Regulating Mobile Health Apps under a 38-Year-Old Law: It’s Time for Congress to Act

(A similar version of this Health Alert appeared at Forbes on 12/18/2014.)

1976: The United States celebrated the bicentennial of our independence; Jimmy Carter was elected president; young men wore bell bottoms and middle-aged ones wore leisure suits; advertising encouraged women to smoke Kool cigarettes. And the Food and Drug Administration (FDA) first regulated medical devices.

Although we fantasized about having Captain Kirk’s communicator or Dr. McCoy’s tricorder, nobody would have known what to do with an actual smartphone or tablet, had they existed in those days. Today, increasing numbers of us use them to keep track of medical information, to remind us to take our meds or do countless other tasks important to our health. In 2013, the Apple app store had 97,000 mobile health apps, and over 60 percent of physicians were using tablets.

And yet, the FDA is still regulating these 21st century technologies under legislation passed when Wings’ Silly Love Songs topped the pop music charts. It’s past time for Congress to amend the Food, Drug and Cosmetic Act to clarify the FDA’s regulatory authority over these new tools for our health.

According to the 1976 amendments, a medical device is an “instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article, including any component, part, or accessory…” [21 U.S.C. 321(h)]. That does not really give the FDA much direction with respect to apps, smartphones and tablets, does it?

Left to its own devices (excuse the pun), the FDA has actually done a very effective job of letting the industry and patients know how it intends to regulate these new technologies. Dr. Jeffrey Shuren, Director of the Center for Devices and Radiological Health, and Bakul Patel, who is responsible for writing the FDA’s final guidance, promised a light regulatory touch. The final guidance was published in September 2013, at which time the FDA noted, “The agency has cleared about 100 mobile medical applications over the past decade; about 40 of those were cleared in the past two years.”

The final guidance is written in plain English and has given many developers confidence that their innovations will not be regulated as medical devices. However, this relies on the FDA continuing a policy of “enforcement discretion.” From the final guidance:

The agency intends to exercise enforcement discretion (meaning it will not enforce requirements under the Federal Drug & Cosmetic Act) for the majority of mobile apps as they pose minimal risk to consumers. The FDA intends to focus its regulatory oversight on a subset of mobile medical apps that present a greater risk to patients if they do not work as intended.

While comforting to developers, this language fairly screams for Congressional action. If the FDA is using its own, self-perceived “enforcement discretion” to withhold regulation of apps, smartphones, tablets and the like, a future FDA can turn that on its head. In the final guidance, the FDA has had to define for itself the terms “mobile app” and “mobile medical app.” The American people should demand that Congress define the technologies subject to FDA regulation, not allow the regulator to define for itself that which it regulates.

Many developers are complacent about the threat of regulation. At the recent mHealth Summit, an expert panel consisting of Scott Thiel (Navigant Consulting), Bradley Thompson (Epstein Baker Green), N. Jason Green (Vasoptic Medical, an early-stage device company) and Robert Jarrin (Qualcomm) discussed the future of FDA regulation of mobile health devices. The panel’s consensus was that the doctrine of “enforcement discretion” was working well, although Mr. Thompson noted that it is unusual in regulation. (I suppose President Obama’s policies on illegal immigration would also fit the bill.)

Although the panel and audience agreed that the FDA is very open and a developer can “give them a phone call” to discuss whether his new app will be regulated or not, the audience noted that the answer might depend on which staffer answered the phone. A couple of entrepreneurs in the audience reported contradictory responses from within the FDA. The FDA cannot be expected to generate fully consistent regulatory standards, ex nihilo, without appropriate legislation. Fortunately, this may be resolved in the next Congress.

The MEDTECH Act, introduced by Senator Hatch (R-Utah) and Senator Bennet (D-Colo.), would legislate that electronic health records (EHRs) and other technologies that only store and communicate information are exempt from FDA regulation. Currently, this exemption exists only in the FDA’s own guidance.

The SOFTWARE Act, first introduced in October 2013 by Representative Marsha Blackburn (R-Tenn.) and a bipartisan group of co-sponsors, would define the term “medical software” as software distributed directly to consumers and not integrated with a drug or device but which includes the use of a drug or device. Such software would be subject to FDA regulation. The bill also introduces the terms “clinical software” (used by medical professionals) and “health software” (used by consumers to store and communicate data, but not including the use of a device). The latter two would not be subject to regulation. The SOFTWARE Act will be re-introduced in January, with some changes.

These bills are four and five pages long ― marvels in this age of thousand-plus pages of incomprehensible legislative jargon. Further, there is not much daylight between that which the FDA is regulating now and that which these bills seek to define as regulated versus not regulated. These bills would not disrupt the way things are working today. Instead, they would give developers and patients confidence that the FDA’s regulatory powers over 21st century medical technology are limited and well-defined.

Print