News & Events
"Examining Federal Regulation of Mobile Medical Apps and Other Health Software"
Jeffrey Shuren, M.D., J.D.
Director, Center for Devices and Radiological Health
Food and Drug Administration
Department of Health and Human Services
Subcommittee on Health
Committee on Energy and Commerce
U.S. House of Representatives
November 19, 2013
Chairman Pitts, Ranking Member Pallone, and Members of the Subcommittee, I am Jeffrey Shuren, Director, Center for Devices and Radiological Health (CDRH) at the Food and Drug Administration (FDA or the Agency). I am pleased to be here today to discuss FDA’s recently published final guidance, “Mobile Medical Applications: Guidance for Industry and Food and Drug Administration Staff” and, more specifically, the actions FDA is taking to protect the public health and foster innovation in the field of mobile applications (mobile apps). This final guidance was long awaited by developers of mobile medical apps and will provide clarity regarding which mobile apps are the focus of FDA oversight and which are not. Mobile health app developers and manufacturers needed a clear, predictable, and reasonable understanding of the Agency’s expectations. Such clarity is critical for attracting investment and accelerating innovation. As our final guidance demonstrates, FDA has adopted a balanced approach to mobile apps that supports continued innovation while ensuring appropriate patient protections. The Agency intends to exercise enforcement discretion for the majority of mobile apps that are devices as they pose minimal risk to consumers. FDA intends to focus its regulatory oversight on a subset of mobile apps that present a greater risk to patients if they do not work as intended.
The widespread adoption and use of mobile technologies is opening new and innovative ways to improve health and health care delivery. Mobile apps—software programs that run on smartphones and other mobile communications devices—can help consumers, health care professionals, and patients manage health and wellness, promote healthy living, and gain access to useful information when and where they need it. Not surprisingly, these tools are being adopted almost as quickly as they can be developed. In fact, industry estimates that 500 million smartphone users worldwide will be using a health care application by 2015, and by 2018, 50 percent of the more than 3.4 billion smartphone and tablet users will have downloaded mobile health applications.
Mobile apps span a wide range of health functions. While many mobile apps carry minimal or no risk to patients, a small subset of these apps can pose significant risks to patients if they don’t operate correctly. And, as we will discuss, FDA’s final guidance takes this variation in risk into account.
In some cases, the risks associated with mobile apps are similar or identical to the risks associated with an already-marketed medical device. As an example, mobile apps that affect the programming of a drug infusion pump or computed tomography scanner could lead to a drug or radiation overdose. An inaccurate or malfunctioning mobile medical app that uses a sensor to diagnose skin cancer or to measure critically low blood oxygen levels in chronic lung disease patients, could delay lifesaving diagnosis and treatment.
It is important to note that FDA has been regulating medical device software for decades and medical device software on mobile platforms for more than 10 years. The Agency has reviewed approximately 100 mobile medical apps, including remote blood pressure, heart rhythm, and patient monitors, and smartphone-based ultrasounds, ECG machines, and glucose monitors.
Development of FDA’s Mobile App Guidance
FDA has jurisdiction over those mobile apps that meet the definition of “device” in section 201(h) of the Federal Food, Drug, and Cosmetic Act (FD&C Act). As you know, FDA issued draft guidance in July 2011 to announce its intention to exercise enforcement discretion for most mobile apps. The guidance also clarified that the focus of FDA’s oversight will be the small subset of mobile apps, referred to as “mobile medical apps,” that meet the definition of “device” in section 201(h) of the FD&C Act and that are either intended to: (1) be used as an accessory to a regulated medical device or (2) transform a mobile platform into a regulated medical device. This narrowly tailored approach will not require active FDA oversight of many apps that would otherwise meet the definition of “device.”
Throughout the development of the mobile medical apps guidance, FDA has actively encouraged public feedback on how its regulatory approach would affect the balance between promoting innovation and providing reasonable assurance of safety and effectiveness. In addition to opening the draft guidance for public comment, the Agency interacted with the stakeholder community, including traditional medical device firms, software companies, health care professionals, patient advocacy groups, health care facilities, third-party payers, and the health information technology (IT) community. FDA also hosted a widely attended public meeting to provide a forum for discussion and to encourage additional public comment from interested stakeholders on the issues raised in the draft guidance.
FDA received more than 130 submissions to the public docket on the July 2011 draft guidance. Respondents overwhelmingly supported a narrowly tailored, risk-based approach, and industry stakeholders were eager to see the guidance finalized. On September 25, 2013, FDA announced the publication of the final Mobile Medical Applications: Guidance for Industry and Food and Drug Administration Staff in the Federal Register.
Our mobile medical app policy is based on risk and functionality. For example, an electrocardiography device—an ECG machine—that measures heart rhythms to help doctors diagnose patients is still an ECG machine, regardless of whether it is the size of a bread box or the size of a credit card. The risks it poses to patients and the importance of ensuring for practitioners and patients that it is safe and effective are essentially the same. Our guidance makes clear that if a mobile app transforms a mobile platform into a medical device, like an ECG machine, or is an accessory to a medical device, such as an app that acts as a remote control for a CT scanner, and it is the kind of functionality we already regulate—that is, we have approved, cleared, or classified such a device—we would continue to regulate that kind of technology, if it is on a mobile platform.
Just as important as what the policy does is what the policy does not do. FDA’s mobile medical apps policy will not result in the regulation of the sale or general consumer use of smartphones or tablets. FDA’s mobile medical apps policy will not result in the consideration of entities that exclusively distribute mobile medical apps, such as the owners and operators of the “iTunes App store” or the “Android market,” as medical device manufacturers. FDA’s mobile medical apps policy will not result in the consideration of mobile platform manufacturers as medical device manufacturers just because their mobile platform could be used to run a mobile medical app regulated by FDA. FDA’s mobile medical apps policy will not result in mobile medical app developers having to seek Agency re-evaluation for minor, iterative product changes.
The guidance also states the Agency’s intent to exercise enforcement discretion for those mobile apps that meet the FD&C Act’s definition of a “device” but do not meet the definition of a “mobile medical app” in the guidance. Mobile apps that may be considered devices for which we would exercise such enforcement discretion and not enforce requirements under the FD&C Act include mobile apps that:
- Help patients self-manage their diseases or conditions without providing specific treatment suggestions;
- Provide patients with simple tools to organize and track their health information, such as blood pressure and drug intake;
- Provide patients with easy access to information related to their health conditions or treatments;
- Help patients document, show, or communicate potential medical conditions to health care practitioners;
- Provide or facilitate supplemental care, by coaching or prompting, to help patients manage their health—such as weight maintenance apps;
- Enable patients or practitioners to interact with Personal Health Records or Electronic Health Record systems;
- Help patients maintain a healthy weight, manage salt intake, adhere to drug intake times, and prevent drug-drug interactions;
- Supplement a verbal discussion with a patient’s health care practitioner, using a camera or videoconferencing portal;
- Conduct simple calculations, such as Body Mass Index, APGAR scores, delivery date estimators, or mean arterial pressure; or
- Provide reminders (for example, medication reminders—mobile apps that provide alerts to patients or health care providers for pre-determined medication dosing schedules).
FDA developed the Agency’s mobile medical apps policy to protect public health and promote innovation. Because the final guidance states that the Agency intends to exercise enforcement discretion for certain categories of mobile apps with respect to applicable device requirements, including listing, FDA does not expect such devices to be listed. The guidance provides clarity regarding the specific types of apps for which the Agency intends to exercise enforcement discretion in the final mobile medical apps guidance.
Due to the tremendous interest in the final guidance, FDA conducted significant communications outreach to our Federal partners, including the Department of Health and Human Services (HHS), Office of the National Coordinator for Health Information Technology (ONC), Federal Communications Commission (FCC), Federal Trade Commission (FTC), and Congress; industry, patient, and consumer groups, and other stakeholders; specialty mobile app bloggers; mobile app publications; and traditional news media. In addition, we participated in a panel discussion sponsored by the Congressional Medical Technology Caucus, which many of your staff attended. We have established a publicly available website with up-to-date information, listing those apps which have been cleared or approved by FDA and those for which FDA intends to exercise enforcement discretion, in order to provide continuing clarity on this issue for industry and other stakeholders. Mobile app developers who have questions can contact us through several mechanisms, including a new e-mail address. Queries will be handled by a special team under the guidance of CDRH senior managers. Also, in response to queries, we will continually update our website, as appropriate, to include additional examples of apps for which we intend to exercise enforcement discretion.
Developing an Appropriate Risk-based Regulatory Framework for Health IT
Mobile medical apps represent just one component in an increasingly connected health care environment. Three Federal Agencies—FDA, ONC, and FCC—have unique and complementary responsibilities in the health IT arena. Section 618 of the Food and Drug Administration Safety and Innovation Act (FDASIA), enacted on July 9, 2012, requires the Secretary of HHS, acting through the Commissioner of Food and Drugs and in consultation with the National Coordinator for Health IT and the Chairman of FCC, to prepare a report by January 2014 containing “a proposed strategy and recommendations on an appropriate, risk-based regulatory framework pertaining to health IT, including mobile medical applications, that promotes innovation, protects patient safety, and avoids regulatory duplication.”
FDA, ONC, and FCC established a “FDASIA Workgroup” under ONC’s Health Information Technology Policy Committee (HITPC), which provided expert input to HITPC to inform the development of this report. The FDASIA Workgroup was comprised of a wide range of stakeholders and conducted in a transparent manner with ample opportunity for public comment. The workgroup gave its final recommendations in early September 2013, which the Committee adopted. Of note, the multi-stakeholder workgroup highlighted the importance of treating functionality the same across platforms and recommended that FDA expedite guidance on mobile medical apps because of the critical importance of providing clarity as soon as possible.
FDA recognizes the importance of implementing a balanced, transparent approach that fosters the development of health IT solutions and innovative products like mobile medical apps, while ensuring appropriate patient protections. Like traditional medical devices, mobile medical apps may in some cases present significant health risks to patients if they do not work as intended. FDA seeks to strike the right balance by providing a risk-based, focused approach to the oversight of a small subset of mobile apps that present risks to patients if they do not work as intended. As explained in the medical mobile apps guidance, FDA will not regulate the sale or general consumer use of smartphones or tablets.
In its regulation of medical devices, the Agency strives for transparency, interaction, collaboration, and the appropriate balancing of benefits and risks; ensuring predictable and consistent recommendations, decision-making, and application of the least-burdensome principle; and implementing efficient processes and use of resources. FDA’s guidance on mobile medical apps, and the tri-Agency collaborative effort on health IT, reflect this regulatory approach.
Thank you for your commitment to the mission of FDA and our medical device program, which helps to ensure that patients and health care professionals have access to safe and effective innovative medical technologies. Thank you for the opportunity to testify today about FDA’s mobile app guidance and about the actions that FDA is taking to foster innovation. I am happy to answer questions you may have.
 FDA, “Mobile Medical Applications – Guidance for Industry and Food and Drug Administration Staff” (Sept. 25, 2013), available at http://www.fda.gov/downloads/medicaldevices/deviceregulationandguidance/guidancedocuments/ucm263366.pdf.
 Research2Guidance, “500m people will be using healthcare mobile applications in 2015” (Nov. 10, 2010), available at http://www.research2guidance.com/500m-people-will-be-using-healthcare-mobile-applications-in-2015/.
 Research2Guidance, “Mobile Health Market Report 2013-2017: The Commercialization of mHealth Applications” (March 4, 2013), available at http://www.research2guidance.com/shop/index.php/downloadable/download/sample/sample_id/262/.
 For example, an application that allows a health care professional to make a specific diagnosis by viewing a medical image from a picture archiving and communication system (PACS) on a smartphone or a mobile tablet.
 For example, an application that turns a smartphone into an ECG machine to detect abnormal heart rhythms or to determine if a patient is experiencing a heart attack.
 FDA, “Public Workshop - Mobile Medical Applications Draft Guidance, September 12-13, 2011,” available at http://www.fda.gov/MedicalDevices/NewsEvents/WorkshopsConferences/ucm267821.htm.
 FDA, “Mobile Medical Applications; Guidance for Industry and Food and Drug Administration Staff; Availability,” 78 Fed. Reg. 59038 (Sept. 25, 2013), available at http://www.gpo.gov/fdsys/pkg/FR-2013-09-25/pdf/2013-23293.pdf.
 APGAR is a quick test performed on a baby at one and five minutes after birth to determine how well the baby tolerated the birthing process and is doing outside the mother's womb. For more information, please see http://www.nlm.nih.gov/medlineplus/ency/article/003402.htm.
 Certain mobile apps are intended for individuals to log, record, track, evaluate, or make decisions or behavioral suggestions related to developing or maintaining general fitness, health, or wellness. When these items are not marketed, promoted or intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, or do not otherwise meet the definition of medical device, FDA does not regulate them. When they are marketed, promoted, or intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, or otherwise meet the definition of medical device, FDA intends to exercise enforcement discretion.
Owners or operators of places of business involved in the production and distribution of medical devices intended for use in the United States are required to register annually with FDA, known as establishment registration. Most covered establishments are also required to list the devices made there and the activities performed on those devices. For more information, see FDA, “Device Registration and Listing,” available at http://www.fda.gov/medicaldevices/deviceregulationandguidance/howtomarketyourdevice/registrationandlisting/default.htm.
See FDA, “Mobile Medical Apps,” at http://www.fda.gov/medicaldevices/productsandmedicalprocedures/connectedhealth/mobilemedicalapplications/default.htm.
The e-mail address is firstname.lastname@example.org.
Food and Drug Administration Safety and Innovation Act, Public Law 112-144 (126 Stat. 993) (July 9, 2012), available at http://www.gpo.gov/fdsys/pkg/PLAW-112publ144/pdf/PLAW-112publ144.pdf.
See FCC, “Membership Applications Sought for FDA Safety Innovation Act Workgroup,” available at http://www.fcc.gov/membership-applications-sought-fda-safety-innovation-act-workgroup. The Workgroup was formed under the ONC’s HITPC, a Federal advisory committee established by the Health Information Technology for Economic and Clinical Health (HITECH) Act (Title XIII of the American Recovery and Reinvestment Act, Public Law 111-5 (123 Stat. 115) (Feb. 17, 2009) (available at http://www.gpo.gov/fdsys/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf).