The FDA Has New Requirements for Medical Device Cybersecurity and PCCPs

Here’s What You Need to Know.

The U.S. Food and Drug Administration recently released draft guidance regarding artificial intelligence/machine learning-enabled medical devices. Here we take a deep dive into the legislative changes related to cybersecurity, predetermined change control plans, and the role of translation and localization services.

The demand for documentation from medical device manufacturers and pharmaceutical companies is substantial and vital for public safety. These companies must produce a wide range of materials, including product labels, user manuals, packaging, software interfaces, marketing collateral, risk assessments, clinical trial information, and post-market surveillance plans, among others. These materials require translation and localization into multiple languages and cultural contexts to ensure global compliance and effective communication with diverse stakeholders, including end consumers.

The use of artificial intelligence (AI) and machine learning (ML) in the medical device and pharmaceutical industries has increased the demand for documentation and the need for support from translation and localization service providers. AI/ML has become an essential part of medical devices and pharmaceutical products, and developing these products is a fast-moving, agile, and iterative process. This requires continuous updates to the usual documentation and may need more, such as data sets, algorithms, and validation studies, to ensure the technology is safe and effective. Naturally, the use of AI/ML also requires specific expertise and knowledge in the localization and translation of technical and medical content. Translation and localization service providers must deeply understand medical device and pharmaceutical terminology and AI/ML concepts to ensure accurate and precise translations. They must also be familiar with the regulatory frameworks and guidelines for AI/ML-enabled devices in different markets.

In the U.S., for example, recent legislation has changed the authority of the U.S. Food and Drug Administration (FDA), the federal agency of the U.S. Department of Health and Human Services responsible for regulating the safety, efficacy, and security of a wide range of products, and ensuring that they are accurately labeled and marketed to consumers. These products include human and veterinary drugs, vaccines, medical devices, food, cosmetics, and other products intended for public use.

The Food and Drug Omnibus Reform Act (FDORA) of 2022 introduced several provisions that enhance the FDA’s ability to oversee clinical research, improve patient safety, and modernize the regulatory framework for medical devices and pharmaceutical products. One of the most significant aspects of FDORA for medical device manufacturers is Subtitle C, which addresses cybersecurity (Sec. 3305) and Predetermined Change Control Plans (PCCPs, Sec. 3308) for medical devices.

Cybersecurity

Addressing cybersecurity in medical devices is crucial to protecting patient safety, safeguarding patient data security and privacy, and maintaining device integrity, as compromised devices can result in harm or even death. Moreover, addressing cybersecurity risks helps maintain the reputation and trust of healthcare providers, manufacturers, and the medical industry.

In Subtitle C, Sec. 3305, the FDORA includes provisions related to medical device cybersecurity, expanding the requirements for sponsors submitting medical devices for FDA approval. Sponsors now need to provide cybersecurity-related information for “cyber devices,” which include software within a medical device that can connect to the internet and may have cybersecurity vulnerabilities. Sponsors must submit a plan to monitor and address post-market cybersecurity vulnerabilities, disclose vulnerabilities, and ensure device and system security. They must also provide a software bill of materials listing the software components used.

The law mandates that the FDA issue updated guidance on cybersecurity in premarket device submissions and requires a report from the Government Accountability Office (GAO) identifying cybersecurity challenges for medical devices.

Predetermined Change Control Plans

The concept of PCCPs has been in practice for several decades in various regulated industries. In medical devices, PCCPs are pre-approved roadmaps for modifying a medical device after it has been cleared or approved by the regulatory authority. Instead of a separate application process, the manufacturer includes the PCCP in the initial marketing submission. The plan outlines the proposed changes, explains their necessity, and ensures the modified device remains safe and effective. The PCCP may cover aspects like updating the labeling instructions, notifying the regulatory authority of issues, and setting performance requirements.

Once the regulatory authority approves the PCCP, the manufacturer can make the specified changes without further delays or paperwork if they adhere to the agreed-upon plan. This simplifies the process of post-market modifications while ensuring regulatory compliance and patient safety.

Subtitle C, Sec. 3308 of FDORA allows post-market changes to a medical device cleared by the FDA through a 510(k) clearance or premarket approval (PMA) without a separate application. Conditions such as alignment with an approved PCCP, demonstrating continued safety and effectiveness, and substantial equivalence to the initial clearance must be met. The PCCP may include labeling instructions and notification requirements. It’s important to note that a modified 510(k)-cleared device cannot be used as a reference for future clearances; only the initial authorized version can serve as a reference.

Support from translation and localization services

Translation and localization service providers, like Argos, play a crucial role in supporting medical device manufacturers and pharmaceutical companies in their global operations. Our teams of linguists are proficient in the source and target languages and possess deep knowledge of medical and pharmaceutical terminology, ensuring accurate translations.

With the new FDA requirements, the need for support from these providers is likely to increase, especially for manufacturers with products in the U.S. market. FDA language requirements for medical device labeling should also be taken into consideration. Per their website, “All labeling shall be in English with the exception of products distributed solely within Puerto Rico or a U.S. territory where the predominant language is other than English. In these instances, the predominant language may be substituted for English. If any representation on the device label or labeling appears in a foreign language, then all required labeling must also appear in that foreign language.” Compliance with local regulations and guidelines, including translating premarket submission documents like cybersecurity plans and vulnerability disclosures, is essential to safety and security in medical device translation and localization.

The importance of the FDA’s regulatory role cannot be overstated. The agency’s work ensures that products are safe, effective, and accurately labeled, thereby protecting public health. The FDORA and Subtitle C represent an important step towards modernizing the regulatory framework for medical devices and pharmaceutical products while enhancing patient safety and streamlining the regulatory process. The demand for documentation from medical device manufacturers and pharmaceutical companies will only continue to grow, making the role of translation and localization service providers all the more critical in facilitating effective communication, regulatory compliance, and successful market entry in global contexts.

If you’re seeking guidance on navigating the FDA’s new requirements for medical device cybersecurity and PCCPs, our experienced consulting partner is here to help. Don’t hesitate to reach out for expert assistance in meeting FDA regulatory standards and ensuring your medical devices are compliant. Contact our consulting partner, CENIT Consulting, today and let them guide you through this crucial process with confidence.

Additional Sources

– New Authorities Help FDA Maintain Oversight of Clinical Research. https://www.fda.gov/about-fda/regulatory-news-stories-and-features/thousands-sites-less-100-investigators-new-authorities-help-fda-maintain-oversight-clinical-research

– Requests for Feedback and Meetings for Medical Device Submissions: The Q-Submission Program https://www.fda.gov/media/114034/download