FDA Mobile Medical App Guidance continues to exert pressure on health-related apps

The FDA’s final Guidance for Industry and FDA staff on mobile medical apps continues to constrain industry development of new health apps. Like the draft mobile medical app FDA guidance, the final FDA Guidance reads FDA jurisdiction expansively. While FDA notes that not all mobile apps are medical devices, FDA intends to “exercise enforcement discretion over these devices.” FDA looks to “functionality and not platform” to determine if a mobile app is a mobile medical app.

What is a Mobile Medical App

Mobile apps include not only software programs that run on smartphones and other mobile communication devices, but also on accessories.

Mobile medical apps meet the definition of a medical device under FDA law. Essentially, this meets the apps:

are intended to be used as an accessory to a regulated medical device, or
transform a mobile platform into a regulated medical device.

These definitions are broader than they may seem. We’ll return to this below.

FDA Enforcement Discretion

FDA explains that it favors health apps that help consumers; and, explains FDA’s “oversight of mobile medical apps as devices and our focus only on the apps that present a greater risk to patients if they don’t work as intended and on apps that cause smartphones or other mobile platforms to impact the functionality or performance of traditional medical devices.”

Although these mobile apps mobile apps may be intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, FDA believes they carry lower risk to the public. Examples include:

To clarify, FDA states that for many mobile apps that meet the regulatory definition of a “device” but pose minimal risk to patients and consumers, the FDA will exercise enforcement discretion and will not expect manufacturers to submit pre-market review applications or to register and list their apps with the FDA. This includes mobile medical apps that:

Help patients/users self-manage their disease or condition without providing specific treatment suggestions;
Provide patients with simple tools to organize and track their health information;
Provide easy access to information related to health conditions or treatments;
Help patients document, show or communicate potential medical conditions to health care providers;
Automate simple tasks for health care providers; or
Enable patients or providers to interact with Personal Health Records (PHR) or Electronic Health Record (EHR) systems.

FDA provides a handy list of Examples of Mobile Apps for which the FDA will exercise enforcement discretion.

Mobile apps that help patients with diagnosed psychiatric conditions (e.g., post-traumatic stress disorder (PTSD), depression, anxiety, obsessive compulsive disorder) maintain their behavioral coping skills by providing a “Skill of the Day” behavioral technique or audio messages that the user can access when experiencing increased anxiety;
Mobile apps that provide periodic educational information, reminders, or motivational guidance to smokers trying to quit, patients recovering from addiction, or pregnant women;
Mobile apps that use GPS location information to alert asthmatics of environmental conditions that may cause asthma symptoms or alert an addiction patient (substance abusers) when near a pre-identified, high-risk location;
Mobile apps that use video and video games to motivate patients to do their physical therapy exercises at home;
Mobile apps that prompt a user to enter which herb and drug they would like to take concurrently and provide information about whether interactions have been seen in the literature and a summary of what type of interaction was reported;
Mobile apps that help asthmatics track inhaler usage, asthma episodes experienced, location of user at the time of an attack, or environmental triggers of asthma attacks;
Mobile apps that prompt the user to manually enter symptomatic, behavioral or environmental information, the specifics of which are pre-defined by a health care provider, and store the information for later review;
Mobile apps that use patient characteristics such as age, sex, and behavioral risk factors to provide patient-specific screening, counseling and preventive recommendations from well-known and established authorities;
Mobile apps that use a checklist of common signs and symptoms to provide a list of possible medical conditions and advice on when to consult a health care provider;
Mobile apps that guide a user through a questionnaire of signs and symptoms to provide a recommendation for the type of health care facility most appropriate to their needs;
Mobile apps that record the clinical conversation a clinician has with a patient and sends it (or a link) to the patient to access after the visit;
Mobile apps that are intended to allow a user to initiate a pre-specified nurse call or emergency call using broadband or cellular phone technology;
Mobile apps that enable a patient or caregiver to create and send an alert or general emergency notification to first responders;
Mobile apps that keep track of medications and provide user-configured reminders for improved medication adherence;
Mobile apps that provide patients a portal into their own health information, such as access to information captured during a previous clinical visit or historical trending and comparison of vital signs (e.g., body temperature, heart rate, blood pressure, or respiratory rate);
Mobile apps that aggregate and display trends in personal health incidents (e.g., hospitalization rates or alert notification rates);
Mobile apps that allow a user to collect (electronically or manually entered) blood pressure data and share this data through e-mail, track and trend it, or upload it to a personal or electronic health record;
Mobile apps that provide oral health reminders or tracking tools for users with gum disease;
Mobile apps that provide prediabetes patients with guidance or tools to help them develop better eating habits or increase physical activity;
Mobile apps that display, at opportune times, images or other messages for a substance abuser who wants to stop addictive behavior;
Mobile apps [if not marketed, promoted or intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, or do not otherwise meet the definition of medical device] that are intended for individuals to log, record, track, evaluate, or make decisions or behavioral suggestions related to developing or maintaining general fitness, health or wellness, such as those that:
- Provide tools to promote or encourage healthy eating, exercise, weight loss or other activities generally related to a healthy lifestyle or wellness;
- Provide dietary logs, calorie counters or make dietary suggestions;
- Provide meal planners and recipes;
- Track general daily activities or make exercise or posture suggestions;
- Track a normal baby’s sleeping and feeding habits;
- Actively monitor and trend exercise activity;
- Help healthy people track the quantity or quality of their normal sleep patterns;
- Provide and track scores from mind-challenging games or generic “brain age” tests;
- Provide daily motivational tips (e.g., via text or other types of messaging) to reduce stress and promote a positive mental outlook;
- Use social gaming to encourage healthy lifestyle habits;
- Calculate calories burned in a workout.

We’ve added the bold above to show that many of these examples involve logging, tracking, or storing data; or using reminders; or, provision of generic advice based on checklists – and, with the proviso that no diagnosis or treatment of disease is occurring via the app.

Examples of Mobile Medical Apps Regulated by FDA

FDA provides a mobile medical apps example page for a list of examples of mobile medical apps that have been cleared or approved by the FDA, and, Examples of MMAs the FDA regulates for a more detailed list of examples of mobile apps that would require FDA review.

FDA recommends that for a list of what is considered a mobile medical application, manufacturers and developers of mobile applications can search FDA’s database of existing classification by type of mobile medical application (for example diagnostic). Approved/cleared mobile medical applications will also be listed in FDA’s 510(k) and PMA databases and on the FDA’s Registration & Listing Database.

FDA also clarifies a question that has come up with our mobile medical app clients previously, which is that FDA’s mobile medical apps policy “does not require mobile medical app developers to seek Agency re-evaluation for minor, iterative product changes.” However, if the intended use changes, then reevaluation is necessary.

FDA’s examples of mobile medical apps (MMAs) it regulates fall into three categories:

Mobile apps that transform a mobile platform into a regulated medical device and therefore are mobile medical apps
Mobile apps that connect to an existing device type for purposes of controlling its operation, function, or energy source and therefore are mobile medical apps
Mobile apps that display, transfer, store, or convert patient-specific medical device data from a connected device and therefore are mobile medical app

Of these three, one of the more common we have seen our clients develop is the third category, an MMA that stores patient data and converts it for display on the physician’s platform to review.

Note that many telemedicine applications will have such a store-and-convert function; and therefore require additional review for FDA MMA issues.

In more detail, the FDA examples include:

Mobile apps that transform a mobile platform into a regulated medical device and therefore are mobile medical apps: These mobile apps use a mobile platform’s built-in features such as light, vibrations, camera, or other similar sources to perform medical device functions (e.g., mobile medical apps that are used by a licensed practitioner to diagnose or treat a disease).

Mobile apps that use a sensor or lead that is connected to a mobile platform to measure and display the electrical signal produced by the heart (electrocardiograph or ECG). Possible product code(s): DPS, MLC, OEY (21 CFR 870.2340), MLO, MWJ (21 CFR 870.2800).
Mobile apps that use a sensor or electrode attached to the mobile platform or tools within the mobile platform itself (e.g., microphone and speaker) to electronically amplify and “project sounds associated with the heart, arteries and veins and other internal organs” (i.e., an electronic stethoscope). Possible product code: DQD (21 CFR 870.1875(b)).
Mobile apps that use a sensor or electrode attached to the mobile platform or tools within the mobile platform itself (e.g., accelerometer) to measure physiological parameters during cardiopulmonary resuscitation (CPR) and give feedback about the quality of CPR being delivered. Possible product code: LIX (21 CFR 870.5200).
Mobile apps that use a sensor attached to the mobile platform or tools within the mobile platform itself to record, view, or analyze eye movements for use in the diagnosis of balance disorders (i.e., nystagmograph). Possible product code: GWN (21 CFR 882.1460).
Mobile apps that use tools within the mobile platform (e.g., speaker) to produce controlled levels of test tones and signals intended for use in conducting diagnostic hearing evaluations and assisting in the diagnosis of possible otologic disorders (i.e., an audiometer). Possible product code: EWO (21 CFR 874.1050).
Mobile apps that use a sensor attached to the mobile platform or tools within the mobile platform itself (e.g., accelerometer) to measure the degree of tremor caused by certain diseases (i.e., a tremor transducer). Possible product code: GYD (21 CFR 882.1950).
Mobile apps that use a sensor attached to the mobile platform or tools within the mobile platform itself (e.g., accelerometer, microphone) to measure physiological parameters (e.g., limb movement, electrical activity of the brain (EEG)) during sleep and are intended for use in diagnosis of specific diseases or conditions such as sleep apnea. Possible product code(s): OLV (21 CFR 882.1400), LEL, MNR (21 CFR 868.2375), FLS, NPF (21 CFR 868.2377).
Mobile apps that use an attachment to the mobile platform to measure blood oxygen saturation for diagnosis of specific disease or condition. Possible product code(s): DQA, NLF, MUD, NMD (21 CFR 870.2700) or DPZ (21 CFR 870.2710).
Mobile apps that present donor history questions to a potential blood donor and record and/or transmit the responses to those questions for a blood collection facility to use in determining blood donor eligibility prior to collection of blood or blood components. Possible product code: MMH
Mobile apps that use an attachment to the mobile platform to measure blood glucose levels. Possible product code: NBW (21 CFR 862.1345).
Mobile apps that use that use an attachment to the mobile platform (e.g., light source, laser) to treat acne, reduce wrinkles, or remove hair. Possible product code: OLP, OHT, OHS (21 CFR 878.4810), OZC (21 CFR 890.5740).

Note that these primarily involve use of sensors, attachments, and tools being added to the smartphone or other device.

Mobile apps that connect to an existing device type for purposes of controlling its operation, function, or energy source and therefore are mobile medical apps: These mobile apps are those that control the operation or function (e.g., changes settings) of an implantable or body worn medical device.

Mobile apps that alter the function or settings of an infusion pump. Possible product codes: MEB, FRN, LZH, LZG, OPP, MEA (21 CFR 880.5725), FIH (21 CFR 876.5820), LKK.
Mobile apps that act as wireless remote controls or synchronization devices for computed tomography (CT) or X-Ray machines. Possible product code: JAK (21 CFR 892.1750), IZL (21 CFR 892.1720), KPR (21 CFR 892.1680).
Mobile apps that control or change settings of an implantable neuromuscular stimulator. Possible product code(s): GZC (21 CFR 882.5860).
Mobile apps that calibrate, control, or change settings of a cochlear implant. Possible product code(s): MCM.
Mobile apps that control the inflation or deflation of a blood-pressure cuff. Possible product code: DSJ (21 CFR 870.1100), DSK (21 CFR 870.1110), DXN (21 CFR 870.1130).

Once again, these primarily involve the use of functions or controls that convert the smartphone or similar device into a medical device in a physical or tangible way.

Mobile apps that display, transfer, store, or convert patient-specific medical device data from a connected device and therefore are mobile medical apps:

Mobile apps that connect to a nursing central station and display medical device data to a physician’s mobile platform for review. (i.e., a medical device data system or MDDS). Product code: OUG (21 CFR 880.6310).
Mobile apps that connect to bedside (or cardiac) monitors and transfer the data to a central viewing station for display and active patient monitoring. Possible product code(s): DSI, MHX, MLD (21 CFR 870.1025), DRT, MWI, MSX (21 CFR 870.2300).
Mobile apps that connect to a perinatal monitoring system and transfer uterine contraction and fetal heart rate data to another display to allow for remote monitoring of labor progress. Possible product code(s): HGM (21 CFR 884.2740).

These, as mentioned, are the most elusive, since the connection may be less visible or less obvious, and has to do with displaying, transferring, storing, or converting information – again, the implications for telemedicine is that once the app stores and/or transmits information for remote physician view and review, FDA (as well as state licensing) issues must be analyzed.

FDA allows inquiries to the Division of Small Manufacturers, International and Consumer Assistance, although one can always choose to remain “dark” and have the initial, informal inquiry made by legal counsel.

Another option is the 513(g) letter, which asks the FDA for written feedback applicable to the mobile app. This is more typically advisable if the venture is fairly clear that the product is likely to be regulated as a mobile medical app, and seeks guidance on classification, labeling, and related matters; although some ventures may want to use the 513(g) as a means to ferret out whether the product will indeed be deemed an MMA, or, if it is such, exempt from the more burdensome 510(k) submission process. There are pros and cons to the 513(g) process which should be vetted with legal counsel. FDA typically responds to the 513(g) request within 60 days of receipt.

One thing to note is that even where FDA exercises enforcement discretion, mobile app manufacturers still should follow the Quality System (QS) regulation. In its FAQ in Appendix C to the Guidance, FDA states its belief that “all manufacturers of medical device software should have in place an adequate quality management system that helps ensure that their products consistently meet applicable requirements and specifications and can support the software through its total life cycle.”

MMA manufacturers should also address HIPAA when dealing with protected health information, and, have a cybersecurity plan in place sufficient to alleviate both FDA and FTC (Federal Trade Commission) concerns.

Mobile Medical App Manufacturer

In general, a mobile medical app manufacturer may include anyone who initiates specifications, designs, labels, or creates a software system or application for a regulated medical device in whole or from multiple software components.

Of interest are those who are NOT considered to be mobile medical app manufacturers. This includes:

Manufacturers or distributors of mobile platforms who solely distribute or market their platform and do not intend (by marketing claims — e.g., labeling claims or advertising material) the platform to be used for medical device functions.
Third parties who solely provide market access to mobile medical apps (i.e. solely distribute mobile apps), but do not engage in any manufacturing functions.
Providers of tools, services or infrastructure used in the development, distribution, or use of a mobile medical app. Examples include providers of internet connectivity.
Persons who manufacture mobile medical apps solely for use in research, teaching, or analysis and do not introduce such devices into commercial distribution.
Licensed practitioners, including physicians, dentists, and optometrists, who manufacture a mobile medical app or alter a mobile medical app solely for use in their professional practice and do not label or promote their mobile medical apps to be generally used by other licensed practitioners or other individuals.

This is an important carve-out for those clinicians who simply create an app for use in their office.

Once the clinician (or researcher) markets the app in interstate commerce, such person or entity is considered a mobile medical app manufacturer.

Wrap-Up

FDA can exercise jurisdiction over health apps when it consider them to be “medical devices,” and retains discretion to make the determination or not. FDA need not be polite by sending your company a warning letter. It can swoop in with penalties and other enforcement action.

Therefore, the best time to consult an FDA lawyer for advice is in a preventative capacity, long before the blueprints translate into software. Contact our FDA attorney team with questions regarding your mobile health software or online health project.