FDA / EU / Regulatory Updates
The draft guidance replaces the 2018 draft version and is intended to further emphasize the importance of ensuring that devices are designed securely, enabling emerging cybersecurity risks to be mitigated throughout the Total Product Life Cycle, and to outline the FDA’s recommendations more clearly for premarket submission content to address cybersecurity concerns.
This guidance document is applicable to devices that contain software (including firmware) or programmable logic, as well as software as a medical device (SaMD).
General Principles:
- Cybersecurity is Part of Device Safety and the Quality System Regulations (i.e., CFR 820). For example, QSR processes (e.g., CFR 820.30 Design Controls) should address the identification of security risks, the design requirements for how the risks will be controlled, and the evidence that the controls function as designed and are effective in their environment of use for ensuring adequate security. Cybersecurity risk management and validation processes are of utmost importance for cybersecurity management.
- Designing for Security
FDA will assess the adequacy of the device’s security based on the device’s ability to provide and implement the security objectives below throughout the system architecture.
Security Objectives:
- Authenticity, which includes integrity;
- Authorization;
- Availability;
- Confidentiality; and
- Secure and timely updatability and patchability.
- Transparency. It is important for device users to have access to information pertaining to the device’s cybersecurity controls, potential risks, and other relevant information.
- Submission Documentation. Device cybersecurity design and documentation is expected to scale with the cybersecurity risk of that device. Manufacturers should take into account the larger system in which the device may be used (e.g., connected to networks or other devices).
Using an Secure Product Development Framework (SPDF) to Manage Cybersecurity Risks
The primary goal of using an SPDF is to manufacture and maintain safe and effective devices and it includes:
- Security Risk Management (Threat Modeling, Third-Party Software Components, Software Bill of Materials, Security Assessment of Unresolved Anomalies, Security Risk Management Documentation, Total Product Life Cycle Security Risk Management)
- Security Architecture (Implementation of Security Controls, Security Architecture Views)
- Cybersecurity Testing
The agency is accepting public comments on the guidance until July 7.
The IVDR has a date of application of 26 May 2022. New or significantly modified IVDs must meet the full requirements of the IVDR to be placed onto the market after May 26, 2022. Until that date, multiple IVD tests are added to EU market under the old and less stringent directive (IVDD). There will be a staggered transition period of 5 years for these legacy IVDs placed on the market under Directive 98/79/EC by class (26 May 2025 for devices that fall in class D under the IVDR, 2026 for class C, 2027 for class B and A sterile).
The main aim of this guidance is to point on where to focus limited resources in the shorter term to ensure IVDR compliance as soon as possible and by the date of application. This guidance is applicable for Member States, the European Commission and all interested parties (e.g., IVD manufacturers) to ensure that the IVDR (EU) 2017/746 is operational from 26 May 2022.
The guidance divides the priorities into two categories:
- Set A – essential actions – which includes the actions essential to ensure that IVD devices can effectively access the European market. For example:
- Emergency planning and monitoring (available emergency action tools, minimum timelines for conformity assessment of different kinds of devices, potential bottleneck steps related to the Regulation (e.g. function of notified bodies, supply of samples for EU reference materials, elaboration of new common specifications etc.).
- Availability of Notified Bodies. (potential risk of shortages and disruption of supply of critical IVDs due to the lack of capacity for certification by notified bodies.).
- Set B – high priority actions – which includes all those guidance documents which are expected to be published to facilitate the work of interested parties such as:
- European Union Reference Laboratories (These laboratories, when designated, will carry out additional tests on class D devices that fall in their scope of designation.).
- Common Specifications. (common specifications are legally binding requirements on certain elements of conformity assessment, adopted in the form of an implementing act. If the manufacturer does not comply with the common specifications, they must justify that they have adopted solutions that achieve at least an equivalent level of safety and performance of the device.).
- Guidelines for Notified Bodies. (specific IVD guidance for Notified Bodies to review the submissions of new tests)
- Performance evaluation and expert panels (The IVDR significantly strengthens requirements on clinical evidence of devices. Therefore guidance in this area is a high priority.)
Standards. (Availability of harmonised European standards cited in the Official Journal of the European Union (OJEU) to confer presumption of conformity would support 12 compliance with the requirements of the IVDR for manufacturers.)
Device Approvals
- Trade/Device Name: Fitbit Irregular Rhythm Notifications
- Regulation Number: 21 CFR 870.2790
- Regulation Name: Photoplethysmograph Analysis Software For Over-The-Counter Use
- Regulatory Class: Class II
- Product Code: QDB (A photoplethysmograph analysis software device for over-the-counter use analyzes photoplethysmograph data and provides information for identifying irregular heart rhythms. This device is not intended to provide a diagnosis.)
- Predicate Device: Apple – Irregular Rhythm Notification
Intended Use:
The Fitbit Irregular Rhythm Notifications feature is a software as a medical device (SaMD). The Fitbit Irregular Rhythm Notifications feature analyzes pulse rate data to identify heart rhythms that are consistent with atrial fibrillation (AFib) and if identified, provide a notification to the user. Devices analyzes pulse rate gathered from PPG pulse rate data to identify episodes of irregular heart rhythms suggestive of atrial fibrillation (AFib) and provide a notification to the user
Software Testing Summary:
The Fitbit Irregular Rhythm Notifications presents a “moderate” level of concern (LOC) as defined in FDA’s Guidance for the Content of Premarket Submissions for Software Contained in Medical Devices (May 11, 2005) (Guidance Document). The software components consist of the Irregular Rhythm Notifications algorithm, which resides/runs on Fitbit servers, and the mobile app used for on-boarding, education and display of notification results. Testing supports that the algorithm analyzes pulse rate data and classifies it as having signs of AFib, having no signs of AFib, or unanalyzable. Testing of the mobile application demonstrates that the Fitbit Irregular Rhythm Notifications mobile application adequately surfaces on-boarding/educational information, generates user notifications when the feature identifies an irregular rhythm suggestive of AFib, and facilitates viewing of that notification.
Human Factors Testing Summary:
A human factors study was designed to evaluate the critical and noncritical tasks associated with the use of the device. Human Factors Usability testing was performed using a simulated version of the Fitbit Irregular Rhythm Notifications mobile app, representative of the final app.
There were a total of 30 subjects distributed into two (2) user groups:
- 15 active interest participants – adult laypeople (22 years and older) with active interest in AFib, defined as individuals who:
○ Have concern regarding AFib and have an active interest in monitoring potential AFib, and
○ Would use the app due to high interest
- 15 passive interest participants – adult laypeople (22 years and older) with passive interest in AFib, defined as individuals who:
○ Do not have concern regarding AFib and do not have an active interest in monitoring potential AFib, and
○ Might use the app due to casual or passing interest.
The Human Factors Validation demonstrated that the Fitbit Irregular Rhythm Notifications meets the special control requirements for human factors and usability testing that demonstrates the following:
- The user can correctly use the device based solely on reading the device labeling.
- The user can correctly interpret the device output and understand when to seek medical care.
Testing was also performed to assess consumers’ ability to correctly self-select if the Irregular Rhythm Notifications app is intended for them. This testing involved 33 subjects, including both users for whom the app is intended, as well as persons outside the app’s intended use population. The testing concluded that users can adequately self-select if the device is intended for them.
