Pathway to Software as a Medical device registration with CDSCO

Its been a while since I published my last article, being a working dad isn't less than a full time job. From being constantly prepared for all your babe's needs to the sleep deprived nights and managing household chores to be able to support your partner is a fun-but-tiring experience one goes through.

Since the past few months I've had great opportunities to interact with a few of my colleagues and independent consultants in the digital health space all asking for the route to SAMD certification. (For those who aren't aware SAMD = software as a medical device). I feel this common interest is ignited by COVID – 19 pandemic which acted as a catalyst to accelerate the uptake of technological solutions in life-sciences & pharmaceutical industry, for the purposes of monitoring, diagnosis, treatment, prevention of diseases and disorders.

A recalibration of interests during a tumultuous period has refocused the demographic’s attention on their personal health, with #digitaltherapeutics, #wearabledevices, applications to monitor vital statistics, provide lifestyle advisories, gamification in healthcare experiences, etc. not only at an individual level but also we see a tremendous shift in core healthcare stakeholders like pharmaceutical companies, payers, hospital systems moving beyond traditional-siloed products and or services to more of an integrated services models powered through technology. The regulators have taken a proactive approach to provide legislative guidance for the regulation of the new age digital solutions in healthcare, and further harness the technologies to create a cooperative healthcare ecosystem within the country. The Medical Device Rules, 2017 (MD Rules), modeled after Food and Drug Administration of USA (FDA) regulations and the European Union Medical Devices Regulations (EU MDR), provides for a regulatory framework in India for the manufacture and sale of medical devices in India.

The CDSCO, in Feb 2020, released a notification to extend the scope of the devices regulated under the Drugs and Cosmetics Act. Under the new scope, software is also considered as medical devices if it is used for;

1. Diagnosis, prevention, monitoring, treatment, or alleviation of any disease or disorder
2. Assistance for any injury or disability
3. Investigation, replacement or modification, or support of the anatomy or a physiological process
4. Supporting or sustaining life
5. Disinfection of medical devices
6. Control of conception

Further on, in September 2021, CDSCO released official guidelines on the classification of SaMD in harmony with IMDRF’s risk-based classification. It is categorised into low-risk (Class A), low-moderate risk (Class B), moderate risk (Class C), and high-risk (Class D) devices.  

The Software as a Medical Device (SaMD) to be marketed in India is subjected to and must comply with the following regulations:

• S.O. 648(E), February 11, 2020, Medical Device Definition
• Medical Device Rules, 2017
• ISO 13485:2016 - Quality Management Systems
• ISO 14971:2019 - Application of Risk Management to Medical Devices

Additionally, the SaMD shall also comply with the applicable global harmonised standards that include:

• IEC 62304; it deals with the software lifecycle, i.e., almost everything about what software engineers do.
• IEC 60601-1 applies to embedded software in a hardware medical device
• IEC 82304-1 applies standalone software also known as Software as a Medical Device (SaMD)
• IEC 81001-5-1 adds requirements for cybersecurity
• IEC 62366-1 adds requirements about man-machine interface ergonomics
• IEC 62304 is the standard for software in medical devices

Regulation in the DH (digital health) space across Asia and its application in each country will increase compliance burden, but also provide the necessary clarity, reduce litigation risks, and give SaMD manufacturers the confidence they need to innovate and leverage these new-age technologies to its maximum extent in the healthcare and life-sciences space.

Continuous dialogue between stakeholders is key in this respect, to ensure that the legacy of Therac – 25 is not repeated in the modern age. Few regulations are still under discussion and may come into force and regulate the Software as Medical Devices (SaMDs) more stringently.