FDA's JAMA Article on Precert Good But Incomplete

FDA's July 2, 2018 JAMA article on FDA Regulation of Mobile Medical Apps is a very logical and informative explanation for why FDA thinks we need a new and different regulatory approach to software when used as a medical device. And I fully support the new approach. In fact, it is desperately needed.

For the most part, I agree with everything they say. But I’m also afraid there are a few important things that the article leaves out.

First, FDA did not exempt all low risk software from FDA regulation. They promised to do so, but they never carry through with their promise to this day. Specifically I’m talking about the promise FDA made in the 2014 report FDA published on health information technology – as required by Congress in FDASIA. In that report, FDA promised that it would exempt low risk CDS from FDA oversight. But the agency never did. Indeed, in December 2017 when FDA published its draft guidance on CDS, the agency only implemented the 21st Century Cures Act requirements for software that is transparent; FDA did not exempt the low risk CDS the agency had promised to exempt back in response to the congressional directive that they do so. And that’s very disappointing.

I raised this issue with FDA this summer, and they told me that they had had second thoughts. They told me that this new precert program was going to be so good that they would not need to exempt low risk software. Honestly I don’t understand that at all, because the precert program – while good and perhaps great – will not be good for low risk software that frankly ought to be exempt from all FDA regulation and now is only subject to the class I requirements – not premarket notification. For low risk products, the precert program offers nothing but additional burden.

Second, so far FDA is painting a pretty incomplete picture of the precert program, and leaving out important details that will not make industry happy. The agency has been focusing on the things it anticipates industry will like, while holding back discussion of the things it knows industry will not appreciate. This includes the whole enforcement side of FDA’s function in the context of the precert program.

And finally, in this article, FDA does a nice and frankly sincere job of explaining just how radically the precert program will depart from the present medical device regulatory approach specified by Congress in the statute. Yet at the same time, in its latest working document, FDA asserts that it thinks it will be able to proceed without statutory or regulatory authority. How is that possible? When the agency invents an entirely new program that is completely at odds with the statute, how is it FDA thinks it can proceed along this path without Congress?