Is it a drug or a medical device? Or both?

The old “Is it Live or Is it Memorex?” commercials from the 1970s suggested that it was difficult to tell the difference between a live performance and a recording, thanks to the quality of the Memorex cassette tapes. Manufacturers trying to determine the best go-to-market strategy for their products may find differentiating a medical device from a medicinal substance just as challenging, and with good reason. When even something as harmless as fluoride-infused dental floss can qualify as a drug/device combination product, it’s easy to see why manufacturers struggle with the definitions – and the accompanying regulatory requirements.

Fortunately, both the Code of Federal Regulations and the newly-minted MDR are clear in their definitions of a combination product. Although that may not stem the lively debates taking place in many a commercialization team meeting, both offer detailed guidelines and regulations to help manufacturers pilot their products to a successful submission with the appropriate agency – and without having to pull the bell bottoms and tie-dye t shirts out of storage, where they belong.

What the FDA Says About Combination Products

Per 21 CFR 3.2, any product that physically or chemically mixes or otherwise combines two or more drug, device, or biologic components is considered a combination product:

• A product comprised of two or more regulated components, i.e., drug/device, biologic/device, drug/biologic, or drug/device/biologic, that are physically, chemically, or otherwise combined or mixed and produced as a single entity
• Two or more separate products packaged together in a single package or as a unit and comprised of drug and device products, device and biological products, or biological and drug products
• A drug, device, or biological product packaged separately that according to its investigational plan or proposed labeling is intended for use only with an approved individually specified drug, device, or biological product where both are required to achieve the intended use, indication, or effect and where upon approval of the proposed product the labeling of the approved product would need to be changed, e.g., to reflect a change in intended use, dosage form, strength, route of administration, or significant change in dose; or
• Any investigational drug, device, or biological product packaged separately that according to its proposed labeling is for use only with another individually specified investigational drug, device, or biological product where both are required to achieve the intended use, indication, or effect

There are nine distinct descriptions of combination products on the FDA website, ranging from metered dose inhalers to drug-eluting stents to prefilled syringes. But even some common and seemingly innocuous items like fluoride-infused dental floss, nasal sprays and spermicidal condoms are classified as combination products, based on their primary mode of action (PMOA).

The primary mode of action is the method by which the desired therapeutic action of the product is achieved, and that in turn determines which agency is responsible for approving or clearing the product for market release. Both the Center for Devices and Radiologic Health (CDRH) and the Center for Drug Evaluation and Research (CDER) can approve combination products, but it is the PMOA that determines the appropriate submission pathway.

For example, a drug-eluting stent has two targeted actions – to open a blocked artery and to deliver a drug to prevent inflammation and stenosis. The primary action is to remove the blockage, which makes the stent a medical device, which would be submitted to CDRH. However, a drug-eluting disk, with a PMOA of conveying chemotherapy to brain tumors, would be submitted to CDER because it is primarily a therapeutic drug. In situations where there are two independent modes of action, 21 CFR 3.2 employs an algorithm for determining the appropriate pathway, based on which center regulates similar products or which has the most relative expertise to evaluate the product.

Any product submitted to CDER must align with their regulations, and that means a lengthy review phase and data. Lots and lots of data. The typical development timeline for new drugs or drug/device combinations can last up to 25 years from the preclinical phase to the commercialization and post-market surveillance phases, so choosing a PMOA that results in submission to CDER is not a decision that manufacturers should make lightly.

MDR’s Impact

The regulatory landscape for combination products marketed in the EU changed drastically with the transition to MDR. The drug portion of these drug-device combinations (DDC) was closely regulated by the now-obsolete Medical Device Directive (MDD), but the device portion was not, allowing manufacturers to self-monitor and report compliance and conformity. That laissez-faire approach will not longer be acceptable under MDR, and the fun doesn’t stop there.

Article 117 of the MDR introduces a new CE-mark requirement for some drug-device combinations, depending on the product’s primary mode of action:

• Where the action of the medicinal substance is ancillary, the product is regulated as a medical device and must be CE marked. As the action of the medicinal product is considered ancillary, a scientific opinion must be provided from a medicines authority before a notified body can issue a certificate for the combined product
• Where the action of the medicinal substance is principal, the combination product is regulated under the medicinal products In that case, the relevant general safety and performance requirements of the MDR apply to the device part

Under Article 117, the notified body will assess the device for compliance with the General Safety and Performance Requirements (GSPRs), while the competent authority will evaluate the quality, safety, and efficacy of the medicinal substance.

MDR also offers the added amusement of up classifying most DDC from Class I to a Class IIb or even Class III designation. That means that “simple” substances like nasal sprays, throat lozenges, and ear drops – which had been marked as Class I devices under MDD – now require a conformity assessment and notified body involvement. Other “invasive” Class IIa substances such as vaginal gels have become Class IIb, while anti-bloating capsules and the like have been upgraded to Class III products and as a result, must comply with new testing requirements. This means full pharmacokinetic testing – absorption, distribution, metabolism, excretion, and local tolerance must all be documented for these “simple” over-the-counter products.

It’s Still Worth the Investment

The regulatory requirements for drug+device combination products can be daunting, and compliance is a time-consuming and expensive undertaking. But the global DDC market is valued at $123.5 billion (US) with an anticipated annual growth rate of 8% through 2027, much better than Memorex cassettes could boast even in their heyday, so it can still be worth the investment to bring a product to market.

It’s no secret that compliance requires perseverance, careful attention to detail, pages of documentation, and hours upon hours in front of the computer. But no one needs to know that you got through it by listening to that old Pink Floyd cassette of The Wall on autoreverse, as long as the product makes it past the regulatory roadblocks and onto the market.

As our world becomes ever more digitized, software has begun to infiltrate every minute of our day. We wake to the alarm on our iPhones, tell Alexa to turn on the coffee and turn off the heat, ride a computer-monitored elevator to our temperature-controlled office. Later, after appeasing our Google Fitness Assistants with an online Peloton spin class and eating our DoorDash dinner, we relax with a glass of wine while mindlessly flicking through Netflix, or repeatedly swiping right in hopes of finding the perfect romantic partner. It’s hard to think of a single daily activity that doesn’t involve software in one form or another, as our phones and tablets and monitoring devices become the fingers that we digitally extend into the online abyss.

These technological advancements have become integrated into our healthcare as well, with a growing number of digital platforms supporting medical and non-medical functions. Software has controlled the motors and sensors and robotic arms of our medical devices for years, but now the ongoing evolution of algorithms, artificial intelligence (AI) and machine learning has spawned smart devices that can capture and transmit EKGs, interpret imaging results, and even preliminarily diagnose any number of medical conditions. It’s a brave new world out there, with new technologies and algorithms introduced every day that further digitize the way we manage our health.

But as a medical device manufacturer trying to bring a new and connected product to market, how do you know if your software is the medical device, as opposed to a means of simply controlling movement and storing data? As with any other regulated device, the answer lies in the guidance documents.

How FDA Defines SaMD

Despite its almost universal acceptance, software as a medical device (SaMD) is not always clearly defined, making it difficult for manufacturers to know whether their software qualifies. The FDA is uncharacteristically concise in their definition of SaMD, defining it only as “software that is a medical device on its own” – no real help there. Fortunately, the International Medical Device Regulators Forum (IMDRF) offers a bit more detail, describing it as “software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device.”

Chaired by the FDA, the IMDRF is a worldwide group of regulators working together to coordinate the regulation of medical devices across jurisdictions. The IMDRF has a variety of working groups focusing on a wide range of medical device topics, including unique device identifiers (UDI), adverse event terminology, regulatory review practices, and product submissions. These working groups develop guidance documents that are reviewed and finalized by the members, who then formally adopt and integrate the guidances into their existing regulations.

In 2013, no doubt seeing the AI writing on the wall, IMDRF established the SaMD working group to develop a framework for the use of software in and as medical devices. Their first task was to issue a guidance to more clearly define software as a medical device (which FDA has incorporated into the clear examples listed on their website):

• A medical device, including in-vitro diagnostic (IVD) medical devices
• Capable of running on general purpose (non-medical purpose) computing platforms
• May be used in combination with other products, including medical devices
• May be interfaced with other medical devices, including hardware medical devices and other SaMD, as well as general purpose software
• Software does not meet the definition of SaMD if its intended purpose is to drive a hardware medical device
• Mobile apps that meet the definition above are considered SaMD
• “without being part of” means software not necessary for a hardware medical device to achieve its intended medical purpose

Somewhat clearer than mud, but still a potential challenge for manufacturers unfamiliar with the terminology associated with SaMD. Perhaps sensing the potential for industry confusion, the IMDRF also released guidance documents on risk categorization, quality management systems and clinical evaluation of software as a medical device to address some of the regulatory concerns and give manufacturers a blueprint for compliance.

Faced with a growing number of questions regarding SaMD and challenged by the many innovative software and app-driven technologies coming to market, the FDA in 2020 established the Digital Health Center of Excellence (DHCE) within the Center for Devices and Radiologic Health (CDRH). DHCE’s stated purpose is to “empower stakeholders to advance health care by fostering responsible and high-quality digital health innovation.” The center wants to modernize digital health policies and regulatory strategies while supporting the advancement of technology such as mobile health devices, wearables, and SaMD. Most importantly, DHCE will coordinate work across the FDA to ensure the uniform application of policies and consistent regulatory oversight, and to create tools to help stakeholders navigate the regulatory challenges presented by software as a medical device.

MDR’s Take on Software as a Medical Device

Not to be outdone, the European Commission established an equally murky regulatory landscape with the new Medical Device Regulation (MDR), which has its own set of definitions, classifications, and rules for software as a medical device.

Article 2 of the new regulation defines a medical device as “any instrument, apparatus or appliance or software intended by the manufacturer to be used alone or in combination for humans for medical purposes, including:

• Diagnosis, prevention, monitoring, prediction, prognosis or treatment or alleviation of disease
• Diagnosis, monitoring, treatment, alleviation of, or compensation for, an injury or disability
• Investigation, replacement, or modification of the anatomy or of a physiological or pathological process or state
• Providing information by means of in vitroexamination of specimens derived from the human body, including organ, blood and tissue donations, and which does not achieve its principal intended action by pharmacological, immunological or metabolic means, in or on the human body, but which may be assisted in its function by such means.”

More simply put, the classification of software as a medical device depends on its intended use. If a manufacturer includes a clear medical purpose in the intended use statement – such as interpreting heart rhythms, analyzing skin moles, or alleviating seasonal depression – then that software qualifies as a medical device. Software for more general lifestyle and well-being purposes does not, provided the manufacturer makes no therapeutic or diagnostic promotional claims. Likewise, an application that allows the user to take pictures of a rash to be shared with their physician does not qualify as a medical device if the app performs no action on those images other than storage.

Perhaps the biggest change that MDR ushers in for software as a medical device is up-classification to a new risk category. This is a big blow to manufacturers of Class I software, as it means a lot more regulatory oversight than was previously mandated for software, including the potential for notified body involvement.

Annex VIII of MDR lists the medical device classification rules, one of which is specific to software. Rule 11 clearly states that “software intended to provide information which is used to take decisions with diagnosis or therapeutic purposes” will be up classified under the new regulation. There are now five software classifications – Class I, Im, IIa, IIb and III – with specific definitions for each outlined in rules 9, 10, and 11.

To say the rules are complex would be an understatement. Here are some examples of how the new MDR rules determine software device classification from a 2019 Regulatory Affairs Professional Society (RAPS) article:

“Software intended to provide information which is used to take decisions with diagnosis or therapeutic purposes is classified as Class IIa, except if such decisions have an impact that may cause death or an irreversible deterioration of a person’s state of health, in which case it is in Class III or a serious deterioration of a person’s state of health or a surgical intervention, in which case it is classified as Class IIb. Software intended to monitor physiological processes is classified as Class IIa, except if it is intended for monitoring of vital physiological parameters, where the nature of variations of those parameters is such that it could result in immediate danger to the patient, in which case it is classified as Class IIb. All other software is classified as Class I. As an example, software used to monitor heart rates or any other physiological parameters during a routine checkup is classified as Class IIa. However, if the monitoring aims at vital physiological parameters, and where those parameters could result in immediate danger to the patient, the classification is elevated to Class IIb.”

The Road Ahead

Clearly, the digitization of patient diagnosis, monitoring, and treatment – indeed all modern-day healthcare – is here to stay. Software as a medical device is a fluid and evolving concept, and one that will continue to change as new technologies, applications, and medical indications for software are developed. The challenges for manufacturers trying to pilot their products through the convoluted regulatory landscape and onto market will only increase, leading them to weather eye on the horizon, adjusting course as new requirements emerge. But the reward is a product that can meet the demands of today’s healthcare systems – and consumers.

As a medical device manufacturer, how do you know if your product is a medical device? Unfortunately, the answer to that question is not always clear, as a wide range of products – from tongue depressors to antibody test kits to programmable pacemakers – can all be classified as medical devices.

Enter “is my product a medical device” into encyclopedia Google and you’ll get a plethora of websites offering a definition. Wikipedia simply states that a medical device is any device intended to be used for medical purposes, so no help there. Both the World Health Organization and the FDA offer more detailed definitions, but more detail does not necessarily lead to product classification clarity. So how is a medical device really defined – and does it matter?

How does the FDA Define a Medical Device?

It absolutely matters, because medical devices are one of the most tightly regulated products on the market. Every phase of the development process from cocktail-napkin concept to working prototype to validation testing and beyond is bound by a complex set of regulations intended to ensure product safety and efficacy. Manufacturers need to align their processes and documentation with these regulations, so knowing whether a product qualifies as a medical device is an important first step in bringing a product to market in the US.

The FDA defines a medical device as “an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article, including a component part or accessory, intended for use in the diagnosis of disease or other conditions.” There are a few more specific bullet points, but this broad opening description serves as the crux of the FDA’s official classification. Even that does not paint a complete picture, so what else does a manufacturer need to determine if their product qualifies as a medical device?

Clarify the Product’s Intended Use

Manufacturers will want to give some serious thought to the intended use of their product. The intended use statement will decide your product’s regulatory future and will go a long way toward clarifying whether your product qualifies as a medical device or not.

Simply put, the intended use refers what the device does – what is it intended to do. The intended use clearly states the purpose of the device as can be demonstrated via labeling, advertising, oral or written statements and product claims. Is your product designed to diagnose disease? Will it be advertised as a better way to monitor blood glucose levels? Does the proposed labeling promise to improve patient health? Chances are your device will qualifiy as a medical device.

Likewise, the indications for use are born of the intended use statement, and clearly state the anatomical sites where the product can be used, the targeted population, and duration of use for the device. While the indications for use are not as important to the classification as the intended use, knowing where your product is to be used and what patient population it targets can help you determine if your product falls under the medical device umbrella.

Does Your Product Meet the Definition?

If the intended use and indications for use of your product fall within the FDA definition of a medical device, the next step is to see if it qualifies based on the definition outlined in the Food, Drug and Cosmetic Act (FD&C). The original 1938 act was amended in 1976 to include medical devices, and almost fifty years later remains the pivotal piece of legislation guiding the production, regulation, sale, and marketing of medical devices in the US.

The FD&C separates medical devices into three classes based on the level of risk posed to users of the product:

• Class I devices are typically those already on the market with a demonstrated history of safety. Think band-aids, dental floss, latex gloves, and some hand-held surgical instruments.
• Class II devices are still relatively simple devices but pose a slightly higher risk so require a bit more regulation to ensure product safety. Most medical devices fall into this category – infusion pumps, pregnancy test kits, surgical drapes and powered wheelchairs are just a few examples.
• Class III devices are typically used to support or sustain life, are implantable, and carry the highest potential risk for illness or injury. Implantable pacemakers, pulse generators, breast implants, and automated external defibrillators (AEDs) are all class III devices.

Does Your Product Fall into an Existing Product Classification?

If you’re still uncertain whether your product qualifies as a medical device, the next step is to review the FDA Product Classification Database. A keyword search of this database will provide a view of any existing product with similar design and intended use to yours.

You can also search individual databases based on FDA approval status:

• Pre-market approval is typically granted to high-risk, Class III devices
• Premarket 510(k) notification is largely comprised of moderate-risk, Class II devices
• de novo classification is used for novel devices of low to moderate patient risk

There is also a database for Emergency Use Authorization, which is used only in situations where a public health emergency has been declared, such as the COVID-19 pandemic. Manufacturers granted an EUA must submit a traditional 510(k) to the FDA if they wish to keep their device on the market after the emergency declaration comes to an end.

The Devil Really is in the Details

Classification of your product really does determine its future and making the wrong choice can result in post-market regulatory headaches and unanticipated expenses. But with careful review of the regulations, consideration of your product’s intended use, and comparison to products already cleared by the FDA, you can determine whether your product qualifies as a medical device. And that determination will guide you down the correct pathway to FDA approval (as applicable) and market success.