The pandemic lockdown has sped up digital transformation in this era. It is increasingly accepted that the availability of certain mobile or web-based apps have helped medical personnel better handle their jobs and allowed patients to access medical information or seek a medical solution more independently. However, when a topic revolves around medical affairs, it always comes with stringent scrutiny, leaving many software developers and manufacturers confused as to when the software is defined as a Software as Medical Device (SaMD) and how this differs from a conventional medical device? Clear guidelines have been developed by the International Medical Device Regulators Forum (IMDRF), which comprises a group of medical device regulators from around the world, including the EU and FDA who are also part of the current members representing their authorities.
SaMD is defined as:
‘software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device.’ (IMDRF/SaMD WG/N10 )
To help with the development of SaMD, the IMDRF has released guidelines that outline the key considerations:
In short, SaMD is independent software that, on its own, is a medical device that serves medical purposes defined in GHTF/SG1/N71:2012. These purposes include:
- Diagnosis, prevention, monitoring, treatment or alleviation of disease
- SaMD that performs analysis of clinical samples that help with disease diagnosis.
- SaMD that helps in monitoring sleep apnea by using the microphone of a smart device to detect breathing pattern during sleep and sounds a tone to rouse the sleeper when detecting interrupted breathing.
- SaMD that uses data from individuals for predicting risk score for developing stroke or heart disease for creating prevention or interventional strategies.
- Disease management
- SaMD that can provide information by taking pictures, monitoring the growth or to supplement other information for a healthcare provider for the uses of disease monitoring.
- Control of conception
- In-vitro diagnostics and sterilization
A software that is embedded as part of a hardware medical device and is necessary to drive the intended medical purpose IS NOT a SaMD. However, if the software is interfaced with other hardware medical devices and acts as an additional enhancement for its medical purposes can be considered as a SaMD.
Also, another highlight to be noted is that the common Fitness or Wellness apps are NOT SaMD. As clearly listed in both EU MDR 2017/745 and 520(o)(1)(A) – (D) of the FD&C Act (FDA) that are endorsed by the IMDRF, a fitness or wellness software that is unrelated to diagnosis, cure, mitigation, prevention or treatment of a disease is NOT qualified to be a SaMD. The examples of “NOT a SaMD software” are:
- Mobile apps that help individuals to “soothe and relax” and intended to “manage stress”.
- Mobile apps that encourage healthy eating, exercise, weight loss or other activities generally related to a healthy lifestyle.
- Mobile apps that track a normal baby’s sleeping and feeding habits.
- Mobile apps that help healthy people track the quantity or quality of their normal sleep patterns.
The categorization of SaMD
Following the qualification of SaMD, developers or manufacturers should identify the category in which their SaMD sits. The categorization principles are based on two statements and determined by four categories (I, II, III, IV) that determine the impact the SaMD has on the patient or public health. The risk category is on a gradual spectrum from the lowest impact (Category I) to the highest impact (Category IV). The examples for each category are:
- Category IV – life and death, time-critical; SaMD that performs analysis to diagnose and making treatment decisions for (i) meningitis in children, (ii) acute stroke patients, (iii) cancer lesions etc.
- Category III – life and death, non-time-critical; SaMD to sounds alarm to apnea patients when detected interrupted breathing during sleep; SaMD that is a treatment planning system and provides specific parameters to aid in the treatment of a particular tumour; SaMD that monitors and provides information to healthcare providers for the diagnosis of a malignant or a benign lesion, etc.
- Category II – SaMD that analyses multiple blood tests etc. that provides recommendations for the diagnosis of e.g. kidney function, cardiac risk, iron and anemia assessment; SaMD that visualizes the anatomical structure that helps in the placement of catheter or marker into the correct structure etc.
- Category I – SaMD that collects data e.g. ECG rate, heart rate walking speed of a rehabilitation patient that is monitored by a qualified professional; SaMD that collects data and anticipate an occurrence of an asthma episode; SaMD that stores historical blood pressure information for a health care provider’s later review; SaMD that allows image analysis such as performing cell counts and morphology reviews etc.
The two statements of the categorization principles identify the medical purposes and the condition that the SaMD is intended for in the real world. The first statement identifies the “significance of the information provided by the SaMD to the healthcare decision” which can be divided into
- Treat or diagnose
- Drive clinical management which is to enhance the effective use of medicinal products or medical device that helps enhancing the “treat and diagnose”
- Inform clinical management which is to inform of options for “treat or diagnose” and to provide aggregating clinical information that can help “treat or diagnose” in the future
While the second statement concludes the “state of the healthcare situation or condition” that the SaMD is intended for and is divided into
- Critical that deals with life-threatening situation and require major interventions
- Serious condition that is moderate in disease progression and intervention is not time-critical
- Non-serious condition that can be managed effectively and usually requires only minor, non-invasive interventions
The summary of the risk categorization of a SaMD is tabulated below 
Quality Management System (QMS) of a SaMD
Just like any other medical device, the development of SaMD must comply with the common QMS standards and regulations in different countries. The consolidated guidance released by the IMDRF can be found in IMDRF/SaMD WG/N23. Briefly, these are the standard QMS regulations that must be considered:
- Health Canada regulations – CAN/CSA ISO 13485:2003
- USA FDA – US FDA 21 CFR 820
- Europe Union regulations – EN ISO 13485:2012 Annexes ZA, ZB, ZC; MEDDEV Guidance 2.1/6
- Australia – Therapeutic Goods (Medical Devices) Regulations 2002, Division 3.2
Due to the nature of a SaMD, the manufacturing of a SaMD relies primarily on its good design rather than the production line. Hence, the QMS for a SaMD should prioritize the following:
- Organizational structure (leadership, infrastructure and work environment)
- Product planning (lifecycle support and management, e.g. SOUP, IEC 62304)
- Risk management (ISO 14971)
- Usability (IEC 62366)
- Safety (IEC 60601)
Figure 2: SaMD QMS strategies: Image adapted from IMDRF/SaMD WG/N23. 
Clinical evaluation of a SaMD
The clinical evaluation of a SaMD is the final step to evaluate if a SaMD is functioning as promised. The link between the output of a SaMD and stated clinical condition will be assessed to make sure that the information generated by the SaMD is clinically reliable and accurate.
This final step involves three processes as below :
“Please do not confuse your Google search with my medical degree.” (Facebook meme, 2015).
The statement above has proven true of the emerging tech-savvy population. Given the advancement of digital technology, it is a common norm in the current era that one will google almost anything which covers the symptoms and possible diagnosis to the prescription given by doctors. While some medical personnel may see it as a troubling trend, from the other perspective, it shows that we have a bunch of engaged and empowered e-patients.
As the regulations for SaMD become clearer, the emergence of various types of SaMD is inevitable. This latest technology extends beyond traditional medical care not only for medical personnel, and more importantly, it provides a reliable and accredited platform for engaging e-patients. Medical care is never easy, but by working together and staying connected, we can make wonders.
Author: Jasmine Lee, Trainee Life Science Consultant KVALITO
KVALITO is a strategic partner and global quality and compliance service and network for regulated industries. To learn more about our service, please visit us on www.kvalito.ch
If you would like to benefit from KVALITO’s expert services, feel free to send us an email at firstname.lastname@example.org.