On July 28, the U.S. Food and Drug Administration (FDA) issued the final guidance “Multiple Function Device Products: Policy and Considerations,” which describes FDA's regulatory approach and policy for products with multiple functions (either hardware- or software-related) that include at least one medical device function and one “other” non-medical device function. This finalizes FDA’s April 2018 draft guidance, summarized here, which built on changes enacted by the 21st Century Cures Act (Cures Act), focusing on the impact of unregulated functions on regulated functions built into the same software or hardware device for use in the United States. In the analysis below, we assess key changes in the finalized version of the guidance, and compare FDA’s approach to the one adopted by the European Commission and national competent authorities in the EU.

The Multiple Function Device Products guidance provides clarity on FDA’s implementation of Section 520(o)(2) of the FD&C Act, added by the Cures Act, which explicitly directed that otherwise unregulated software functions would not become regulated solely because they are included in a product with an FDA regulated function. However, the guidance broadens the scope of the policy to all multiple function products (not just software products) that contain at least one device function. For non-device functions, collectively referred to as "other functions," FDA says it will focus on any impact on the medical device function under review, as determined by the company. Generally, the guidance is consistent with the way FDA has been treating multiple function products for several years, and the final version of the guidance mostly mirrors the draft version’s provisions.

The primary difference between the two versions is FDA’s insertion into the final guidance of language indicating manufacturers should provide, in their premarket submission for the device function, information that is related to the impacts of “other functions” if they positively impact the device function-under-review and this fact will be represented in the device function-under-review’s labeling (“labeled positive impact”); in the draft version, FDA focused on manufacturers providing only information that could negatively impact the device function-under-review, where such “negative impact” information should also be provided to FDA, as outlined below.

Premarket submission content explained

In the final guidance, FDA explains that the content of a premarket submission for a device function-under-review should include:

• Indications for Use: The final guidance notes, “The indications for use should not include the indications for use of any ‘other function,’ unless the sponsor would like the positive impact to be considered in FDA’s assessment of the device function-under-review.”

• Device Description – Description of Functions: The final guidance adds to the draft version a description of how potential positive and negative impacts should be assessed: “For a multiple function device product, the device description should include a description of the ‘other function(s)’ that could adversely impact the device function-under-review and should address how the device function-under-review is impacted by each of the ‘other functions.’ If the device function-under-review could be positively impacted by the ‘other function,’ and the labeling reflects the positive impact (labeled positive impact), the device description should include the information outlined above in regard to the positive impact of the “other function” on the device function-under-review.”

• Labeling: New in the final version of the guidance, FDA primarily warns here that the agency regulates devices labeling, stating, “For multiple function device products, the labeling should include a description of the “other function(s)” adequate to ensure appropriate use of the device.”

• Architecture and Design: The architecture and design documents appropriate to the software level of concern should be included in the premarket submission,” pursuant to the FDA guidance “Guidance for the Content of Premarket Submissions for Software Contained in Medical Devices.”

• Device Hazard Analysis: Formerly entitled “Risk Analysis,” this section adds in language reflecting that the risk-based assessment should consider any “labeled positive impact” as well as any potential adverse impact.

• Requirements and Specifications: Documentation of requirements and specifications included in the premarket submission for the device function-under-review should include adequate detail to describe any expected relationship, utility, reliance, or interoperability with any “other function.”

• Performance Testing: New to the final version of the guidance, this section explains: “Performance testing for the device function-under-review should be conducted considering those aspects of the ‘other function(s)’ that have an impact (either if there could be an adverse impact or labeled positive impact) on the performance in order to demonstrate that the impact to safety or effectiveness is appropriately addressed.”

• Submission Summary: This section again adds language in the final version of the guidance reflecting that the risk-based assessment should consider any “labeled positive impact.”

In addition, when considering cybersecurity risks, the final guidance advises manufacturers that “some level of separation of the device function-under-review from the “other function(s)” in design and implementation may be necessary to mitigate cybersecurity risks to the device function-under-review.” For example, FDA says that “modular and/or separation architectures can help reduce the possibility that a cybersecurity threat to/from an “other function” could impact the device function-under-review.” Highlighting how a mobile medical application has a relationship with the computing platform on which it is executed, FDA suggests that, when considering if an “other function” may impact the safety or effectiveness of the device function-under-review, a manufacturer should assess whether an “other function” writes to memory or other storage that stores code or data of the device function-under-review.

The final guidance also adds a flowchart as a guide to be used with the textual descriptions in the guidance:

Last, the final guidance adds a section entitled “Modifications to the ‘Other Function’ of a Multiple Function Device Product,” which advises manufacturers that if there is a modification to the “other function” of a multiple function device product, then that modification should be assessed to determine if the change could significantly impact the safety or effectiveness of the device function that was the subject of FDA review, thus including these other functions as part of a manufacturer’s risk management and regulatory processes in assessing when a new device function regulatory submission will be required.

Comparison to the EU

Like the U.S., EU legislation and guidance documents on medical devices provide clarity on the regulation of multiple function device products and provide a regulatory approach and policy for those products. The EU guidance available mainly focuses, however, on software related products. In relation to the Medical Devices Directive, the European Commission published the MEDDEV 2.1/6 guidelines on the qualification and classification of standalone software. According to MEDDEV 2.1/6, the standalone software may break into a significant numbers of applications for the user where each of these applications is correlated with a module. Some of these modules may have a medical purpose, and some may not. MEDDEV 2.1/6 provides that the modules which are subject to the Medical Devices Directive must comply with the requirements of the Directive and must bear the CE mark. Products that are not medical devices modules are not, however, required to comply with these requirements. The legal manufacturer of the multiple function device products must identify the boundaries and the interfaces of the different modules. MEDDEV 2.1/6 further provides that in accordance with Essential Requirements 9.1 of Annex I to the Medical Devices Directive, if the modules which are subject to the Medical Devices Directive are intended for use in combination with other modules of the whole software structure, other devices or equipment, the whole combination, including the connection system, must be safe and must not impair the specified performance of the modules which are subject to the Medical Devices Directive. The Essential Requirements 9.1 provides that any restrictions on use must be indicated on the label or in the instructions for use.

On May 26, 2021, the Medical Devices Directive will be replaced by the Medical Devices Regulation (MDR). The MDR was originally intended to go into effect on 26 May 2020. However, as a result of the COVID-19 pandemic, the European Council and European Parliament adopted a proposal from the European Commission to amend the MDR, postponing its effective date by one year. The MDR will substantially change the requirements applicable to medical devices in the EU and up-classify a number of medical devices, including software. The European Commission's MDCG 2019-11 guidance document on the qualification and classification of software under the MDR provides the same guidelines as does MEDDEV 2.1/6 for multiple function device products. Similarly to Essential Requirements 9.1 of Annex I to the Medical Devices Directive, the General Safety and Performance Requirements 14.1 of Annex I to the MDR provides that if the modules which are subject to the MDR are intended for use in combination with other modules of the whole software structure, other devices or equipment, the whole combination, including the connection system, must be safe and must not impair the specified performance of the modules which are subject to the MDR. The General Safety and Performance Requirements 14.1 also provides that any restrictions on use applying to these combinations must be indicated on the label or in the instructions for use of the device. The MDR provides an additional requirement for those products. According to General Safety and Performance Requirements 14.1, connections which the user has to handle, such as fluid, gas transfer, electrical or mechanical coupling, must be designed and constructed in such a way as to minimize all possible risks, such as misconnection.

FDA to offer more information in upcoming webinar

On September 10, FDA will host a webinar for stakeholders interested in learning more about the Multiple Function Device Products final guidance. An opportunity will be provided to ask questions about the guidance.

For companies preparing premarket submissions for multiple function device products, it will be important to understand this final guidance and clearly define device functions versus “other functions” of the product, assess the impact of the other functions on the device function in terms of safety and efficacy, and the introduction of new risks or adverse effects, and provide documentation that those risks have been mitigated. It would be advisable for these distinctions be carried through and highlighted in all documentation and in particular starting with design and development and risk management.

[View source.]