TGA Proposes New Course of Treatment for Software as a Medical Device

In December 2019 the Therapeutic Goods Legislation Amendment (2019 Measures No. 1) Regulations 2019 was passed as part of measures to more closely align Australian therapeutic goods regulations with the European Medical Device Regulation 2017/745. As part of these changes, new medical device regulations will enter force on 25 August 2020 to specifically address the growing Software as a Medical Device (SaMD) sector.

The regulatory framework for medical devices in Australia was implemented in 2002 and has not substantially changed since then. Unlike the regulatory regime, technology has developed rapidly since the early 2000s, leaving the therapeutics regulatory system struggling to cope with a new genre of medical technology, particularly in the realm of software. In February 2019 the TGA proposed the first major change to the medical device regulatory system in an effort to bring Australia into alignment with current international guidelines and the new European Medical Device Regulations.

These changes have the potential to substantially increase the regulatory obligations for both current and future developers of SaMD.

The regulatory framework generally

Medical devices are regulated in Australia by the TGA under the Therapeutic Goods Act 1989 (Cth) (Act) in a similar way to medicines. Under s 41BD of the Act, medical devices are defined in a broad, purposive fashion as:

any instrument, apparatus, appliance, material or other article (whether used alone or in combination, and including the software necessary for its proper application) intended, by the person under whose name it is or is to be supplied, to be used for human beings for the purpose of one or more of the following:

• diagnosis, prevention, monitoring, treatment or alleviation of disease;

• diagnosis, monitoring, treatment, alleviation of or compensation for an injury or disability;

• investigation, replacement or modification of the anatomy or of a physiological process;

• control of conception;

and that does not achieve its principal intended action in or on the human body by pharmacological, immunological or metabolic means, but that may be assisted in its function by such means.

The key features of a medical device are that it is intended to have a medical purpose and it is not a drug.

This broad definition currently captures medical software in two ways: software as part of a medical device (e.g. software embedded in or controlling a hardware device); or standalone software which is intended to have a medical purpose. Despite this there was only one specific reference to software in the Act or regulations – regulation 3.3(5) of the Therapeutic Goods (Medical Devices) Regulations 2002 (Cth) states that software which forms part of a hardware medical device will be classified in the same way as the hardware device.

The lack of specific consideration of software in the medical device regime highlights the shortfalls of our current regulatory system in managing the growing number of standalone therapeutic software products entering the market.

TGA proposed reforms

The reforms proposed by the TGA, in February 2019, broadly follow proposals made by the International Medical Device Regulators Forum (IMDRF) in relation to the definition and classification of SaMD.

The IMDRF defines SaMD as “software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device”.

Importantly this definition excludes any software which relies on a specific hardware device to perform its intended medical function, e.g. the software used to control an MRI machine.

The TGA has proposed three main reforms to specifically address how SaMD under this definition will be regulated:

1. a new device classification system specifically for SaMD;
2. closing the personal import exemption for SaMD; and
3. updating the medical device essential principles to address SaMD directly.

New classification system for SaMD

The TGA proposed changes to address the current classification system in relation to SaMD. Under the existing regulations, the risk classification of a device and the level of scrutiny required before it is listed on the Australian Register of Therapeutic Goods (ARTG) are primarily based on the level of physical interaction the device has with the patient. As SaMD inherently do not interact with the patient, it is almost exclusively considered class I and needs no third party oversight or review prior to listing on the ARTG. This default classification overlooks the potentially substantial risks of harm associated with modern, sophisticate SaMD which might be relied upon to diagnose serious conditions, propose treatments or set drug dosage levels.

The new classification system is based on IMDRF recommendations and will set the risk classification level of SaMD based on:

1. The significance of the information provided by the software to the healthcare decision
2. The context in which the information is used
3. The state of the healthcare situation or condition

Under this proposal, most SaMD will be reclassified at a higher risk level. This would bring the Australia regulatory system broadly into alignment with European Medical Device Regulation 2017/745 and would effectively change the default classification for most SaMD from Class I to Class IIa.

Closing the personal import exemption

Medical devices imported into Australia must generally be approved by the TGA and listed on the ARTG; however, there is currently an exemption for devices imported for personal use. In relation to SaMD, this exemption allows developers outside Australia to produce SaMD and make it available for download directly by consumers in Australia without being listed on the ARTG. This effectively permits mass importation of SaMD without any TGA oversight, certification of the device or capacity to ensure ongoing post-market monitoring.

To address this, the TGA has proposed removing the personal import exemption in relation to SaMD, requiring all SaMD to be listed on the ARTG regardless of import route.

Updating the essential principles

The medical device essential principles set out the fundamental design and manufacturing requirements which manufacturers must comply with to obtain ARTG listing. The essential principles are broadly framed and non-prescriptive in order to cover the broad range of medical devices. As a result, the existing principles are generally applicable to SaMD, but do not specifically address the requirements or standards for best practice software design.

Although the TGA notes that many developers already adhere to best practice, the essential principles will be updated to formalise these requirements and provide clarity for SaMD manufacturers. In particular, the updated essential principles will clarify the TGA’s expectations regarding areas such as taking account of computing platform features and capabilities, managing cyber security risks, facilitating updates and notifying users of any associated clinical risks and managing risks of unauthorised access to devices.

What has changed?

From 25 August 2020 new classification rules for software medical devices will be introduced in Schedule 2 to the Therapeutic Goods (Medical Devices) Regulations 2002 and new software specific design principles will be introduced to the Essential Principles in Schedule 1. These changes substantially implement two out of the three reforms proposed by the TGA. These changes also bring the Australian regulations substantially into alignment with the European MDR 2017/745.

Under the new regulations, programmable or software medical devices which diagnose, screen conditions, recommend treatments or inform medical practitioners will be classified based on the risk that information poses to the patient or public health. One notable change from the TGA’s recommendations is that lower risk devices in most cases will remain class I, rather than being moved to class IIa by default.

Essential Principle 12.1 has been significantly expanded to specifically address key areas of concern identified in the consultation. Under the new Essential Principles, cyber security, data management, computing platform compatibility and software development best practices must all be specifically addressed in the design of the device.

Key takeaways

• The changes to the medical device regime will come into effect on 25 August 2020.
• The changes will only apply to SaMD, i.e. standalone software which is intended to have a medical purpose – software which solely encourages health and wellness related lifestyle objectives will remain unregulated, whether as a medical device or otherwise.
• Many devices which assist diagnosis or monitoring are expected to retain their current classification, while devices which directly provide therapy are expected to move to a higher classification.
• The TGA’s proposed changes to the personal import exemption are yet to be implemented.
• The new regulations do not apply to IVD devices.
• SaMD developers or those expecting to enter the market within the next 12 – 18 months are advised to conduct a gap analysis between their current regulatory obligations and those under the new regime.
• SaMD developers are advised to inform all commercial personnel of any potential shift in the entity’s usual regulatory obligations.