An Overview on the Regulation of Medical Devices

The US Congress passed the Federal Food, Drug, and Cosmetic Act in 1938 (the FD&C Act), which empowered the US Food and Drug Administration (the FDA) to oversee the safety of, among other things, medical devices.

Generally, the FDA is charged with approving medical devices for use in healthcare, as well as monitoring the safety of all such regulated medical devices. 

This blog post will examine the types of medical devices that fall within the scope of the FDAs jurisdiction and describe the approval process necessary for medical devices to be used in the healthcare industry.

If you have any questions regarding this process, it is best to reach out to a qualified HealthTech attorney who can assist you throughout the process. 

The term device does not include certain medical and decision-making support software functions excluded from the FD&C Act. All medical devices fall into one of three classes, and FDA clearance is dependent on the classification the device seeking approval:

• Class I: Devices that do not require pre-market approval or clearance but must follow general controls. 35 per cent of medical devices fall under Class I, and 93% of these Class I devices are exempt from pre-market review. Dental floss falls under the Class I category.
• Class II: Devices that generally present a moderate risk of harm to the user and are cleared using the Premarket Notification 510(k) process (described below). 53 per cent of device types are Class II, most of which require FDA review. An example of a Class II device is a hearing aid.
• Class III: Devices that are approved by the Premarket Approval (PMA) process, analogous to a New Drug Application. These tend to be devices that are permanently implanted into a human body or may be necessary to sustain life. 9 per cent of device types are Class III and require FDA review through PMA or humanitarian device exemption. An artificial heart falls under Class III categorization.

Most Class I devices and some Class II devices are exempt from the Premarket Notification 510(k) submission. 

If the device requires the submission of a Premarket Notification 510(k), the manufacturer cannot commercially distribute the device until a letter of substantial equivalence has been issued from FDA authorizing the manufacturer to do so. 

Devices requiring PMAs are Class III devices, i.e., high risk devices that pose a significant risk of illness or injury, or devices found not substantially equivalent to Class I and II predicate (as defined in X.78 below) through the 510(k) process. The PMA process is more burdensome and includes the submission of clinical data to support claims made for the device.

As noted above, devices regulated under the FD&C Act do not include certain medical and decision-making support software. 

Due to the increased availability of software and mobile applications, the FDA issued further guidance regarding its software oversight approach, which considers software functionality rather than the software’s platform. 

The guidance set by the FDA intends to apply its regulatory oversight only to software functions where there is a risk to patient safety if the device were to not function as intended. If a product contains multiple functions, with at least one software function that falls within the exemptions described above and another function that would otherwise fall within the definition of a device under the FD&C Act, then the software function will not be regulated as a device. 

However, the FDA will consider the impact of the software function(s) on the safety and effectiveness of the non-software function(s). Notwithstanding the exemption of certain software functions from review, the FDA retains authority to find that software functions identified in a final FDA order would be reasonably likely to have serious adverse health consequences. 

Further, the FDA can exercise enforcement discretion as to any device subject to regulation, regulate software used in the manufacture and transfusion of blood to assist in the prevention of disease in humans, and regulate software as a device if the software meets the criteria as a Class III device.

Matthew DeNoncour, Esq. is the principal attorney and owner of Magis Law Firm, a boutique law firm based in Boston, with offices in Providence, Miami, and Fort Myers, where he provides legal services to the healthcare, life science, and technology industries. You can reach Matt at magislawfirm.com, by phone at 866-277-8680 or by email at mdenoncour@magislawfirm.com. This post is not meant to be legal advice: learn more here.