SaMD and Customer Integrations

[klappa17]

I work in a relatively new SaMD company, some of the challenges we're starting to think about customer level integrations and whether they fall under medical device regulation or not.

An example is we have an API that allows our product to integrate with a customer's system. Now being relatively new company, these customers are requesting we build these integrations. Would these solutions fall under medical device regulation in the EU and US? In my previous experience, solutions like these would fall under med device accessories if we don't bundle them in as part of the main SaMD (potentially MDDS in the US). However from what I can gather speaking to a couple of people in the industry though, there are integration enginers that follow industry practices outlined by IHE (Integrating the Healthcare Enterprise) and not always following med device regs? Are these because the customer's IT team are taking on responsibility for the integration and in these scenarios med device regulations can be overlooked? Curious to know what others experiences are in this space?

Thanks in advance! (P.S first time posting, so I can't paste a link to IHE, but if you google Integrating the Healthcare Enterprise, they should be one of the first few links)

 

[Ronen E]

There's a conceptual difference between a situation where the end user is implementing / responsible for the integration with their own system, and one where the medical device (SaMD in this case) manufacturer is supplying the integration "bridge" (sorry, I'm not a SW specialist; regardless, this still holds in the general sense).

In your case indeed it sounds like the integration component is either an integral part of the medical device (can the device achieve its intended use without it?), or an Accessory in the regulatory sense. Either way, it seems essential to analyse the applicable regulatory requirements carefully, and address the relevant ones. As long as you (the device's manufacturer) are providing the integration element, it would be unwise of you to ignore the medical devices regulations - IMO.

 

[klappa17]

There's a conceptual difference between a situation where the end user is implementing / responsible for the integration with their own system, and one where the medical device (SaMD in this case) manufacturer is supplying the integration "bridge" (sorry, I'm not a SW specialist; regardless, this still holds in the general sense).

In your case indeed it sounds like the integration component is either an integral part of the medical device (can the device achieve its intended use without it?), or an Accessory in the regulatory sense. Either way, it seems essential to analyse the applicable regulatory requirements carefully, and address the relevant ones. As long as you (the device's manufacturer) are providing the integration element, it would be unwise of you to ignore the medical devices regulations - IMO.

Thanks for replying! Yeah conceptually that's what I was leaning towards as well. We are taking the responsibility to develop an integration that enables the product to perform it's intended use. Therefore it would fall under the med device regs.

 

[Junn1992]

Hm..I wonder if expanding the scope of the "intended use environment" would help with regulatory side. Since under MDR we need to define minimum operating requirements eg: Windows 10, 64 bit with at least 4GB RAM and 256 GB Hard Drive. But if it can be expanded to for example: Compatible with DICOM/Python based systems etc. Wonder if it will help? Also probably a risk assessment will have to be conducted to take into account various end use environments. This will also impact your cybersecurity risk assessment etc.