The Therapeutic Goods Administration (TGA) regulates software-based medical devices; including software that functions as a medical device in its own right, and software that controls or interacts with a medical device either from within the device or externally. If a product is a medical device, it must be included in the Australian Register of Therapeutic Goods (ARTG), unless exempt, before it can be legally supplied in Australia.

Following consultation with stakeholders including with global medical device regulators in 2019 and 2020, the Therapeutic Goods (Medical Devices) Regulations 2002 were amended by the Government to clarify some existing requirements and to introduce new requirements for software-based medical devices.

The changes, which commenced on 25 February 2021, include:

• clarifying the boundary of regulated software products (including ‘carve outs’)

• introducing new classification rules
• providing updates to the essential principles to more clearly express the requirements for software-based medical devices.

Carve-outs

From 25 February 2021, certain software-based medical devices were carved-out (through either an exemption or exclusion) from the scope of the TGA regulation, based on the following principles:

• Align with international regulatory frameworks where appropriate.

• Reduce or remove unnecessary regulatory burden:

– by not regulating products where there is no significant risk to safety

– by not regulating where suitable frameworks for product or system oversight are already  in place.

Certain clinical decision support systems (CDSS) have been exempted. CDSS is software that can perform a broad range of functions that facilitate, support and enable clinical practice. Other products have been excluded and are not subject to any TGA regulatory requirements. The types of excluded products include:

• Consumer health products – prevention, management and follow up devices that do not provide specific treatment or treatment suggestions

• Enabling technology – for telehealth, healthcare or dispensing

• Digitisation – of paper based or other published clinical rules or data including simple dose calculators and Electronic Patient Records

• Population based analytics – Data analytics that are for the collection and analysis of class, group or population data that are not intended to be used for clinical use cases for individuals

• Laboratory Information Management Systems – these systems include pathology and radiology use cases and typically allow laboratories to automate workflows, integrate instruments, manage orders and samples and associated information.

New Classification Rules

Diagnosis or screening

For software-based medical devices that provide a diagnosis or screen for a disease or condition, the classification depends on whether the device provides the diagnosis/screening directly, or whether a relevant health professional makes the diagnosis using information provided by the device.

This rule covers both software-based medical devices intended to be used for:

• the screening of apparently healthy, asymptomatic individuals to detect disease, abnormalities or risk factors

• the diagnosis of unwell individuals to determine a cause for symptoms.

Monitoring

For software-based medical devices intended to provide information to monitor the state or progression of a disease or condition, the classification depends on both the potential risk to public health and whether the information could indicate if a person is in ‘danger’. The Macquarie dictionary defines danger as “liability or exposure to harm or injury; risk; peril”. This rule considers both:

• immediate danger (danger occurring without delay)

• other danger (i.e. danger that is not immediate)

Specification or recommendation of a treatment or intervention

For software-based medical devices intended to specify or recommend a treatment or intervention, the classification depends on whether the device specifies or recommends the treatment or intervention, or whether the device recommends the treatment or intervention to a relevant health professional so that they may decide whether or not to action the recommendation using information provided by the device. This rule covers both software-based medical devices intended to:

• directly specify a treatment or intervention (the software makes the decision)

• recommend a treatment or intervention (the user makes the decision)

Information as therapy

For software-based medical devices intended to provide therapy through the provision if information, the classification depends on the potential to cause harm to the person using the information. For this rule, four levels of harm are referred to:

• harm that may result in the death of a person or a severe deterioration in the state of a person’s health

• serious harm

• harm that is not serious and will not harm that may result in the death of a person or a severe deterioration in the state of a person’s health

• no harm

Changes to the Essential Principles

To supply a medical device in Australia, the sponsor or manufacturer must be able to demonstrate their medical devices meet the relevant Essential Principles.

From 25 February 2021 the following changes that will impact programmed or programmable medical devices or software that is a medical device will be made to the essential principles:

• Essential Principle 12.1 is amended to clarify the existing requirements for:

– cyber security

– the management of data and information

– requirements relating to development, production, and maintenance.

• Essential Principle 13.2(3) is amended to allow information to be provided electronically rather than on a leaflet.

• A new essential principle, Essential Principle 13B, will be introduced requiring the current version and build number for the software to be made accessible and identifiable to users of software-based medical devices.