On October 27, 2021, the U.S. Food and Drug Administration (FDA), Health Canada and the United Kingdom’s Medicines and Healthcare products Regulatory Agency (MHRA) issued a set of ten guiding principles meant to aid the development of Good Machine Learning Practice (GMLP).

Artificial intelligence and machine learning (AI/ML) offers the potential to analyze the vast amount of real-world data generated from health care every day to provide transformative insights. These insights can not only help improve individual product design and performance, but also hold the promise of transforming health care.

However, AI/ML technology has unique complexities and considerations. The goal of these guiding principles is to help promote safe, effective, and high-quality medical devices that use AI/ML to best cultivate the future of this rapidly progressing field.

Although not formal or binding, as companies continue to leverage AI/ML in their medical devices, they should remain mindful of each of the ten guiding principles:

1. Leveraging Multi-Disciplinary Expertise Throughout the Total Product Life Cycle

Companies should leverage internal and external multi-disciplinary expertise to ensure they have a thorough understanding of the model’s integration into the clinical workflow, and the desired benefits and associated patient risks, to ensure the safety and effectiveness of the device while serving clinically meaningful needs throughout the product lifecycle.

2. Implementing Good Software Engineering and Security Practices

Companies should implement as part of model design data quality assurance, data management, good software engineering practices, and robust cybersecurity practices.

3. Utilizing Clinical Study Participants and Data Sets that Are Representative of the Intended Patient Population

Companies should ensure that their data collection protocols have sufficient representation of relevant characteristics of the intended patient population, use, and measurement inputs in an adequate sample size in their clinical study and training and test datasets so that results can reasonably be generalized to the population of interest.  Data collection protocols appropriate for the intended patient population may help to identify where the model may underperform and may mitigate bias.

4. Keeping Training Sets and Test Sets Independent

Companies should consider and address all sources of dependence between the training and test datasets, including patient, data acquisition, and site factors to guarantee independence.

5. Selecting Reference Datasets Based Upon Best Available Methods

Companies should use accepted, best available methods for developing a reference dataset, i.e., a reference standard, to ensure clinically relevant and well characterized data are collected (and that the reference’s limitations are understood).  Where available, companies should use accepted reference datasets in model development and testing that promote and demonstrate model robustness and generalizability across the target population.

6. Tailoring Model Design to the Available Data and Reflecting the Intended Use of the Device

Companies should have a solid understanding of the clinical benefits and risks related to the product and utilize this understanding to create clinically meaningful performance goals.  Additionally, companies should ensure the model design is suited to the available data and supports active mitigation of the known risks.

7. Focusing on the Performance of the Human-AI Team

Where the model has a human element, companies should consider human factors and human interpretability of the model outputs.

8. Testing Demonstrates Device Performance during Clinically Relevant Conditions

Companies should develop statistically sound tests and execute them to assess device performance data independent of the training data set. Such assessment should be conducted in clinically relevant conditions with consideration given to the intended use population, important subgroups, clinical environment and use by the Human AI-Team, measurement inputs, and potential confounding factors.

9. Providing Users Clear, Essential Information

Companies should provide users ready access to clear, contextually relevant information that is appropriate for the target audience. Such information includes not only information pertaining to the product’s intended use and indications for use, performance of the model for appropriate subgroups, characteristics of the data used to train and test the model, acceptable inputs, known limitations, user interface interpretation, and clinical workflow integration of the model, but also users should be made aware of device modifications, updates from real-world performance monitoring, the basis for decision-making (when available), and a way to communicate product concerns to the company.

10. Monitoring Deployed Models for Performance and Managing Re-Training Risks

Companies should deploy models that are capable of being monitored in real-world usage with a focus on maintaining or improving safety and performance. Further, when models are trained after deployment, companies should ensure there are appropriate controls in place to manage risks that may impact the safety and performance of the model.

FDA’s expectations with respect to GMLP will continue to advance and become more granular as additional stakeholder input is considered.  The docket for FDA’s GMLP Guiding Principles, FDA-2019-N-1185, is open for public comment.

Visit the Goodwin on Medtech hub to stay informed on important developments affecting medtech innovators and investors.

In September 2020, the Centers for Medicare & Medicaid Services (CMS) proposed a new rule that would expedite Medicare coverage for medical technology approved through the Food & Drug Administration’s (FDA’s) “Breakthrough Devices Program.”  CMS’s proposal – the Medicare Coverage of Innovative Technology, or MCIT, Pathway – was groundbreaking in that innovative medical technology would be afforded a new, expedited coverage avenue that would significantly reduce the time it takes for Medicare beneficiaries to gain access to and benefit from innovative technology. It published the final rule on January 14, 2021.

But, just one year later on September 15, 2021, CMS plans to rescind the MCIT pathway altogether.  As a result, the medical technology industry, providers, and patients, which had looked favorably upon the agency’s MCIT proposal, will continue to face the uphill climb of traditional Medicare coverage for medical devices.

Medicare Coverage of Medical Technology

Prior to CMS’s proposal, FDA marketing authorization of a breakthrough device did not mean immediate access for Medicare beneficiaries.  Instead, Medicare rules required even greater effort on the part of manufacturers and providers for Medicare to actually pay for the technology.

Under traditional Medicare coverage rules, even if the FDA granted a particular product marketing authorization, CMS separately determines if the device should be considered “reasonable and necessary” for patient diagnosis and treatment via a National Coverage Determination (NCD) from CMS or via a Local Coverage Determination (LCD), made by one or more Medicare Administrative Contractors, or MACs.  This process, which includes evidence-based reviews, is lengthy and – in the case of an LCD – may even result in different standards in different geographies, based on the location of the MAC.  And, as the medical technology industry has repeatedly emphasized, the result is that America’s seniors and others dependent upon Medicare coverage, would have to wait – in some cases for years – to access the most innovative technology.

MCIT Proposal – An Expedited Avenue to Coverage for Innovation

Under the original 2020 proposal’s MCIT coverage path, CMS would offer a four-year period after FDA marketing authorization for breakthrough status medical technology to be reimbursed by Medicare, thereby bypassing the NCD or LCD process.  If the technology did not have an existing Medicare benefit category or was excluded from Medicare coverage by statute, MCIT would not be available.  During the MCIT path’s four-year period, medical device makers would be encouraged (not required) to develop additional clinical evidence and to collect additional data.  And at the end of the four years, the device would be subject to an NCD that either grants or denies Medicare coverage or offers MACs the discretion to conduct claim-by-claim adjudication or an LCD.

Put another way, the MCIT path would significantly abbreviate what has become a lengthy coverage process and would provide Medicare beneficiaries with quicker access to advanced, innovative technology.

In promulgating the MCIT coverage path, then-CMS Administrator Seema Verma emphasized its goal of expediting the delivery of advanced, innovative technology to Medicare beneficiaries, and diminishing administrative burdens on that hamper or slow this process.  Verma noted, “Government processes have slowed beneficiaries’ access to innovative treatments. Despite being deemed safe and effective by the FDA, Medicare beneficiaries have not had predictable, immediate access to innovative breakthrough devices . . . [t]he MCIT rule will eliminate this lag time for both seniors and innovators.”

MCIT Proposal’s “Reasonable and Necessary” Definition

The MCIT rule also addressed another critical issue for the Medicare program:  defining the term “reasonable and necessary.”  Under the current regulatory framework, Medicare may only cover items and services that are classified as “reasonable and necessary” for the diagnosis or treatment of an illness or injury.  Notably, this term – despite its clear significance – is not defined in the statute or regulations.  The term is defined only in informal guidance (i.e., the Medicare Program Integrity Manual).

The MCIT Final Rule sought to codify and expand the definition of “reasonable and necessary” as laid out in the Medicare Program Integrity Manual.  In expanding the definition, the MCIT Final Rule stated that, in addition to  meeting any of the qualifications outlined in the Medicare Program Integrity Manual, items and services may be deemed “reasonable and necessary” based on CMS review of commercial insurer coverage decisions and policies.  At the time of the MCIT Final Rule, CMS stated that it would publish a draft methodology for determining when commercial insurers’ policies could be considered to meet the definition of “reasonable and necessary.”  Most notably, Verma emphasized that this portion of the rule would help give innovators a clearer understanding of CMS standards.

A New Administration, a New Approach

Despite the clarity provided by the MCIT rule, despite the certainty offered Medicare beneficiaries to accessing innovative technology, and despite the release of a final rule in January 2021, the Biden Administration now plans to kill the MCIT path outright, citing the following reasons for its decision to rescind what had promised to get seniors better access to advanced technology:

• Lack of Adequate Studies: There is no FDA requirement that Medicare beneficiaries be included in clinical studies needed for market authorization. CMS, not FDA, typically requires and reviews evidence specific to medical devices for the Medicare population.  By automatically granting national Medicare coverage to devices that receive FDA market authorization, the MCIT path would have eliminated CMS’s ability to ensure whether medical device makers have generated adequate evidence that the breakthrough device would be reasonable and necessary for the Medicare patients that have the particular disease or condition that the device is intended to treat or diagnose.
• Limited Ability to Revoke Coverage: Traditionally, CMS reserves the right to deny coverage if it learns that particular devices may be harmful to Medicare beneficiaries. The MCIT path limited such rights for breakthrough medical devices with FDA market authorization. Under the MCIT path, CMS would only be able to expeditiously remove a Breakthrough Device from MCIT coverage for limited reasons, such as if FDA issued a warning letter or removed marketing authorization for the device.
• Disincentivizing Development: According to CMS, by incentivizing devices eligible for FDA breakthrough device designation, the MCIT path may have the unintended consequence of disincentivizing development of innovative second-to market devices and subsequent technologies of the same type that would not be eligible for breakthrough device designation.

CMS also plans to return to the drawing board on the definition of “reasonable and necessary,” noting the following:

• The Definition Removes Flexibility for the Agency: Suggestions to codify or expand the definition of “reasonable and necessary” to include commercial insurer policies may remove existing flexibility and could even impact CMS’s ability to ensure equitable health care access.
• Need for a Separate Rule. Given the implications the definition has for Medicare policy above and beyond just the coverage of innovative medical technology, the agency notes that the definition should be included in a separate rule.

Conclusions

While CMS’s decision to rescind the MCIT Pathway appears to be a fait accompli, comments to the agency’s proposed rule are due on or before October 15, 2021.  If finalized, it is unclear whether the agency will revisit the concept in the future or whether the industry will continue to face lengthy delays between the time a medical device is authorized and the time America’s seniors will benefit.  CMS will continue to require and review evidence specific to the Medicare population to cover medical devices– a lengthy process that is above and beyond any clinical evidence produced as a result of any clinical studies required for FDA authorization.

Further, stakeholders will continue to face uncertainty.  This includes providers (who will not be certain that their claims for procedures or products will be paid, especially if handled on a claim-by-claim basis or if subject to varied and differentiated local decisions from contractors); patients (who may or may not be able to access innovative technology), and medical device makers (who may be required to undergo significant evidence collection processes, not to mention delays in recouping the funds invested into developing and building the medical technology in the first place).

We will continue to monitor and provide updates on this important issue for the medical technology industry.  If you have any questions or would like to submit comments, please reach out to Matt Wetzel (mwetzel@goodwinlaw.com).

The use of telehealth continues to grow rapidly across the U.S.  Given legislative proposals and the Centers for Medicare & Medicaid Services efforts to expand access to telehealth, we can only anticipate that remotely engaging with healthcare providers is here to stay.   In fact, the National Center for Health Statistics and the Centers for Disease Control and Prevention reported that between April and July 2021, 24.5% of adults in the U.S. had a virtual care appointment with a healthcare professional over video or phone.  Given the continued persistence of COVID-19 and the ease and convenience for both provider and patient, telehealth services will most likely remain popular even as the option of in-person appointments regains footing.

On a parallel front, artificial intelligence (AI) is also driving considerable advancements in patient care. Advances in AI offer a powerful way to create clinical and operational efficiency in today’s healthcare system. According to a study by MIT, 72% of healthcare professional respondents showed interest in implementing AI in healthcare delivery. In the field of radiology, as just one of many examples, AI can already be used to find patterns in CT scans, mammography, and other imaging modes that help radiologists more accurately diagnose cancer and a whole spectrum of  other sometimes hard-to-identify diseases.

Telehealth is one of the newest services to utilize AI widely, and there is great promise in its application.  Telehealth typically involves a synchronous, real-time electronic communication from person-to-person.  Subject to limitations in certain states, telehealth also can be furnished through asynchronous communication, whereby a physician reviews and makes medical assessments based on information that a patient has uploaded or stored in a database.  Even though it is asynchronous, this remains a person-to-person communication.  Recently, however, we see more and more opportunities for AI to augment the person-to-person nature of and enhance the capabilities of telehealth.  For example:

• Clinical Evaluation – leveraging AI to take patient histories and make collecting patient information more efficient. This could include a series of AI-developed questions during telehealth intake designed to ask the right questions in the proper sequence to better assist a physician in determining the cause of a patient’s symptoms.
• Telemonitoring – the potential for AI and telemonitoring extends beyond just collecting patient data and turning them into reports. Implementing AI into remote patient monitoring (RPM) devices can promote preventative care and equip the RPM with the ability to predict adverse events.
• Quality Improvement –further integration of AI technology in telehealth services can help with quality improvement processes by enhancing clinical decision-making and disease diagnosis, ultimately optimizing patient care and significantly improving healthcare outcomes.
• Virtual Health Assistants – AI-enabled interfaces allow patients to have more power and control over their healthcare paths. AI applications in virtual health assistants can provide the patient with precise information about their healthcare condition and assist with better healthcare management.

With the promising future of the continued convergence of AI and telehealth and the increased use of digital and consumer technologies to deliver virtual care, there are several legal and regulatory considerations for telehealth providers.  These include:

• Protecting Patient Health Information. One of the biggest issues related to data privacy and security with the application of AI in healthcare is the need to either use de-identified information or obtain patient authorization to use identifiable information. Absent patient authorization, it is difficult to use protected health information (PHI) for machine learning.  But sometimes de-identified information is insufficient for machine learning.  If the developer of the AI is using de-identified information, it must have the right to de-identify the PHI.  Typically, a business associate (BA) is developing the AI. BA’s must have the right to de-identify under the business associate agreement (BAA); otherwise, they can’t de-identify PHI.  Further, there is a separate risk that the AI can be used to re-identify de-identified information.  Studies have demonstrated the potential to re-identify de-identified patient records by combining it with other data sources that AI collects such as facial recognition or iris scans. Because only a few states, like California, have banned re-identification of de-identified data, a Covered Entity may want to include provisions in a BAA with an entity developing AI to protect against that.

Another significant consideration with AI implementation in digital health is patient health information protection and verification.  Healthcare providers are subject to state privacy and security regulations as well as the Health Insurance Portability and Accountability Act (HIPAA) and its implementing regulations, which protect the privacy and security of health information and give individuals certain rights concerning their health information.  According to a 2019 University of California Berkley study, due to the nature and functionality of AI, current laws and regulations appear inadequate to keep an individual’s health status private.  The findings demonstrate that using AI makes it possible to identify individuals by learning daily patterns collected by remote patient monitoring devices such as smartwatches and smartphones and correlating them to demographic data.  If bad actors gain access to such information, they can piece together patients’ identities.  According to a 2020 cybersecurity survey, 70% of the healthcare providers that responded stated that they experienced significant security incidents between 2019 and 2020.  Telehealth providers should be mindful of the potential gaps in data protections that could be created with the addition of AI.  This includes continued vigilance when it comes to HIPAA compliance and reexamining their internal risk assessments, policies, and practices considering the additional risks raised by AI.

• Corporate Practice of Medicine Considerations. As telehealth platforms leverage AI to help physicians deliver care to patients, there is an increasing opportunity for providers to use AI, through machine learning, for example, to diagnose and/or identify the appropriate treatment regimen for patients.  Potential corporate practice of medicine (CPOM) concerns could ensue.  Generally, CPOM laws are designed to prohibit corporations from practicing medicine:  only individual practitioners can diagnose and treat patients, and CPOM prohibitions prevent corporate interference with a healthcare professional’s independent professional judgment.  Without the right level of physician supervision, it is conceivable that an advanced AI-enabled telehealth platform could potentially diagnose or recommend patient treatment options or otherwise blur the lines demarcating where the machine’s judgment ends, and the physician’s judgment begins.  A company offering AI-enabled telehealth services should be mindful of and create clear supervision requirements and boundaries to avoid running afoul of these longstanding laws.  These boundaries should identify important guardrails, including whether and how a physician can overrule AI-driven diagnoses, and when must a physician sign off on an AI-generated treatment regimen.  Since telehealth is often practiced in multiple states, and because CPOM laws vary from state-to-state, providers utilizing telehealth services must structure their operations to account for the variability of the CPOM prohibitions in various states.
• Health Disparities. The implementation of AI-enabled telehealth services also raises important ethical questions about the availability of innovative care.  There is a potential that adding AI to telehealth services might shrink the gap between those accessing advanced care technologies and those that are not.  For example, studies have shown that those with limited English language skills have lower rates of telehealth use.  Adding AI virtual assistants to telehealth technology could, for example, help to ensure that language barriers do not get in the way of appropriate care.  Rather than finding a provider that speaks a particular language, an AI-enabled telehealth platform could assist by providing translation services in real time in multiple languages.  This could allow an AI virtual assistant, for example, to collect more comprehensive medical history during a telehealth visit, thereby providing a greater opportunity for better care and treatment.  Incorporating AI into telehealth visits might also allow for better questions that account for how different cultures view disease and treatment, or for diseases that might only affect a narrow sub-population.

But, there is also the possibility that AI-enabled telehealth services might exacerbate the gap between those who have access to the latest innovative technology and those who do not.  The growing expansion of telehealth services could risk widening disparities among marginalized populations who may have limited access to necessary resources: for example, those who lack access to a computer or smartphone or lack reliable broadband access.  The deployment of AI by telehealth providers is likely to lower costs and should improve disparities in access to care.  However, in the short term, access to AI-aided telehealth services may be uneven and contribute to a greater disparity in access to care.  The addition of AI to telehealth will likely not solve the physical access or cost problems, and it could conceivably add more costs to telehealth technology.  Further, many state Medicaid programs do cover telehealth visits for their beneficiaries, but the infusion of AI may require state regulators to further examine telehealth coverage policies.

• Professional Liability & Malpractice.  As AI advances and its capabilities are better leveraged, how will the highly litigious American people respond?  Who will be responsible when AI-enabled telehealth results in an unfortunate misdiagnosis?  AI and machine learning are not immune to mistakes.  For example, the visual nature of a skin examination lends itself well to the use of machine learning as a potentially valuable tool in teledermatology and the diagnosis and management of dermatologic diseases, especially in areas where a dermatologist may not be available.  However, just like humans, AI might not always get it right.  AI algorithms have some shortcomings, including inapplicability outside of their training domain or bias. We know that blind spots in machine learning machines can sometimes imitate the worst societal biases, with a risk of unintended consequences that have particular effects on minority groups, which can open up providers to increased liability if they depend on these algorithms to assist in diagnosing patients.  Who can be held liable for malpractice if a patient undertakes a series of damaging treatments – or fails to seek treatment based on an AI-enabled diagnosis the patient receives through a telehealth platform?  The AI developer?  The telehealth platform?  The individual physician who signed off on the misdiagnosis?  And which law applies, especially if the patient is in one state, the telehealth provider in another state, and the AI data platform in yet another state?  Further, how much training must a telehealth platform provide its individual physicians regarding the use of AI-infused tools?  If a healthcare provider uses AI to treat or diagnose a patient, both the AI developer and the healthcare provider may be exposed to tort liability related to an adverse event.  The AI developer can be exposed to products liability claims and the provider may be exposed to malpractice claims.  However, without clear legislative direction, it is conceivable that litigants will use the courts to lay out these rules.
• FDA Implications. The regulatory framework governing AI is complex.  A threshold question for any AI developer is whether their AI-enabled product will be actively regulated by the U.S. Food and Drug Administration (FDA), a question that hinges not only on the product’s functionalities, but also its proposed marketing claims.  Further, the FDA continues to develop its framework for regulation of AI-enabled products that the agency actively regulates.  On January 12, 2021, the FDA released the agency’s first Artificial Intelligence/Machine Learning (AI/ML)-based Software as a Medical Device (SaMD) Action Plan.  This action plan describes a multifaceted approach to advance the FDA’s oversight of AI/ML-SaMD, and offers stakeholders several opportunities to engage with the FDA to discuss the agency’s oversight approach.  For example, upcoming opportunities include the FDA’s planned virtual public workshop on October 14, 2021 on the role of transparency in enhancing the safety and effectiveness of AI/ML-based SaMD. Stakeholder feedback continues to inform the evolution of FDA’s regulatory framework for oversight of AI/ML-based SaMD, including FDA’s expectations for such products during premarket review.  A thorough understanding of such expectations early in development can inform more efficient development strategies.

Advances in the use of AI in telehealth will no doubt continue.  AI’s application in telehealth platforms is not just limited to potentially diagnosing a wide range of diseases (like analyzing data from tele-dermatological visits to more accurately diagnose skin cancer); but it can also improve the patient experience (by asking more pinpointed intake questions, for instance), make telehealth visits more efficient (by, for example, more rapidly analyzing a patient’s history for a physician in advance of a visit), and help ensure more effective treatment (with AI-generated follow-up adherence or refill calls).   AI can reduce differences in clinical practice, improve efficiency, and prevent avoidable medical errors that can help with healthcare costs and improve health outcomes and the patient experience.

But a fundamental component to achieving a safe and effective deployment of AI in telehealth services is ensuring that AI developers, telehealth platforms, and the physicians that leverage these tools have the necessary legal and regulatory guardrails in place. This includes addressing the application of current privacy and data security regimes, how telehealth providers supervise the use of AI technology to ensure compliance with CPOM laws, and how telehealth providers address growing disparities in access to care.

The Biden Administration’s withdrawal of the Trump Administration’s proposal to exempt 84 medical device types from the FDA’s premarket notification, or 510(k), requirement, underscores the promotional framework that developers and marketers of these devices are subject to.  The Trump Administration proposal included devices critical to combating the COVID-19 public health emergency, ranging from personal protective equipment and ventilators to remote patient monitoring and other types of digital health devices.

Read more about promotional considerations for these devices here.

On January 19, 2021, the FDA issued guidance for licensed and investigational cellular and gene therapy (CGT) manufacturers during the COVID-19 pandemic. This new guidance supplements the recommendations provided in FDA’s June 2020 guidance regarding manufacturing controls to prevent contamination in drugs, risk assessment of SARS-CoV-2 as it relates to drug safety and quality, and continuity of manufacturing operations as applied to all drug and biological product manufacturers.

The new guidance provides risk-based recommendations to minimize potential transmission of SARS-CoV-2 to patients and facility personnel with specific considerations relating to, among other things, the assessment of donors, cellular and tissue source materials, manufacturing processes, manufacturing facility control, material testing, and the number of patients that can be treated with the product. While FDA acknowledges in the guidance that is not aware of any CGT products that have been contaminated with SARS-CoV-2 or of information indicating transmission of SARS-CoV-2 via CGT products, FDA notes that “CGT manufacturers are expected to evaluate whether [the virus] poses new risks in the context of their specific products, facilities, processes, and manufacturing controls.”

FDA recommends that CGT manufacturers review the current good manufacturing practice requirements and recommendations and perform a risk assessment that identifies, evaluates, and mitigates factors that may allow for transmission of SARS-CoV-2 to patients and facility personnel and include a description of the risk assessment and mitigation strategies in any investigational new drug application (IND), biologics license application (BLA), or master file. Since this is an evolving area, manufacturers should look to scientific literature to provide justification and support for their risk assessment and mitigation strategies.

CGT manufacturers should evaluate their manufacturing operations for SARS-CoV-2 risks and be sure that all risk assessments of production controls, including any follow-up and changes, are approved by their quality unit and appropriately documented within their quality management system.

On January 12, 2021, the U.S. Food and Drug Administration (FDA) published its Action Plan for further development of the Agency’s framework for regulatory oversight of artificial intelligence (AI) and machine learning (ML) based Software as a Medical Device (SaMD).  The Action Plan identifies several opportunities for SaMD developers to engage the FDA as its regulatory framework for AI/ML-based SaMD oversight evolves:

• Predetermined Change Control Plans: FDA remains committed to refining a regulatory framework that would allow for some post-market SaMD modifications based largely on the establishment and utilization of SaMD Pre-Specifications (SPS) and an Algorithm Change Protocol (ACP) set forth in a “Predetermined Change Control Plan.” SaMD developers can expect, and be ready to submit comments on, a draft guidance in 2021 addressing a Predetermined Change Control Plan.
• Real-World Performance: Real-world data collection and monitoring is another key concept in FDA’s proposed regulatory framework for oversight of modifications to AI/ML-based SaMD. FDA plans to advance real-world performance monitoring pilots with stakeholders on a voluntary basis, and  use the learnings from these activities to develop a framework for gathering and validating relevant real-world performance parameters and metrics.
• Algorithm Transparency: To identify types of information that FDA may recommend SaMD developers include in the labeling of their AI/ML-based devices, FDA intends to hold a public workshop to elicit input from the broader community on how device labeling supports transparency to users.

FDA also will continue to participate in global working groups focused on harmonizing principles of Good Machine Learning Practice (GMLP) as well as expand upon the Agency’s efforts to develop methods for evaluating and addressing algorithmic bias.

The Agency recognizes that continued stakeholder engagement will be crucial for the formation of a sensible regulatory framework for oversight of AI/ML-based SaMD.  SaMD developers seeking to inform the development of FDA’s regulatory framework are strongly encouraged to participate in the specific opportunities outlined in the Action Plan.

In August, the U.S. Department of Health & Human Services (HHS) announced that the FDA will not require premarket review of laboratory developed tests (LDTs), whether COVID-19 related or not, absent notice-and-comment rulemaking.  Labs may voluntarily seek a premarket approval, 510(k) clearance, or an emergency use authorization (EUA) for their LDTs. Importantly, labs that do not obtain such FDA approval, clearance, or authorization would not be eligible for PREP Act coverage.

This announcement may have come as a surprise to FDA, which historically has asserted its medical device regulatory authority over LDTs while often subjecting them to enforcement discretion. Despite this HHS announcement, FDA’s May 11, 2020 Policy for Coronavirus Disease-2019 Tests During the Public Health Emergency remains in effect and has not been revised since the announcement. Importantly, this guidance offers two pathways for COVID-19 related LDTs – an EUA submission to FDA and the development of an LDT under the authorities of the State in which the laboratory resides, where the State takes responsibility for COVID-19 testing by labs in its State.

For FDA’s latest statements on COVID-19 testing, see the opinion piece authored by CDRH Director Dr. Jeffrey Shuren and Dr. Timothy Stenzel, Director of the Office of Health Technology 7, In Vitro Diagnostics and Radiological Health, in the Hill.

Developers of certain digital health devices for treating psychiatric disorders may be able to take advantage of an FDA enforcement policy, which remains in effect for the duration of the COVID-19 public health emergency.  The policy applies to certain prescription computerized behavioral therapy (CBT) devices for psychiatric disorders, digital health therapeutic devices for psychiatric disorders that operate using a different fundamental technology than CBT, other variations of CBT devices, such as non-prescription devices, and low-risk general wellness and digital health products for mental health or psychiatric conditions.

Relevant psychiatric conditions include Obsessive Compulsive Disorder, Generalized Anxiety Disorder, Insomnia Disorder, Major Depressive Disorder, Substance Use Disorder, Post-traumatic Stress Disorder, Autism Spectrum Disorder, and Attention Deficit Hyperactivity Disorder. The enforcement policy’s goal is “to help expand the availability” of these devices to aid those with these conditions “while reducing user and healthcare provider contact and potential exposure to COVID-19.”

Under this policy, these devices may be distributed and used without complying with the following regulatory requirements, where such devices do not create an undue risk in light of the public health emergency: 510(k) submission, correction and removal reports, registration and listing requirements, and Unique Device Identification requirements. For those software products with low-risk general wellness indications or functionality, FDA does not intend to enforce regulatory requirements consistent with the agency’s existing policies, which were in effect prior to the pandemic. Finally, FDA’s enforcement policy sets forth certain recommendations regarding the performance and labeling elements for these devices, such as user instructions that direct the patient to contact a physician before using the device. This enforcement policy highlights FDA’s regulatory flexibility for software and app developers in this therapeutic area during the COVID-19 pandemic.