In the wake of FDA’s long-awaited final guidance for the regulation of Clinical Decision Support Software, many software developers and other stakeholders in the digital health industry are urgently reassessing the regulatory standing of their CDS software.

Our September alert covering the issuance of the Final Guidance provided a comprehensive overview of FDA’s regulatory approach and a discussion of the significant changes in the Final Guidance, as compared to FDA’s 2019 revised draft CDS guidance (the Draft Guidance).

On October 18, 2022, FDA held a hotly anticipated public webinar to discuss and answer questions about the Final Guidance. FDA representatives talked through the Final Guidance, pointed out how the Final Guidance fits in with other existing guidance documents and fielded questions from listeners.

This alert provides a quick update on four key takeaways from the webinar and flags the impact of the Final Guidance on reimbursement opportunities.

Takeaway 1: No transition period or grandfathering

When faced with a question about when regulatory compliance with the newly issued Final Guidance needed to be achieved, FDA’s position was clear: compliance is expected now, and there is no grace period.

In answering the question, FDA asserted that since there had been no change in the underlying law, there should be no change in any product’s regulatory status. Yet changes in FDA’s interpretation of the law impact enforcement and how industry interprets the law. And many industry innovators and adopters are deeply concerned about the changes in interpretation introduced in the Final Guidance, which may mean that products formerly believed to be non-device or subject to enforcement discretion are viewed by FDA as actively regulated devices.

While FDA suggested that there is no product that was previously not a device that becomes a device under the Final Guidance, the Agency set out two options for those with concerns: 1) adjust the product to alleviate those concerns or 2) approach FDA to discuss how to move forward.

Takeaway 2: Risk bears no impact on non-device CDS criteria

As previously reported, a notable difference between the 2019 Draft Guidance and the recently issued Final Guidance is that the Final Guidance removed the International Medical Device Regulators Forum (IMDRF) risk categorization and the risk-based enforcement discretion policy (more on enforcement discretion in the section below).

During the webinar, FDA representatives confirmed that interpretation of the four non-device CDS criteria set out in the 2016 21st Century Cures Act will not vary based on the risk profile of the intended use condition or disease state, nor on the significance of information provided by the product with respect to a healthcare decision. The criteria are applied without regard to any type of risk categorization, opening a broad swath of low-risk devices to regulatory review.

Takeaway 3: Enforcement discretion is not gone, just gone from the Final Guidance

FDA acknowledged that the enforcement discretion policies proposed in the Draft Guidance do not appear in the Final Guidance. Comments from FDA indicated that references to enforcement discretion had been stripped from the Final Guidance in order to focus on the concept of whether a function is excluded from the definition of device (rather than removal being intended to reduce the scope of enforcement discretion with respect to lower risk devices).

FDA encouraged industry to look to other digital health guidances for direction on enforcement discretion. In particular, FDA referred to enforcement discretion that exists for software functions that help users self-manage their disease or condition without providing specific treatment or treatment suggestions, or functions that automate simple tasks for healthcare professionals. These are described in FDA’s Policy for Device Software Functions and Mobile Medical Applications.

While industry should certainly consult the existing suite of digital health guidances for enforcement discretion opportunities, those opportunities do now appear to be more limited compared to the discretion previously understood to be available before the recent CDS guidance update.

Takeaway 4: No bright lines

Audience members pressed FDA for further details, if not clear thresholds and cutoffs, for many of the new concepts introduced in the Final Guidance. For example, the Final Guidance raises the concern of “automation bias” and notes that any software making time-critical recommendations, such as certain EHR alerts, would be treated as device CDS subject to FDA regulation. When pressed for further clarity on what qualifies as time critical, however, FDA declined to provide specific intervals or cutoffs, leaving much room for interpretation and guesswork on a case-by-case review of CDS products.

Likewise, the Final Guidance distinguishes “medical information” from a signal or pattern based on sampling frequency. But when an audience member pressed for further details on when a series of results turns into a signal or pattern (with very different regulatory implications), FDA again declined to provide “one single cutoff.” FDA did refer to a rule of thumb in the guidance, noting that “medical information” would be the kind of information doctors might share in the “hallway.” That vagueness, notably, may contribute to an uncertain environment.

Absent these and other bright lines, we expect a lack of predictability, at least in the early phases of applying these new regulatory rules for innovators and adopters.

Impact: Reimbursement opportunities

The changes introduced by the Final Guidance may have much broader impacts than FDA may realize. Recent development of reimbursement codes for Remote Patient Monitoring (RPM) and Remote Therapeutic Monitoring (RTM) by the Centers for Medicare and Medicare Services (CMS) cross-reference FDA’s definition of “device,” stating that any device used to qualify for the codes “needs to meet the FDA’s definition of a medical device as described in section 201(h).” See 2022 Medicare PFS Final Rule. RPM codes require physiological data to be collected and transmitted, while RTM codes focus on non-physiological data for the respiratory and musculoskeletal systems (including therapy adherence and therapy response). Some software-as-a-medical-device tools could potentially qualify for these codes. Some manufacturers may be reassessing their previous understanding that their product was excluded from the device definition; for such stakeholders, it may be useful to consider how reimbursement availability may be impacted by your updated FDA regulatory analysis.

For more information about CDS and the changing digital health landscape and associated FDA regulation, please contact your DLA Piper relationship partner, the authors of this alert or any member of our FDA practice group.