US medical device regulatory round-up 2023

Credit: Shutterstock / tokar

May 2023: transitioning COVID-19 EUA medical devices. The FDA’s Center for Devices and Radiological Health (CDRH) issued guidance for transitioning COVID-19 devices from emergency use authorisations (EUAs) to traditional marketing pathways once the public health emergency ended in May 2023.  Since the start of the pandemic, the FDA has issued EUAs covering 4,000 medical devices, including COVID-19 tests, infusion pumps, blood purification devices, ventilators, in vitro diagnostics, wearable devices, decontamination systems and personal protective equipment (PPE). From March 2023 a transition plan provides guidance to manufacturers of devices issued EUAs during COVID-19 for transitioning to normal operations. The FDA believes the policy set out in this guidance will help the FDA and other stakeholders return to business as usual. 

June 2023: list of medical device shortages gets shorter. The pandemic exposed huge vulnerabilities in the medical devices supply chain and its dependence on medical devices from abroad. The FDA publishes an up-to-date list of devices identified as being in short supply. Seven categories of medical devices currently appear on the shortages list. The FDA has removed several categories from the list. These include MRI breast biopsy grid plate related devices, saline and vascular access flush devices, some automatic external defibrillators,  testing supplies and equipment and, in October 2023, ventilation-related products. The CDRH plans to invest an additional $11.6 million between 1 October 2023 and 30 September, 2024 into a new Resilient Supply Chain Program for medical devices (RSCP).

September 2023: modernising the 510(k) programme. The FDA issued three draft guidances (Medical Device Safety and the 510(k) Clearance Process, followed by  Evidentiary Expectations for 510(k) Implant Devices and a CDRH Statement). These aim to enhance the predictability, consistency, and transparency of the 510(k) programme and provide clarity on complex device matters in 510(k) submissions, particularly for implanted devices. This is intended to promote consistency and facilitate efficient review, as a way to support efforts to continue to improve and modernise the 510(k) programme and advance the safety and effectiveness of medical devices as they become more complex and innovative. “In the CDRH Statement, we continue to take steps to improve the premarket notification [510(k)] programme,” said Jeff Shuren, MD, JD, director of the CDRH.

New type of information for biocompatibility. The FDA also issued final guidance in September on the use of international standard ISO 10993-1, “Biological evaluation of medical devices – Part 1: Evaluation and testing within a risk management process”. This guidance adds recommendations which reflect the agency’s current thinking, for instance, about the type of biocompatibility information which should be provided as part of a medical device premarket submission for certain materials which only contact intact skin. This guidance provides clarification and updated information on the use of ISO 10993-1 to support various types of medical device applications, including premarket approvals (PMAs), Humanitarian Device Exemptions (HDEs), Investigational Device Exemption (IDE) applications, 510(k) applications, and De Novo applications, in order to determine the potential for an unacceptable adverse biological reaction resulting from contact of the constituent materials of the device with the body. The release of this guidance has been eagerly anticipated due to the lack of validated or qualified New Alternative Methodologies (NAMs) for assessing the biocompatibility of medical devices. The challenge is to introduce tools and methodologies aimed at enhancing and ensuring the consistency of toxicology risk assessments associated with medical devices.

Q3 2023: revamped guidance document: cybersecurity in medical devices. The healthcare industry in the U.S. suffered a substantial number of cyberattacks in 2023. In the first half of the year, 327 data breaches were reported to the U.S. Department of Health and Human Services Office for Civil Rights, marking a 104% increase over the previous year. These breaches involved the data of more than 40 million individual patients, representing a 60% increase year-on-year for the first six months. This alarming number of cyberattacks in the healthcare industry in recent years is due in no small part to the growing number of medical devices (such as heart rate monitors,  imaging machines and automated drug delivery devices) which are connected to healthcare providers’ electronic health records systems and other networks. According to Arctic Wolf Networks, the typical cost of a healthcare data breach was $10.93 million, which is the highest across all industries.

In response, the FDA issued a final guidance document titled “Cyber security in Medical Devices: Quality System Considerations and Content of Premarket Submissions”. This guidance flows from section 3305 of the Consolidated Appropriations Act, 2023, which became law in December 2022, granting authority to the FDA to establish cybersecurity standards for premarket submissions for medical devices. It supersedes the final guidance document “Content of Premarket Submissions for Management of Cybersecurity in Medical Devices,” issued 2 October, 2014. This guidance provides detailed recommendations on performing cybersecurity risk assessments and documents to be included in premarket submissions to the FDA.

April 2023: new rules on AI and ML-based medical devices. By December 2023, nearly 700 artificial intelligence (AI) and machine learning (ML)-enabled devices had been granted marketing authorisation, via the 510(k), De Novo, and Premarket Approval (PMA) pathways. These related to robotic surgery, precision medicine, electronic health records (EHR), medical imaging diagnostics, genome sequencing and oncology research. The FDA released Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence /Machine Learning (AI/MI-Enabled Device Software Functions on 3 April, 2023. This guidance document defines a least burdensome approach to support the iterative improvement of machine learning-enabled device software functions, while continuing to assure their safety and effectiveness. It provides recommendations on the information to be included in a Predetermined Change Control Plan (PCCP) which may be provided in a marketing submission for a ML-DSF. “The release of this guidance reflects our commitment to developing innovative approaches to the regulation of medical device software and other digital health technologies to ensure their safety and effectiveness”, said experts from the FDA in a press release. 

January: accelerated pathway to approval based on real-world evidence. China has introduced new real-world evidence (RWE) elements into the regulatory decision-making process for medical devices. The use of RWE is being explored to support accelerated medical device innovation and market introduction, with an opportunity to gain accelerated approval in the ‘Boao Lecheng Pilot Zone’ in Hainan Province. The Boao Lecheng Real-World Data Research Platform has been set up to connect, structure and standardise data from various sources to support the life cycle evaluation of medical device products, from registration to post-marketing adverse event monitoring. However, challenges such as limited data accessibility, data sharing and concerns about data quality remain. 

July: revised medical device exemption catalogue. In the summer, China’s National Medical Products Administration (NMPA) updated the catalogue of medical devices exempt from clinical evaluation. The new revised catalogue includes a total of 1025 medical devices, with 821 devices categorised as Class II, 202 devices categorised as Class III and 2 devices categorised as both Class II and Class III. A further 21 new devices have also been added, including single-use intracranial traction catheters, anchor balloon dilatation catheters and medical air compressors, among others. The exemption catalogue presents several benefits for medical device manufacturers seeking to introduce products to the Chinese market.

July 2023: new guidelines, including for continuous glucose monitors. As part of the new Medical Device Classification Catalogue, which incorporates advances such as left atrial appendage devices, clipping systems, artificial corneas, disposable absorbable staples, and rotating breast biopsy systems, the Center for Medical Device Evaluation (CMDE) released a series of guidance documents, including ‘Registration Review Guidelines for the Clinical Evaluation Of Ventilators’, ‘Registration Review Guidelines for Continuous Glucose Monitoring Systems’ and ‘Technical Guidelines for the Benefit-Risk Assessment of Medical Device Products’.

August 13: evaluation criteria for targeted software innovations. CMDE’s Announcement No. 23 of 2023 set out various review points for evaluating the performance and clinical assessment of certain types of artificial intelligence (AI) software. This announcement issued guidelines for the clinical evaluation of dental implant systems, including a standardised framework for assessing their clinical performance.

August 20: enhanced oversight of medical device production. In August, the NMPA also issued guidelines for further strengthening the supervision of entrusted production by medical device registrants. These guidelines aim to fully implement the main responsibility of registrants for the quality and safety of medical devices, prevent and control hidden risks in medical device-entrusted production, and strengthen its supervision. 

The paper showcased attempts to make GPT-4 produce data that supported an unscientific conclusion – in this case, that penetrating keratoplasty had worse patient outcomes than deep anterior lamellar keratoplasty for sufferers of keratoconus, a condition that causes the cornea to thin which can impair vision. Once the desired values were given, the LLM dutifully compiled a database that to an untrained eye would appear perfectly plausible.

Taloni explained that, while the data would fall apart under statistical scrutiny, it didn’t even push the limits of what Chat-GPT can do. “We made a simple prompt […] The reality is that if someone was to create a fake data set, it is unlikely that they would use just one prompt. [If] they find an issue with the data set, they could fix it with consecutive prompts and that is a real problem. 

“There is this sort of tug of war between those who will inevitably try to generate fake data and all of our defensive mechanisms, including statistical tests and possibly software trained by AI.”

The issue will only worsen as the technology becomes more widely adopted too. Indeed, a recent GlobalData survey found that while only 16.1% of respondents from its Hospital Management industry website reported that they were actively using the technology, a further 26.8% said either that they had plans to use it or were exploring its potential use.

Nature worked with two researchers, Jack Wilkinson and Zewen Lu, to examine the dataset using techniques that would commonly be used to screen for authenticity. They found a number of errors including a mismatch of names and sexes of ‘patients’ and lack of a link between pre- and post-operative vision capacity. 

In light of this, Wilkinson, senior lecturer in Biostatistics at the University of Manchester, explained in an interview with Medical Device Network that he was less concerned by AI’s potential to increase fraud.

“I started asking people to generate datasets using GPT and having a look at them to see if they could pass my checks,” he said. “So far, every one I’ve looked at has been pretty poor. To be honest [they] would fall down under even modest scrutiny.” 

He acknowledged fears like those raised by Dr. Taloni about future improvements in AI-generated datasets but ultimately noted that most data fraud is currently done by “low-skill fabricators,” and that “if those people don’t have that knowledge, they don’t know how to prompt Chat-GPT to have it either.”

The problem for Wilkinson is how widespread falsification already is, even without generative AI.