An introduction to the FDA’s regulation of medical devices

Are you planning to bring your medical device to the U.S. market?  

In this article, prepared in close cooperation with Krzysztof Minicki, Director of Healthcare and Life Sciences at Spyrosoft, we present an overview of the requirements for marketing medical devices, including software, in the U.S.  

Read on to find out: 

– how to determine if your device is considered as a medical device by the FDA, 

– what the medical device classification process looks like,  

– what the various premarket submission pathways are,  

– and how the FDA regulates software as a medical device.  

What is the FDA? What does the FDA do?  

The FDA (Food and Drug Administration) is a federal agency of the U.S. Department of Health and Human Services. The role of the FDA is to protect human life and health, and also to promote novelties in the medical services sector. The FDA is responsible for the control and supervision of medical devices and drugs, but also food safety, tobacco products, cosmetics, veterinary products and more. 

The FDA also determines the rules governing the classification and distribution of medical devices on the U.S. market. We’ll take a closer look at these requirements later in this article. Firstly, let’s see what devices can be considered as ‘medical’, according to the FDA. 

FDA medical device definition 

A medical device is defined in Section 201(h) of the FD&C Act (21 USC 321(h)) as “an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article, including any component, part, or accessory, which is: 

• recognised in the official National Formulary, or the United States Pharmacopeia, or any supplement to them, 
• intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man or other animals, or 
• intended to affect the structure or any function of the body of man or other animals, and which does not achieve its primary intended purposes through chemical action within or on the body of man or other animals and which is not dependent upon being metabolised for the achievement of its primary intended purposes.” 

The way the FDA defines a medical device isn’t very different from how the EU MDR defines it. In both cases, the main criteria are the Intended Use of a device and how it affects the human body.  

Recommended reading: How to determine if your product is a medical device according to the FDA?

What is a combination product? 

As defined by the FDA, a combination product is “composed of any combination of a drug and a device; a biological product and a device; a drug and a biological product; or a drug, device, and a biological product.” An example of a combination device may be a stent placed in a body, which slowly releases a drug into the patient’s blood system.  

It’s important to note that combined devices are subject to additional field-specific regulations, depending on their components. For this reason, their production and distribution may be more challenging.  

CFR – Code of Federal Regulations Title 21 requirements for medical devices 

The manufacturers of medical devices, including software, should follow the rules described in Title 21 of FDA’s CFR (Code of Federal Regulations)  

Part 801, devoted to labelling, and Part 820, which describes Quality System Regulation, are also crucial for medical device manufacturers  

Additionally, to help understand and correctly implement the requirements, the FDA publishes special Guidance Documents. It’s a rich base of guidelines and examples presenting the FDA’s interpretations of their policies. The guidelines are non-binding, which means that you don’t have to follow the same approach as described, but they often provide very helpful guidance for applying the requirements correctly.  

How to bring your medical device to the U.S market? 

The process of bringing a medical device to the U.S market, as determined by the FDA, can be broken down into 5 main steps: 

We’ll dig deeper into this process in the next article of the FDA series. 

The classification of medical devices according to the FDA 

The FDA categorises medical devices as either Class I, Class II or Class III:  

• Class I devices pose the lowest risk as they have a minimal impact on the patient or operator’s health and life.  
• Class II devices present a significantly higher risk as they usually come into contact with the patient’s internal organs or are used for diagnosis.  
• Class III devices are usually used to support life, are implanted or generate a high risk of death or injury.  

Each class is subject to different regulatory controls and submission processes. Let’s discuss them briefly. 

Types of the FDA’s premarket submissions 

Premarket notification 510(k) 

510(k) is used for class I devices and the majority of class II devices, which aren’t subject to another kind of premarket submission. To demonstrate that a medical device is safe and effective, 510(k) submitters must compare their device to at least one legally marketed device and prove their substantial equivalence. Only when the FDA agrees that the device is substantially equivalent in terms of its Intended Use, features and effectiveness to one or more devices already available on the market, can it be distributed within the U.S.  

Premarket approval (PMA) 

It’s the most stringent type of premarket submission required by the FDA. It is applied to class III devices that present the highest risk or don’t have substantial equivalents already available on the market.  

Investigational Device Exemption (IDE) 

IDE applies to investigational devices that are to be used in clinical studies to collect data on their safety and effectiveness and to identify potential risks to human health and life.  

De Novo Classification Request 

De Novo Classification Request is a submission pathway for novel class I or class II devices that have no similar predecessors available on the U.S. market and don’t fit any of the existing categories.  

For novel and not substantially equivalent low- and moderate-risk devices, De Novo Classification Request is considered a less burdensome alternative to the costly and lengthy PMA. Additionally, medical devices introduced to the market through the De Novo Classification Request may be used as predicates for future 510(k) submissions.  

Humanitarian Device Exemption (HDE) 

HDE is a premarket submission method used for class III devices presenting a high-risk level. Contrary to other submission pathways, HDE doesn’t require evidence of effectiveness. However, for a device to qualify for the HDE premarket submission, the intention must be to use it on a small group of patients (fewer than 8000 people per year). Therefore, HDE usually applies to devices intended to treat rare diseases or medical conditions.  

One more caveat is that a device can qualify for HDE submission only when there is no comparable device already available on the market. 

Classification Product Codes 

Each medical device is registered in a Product Classification Database and gets a 3-letter product code, which indicates the type and classification of the device. The codes are used for internal classification and tracking purposes. This method ensures that subgroups of medical devices are distinguishable, for example, one subgroup may need specific warnings on the labelling.  

What is the “Level of Concern”? 

The “Level of Concern” is a concept used by the FDA to categorise the risk of software as a medical device. There are three Levels of Concern: Minor, Moderate and Major.  

The Level of Concern is Minor when any possible software failures or design flaws are unlikely to cause injury to the patient or device operator and lead to an incorrect medical diagnosis. 

When the software’s Level of Concern is Moderate, a possible failure or design flaw could lead to a minor injury to the patient or operator or might result in an incorrect medical diagnosis. 

The Major Level of Concern applies to software, which may cause a severe injury or even death if  there’s a failure or as a result of a design flaw.  

In order to determine the level of concern of your software you have to answer questions from tables 1 and 2 on pages 6 and 7 of the Guidance for the Content of Premarket Submissions for Software Contained in Medical Devices. If all the answers are negative, the Level of Concern is Minor. If at least one answer to questions from table 1 is positive, the Level of Concern is likely to be Major. If at least one answer to questions from table 2 is “Yes”, the Level of Concern is likely to be determined as Moderate. 

Note that the levels of concern can be mapped, to some extent, to classes A, B and C of the IEC 62304 standard. 

The FDA’s requirements regarding the Quality Management System  

The requirements regulating how a Quality Management System should be designed and developed to ensure a medical device is safe to use are described in Part 820 of FDA’s CFR Title 21.  

It’s worth noting that the requirements of Part 820 and ISO 13485 are almost equivalent, so if your Quality Management System is already compliant with ISO 13485, it’s likely to also be in line with Part 820. 

We’ll support you in releasing your medical software onto the U.S. market 

Our experts in the FDA requirements for medical devices will guide and assist you throughout the whole process. We’ll help you correctly define the Intended Use for your software, classify it and choose the most appropriate premarket submission pathway.  

Use the contact form below to book a free, no-obligation call.