FDA issues draft guidance for software updates in medical devices

The Food and Drug Administration released new draft guidance to help clarify when makers of certain types of medical devices may need additional clearance for a software update.

Unveiled this week, the draft applies to medical devices, like MRI machines, that were put through FDA’s 510(k) submission process — a pathway, meant for products that pose a medium-to-low risk to patients, that requires manufacturers to demonstrate their product is “at least as safe and effective” as similar devices already on the market. The draft lays out under what circumstances makers of these devices would need to file another 510(k) submission to account for a change. 

While Beau Woods, deputy director of the Atlantic Council’s Cyber Statecraft Initiative, said he didn’t see a lot that was new in the draft guidance, it could help to clear up some misconceptions about FDA’s policies among device-makers.

“It’s a great clarification that answers a lot of questions very explicitly and formally that a lot of manufacturers and health care delivery organizations have,” he said of the document. 

Woods also highlighted the decision-making flowchart included in the draft, saying it would be a “powerful” resource for “anyone needing to make these types of decisions.”

Notably, the draft also reiterates that updates made solely to boost the device’s cyber defenses would not require a 510(k). That approach aligns with a separate draft medical device cybersecurity guidance from earlier this year and another final guidance on cybersecurity from 2014, according to Axel Wirth, health care solutions architect at Symantec cybersecurity company.

“I see a constant line here: Regulate where necessary, but don’t stifle for the sake of regulating,” he said. “I applaud the FDA for taking that approach.”

The draft was released at the same time as a separate, more broad draft guidance about what kinds of updates might require a 510(k). Both would update a guidance from 1997 — “a millennia ago,” Wirth joked.

“When finalized, the two guidances will provide improved clarity, regarding minor changes that do not require FDA review, and help ensure that the FDA receives appropriate submissions for modifications that do require premarket review by the agency,” according to an FDA press release. 

The public has until Nov. 7 to comment before the agency begins work on the final version.