Posts
On October 26, 2006, FDA issued a Warning Letter to Patterson Technology of Effingham, IL, for marketing an adulterated medical device. That "device" was their EagleSoft patient recordkeeping software package (I am passingly familiar with EagleSoft: my dentist uses it). In that Letter, FDA claimed that EagleSoft constituted an "unclassified" medical device, subject to GMPs and Design Controls (21 CFR 820.30(a)(2)(i)).
Immediately after this Letter was issued, I received a number of inquiries both directly from software companies and through associates. What did this Letter mean? How can software which does not itself "treat, diagnose, or mitigate a disease or function" (21 U.S.C. 321) possibly be a medical device? And what does it mean to be an "unclassified" device, when the Safe Medical Device Act specifies that within the United States, a Medical Device is always Class I, Class II, or Class III?
My short-term advice was: you should have basic quality systems in-place anyway, you should be doing design controls anyway. In my opinion, FDA had no legal authority to issue such Warning Letters since there was no such thing as an "unclassified" device in the Act but hey, that didn't stop them from going after a company marketing identification tags for subdermal implantation and pursuing them for years in the courts, only to finally have a judge rule that no way did Congress give FDA that authority. But since you should be doing these basic quality things anyway, don't bother fighting it.
Meanwhile, the number of software applications that potentially touch upon the medical care of the public has absolutely exploded. This is especially true in two areas: handheld devices used by Sales Reps to collect and transmit patient information (directly or through physicians), and web-based "cloud" systems.
This year, John Murray, CDRH's Subject Matter Expert on software (and therefore the person who largely determines FDA's policy on software enforcement) has been particularly busy. He has drafted a number of new guidance documents, including off-the-shelf software used inside medical devices and "cybersecurity" (more a list of topics than an actually useful guidance, IMHO...sorry, Mr. Murray). But his biggest contribution, hands-down, was a video he made earlier this year, CDRH Regulated Software: An Introduction.
In this video, Mr. Murray clarifies that he (meaning, of course, FDA) has determined that... (Click to read more)
