ORCHA Guest Blog: Is Medical Device Regulation Providing the Assurance You Think for Digital Health?

Medical Device regulation is one of those terms that makes you metaphorically sit up to attention. Being compliant under these regulations is - rightly - seen as a big deal and a crucial plank in the system of protections that are in place in this critical area.

Being UK CA marked and EU CE marked consequently carries a lot of weight and conveys a degree of assurance that is relied upon by health and care organisations, professionals and even patients and carers.

Scratch below the surface however and this ‘gold standard’ protection might not be all it appears. This is certainly the case in the area of digital health - or in the Medical Device lingo - Software as a Medical Device or SaMD for short. It is also an area where there is increasingly a marked difference between the position in the EU and the position in England, Scotland and Wales post Brexit (NI being a little more complex).

This is because one of the key decisions post Brexit in the UK, in this space, was to not adopt the ‘new-ish’ Medical Device Regulation (MDR) which was due to come into force across the EU in 2017, but instead to retain - as the underpinning regulation - the UK MDR 2002, based on the Medical Devices Directive (MDD). The MDD is a venerable code, having come into force back in 1993.

The principle impact of the MDR v the MDD was in the case of the former to ‘up-level’ most digital solutions (SaMD) from Class i to Class ii and above status. This is a major change as the difference between the level of assurance associated with Class i v Class ii is like night and day. Class i status is achieved through a self certification process that has no ostensible oversight or validation. Class ii status and above, on the other hand involves a much more significant - and consequently costly - evaluation by special organisations known as Notified Bodies or in the UK Approved Bodies (although in practice they are often the same).

Because of the post Brexit decision to not move to the MDR, many of digital health solutions in the UK (outside of NI), are still viewed as class i and therefore not subject to the significantly more rigorous assessment process that they face in the EU. This is however not necessarily clear to the ‘man/women on the street’ or even those in the industry. Whether a product is Class i or Class ii is also not immediately obvious, with both types simply displaying a UKCA mark. This universal signifier of ‘conformity’ to the regulation, therefore masks a large gulf in the actual underpinning levels of assurance provided.

To be fair this is a throw back to a time before software based devices became so prevalent. The MDD pre-dates the digital health revolution and even the ‘new kid’ MDR, was drafted back in 2017 and therefore was not really designed with the advances in technology and data driven solutions that are now offering such transformational changes to health and care delivery.

Whilst the levels of theoretical protection afforded by the MDR roll out in the SaMD world are much more significant than those currently provided under the UK CA marking regime, it does not come without its challenges and impacts. One such challenge has been the ability for the Notified Body market to cope with the sudden demand for Class ii certification. This has already lead to a number of waivers and extensions to the original timeframes and many products in the EU are still trading on the basis of a pre-existing Class i self certification. Alongside the capacity constraints, the upleveling of SaMD has also imposed substantial additional costs for providers of these services. In a market that is still somewhat nascent and where consistent renumeration approaches are hard to find, this poses a major challenge to an already stretched eco-system.

Other issues pose further challenges to the veracity of this centre piece of medical regulation in the EU. Studies have shown a wide range of interpretations being applied to the MDR’s requirements in the area of SaMD by Notified Bodies. This is in fact a concept enshrined in the regulatory approach, with the MDR in effect ceding a broad range of interpretive freedom to Notified Bodies based on the significant demands that the regulation places on those organisations as part of their Notified Body application process. Whilst this does enable a decentralised model of assurance - in contrast to say the approach taken by the FDA in the US - it means that there is significant potential variation between the assurance provided by one Notified Body v another. This variation does seem an odd thing to accept in what most would imagine should be a singular and consistent assurance benchmark.

In recent consultations, MHRA have signalled an intent to update the ‘classification’ system that currently places so many SaMD products in Class i. The proposal is to align to the IRDF classification system that is widely adopted internationally. Whilst not an exact alignment to the MDR, this would certainly move the two regimes closer and would have a similar ‘uplevelling’ effect on SaMD in the UK.

So is the regulatory ‘indigestion’ and cost - certainly based on the EU experience - worth it for the additional assurance it may provide? This of course depends on the relative risk and this is still very difficult to assess. The MDR was in some respects crafted in response to a health care scandal that caused huge harm and undermined and exposed the weaknesses in the protections that were meant to prevent it. Whether the next breast implant or Thalidomide scandal will emerge in the SaMD space remains to be seen. What is however certainly a concern is the potential over reliance that organisations and individuals are placing on UK CA marking as a form of assurance and as an aid to decisions to engage with these solutions, given the virtually none existent protections that exist around Class i.

The opportunity that Brexit presented, was to provide a transformative approach to regulation and to build on some of our undoubted world class capabilities that were so in evidene during the vaccine approval process in the pandemic. There are other methods of assurance that are now widely accepted and utilised in the UK by the NHS and others. These processes offer substantially greater levels of protection than the current Class i approach and at a fraction of the time and cost of a Class ii process. The UK is the home to globally recognised leaders in digital health assurance and through powerful partnership with many parts of the NHS, has lead and continues to lead the way in delivering transformative approaches that use digital techniques to manage and monitor digital devices.

The window of opportunity remains, SaMD under the current UK CA regime is perhaps best viewed as a sheep dressed in wolves clothing. The huge drive to further embrace digital in the NHS needs a 21st century regulatory approach if this is to be implemented safely and effectively but at pace. The current model will at best slow this down and at worst create a ticking bomb that could explode at any time in the form of a major med tech issue that undermines the amazing opportunity that these solutions generally offer. It is time therefore to unlock the huge potential not just in technology, but in technology supported assurance that exists in the UK and as a result to maintain and expand our reputation for regulatory innovation globally.

Health and Social Care Programme activities

techUK is helping its members navigate the complex space of digital health in the UK to ensure our NHS and social care sector is prepared for the challenges of the future. We help validate new ideas and build impactful strategies, ultimately ensuring that members are market-ready. Visit the programme page here.