Regulatory and Technical Aspects of Software as Medical Device (SaMD)

Nagalakshmi S; Sangeetha Priya S; Aravind R

doi:10.37421/2167-7689.2023.12.358

Review Article - (2023) Volume 12, Issue 6

Regulatory and Technical Aspects of Software as Medical Device (SaMD)

Nagalakshmi S^*, Sangeetha Priya S and Aravind R

^*Correspondence: Nagalakshmi S, Department of Pharmaceutics, Deemed to be University, Chennai, India, Email:

Author information

Department of Pharmaceutics, Deemed to be University, Chennai, India

Received: 30-Mar-2023, Manuscript No. PBT-23-93633; Editor assigned: 04-Apr-2023, Pre QC No. PBT-23-93633(PQ); Reviewed: 18-Apr-2023, QC No. PBT-23-93633; Revised: 18-May-2023, Manuscript No. PBT-23-93633(R); Published: 16-Jun-2023 , DOI: 10.37421/2167-7689.2023.12.358 , QI Number: PBT-23-93633
Citation: S, Nagalakshmi, Sangeetha Priya S and Aravind R. "Regulatory and Technical Aspects of Software as Medical Device (SaMD)." Pharmaceut Reg Affairs 12 (2023): 358.
Copyright: © 2023 Nagalakshmi S, et al. This is an open-access article distributed under the terms of the creative commons attribution license which permits unrestricted use, distribution and reproduction in any medium, provided the original author and source are credited.

Abstract

Software is revolutionizing how doctors practice medicine, customers control their health, and patients and providers interact. Software that can perform advanced medical functions software as a medical device is a game-changing innovation in digital health technology (SaMD). SaMD may diagnose ailments, prescribe medications and offer clinical treatment recommendations. The US FDA, EU and Australia TGA also specified general platforms. To overcome the challenges while interpreting software product fits into the medical device framework, IMDRF has developed different guidance including risk based categorization to determine possible levels of premarket reviews and Real-World Evidence (RWE).) IMDRF plays a similar function in enabling the regulators to risk-stratify submissions and focus resources on products that pose the greatest risk to patient safety. While SaMD products are not new, there are many new players in the SaMD space to better regulate iterative devices. One of the key goals is to identify the excellence of the SaMD Regulatory paradigm regulation of these products will need to radically change to accommodate new SaMD manufacturers and the technology’s rapid evolution and to harness SaMD’s ability to capture RWD to create a collaborative, innovative SaMD community. This review aimed to describe the regulatory and technical aspects of the software as a medical device and regulatory transformation of digital health rapidly expanding regulations by different health authorities.

Keywords

SaMD • IMDRF • Risk categorization • ISO/IEC • Application lifecycle management • GDPR

Introduction

Prospects for (SaMD) products are quite promising. This program has the potential to not only enhance the identification and treatment of ailments but also grant people a greater degree of autonomy when it comes to their health. Moreover, the data collected by these goods can expedite the process of innovation and lead to more advanced algorithms. SaMD refers to a software program that functions as an independent medical product and should not be confused with SiMD, which is simply software that helps medical device hardware to operate.

The most significant characteristic of SaMD is that it can carry out medical tasks without needing hardware. It is usually used in conjunction with non-medical computer systems linked to the internet, regular medical devices or other basic computing platforms [1].

Literature Review

Medical device definition

A medical device is any type of equipment, tool, implant, reagent, software, material, or other article intended by its maker to be used in humans, either independently or with other items, for one or more particular medical purposes [2].

In Vitro Diagnostic (IVD)

In Vitro Diagnostic (IVD) medical device’ means a medical device, whether used alone or in combination, intended by the manufacturer for the in-vitro examination of specimens derived from the human body solely or principally to provide information for diagnostic, monitoring or compatibility purposes [3].

SaMD definition

The International Medical Device Regulatory Forum (IMDRF) defines SaMD as "software designed to be used for one or more medical purposes to perform those operations that are not part of the medical device. It serves individual patient-specific medical purposes (i.e. a specific disease or condition) (Figure 1).

Figure 1. Medical software use falls into four categories.

Some of the primary features of SaMD

Data-driven better health outcomes: SaMD has the potential to augment existing medical treatment methods and equipment.

Speedy production and feedback for accelerating innovation: SaMD can supplement the existing medical devices and bring about faster software solutions that are more affordable to upgrade than hardware. This facilitates rapid manufacturing and feedback, thus speeding up the process of innovation.

SaMD basic programming model

The SaMD programming model is a form of software that takes digital content as the input and, based on a set of rules and a model, produces an output that is designed for use in the medical field (Figure 2).

Figure 2. SaMD basic programming model.

What is and is not SaMD?

A rational perspective on risk categorization of software as a medical device. The severity of the medical device and the output of the software provide information for clinical management, treatment monitoring, and therapies used to determine the IMDRF SaMD risk level. To assist businesses in assessing the risk associated with using the software as a medical device, the IMDRF framework was created (SaMD) (Table 1).

**Table 1.** Samd categorization principles.
Category I	Category II	Category III	Category IV
Astigmatism may be diagnosed using software that analyses pictures and eye movement	Software that monitors heart rate	The software detects irregular breathing using a microphone	Software that can perform diagnostic image analysis
Computer programs that record blood pressure data for later	Health data analysis software can be used to forecast the risk of cardiac ailments and estimate the likelihood of asthma attacks	A lesion's fractal dimension is computed via software	Software that produces a structural map with potential development patterns
Software to help with hearing loss self- evaluation	Software that integrates tests and analyses the results to suggest a diagnosis	-	Data-combining software that searches for changeable pathogens by combining information from several sources

SaMD categorization principles

To effectively categorize SaMD, certain fundamentals must be in place. Specifically, the categorization is dependent on having a precise and thorough SaMD definition statement. Moreover, the categorization is achieved by considering the importance of the data obtained from SaMD in making healthcare decisions and managing a specific medical condition or scenario. The following categories are based on the scope of the SaMD's influence on patients or public health (I, II, III, as well as IV). For the public's health to be protected and to prevent death, permanent disability, or any other major deterioration in health, the SaMD's information must be accurate [4].

SaMD in action

Screening and diagnosis: Computer programs that use advanced algorithms can accurately predict the possibility of acquiring a chronic ailment and aid in determining the optimal course of therapy.

Observation and notification: Several vital indicators may be captured using wearable sensors in SaMD systems, and these data can subsequently be followed using the software. The computer records this information and utilizes it to provide precise suggestions and warnings to patients and clinicians [5].

Management of recurrent illnesses and diseases: SaMD is a tool that both patients and doctors may use to collect and understand health data and modify treatment plans for better outcomes.

Computerized therapies: SaMD is helpful for both treating and preventing serious illnesses its capacity to collect and input highly pertinent clinical data into "other medical devices, pharmaceutical product special-purpose transducers, or other ways of administering treatments to a human body [6].

International regulations and technical aspects

In 2013, the international medical device regulators forum established a committee centered on software as a medical device (IMDRF). They are investigating the characteristics that distinguish this type of software. The related documents can be accessed on the IMDRF journal articles website in the "technical documents" area. The Worldwide Electrotechnical Commission (IEC) is an international organization that creates and circulates global standards for all types of electrical, electronic and related technologies (commonly referred to as "electro technology") [7].

ISO, an independent, non-governmental organization, offers a unified framework to ensure the overall performance, safety and quality of goods and Systems [8].

The IEC 62304 is a regulation in the medical area that is especially pertinent to the production and upkeep of medical device software. To guarantee that regulations such as the FDA 21 CFR part 820 and ISO 13485:2016 are followed, SaMD suppliers must incorporate a strong quality control system into the building process. The FDA, Health Canada and the MHRA have created standards for the development of GMLP (Figure 3) [9].

Implementing the IEC 62304 standard's requirements into the software lifecycle

A software quality assurance plan must include the IEC 62304 to achieve its software lifecycle criteria and application lifecycle management is crucial for the development of embedded software products. Therefore, using an efficient ALM solution is essential for developing and monitoring software quality in the medical industry. It enables effective monitoring of the full application lifetime and supports both on-site and remote audits (Table 2 and Figure 4).

Figure 3. Implementing the IEC 62304 standard's requirements into the software lifecycle.

**Table 2.** Medical device classifications.
Regulatory agency	Lowest to highest
International (IMDRF)	I	II	III	IV
EU (MDR)	I	IIa	IIb	III
EU (IVDR)	A	B	C	D
USA (FDA)	I	II	II	III
Safety/Risk classifications
International (IEC 62304)	A	B	C
USA (FDA)	Minor	Moderate	Major

Figure 4. Software verification and validation plan that includes.

Clinical evaluation

The US FDA, EU and Australia TGA have also said that generic platforms on which such medical software may operate or be distributed are not intended by their maker to be used for therapeutic purposes and would not be regulated as a medical device (Table 3).

**Table 3.** Clinical evaluation.
Stages	Clinical evaluation	Remarks
Stage 1	Valid clinical association	Exists a reliable clinical correlation between your SaMD's output and the clinical problem it was designed to treat ?
Stage-2	Analytical technical performance	Does your SaMD properly analyze input data to provide exact, accurate, and trustworthy output data?
Stage-3	Clinical performance	Does the utilization of your SaMD's accurate, dependable, and exact output data enable you to accomplish your goals about your target audience when providing clinical care ?

FDA's approach to regulation for software-based medical devices

QSR Requirements for medical devices, part 820, drug quality system regulation. According to the FDA's digital health innovation action plan, protracted approval processes for SaMD product upgrades may keep patients from receiving life-saving devices. Whether inventors file a 510(k) application (Traditional, special and abbreviated submissions), a self-registration form or a Premarket Approval (PMA) application will determine how long the FDA will take to approve a medical device. Application de novo principles and solutions for a new regulatory framework patients who stand to gain from new digital health technologies, SaMD product developers and regulatory agencies are all involved. The FDA has developed a five-part action plan to help it regulate SaMD-based devices better in 2023 and beyond (Figure 5) [10].

Figure 5. Total Product Lifecycle Management) The plan involves the following steps.

The following concepts constitute the TPLC scheme

The FDA TPLC approach would make it possible to assess businesses and their SaMD products over the course of their lifecycles (from premarket development to post-market performance), giving patients, carers, and other users confidence in the products (Figures 6-8).

Figure 6. The following concepts constitute the TPLC scheme.

Figure 7. The plan anticipates two types of modifications.

Figure 8. PBT-application

RWE (Real-World Evidence) in USA medical device regulations

Incorporating RWE into regulatory decision-making is strongly encouraged by the FDA.

In post-marketing approval and surveillance, examples of RWE and RWD include:

• RWE in post-marketing approval for expansions of bayesian hierarchical analysis was utilized by the sponsor in postmarketing clearance for the extension of indications. RWD was taken from two registry datasets.

• RWD in post-marketing surveillance-Post approval research was carried out to assess efficacy and safety.

EU (MDR) Medical Device Regulation for software-based medical devices: Regulatory Approach. The EU Medical Device Regulation (MDR; 2017/745) and the EU In Vitro Diagnostic Regulation (IVDR; 2017/746) apply to medical devices and in vitro diagnostic devices, respectively. Europe's commission and the medical device coordination group are developing SaMD legislation (MDCG). The MDCG is a professional group that has been chosen to monitor a wide range of topics, including notified bodies, clinical research, post-marketing surveillance, international concerns, the deployment of the EUDAMED database, and recommendations for the use of IVD and Annex IV products (Figure 9) [11].

Figure 9. Medical Device Software (MDSW) can be placed on the market in two different ways.

Discussion

Decision steps for qualification of software as MDSW

The platform's location or the way the software interacts with each other and a device impacts whether MDSW qualifies as a device or an accessory. For MDSW certification, there are five steps (Figure 10).

Figure 10. What qualifies as a medical device in terms of software?

What qualifies as a medical device in terms of software?

• The European Union Medical Device Regulation (EUMDR), which was recently passed, provides definitions, guidelines, classifications and procedural requirements for medical device software standards.

• Various software as medical device categorization guidelines are discussed in EUMDR annex VIII.

• Specifically, Rule 11 of annex VIII, which deals with the categorization of software, refers to the classification of software used either alone or in conjunction with medical equipment.

• Class IIa software is intended to give data that is used to make decisions for therapeutic or diagnostic reasons, except in cases where such decisions may result in a person's death or an irreversible decline in health. Such situations fall under class III unless there has been a significant decline it falls under class IIb if it is related to health or a surgical procedure.

• During a standard checkup, for example, class IIa software may be used to monitor heart rates or other physiological indicators.

The classification is advanced to class IIb, however, if the monitoring is concentrated on critical physiological indications that represent an urgent risk to the patient. It is categorized as class I for all other software (Figure 11).

Figure 11. RWE (Real-World Evidence) in EU medical device regulations.

RWE (Real-World Evidence) in EU medical device regulations

A foundational need for post-marketing clinical follow-up in the EU is that data be constantly produced throughout the product's lifecycle. This is by MDR 2017/745. Also required is the production of RWE on safety and efficacy. The data might come from several sources, such as clinical decision support systems, implanted device datasets, dispensary data and patient assessments, to highlight a few. RWE can show a product's efficacy and safety for both new and used items and analyze a product's performance after it has been launched to the market (for instance, SaMD or health technology) (Figure 12).

Figure 12. The TGA regulatory process for medical device supply in Australia may be split into three steps.

TGA regulatory approach for SaMD

The method taken by Australia to regulate software-based devices is supported by the IMDRF's policy. The laws substantially align with those of the EU. Unless it is exempt, software products that are medical devices must be registered in the Australian Register of Therapeutic Goods (ARTG) to be distributed legally in Australia. Australian software and mobile applications that fulfill the requirements of a medical device are governed by the TGA [12].

The TGA regulatory process for medical device supply in Australia may be split into three steps

TGA enacted new rules on February 25, 2021: In December 2019, the regulations were amended to add a new stipulation for categorizing software-based medical apparatus, known as "Softwarebased, programmable, and programmed medical devices." It's worth noting that In Vitro Diagnostics (IVDs) are exempt from these rules. On February 25, 2021, these regulations will become effective. Producers and sponsors of medical device products listed in the ARTG before February 25^th, 2021 will be offered transitional choices. The regulations address the potential damage that may arise from providing users of these medical devices with erroneous data.

Regulations have been established to include medical apparatus meant for (for instance, in terms of data quality management).

• Screening or identifying an illness or condition.

• Tracking the development or status of an illness, condition, etc.

• Describing or advising a course of therapy or intervention.

• Offering treatment (via the provision of information).

In Japan: The oversight of the SaMD regulation procedure is done by the Pharmaceuticals and Medical Devices Agency (PMDA) and the Ministry of Health and Labor Welfare (MOHLW). General medical devices, controlled medical devices, highly controlled (highrisk) medical devices, and specially controlled (life-threatening) medical devices are the four classifications of SaMD. In December 2019, the Sakigake designating system was put in place due to changes made in the nation's pharmaceutical and medical devices act which would quicken the regulatory approval process for medical devices. This approach takes into account four components: Innovation, efficiency, illness seriousness and Japan's development plan. The regulations also provide for expedited evaluation of orphan drugs, Sakigake products, and products with a certain usage (such as pediatric usage). The PMDA and MOHLW have collaborated to create the IDATEN framework, which lessens the regulatory pressure and ensures the safety and effectiveness of medical devices through consistent tracking and analysis by producers and the PMDA. This has enabled persistent progress in medical device technology [13].

In Singapore: A directive on software-based medical devices and the application of AI in the healthcare industry has been made available by the ministry of health and the health sciences authority. It identifies medical devices and outlines standards for software certification, data correctness, safety, and effectivity, as well as other SaMD-related aspects. Despite this, neither of these regulatory agencies has exactly categorized SaMD, and neither uses the IMDRF's approach for classifying hazards.

SaMD/MDSW risk management connected with its use: Ensuring data accuracy and confidentiality, understanding any racial and cultural dissimilarities in biological features, and exercising caution when dealing with data will all be crucial elements when creating a sound regulatory framework. The General Data Protection Regulation 2016/679 (GDPR) provides standards and restrictions for devices in numerous countries [14].

Initiative to update from a product to a system approach: Instead of relying on medications, it is widely accepted that factors such as tools, personnel, abilities, instruction, culture, workflow, and procedures have a big influence on how software and IT are utilized.

Authorities might additionally impose further restrictions, like ongoing system observation, frequent retraining, software and utilization reviews and a general evaluation of usage details (like to discover possible movements in treatment frequencies and decision forms of users).

Authorities need data and model confirmation and robustness analysis due to concerns about data quality or antagonistic attacks. Authorities might also require that versions with varying levels of liberty be tested: when a tool offers probabilistic suggestions, for example, users' discretion may be more or less restricted. Supervisory authorities may also necessitate medical assessments for SaMD when it is used for its authentic, planned medical purposes, monitor any alterations in behavior over an extended period, and have digital medical records that register all choices that could be associated with the utilization of SaMD (Figure 13) [15].

Figure 13. Recall these important details.

Conclusion

The COVID-19 epidemic has taught us the need to be always flexible. Software-enabled medical devices enable people to take care of themselves and make healthcare products even more comfortable. Even though it's not required by law, SaMD makers that follow these rules will find it simpler to have their medical devices approved by regulators. It is also vital to adopt an intersectional strategy that brings together several government departments to inform the regulatory recommendations this framework should have laws that defend privacy, diversity, data integrity and human rights. According to research, a piece of medical equipment must be marketed for about three to seven years. Unfamiliar developers may grow dissatisfied and abandon working on SaMD products due to problems in having their products authorized and supplied on time. Products that offer a moderate-to-high danger to the health of patients may necessitate a more extensive review procedure. Last but not least, SaMD devices may continually gather medical data such as body temperature, heart rate, test results and other variables. As a result, these items and patient data must be securely protected against any cybersecurity threats. As a result, proper training is required to assure SaMD utilization, improve productivity, and report RWD.

Acknowledgment

I am thankful to my guide who initiated me to work on this topic and I am also thankful to my co-author who contributed to my manuscript preparation throughout.