Through rapid advances in computing technology, software has expanded from our personal devices and televisions, and into our medical devices. Software products can now inform, drive, and even replace clinical decisions and directly provide therapy to individuals, drastically changing their risk profiles in medicine and healthcare.
To better address such use of software in the field and align Australia’s regulatory position with international guidance and the European Union position, regulatory requirements specific to software-based medical devices have been incorporated in the Therapeutic Goods (Medical Devices) Regulations 2002 (Regulations).
The updated Regulations are administered by the Therapeutic Goods Administration (TGA) from 25 February 2021. Applications to include software-based medical devices in the Australian Register of Therapeutic Goods (ARTG) after this date must meet the new requirements, whereas transition arrangements until 1 November 2024 apply for applications made prior to this date and software-based medical devices already included in the ARTG.
Who will be affected?
The Regulations apply to manufacturers of software-based medical devices and sponsors of the devices (persons or companies supplying the devices in Australia or exporting them out of Australia).
Software developers could be considered manufacturers for regulatory purposes if their products fall within the definition of a therapeutic good or medical device, and they meet the definition of a manufacturer under the Therapeutic Goods Act 1989 (Cth). They will then need to bear responsibility for their software-based medical devices (eg classify the device and obtain conformity assessment certification if necessary).
Accordingly, software developers and businesses in the medical technology space should take note of the new and existing requirements in the Regulations and consider whether and/or how their products may be affected.
For example, an app that monitors sleep and movement to assess and report on the quality and quantity of sleep is not considered a medical device. Conversely, software that monitors sleep and also predicts risk of sleep apnoea is a medical device which will be regulated. Software that records images directly from an MRI scanner is a medical device, whereas software that communicates medical images between devices is not, and will be excluded from regulation. Similarly, laboratory software that facilitates transfer of data between medical devices, but does not drive or influence a device, or analyse the data transferred will not be considered a medical device.
What are the changes?
Some of the key changes to the Regulations which have come into effect are:
- Regulatory exclusions and exemptions for certain software products;
- New classification rules relating to software-based medical devices; and
- Updated Essential Principles clarifying requirements for software-based medical devices.
Exclusions and exemptions
Exclusions and exemptions for specific types of software products have been introduced to ensure sponsors and manufacturers of software products are not subject to unnecessary regulatory oversight. Specifically:
- Excluded products are not medical devices and are not subject to any TGA regulatory requirements; and
- Exempted products are medical devices and subject to some but not all regulatory requirements. They are not required to be registered on the Australian Register of Therapeutic Goods (ARTG) but the TGA still retains some oversight for advertising, adverse events and notification.
A software product will be excluded if it meets the exclusion criteria in Therapeutic Goods (Excluded Goods) Amendment (Software-based Products) Determination 2021. Per the criteria, software products will be excluded from TGA regulation if they are:
- Consumer health products for prevention, management and follow up not intended to be used for serious diseases or conditions or provide specific treatment or treatment suggestions (eg wearables allowing the wearer to track their heart rate for fitness and kilojoule counters);
- Enabling technology to support telehealth and healthcare facility management (eg software to facilitate telehealth consultations, clinical workflow management software and systems intended to only store or transmit patient images);
- Digitisation of paper based or other published clinical rules or data (eg simple dose calculators and Electronic Patient Records).
- Population based analytics that do not drive outcomes for individuals; and
- Laboratory information management systems (eg software to automate workflow in laboratories, manage orders and samples, and facilitate data transfers without analysing the data transferred or controlling a medical device).
A software-based medical device will be exempted if it meets the exemption criteria in Part 2 of Schedule 4 of the Regulations. The criteria includes a new exemption for clinical decision support software provided that the software is not intended to directly process or analyse medical information from another medical device, and is intended to only provide or support a recommendation to a health professional, not replacing his or her clinical judgment.
A software-based medical device that does not meet the exemption will be subject to all applicable regulatory requirements, including registration on the ARTG.
New classification rules
The new classification rules apply to software-based medical devices referred to as ‘programmed or programmable medical device or software that is a medical device‘ (PPSMD). The rules consider PPSMDs by their intended purposes and categorise the devices as follows:
- Diagnosing or screening for a disease or condition;
- Monitoring the state or progression of a disease or condition, or the parameters of a person with a disease or condition;
- Specifying or recommending a treatment or intervention; and
- Providing therapy through the provision of information.
Specific considerations and tiers of classification apply depending on the category the PPSMD falls in. Broadly, the relevant considerations are:
- For PPSMDs involved in diagnosis or screening, the severity of the associated disease or condition, whether the device is intended to be used by relevant health care professionals and associated public health risk;
- For PPSMDs intended to provide information to monitor diseases or conditions, whether the information provided could indicate if a person is in immediate or other danger and associated public health risk;
- For PPSMDs that specify or recommend treatments, whether the device directly specifies or recommends treatment (ie does the software or user make the decision), the risk of harm associated with the specified or recommended treatment, associated public health risk and whether the device is intended to be used by relevant health care professionals and the extent of the health professional’s involvement in the decision-making process; and
- For PPSMDs that provide therapy through provision of information, the potential of therapy to cause harm to the person using the information.
Generally, the higher the level of risk, the higher the classification required, and therefore the higher level of regulatory scrutiny by the TGA.
Updated Essential Principles
Medical devices, including those based on software, must meet standards relating to safety, purpose, design, construction and transport of medical devices before they can be supplied in Australia. These are known as Essential Principles.
The following changes have been made to improve the clarity of the Essential Principles in respect of software-based medical devices:
- Essential Principle 12.1 has been amended to clarify requirements around software-based medical devices relating to cyber security, the management of data and information, and development, production and maintenance;
- Essential Principle 13.2(3) has been amended to allow information to be provided electronically rather than on a leaflet for software-based medical devices; and
- Essential Principle 13B is introduced to require the current version and build number for software to be made accessible and identifiable to users as software-based medical devices.
All software-based medical devices will need to comply with updated Essential Principles 12.1 and 13.2(3) from 25 February. There are no transitional arrangements for compliance as these changes only clarify existing requirements. There will however be a transition period until 1 November 2024 for software-based medical devices that are already included, or have pending applications for inclusion on the ARTG before 25 February.
Software-based medical devices will also need to comply with all other applicable Essential Principles in addition to the above, as described in Schedule 1 of the Regulations.
How can we help?
The new changes to software-based medical devices regulations are extensive and undoubtedly widen the regulatory framework businesses must navigate in this space.
If you are unsure how the changes will affect your software product and whether it could be deemed a medical device, or if you need any general advice in relation to medical devices and therapeutic goods regulations, please feel free to contact a member of our Intellectual Property, Technology and Health Law teams for assistance. Our teams have extensive experience in advising businesses on therapeutic goods regulatory issues, including those relating to software-based medical devices.
This article was written by Luke Dale, Partner and Stephanie Leong, Solicitor.
