Blog

TGA guidance in line with cybersecurity requirements from US, Canadian, South Korean regulators

The US Food and Drug Administration has called for test cases from developers for its nascent Pre-Cert certification program for software as a medical device (SaMD).

EMERGO BY UL SUMMARY OF KEY POINTS: Connected medical device design and develoment paradigm shifting...

EMERGO BY UL SUMMARY OF KEY POINTS: US FDA publishes final guidance on Q-Submission Program for medical device and IVD manufacturers; Sample Q-Sub questions provided by FDA now include those for cybersecurity-related issues; Final Q-Sub guidance replaces draft guidance issued in 2017.

EMERGO BY UL SUMMARY OF KEY POINTS: Health Canada proposing regulatory requirements for software as a medical device (SaMD). Proposed Health Canada regulations for SaMD based on International Medical Device Regulators Forum (IMDRF) guidelines. Health Canada SaMD regulations would exclude products such as electronic health records and wellness apps.

EMERGO BY UL SUMMARY OF KEY POINTS: US FDA has issued a new regulatory framework, working model and test plan for its Pre-Cert pilot program for Software as a Medical Device (SaMD). The FDA Pre-Cert regulatory pathway would utilize FDA’s De Novo classification request framework for qualifying SaMD products. FDA is accepting comments on these Pre-Cert updates through March 8, 2019.

EMERGO BY UL SUMMARY OF KEY POINTS: Regulatory focus on medical device safety and risk management intensifying; Functions such as clinical research, post-market surveillance and ISO 14971 compliance should bolster safety and risk management efforts; More robust safety and risk management processes to help medical device companies pivot faster when regulators change requirements.

EMERGO SUMMARY OF KEY POINTS: European regulators have published high-level cybersecurity recommendations for industries including medical devices involved in the Internet of Things (IoT) paradigm. The recommendations are partially intended to help companies meet upcoming European data privacy requirements under the General Data Protection Regulation, or GDPR. The European report cites US FDA guidance regarding medical device cybersecurity principles and recommendations.

EMERGO SUMMARY OF KEY POINTS: US FDA has issued three new guidances focused on digital health technology regulations. The guidances stem from 21 st Century Cures Act requirements for timelier registration processes for digital medical technologies.

EMERGO SUMMARY OF KEY POINTS: Pressure from US regulators and healthcare purchasing organizations for medical devices to demonstrate adequate encryption capabilities is increasing. Compliance with the Federal Information Publications Standard (FIPS) 140-2 standard enables manufacturers to demonstrate adequate encryption tools for their devices. FIPS 140-2 compliance is best addressed early in the medical device design phase.

EMERGO SUMMARY OF KEY POINTS: New legislation introduced in the US House of Representatives would launch a working group headed by the FDA to develop strategies for mitigating cybersecurity risks in medical technology. The proposed legislation builds on recommendations issued by the Health Care Industry Cybersecurity Task Force earlier in 2017. If passed by the full Congress, the legislation would require the FDA-led working group to report on its efforts within 18 months.

EMERGO SUMMARY OF KEY POINTS The US FDA has identified nine participants in its digital health technology and software precertification pilot program. FDA Pre-Cert pilot participants include firms such as Apple, Samsung, Fitbit and Johnson & Johnson. The FDA will provide periodic Pre-Cert pilot updates as well as a public workshop in early 2018.

EMERGO SUMMARY OF KEY POINTS: The Singapore Health Sciences Authority (HSA) has issued new clarification and an FAQ regarding how telehealth products and mobile medical apps are regulated in the country. HSA plans an immediate market access pathway for mobile medical apps that have already registered in the US, Canada, Australia, Europe and/or Japan. Singapore’s general regulatory approach to telehealth resembles that of the US FDA.

EMERGO SUMMARY OF KEY POINTS: The US FDA has now officially recognized the UL 2900 cybersecurity standard for medical devices. UL 2900-1 covers general cybersecurity requirements for network-connectable devices. FDA medical device applicants may now declare conformity to UL 2900-1 in order to address cybersecurity requirements as part of their US market registration.

EMERGO SUMMARY OF KEY POINTS: The US FDA will begin its Pre-Certification for Software (Pre-Cert) pilot program for digital health technologies considered medical devices in September 2017. Eligibility requirements for Pre-Cert participation as well as frequently asked questions have been published. As of now, US regulators have not set a deadline for applying to participate in the Pre-Cert program.