5 Key Takeaways from FDA's Final Guidance on Regulation of Clinical Decision Support Software: FDA Outlines Significant Changes for CDS

On September 28, 2022, FDA published the final version of the “Clinical Decision Support Software” guidance (“Final CDS Guidance”) implementing statutory changes made by the 21st Century Cures Act of 2016. The Final CDS Guidance describes the Agency’s interpretation of the criteria for clinical decision support (“CDS”) software functions excluded from device regulation under section 520(o)(1)(E) of the FDCA (“Non-Device CDS”).

The Final CDS Guidance had been eagerly awaited by industry, as FDA’s prior 2019 draft guidance had left open many interpretive questions. While there is a lot to unpack in the Final CDS Guidance, the guidance introduces new concepts, questions and ambiguities and may be challenging to implement in practice.

As part of the Cures Act, Congress added section 520(o) of the FDCA to explicitly carve out from the statutory definition of a “device” (and therefore from medical device regulation by FDA) five categories of software functions, including CDS software. Under section 520(o)(1)(E) of the FDCA, CDS software functions are not devices if the relevant software function meets all of the following four criteria:

• Criterion 1: The software is not intended to acquire, process, or analyze a medical image or a signal from an in vitro diagnostic device or a pattern or signal from a signal acquisition system.
• Criterion 2: The software is intended for the purpose of displaying, analyzing, or printing medical information about a patient or other medical information.
• Criterion 3: The software is intended for the purpose of supporting or providing recommendations to a healthcare professional (“HCP”) about prevention, diagnosis, or treatment of a disease or condition.
• Criterion 4: The software is intended for the purpose of enabling the HCP to independently review the basis for the recommendations that such software presents so that it is not the intent that the HCP rely primarily on any of such recommendations to make a clinical diagnosis or treatment decision regarding an individual patient.

FDA initially issued a draft guidance interpreting these criteria in 2017 (see Covington’s summary here), and given stakeholder feedback, issued a revised draft guidance in September 2019 (see Covington’s summary here). Alongside the Final CDS Guidance last week, the Agency also issued revised versions of two other digital health final guidances: a revised final “Policy for Device Software Functions and Mobile Medical Applications” and a revised final “Medical Device Data Systems, Medical Image Storage Devices, and Medical Image Communications Devices.” 

Five Key Takeaways from the Final CDS Guidance

1. FDA has meaningfully narrowed the scope of “recommendations” that could qualify as Non-Device CDS under Criterion 3, revealing that FDA intends to actively regulate more CDS functions as SaMD. The new limitations on Criterion 3 also raise several questions that may make it challenging for CDS developers to understand how to apply the Final CDS Guidance.
   • FDA’s prior 2017 and 2019 draft guidance documents provided little discussion of Criterion 3, and most stakeholders had generally taken a broad interpretation of software outputs that could be a CDS “recommendation.”
   • FDA now states that software that provides “a specific preventative, diagnostic, or treatment output or directive”—including software that provides information that a patient may exhibit signs of a disease or identifies a risk probability or risk score for a disease—does not meet Criterion 3. FDA appears to limit Criterion 3 to software that provides multiple options or a list of recommendations as its output. In addition, FDA states that software that is intended to support time-critical decision-making does not meet Criterion 3.
   • These changes raise a number of new questions and may be challenging to apply in practice. For example, FDA states that drug-drug interaction and drug-allergy contraindication alerts are an example of Non-Device CDS, but these types of alerts could be presented in time-sensitive situations and generally provide a specific output rather than a list of options. So it is unclear how FDA is applying Criterion 3 with respect to the specific examples provided in the Final CDS Guidance.
   • It also is unclear where FDA finds these limitations for Criterion 3 in the statutory language—limitations that could have the unintended result of encouraging developers to present multiple options or recommendations, even where there is an optimal singular recommendation. Curiously, these types of limitations on the scope of “recommendations” were not the focus of negotiations around the Cures Act regarding Criterion 3; those discussions were centered on limiting this criterion to recommendations provided to HCPs (and not to patients or other users).
   • FDA generally states that the new limitations on Criterion 3 reflect types of software function that may present “automation bias,” where the HCP may be more likely to accept the software output. However, this appears to be conflating Criterion 3 with Criterion 4, creating confusion when applying the guidance.
2. FDA has significantly modified its interpretation of Criterion 1 and Criterion 2, such that more software will be SaMD, and created some ambiguity as to the interplay between those two criteria.
   • In the Final CDS Guidance, FDA made significant changes that will result in more software being regulated as SaMD, including:
     • FDA newly defines “medical image” to include any image analyzed for a medical purpose including images not originally taken for a medical purpose.
     • FDA added an interpretation of “pattern” in Criterion 1 to mean multiple, sequential or repeated measurements of a signal, such as data from continuous glucose monitors.
     • With respect to genomic sequencing software, FDA states that datasets such as variant call format (VCF) files constitute patterns from a signal acquisition system, suggesting that CDS functions that analyzes VCFs would not meet Criterion 1.
   • Previously, “medical information” in Criterion 2 was widely understood to apply broadly, but the Final CDS Guidance adds a potentially significant limitation on what constitutes “medical information.” FDA states that medical information is “the type of information that normally is, and generally can be, communicated between HCPs in a clinical conversation or between HCPs and patients in the context of a clinical decision, meaning that the relevance of the information to the clinical decision being made is well understood.” FDA’s intent with this discussion in the Final CDS Guidance is not clear and raises significant questions about how developers can apply this criterion going forward.
   • FDA does clarify that “medical information” can include results from a device or test results, which is consistent with the approach much of industry had taken under the 2019 draft guidance.
3. FDA has expanded the nature of the information that must be provided to the HCP in order for the HCP to “independently review” the basis for the recommendation, which may make it more challenging to meet Criterion 4 for Non-Device CDS.
   • The Final CDS Guidance expands the information that should be provided in Non-Device CDS to include algorithm methods, datasets and validation, including a description of the results from clinical studies conducted to validate the algorithm so that an HCP can assess the potential performance and limitations when applied to their patients.
   • Developers will need to determine if they can provide the level of disclosure described in the Final CDS Guidance, and what to do with existing software functions that take a different approach.
4. The Final CDS Guidance does not include key categories of enforcement discretion that FDA had described in the 2019 draft guidance, including for CDS intended for patients or caregivers.
   • The 2019 draft guidance proposed that FDA exercise enforcement discretion for certain CDS intended for use by patients or caregivers and certain CDS for use by HCPs intended to inform management of a non-serious situation or condition. The Final CDS Guidance does not discuss a policy of enforcement discretion for either category. Instead, FDA merely states that some decision support software may be subject to enforcement discretion under the Agency’s other digital health guidances.
   • Because FDA does not address the enforcement discretion policy proposed in FDA’s 2019 draft guidance, the Final CDS Guidance leaves open the question of whether FDA intends to issue a second final guidance to address the proposed enforcement discretion policies for HCP- and patient-facing CDS that do not meet the criteria for Non-Device CDS. FDA has not clearly signaled that it will do so, and thus, CDS developers should not assume any such guidance will be forthcoming.
5. Despite the significant changes, FDA has not addressed how it will apply the Final CDS Guidance.
   • The Final CDS Guidance provides no discussion of how industry should apply the many changes in the guidance or how the Agency will view software on the market under the prior guidance documents that now may not meet the criteria for Non-Device CDS under the revised interpretations in the Final CDS Guidance. For example, FDA included no discussion of an effective compliance date for the new interpretation in the Final CDS Guidance or a transition period to allow industry to make corresponding changes.
   • The policy changes also raise the question as to whether FDA should have issued a new draft guidance, as it did in 2019, to allow for stakeholder feedback on the Agency’s new approach.

Companies that put CDS software functions on the market as non-FDA-regulated software under policies proposed in the 2019 draft guidance (or have such software functions in development) will need to carefully reassess their software under in the Final CDS Guidance and determine the impact of the changes in the Final CDS Guidance. The Final GDS guidance raises a host of issues that are likely to impact specific products in ways that are more detailed than can be discussed in this summary.

We anticipate that there may be many software functions on the market or in development that no longer fall within Non-Device CDS under FDA’s Final CDS Guidance or under enforcement discretion under FDA’s other digital health guidances. FDA has not specified any transition or compliance period, so developers will want to act quickly to assess these impacts, develop a strategy, and potentially engage with FDA regarding impacted software.

Industry may also want to consider avenues to engage with FDA regarding the many open questions raised by the Final CDS Guidance. Although it was issued as a final guidance, comments can be submitted to FDA via the electronic docket at regulations.gov. The CDS provision in section 520(o)(1)(E) was also one of the most heavily negotiated parts of the 21st Century Cures Act, so in light of questions about how FDA’s interpretation in the Final CDS Guidance relates to the statutory language, stakeholders also might consider engaging with Congress.

If you have any questions concerning the material discussed in this client alert, please contact the members of our Digital Health Practice.