Recently, FDA finalized its guidance on Mobile Medical Applications (MMA), which is available here. The release of this guidance document lifted much of the regulatory uncertainty regarding which types of mobile apps FDA would and would not be actively regulating. Some of the regulated MMAs are developed (i.e., manufactured) by entities that have little to no prior experience in FDA regulation. Consequently, there is some question regarding which FDA requirements will apply to them as device manufacturers.
Ultimately, the total sum of a device manufacturer’s FDA regulatory obligations will depend on how FDA views the risks associated with their particular device and may or may not include requirements for marketing authorizations prior placing the MMA in commercial distribution. However, all medical device manufacturers are subject to the following requirements, known as medical device “general controls.” These general controls include the following:
- Establishment Registration (21 C.F.R. Part 807, Subpart B) – Finished device manufacturers are required to register their establishments with FDA. In order to register its establishment, a finished device manufacturer must complete an on-line application (FURLS) on FDA’s website. Registration provides FDA with information on the location of the establishment, as well as other administrative information. FDA uses establishment registrations to keep apprised of who and where the regulated entities are and to schedule inspections of their establishments. There is also an annual registration requirement and registration fees for manufacturers in some cases.
- Medical Device Listing (21 C.F.R. Part 807, Subpart B) – Finished device manufacturers must list with FDA those finished medical devices they place into commercial distribution in the United States. Listing of devices is accomplished on FDA’s FURLS website and entities are required to provide information on the products which the finished device manufacturer places into U.S. commercial distribution.
- Quality System Regulation (21 C.F.R. Part 820) – In most cases, finished device manufacturers must comply with FDA’s Quality System Regulation (QSR), which covers the methods used in, and the facilities and controls used for, the design, manufacture, packaging, storage, and installation of medical devices and contains system requirements in areas of concern to all manufacturers of finished devices. Among other requirements, it covers the following general areas:
- Management responsibilities;
- Design controls;
- Document controls;
- Purchasing controls;
- Production and process controls;
- Corrective and preventive action;
- Labeling and packaging;
- Handling, storage, distribution and installation;
- Complaint handling; and
- Organization and personnel.
Importantly, manufacturers are subject to only those requirements of the QSR that are applicable to the operations they perform.
- Medical Device Reporting (21 C.F.R. Part 803) – Finished device manufacturers are required to comply with FDA’s medical device reporting regulation. This regulation requires manufacturers to have written operating procedures for fulfilling reporting and recordkeeping requirements related to adverse events involving their medical devices. A manufacturer is required to report to FDA information which reasonably suggests that one of its devices may have caused or contributed to a death or serious injury, or that its device has malfunctioned, and the device or a similar device marketed by the manufacturer would be likely to cause or contribute to a death or serious injury if the malfunction were to recur.
- Medical Device Labeling (21 C.F.R. Part 801) – Medical devices offered for commercialization in the United States must comply with applicable medical device labeling requirements. Certain labeling requirements apply to all medical devices. For example, the label of every device in package form must “specify conspicuously the name and place of business of the manufacturer, packer, or distributor.” 21 C.F.R. § 801.1(a).
- Corrections and Removals (21 C.F.R. Part 806) – Finally, certain removals or corrections of medical devices in the field (i.e., recalls) must be reported to FDA, and there are recordkeeping requirements for device removals and corrections.
One of the first orders of business for members of the MMA industry that find themselves as newly-minted FDA-regulated entities should be to audit their own policies and procedures to assess their current state of compliance with these FDA requirements. Usually, the most efficient way to do so is with the assistance of an experienced FDA-regulatory firm/consultant who can also assist the company in establishing FDA-complaint systems.