On Tech Ethics Podcast – AI and Software in Research: When FDA Rules Apply

To easily navigate through our podcast, simply click on the ☰ icon on the player. This will take you straight to the chapter timestamps, allowing you to jump to specific segments and enjoy the parts you’re most interested in.

1. Episode Introduction (00:00:03) Daniel opens the episode with a disclaimer, introduces Lauren Hartsmith, and frames the conversation around regulatory considerations for research involving medical devices, AI, and software as a medical device.
2. Lauren Hartsmith’s Background in Research Compliance (00:00:56) Lauren discusses her experience in human subjects protection, law school, work with OHRP during the revised Common Rule process, her role at Advarra, and her consulting work with HRP Consulting Group.
3. When Software and AI Count as Medical Devices (00:04:52) The conversation turns to how medical devices are defined under the Food, Drug and Cosmetic Act, why software and algorithms complicate that definition, and how the 21st Century Cures Act created specific carve-outs.
4. Software as a Medical Device and the 21st Century Cures Act (00:09:08) Lauren explains how software functions can be considered medical devices, outlines the four major carve-outs, and highlights why general wellness devices and clinical decision support tools can be difficult to classify.
5. Applying FDA Versus Common Rule Regulations (00:14:08) Daniel asks how researchers and IRBs should think about when FDA regulations may apply instead of, or in addition to, the Common Rule, especially for evolving software, digital tools, AI, and machine learning systems.
6. Human Data, Algorithm Development, and Early Regulatory Questions (00:14:46) Lauren explains why AI and machine learning research may involve human subjects earlier in the development process than traditional device research because of the volume of human data needed to train algorithms.
7. Human Subjects Protections and Regulatory Exemptions (00:19:46) The discussion compares FDA human subjects protection regulations with the Common Rule, including differences in human subject definitions, available exemptions, HIPAA-related carve-outs, and early-stage software development oversight.
8. Mid-Episode Message About CITI Program’s On Research Podcast (00:26:22) Alexa McClellan briefly promotes CITI Program’s On Research podcast and invites listeners to subscribe before the episode resumes.
9. IDE Requirements and Significant Risk Versus Non-Significant Risk Devices (00:26:41) Daniel asks Lauren to walk through investigational device exemption requirements, significant risk and non-significant risk determinations, and how those considerations apply to software and AI-enabled devices.
10. How to Determine Whether 812 Applies (00:29:10) Lauren explains the investigational device exemption framework, including whether a product is a medical device, whether it is carved out, whether the study involves an investigational device, and whether human subjects are involved.
11. Documenting Device Study Determinations (00:34:22) Lauren describes the importance of working through each step of the device study assessment, documenting whether exemptions apply, and avoiding unnecessary significant risk or non-significant risk determinations when 812 does not require them.
12. Significant Risk Determinations in Context (00:38:24) Lauren explains that significant risk determinations depend on how the device is used in a specific study, why sponsor and IRB assessments matter, and how FDA approval and IRB approval interact for significant risk device studies.
13. Minimal Risk Versus Significant Risk Device Studies (00:42:40) Lauren clarifies that a study can be minimal risk while still involving a significant risk device, using in vitro diagnostics and pregnancy tests as examples of why device risk classifications require a separate analysis.
14. Key Oversight Questions for IRBs and Researchers (00:46:49) Daniel asks what IRB members, researchers, and oversight professionals should ask to ensure appropriate oversight and participant protection in device studies.
15. Identifying What Is Actually Investigational (00:47:23) Lauren emphasizes the importance of distinguishing between a medical device used in a study and the actual object of the investigation, using surgical studies and off-label device use as examples.
16. Companion Diagnostics and Interstate Commerce Considerations (00:52:50) Lauren discusses companion diagnostics, when 812 may not be required, and why sponsors and IRBs should still consider whether investigational products are entering interstate commerce lawfully.
17. Recommended Resources for Device Study Oversight (00:57:58) Daniel asks where listeners can learn more, and Lauren recommends FDA guidance documents on software as a medical device and HRP Consulting Group’s practical checklist for device study regulatory workflows.
18. Episode Closing and Tech Ethics Training Promotion (00:59:01) Daniel thanks Lauren, encourages listeners to explore CITI Program’s podcasts, courses, and webinars, highlights the Tech Ethics Training Solution, and thanks the production team.

Daniel Smith: Welcome to On Tech Ethics with CITI Program. Today, I’m going to speak with Lauren Hartsmith, who is a consultant at the HRP Consulting Group and a human subjects protection professional with over 15 years of experience in research compliance, institutional review board oversight, and regulatory affairs. In our conversation, we are going to discuss regulatory considerations for research involving medical devices, particularly given the rise of AI and software as a medical device.

Before we get started, I want to quickly note that this podcast is for educational purposes only. It is not designed to provide legal advice or legal guidance. You should consult with your organization’s attorneys if you have questions or concerns about the relevant laws, regulations, and guidance that may be discussed in this podcast. In addition, the views expressed in this podcast are solely those of our guest. And on that note, welcome to the podcast, Lauren.

Lauren Hartsmith: Thank you so much. I’m so excited to be here.

Daniel Smith: It’s wonderful to have you. So I very briefly introduced you, but can you just tell us more about yourself and your work in research and regulatory compliance?

Lauren Hartsmith: Sure. So I appreciate your kind introduction. I think you summarized my career super well, but I’m happy to give a little bit more background about my work in this space and what I’ve been up to in the past several years. So right out of college, I kind of found my way into the field, which is a little bit unusual. So I’ve really focused my career on human subjects protections, and it’s been a delightful 15 to 20 years. So I actually got my start working at a pretty big nonprofit and I was the human subjects protection administrator basically for their human research protection program. And I was so interested in the work that obviously there’s a heavy regulatory component. And so I was exploring what other types of education I might want to get, and I decided, okay, I think law school would be a really good fit.

So I went to Wake Forest University School of Law, and I focused my education there on human subject protection. And they have a great bioethics program as well, and they have a great medical school. And so there was a lot of expertise and interesting coursework around bioethics and medical devices and a lot of really awesome opportunities there to work with thought leaders in the field and thought leaders around administrative law. So when I graduated law school, Office for Human Research Protections, actually they had several fellowship opportunities through the ORISE program, which is a really great postdoctoral fellowship organization that puts people in different federal institutions so that they can get experience in mentoring, and OHRP just happened to have some of these fellowships. And I had actually interned with OHRP during law school.

And so it was this amazing fit, and this was in 2014. So this was kind of in the very beginning stages of the revised common rule process. And it was one of those opportunities of a lifetime, right place, right time. I was graduating law school at the exact right time for this. And so of course I took it and I was at OHRP through the whole rulemaking process. And if you ever want stories about how the sausage gets made, boy, do I have a ton of them. It was just a really interesting time to be behind the scenes. So I was at OHRP until 2020, and then I took a job at Advarra as their director of regulatory affairs. And that was a really amazing experience to get to see at such a large scale how human research protection programs and IRBs are balancing the sometimes very different regulatory landscapes for research.

I understood that regulators were trying really hard to harmonize, and I had a really good academic understanding of where the differences were between the FDA regs and the HHS regs, but being able to list out like, “Oh, there’s differences in this definition and differences in this definition and differences here, and it leads to these other differences.” Being able to academically rattle those off, it’s very different than seeing the on-the-ground impacts that has on research. And at Advarra, you just were witnessing firsthand what all those differences meant on the ground.

And so that was a really amazing experience. And that was also when I really started digging deep into the device regulations and really trying to understand what are the differences, how do they play out, and why does this matter in the context of human subjects research? So I’m super grateful for all those experiences. So I was at Advarra for several years and then I decided to kind of branch out on my own. And I’ve been an independent consultant for the last several years and I work with HRP Consulting Group and I’m part of the BRANY family and super happy to be here.

Daniel Smith: So you mentioned your background and understanding of the medical device regulations, which is essentially what we’re here to talk about today. So to start at a really high level, can you just talk about when something counts as a medical device in research and why that determination is especially important for technologies like software and AI?

Lauren Hartsmith: Okay. So we’re talking about software and kind of electronic tools. We’re not talking about traditional medical devices like a pacemaker or a bandaid or a tongue depressor. So it may seem kind of counterintuitive that we’re not talking about a tangible product, we’re talking about algorithms and software tools. And again, remember that my background is legal. And just to echo, Daniel, what you said before, I am a lawyer. I’m not your lawyer, audience listening to this. So please, I’m trying to give a high level overview, but definitely check with your legal counsel because a lot of these things are kind of legal determinations that may or may not make logical sense because so much is just dictated by how Congress set up their legislation and then how administrative agencies are implementing these rules.

So in the context of a device, just thinking about legislative history. So basically you have the Food, Drug and Cosmetic Act, which was initially promulgated in the ’30s. And then over time, Congress has modified and amended the FD&C, and that is what FDA is governed by. And so the Food, Drug and Cosmetic Act, that’s where you find the definition of a medical device. And when that definition was initially created, it was around defining when these tangible things like a tongue depressor or an in vitro diagnostic test or something implantable like a pacemaker, the circumstances in which those types of tangible products would be considered a medical device under the Food, Drug and Cosmetic Act.

So I’ve listed some examples here of what a medical device is, but let me try to pull up the actual regulatory definition so that we’re all starting from the same place. According to the FDA, basically the definition of a medical device is an instrument apparatus, implement machine, contrivents, implant, in vitro, reagent, or other similar or related article, including a component part or accessory, which is recognized in the official national formulary or the United States Pharmacopia or any supplement to them. The other option is intended for use in the diagnosis of disease or other conditions or in the cure, mitigation, treatment, or prevention of a disease in man or other animals or intended to affect the structure or any function of the body of man or other animals and which does not achieve its primary intended purposes through chemical action within or on the body of man or other animals and which is not dependent upon being metabolized for the achievement of its primary intended purpose. The term device does not include software functions excluded pursuant to section 520O.

So that was a lot of words. And as you can see, there’s explicit discussion in the definition these days of software. But imagine before 2016, that last sentence about the term device does not include certain software functions. That sentence did not exist. So really the original definition of medical device in the Food, Drug and Cosmetic Act, it’s very focused on distinguishing medical devices from drugs because drugs have their own definition in the Food, Drug and Cosmetic Act. And so the definition very much so is about saying we really only want to apply the device regulations to things that are medical devices and not to things that could be drugs. But again, that’s not necessarily something that’s going to make intuitive sense because it’s being defined by legislation and regulation. It is largely kind of a legal distinction.

So again, the definition of device is really trying to say it’s these tangible things and it couldn’t be classified as a drug. So we’re not going to talk about combination products, i.e. products that have a drug component and a device component for the purposes of this conversation. And in 2016, some of you will remember that there was a really big kind of bipartisan piece of legislation that was passed in December of that year called the 21st Century Cures Act. And the 21st Century Cures Act, it was massive and it made a ton of updates to the HIPAA regulations and to the HIPAA statutes, and that’s medical privacy laws.

It made big changes to the Food, Drug and Cosmetic Act, and it made big changes to the Public Health Service Act. And those are kind of the three pieces of legislation that really matter for human subjects protection. And as part of the 21st Century Cures Act amendments, they made explicit that software could, in fact, because software would often be a component part of an instrument apparatus, implement machine contrivance, implant, in vitro reagent, or similar related article, that software or algorithms could be a component part of those things. And that software could, in fact, be defined as a medical device, but they carved out four very limited functions that by purposes of the 21st Century Cures Act would not be considered a medical device. So it accepted from the definition of a medical device, certain general wellness devices, certain software functions and mobile medical applications, certain off-the-shelf software that can be used in medical devices, but the original purpose of those devices had nothing to do with the medical device, and then certain clinical decision support tools.

So those were the four carve-outs. Probably the biggest one is for general wellness devices. And the idea there is that there are certain types of limited function devices like the Fitbit of 2016, not the Fitbit now that is doing all kinds of things. And the Apple Watch circa 2016, again, think about the way those devices functioned 10 years ago, not the way they’re functioning right now, but that there were certain functions and certain types of general wellness devices that Congress decided, “Okay, even though they could technically meet the definition of a medical device, because you could be using these devices in the treatment cure mitigation of a disease or condition, we’re going to say, no, these don’t meet the definition.”

Now, just to be clear, so there are components these days of the Apple Watch and of Fitbits that do cross into that threshold. And if you look through the FDA databases on various approved and cleared devices, you will see that there are certain components to the Apple Watch or to other general wellness devices like wearables that actually have gone through the formal FDA process for clearance. So just keep that in mind. But in general, you’ve got these four exceptions and it can get really confusing. So we have this very broad definition that I read out for you all a little bit ago that’s really trying to draw distinctions between what’s a drug and what’s a device. And then on top of that, we now have recognition that, yes, software in and of itself could be a device, but there are these four carve-outs from the definition of a medical device to be aware of.

So that’s just the general confusion that when we’re talking about software, knowing whether or not you’re a medical device, it’s not an intuitive discussion. It’s very much so you need to go back and read the specific laws around it and the guidance that has been issued because it’s not like the tests for when something is a medical device, when an algorithm is a medical device or when software is a medical device and when it is not. Yeah, it’s not super intuitive. You have to understand the legal framework behind the 21st Century’s Cure Act and why they decided to carve out these four exceptions and how FDA has implemented it over the past 10 years.

So it has gotten super confusing. But at its core, the first question when you’re trying to figure out, okay, is this a medical device? Do we need to worry potentially about certain pre-market regulations for research involving software that could be considered a medical device? The first question is, does it meet the definition of a medical device? And as part of that, you have to look at the exclusions from the definition of medical device in section 520, and that’s kind of your first step. So I hope that made sense, but if I need to clarify anything, let me know.

Daniel Smith: No, absolutely. That’s very helpful. And what I’ve gathered is that obviously there’s a lot of nuance there. So at a high level, what kind of guidance would you give to folks when they’re thinking about when the regulations may apply versus when perhaps just the common rule or the Department of Health and Human Services, human subjects research regulations might apply, particularly in studies involving software, digital tools where the software may evolve and change the function over time and things like that as you were just alluding to?

Lauren Hartsmith: Oh yeah, that’s a great question. So I think one of the other reasons that dealing with software as a medical device and whether software or an algorithm crosses into what I like to call affectionately devicelandia can be so complicated is that when you’re talking about a traditional medical device, so again, think of your pacemaker, your tongue depressor, your bandaid. When you’re developing those tools or when you’re developing those products, the initial development of the product likely does not involve any human subjects. You’re building the tool, it’s an engineering function, you’re working with a lot of models and theoretical concepts. You’re not necessarily testing it on people. But when you’re talking about an algorithm or when you’re talking about these machine learning tools or AI tools, one of the things that we know and that we talk a lot about is just how much data is needed to train these algorithms in order to get the outputs that you want.

So for the purposes of this question, Daniel, I’m going to assume that you’ve done the analysis of, okay, we have this algorithm, we’ve determined it meets the definition of a medical device. The algorithm is designed to help treat, mitigate, or cure a disease or illness. It’s not something that could be considered a drug, and it’s not something that fits into one of the 21st Century Cures carve-outs for software as a medical device. So we’re positive that this algorithm in question, it’s a new algorithm, it hasn’t been approved or cleared by the FDA before, and there’s some investigational component to the research activity. Great, okay. But in traditional devices, and I would say in drugs too, a lot of that initial development is not done in people. If you don’t have any human subjects, then you don’t have to apply the FDA regulations until human subjects are involved.

Well, that gets a lot more complicated when we’re talking about AI and machine learning, because in order to train the model to even see if your model and if your idea for an algorithm works, you have to involve so much data and information about and from people, and that means that in the development stage, you actually might be including human subjects under the regulatory definitions. And so that in and of itself makes the conversation very different. That’s the first thing I think just at its core to understand.

And again, I don’t want to throw out regulatory citations without explaining them. So if I say 312, I’m referring to 21 CFR Part 312, which is the investigational drug regulations. And if I say 812, I’m referring to 21 CFR 812, which is the investigational device exemption regulations. So first off, figuring out if your algorithm in and of itself counts as a medical device can be tricky because you’ve got these carve-outs from 2016 that you have to contend with, and you have a definition that was really written to help people figure out whether these traditional physical tangible devices counted as a medical device or as a personal wellness product. So you first have that kind of weird distinction.

And then once you get through that, you have the issue of, well, in traditional device and drug development, you’re not necessarily involving human subjects until later on in the process. In the kind of exploratory investigational phase, you may not really have any human subjects as they’re defined in the regulations. But again, when we’re talking AI and machine learning, because of the volume of human data that’s involved to train these algorithms, well then all of a sudden at this kind of what we would sometimes think of as exploratory pre-investigational phases, you actually might cross that human subject and research definition threshold, and you might need to apply investigational device regulations and the FDA human subject protection regulation significantly earlier in the process than you originally thought, or that you might have applied those regulations when you were working on a research activity with a traditional medical device.

So that’s one of the first tricky things that I have seen in my work, and that has caused some challenges for IRBs and for researchers. Just the very fundamental question of at what point in the product development life cycle, when we’re talking software, should we be saying, “Okay, this is a medical device at this point and we need to apply 812 and 21 CFRs 50 and 56,” which are the FDA corollaries to the common rule, so the human subjects protection regulations. And that can be really tricky.

And then I’ll go another step further, just again, in terms of explaining what makes this so particularly complicated, is that when you look at the FDA Human Subjects Protection Regulations versus the common rule, one of the biggest differences in these two sets of regulations is in their definitions of human subject, and then further in what exemptions that are permitted. So when you look at the common rule, there’s eight broad categories of exemption, and some of those categories have sub-exemptions. But one of the goals of the revised common rule was to articulate the fact that in this day and age, some of the privacy and confidentiality concerns, we have a good handle on how to protect people from those concerns. I’m not saying whether I agree with that supposition or not, I’m just saying that was the argument put forward in the revised common rule.

And that the other idea is that there’s other privacy-related regulations that govern a lot of this data and that those regulatory schemas do a better job than the IRB system in and of itself of regulating research where the primary concerns are related to privacy and confidentiality. And so to that end, in the revised common rule, you have this really big carve-out, it’s exemption category for III, for if you want to do health research that’s involving healthcare data and that healthcare data is governed by HIPAA, again, the privacy protections for certain types of medical records, then you only need to follow the HIPAA regulations. Now, of course, if there’s privacy protections embedded in HIPAA, but the idea is, okay, the HIPAA schema is sufficient to protect the information and the privacy interests that people have there. The IRB doesn’t necessarily need to be involved. Okay, great.

But that’s just under the common rule. This is relevant because a lot of the research development that the researcher might be undertaking, often it’s not funded at all. And so IRBs will say, “Great, by default we apply the common rule. Okay, you want to explore something using a ton of medical record data that’s exempt under exemption for III, fine.” This gets complicated though, because if it’s actually ultimately considered a medical device, then arguably in those early stages, the FDA regulations should have been applied and not the common rule. And as I mentioned in the beginning of this example, the FDA regulations, they only have one exemption and it’s super narrow. It’s the food and taste evaluation exemption. So it’s an exemption that is harmonized with the common rule, but they only have one. So this big HIPAA carve-out that exists in the common rule doesn’t exist on the FDA side of the house.

So that’s another thing that’s really tricky. And again, historically, this sort of data work wasn’t considered FDA regulated. It often wasn’t funding. And so by default, institutions were applying the common rule. And that has been kind of a best practice in our field since the common rule was promulgated in ’91. But now these sorts of default determinations can get tricky because what if you have someone who, in the very beginning of a research activity, is saying, “I am trying to build this algorithm. I have no idea if it’s going to work, but if it does, it likely would be considered a medical device,” which means that the FDA regulations would apply. But at the time that they’re describing the activity to the IRB or that they’re making their application, the IRB is saying, “Okay, based on what you’re describing to me today, no regulation applies by law. We’re going to apply the common rule by default. This is exempted from IRB oversight under the common rule. Go forth and do your work and then come back to us later if you need to go to the next stage of your product development.”

But even if we determine that 812 doesn’t necessarily apply, at what point are we going to say, “But by default for these types of studies, we’re going to apply the FDA Human Subjects Protection Regulations instead of the common rule just in case because we want to make sure that later, if it does cross into the software as a medical device definition,” which you can’t always assess when someone’s very early on in the product development stage. But FDA, legitimately, that’s something that they look at when you’re submitting your materials at the end of the lifecycle for clearance or approval. They’re checking to make sure that you have followed the appropriate and the required regulatory schemas throughout the development life cycle.

And so it really can matter in those beginning phases whether you’re applying the FDA regulations. And again, there are major differences, like I just described, where one activity might be just totally exempt under the common rule, but would require IRB oversight under the FDA Human Subjects Protection Regulations, just because of differences in the exemptions that apply. So to summarize that point, what I’m trying to perhaps in a long-winded way get at is that there’s a lot of ways that the human subjects protection field has evolved, where we recognize that there’s lots of studies in the very early development stages and they’re not federally funded. It may not be obvious whether any regulatory schema must be applied. And so institutions have developed lots of policies and processes around how to deal with those. And typically the answer is, okay, when no regulation is required by law, then we just apply the common rule.

That gets really tricky when you suspect that, okay, should this algorithm that they’re trying to develop actually come to fruition, this would be considered software as a medical device. So even if we don’t think it’s software as a medical device right now, should we by default be applying the common rule or should we be more conservative and apply the FDA regulations? Which again, they don’t really have the same number of exemptions. So it would require IRB oversight and continuing review and all of that entails. How should we handle that? And I think that’s a really big trouble thought that institutions are trying to deal with right now.

Alexa McClellan: I hope you’re enjoying this episode of On Tech Ethics. If you’re interested in hearing conversations about the research industry, join me, Alexa McClellan, for CITI’s other podcast called On Research with CITI Program. You can subscribe wherever you listen to podcasts. Now back to the episode.

Daniel Smith: I want to hone in a bit more on the FDA regulations. And you mentioned that the 812 regulations are for investigational device exemptions. So can you walk us through the IDE requirements and the considerations for significant risk versus non-significant risk and how those play out in practice for software and AI-enabled devices?

Lauren Hartsmith: Okay. So one thing that I’ve also learned over time is that the device regulations are the most complicated in the human subjects protection landscape. And thing number two that I’ve learned, in the grand schema of the research universe, there’s a lot more drug research and a lot more HHS-funded research involving human subjects that institutions have oversight over. So what this means is that the average human research protection professional has a very good grasp on the common rule, a good or very good grasp on the drug regulations depending on the portfolio of the institution, but it is very uncommon for an institution to have a substantial device presence in their portfolio. So if you look at clinicaltrials.gov, about 10% of the studies that are registered on ct.gov are device studies. So this means that if you add up all the device research in the US and abroad, there’s a lot of activities going on that it’s not concentrated in any one place.

So most IRBs, a very small percentage of their portfolio is this device research. And so very understandably, it’s not your typical institution’s bread and butter. So there’s a lot more questions and trepidation around the device regulations. So what I want to say before I get started here is it’s going to sound complicated, but y’all got this and we’re going to walk through it together and you’re going to be okay. There’s lots of guidance out there, and together we can get to the place where everyone feels comfortable with how the regulations work. We don’t have to fear the device regs, even though it may not be something that you’ve had to work with a lot in your careers. And I hope my explanation kind of shows that, again, the average person probably just hasn’t seen that many device studies. Just again, because while across the US there’s a lot of device research, it’s still one-tenth of the research that’s going on.

Okay. So when we’re talking about whether or not 812 applies, so again, 812 is called the Investigational Device Exemption Regulations. And so to take it back a little bit, because right again, lawyer by training. So FDA’s constitutional authority is through the Commerce Clause. So FDA exerts its authority through saying, “Okay, these drugs, devices, other products, they’re entering interstate commerce. And so we are regulating the extent to which those articles can be used in interstate commerce.” So the mail, the roads. And so why is this important? So what they’re basically saying, and this is also kind of the premise of the drug regulations too, is that, hey, if something is an FDA cleared or FDA approved device, that can enter the stream of commerce consistent with whatever restrictions FDA has put on it, but that can enter the stream of commerce, no problem. Once you’ve gotten approval and you’re following other FDA regulations on labeling and shipping and all that stuff, you’re good to go.

If a medical device or a drug is investigational, there are additional rules that are going to apply in order for you to be allowed to have the investigational product enter the stream of commerce. So that’s the general idea behind both the investigational drug and the investigational device regulations. And so the next thing in the investigational device regulatory schema is that FDA takes it a step further and says, “Okay, because there is so much variety in devices,” right? Again, I keep referencing you’ve got bandaids and tongue depressors on one end and you’ve got pacemakers on the other end and software fits in somewhere, that you have a huge variety of different types of products and how often or how long they’ve been in the stream of commerce. There’s just so much variety in the device world that they further have tried to stratify the regulations to basically say, “Okay, if something is a medical device, 812 might apply.”

So the first thing that you have to do when you’re going through your 812 flow chart is step one, does 812 apply? Okay. And that means, is it a medical device? So step one, is it a medical device? Step two, if it meets the definition of medical device, is there some other rule or FDA guidance document or FDA enforcement discretion document that says, “Yes, this meets the definition of medical device, we’re carving it out and you don’t have to consider it a medical device.” So again, those 520 (o) examples that I gave you, the 21st Century Cure examples of those four areas that are carved out, right? Okay, so step one, is it a medical device? If yes, step two, is it somehow carved out? Then the next question that you have is, is it an investigational device that’s being used? Is it an investigation that involves human subjects?

And those are definitions specifically in 812. And so you need to meet the definition of investigational device, of an investigation and the definition of subjects. So FDA, in terms of the risk stratification, they’re trying to say like, “Okay, if you’re doing research involving an FDA cleared device or an FDA approved device,” so again, something that the FDA has looked at and said, “Yes, this may enter the stream of commerce as long as you follow X, Y, Z rules or restrictions on it.” FDA will say, “Okay, there might be some sort of regulation that applies, but you don’t need to apply these investigational device regulations because it’s not investigational.” However, if either the device has never been reviewed and approved/cleared by FDA, or you’re using an approved device, but in a way that’s inconsistent with the FDA restrictions or parameters around that use. So the most common thing is that FDA will approve a device and say, “Okay, it can only be used in this population.”

But let’s say the device was approved in subjects 18 and over and you say, “Hey, I think this device might really work well in ages 12 to 18 and I want to look at it.” Is it a device that’s already available in the stream of commerce? Yes. Was it approved for ages 12 to 18? No. Therefore, it’s still an investigational device because you’re not using it in the specific confines that FDA has set for that approval. Okay. So you got to ask yourself, is it an investigational device? Is what you’re doing an investigation? And 812 has a definition for investigation, and are human subjects involved? And if the answer is yes, there’s still more things that we have to figure out. But then you’re like, “Okay, 812 really might apply here.” So we often talk about exemptions in the context of the common rule, but there’s also exemptions from 812, just like there’s exemptions from 312.

So the next thing that you have to ask yourself is, “Okay, so we’ve determined we have something that needs the Food, Drug and Cosmetic Act of a medical device. It is not somehow excluded by the 21st Century Cures Act or some other FDA guidance. And we know that the research activity in question involves an investigational device, meets the definition of investigation in 812, and it meets the definition of subjects in 812. Great.” And we could do a whole podcast on when is something an investigation and when is a person a subject under 812? So I don’t want to minimize that those can be complicated assessments, but I’m trying to get to the, is it a significant risk device part? So I’m speeding through this a little bit. So then you’ve got to look at, “Okay, do one of the exemptions apply?” The exemptions are spelled out in 812.2C, and there’s three different exemption categories from 812.

These aren’t exemptions from the informed consent regulations. These are exemptions from the investigational device regulations. If they are 812 exempt, what that means is most of the requirements of 812 won’t apply to the activity, but you still need to submit for IRB review and the IRB still needs to review the study under 5056, which again, those are the FDA human subject protection regulations governing IRBs and informed consent. So if you’ve gone through all of these checks and you’ve determined it’s an investigational device, it’s an investigation, human subjects are involved, it’s a medical device. And then you get to the question of, is it exempt from the IDE regulations? And you say, “Okay, it meets one of the three 812 exemptions.” Great. 5056 apply. There are some abbreviated requirements within 812 that you need to follow, but those are sponsor obligations and that’s a pretty straightforward assessment.

Okay. But let’s assume for the purposes of this conversation that, okay, you’ve gone through all those steps, you’ve looked at your 812 exemption categories, and no, it is not 812 exempt. That’s where you get into, is the device as used in that specific clinical investigation a significant risk device or a non-significant risk device? So for those keeping track of the permutations of our tree, you don’t get to, is it a significant risk device or non-significant risk device until step four, step five of our process. It’s very much later on. There’s a lot of activities involving medical devices that don’t even make it to the, is it a significant risk device or a non-significant risk device question. And I strongly recommend that for every device study, you go through each of the steps that I’m talking about and that you really make significant risk device determinations or non-significant risk device determinations only for the activities that require it.

Because the minute you start saying like, “Oh, we made a device determination for something that’s 812 exempt,” or, “We made a device determination, even though we don’t think that the device in question is a medical device,” it becomes a compliance issue because by the way the FDA regulations work, when you make a device determination, you’re saying that 812 applies. So if an IRB makes the device determination, but then also says, “But the study’s exempt from 812,” or, “This isn’t an investigation as defined under 812,” it gets very confusing to a regulator or to an auditor. Questions come up about like, “Well, wait, you made a device determination, which you weren’t supposed to do unless the study required it, but then you’re saying the study doesn’t require it, so which is it?” It creates a lot of confusion. So I’m a big advocate for every device study going through all of these steps and making sure that you document your findings for each step.

So you would document, yep, it’s a medical device. Or yes or no, it’s carved out from the definition. Yes, this study, it’s an investigational device. Yes, it meets the definition of an investigation. Yes, it involves human subjects. Yes or no, it’s exempt from 812. Document all of these things as you’re kind of assessing the regulatory schema that a study is required to follow. Okay, but now we’re at the significant risk or non-significant risk device. So this is another kind of confusing area of the FDA regulations because basically there’s a definition in 812 and it’s at 812. 3M, and those lay out the four different criteria that would make a study a significant risk device study.

So another important thing to note here is you’re making a device determination for how that device is used in the study, and that really truly can be dependent on study design. So you can have the same medical device that in one study is a non-significant risk device, and that same medical device in another study is a significant risk device. So I know IRBs are often very worried about consistency, but this is an area where it is context specific. So just because you made a significant risk determination in one study using the same medical device does not mean that you’re going to make the same definition in another study. So that’s just something else to keep in mind. So the way the regs are written essentially is that the sponsor is supposed to say to the IRB, “Hey, we’ve looked at the regulations and this is our assessment of whether or not the device is a significant risk study.” And you look at the 812.3M criteria, and there’s four ways that a device as used in the study could be a significant risk device study.

And I am not going to read them out because that would take too much time, but just know there’s four different criteria and it’s not an and, it’s an or. So if a study meets one of those four prongs in 812. 3M, it’s a significant risk device study. So basically the sponsor or the investigator is supposed to make the first recommendation, then the IRB is supposed to review it and determine if they concur or they don’t concur with that determination. And if the study is determined to be a significant risk device study, then that means that the sponsor needs to submit an IDE application to FDA and wait for FDA to approve the activity and the research before it may begin.

So basically, if you go through your checklist and you get down to the point where you’re like, “Okay, this is a medical device, this is an investigational study, and we’ve determined that it is a significant risk device study,” and this is going to be a minority of research activities that involve medical devices, then the sponsor needs to go do a bunch of applications with FDA and wait until they get kind of approval to continue and they have to wait for IRB approval. And only when they receive both of those approvals can they go forward with the study.

If the study is a non-significant risk device study and the IRB and the sponsor are in agreement about that determination, then the sponsor only needs IRB approval before they can move forward. So there’s a lot of guidance on when something’s a significant risk device and when something’s a non-significant risk device. But it is a critical point. If you have made all the other relevant determinations in a device activity and you get to the point where you say, “Okay, 812 definitely applies,” but we’re deciding does the sponsor need to get pre-approval to continue from FDA or not? That’s really the focus of the significant risk device determination. Another thing that trips IRBs up is that the device determination, it’s different criteria than whether or not the study is minimal risk.

So you very much so could have a study that’s considered minimal risk that is also a significant risk device study. So let me give you an example. So you have an in vitro diagnostic, you’re positive it’s a medical device, you know that it’s not excluded from the definition of medical device. You’ve run through your definitions and you know that the research activity, the way it’s designed, you’re meeting the investigational device investigation and subject definitions, and you know that it is not exempt. So it’s a test in vitro diagnostic, but you are essentially getting results confirmed by an already FDA approved or cleared in vitro diagnostic device. So let’s say that’s not happening. This is an in vitro diagnostic that has never been developed before. So you’re positive it’s not under one of the exemptions. And then we get to the significant risk device criteria. It’s entirely possible that based on the study design, let’s say this is a diagnostic test that’s non-invasive, no distress on the subject who might be going through the test.

So it very reasonably could meet the definition of minimal risk, but let’s say that the device as used in research is of substantial importance in diagnosing, curing, mitigating, or treating disease, and it presents a potential for serious risk to the health, safety, or welfare of a subject. So one of the examples that FDA has used in its significant risk, non-significant risk device FAQ about medical devices is urine pregnancy tests as something that would more often than not be considered depending on study design. If it’s not somehow accepted from the 812 requirements and you get down to the point in your workflow where you have to make a significant risk device determination because a pregnancy test is of substantial importance in diagnosing, curing, mitigating, or treating disease, and it could present potential for serious risk to the health, safety or welfare of a subject. Even though it’s non-invasive, even though you very reasonably could say, “Well, the study in and of itself is minimal risk,” FDA has indicated this is an example of an in vitro diagnostic study that would likely be a significant risk device study just because of the nature of the tool.

And because again, if it’s not something that meets one of the 812 exemption categories, then that means the way the device is being used in the study, it is truly of importance in diagnosing, curing, mitigating, or treating a condition. And so in that case, it would very reasonably be a significant risk device. So in IRB protocols, I will often see device companies or sponsors talk all about minimal risk and how they have all of these great risk management, risk mitigation strategies in their research activity. And that’s great. Those are all really important discussion points for whether or not the study is approvable under the IRB approval criteria in 21 CFR 56.111. All of that is really important in terms of making sure risks to subjects are minimized, but that actually doesn’t have an impact on whether or not the device as used in the study is a significant risk device study or not.

And I hope that makes sense. So the devil’s in the details, we could have done a full hour on any one of these steps in the process, but I did want to make sure, as Daniel was asking, getting down to like, okay, so when in this process do you actually have to make the device determination? It’s at the very end, and you should only be doing device determinations in a minimal number of device studies. And even within that, I would say more often than not, you’re going to have non-significant risk device studies. And again, that’s just because of what manufacturers are putting out these days.

Daniel Smith: That’s a lot of really helpful information. And I think you broke that down in an extremely helpful way. Just to synthesize it down into maybe some guidance for IRB members, researchers, and others involved in oversight, what questions should they be asking to ensure there’s appropriate oversight and participant protection in device studies?

Lauren Hartsmith: So asking the investigators or asking-

Daniel Smith: Yeah, to draw out some of this nuance, what are the key questions they should be thinking about or asking?

Lauren Hartsmith: So I think even though we didn’t spend much time talking about it, I think really understanding if the device as used in the study is investigational is a critical aspect of this. So I guess I’ll give you an example of where that gets tricky. Surgery is, unfortunately, it’s an area of research that is often kind of the wild, wild west. So if a surgical study is not funded by HHS, it’s often not subject to the FDA regulations. Because in a surgical study, if you’re actually studying the technique and not the devices that are being used as part of the surgical process, then it’s outside the scope of the FDA regulations. And this is because FDA does not have authority over the practice of medicine, but it does have authority over interstate commerce. That’s why doctors can prescribe or use medication and devices off-label. But if it’s in the context of a research activity or a clinical investigation, that’s no longer considered the practice of medicine, and so that’s why FDA can impose these additional rules on those sorts of activities.

So a doctor on a one-off can say, “Even though this scalpel, let’s say, was not necessarily approved for this surgical technique, I can still in practice of medicine do the surgery with this scalpel.” So that’s kind of one distinction or why surgery can be so complicated. So let’s take ophthalmology surgical activities. There’s a lot of different lasers that get used for different eye-related surgeries that may or may not be FDA cleared for that purpose. Often they are, but maybe not. But let’s say that is the standard of care for that surgery. And this happens in lots of different fields where the standard of care or the most appropriate and accepted treatment for a condition, it might involve the off-label use of a drug or device. So let’s take, again, eye surgery protocol and the object of the investigation is not the lasers being used, it’s the actual surgery techniques.

And maybe they’re saying, “We’ve seen great promise in this one kind of innovative surgical technique, and that’s what we’re trying to assess in the course of this research activity.” So there’s a temptation in that type of study. And again, devil’s in the details. So I’m trying to give you the best example that I can, but for a full assessment, you need to look at all of the details in the context of a study. But we’re assuming that we’ve done all of that and I’m giving you the outline of what the study entails. So in this example that I’m trying to describe here, the devices themselves, they’re not being used in an investigational way. And the object of the investigation and what is being investigated is actually the surgical techniques in and of themselves. Those aren’t FDA regulated. And if they aren’t collecting any safety or efficacy data about the medical devices in question, then 812 is not required to apply.

So really we didn’t spend a lot of time on it, but being able to identify what are the investigational devices in the study? Is it an investigation? Are subjects involved? Those sound like easy determinations, but they often aren’t. So I think really making sure when you’re reviewing these studies from the get-go, that as the reviewer, you’re clear on what’s actually investigational in the study. I think a lot of people get so used to doing your jobs and you’re looking at these things quickly and maybe you’re not doing that detailed analysis anymore of like, okay, what’s actually at issue here? Is it the medical device or is it the surgical technique? And then further digging into when someone gives you a lot of information about a medical device, and I’ve seen this more often than not in surgical studies, people might give you all kinds of details in their protocol about the devices that are being used in the surgery. And that can be very useful context, but I think this is another important point.

I think just remembering that the sponsors, they have a lot of expertise in what data they need to gather in order to submit information to FDA for clearance or approval. But that doesn’t mean that they have a detailed, nuanced understanding of whether a device is required to follow 812 or not. And so just because a sponsor gives you a lot of information about the devices in a protocol doesn’t mean that you don’t have to do your own assessment of which devices or what items in a study are investigational, whether human subjects are actually involved. Because the sponsors have expertise in one area and IRBs and HRPPs have expertise in other regulations and in other areas. So I think that’s another really important thing to keep in mind. And I think one of the final things to keep in mind, and again, it kind of relates to is it an investigational device?

Is it an investigation that involves subjects? To the third step of my worksheet. So there are circumstances where, and this does happen, I think one of the areas that we see it most common is in companion diagnostics. So let’s take a study where the study is truly around, let’s say, kind of behavioral interventions. It’s a two-arm study and you have to test positive for a certain biomarker in order to be in one treatment arm versus the other. So imagine that that’s the study design, but the biomarker in question, there’s no commercially available test for it, so you’re using technically an investigational diagnostic in order to get the information necessary to triage people into the appropriate arm of the study. And this definitely happens. So this is often called the companion diagnostic.

So in that case, the companion diagnostic, it’s not the object of the investigation. There’s no safety or efficacy data being collected about the device. And so you might say, “Okay, well, 812 doesn’t apply.” And I think it’s accurate to say that 812 is not required to apply in that case. But I think the nuance there to remember is that the FDA functions through interstate commerce. So also just remember when you’re doing these assessments that even if 812 does not apply by is not required to apply, you still want to do a gut check of is everything that is entering interstate commerce here, is it doing so lawfully? So in this case of the companion diagnostic, you’d want to ask the person submitting to the IRB like, “Hey, we see that there’s this companion diagnostic. We don’t think that 812 is required to apply, but we wanted to understand how you plan on shipping this product, because you need to make sure that whatever pathway you choose to ship the product and to have the product enter interstate commerce, you’re doing it lawfully.

So you’re not saying that it’s an investigational device, but you are asking the question of what other FDA pathway are they going through?” And so there are cases where a sponsor might choose to say, “Okay, we are going to go through the investigational device route in order to have our companion diagnostic, which is not otherwise FDA cleared or approved, be able to be used in this study.” So there’s also nuances where you genuinely might have a device that plays a critical role in terms of in a study that where no safety or efficacy data is being collected, but the investigational device is playing a critical role in the study design and where you still might have to, even though it doesn’t necessarily meet the definition of investigational device or an investigation, the sponsor and the IRB together could say, “Okay, going through these extra regulatory steps, that is a pathway open to you in order to have this device enter interstate commerce. And so that’s what we’re going to do to make sure that you’re entering interstate commerce appropriately.”

So when you’re thinking about the applicability of 812, it’s not just must 812 apply? But with devices, you still might have questions of, okay, even if 812 isn’t required, is there some device being used in the study where we still need to make sure that it is entering interstate commerce in a legal way? And if so, how is the sponsor planning on handling that? And do we need to still recommend that they consider that we apply 812 to ensure that the device can enter interstate commerce? And I’ve definitely worked with clients in the past where they had other pathways available to them within the FDA frameworks for the product to enter interstate commerce. But for a variety of reasons, they said, “Hey, we want to do a study under 812. We want to go through all those steps under 812 and have this be an investigational device study with a non-significant risk determination as opposed to availing ourselves of one of the other pathways that might be available to us under the FDA regulations.”

And that nuance is something that I think also gets missed. So 812 could be a really good viable option for a sponsor to have an item enter interstate commerce. And so I think also just remembering in the framework, this is all about making sure various items can enter interstate commerce lawfully. That’s the other thing that I think is really helpful when you’re thinking through the device regulations. The lens here isn’t just, are human subjects being protected? It’s also is interstate commerce being used in a way that FDA has permitted? And that’s kind of an extra though point that we don’t always consider.

Daniel Smith: So we’ve really covered a lot of ground here today, I think in a really helpful and practical way for our listeners. So on that note, if there’s anything where our listeners want to learn more about what we discussed today, do you have any recommendations for additional resources or places they can go to learn more and explore everything that we’ve discussed today in more detail?

Lauren Hartsmith: So there’s several FDA guidance documents that pertain to software as a medical device and those exceptions from the definition of medical device that we talked about at the top of the conversation. HRP also has available, I think, a really practical and useful checklist of that workflow that I just talked about with links to the relevant regulatory definitions and kind of like, yes, go here, no, then it’s not subject to these regulations. And then with some explanation on who’s responsible for what and the significant risk device determination side of things.

Daniel Smith: Wonderful. Well, I think that is a great place to leave our conversation today. So thank you again, Lauren, for joining me.

Lauren Hartsmith: Yeah, thanks so much for having me.

Daniel Smith: If you enjoyed today’s conversation, I encourage you to check out CITI Program’s other podcasts, courses, and webinars. As technology evolves, so does the need for professionals who understand the ethical responsibilities of its development and use. That is why we developed our new Tech Ethics Training Solution. This new offering brings together practical, thoughtfully designed courses to help professionals navigate ethical and regulatory challenges with confidence. The courses cover responsible AI, software as a medical device and clinical decision support systems, big data and data science, data management, software development, and more. Check out the link in this episode’s description to learn more. And I just want to give a last special thanks to our line producer, Evelyn Fornell, and production and distribution support provided by Raymond Longaray and Megan Stuart. And with that, I look forward to bringing you all more conversations on all things tech ethics.