k-change-existing-device; “Deciding When to Submit a 510(k) for a Software Change to an Existing Device” Guidance, https://www.fda.gov/regulatory-information/search-fda-guidance-documents/deciding-when-submit-510k-software-change-existing-device, or “Modifications to Devices Subject to Premarket Approval (PMA) - The PMA Supplement Decision-Making Process” Guidance, https://www.fda.gov/regulatory-information/search-fda-guidance-documents/modifications-devices-subject-premarket-approval-pma-pma-supplement-decision-making-process. back to top