FDA Commissioner Scott Gottlieb dropped three new FDA guidance documents today, two draft guidances and a final guidance. One draft guidance is the long-awaited guidance on clinical (as well as patient) decision support, while the other deals with changes to medical software policy based on Congressional mandates in the 21st Century Cures Act. The final guidance is on Software as a Medical Device (SaMD) and is based on the work of the International Medical Device Regulators Forum (IMDRF). This is the conclusion of a busy week for the agency, which has also recently published guidelines around the artificial pancreas and 3D printing. 

"Today, we’re announcing three new guidances — two draft and one final — that address, in part, important provisions of the 21st Century Cures Act (“Cures Act”), that offer additional clarity about where the FDA sees its role in digital health, and importantly, where we don’t see a need for FDA involvement," Gottlieb said in a statement. "We’ve taken the instructions Congress gave us under the Cures Act and are building on these provisions to make sure that we’re adopting the full spirit of the goals we were entrusted with by Congress."

The Cures Act guidance, "Changes to Existing Medical Software Policies Resulting from Section 3060 of the 21st Century Cures Act" isn't exactly full of surprises — it lists four categories of device that the FDA won't regulate, and the list is the same as the one in the law, which passed exactly one year ago today. Those include software used for administrative purposes in a hospital; wellness software for "maintaining or encouraging a healthy lifestyle;" EHR software; and software for transferring, storing, or displaying data.

Similarly, the SaMD guidance hasn't changed dramatically from the draft guidance floated in October 2016. The October draft guidance was literally an IMDRF document, whereas the final guidance is an FDA document that draws heavily on the IMDRF document, but the basic categorization in both documents is the same.

"This final guidance provides globally recognized principles for analyzing and assessing SaMD, based on the overall risk of the product," Gottlieb said. "The agency’s adoption of these principles provides us with an initial framework when further developing our own specific regulatory approaches and expectations for regulatory oversight, and is another important piece in our overarching policy framework for digital health."

Of the three, the clinical decision support guidance is the most noteworthy — and the most controversial. The new guidance lays out forms of clinical decision support that won't be regulated, but does so based on the degree of human involvement, rather than based on risk. Essentially, the document says CDS won't be regulated if the physician can independently review and understand the basis of the software's decision. Some, like Foley & Lardner partner and healthcare lawyer Nathaniel Lacktman, applauded the agency for the approach.

"Digital health companies and telemedicine providers should take a moment today and tweet a big thank you to Commissioner Scott Gottlieb (@SGottliebFDA) and the FDA for this long-awaited guidance," he told MobiHealthNews in an email. "Not only has the FDA made great leaps to educate digital health software developers, Commissioner Gottlieb's direction clearly recognizes the need not to over-regulate our industry and instead maintain the delicate balance between protecting patient safety and promoting health innovation."

On the other hand, Bradley Merrill Thompson, an FDA expert, lawyer at Epstein Becker Green, and, notably, leader of the CDS Coalition, said he was disappointed by the guidance because it fails to deregulate low-risk devices.

"What I think many of us in industry were hoping for was an effort by FDA to distinguish high from low risk as a basis for regulation. We didn’t get that. Worse, it appears based on the guidance that FDA is not interested in drawing that line," Thompson told MobiHealthNews in an email. "...The bottom line seems to be that software that does not provide a reasonable basis for reviewing the recommendation will always be regulated regardless of risk. So if, for example, software uses a complicated machine learning algorithm to discern which patients have the common cold, the software will be regulated simply because it uses a complicated algorithm that the physician user can’t mentally duplicate. The software will be regulated even though it is low risk."

The CDS Coalition released its own voluntary guidelines on CDS risk assessment in September which demonstrate an alternate approach. By contrast, Thompson sees the FDA's guidance as essentially doing the bare minimum of what the 21st Century Cures Act requires. 

"Of course FDA needed to abide by the statute, but it didn’t need to stop there," he said. "Indeed, FDA recognized that when it extended the statutory language to include software sold to patients and caregivers. That was good. But with regard to professional users, FDA stopped at the edge of the statute."