Software design for_medical_devices_europe_conferent_19012011[1]

7402875.1

Legal aspects of medical devices software and software as medical device

19 January 2011

©2007, Greenberg Traurig, LLP. Attorneys at Law. All rights reserved.

GREENBERG TRAURIG, LLP ▪ ATTORNEYS AT LAW ▪ WWW.GTLAW.COM

Software Design for Medical Devices EUROPE


19 January 2011

Overview

■ Software in and as a medical device

■What has the revision changed?

■Classification

■ Software standards and guidance

■ Tips for compliance

■What is next in software and standards?


19 January 2011

Developments

■ Devices will become more networked or network-based as a result of developments in eHealth

» Software as service (SAAS) model; device manufacturers become IT service providers

» Remote disease management / patient monitoring

■ Paradigm shift to disease prevention: predict probability of disease (occurrence and recurrence) to support lifestyle management / prophylaxis


19 January 2011

Developments

■ Software becomes even more of an ‘active’ medical device

» Running e.g. on surgical or care robots


19 January 2011

Developments

■Decision supporting knowledge systems

»E.g. interpretation of diagnostic results

■Off-the-shelf medical devices software

»E.g. to be incorporated into other medical devices software

■ eHealth - new paradigms, new problems

»EU initiatives to harmonise EU Member States’ laws and standards


19 January 2011

Software in and as medical device

■ Used alone or in combination with a medical device

» Including the software intended by its manufacturer to be used specifically for diagnostic and/or therapeutic purposes and necessary for its proper application

■ Software for general purposes used in a healthcare setting is not a medical device (recital 6)

■ Supporting tools for device fall within the scope of ‘medical device’ (definition of ‘accessory’)


19 January 2011

When is software a medical device?

■ If one or more of the following four apply:

» Purpose of the software is explicitly mentioned in a Medical Device Directive

□e.g. diagnosis, monitoring, treatment, alleviation (e.g. automated anesthetizer

» Software is intended for use by patients to diagnose or treat a physical or mental condition or disease


19 January 2011

When is software a medical device?

■ If one or more of the following four apply (continued):

» Purpose of software is to control or influence functioning of a medical device

» Software is intended for analysis of patient data generated by a medical device with a view towards diagnosis and monitoring

□e.g. a software for diagnosis of brain scans for Alzheimer


19 January 2011

When must software be CE-marked?

■ Medical device software is one out of the following three:

» A medical device or an accessory to a medical device

□must be CE-marked as such

□Example of accessory: software used for programming and control of pacemakers

» A component and integral part of a medical device

□cannot be CE-marked in its own right, but is covered by the conformity assessment of the medical device of which it forms a part

□example: firmware of a ventilator or infusion pump


19 January 2011

When must software be CE-marked?

■ Medical device software is one out of the following three (continued):

» None of the above

□not covered by the Medical Devices Directives

□example: overall software design tools, administrative software for patient handling» RFID reader linked to patient record


19 January 2011

Changes with respect to software

■Validation of software as device or devices incorporating software according to the state of the art, taking into account (Annex I.12.1a):

»Development life cycle

»Risk management

»Validation

»Verification


19 January 2011

Classification

■ Annex IX - Classification

» Software is class I unless special rule applies (Annex IX, rule 1)

» Stand-alone software is active medical device (Annex IX, I.1.4)

» Active medical device may be active therapeutic device (Annex IX I.1.5) or active device for diagnosis (Annex IX I.1.6): influences classification (Annex IX III.3: additional rules for classification)

» Software falls in the same class as the device it drives or the use that influences (Annex IX 2.3) unless it is an accessory


19 January 2011

Manufacturer obligations

■ Manufacturer of software in and as medical device must comply with all the relevant rules in MDD, e.g.:

» Clinical evaluation as part of technical file (Annex X)

» Vigilance and post marketing surveillance

» Clinical trial requirements

■ Even though compliance with standards assumes compliance with essential requirements (i.e. Annex I), there is no automatic compliance with all provisions of the Medical Device Directives


19 January 2011

Manufacturer obligations: comply with CE■ If changes to software:

» E.g. new version, new intended use, change of platform on which software runs or solving of compatibility issues

■ then manufacturer must ensure that:

» Software still complies with essential requirements in MDD

» Changes are documented (see IEC 60601-1-4)

» Changes are validated and approved

» Significant changes are reported to notified body and to authorities (if applicable, e.g. changes after incident)

» Changes made do not alter the risk class of device – if so, do new conformity assessment

» The manufacturer contacts the notified body if CE certificate refers to versions of software


19 January 2011

Subcontractors for software

■ If the software is developed by someone other than the device manufacturer

»the software developer is not directly responsible for compliance with manufacturer’s intended use


19 January 2011

Subcontractors for software

■ Manage subcontracted or outsourced software development

» Demonstrate control over process within software life cycle

» Require subcontractor/outsourcee to comply with relevant standards (explicitly mention standards in agreement)

» Require subcontractor/outsourcee to report design changes (may be relevant for CE certificate!)

» Embed subcontractors in PMS and vigilance procedures

» Always audit for SOUP (Software Of Unknown Provenance) as part of IEC 62304 and ensure they meet requirements


19 January 2011

Standards and guidance

■ Standards adhered to must be state of the art

■Notified bodies and authorities

»Use standards as yardstick

»Must presume compliance with essential requirements of MDDs if compliance with EU published standards (e.g. publication of IEC 62304:2006 in Official Journal of 27 November 2008)


19 January 2011


■Medical device software standards

»IEC 60601-01:2005 - general requirements for basic safety and essential performance

»IEC 60601-1-4 - programmable electrical medical systems

»IEC 60601-1-6 - usability

»IEC 62304:2006 - medical device software - software life cycle processes (OJ 2008 C304/8)

»IEC 61508-3 - functional safety of electrical/electronic/programmable safety related systems


19 January 2011


■Medical device software standards

»Medical devices on networks

□IEC 80001 - Application of risk management to IT networks incorporating medical devices

»Software risk management

□IEC 80002 - Guidance on the application of EN 14971 to medical device software with reference to EN 62304


19 January 2011

IEC 62304 - Relationship to other standards


19 January 2011

Clinical Evaluation of Software

■Clinical evaluation ≠ clinical investigation

■Clinical evaluation:

»Verification of clinical capabilities claimed by manufacturer

»Preceded by one or more questions to be answered

»Questions can be derived from the risk and usability analysis


19 January 2011

Clinical Evaluation of Software

■All medical devices must undergo clinical evaluation (new under Annex X)

■ Evaluation must be based on existing clinical data

»Records of own previous experience

»Scientific or other trustworthy documents

■Aim is to answer and fulfil the regulatory statements of the Essential Requirements

■Own clinical investigation must be initiated if no sufficient pre-existing clinical data available


19 January 2011

Clinical Investigation of Software

■High risk that assessments of new or amended software are considered to be a clinical trial

■ Scenarios:

»Software is not yet CE-marked

»New software version that is not covered by existing CE-marking

■Human tests of new or amended software may only be run within an approved clinical trial


19 January 2011

Installation and Maintenance in Networks

■ Infrastructure and support functions

»Allow to run IT-systems

»Electricity, networks, heating, cooling, etc.

»Extremely important for safe operation of medical devices, including software

»Line between medical devices and supporting systems more and more unclear

»Trend towards convergence


19 January 2011


■Communication with other systems

»Medical devices software is often dependent on a certain technical environment

»Risks result from unclear interfaces with other medical devices, software, etc.

»Manufacturers need to coordinate certain aspects, e.g. interfaces to ensure that medical devices in network operate without any risk


19 January 2011


■Managing risks in networks

»Validation of medical devices software in a controlled environment

»Environment should be as similar to the final environment at the user’s site

»Uncontrollable risks should be communicated to the user


19 January 2011


■Handling changes in installation environment

»Prerequisites of original installation and verification change constantly

»Changes may cause negative effects which jeopardize patient safety

»Often, lack of awareness of change at user’s and manufacturer’s site

»IEC 80001 (Application of risk management for IT-networks incorporating medical devices) provides appropriate guidelines


19 January 2011

What is next in regulatory re software?

■ Software MEDDEV is in the pipeline

» Likely to enter into force this year

» Based on Swedish competent authority paper

■ Medical devices recast likely to put more emphasis on software

» Commission is now aiming for proposal until in 2012

■ eHealth developments will influence discussion of scope of medical device and lead to new standards

» New eHealth services and applications will cause borderline problems with medical devices

» New EU rules on patient mobility will put pressure on standardisation efforts


19 January 2011

Erik Vollebregt

Greenberg Traurig LLP

Strawinskylaan 31271077 ZX Amsterdam

Tel. +31 (0)20 30 17 436Mobile: +31 (0)6 47 180 683

Blog: medicaldeviceslegal.wordpress.com

Twitter: @meddevlegal

E: [email protected]

Erik has 12 years experience as IP and regulatory lawyer. After his stage at the European Commission he spent two years in the EU department at Liederkerke Siméon Wessing Houthoff. He subsequently worked as core member of the industry group "Healthcare, Life Sciences and Chemicals" at the Amsterdam and Brussels offices of Clifford Chance from 1999 until 2007. He is responsible for Greenberg Traurig’s European life sciences practice since 2007.

His practice comprises advice to and litigation for clients from the pharmaceutical, medical device and biotechnology industry in legal, regulatory, intellectual property and anti-trust matters.

Erik is author of a number of publications on legal and regulatory subjects relating to pharmaceuticals and medical devices as well as editor of two Dutch legal journals in the field of pharmaceutical law and medical technology law, as well as author of the medical device law part of the Dutch language loose leaf commentary on pharmaceutical and medical technology law.

Languages: Dutch, German, English, Swedish and French

Software design for_medical_devices_europe_conferent_19012011[1]

Health & Medicine

medical technology

active medical

medical devices

medical device

medical devices

medical device

clinical evaluation

greenberg