Legal expert: FDA’s CDS software guidance is a ‘disaster’ for industry

Regulatory NewsRegulatory News | 29 September 2022 |  By 

The US Food and Drug Administration’s (FDA) final guidance on clinical decision support (CDS) software goes against the statutory language laid out in the 21st Century Cures Act, according to a legal expert following the matter. While the guidance seeks to elaborate what CDS software FDA will regulate, critics said the agency’s rationale goes against what Congress has mandated.
The Cures Act included language stating that the FDA should not regulate certain medical software such as CDS software, so long as it is not the primary decision resource for health care providers (HCP). Such unregulated software should also allow physicians to independently review the basis for the medical decision.
On 27 September, the FDA published a final guidance titled Clinical Support Software, that Bradley Merrill Thompson, attorney at Epstein Becker Green, says overrides Congress’ mandate and broadly expands the agency’s oversight authority.
“FDA clearly wants to block what Congress has done, to the point where it is reaching nonsensical conclusions about what statutory language means,” he told Focus.
Thompson said that FDA’s decision to narrow what CDS software it won’t regulate was in response to comments it received on its 2019 draft guidance, in which stakeholders argued that the agency’s risk-based framework for deciding which software to regulate violated the Cures Act. (RELATED: FDA Explains What Mobile Apps Are No Longer Devices, Regulatory Focus 26 September 2019)
“Having realized that the agency couldn’t defend its interpretation in that regard, the agency shifted approaches and came up with this entirely new attack on the statute and then went right to final guidance with it,” said Thompson. “Never have I seen in 35 years of practicing food and drug law a guidance document so radically changed from proposed to final as this one.”
Thompson said that FDA seems to be “desperately trying to draw a distinction” between software that asserts diagnoses versus those that are more nuanced in their diagnostic recommendation. He also noted that the agency has removed a section on risk that was based on discussions with the International Medical Device Regulators Forum (IMDRF). (RELATED: Clinical Decision Support Software: Stakeholders Seek More Clarity From FDA Draft Guidance, Regulatory Focus 16 January 2020)
While the Cures Act states that FDA shouldn’t regulate CDS software that analyzes “medical information about a patient,” the agency said it will not regulate “the type of information that normally is, and generally can be, communicated between HCPs in a clinical conversation or between HCPs and patients in the context of a clinical decision, meaning that the relevance of the information to the clinical decision being made is well understood and accepted.”
Thompson said that FDA’s interpretation in the final guidance is narrower than what Congress intended and would “severely tie the hands” of software developers.
“Machine learning developers routinely include other information adjacent to classical diagnostic information to try to improve accuracy beyond what humans have accomplished in the past,” said Thompson. “The statute in no way says that the information must be limited to that which we already know is relevant.”
The 2016 law also states that CDS software programmers can produce software that analyzes other medical information which leaves the matter of interpretation “open-ended,” according to Thompson. He says it allows them wide leeway for what kind of information can be used for the basis of their algorithm.
“Yet FDA takes it in the complete opposite direction [in the final guidance], declaring that those are words somehow of limitation, that mean the information must be from peer-reviewed clinical studies, clinical practice guidelines or ‘similarly independently verified and validated as accurate, reliable, not omitting material information, and supported by evidence,’” said Thompson. “Where the heck did that come from in the statutory language?”
Another criteria in the Cures Act when exempting certain medical software includes when such software is meant to support or provide recommendations to HCPs about how to prevent, diagnose or treat a patient. Thompson argues that FDA interprets that provision to mean that CDS software cannot direct providers on what to do.
“Apparently, FDA has a very low view of healthcare professionals if the agency thinks that mere software can ‘direct’ doctors what to do, as if the doctor then has no choice,” he said. “FDA amplifies on this to say that in determining whether the software directs a healthcare professional what to do, the agency will look at the level of software automation and the time-critical nature of the healthcare professional’s decision-making.”
In the final guidance, FDA raises concern that physicians and other HCPs may become too reliant on CDS software even if it’s not meant to be the primary source for decision-making. The agency is concerned such "automation bias” may lead to medical errors of commission where providers follow incorrect advice or omission where they fail to act because they’re not prompted to do so.
“Automation bias may be more likely to occur if software provides a user with a single, specific, selected output or solution rather than a list of options or complete information for the user to consider,” said FDA. “In the former case, the user is more likely to accept a single output as correct without taking into account other available information to inform their decision-making.”
To address this concern, the agency said it will regulate certain software that provides information that a specific patient may exhibit signs of a disease or condition or identify the risk probability or risk score for particular disease or condition.
Thompson said that this interpretation has no basis in the statutory language.
“This is FDA rebelling against Congress to limit what Congress has done,” Thompson said. “According to the statutory language, if the software produces a ‘recommendation,’ the software will be exempt if it meets the other elements of the statutory provision.”
“The statute does not say any words of limitation that the recommendation must somehow be mealymouthed or does not exempt,” he added. “FDA is adding words not found in the statute. Congress put no adjective before the word ‘recommendation’ that would support this interpretation.”
Similarly, FDA said it plans to regulate software that is “intended to support time-critical decision-making.” Thompson said this decision isn’t supported by the statutory language either, though he understands that the agency is concerned about whether physicians will have enough time to review the software’s clinical recommendations before making a decision.
“It is true that all CDS is automation just by definition,” Jeffrey Senger, a partner at Sidley Austin and former acting chief counsel at FDA, told Focus. “If FDA thinks that automation bias is problematic, then they would be saying all CDS is problematic.”
“There's nothing in the Cures Act that enacts a time-critical distinction and so the FDA came up with that all on their own,” he added.
Senger said he thinks the agency was trying to be thoughtful by acknowledging that automation bias exists and is concerned especially with time-critical decision software which may require more regulatory oversight. Like Thompson, he is also concerned with the FDA's statement that it will refrain from regulating CDS software where the information used would be information that is shared in general conversation between physicians and their patients for clinical purposes.
"I have clients who have very sophisticated information that they have developed that can be of great value in a CDS algorithm that is not normally and generally communicated between HCPs and patients," he said. "I agree that if the FDA interpretation is exclusive [to such information], then it would exclude some information that could be valuable."
On the more positive aspect of the final guidance, Senger said he’s happy the FDA has cleared up some ambiguity from the draft guidance, including about whether it would regulate CDS software that doesn’t acquire, process, or analyze signals. He said the loophole stemmed from the wording in the Cures Act itself where there was ambiguity about the definition of what constitutes a signal.
“There were some concerns that if interpreted broadly, which FDA's draft seemed to leave open as possibility, a great deal of CDS would be regulated because much of it analyzes signals,” said Senger. He noted devices processing information such as heart rate, temperature and blood pressure could be considered as processing signals.
“I thought that the final guidance was useful in its closing of that loophole and its clarity that discrete test results would not be considered signals, but instead signals would refer to continuous sampling like continuous glucose monitors, which would be outside of the protection of the statute,” said Senger.
Because FDA guidances don’t hold legal weight, CDS software developers can’t immediately challenge the agency in court and would have to wait until the agency acts on the guidance to mount a challenge to the policy.
For the time being, Thompson said stakeholders unhappy with the final guidance will need to reach out to lawmakers to voice their concerns about the guidance.
“I guess we live in interesting times,” said Thompson. “Having waited six years since the statute was enacted, this final guidance is truly a disaster for the clinical decision support industry, and the healthcare professionals and ultimately the patients who would benefit from expanded use of these software programs.”
Morgan Reed, executive director of the Connected Health Initiative, said he appreciates the FDA’s efforts to give more clarity to physicians and CDS software developers. However, he does have suggestions to improve the guidance.
“FDA should help define the term ‘physiologic’ [in the guidance] broadly to include characteristics of human functioning and well-being for the prevention or treatment of disease, recognizing that its definition will have a wide impact on digital health past the FDA’s approach to CDS software,” he told Focus. “This is an issue that will continue to need additional direction.”


© 2023 Regulatory Affairs Professionals Society.

Discover more of what matters to you