Does FDA Deem My Product to be a Medical Device?

Does FDA deem your product to be a medical device, or is it just a consumer product that would not be regulated by FDA?

Here are basic steps you can take to work through the puzzle.

1. Determine whether you have a medical device.

A medical device is “an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article, including a component part, or accessory which is:

• recognized in the official National Formulary, or the United States Pharmacopoeia, or any supplement to them,
• intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man or other animals, or
• intended to affect the structure or any function of the body of man or other animals, and which does not achieve any of its primary intended purposes through chemical action within or on the body of man or other animals and which is not dependent upon being metabolized for the achievement of any of its primary intended purposes.”

This definition provides a clear distinction between a medical device and other FDA regulated products such as drugs. If the primary intended use of the product is achieved through chemical action or by being metabolized by the body, the product is usually a drug.

FDA says this in a description of how many products can be considered medical devices:

Medical devices range from simple tongue depressors and bedpans to complex programmable pacemakers with micro-chip technology and laser surgical devices. In addition, medical devices include in vitro diagnostic products, such as general purpose lab equipment, reagents, and test kits, which may include monoclonal antibody technology. Certain electronic radiation emitting products with medical application and claims meet the definition of medical device. Examples include diagnostic ultrasound products, x-ray machines and medical lasers. If a product is labeled, promoted or used in a manner that meets the following definition in section 201(h) of the Federal Food Drug & Cosmetic (FD&C) Act it will be regulated by the Food and Drug Administration (FDA) as a medical device and is subject to premarketing and post-marketing regulatory controls

Even electric toothbrushes are regulated as medical devices, because they are intended to help prevent tooth decay and gum disease.

2. Classify the Device

If a product is a medical device, then the first step in determine the regulation that applies, is to classify the medical device.  FDA has established classifications for approximately 1,700 different generic types of devices and grouped them into 16 medical specialties referred to as panels. Each of these generic types of devices is assigned to one of three regulatory classes based on the level of control necessary to assure the safety and effectiveness of the device:

• Class I (lowest risk to the patient and/or user; as noted, subject to general controls (with and without exemptions; if exempt, then subject to FDA limitations on exemptions).
• Class II (riskier; as noted, subject to general controls and special controls (with and without exemptions).
• Class III (most risky; as noted, subject to general controls and premarket approval, the most rigorous submission).

Device classification depends on the intended use of the device (for example, a scalpel is intended to cut tissue) and also on the indications for use (for example, a particular scalpel used to make incisions in the cornea).

Class I devices are the least risky and subject to “general controls,” including provisions relating to:

• adulteration
• misbranding
• device registration and listing
• premarket notification
• banned devices
• notification, including repair, replacement, or refund
• records and reports
• restricted devices;
• and good manufacturing practices (GMPs)

FDA has exempted almost all Class I devices (exempt from the premarket notification requirement (i.e., here, the 510(k)), and has published a list of Class II devices, subject to certain limitations, that are exempt.

Class II devices are subject general controls and special controls.  Special controls include:

• special labeling requirements
• mandatory performance standards
• post-market surveillance

Class II devices typically require a submission to FDA showing that the device is substantially equivalent” (SE) to an already legally marketed medical device (called a predicate device) that is not subject to premarket approval (PMA).  This is determined by filing a 510(k) submission to the FDA to demonstrate substantial equivalence.

Class III devices require premarket approval (PMA).  Class III devices usually are those that support or sustain human life, are of substantial importance in preventing impairment of human health, or present a potential, unreasonable risk of illness or injury.  For example, an implantable pacemaker.

There are more things you need to know, though, as you think about classification and trying to figure out how to get your product to market.

The 510k

FDA provides detailed guidance on the 510(k) submission process. In brief:

21 CFR 807 Subpart E describes requirements for a 510(k) submission. Before marketing a device, each submitter must receive an order, in the form of a letter, from FDA which finds the device to be substantially equivalent (SE) and states that the device can be marketed in the U.S. This order “clears” the device for commercial distribution.

A 510(k) is a premarket submission made to FDA to demonstrate that the device to be marketed is at least as safe and effective, that is, substantially equivalent, to a legally marketed device (21 CFR 807.92(a)(3)) that is not subject to PMA. Submitters must compare their device to one or more similar legally marketed devices and make and support their substantial equivalency claims. A legally marketed device, as described in 21 CFR 807.92(a)(3), is a device that was legally marketed prior to May 28, 1976 (preamendments device), for which a PMA is not required, or a device which has been reclassified from Class III to Class II or I, or a device which has been found SE through the 510(k) process.  The legally marketed device(s) to which equivalence is drawn is commonly known as the “predicate.”  Although devices recently cleared under 510(k) are often selected as the predicate to which equivalence is claimed, any legally marketed device may be used as a predicate.  Legally marketed also means that the predicate cannot be one that is in violation of the Act.

Until the submitter receives an order declaring a device SE, the submitter may not proceed to market the device. Once the device is determined to be SE, it can then be marketed in the U.S. The SE determination is usually made within 90 days and is made based on the information submitted by the submitter.

Please note that FDA does not perform 510(k) pre-clearance facility inspections. The submitter may market the device immediately after 510(k) clearance is granted. The manufacturer should be prepared for an FDA quality system (21 CFR 820) inspection at any time after 510(k) clearance.

FDA explains that a device is declared “substantially equivalent” (SE) to a predicate device if it:

• has the same intended use as the predicate; and
• has the same technological characteristics as the predicate; or
• has the same intended use as the predicate; and
• has different technological characteristics and the information submitted to FDA;

• • • • does not raise new questions of safety and effectiveness; and
      • demonstrates that the device is at least as safe and effective as the legally marketed device.

A claim of substantial equivalence does not mean the new and predicate devices must be identical. Substantial equivalence is established with respect to intended use, design, energy used or delivered, materials, chemical composition, manufacturing process, performance, safety, effectiveness, labeling, biocompatibility, standards, and other characteristics, as applicable.

FDA further explains that a device may not be marketed in the U.S. until the submitter receives a letter declaring the device SE. If FDA determines that a device is not substantially equivalent, the applicant may:

• resubmit another 510(k) with new data,
• request a Class I or II designation through the de novo process
• file a reclassification petition, or
• submit a premarket approval application (PMA).

FDA describes its fees for 510(k) submissions and 513(g) submissions (described below) on its webpage, Premarket Notification (510(k)) Review Fees.  The small business fees are somewhat lower than the regular fees (currently $2,480 for a 510(k) and $1,674 for a 513(g)).

FDA states that 510(k) submitters may request information on their 510(k) review status 90 days after the initial log-in date of the 510(k). Thereafter, the submitter may request status reports every 30 days following the initial status request.

To find out whether you might have a predicate device on the market on which to base your argument of substantial equivalence for your 510k, you can do a couple of searches:

1. Search the Medical Device Databases, including the Product Code Classification Database
   This database contains medical device names and associated information developed by CRDH (within FDA).  It includes a three letter device product code and a Device Class that refers to the level of CDRH regulation of a given device.
2. Search the Device Classification Panels in the Code of Federal Regulations (CFR), Parts 862-892
   Devices are organized in 21 CFR, Parts 862-892 into 16 medical specialty panels, such as anesthesiology, cardiovascular, chemistry, dental, ear nose and throat, gastroenterology and urology, general and plastic surgery, immunology, microbiology, and so on.Search the 510(k) Premarket Notification database.
3. Search the Total Product Life Cycle (TPLC).
   The Total Product Life Cycle (TPLC) database integrates premarket and postmarket data about medical devices. It includes information pulled from CDRH databases including Premarket Approvals (PMA), Premarket Notifications (510[k]), Adverse Events, and Recalls. You can search the TPLC database by device name or procode to receive a full report about a particular product line.

Intended Use

Remember that FDA looks to the product’s “intended use” and this can be determined from a variety of sources, including all the marketing claims.

Combination Products

A combination product is:

a product composed of any combination of a drug and a device; a biological product and a device; a drug and a biological product; or a drug, device, and a biological product. Under 21 CFR 3.2 (e), a combination product is defined to include:

1. A product comprised of two or more regulated components (i.e., drug/device, biologic/device, drug/biologic, or drug/device/biologic) that are physically, chemically, or otherwise combined or mixed and produced as a single entity;
2. Two or more separate products packaged together in a single package or as a unit and comprised of drug and device products, device and biological products, or biological and drug products;
3. A drug, device, or biological product packaged separately that according to its investigational plan or proposed labeling is intended for use only with an approved individually specified drug, device, or biological product where both are required to achieve the intended use, indication, or effect and where, upon approval of the proposed product, the labeling of the approved product would need to be changed (e.g., to reflect a change in intended use, dosage form, strength, route of administration, or significant change in dose); or
4. Any investigational drug, device, or biological product packaged separately that according to its proposed labeling is for use only with another individually specified investigational drug, device, or biological product where both are required to achieve the intended use, indication, or effect.

513(g) Submission

In case a manufacturer believes that the product is not a medical device, one option is to make a “513(g) Request for Information” submission to the FDA, arguing that the product is not a medical device, and that no regulatory review is necessary. The FDA will respond with its views as to whether the product is a device.

The 513(g) submission can also be used to query the FDA as to its views regarding classification of a medical device.  FDA notes that it will provide FDA’s assessment as to classification; whether a PMA, 510(k) or neither is required in order to market the product; and other regulatory requirements and information.  In a 513(g) submission, FDA does not review data related to substantial equivalence.

The 513(g) submission should contain a cover letter, a description of the product and what it is to be used for, and any proposed labeling or promotional material for the device (as well as for any similar legally marketed product, if available).  The FDA requires a detailed description of the product and its uses.

The FDA generally responds within 60 days. If the FDA’s assessment is that the product is a medical device, then the FDA will generally state whether the product is a Class I, II or III device (and if so, what regulatory requirements apply); whether premarket approval (PMA) or 510(k) is required to market the product; and what other FDA requirements may be relevant.

Cyber Security Plan Submission for Medical Devices

On June 14, 2013, FDA issued Draft Guidance on Content of Premarket Submissions for Management of Cybersecurity in Medical Devices (“Draft Cybersecurity Guidance”).

In brief, the Draft Cybersecurity Guidance states that manufacturers “should develop a set of security controls to assure medical device cybersecurity to maintain information confidentiality, integrity, and availability.” 

Further:

Manufacturers should consider cybersecurity during the design phase of the medical device, as this can result in more robust and efficient mitigation of cybersecurity risks.  Manufacturers should define and document the following components of their cybersecurity risk analysis and management plan as part of the risk analysis required by 21 CFR 820.30(g):

• Identification of assets, threats, and vulnerabilities;
• Impact assessment of the threats and vulnerabilities on device functionality;
• Assessment of the likelihood of a threat and of a vulnerability being exploited;
• Determination of risk levels and suitable mitigation strategies;
• Residual risk assessment and risk acceptance criteria.

              FDA notes that the “extent to which security controls are needed will depend on the medical device, its environment of use, the type and probability of the risks to which it is exposed, and the probable risks to patients from a security breach.”

FDA also asks that manufacturers provide justification in their premarket submission (PMA and 510(k)) for the security features chosen, including:

• Limits access to trusted users only
• Ensure trusted content
• Use fail safe and recovery features

FDA specifically asks that the premarket submission discuss:

1. Hazard analysis, mitigations, and design considerations pertaining to intentional and unintentional cybersecurity risks associated with your device, including:
   • A specific list of all cybersecurity risks that were considered in the design of your device;
   • A specific list and justification for all cybersecurity controls that were established for your device.
2. A traceability matrix that links your actual cybersecurity controls to the cybersecurity risks that were considered;
3. To assure continued safe and effective device use, the systematic plan for providing validated updates and patches to operating systems or medical device software, as needed, to provide up-to-date protection and to address the product life-cycle;
4. Appropriate documentation to demonstrate that the device will be provided to purchasers and users free of malware; and
5. Device instructions for use and product specifications related to recommended anti-virus software and/or firewall use appropriate for the environment of use, even when it is anticipated that users may use their own virus protection software.

FDA Establishment Registration Rules

Section 510 of the federal Food, Drug & Cosmetic Act (“FDCA”) requires medical device establishments to register their location and to list the medical devices that are manufactured, prepared, propagated, compounded, assembled or processed at those establishments.  In 2007, the Food Drug Administration Amendments Act (“FDAAA”) mandated use of an electronic registration and listing system.  In 2012, the Food and Drug Administration Safety and Innovation Act (“FDSIA”) mandated that all registered establishment types pay the annual user registration fee.

As FDA states on its webpage on Device Registration and Listing:

Owners or operators of places of business (also called establishments or facilities) that are involved in the production and distribution of medical devices intended for use in the United States (U.S.) are required to register annually with the FDA. This process is known as establishment registration.

In its summary of relevant regulations, FDA notes that the following domestic establishments must register:

• Manufacturers and Remanufacturers
• Kit Assemblers
• Repackagers and Relabelers
• Contract Manufacturers and Contract Sterilizers
• Specification Developers
• Reprocessors of Single Use Devices
• Complaint Handlers
• Initial Importers

Domestic Distributors (those that distribute devices only from manufacturers in the United States) do not register.  According to FDA, the following foreign establishments must register:

• Manufacturers and Remanufacturers
• Kit Assemblers
• Repackagers and Relabelers
• Contract Manufacturers and Contract Sterilizers
• Specification Developers
• Reprocessors of Single Use Devices
• Complaint Handlers
• Foreign Exporters
• Private Label Distributors

FDA notes that some entities are exempt from registration and listing requirements, including:

• Component manufacturers.
• Licensed practitioners who manufacture or otherwise alter devices solely for use in their practice.
• Retail establishments who provide the device directly to end users.
• Manufacturers of devices properly labeled and used solely in research, teaching, or analysis and are not introduced into commercial distribution.

A domestic establishment must register and list within 30 days of putting the device into commercial distribution.  A foreign establishment must register and list prior to exporting the device to the U.S. for the first time.  An initial importer must register the establishment prior to importing the device into the United States for the first time; the initial importer does not list the device, but must identify the manufacturer of each device imported.

Failure by the foreign establishment to register and list, or by the importer to register, could result in the shipment being detained and held by FDA at the port of entry, in conjunction with the Customs and Border Patrol (“CBP”).

Establishments also must regularly update their registration information.

Domestic, registered establishments are subject to bi-annual inspection. Foreign, registered establishments must include in their registration the name of the U.S. agent for the establishment, the name of each importer and name of each person who imports or offers for import, and other information. In addition to registration, the establishment must file a list of all devices and a brief statement of the basis for believing that the device is a medical device and not a drug, and other prescribed statements.

21 CFR 807 (Establishment Registration and Device Listing for Manufacturers and Initial Importers of Devices) details the regulatory requirements summarized on the FDA website.

Some regulatory definitions within this Part are important:

(b)Commercial distribution means any distribution of a device intended for human use which is held or offered for sale but does not include the following:

(1) Internal or interplant transfer of a device between establishments within the same parent, subsidiary, and/or affiliate company;

… (4) For foreign establishments, the distribution of any device that is neither imported nor offered for import into the United States.

(c)Establishment means a place of business under one management at one general physical location at which a device is manufactured, assembled, or otherwise processed.

(d)Manufacture, preparation, propagation, compounding, assembly, or processing of a device means the making by chemical, physical, biological, or other procedures of any article that meets the definition of device in section 201(h) of the act. These terms include the following activities:

(1) Repackaging or otherwise changing the container, wrapper, or labeling of any device package in furtherance of the distribution of the device from the original place of manufacture to the person who makes final delivery or sale to the ultimate consumer;

(2) Initial importation of devices manufactured in foreign establishments; or

(3) Initiation of specifications for devices that are manufactured by a second party for subsequent commercial distribution by the person initiating specifications.

(f)Owner or operator means the corporation, subsidiary, affiliated company, partnership, or proprietor directly responsible for the activities of the registering establishment.

(g)Initial importer means any importer who furthers the marketing of a device from a foreign manufacturer to the person who makes the final delivery or sale of the device to the ultimate consumer or user, but does not repackage, or otherwise change the container, wrapper, or labeling of the device or device package….

(t)Wholesale distributor means any person (other than the manufacturer or the initial importer) who distributes a device from the original place of manufacture to the person who makes the final delivery or sale of the device to the ultimate consumer or user…

(v)FURLS means the Food and Drug Administration’s Unified Registration and Listing System…

(x)Importer means, for purposes of this part, a company or individual in the United States that is an owner, consignee, or recipient, even if not the initial owner, consignee, or recipient, of the foreign establishment’s device that is imported into the United States. An importer does not include the consumer or patient who ultimately purchases, receives, or uses the device, unless the foreign establishment ships the device directly to the consumer or patient.

(y)Person who imports or offers for import means, for purposes of this part, an agent, broker, or other entity, other than a carrier, that the foreign establishment uses to facilitate the import of its device into the United States.

Each owner or operator must maintain a historical file containing the labeling and advertisements in use on the date of initial listing, as prescribed in 21 CFR 807.26 (Additional listing information).