SOFTWARE AS A MEDICAL DEVICE (SaMD) - · PDF fileSOFTWARE AS A MEDICAL DEVICE (SaMD) ... Tips and Tricks from our experience ... CIS / Patient Data Management Systems – PDMS

0

Robert-Walser-Platz 7 I CH-2503 Biel I +41 32 513 67 67 I [email protected] I www.iss-ag.ch 20170302 Presentation SW As a Medical Device page 1/27

SOFTWARE AS A MEDICAL DEVICE

(SaMD)

A short introduction

© ISS Integrated Scientific Services AG

Sandra Item, Head Regulatory Affairs and Knowledge Management

[email protected]

0


Agenda

Regulatory Framework

In what cases is a Software a medical device?

Some Examples

What is applicable if a SW is a Medical Device?

Validation of Stand-Alone-Software

Tips and Tricks from our experience

Impact of new European Regulation (MDR)

ISS at a glance

0


Global iOS & Android • >165’000 mHealth apps • 500 m users • CAGR > 40% • Certified ~10%

0


What happens?

Chaos! says the pessimists

- Confusion all over (safety, privacy, efficacy???)

- Non regulated

- Dangerous for patients

- Transparent patient

Chance! says the optimist

- Potential for prevention, monitoring…

- Simplified processes

- Cost saving possibilities

- Creates jobs

0


EUIVDR, MDR

IA, DANational (CH)

HMGHFG

MepV, KlinV

Standards

ISO 13485:2016, IEC 14971, IEC 62304, IEC 62366, IEC 60601, IEC 61010, ISO

10993, new: IEC 82304 …

Recommendations and GuidancesMEDDEV, ZLV, NB-RecommendationsMedical specialist’s recommendations

Regulatory Framework In general

0


In what cases is a Software a medical device? Definition of a „medical device“ according to Article 1 Council Directive 93/42/EEC (MDD)

‘medical device’ means any instrument, apparatus, appliance, software, material or other article, whether used

alone or in combination, including the software intended by its manufacturer to be used specifically for

diagnostic and/or therapeutic purposes and necessary for its proper application, intended by the manufacturer

to be used for human beings for the purpose of:

- diagnosis, prevention, monitoring, treatment or alleviation of disease,

- diagnosis, monitoring, treatment, alleviation of or compensation for an injury or handicap,

- investigation, replacement or modification of the anatomy or of a physiological process,

- control of conception,

and which does not achieve its principal intended action in or on the human body by pharmacological,

immunological or metabolic means, but which may be assisted in its function by such means;

….

0


What does this mean exactly?

Help is given by the MEDDEV 2.1/6 (latest issue from July 2016)

http://ec.europa.eu/DocsRoom/documents/17921/attachments/1/translations/en/renditions/pdf

“Qualification and Classification of stand alone software”

Below the relevant Flowchart from the above mentioned MEDDEV for answering the question „is my SW a

Medical Device? “

0


0


Some Examples Hospital Information Systems are not qualified as medical devices. However they may be used with

additional modules, as described hereafter. These modules might be qualified in their own right as medical

devices.

Decision Support Software are qualified as medical devices, e.g.

- Radiotherapy treatment planning systems

- Drug (e.g.: Chemotherapy) planning systems

- Computer Aided Detection systems… for example, such systems would be able to automatically read x-

ray images or interpret ECGs

0


Information systems

Electronic Patient Record Systems

That simply replaces a patient’s paper file does not meet the definition of a medical device.

But certain modules can be a medical device, e.g.:

- an image viewer with functionality for diagnosis based on digital images;

- a medication module.

Aus dem Merkblatt der Swissmedic:

Eine Anzeige von Bildern beschränkt sich nicht auf Speicherung, Archivierung, Kommunikation, einfache Suche

oder verlustfreie Kompression, weil für diese mathematische Algorithmen notwendig sind. Deshalb ist eine

eigenständige Software, die Bilder zu einem medizinischen Zweck für eine Einzelperson anzeigt, als

Medizinprodukt zu qualifizieren. Daraus folgt, dass ein medizinisches Bildarchivierungs- und

Kommunikationssystem (PACS, Picture Archiving and Communication System) in den meisten Fällen ein

Medizinprodukt ist, umso mehr, als es neben der Anzeige von Bildern mit vielen PACS auch möglich ist, Bilder

zu manipulieren, auszuwerten oder Medizinprodukte zu steuern.

0


Clinical Information Systems – CIS / Patient Data Management Systems – PDMS

…CIS/PDMS are not qualified as medical devices.

But: Modules that are intended to provide additional information that contributes to diagnosis, therapy and

follow-up (e.g. generate alarms) are qualified as medical devices.

Web systems for monitoring of data

- Modules that are intended to monitor non medical performance of medical devices do not fall under the

scope of Medical Devices Directives (e.g. remote Maintenance Software)

But: Software modules on server(s) might be qualified in their own right as medical devices depending on their

intended purpose

Apps

Apps are not separately mentioned in the MEDDEV, but they are to be treated like other SaMD.

0


What is applicable if a SW is a Medical Device?

Each Medical Device needs a CE certification.

This is as well applicable for SaMD

Manufacturer have to maintain a Quality Management System, in most cases ISO 13485 is the best

choice

Following information is relevant if the concerned SW is a Medical Device according to the MDD 93/42 ECC

Next page: Normative Landscape for Medical Device SW (EU).

0


0


0


Rough procedure for a CE-marking of a SaMD

screening

•Clarify intended use and indication for use

•Is it a medical device?

•RA-Strategy

•Classification

review & strategy

•Gap analysis technical documentation

•Planning

certificaton

•proof safety

•proof efficacy

•TechDoc, V&V, Tests

•ev. Certification of legal manufacturer

•CE Marking

operation

•Maintain certification

•CAPA

•PMS (Post market surveillance)

•Handling of Adverse Events

0


Next Page:

V-Model from 60601-1 (adapted by Institut Johner)

Green part: is covered 60601-1 (for systems) but only partly applicable for „stand alone software“ Red part: is covered in IEC 62304

For the validation of stand alone software, a new standard (IEC 82304) is under development

0


IEC

623

04

IEC

606

01-1

(IEC

823

04)

0


Validation of Stand-Alone-Software - Validation against the intended use (inclusive

clinical evaluation) is a requirement of EN ISO

13485 (chapter 7.3.6) and 21CFR820 chapter

820.3(z)(2) and 820.30(g).

- SW-validation is required in IEC 62304, but not

really covered (SW-verification only)

- Actually, one has to create an own validation

strategy (e.g. in the style of the strategies

proposed in IEC 60601-1)

- Standard IEC 82304 (2016 approval stage) closes this gap, but IEC 82304 is a draft only and not (yet) on

the list of harmonized standards (EU, USA).

source: IEC 82304

0


Validation can be quite extensive (and expensive): example of a glucose monitoring app from dexcom

0


Tips and Tricks from our experience

General

- System boarders are changing. Risk Management has to cover the Deployment (via shops), Updates via

Shops etc.

- IT-security, privacy, product liability has to be taken into account -> not “automatically” covered by IEC

62304

- Operating systems: everything is possible, with respective pros and cons per OS. Remark: a FDA or CE-

validated Operating Systems for Medical Software does not exist, even though it is promised in some

advertisements. Validation has always to be done in the respective context.

- IEC 82304 already is a reasonable proposal for validation of Stand alone Software. Taking it into the

development process is recommended.

- Define a responsible Q/documentation person -> otherwise you lose time for

0


Agile Development

Today, Software is developed iteratively in most cases (Agile development). It is possible to do this under IEC

62304:

- See the V-Modell as Documentation Landscape, not as a fixed development process

- Define the Software development plan (especially document plan) at the beginning of the project and

release it

o Ongoing adaptation of the draft

o Re-Release the plan when you have major changes

- Ongoing adaptation of the documents, Requirements and Design have to be released before the

testing activities (verification) at the latest.

- Plan Reviews and run and document them on a regular basis.

- Prior to a Release compile and review a complete and consistent state of all document

0


Collaboration with external Developers

- Treat them as Critical suppliers (supplier management)

- If you are not sure that they know enough about medical device software development, set up a supplier

audit with a specialist

- External Developers (as internal) should work under IEC 62304 and IEC 82304 (possibly under your

processes if available (extended workbench))

- Define what documents have to be produced and released by which party at what point in time

0


Impact of new European Regulation (MDR) New classification of Standalone Software

MDR classification Rule 11

Software intended to provide information which is used to take decisions with diagnosis or therapeutic purposes

is classified as class IIa, except if such decisions have an impact that may cause:

– death or an irreversible deterioration of a person's state of health, in which case it is in class III; or

– a serious deterioration of a person's state of health or a surgical intervention, in which case it is classified as

class IIb.

Software intended to monitor physiological processes is classified as class IIa, except if it is intended for

monitoring of vital physiological parameters, where the nature of variations of those parameters is such that it

could result in immediate danger to the patient, in which case it is classified as class IIb.

All other software are classified as class I.

0


Helpful Links MEDDEV 2.1/6 July 2016: http://ec.europa.eu/DocsRoom/documents/17921/attachments/1/translations/en/renditions/pdf

European Commission, Green Paper on mobile Health (mHealth), 10. April 2014,

http://ec.europa.eu/digital-agenda/en/news/green-paper-mobile-health-mhealth

MHRA Guidance on medical device stand-alone software (including apps), 25. August 2016,

https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/548313/Software_flow_chart_Master.pdf

FDA, Mobile Medical Applications Guidance for Industry and Food and Drug Administration Staff, 9.02.2015

http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/UCM263366.pdf

MDR (draft from Feb. 22 2017)

http://data.consilium.europa.eu/doc/document/ST-10728-2016-INIT/en/pdf

Merkblatt der Swissmedic zum Thema „Eigenständige Medizinprodukte-Software“ (Jan 2016)

https://www.swissmedic.ch/medizinprodukte/02635/02645/index.html?lang=de&download=NHzLpZeg7t,lnp6I0NTU042l2Z6ln1acy4Zn4Z2qZpnO2Yuq2

Z6gpJCDd358e2ym162epYbg2c_JjKbNoKSn6A--

IMDRF document (2014): „Software as a Medical Device: possible framework for risk categorization and corresponding considerations

http://www.imdrf.org/docs/imdrf/final/technical/imdrf-tech-140918-samd-framework-risk-categorization-141013.pdf

FDA Guidance Document, Software as a medical Device, (SaMD), clinical evaluation

https://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/UCM524904

0


ISS at a glance

- Fully dedicated to MedTech

- 28 high profile employees (Engineers, Scientists, Medical Doctors)

- Projects, services and products for MedTech companies in the fields of QM and Engineering Support,

Regulatories, Software development

- Certified per ISO 13485, IEC 62304 etc., audited CRO services (BVMA)

- International customers in various subfields of the MedTech industry

- Dedicated to “Doing” rather than “Consulting only”

- Founded in 2003 as spin-off from Ziemer Group, an established manufacturer of ophthalmic High Tech

devices

- Located in Biel, a core area of Switzerland’s watchmaking and high-tech industry

0


ISS Services from a Project Perspective

BD Down-to-earth Business Model Dev. Project Management Project Coaching

ISO 13485/FDA 21CFR 820 Tech File, Audit Support, V&V CAPA, Complaint handling

RA Strategy RA-Intelligence Global Registrations PMS Re-Registrations

Cl. Strategy Study Planning, Approvals, Operations, Clin. Eval., Medical Writing, PMCF

Req. Engineering SW-Development SW Validation Product Support

Idea Implementation Market Introduction

Q & Eng. Avoid problems

RA Services Global Markets

Clinical Srv. CRO for MedTech

Software Applied IEC 62304

Maintenance

0


Decomplix AG, a joint venture to accelerate market access for medical devices