Standalone software caught by medical device regulation
The medical sector is undergoing significant change triggered by advancements in technology and enhanced use of patient data. Increasingly, software in a ‘supporting role’, is… Read more
The medical sector is undergoing significant change triggered by advancements in technology and enhanced use of patient data. Increasingly, software in a ‘supporting role’, is introduced into the traditional medical landscape to assist physicians with making critical decisions. This has given rise to key questions around whether standalone software that is not being applied specifically for medical use, but is used to support medical decisions should be regulated as a ‘medical device’.
These questions have been addressed in the changes introduced by the European Commission to consolidate the European regulatory framework on medical devices, as well as a recent key decision by the Court of Justice of the European Union (the “CJEU”), which significantly broadens the scope of ‘medical device’ to capture standalone software and apps that are manufactured with a ‘medical’ purpose.
Status of software as medical device confirmed under new laws
On 5 May 2017, the European Union introduced two new regulations: one for medical devices, Regulation (EU) 2017/745 (the “MD Regulation”) and the other for in-vitro diagnostic medical devices, Regulation (EU) 2017/746 (the “IVD Regulation”). These new laws, which were aimed at ensuring a “high level of safety and health whilst supporting innovation” were a long-awaited overhaul of what was perceived to be an ill-fitted model for regulating a fast-changing med-tech environment. Each of these regulations will, by 2020 and 2022 respectively, replace the existing European framework for marketing medical and in-vitro devices in Europe, expanding the scope of what will be regulated, and introducing new requirements.
The now-replaced framework already captured software that was intended by the manufacturer to be used for one or more of the medical purposes as a medical device. Under the regulations, medical purposes include:
- Diagnosis, prevention, monitoring, treatment or alleviation of disease
- Diagnosis, monitoring, treatment, alleviation of or compensation for an injury or a disability
- Investigation, replacement or modification of the anatomy or of a psychological process
- Control of conception
The new MD Regulation and IVD Regulation have confirmed the position regarding software as a medical device while expanding the definition and the scope of purposes to capture new types of device; the new regulations now include additional purposes including “prognosis” and “prediction” of diseases.
Further, Article 2(2) of the MD Regulation expands the application of the new rules to “accessory for a medical device”, which is defined as not itself a medical device, but one that is intended to be used together with one or several medical device(s) to enable that medical device to be used in accordance with its intended purpose, or to specifically and directly assist the medical functionality of the medical device to fulfil its intended purpose. This means that the different software and apps designed to enable medical devices to be used for their intended purpose would now be categorised as a medical device. The MD Regulation does, however, clarify that software will not be classified as a medical device if it is intended for general purposes such as life-style and well-being apps.
The MD Regulations have also introduced a more detailed classification system for software, which system determines the safety rules and conformity assessments that would apply. While software will generally attract a lower risk classification I, the new regulations mandate a stricter classification system for the more complex and critical software such as software that is used to make diagnostic or therapeutic decisions that are likely to have a serious impact on the patient’s health.
CJEU adopts a purposive approach to determining software as medical device
The position regarding standalone software, while clear under the new regulations, has not been as clear cut in the Courts. The CJEU has on various occasions opined on the scope of the definition of ‘medical device’ under the Medical Devices Directive (Directive 93/42/EEC), but not until very recently has the CJEU ruled that standalone software is a medical device despite the fact that the software does not itself act on or in the human body in any way.
The CJEU decision followed a reference and a preliminary ruling by the French Conseil d’État on whether certain prescription support software that provides healthcare professionals with information on patients relating to contraindications, drug interactions and dosage limits can be classified as a ‘medical device’. The CJEU adopted the opinion of the Advocate General in this case, stating that the intended purpose of the software (i.e., whether its purpose falls within a medical purpose as prescribed by the regulations) and the function that the software performs on the data (i.e., analytics, learning and decision-making) are key tests in determining whether the relevant software is a medical device or not.
In this case, the particular support software was found to have met the relevant tests, as the software facilitated calculation of dosage and the proper design of the treatment by the healthcare professionals by providing relevant information and analysis. As such, the purpose of the software was a ‘medical purpose’, as it allowed physicians to prescribe medicines more safely and to minimise the risk of an incorrect prescription. The CJEU stated that:
“software, of which at least one of the functions makes it possible to use patient-specific data for the purposes, inter alia, of detecting contraindications, drug interactions and excessive doses, is, in respect of that function, a medical device, within the meaning of Article 1(2) of Directive 93/42, even if such software does not act directly in or on the human body.” 
The CJEU’s judgement is supported by existing guidance in Europe, including the European Commission’s Guidance document Medical Devices – Scope, field of application, definition – Qualification and Classification of standalone software – MEDDEV 2.1/6, which provides that “software, which is intended to create or modify medical information might be qualified as a medical device”.
The UK’s Medicines and Healthcare products Agency (the “MHRA”) has also taken a similar approach stating that independent software is likely to be a medical device where:
- it is linked to a specific medicine or device (e.g., as an accessory);
- it is intended to influence the actual treatment (e.g., dose, size of implant, time of treatment, etc.); and
- it results in a diagnosis or prognosis.
The MHRA provides that “some decision support software may not be considered to be a medical device if it exists only to provide reference information to enable a healthcare professional to make a clinical decision, as they ultimately rely on their own knowledge. However, if the software/app performs a calculation or interprets or interpolates data and the healthcare professional does not review the raw data, then this software may be considered a medical device.” The MHRA goes on to state that physicians are increasingly relying on apps and software that rely on outputs from the software without studying the data source, therefore, indicating that such technology should be captured by regulations.
Implications for industry
The CJEU decision will have a direct impact on what is a fast-evolving med-tech scene that is innovating in novel ways to use machine learning, autonomous decision making and artificial intelligence to enhance efficiency and accuracy in disease intervention and medical diagnosis and management. Innovators and manufacturers will need to take note to carefully assess whether a software or an app will be classified as a medical device, therefore needing to satisfy the regulatory requirements. Similarly, while the MD Regulation and IVD Regulation will not come into full force until 2020 and 2022 respectively, software and app innovators will need to review the new regime to ensure compliance – further guidance on these regulations is expected by mid-2018.
 MD Regulation, Recital 1
 Directive 2007/47/EC (amending Directive 90/385/EEC and Directive 93/42/EEC)
 Case C-329/16 Syndicat national de I’industrie de technologies médicales (SNITEM) and Philips France v Premier Minister and Ministre de Affairs sociales et de la Santé
 Ibid, at paragraph 34
 Medicines & Healthcare products Regulatory Agency, Guidance: Medical device stand-alone software including apps (IVDMDs) at https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/648465/Software_flow_chart_Ed_1-04.pdf
Share this blog
Share this Blog
- Adtech & martech
- Artificial intelligence
- Cloud computing
- Complex & sensitive investigations
- Cryptocurrencies & blockchain
- Data analytics & big data
- Data breaches
- Data rights
- Digital commerce
- Digital content risk
- Digital health
- Digital media
- Digital infrastructure & telecoms
- Emerging businesses
- Financial services
- KLick DPO
- Open banking
- Software & services