Quiero saber acerca de...

Federal Register / Vol. 86, No. 190 / Tuesday, October 5, 2021 / Rules and Regulations V. Comments on Proposed Rule and FDA Response
lotter on DSK11XQN23PROD with RULES1

A. Introduction We received several sets of comments on the proposed rule by the close of the comment period, each containing one or more comments on one or more issues.
We received comments from medical device associations, industry, medical and healthcare professional associations, public health advocacy groups, law firms, and individuals. We describe and respond to comments in sections V.B through V.K. We have numbered each comment to help distinguish between different comments. We have grouped similar comments together under the same number, and, in some cases, we have separated different issues discussed in the same comment and designated them as distinct comments for purposes of our responses. The number assigned to each comment or comment topic is purely for organizational purposes and does not signify the comments value or importance or the order in which comments were received.
B. Description of General Comments and FDA Response Several comments made general remarks supporting the proposed rule without focusing on a particular proposed provision. Almost all comments supported the objective of the proposed rule: To establish regulations implementing the De Novo classification process. Several comments also requested that FDA
make changes without focusing on a particular provision of the proposed rule. In the following paragraphs, we discuss and respond to such general comments.
Comment 1 A commenter states that FDA should retain patient safety as its number one priority and integrate cybersecurity into the De Novo request process, and that science should support any decisions.
Response 1 FDA agrees with this comment. As part of the cybersecurity review for premarket submissions for devices that contain software including firmware or programmable logic as well as software that is a medical device, FDA recommends that medical device manufacturers assess the impact of threats and vulnerabilities on device functionality and end users/patients as part of the cybersecurity review Ref. 1.
Comment 2 A commenter requests FDA to adopt an abbreviated procedure and a reduced user fee for De Novo requests when the requester believes that its device meets the criteria for classification in class I under section
VerDate Sep<11>2014

17:01 Oct 04, 2021

Jkt 256001

513a1Aii of the FD&C Act, because the commenter believes that it would help provide more timely access to low-risk devices and conserve valuable FDA premarket review resources without compromising public health protection.
Response 2 We do not agree that the procedure proposed by the commenter would be more efficient than the procedures described in FDAs proposed rule. The De Novo classification process provides a pathway for certain devices to obtain marketing authorization as class I or class II devices, rather than remaining automatically designated as class III
under section 513f1 of the FD&C Act.
FDA makes the determination that a device is class I or class II under section 513f2 of the FD&C Act using the criteria in section 513a of the FD&C
Act. The process proposed by the commenter would require an abbreviated submission with only some of the information FDA proposed to require in a De Novo request when the requester believes that its device meets the criteria for classification as a class I device. The proposed process would also add a step to the Agencys review process for such devices by requiring FDA to determine within 15 days of receiving the request either that the device meets the criteria for classification into class I or that additional information is required to make the classification determination.
The FD&C Act provides 120 days for review of a De Novo request, regardless of the ultimate classification determination. In FDAs experience, 15
days is not a workable timeframe for the Agency to complete a substantive review of a submission for a new device type to determine that the device meets the criteria for classification into class I.
Further, the commenters suggested abbreviated initial submission omits information that is important for FDAs classification determinations, such as information on probable risks to health associated with use of the device.
Therefore, under the commenters proposed process, FDA would usually, if not always, need to require additional information within 15 days. In 860.220a of this final rule, FDA has identified the required contents of a De Novo request taking into account the Agencys experience with the types of information needed to make a determination on a De Novo request. If a requester believes that some of the required information is not applicable to its device, the requester may submit a justification for omitting that information pursuant to 860.220c.

PO 00000

Frm 00029

Fmt 4700

Sfmt 4700

54829

We also note that the proposed process does not appear to provide for any FDA action other than requesting additional information or classifying the device. Section 513f2 of the FD&C
Act provides for FDA to decline a De Novo request.
With respect to the user fees applicable to a De Novo request, the Medical Device User Fee Amendments of 2017 amended the FD&C Act to authorize FDA to collect user fees for certain premarket submissions received on or after October 1, 2017, including De Novo requests see section 738 of the FD&C Act 21 U.S.C. 379j. The fees are set by statute section 738a2Axi of the FD&C Act and therefore any changes to such fees are outside the scope of this rulemaking.
Comment 3 A commenter concerned about the design of a remote monitoring system containing software states that as part of the De Novo request, a manufacturer should provide information on whether the device collects protected health information PHI. The same commenter requests that the Health and Human Services Office for Civil Rights should complete a review prior to the De Novo request being granted by FDA. A commenter states that a PHI pre-approval plan should be reviewed with the impact and patient experience included in the overall De Novo request grant.
Response 3 Standards for the use and disclosure of protected health information by certain entities are set forth in regulations implementing the Health Insurance Portability and Accountability Act of 1996 HIPAA
Pub. L. 101191, which are outside the scope of this rulemaking. To demonstrate a reasonable assurance of safety and effectiveness for software devices, documentation related to the requirements of the quality system regulation QSR 21 CFR part 820 is often a necessary part of the premarket submission. See also Guidance for the Content of Premarket Submissions for Software Contained in Medical Devices Ref. 2. As part of QSR design controls, a manufacturer must establish and maintain procedures for validating the device design, which shall include software validation and risk analysis, where appropriate. 820.30g. As part of the software validation and risk analysis required by 820.30g, software device manufacturers may need to establish a cybersecurity vulnerability and management approach, where appropriate. Such cybersecurity design controls help to ensure device security, including protection of health information.

E:FRFM05OCR1.SGM

05OCR1