Medical Device Software "Level of Concern"

[mscottf]

In the FDA Guidance for for the Content of Premarket Submissions for Software Contained in Medical Devices, determining the Level of Concern requires a determination of what level of injury could result from failure. I have two questions:

1. Is this determination based on only failure or should injury that is a result of unintended use be considered here? I know it does for risk analysis but I'm not sure about "level of concern".

2. Would permanent or long-term reddening or scarring on 1 square inch of forearm skin be considered as "permanent damage to a body structure", resulting in this being considered a serious injury and therefore a Major level of concern?

Thanks.

 

[yodon]

Re: Questions regarding Medical Device Software Level of Concern

1. Is this determination based on only failure or should injury that is a result of unintended use be considered here? I know it does for risk analysis but I'm not sure about "level of concern".

A little tricky to answer but the software level of concern is based on the risk of the failure of the software. Would your software prevent this unintended use? One example I can think of would be a hand-held neurostimulation device - delivers electrical current to treat pain. The software can control, to a degree, the electrical delivery. The hardware limits it, though, so the worst case of software failure would be pain (not a fatal shock). The treatment is intend for topical use but is not indicated for, say, migraines. In theory, you could cause brain injury if you used the device at max setting at your temples. The software can't control that and no failure would address it so to me, that would be out of scope of consideration for level of concern.

2. Would permanent or long-term reddening or scarring on 1 square inch of forearm skin be considered as "permanent damage to a body structure", resulting in this being considered a serious injury and therefore a Major level of concern?

I *personally* wouldn't consider superficial scarring as such but I would recommend getting advice from a regulatory expert. It just doesn't seem to be in the vein of other parts of the definition (life threatening, impairment of a body function, or medical or surgical intervention)

 

[primavesvera]

Hi, I thought I might use this topic, since it doesn't make much sense to duplicate it.
My problem is that I don't get certain things what FDA actually wants to see.
For example, from the guidance:
For Major Level of Concern Software Devices, this document should also include an annotated list of the control/baseline documents generated during the
software development process and a list or description of software coding standards.

What do they mean by the software coding standards? Is it about the programming style and practices or something completely different?

 

[Pads38]

They could be looking for things like:
MISRA
Autosar
High Integrity C++
CERT
(and others)

Also IEC standards such as 61508 Functional safety of electrical/electronic/programmable electronic safety-related systems (there will be ANSI standards as well).

Introduction here (no connections)
Intro to Coding Standards — Coding Rules and Guidelines | Perforce

 

[uwamahoro]

Thank you so much for the information.
I need your advice ! For the first time , our company is interested in distributing devices with software. what should we look at as distributor regarding software validation? what kind of information should we request from the supplier? is there any SOP that we supposed to have in place in this regards as distributor ? please advise, we are a small company without really experience in this industry but willing to learn. I just thank GOD to be on this forum. I am learning a lot on daily basis. Thank you . Frany

 

[yodon]

IEC 62304 is a recognized consensus standard by FDA. That's probably a good place for you to start. I presume your supplier is a software development firm? If so, your contract with them can specify compliance to 62304. Understanding of that standard would be a good starting point for supplier qualification and approval!

However, there are things you'll need to consider internally, primarily the work driving maintenance (gathering feedback, reviewing postmarket data, etc.) to determine if software updates are necessary. You can probably maintain your relationship with your software service provider to support this effort but they can't really do it all, I'm guessing.

 

[akp060]

In the FDA Guidance for for the Content of Premarket Submissions for Software Contained in Medical Devices, determining the Level of Concern requires a determination of what level of injury could result from failure. I have two questions:

1. Is this determination based on only failure or should injury that is a result of unintended use be considered here? I know it does for risk analysis but I'm not sure about "level of concern".

2. Would permanent or long-term reddening or scarring on 1 square inch of forearm skin be considered as "permanent damage to a body structure", resulting in this being considered a serious injury and therefore a Major level of concern?

Thanks.

1. Only intended use is to be considered
2. Could you please provide some details like which layer of skin this is limited to? Scar tissue is replaced by epithelial cells in some time, but if its more than just a scar need to check, so some details here could help answer this. Seems like the following statement in the same guidance can come to your rescue

[For the purposes of this document, the term permanent is defined as “irreversible impairment or damage to a body structure or function, excluding trivial impairment or damage.”]

As you know with regulatory 'ifs' and 'buts' are common, Good Luck!

 

[Tidge]

To echo @yodon

The software classifications of 62304 (A, B, C) are roughly commensurate with the FDA's classification scheme (Minor, Moderate, Major), so any developer following a (risk-motivated) 62304-compliant development process should have all the documents necessary for an FDA submission. There are only a few subtle differences between the 62304 and FDA classifications:

1. 62304 is a process standard that will require the generation of certain documents (based on classification), the FDA classification is only for the purposes of determining what documents must be included in a submission (based on Level of Concern).
2. The FDA level of concern is to be made PRIOR to the consideration of risk controls (in the total device); the 62304 classification allows for the consideration of device design choices such that the development requirements scale with the responsibilities of the software alone.

In practice, I've never worked on a ME device (with software) where the device didn't align with (A/Minor, B/Moderate, C/Major). I would estimate that 80% of the reason for this result has been due to the specific ME device design choices, and 20% due to an unwillingness on the part of design teams to apply any sort of analysis in the area of segregation/allocation of risk controls prior to jumping into development.