Guidance on "Medical Apps"
Differentiation between apps and medical or other devices as well as on the subsequent risk classification according to the MPG
Software applications for mobile phones and tablets, so-called "apps", have become our daily companions in homes and offices. The range of apps for the health sector has also increased considerably in the past years. Apps measure our physical fitness, give health tips, analyse physiological data and calculate dosing of medicines.
But where is the border between health and fitness apps and medical devices? How can developers tell whether their product is subject to the Act on Medical Devices (Medizinproduktegesetz, MPG) and related ordinances? And if so, what has to be done?
In the following, the BfArM offers guidance on differentiation between apps (in general: stand alone software, i.e. software that is not incorporated into a medical device, e.g. as control software) and medical or other devices as well as on the subsequent risk classification according to the MPG.
However, this guidance can only serve as an informative basis. Decisions with regard to qualification and classification which are to be based on the intended purpose of the software, as well as the marketing thereof are within the responsibility of the manufacturer (person responsible pursuant to Section 5 MPG), if applicable in agreement with a notified body.
This guidance is also intended to support considerations prior to submitting an application to the BfArM pursuant to Section 13 sub-sections 2 and 3 MPG. Applications can be submitted by the manufacturer of the software, the Land authority responsible for the manufacturer and, if applicable, the notified body involved in the conformity assessment procedure. For further information on the submission of applications please refer to the item "Antragstellung".
In accordance with Section 3 number 10 MPG, the intended purpose is the use for which the medical device is intended according to the manufacturer's information on labelling, instructions for use or promotional materials.
Thus, not only the explicitly described intended purpose is relevant e.g. for an authority decision on qualification as a medical device, but also the instructions for use and the promotional materials (e.g. website, information in App Store) regarding the specific product.
Stand alone software like smartphone apps can indeed be classified as a medical device. In order for this to be the case, the software must be intended by the manufacturer to be used for humans and for at least one of the following purposes pursuant to Section 3 number 1 MPG:
- diagnosis, prevention, monitoring, treatment or alleviation of disease,
- diagnosis, monitoring, treatment, alleviation or compensation of injuries or handicaps,
- investigation, replacement or modification of the anatomy or of a physiological process,
- control of conception.
As opposed to mere provision of knowledge, e.g. in a paper or electronic book (no medical device), any type of interference with data or information by the stand alone software is indicative of a classification as a medical device.
Possible indicative terms in connection with the intended purpose of corresponding functions can be e.g.: alarm, analyse, calculate, detect, diagnose, interpret, convert, measure, control, monitor, amplify.
Indicative functions for classification as a medical device can be among the following:
- decision support or decision making software e.g. with regard to therapeutic measures
- calculation e.g. of dosing of medicines (as opposed to mere reproduction of a table from which users can deduce the dosage themselves)
- monitoring patients and collecting data e.g. by measurements if the results thereof have an influence on diagnosis or therapy.
Pure data storage, archiving, lossless compression, communication or simple search functions do not result in classification as a medical device.
Note: Declarations e.g. a statement in the App Store "This is not a medical device" do not circumvent the afore-mentioned criteria and are not considered in the BfArM's decisions pursuant to Section 13 MPG if an intended medical purpose is stated or implied by the manufacturer in labelling, instructions for use or promotional materials.
Like all other medical devices from own production, software applications from own production are medical devices and thus must fulfil the basic requirements of Council Directive 93/42/EEC. This includes accessories manufactured and used in a health facility without being placed on the market or fulfilling the prerequisites of a custom-made device pursuant to Section 3 numbers 21 and 22 MPG.
2. Risk classification
With the exception of in vitro diagnostic medical devices and active implantable medical devices, medical devices are allocated to risk classes that are mainly based on the potential damage that can be caused by an error/malfunction of the medical device. These risk classes range from Class I (low risk) and IIa and IIb to Class III (high risk). Class I products are additionally subdivided according to whether they require sterilisation (Is) or include a measuring function (Im) which is relevant for the further conformity assessment procedure.
The classification is based on the rules laid down in Annex IX of Council Directive 93/42/EEC. The following rules are most suitable for the classification of stand alone software:
- Rule 9
"All active therapeutic devices intended to administer or exchange energy are in Class IIa unless their characteristics are such that they may administer or exchange energy to or from the human body in a potentially hazardous way, taking account of the nature, the density and site of application of the energy, in which case they are in Class IIb.
All active devices intended to control or monitor the performance of active therapeutic devices in Class IIb, or intended directly to influence the performance of such devices are in Class IIb."
"Active devices intended for diagnosis are in Class IIa,
- if they are intended to supply energy which will be absorbed by the human body, except for devices used to illuminate the patient's body, in the visible spectrum;
- if they are intended to image in vivo distribution of radiopharmaceuticals;
- if they are intended to allow direct diagnosis or monitoring of vital physiological processes, unless they are specifically intended for monitoring of vital physiological parameters, where the nature of variations is such that it could result in immediate danger to the patient, for instance variations in cardiac performance, respiration, activity of CNS in which case they are in Class IIb.
Active devices intended to emit ionizing radiation and intended for diagnostic and therapeutic interventional radiology including devices which control or monitor such devices, or which directly influence their performance, are in Class IIb.“
- Rule 12
"All other active devices are in Class I."
- Rule 14
"All devices used for contraception or the prevention of the transmission of sexually transmitted diseases are in Class IIb, …"
- Implementing rule 2.3
"Software, which drives a device or influences the use of a device, falls automatically in the same class."
The following definitions in accordance with Annex IX Section I No. 1 of Council Directive 93/42/EEC are to be observed:
Stand alone software
Stand alone software is considered to be an active medical device.
- Active therapeutical device
"Any active medical device, whether used alone or in combination with other medical devices, to support, modify, replace or restore biological functions or structures with a view to treatment or alleviation of an illness, injury or handicap."
- Active device for diagnosis
"Any active medical device, whether used alone or in combination with other medical devices, to supply information for detecting, diagnosing, monitoring or treating physiological conditions, states of health, illnesses or congenital deformities."
The afore-mentioned rules show that e.g. medical apps on smartphones and tablets will mostly be classified in risk Class I in accordance with Rule 12. If the medical devices are intended for diagnosis or monitoring of vital functions (e.g. cardiac functions), Classes IIa or IIb can also be considered.
Depending on the risk class there are different requirements for conducting a conformity assessment procedure as the prerequisite for affixing the CE marking and for correct marketing within the European Economic Area. Thus, the manufacturer can perform a conformity assessment e.g. for Class I devices without involvement of a notified body; for all other risk classes (also in the case of Class I devices that require sterilisation or include a measuring function) it is mandatory to involve a notified body.
The BfArM is not involved in conformity assessment or marketing of medical devices. Further information on this subject can be found e.g. under:
- Market access
If a stand alone software or app is placed on the market as a medical device it is subject to the same regulations as all other medical devices. One example for such regulations are the incident reporting obligations of professional users and manufacturers or authorised representatives pursuant to Section 3 of the Medical Device Safety Plan Ordinance (Medizinprodukte-Sicherheitsplanverordnung, MPSV):
3. Examples for qualification/differentiation
Decision supporting software
In general, software is usually considered a medical device when it is used for healthcare, if e.g. medical knowledge databases and algorithms are combined with patient-specific data and the software is intended to give healthcare professionals recommendations on diagnosis, prognosis, monitoring or treatment of an individual patient.
- Software systems
If a software consists of several modules it is the manufacturer's responsibility whether he wants the modules as a whole to be qualified and classified or each module individually. If the entire system is qualified and if it consists both of software with and without the properties of a medical device, the system is subject to medical device legislation.
- Telemedical software
In telemedicine the physician observes and assesses the patients' medical data using telecommunication technologies - e.g. via the internet. Patient and physician can be at different locations.
Depending on the intended purpose, communication systems for telemedicine can either be non-medical devices (purely for transfer of data) or a combination of non-medical devices and medical devices (e.g. in order to support diagnoses).
Hospital information systems (HIS)
Hospital information systems that support patient management are generally not medical devices, especially if they have the following intended purpose:
- collection of data for patient admission
- administration of general patient data
- scheduling of appointments
- insurance and billing functions
However, hospital information systems can be combined with other modules that could be medical devices.
- Picture Archiving and Communication System (PACS)
For example, if the manufacturer of the PACS software specifies in the intended purpose that the software is only meant for storage or archiving of pictures and not for diagnosing, this would indicate that it is not a medical device. However, if the manufacturer intends the PACS software for controlling a medical device or to have an influence on its use or to allow a direct diagnosis, this would support its classification as a medical device.
Stand alone software or apps that are not medical devices
- Operating system software:
Operating system software (e.g. Windows, Linux) is neither a medical device nor is it an accessory to a medical device.
- Software for general purposes
Software for general purposes is not a medical device even if it is used in connection with healthcare.
- Software or apps as health or fitness products
When differentiating medical devices e.g. from health or fitness products, the decisive issue is whether they are intended for medical or non-medical purposes. This is defined by the manufacturer of the product. Software or apps merely intended for sporting activities, fitness, well-being or nutritional aims without a medical purpose claimed by the manufacturer are generally not medical devices.
- Operating system software:
4. Further information and guidance (selection)
4.1 European Commission
MEDDEV 2.1/6 rev. 1: Qualification and classification of stand alone software
This guideline on the qualification and classification of stand alone software was drafted by the European Commission after consultation of the competent authorities, commission services, industry and notified bodies. The BfArM also implements this guideline in its decisions according to Section 13 MPG.
Pursuant to this guideline, a stand alone software must fulfil the following criteria in order to be classified as a medical device:
- it has to be a computer program
- the software has to have a different purpose than mere storage, archival, lossless compression, communication or simple search
- the software has to be for the benefit of individual patients
- the software has to have an intended purpose listed in Article 1(2)a) of Directive 93/42/EEC.
(In Germany, Article 1(2)a) of Directive 93/42/EEC has been implemented as national law in Section 3 number 1 MPG.)
- MEDDEV 2.1/1: Definition of "medical devices" - Definition of "accessory" - Definition of "manufacturer"
- Manual on borderline and classification in the Community Regulatory framework for medical devices
- MEDDEV 2.4/1 Rev. 9: Classification of medical devices
- GREEN PAPERS via mobile health services („mHealth“)
4.2 Other authorities
Medical Products Agency (Läkemedelsverket): “Medical Information Systems – guidance for qualification and classification of standalone software with a medical purpose”, January 2013
Food and Drug Administration FDA: “Mobile Medical Applications -Guidance for Industry and Food and Drug Administration Staff ”, February 2015
Asian Harmonization Working Party (AHWP), November 2014
International Medical Device Regulators Forum (IMDRF): Software as a Medical Device (SaMD): Key Definitions, December 2013