Accounting for controlled substances, maintaining complete and accurate records/reports and employing effective, compliant security do not alone guarantee a successful Drug Enforcement Administration (“DEA”) inspection.  A negative DEA inspection can plague registrants for years.

Hyman, Phelps & McNamara, P.C. (“HP&M”) invites you to join Director Larry Houck for a free webinar demystifying DEA inspections by providing an understanding of controlled substance accountability audits, the importance of conducting mirror reviews, and mock DEA-style internal inspections.  The webinar, scheduled for Wednesday, May 24, 2023 from 12:00-12:45 (Eastern), will share additional valuable inspection tips.

Registrants are far from powerless when DEA investigators inspect their controlled substance operations.  This webinar will provide insight on how to prepare for and manage inevitable DEA inspections to help ensure favorable results.

Before joining HP&M in 2001, Mr. Houck conducted numerous scheduled cyclic and targeted inspections and investigations as a DEA Diversion Investigator in the field for ten years.  He later served as Staff Coordinator in Diversion Control’s Liaison and Policy Section at DEA headquarters.

We hope that you will be able to join us!  Please see the attached flyer that includes a link to register for the webinar.

In a dense, multi-part opinion, the Supreme Court affirmed 5-4 the lower courts’ dismissal of a challenge to California’s Proposition 12. That law bans the knowing sale of eggs, uncooked pork, or veal derived from farm animals that are housed under conditions that do not meet certain minimum requirements – regardless of whether the animals are raised in California or out-of-state. Our colleagues at SCOTUSblog have penned a helpful analysis that examines the basis for the Court’s opinion, as well as its multiple parts and concurring opinions. Our focus is on the decision’s practical impact, which could be felt almost immediately.

The California Department of Food and Agriculture (CDFA) issued regulations implementing Proposition 12 on September 1, 2022, but their implementation was enjoined until July 1, 2023, pending the Supreme Court’s decision. With that out of the way, implementation of CDFA’s regulations can be expected to go forward, barring any further judicial or legislative intervention. CDFA has established a web page with multiple resources for producers and distributors, including links to the regulations and guidance documents.

California is not the only state to have established animal welfare requirements affected by the Supreme Court’s decision. Voters in Massachusetts approved a ballot initiative (Question 3) in 2016 that imposed requirements similar to those imposed under Proposition 12. The Massachusetts Department of Agricultural Resources (MDAR) subsequently issued implementing regulations that were partly enjoined pending the Supreme Court’s decision. Those regulations are now expected to take effect on June 10, 2023, barring any further judicial or legislative intervention.

Given consumer interest in farm animal welfare generally, it seems certain that additional states will seek to establish their own requirements similar to those in California and Massachusetts. To the extent that those requirements differ from one another, pressure may build for federal legislation to establish uniform national standards.

As we noted in our previous blog post available here, Quidel’s Sofia 2 SARS Antigen+ FIA, Sofia 2 SARS Antigen+ FIA Control Swab Set’s De Novo, now opens the door for follow-on 510(k) submissions that declare this product as their predicate, if the product meets the established Special Controls as noted in the reclassification order.  In this blog we examine the Special Controls put in place to mitigate false results, incorrect interpretation of results, and incorrect operation of the device.

Design Verification and Validation Special Controls

Analytical testing includes many of the same tests already required for an EUA:

• Limit of Detection (LoD)
• Inclusivity, including relevant variants
• Cross-reactivity
• Microbial interference
• Interfering substances
• Hook effect
• Inclusivity of relevant circulating variants
• Specimen stability
• Reagent stability
• Flex studies

However, there are some additional studies noted, specifically site-to-site reproducibility, within-lab precision, carryover and cross contamination, and competitive inhibition.  Previously, the EUA template only required these studies for Multiplex Respiratory panels in which a new instrument was used with the proposed device; however this De Novo was for a simple point-of-care device to detect SARS-CoV-2 viral targets only.

Final Release Criteria Special Controls

Sponsors will need to provide the final manufacturing release criterion with evidence that lots released at the extremes of the specification will still meet the claimed device performance (i.e., analytical, clinical and stability).  The Special Controls are silent on what would constitute appropriate levels of evidence necessary to satisfy this criterion.

Collection Device Special Controls

Sponsor will need to select a collection device that is either FDA-cleared, -approved, or -classified as 510(k) exempt (either as a standalone collection device or as part of a system) or alternatively the collection device can be cleared within the premarket submission for the POC test.

Clinical Testing Special Controls

In the Special Controls, there are two different criteria a sponsor can meet for their clinical study, each resulting in different indications for use:

Serial testing was defined as testing symptomatic individuals twice over three days with at least 48 hours between tests, which is in accordance with study findings from the National Institute of Health referenced here and current EUA labeling for serial testing.

The other requirements, listed below, for the clinical study are similar to previous recommendations included in the Antigen EUA template with some important subtle nuances to consider:

• prospective multi-site clinical study,
• geographically diverse intended use population,
• consistent with the intended use population and intended operators,
• conducted in a representative intended use setting,
• performance estimates derived for each claimed specimen, and
• compare results of the candidate device to an” FDA accepted” molecular comparator method.

For EUAs, FDA recommended the clinical evaluation be done at one to two sites; however, the Special Controls explicitly states the testing should be done in geographically diverse intended use populations, to ensure the device results represent “all present, circulating strains of the SARS-CoV-2.” It is not clear how sponsors are to meet this special control as prospective studies are executed in the months prior to the FDA review, given the time necessary to prepare for and submit a 510(k) in addition to the FDA’s premarket review timelines.  Even though only two sites are required, sponsors should consider including a sufficient number of sites to ensure geographic diversity and ability to capture all circulating strains in the study.

The selection of operators is another critical component of the study design and should be operators that would be typically expected to run simple tests in a POC environment and are not hired just to execute a clinical study.  We note the Special Controls indicated that the POC study needs to be conducted in the representative intended use setting so consider incorporating the testing into the operator’s existing workload.

Notably absent are details regarding what is considered an “FDA accepted” molecular method.  In the EUA template the FDA indicated sponsors should use a “RT-PCR which used chemical lysis step followed by phase extraction of nucleic acid (e.g., silica bead extraction) and reports cycle threshold values and be one of the more sensitive RT-PCR assays.”  We note the FDA has granted a De Novo and subsequent clearance for SARS-CoV-2 RT-PCR test which would seem to be the logical comparator of choice, however discussing the proposed comparator or even the use of a composite comparator with the FDA prior to initiating a clinical study is highly recommended.  Sequencing can be an important tool to understand the distribution of variants in the clinical study especially given the fact sponsors will be required to include a statement in their labeling regarding the predominant strain in the study.

Software Special Controls

If the device includes software or is an instrument with software, the software required under the special controls is consistent with the typical software documentation provided in 510(k) submissions.  In addition, similar to what was required for an EUA, sponsors should evaluate cybersecurity of their system to ensure user and patient safety in the intended use environment.

Continuous Monitoring and Post Market Reporting Special Controls

Within the Special Control for Risk Analysis are details regarding continuous monitoring.  The submission will need to include a “detailed description of a protocol for continuous monitoring, identification, and handling of genetic mutations and/or novel isolates or strains.”  The Special Controls provides the examples on what sponsors might do to monitor:

• regular review of published literature, and
• periodic in silico analysis of target sequences to detect possible mismatches.

Is this really as straightforward as reviewing literature and doing periodic in silico analysis? When reviewing FDA’s Policy for Evaluating Impact of Viral Mutations on COVID-19 Tests (Revised) dated January 12, 2023, the agency previously stated monitoring the impact on antigen tests is not as straightforward as monitoring the impact on molecular tests because antigen tests do not directly target the genetic sequence.  The Special Controls seem to leave it up the sponsor to determine if monitoring is required for all new circulating variants or only if they reach a threshold level of prevalence in the United States.  It is unclear what specific testing would be done to demonstrate the impact on established performance.  We know that FDA has asked sponsors to conduct Limit of Detection Studies with specific variants, but it is not clear what FDA’s expectations are for demonstrating equivalence.

The monitoring protocol also needs to include plans to update labeling with the additional performance data.  This data and any additional FDA-directed data analysis must be provided to the FDA, when requested or be made available during a routine evaluation.  FDA can request that sponsors provide this data within 48 hours of the Agency making said request.  While it is true sponsors will have the data on file, responding and providing the data within a 48-hour time-period can create stress in any organization.  And if you think a 48-hour turn-around time is fast, if novel respiratory pathogen strains or isolates impact the stated performance of the device, the data needs to be sent to the FDA immediately (although the specific trigger for such “immediate” notification is “unclear”).  While immediately is not defined, it could suggest a shorter turnaround time than the previously stated 48 hours.  The Special Controls is silent on defining to what extent a reduction in performance would require immediate reporting to the FDA.  In the prior FDA EUA guidance, a reduction of test performance of 5% or more from the established performance or a drop below the stated performance recommendation in the EUA templates were identified as thresholds for impact on performance, however it is unclear if this same threshold would be applied.

Emergency Analytical Reactivity Post Market Obligations Special Controls

Interestingly the Special Controls also add details regarding post market obligations if a new public health emergency is declared for the analyte detected and if FDA has characterized samples available for testing.  In this case, sponsors will have 30 days to complete testing in accordance with an FDA protocol.  Within 60 days and continuing for 3 years, sponsors will be required to include the results of that testing in the device’s labeling along with details about the samples used for the testing.

Labeling Special Controls

The labeling may seem like the easiest Special Control for demonstrating compliance.  Here we have broken out the requirements for the Indications for Use, Quick Reference Instructional Sheet, and Device Labeling.

Indications for Use

The indications for use should include the following:

• analytes detected,
• specimen types tested,
• indication for testing of respiratory specimens,
• clinical indications for which the test is used,
• specific intended population(s),
• intended use locations including testing location(s),
• statement regarding positive results,
• for symptomatic, number of days of symptom onset,
• statement regarding negative results,
• statement regarding the predominant strain during performance testing, and
• depending on the results of the clinical study serial testing requirement.

Quick Reference Instruction

The Quick Reference Instructions (QRI) should include, at a minimum, the following:

• name of the test,
• intended use of the test,
• easy to follow step-by-step instruction for controls,
• easy to follow step-by-step instructions for each sample type,
• graphic illustrations of each step,
• results interpretation guidance,
• warning and limitations,
• toxicology information and safety considerations for any hazardous materials,
• troubleshooting or frequently asked questions, and
• how to get technical assistance (e.g., Customer Support Help line).

Labeling Instructions for Use

The labeling should include the following:

• detailed device description,
• detailed description of performance characteristics,
• detailed descriptions of the test procedure(s), interpretation of results, and acceptance criteria for QC testing,
• statement regarding positive results and patient management decisions,
• detailed instructions on how to minimize exposure to infectious reagents included in the device,
• detailed instructions on how to minimize false positive results, and
• limiting statements regarding results and performance characteristics with the predominant strain.

As we stated previously, this submission took well over nine (9) months to review and develop the Special Controls.  After reviewing the Special Controls, we understand what took so long.  Unlike like the definition of “simple test,” the Special Controls are anything but simple.  Since the De Novo reclassification order on March 8, 2023, the FDA has recently posted the Quidel’s decision summary, which happed at warp speed as compared to this De Novo from July 2022, which still has yet to have its decision summary posted.  Stay tuned for a future post evaluating the details of the Quidel’s decision summary.

For those readers unfamiliar with the regulation of animal food ingredients in the United States, below is a brief background.

In the United States, animal food (feed) regulations are enforced by state and federal regulatory officials.  At the federal level, the Center of Veterinary Medicine (CVM) of FDA regulates food for animals, including livestock and pets.  As part of its regulatory responsibilities, CVM reviews the safety of new or modified animal food ingredients.  Such reviews may be in response to food additive or color additive petitions, or notifications that a substance is generally recognized as safe (GRAS).  In addition, CVM, on its own initiative, may propose an animal food additive or color additive regulation.

States frequently review labels (and labeling) for animal food products.  Part of this review involves the status of the ingredients included in the product.

The Association of the American Feed Control Officials (AAFCO) is a group of state, federal, and international regulatory officials that partner to support uniform animal food regulatory systems.  AAFCO develops model regulations, that serve as model for the states.  The goal is to create uniformity to facilitate interstate commerce.

A major component of AAFCO is its work on ingredient definitions, specifying what ingredients may be use in animal feed under what conditions.  AAFCO’s ingredient definitions are not federal regulations and do not have the force or effect of federal law. However, most states incorporate the ingredients listed in the AAFCO Official Publication (OP) into their state laws, so the AAFCO feed ingredient definitions facilitate the interstate marketing of animal food ingredients.  The AAFCO OP includes FDA approved feed and color additives, substances that are subject to GRAS notifications (AGRNs), etc.  Most states treat the OP as a “positive list” of ingredients that may be included in animal foods.  The absence of “common foods” in the OP has resulted in uncertainty as to whether such common foods can be used in animal foods.

On May 2, AAFCO announced that it had published its first installment of a common food index (CFI).  AAFCO defines “common food” as a food item “commercially available and suitable for use in animal food but [which is] not defined by AAFCO, including but not limited to certain whole seeds, vegetables, or fruits.” The CFI includes a list of common foods that “may be appropriate for use in animal food and serve as a tool for use during review of ingredients on an animal food label.”  The goal of this positive list is to provide harmonization, consistency, and transparency.

The first installment includes 72 foods. AAFCO is requesting stakeholders, such as veterinarians, animal nutritionists, consumer groups, and the public, to provide feedback on the initial CFI by June 2, 2023.  Comments may be submitted using a virtual form.  AAFCO has developed procedures for further review and determination as to what products will be included or removed from the CFI.  This document also describes an appeal procedure.

This by no means constitutes the complete list of common foods.  AAFCO has developed a process for submitting applications to add additional products to the CFI.  However, while AAFCO is receiving feedback on this first proposed list of products, applications for additional common foods are not accepted.

Inclusion on the CFI does not mean that the common food is safe.  Manufacturers are responsible for determining that the common food is safe and has utility for its intended use prior to commercial distribution as animal food.

Well, we’re a little late to blogging about this, but the significance of the ongoing Teva v. GSK litigation to Hatch-Waxman aficionados makes this case still ripe for blogging.

Six months after the Supreme Court asked the Solicitor General to submit a brief on behalf of the U.S. government in the now-infamous (at least in FDA circles) Teva v. GSK skinny label case, the U.S. Government submitted an Amicus Brief—not only signed by the Solicitor General, but also the lead attorneys representing the USPTO, HHS, and FDA—encouraging the Supreme Court to grant Teva’s Petition for Certiorari to address whether a generic company can be held liable for induced infringement where its label carves out a patent-protected method of using a product.

In the brief, the Government takes a strong position, stating “[t]he court of appeals’ holding that respondents presented sufficient evidence of petitioner’s intent to induce infringement is erroneous and warrants this Court’s review.”  Specifically, the Government explained, “[t]he section viii pathway cannot function properly if FDA and generic manufacturers cannot rely on an NDA holder’s representations to the agency regarding which portions of the brand-name drug’s labeling teach patented methods of use.”  Concerned about the uncertainty of the future of the skinny label after the Federal Circuit decision in this case and the potential for that decision to deter reliance on the skinny label, the Government asks the Supreme Court to grant a writ of certiorari and reverse the judgement of the Federal Circuit.

Agreeing with Judge Prost’s dissents in the Federal Circuit’s initial and rehearing decisions in this case, the Government argues that a generic’s labeling should not be treated as evidence of intent to induce infringement where that generic “plays by the rules of the section viii pathway” (internal citations omitted).  The Government’s concern goes far beyond this case: Like many generic drug sponsors, the Government raises concerns of the implications of the outcome of this case on the skinny label pathway itself.  The issue, according to the Government is that:

[A] jury may conclude that a generic manufacturer’s engagement in the precise conduct that the Hatch-Waxman Amendments contemplate—namely, marketing an FDA-approved generic version of a brand-name drug with labeling that carves out those indications that the brand-name manufacturer has identified to FDA as claimed by a method-of-use patent—is itself evidence of intent to induce infringement of the patented method.

If an FDA-approved carve-out could support an intent to induce infringement claim, the use of the “section viii pathway would be substantially deterred.”  To maintain the legitimacy of the section viii pathway and mitigate the effects of this decision, the Government urges the Supreme Court to hear this case.

While the Government’s concerns in this case are geared more towards the decision’s downstream effect on the skinny-label and generic competition, the Government does not mince words when talking about the facts at issue in Teva v. GSK.  Plainly, the Government brief states “The decision below is incorrect. No reasonable jury could have concluded that the carved-out labeling for petitioner’s generic carvedilol from 2007-2011 was itself evidence of intent to induce infringement.”  Where the generic sponsor has carved-out the specific indication identified in the Orange Book as covered by the method of use patent, the Government argues, the generic labeling “cannot provide the requisite evidence of specific intent to induce infringement . . . .”  Other communications may suffice to show infringement, but carved-out labeling more accurately reflects an intent not to encourage infringement, reasons the Government, extensively citing Judge Prost’s Federal Circuit dissent.  Here, the Government explained, the carved-out labeling was insufficient to show intent to infringe, as that labeling was dictated by FDA regulatory requirements and GSK’s use code.  Instead, the Government takes the position that, to support an inference of intent to induce infringement, independent evidence that the generic sponsor understood its carved-out labeling to encompass patented uses and proof that petitioner expected and encouraged doctors to rely on the labeling should be necessary.

The Government’s brief puts a lot of faith in the existing regulatory system rather than the patent system.  Because FDA cannot review patent claims, the Agency must rely on the brand-name manufacturer’s use code description to permit carve-outs, and the generic sponsor is limited to the use code in proposing use code carve-outs.  Allowing induced infringement claims based on the carve-out, which is governed by the use code, allows for some serious gamesmanship; so rather than sue for induced patent infringement, the Government points to the pathways for resolution under the regulatory system.  The Government suggests that GSK should have submitted a Citizen Petition regarding the carve-out or request that FDA stay the approval of the ANDA for further administrative review.  The Government chastises GSK for failing to use these options (though the availability of these options in this circumstance is questionable, and, more generally, the utility of these options also is questionable).

The Government urges the Supreme Court to take this case because of FDA’s concern that the potential for liability “may discourage manufacturers from invoking the section viii pathway, thereby decreasing the availability of lower-cost generic drugs” even if that liability is rarely imposed.  Further, despite the insistence by the Federal Circuit and GSK that the case is limited to the fact pattern at issue here, the Government is concerned that the facts at issue here—particularly the background facts—are likely to be present in most skinny label cases.  In short, the Government, like Judge Prost, is concerned that the Federal Circuit decision in this case is so extrapolatable that “generics simply won’t play” and “the section viii pathway will be seriously jeopardized.”

It’s important to note here that the Government’s brief was signed by both FDA and the USPTO.  The two have long been encouraged to collaborate more, and it seems that this case has presented a prime opportunity.  That the USPTO, charged with furthering effective IP protection, agrees with FDA with respect to the application of the induced infringement scheme should not be overlooked.  FDA’s signature here is also significant.  The Agency delegated with authority to execute the skinny label pathway is concerned about the viability of the skinny label.  That should legitimize generics’ concerns about the death of the skinny label after this case—particularly if the background facts are similar across skinny label cases, as the government portends.

However, the Government’s suggestion that the facts will be similar across skinny label cases is flatly denied by GSK in the pleadings.  GSK filed a supplemental brief in response to the Government’s brief.  That brief criticizes the government brief for “rewrit[ing]” the “facts of this case and the documented history of the section viii ‘carve-out’ process” in order “to reach the result it wants.”  GSK goes through the factual history of the matter in great detail, arguing that FDA’s regulatory alternatives simply were not available here.   GSK appears to be encouraging the Court to focus only on the specific facts at hand rather than the parade of horribles the government and other amici have represented.  This case, in other words and according to GSK, will not destroy the skinny-label statutory scheme by leaving it open to induced infringement issues; the holding will be limited to the facts of this case because the facts of this case are so special.  But even if it were that significant, GSK points out that “Congress is the proper forum for the government’s policy-driven argument.”

Whether the Court takes up Teva v. GSK is still up in the air.  Given that the Supreme Court takes so few cases, chances are low that the justices ever hear it.  Nevertheless, we’re optimistic that we’ll be hearing more about the case and the skinny label in the near future, whether from the Supreme Court or the inevitable battle in Congress.

We blogged earlier this week here that DEA is reconsidering its proposed rules for telemedicine prescribing of controlled substances and buprenorphine. Today is indeed the official “end” of the COVID-19 pandemic Public Health Emergency (PHE) Declaration, and DEA, jointly with the Substance Abuse Mental Health Services Administration (SAMHSA), have announced the issuance of a temporary rule extending the PHE telemedicine exemptions, as described below.  DEA states the temporary rule will take effect today, and “extends the full set of telemedicine flexibilities adopted during the COVID-19 public health emergency for six months – through November 11, 2023.”  In addition, concerning any practitioner-patient telemedicine relationships that have been or will be established up to November 11, 2023, all telemedicine flexibilities concerning prescribing of controlled substances established during the COVID-19 PHE will also be extended for one year – through November 11, 2024.  

This much welcomed — and needed — extension of the telemedicine flexibilities is a result of DEA’s receipt of over 38,000 comments on its set of proposed telemedicine rules for controlled substances and for buprenorphine treatment. We applaud DEA’s and SAMHA’s recognition that:

[T]he goal of this temporary rule is to ensure a smooth transition for patients and practitioners that have come to rely on the availability of telemedicine for controlled medication prescriptions, as well as allowing adequate time for providers to come into compliance with any new standards or safeguards that DEA and/or SAMHSA promulgate in one or more final rules.

88 Fed. Reg. 30,038 (May 10, 2023).

This time around, DEA is acting jointly with SAMHSA, which agency “concurs” with the temporary rule, and has advised DEA that no additional rulemaking is necessary at this time other than the temporary rule, nor are amendments required to 21 U.S.C. § 802(54)(G) (which references CMS’s statutory definition of “practice of telemedicine”). DEA’s preamble sets forth the temporary rule’s purpose:

• Facilitates continuity of care;
• Prevents backlogs concerning in-person medical evaluations in the months before and after the expiration of the COVID–19 PHE declaration;
• Ensures the availability of telemedicine for practitioners and patients that have come to rely on it;
• Addresses the urgent public health need for continued access to the initiation of buprenorphine for opioid use disorder in the context of the continuing opioid crisis;
• Allows patients, practitioners, pharmacists, service providers, and other stakeholders sufficient time to prepare for future regulations;
• Enables DEA and SAMHSA to review the 38,369 comments in response to the proposed rules; and
• Permits time to consider regulatory alternatives that may effectively expand access to telemedicine, which “alternatives may be consistent with public health and safety, while maintaining effective controls against diversion.”

More specifically, the temporary rule adds new regulatory sections 21 C.F.R. §1307.41and 42 C.F.R. 12.1, effective May 12, 2023 through November 11, 2024,  Telemedicine relationships that are included in this period must be “in effect” as of November 11, 2023.  It is extremely important to keep in mind that telemedicine relationships that are in effect or that are established for the prescribing of controlled substances including buprenorphine must include all of the following:

• First, the prescription must be issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice.

• Second, the prescription must be issued pursuant to a communication between a practitioner and a patient using an interactive telecommunications system referred to in CMS requirements for telemedicine services set forth at 42 C.F.R. § 410.78(a)(3). More specifically, it must be issued using audio and video  equipment permitting “two-way, real-time interactive communication or, for prescriptions to treat a mental health disorder—which include, but are not limited to, prescriptions for buprenorphine for opioid use disorder—a two-way, real-time audio-only communication if the distant site physician or practitioner is technically capable of using an interactive audio-video telecommunications system, but the patient is not capable of, or does not consent to, the use of video technology.”

• Third, the practitioner must be authorized by DEA to prescribe the basic class of controlled medications specified on the prescription or otherwise exempt

• Fourth, the prescription must be consistent with all other requirements of 21 C.F.R. part 1306 (which include DEA’s general requirements for prescribing controlled substances);

88 Fed. Reg. at 30,039 (emphasis added).

By any measure, prescribers that handle controlled substances and  have engaged actively in a telemedicine practice since the onset of the pandemic, and patients that have come to rely on needed telemedicine relations and resulting controlled substance prescriptions, have been granted a reprieve from an imminent retraction in services and the potential for DEA enforcement activity. The plain message here is that citizens and industry commented — loudly, and both DEA and SAMHSA are listening.  We hope that prudent use of the practice of telemedicine continues during this longer transition period while both DEA and SAMHSA meaningfully evaluate the more than 38,000 comments received.

We were listening to a radio interview last week with Lina Khan, the Chair of the Federal Trade Commission (“FTC”).  In the interview, Khan spoke about the Commission’s efforts to regulate geolocation data trackers so that they don’t abuse their abilities. The risks she described caught our attention because two of the risk profiles she cited included things that touched on FDA-related entities, such as medical devices that transmit data. See, e.g., here.

“We have taken several actions that just in the last few months that have been making sure we’re protecting people’s sensitive information via geolocation data that people can buy to track with great precision” said Khan, “whether people are going to addiction facilities or places of worship or seeking reproductive health service.”

Khan was referencing a suit that FTC and DOJ filed against Kochava, a prominent location data broker, in August 2022.  The interview aired on Monday, May 1.  The rest of Khan’s week didn’t go as well.

On Thursday, a District Court judge in Idaho issued a pair of mixed rulings relating to the FTC’s case against prominent location data broker Kochava.  The news wasn’t all bad for the government, but FTC’s now has some decisions to make.

Back in the Summer of 2022, FTC approached Kochava about its contemplated suit against the company for violations of the FTC Act.  Kochava decided to strike first and sued the FTC, hoping to preempt the pending enforcement suit.  Undeterred, FTC moved ahead with its case.

When FTC brings data privacy cases against tech companies, it does so under the provisions of the FTC Act that prohibit “unfair or deceptive” practices.  Deceptive practices are the frequent bedrock legal theory for these cases.  Tech companies that don’t live up to their promises to safeguard consumer data are frequent targets of the FTC.

The case against Kochava is a little different.  The complaint does not describe deceptive practices, instead alleging that Kochava was acting unfairly.  According to the FTC and DOJ, the sale of consumers’ geolocation data to publicly accessible on-line data marketplaces is unfair because it potentially puts those consumers at risk.  Advertisers, the complaint says, aren’t the only digital entities hoping to make use of data showing where people go.  Those with more malevolent—unfair?—intent may also exploit that information.  This is what Khan was describing in her interview.

On Thursday, the judge overseeing the parallel cases made two, mixed rulings.  To the benefit of the FTC, the judge permanently dumped the company’s pre-emption suit.  He ruled that it was a “race-to-the-courthouse declaratory action” that Kochava filed without the purpose of “seeking any real affirmative declaratory relief . . . .”  In the court’s opinion, Kochava was asking it to “pre-determine that the FTC anticipated lawsuit would fail.”  While there are some cases where seeking to preclude agency action might work, it would be a remarkable decision for a federal judge to rule on the merits of an enforcement suit before it was filed, as Kochava was asking here.

But the judge also dealt a blow to the government, dismissing its suit against Kochava.  Khan is correct in that one can easily envision how the sale of location data might unfairly put consumers at risk, but the judge in Idaho ruled that the FTC had not effectively alleged facts that show a likelihood of substantial consumer injury.  FTC’s case did not rely on specific instances of realized consumer unfair harm related to the sale of geolocation information.  In this case, the potential for harm was not enough to sustain the suit.

However, FTC may get another crack at this.  The ruling left open the door for FTC to file an amended complaint that relies more on specific factual evidence.  So, the government here has a choice to make.  FTC will need to investigate further and put together some data specific to Kochava, it seems, since they didn’t include it in the first suit. If the parade of horribles they envision isn’t as evincible as it is imaginable, then pressing the suit against Kochava looks to be more challenging.

As a final note, we would note that it doesn’t seem difficult to envision this case affecting many FDA-regulated companies.  We’ve written before (see here too) about how medical device companies are truly data companies to the extent they promote software or are otherwise connected to the internet. By their very nature as regulated medical products, they traffic in data that is similarly sensitive to the geolocation information at issue in the Kochava case.  As FDA continues to both build its cybersecurity and digital health infrastructure and strengthen its cross-agency relationship with FTC, we can’t help but wonder how soon we’ll see an action like this against a device company.

FDA recently published a long-awaited draft guidance aimed at reducing the need for prior FDA authorization of modifications to artificial intelligence/machine learning (AI/ML)-enabled device software functions (ML-DSFs).  The draft guidance, “Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence/Machine Learning (AI/ML)-Enabled Device Software Functions,” describes the information on planned modifications that should be included with an initial premarket submission to enable FDA to prospectively evaluate a manufacturer’s process for implementing software changes.

History of the Development of Predetermined Change Control Plans

Traditionally, manufacturers seeking to make improvements or updates to their software device functions have needed to consider whether a new marketing submission is required, based on criteria specified in FDA regulations that focus on the potential impact of the proposed modifications on safety and effectiveness.  See 21 CFR 807.81(a)(3) and 21 CFR 814.39(a), and related guidance documents (e.g., here for a 510(k) device and here for a PMA device).  The purpose of a predetermined change control plan (PCCP) is to avoid the need for such post-market assessments – and the delay and expense entailed when it is determined that a new submission is needed – through prospectively defining a process for making post-market changes.

The draft guidance follows the December 2022 enactment of the Food and Drug Omnibus Reform Act of 2022 (FDORA).  FDORA added section 515C, “Predetermined Change Control Plans for Devices” to the Federal Food, Drug, and Cosmetic (FD&C) Act.  Section 515C authorizes FDA to approve a PCCP submitted as part of a PMA or 510(k) submission and to require that such PCCP include (a) labeling required for safe and effective use of the device as it changes; (b) notification requirements if the device does not function as intended pursuant to the plan, and (c) performance requirements for changes made under the plan.  Once FDA has cleared or approved a PCCP, that statute states that a supplemental application “shall not be required” to make a change consistent with such PCCP.

Although FDORA gave FDA express authority to allow PCCP , FDA had already been considering creating a mechanism for manufacturers to prespecify modifications for AI/ML-based software subject to 510(k) premarket notification and de novo classification for several years.

The 2019 discussion paper, “Proposed Regulatory Framework for Modifications to Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD) – Discussion Paper and Request for Feedback,” introduced the PCCP principle as a means to “enable responsible performance enhancements in AI/ML technologies.”  The discussion paper described a PCCP as including (1) the types of anticipated modifications (SaMD Pre-Specifications or SPS) based on the retraining and model update strategy and (2) the associated methodology  (Algorithm Change Protocol or ACP) being used to implement those changes in a controlled manner to manage patient risks.

In February 2020, FDA granted a de novo classification request (DEN190040) for software intended to assist medical professionals in the acquisition of cardiac ultrasound images and that included a PCCP for future software modifications.  The reclassification order established a Special Control requiring the inclusion of a “detailed protocol that describes, in the event of a future, change, the level of change in the device technical specifications or indications for use at which the change or changes could significantly affect the safety or effectiveness of the device and the risks posed by these changes.”  Additionally, it stated that the “assessment metrics, acceptance criteria, and analytical methods used for the performance testing of changes that are within the scope of the protocol must be included.”

In January 2021, as part of its “Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD) Action Plan,” FDA committed to issuing a draft guidance on PCCPs that would address the content of SPSs and ACPs and identify the types of modifications appropriate under a PCCP.  That draft guidance has now been issued.

Overview of the Draft Guidance

The draft guidance describes a PCCP as a “plan that includes device modifications that would otherwise require a premarket approval supplement, De Novo submission, or a new premarket notification.”  It states that FDA will review a PCCP for a ML-DSF as part of the initial marketing submission and “authorize” it in whole or in part, i.e., permit either all of the proposed modifications or only some of them.

Proposed modifications should be consistent with the device’s intended use and indications for use and be “intended to maintain or improve the safety and effectiveness of the device.”  Manufacturers should be able to verify and validate the proposed modifications within their existing quality system.

Post-market, manufacturers can make modifications consistent with the PCCP and document the modification in accordance with their quality system, without the need for a new marketing submission.  Modifications that are not consistent with the authorized PCCP, however, must be evaluated in accordance with the traditional regulatory process described in applicable regulations and guidances referenced above.

The draft guidance provides examples of modifications that may be included in a PCCP, including:

• modifications related to quantitative measures of the ML-DSF performance specifications, including improvements to analytical and clinical performance resulting from re-training the ML model based on new data from the same type of input signal;
• modifications related to device inputs to the ML-DSF which may involve including new sources of same signal type; and
• modification related device’s use and performance for use within a specific subpopulation that was part of the originally indicated population.

Components of a PCCP

The draft guidance describes the sections that should be included as part of a PCCP and the specific information that should be included under each section.  The sections are: (1) description of modifications; (2) modification protocol; and (3) impact assessment.

Description of Modifications

The PCCP should include a detailed description of the changes to “device characteristics and performance” that are expected to result from proposed modifications.  FDA recommends that PCCPs specify only a “limited number” of modifications but does not provide a limit on the number of modifications that can be included.

Both automatic and manual modifications can be included in a PCCP, so manufacturers should indicate the proposed implementation strategy for each modification.  In addition, manufacturers should identify whether the modifications will apply to all devices in the field (referred to as global adaptations) or will be implemented based on a specific clinical site or individual patients” (referred to as local adaptations).  For local adaptations, information should be included addressing what “local factors or conditions warrant a local change.”

FDA recommends manufacturers submit each modification, associated labeling changes and specific performance evaluation in the Modification Protocol (MP).

Modification Protocol

The modification protocol (MP) describes the methods that will be followed when “developing, validating, and implementing those modifications, to ensure the device remains safe and effective.” For each proposed modification, the MP should describe:

1. Data management practices: The MP should address how new data will be “collected, annotated, curated, stored, retained, controlled and used”; identify any relationship between the new data and the original data used for training and testing the initial device; define any data sequestration strategies and explain how the data are separated into training and testing dataset; and ensure that access to the testing datasets is restricted to prevent the use of that data for training.
2. Re–training practices: The MP should state whether the model will need to be re-trained. If retraining applies to only certain parts of the ML-DSF, manufacturers will need to demonstrate that re-training does not affect other functions or software components.  The MP should also discuss how the manufacturerr will address risks associated with overfitting and model bias when re-training.
3. Performance evaluation protocols: The MP should include plans to verify and validate modifications. If the proposed performance evaluation methods are different from the original methods used, the manufacturer should describe the differences and provide a justification for the changes.  Just like any other verification or validation activity, the protocol should include pre-defined acceptance criteria and any statistical tests used.  Since the manufacturer will be implementing the change without FDA premarket review, this section of the MP will need to include a statement that if there is a failure in performance, the failure will be recorded and the modification will not be implemented.
4. Update procedures: The MP should describe how the manufacturer will update the software and any associated labeling that will be required for the modifications. Updates performed automatically will face a “higher bar” for demonstrating safety and effectiveness.  For automatic updates, the MP will need to describe how the software will be updated; how legacy users may be affected by the modification;  how users will be made aware of the modification; and any impact on performance that could be caused by the modification (e.g., whether clinically meaningful differences may be observed in patient results before and after the modification).  Further, the MP should address how version information will be presented to the user for the modified device.  In addition, manufacturers may need to establish a device monitoring plan that will address how they will monitor post market device performance of the modifications, including monitoring real-world device performance or justify why that device monitoring is not necessary.

The draft guidance includes an appendix with example elements that may be required in a MP depending on the size, scope, complexity, and risk associated with each proposed modification.

Impact Assessment 

A PCCP should include an impact assessment that evaluates the risks and benefits of the modifications and how any risks will be mitigated.  The impact assessment can be included with the MP or provided as a stand-alone document, and should include:

1. a comparison of the version of the device without modification to the version of the device with the modifications implemented;
2. risks and benefits of the modifications;
3. how the MP will continue to reasonably ensure safety and effectiveness;
4. how the implementation of one modification affects the implementation of another; and
5. the cumulative impact of all modifications.

Things to Consider When Deciding Whether to Include a PCCP

PCCPs provide a new mechanism for introducing certain significant changes to an ML-DSF.  The use of a PCCP is not required; a manufacturer can continue to implement significant device changes via supplemental submissions to FDA.  However, including a PCCP can speed up the process of making post-market software modifications and potentially reduce costs by avoiding additional marketing submissions.

Once authorized, a PCCP is considered a technological characteristic of the authorized device.  Consequently, details of the PCCP would be included in the 510(k) Summary, De Novo decision summary, or PMA Summary of Safety and Effectiveness.  Manufacturers seeking to modify a PCCP once it has been authorized will need to submit the modified PCCP as part of a marketing submission for FDA’s review.  The PCCP is applicable only to the device that was the subject of the market authorization in which it was included, which means that, if the manufacturer makes other changes to the device before implementing the modifications outlined in the PCCP, a new submission for the modified device will be needed to reestablish the PCCP.

The Agency recommends that manufacturers discuss the PCCP strategy with FDA through the Q-Submission program before submitting a marketing submission with a PCCP.  We note that FDA has already updated the eStar template to include a separate section indicating whether the sponsor is including a PCCP with the submission and a mechanism to attach it to the submission.

Industry stakeholders seeking to provide feedback to FDA can submit comments to  Docket: FDA-2022-D-2628 by July 3, 2023.

On May 3, 2023, DEA’s Administrator Anne Milgram issued a very brief and lightly publicized statement announcing that DEA intends to issue a “temporary rule” extending telemedicine flexibilities that existed during the COVID-19 Emergency Declaration, which Declaration is set to expire on May 11, 2023.  Most notably for the millions of patients who, for over three years, have depended on telemedicine solutions to receive needed controlled substance medications, the Declaration’s expiration would also put an end to DEA’s flexibilities permitting certain exemptions to the Ryan Haight Online Privacy and Consumer Protection Act’s in-person examination requirements.

As a reminder, back in February 2023, HPM blogged about DEA’s two proposed rules for prescribing controlled substances generally, and for buprenorphine use in opioid treatment.  HPM also conducted a  90-minute webinar addressing the “End of the COVID-19 Emergency and the Ryan Haight Act: Telemedicine and Next Steps.” HPM’s Presentation Deck and Recording of the Presentation. slides are here, and here (passcode Bv3*o^i5).

Why is DEA now putting the brakes on its rulemakings, given the Emergency Declaration expires in just a week? DEA states that it received over 38,000 (yes, 38,000!) comments on the proposed rules.  DEA is taking these comments “seriously” and is considering them “carefully,” which, by the way, it is generally required to do for rulemakings issued pursuant to the Administrative Procedure Act (5 U.S.C. §553).   See Perez v. Mortg. Bankers Ass’n, 575 U.S. __, 135 S. Ct. 1199, 1203 (2015) (“An agency must consider and respond to significant comments received during the period for public comment.”).

DEA and HHS have submitted a draft Temporary Rule to the Office of Management and Budget titled “Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications.”  We eagerly await further details about the temporary rule.  We will update our readers when the temporary rule is published – hopefully soon– in the Federal Register.

On May 2nd, FDA released a new draft guidance with recommendations for decentralized clinical trials (DCTs) for drugs, biologics, and devices.  A DCT is a clinical trial where some or all of the trial-related activities, such as administration of the investigational product, data collection, or safety monitoring, occur at locations other than traditional clinical trial sites.  In a DCT, trial-related activities may occur in trial participants’ homes, at local health care providers’ offices, or in local clinical laboratories.

DCTs became more common during the COVID-19 public health emergency, when sponsors were motivated to conduct more clinical trial activities remotely in order to avoid in-person interaction.  This draft guidance builds on recommendations that FDA initially developed early in 2020, in response to the COVID-19 challenges (see our blog post on these recommendations here).

Section 3606(a) of the Food and Drug Omnibus Reform Act (FDORA) directed FDA to “issue or revise draft guidance that includes recommendations to clarify and advance the use of decentralized clinical studies to support the development of drugs and devices,” not later than December 29, 2023.  This draft guidance was published in response to this statutory mandate.

The draft guidance notes that DCTs may not be feasible for all study designs.  Notably, the draft guidance explains that variability of the data obtained in a DCT, compared to a traditional clinical trial, could affect the validity of finding non-inferiority but would not affect the validity of a finding of superiority.  For example, in a non-inferiority trial where the effect size of an active control drug has only been determined in a traditional clinical trial, the same effect size may not be seen for the active control drug in a DCT.

With regard to clinical trial visits and activities, the draft guidance provides examples of the types of approaches that may be possible with a DCT.  Study visits can be conducted using telehealth visits if in-person interaction is not necessary.  Trial personnel can also be sent to participant’s homes.  Visits can also potentially be conducted by local health care providers close to a participant’s home, rather than clinical trial personnel.

DCTs often include the use of digital health technologies (DHTs), which is technology that can be used to remotely capture and transmit health care information.  DHTs include monitoring instruments (e.g., activity trackers, glucose monitors) and software (e.g., mobile applications to capture patient-reported outcomes through questionnaires).

The draft guidance is part of a larger FDA initiative related to DHTs.  For example, in March 2023, FDA issued a Framework for the Use of Digital Health Technologies in Drug and Biological Product Development, which noted that FDA would publish guidance on the use of DHTs in both traditional and decentralized clinical trials.  FDA has created a DHT for Drug Development website and an email address for questions related to DHT-derived data (dhtsfordrugdevelopment@fda.hhs.gov).  FDA has also launched a series of five public workshops on issues related to DHTs in regulatory decision-making.

The draft guidance cautions that any DHTs used in a DCT should be “available and suitable” for all trial participants.  If participants are permitted to use their own DHTs, sponsor-provided DHTs should be available as an option to avoid excluding participants from the trial due to lack of available technology.  In a CDER Conversation regarding DCTs and DHTs, Leonard Sacks, Associate Director for Clinical Methodology in CDER’s Office of Medical Policy, noted that there is a risk that technical hurdles could skew a trial population to a “younger and more tech savvy” population compared to the actual patient population.

DCTs also have the potential to increase diversity and inclusiveness in trial populations.  The draft guidance states that the use of local health care providers, for example, may “improve engagement, recruitment, and retention of diverse participants” and “may reduce cultural or linguistic barriers.”  Dr. Sacks also explained that DHTs and DCTs may “open access to research” for older individuals and people with disabilities who are not able to travel to clinical trial sites, but could participate from home or a nearby clinic.

The draft guidance outlines some of the practical considerations for DCTs with regard to recordkeeping and clinical trial operations.  For example, the draft guidance notes that the trial’s data management plan should include information about the multiple sources of data collection.  Additionally, the draft guidance describes when local health care providers may be considered sub-investigators for purposes of completing Form FDA 1572 (for drugs) or the list of investigators in an investigational device exemption (IDE) (for devices).  Investigators should also maintain a task log of all local health care providers who perform trial-related activities.

The draft guidance also states that informed consent can be collected remotely or electronically as part of a DCT, so long as there is institutional review board oversight.  The informed consent process should inform participants whom they should contact with questions.

The draft guidance describes situations when an investigational product should be administered with in-person supervision by an investigator at a trial site versus shipped to a patient’s home.  Investigational products that involve complex administration procedures or have a high-risk safety profile may require in-person supervision, while products for which the safety profile is well-characterized and do not involve specialized monitoring could be administered at home without direct supervision.  The stability profile of the product must be considered when a product is shipped to a participant’s home.

The draft guidance provides recommendations related to the safety monitoring plan in a DCT.  The safety monitoring plan should ensure that all adverse events are appropriately captured and addressed despite the decentralized nature of the trial.  There should also be a plan in place for responding to adverse events, including how participants are expected to seek medical assistance locally when necessary.

Finally, the draft guidance addresses the use of software in a DCT.  All parties using software should be trained on how to use it properly.  Any software that is used to produce or process trial records must be compliant with the requirements in 21 C.F.R. Part 11.  FDA considers real-time video interactions to be a live exchange of information between trial personnel and trial participants, so these interactions are not subject to Part 11, though local laws regarding telehealth may apply.

FDA is accepting public comment on the draft guidance until August 1.

FDA posted the last five “deemed final orders” under OTC monograph reform this week.  All 33 of the final orders can now be found at OTCMONOGRAPHS@FDA.  Under the 2020 Coronavirus Aid, Relief, and Economic Security Act (CARES Act) (see our blog post here), all final monographs (i.e., the regulations formerly found in 21 C.F.R. parts 331 through 358) were deemed to be final administrative orders as of the CARES Act effective date.  As part of the implementation of monograph reform, the deemed orders were to be posted on FDA’s website.

As the first step in implementing this provision of the CARES Act, FDA issued a Federal Register notice on September 21, 2021, announcing the availability of the first group of deemed final administrative orders (see our blog post here).  The initial group posted also included the administrative order containing a list of certain active ingredients offered for certain OTC uses FDA had found to be non-monograph conditions (former 21 CFR § 310.545).  The deemed final orders posted this week are from the therapeutic areas of anticaries drug products, external analgesics, first aid antibiotics, first aid antiseptics, and laxatives.

At the moment, all 33 final monographs can be found on FDA’s website and in the CFR (on-line and in the paper volumes for those of us who still look forward to the new color each year).  FDA announced that it will be taking the next step of issuing a notice to withdraw the regulations establishing final monographs in the CFR.  With that withdrawal, the administrative tasks associated with changing final monographs from regulations to final administrative orders will be complete and the 21 CFR volume including Part 300 et seq will be noticeably thinner next year.

Accounting for controlled substances, maintaining complete and accurate records/reports and employing effective, compliant security do not alone guarantee a successful Drug Enforcement Administration (“DEA”) inspection.  A negative DEA inspection can plague registrants for years.

Hyman, Phelps & McNamara, P.C. (“HP&M”) invites you to join Director Larry Houck for a free webinar demystifying DEA inspections by providing an understanding of controlled substance accountability audits, the importance of conducting mirror reviews and mock DEA-style internal inspections.  The webinar will share additional valuable inspection tips.

Registrants are far from powerless when DEA investigators inspect their controlled substance operations.  This webinar will provide insight on how to prepare for and manage inevitable DEA inspections to help ensure favorable results.

Before joining HP&M in 2001, Mr. Houck conducted numerous scheduled cyclic and targeted inspections and investigations as a DEA Diversion Investigator in the field for ten years.  He later served as Staff Coordinator in Diversion Control’s Liaison and Policy Section at DEA headquarters.

We hope that you will be able to join us!  Please see the attached flyer that includes a link to register for the webinar.

On the day I was born
The nurses all gathered ‘round
And they gazed in wide wonder
At the joy they had found
The head nurse spoke up
Said, “Leave this one alone”
She could tell right away
That I was bad to the bone

As we noted in our post yesterday, on May 2nd, the U.S. Senate Committee on Health, Education, Labor and Pensions (“Senate HELP”) is scheduled to discuss in an Executive Session various pieces of FDA legislation.  Among those pieces of legislation—all intended to shield FDA from litigation in some way, shape, or form—is the latest version of the “Bringing Low-cost Options and Competition while Keeping Incentives for New Generics Act,” which is better known as the “BLOCKING Act,” and that would significantly alter the ANDA Paragraph IV 180-day exclusivity incentive.  This time, however, it is called the “Expanding Access to Low-Cost Generics Act of 2023” (S. 1114).

The BLOCKING Act has been floating around as a legislative proposal since February 2018 when it appeared in the Trump Administration’s Proposed Fiscal Year 2019 Budget (pages 22 and 51).  It has drawn this blogger’s ire in prior blog posts (here, here, here, and here) and in Congressional testimony as antithetical to a primary goal of the Hatch-Waxman Amendments: getting high quality, low-cost generic drugs into the hands of consumers—fast.  It made some headway last year as as part of the Senate HELP-passed S.4348, the “Food and Drug Administration Safety and Landmark Advancements Act of 2022” (Section 515), but ultimately was not enacted.  Then earlier this year, the BLOCKING Act reappeared as a proposal in FDA’s Summary of FY 2024 Legislative Proposals:

Amend the 180-Day Exclusivity Provisions to Encourage Timely Marketing of First Generics

FDA is proposing that the FD&C Act be revised to specify that 180-day patent challenge exclusivity for generic drugs does not block approval of subsequent applications from other generic drug manufacturers until a first applicant begins commercially marketing the drug; this revision should ensure that the exclusivity period lasts 180 days (i.e., from the date of first commercial marketing by a first applicant until 180 days later) rather than for multiple years, as can occur under current law (i.e., while the first applicant is eligible for 180-day exclusivity prior to commercial marketing in addition to the 180-day period itself). 180-day patent challenge exclusivity is intended to provide an incentive and a reward to the first generic drug applicant(s) to submit a substantially complete application with a certification that a patent listed for its reference listed drug is invalid, unenforceable or not infringed by the ANDA, and thus expose themselves to the risk of patent litigation. Forfeiture provisions, under which a first applicant may lose its eligibility for this exclusivity, also seek to motivate first applicants to begin marketing quickly in order to reap the benefits of this marketing exclusivity. In practice, however, the framework has not been operating to encourage early generic entry. First applicants often “park” their eligibility for this exclusivity either by declining to begin marketing their product for extended periods of time after ANDA approval, or by delaying receipt of final approval of their ANDAs for extended periods of time, while avoiding a forfeiture. FDA’s proposal would substantially increase the likelihood that generic versions of patent-protected drugs will come into the market in a timely fashion, and that multiple versions of generic products will be approved quickly (leading to significant cost savings).

The current iteration of the BLOCKING Act that is the “Expanding Access to Low-Cost Generics Act of 2023” (S. 1114) and that Senate HELP will discuss on May 2nd would, like its progeny, further dilute the 180-day exclusivity incentive by amending the Paragraph IV 180-day exclusivity statutory provisions at FDC Act § 505(j)(5) to place new conditions on when a subsequent Paragraph IV ANDA can be approved notwithstanding a first applicant’s eligibility for 180-day exclusivity.  But unlike its progeny, S. 1114 includes a new proviso that is intended to guard against a subsequent Paragraph IV ANDA gutting the exclusivity incentive, and would thus somewhat blunt the negative effective of the proposal.  Below is the relevant text from the bill with proposed additions to FDC Act § 505(j)(5)(B)(iv) identified in red, italicized, bold typeface:

(iv) 180-DAY EXCLUSIVITY PERIOD.—

(I) EFFECTIVENESS OF APPLICATION.—Subject to subparagraph (D) and subclause (III), if the application contains a certification described in paragraph (2)(A)(vii)(IV) and is for a drug for which a first applicant has submitted an application containing such a certification, the application shall be made effective on the date that is 180 days after the date of the first commercial marketing of the drug (including the commercial marketing of the listed drug) by any first applicant or an applicant whose application was approved pursuant to subclause (III). If an applicant described in subclause (III) is eligible for effective approval on the same day a tentatively approved first applicant who has requested final approval is determined by the Secretary to be eligible for effective approval by meeting all the approval requirements of this subsection, such applicant described in subclause (III) may not receive effective approval until 180 days after the first applicant begins commercial marketing of the drug. . . .

(III) APPLICANT APPROVAL.—The Secretary may approve an application containing a certification described in paragraph (2)(A)(vii)(IV) that is for a drug for which a first applicant has submitted an application containing such a certification, notwithstanding the eligibility of a first applicant for the 180-day exclusivity period described in subclause (II)(aa), if each of the following conditions is met:

(aa) The approval of such application could be made effective, but for the eligibility of a first applicant for 180-day exclusivity under this clause.

(bb) The applicant of such application has submitted a certification to the abbreviated new drug application that there are no conditions that would prevent the applicant from commercial marketing within 75 days after the date of approval and that the applicant intends to so market the drug.

(cc) At least 33 months have passed since the date of submission of an application for the drug by at least one first applicant.

(dd) Approval of an application for the drug submitted by at least one first applicant is not precluded under clause (iii).

(ee) No application for the drug submitted by any first applicant is effectively approved on the date that the conditions under items (aa), (bb), (cc), and (dd) are all met and maintained.

New to the above calculus included in prior versions of the BLOCKING Act is the addition of a “tie-goes-to-the-runner” provision at proposed FDC Act § 505(j)(5)(B)(iv)(I), a longer (i.e., 33-month instead of 30-month) period under proposed FDC Act § 505(j)(5)(B)(iv)(III)(cc) to account for longer ANDA approval times, and an additional criterion at proposed FDC Act § 505(j)(5)(B)(iv)(III)(bb) requiring a subsequent Paragraph IV applicant to certify that “there are no conditions that would prevent the applicant from commercial marketing within 75 days after the date of approval and that the applicant intends to so market the drug.”  (We previously analyzed the other criteria in proposed FDC Act § 505(j)(5)(B)(iv)(III), which appeared in prior versions of the BLOCKING Act.)

The new certification criterion is further laid out and explained in a special approval status rule for certain subsequent applicants at proposed FDC Act § 505(j)(5)(D)(v):

(v) SPECIAL APPROVAL STATUS RULE FOR CERTAIN SUBSEQUENT APPLICANTS.—An application that is approved pursuant to subclause (III) of subparagraph (B)(iv) is deemed to be tentatively approved and to no longer have an effective approval pursuant to such subclause (III) on the date that is 76 days after the date on which the approval has been made effective pursuant to such subclause (III) if the applicant fails to commercially market such drug within the 75-day period after the date on which the approval is made effective. If the applicant of an application approved pursuant to such subclause (III) submits a notification that it can no longer commence commercial marketing within 75 days after the date of approval, as required under subparagraph (B)(iv)(III)(bb), its application is deemed to be tentatively approved and to no longer be effectively approved on the date that such a notification is received. If an applicant does not commence commercial marketing within the 75-day period, it shall not be eligible for a subsequent effective approval for the application under subclause (III) of subparagraph (B)(iv) unless, in addition to meeting each of the conditions in such subclause (III), it submits a certification to its abbreviated new drug application that an event that could not have been reasonably foreseen by the applicant prevented it from commencing commercial marketing and that it has fully resolved this issue. The applicant shall submit notification to the abbreviated new drug application confirming that such applicant has commenced commercial marketing of the drug not later than one business day after commencing such marketing.

Under this special rule, a what we’ll coin as a “Special Subsequent Paragraph IV Applicant” that makes a certification under proposed FDC Act § 505(j)(5)(B)(iv)(III)(bb) and that does not commercially market within the certified-to 75-day period has its final ANDA approval converted to (or deemed) a tentative approval.  If the stars line up again for that Special Subsequent Paragraph IV Applicant, it cannot be once again be eligible for approval under proposed FDC Act § 505(j)(5)(B)(iv)(III) unless “it submits a certification to its [ANDA] that an event that could not have been reasonably foreseen by the applicant prevented it from commencing commercial marketing and that it has fully resolved this issue.”

The exception provision above is intended to be narrow so that the exception does not swallow the “one-shot-deal” rule.  And whoever it was who drafted this provision clearly had something in mind: the “event that could not have been reasonably foreseen” language parallels language in FDA’s MAPP 5240.3 (Rev. 6), titled “Prioritization of the Review of Original ANDAs, Amendments, and Supplements,” concerning priority review for certain ANDA supplements under 21 C.F.R. § 314.70(b)(4).  Under MAPP 5240.3 (Rev. 6), FDA states:

Supplements for which a priority review is requested under 21 CFR 314.70(b)(4)

Under 21 CFR 314.70(b)(4), an applicant may ask FDA to grant a priority review to “a supplement for public health reasons or if a delay in making the change described in [the supplement] would impose an extraordinary hardship on the applicant.”  Under this factor, “extraordinary hardship on the applicant” will be interpreted to include the following:

• Catastrophic events such as explosion, fire, or storm damage to manufacturing facilities.
• Events that could not have been reasonably foreseen by the applicant and for which the applicant could not have planned. Examples include:
  • An abrupt discontinuation of the supply of an active ingredient, packaging material, or container closure system.
  • The relocation of a facility or a change in an existing facility because of a catastrophic event.

The proposed new certification requirement and accompanying special rule provision are significant improvements to prior iterations of the BLOCKING Act.  That being said, it’s kind of like putting lipstick on a pig.  In the end, the “Expanding Access to Low-Cost Generics Act of 2023” (S. 1114) is still the BLOCKING Act, and it is still bad to the bone.  As we’ve said before, what generic drug companies would be willing to invest millions of dollars in generic drug development and patent challenges for the potential of a hollow exclusivity incentive?  More ANDA approvals does not necessarily translate into more launches.  Over time, a new exclusivity regime for Paragraph IV ANDAs may mean fewer ANDA approvals and launches.  And that ultimately means more drug shortages of critical medicines, fewer choices for consumers, and higher costs to the U.S. healthcare system.

On May 2nd, the U.S. Senate Committee on Health, Education, Labor and Pensions (“Senate HELP”) is scheduled to take up legislation that could significantly limit access to the courts and immunize critical FDA decisions from timely judicial review.  That bill is S. 1067, the “Ensuring Timely Access to Generics Act of 2023,” and it would fundamentally transform the playing field for NDA, ANDA, BLA, and aBLA applicants seeking to preserve their rights in the wake of an adverse FDA approval decision.

It does so by amending FDC Act § 505(q), the current statutory subsection regarding citizen petitions.  Subsection 505(q) initially was added by Section 914 of the 2007 FDA Amendments Act (“FDAAA”), Pub. L. No. 110-85 (2007), as amended by Section 301 of Pub. L. No. 110-316 (2008) and by Section 1135 of the FDA Safety and Innovation Act (“FDASIA”), Pub. L. No. 112-144 (2012).  And, as originally drafted, it was narrowly intended to prevent the citizen petition process from being used to delay the approval of ANDAs,  505(b)(2) applications, and aBLAs.  We’ve posted on FDC Act 505(q) many times over the years (see, e.g., here, here, here, and here).

As background, FDC Act § 505(q) states that FDA shall not delay approval of a pending ANDA, 505(b)(2) application, or 351(k) biosimilar application as a result of a citizen petition submitted to the Agency pursuant to 21 C.F.R. § 10.30 (citizen petition) or § 10.35 (petition for stay of action), unless FDA “determines, upon reviewing the petition, that a delay is necessary to protect the public health.”  FDA is required to “take final agency action on a petition not later than 150 days after the date on which the petition is submitted.”  FDA may not extend the 150-day period “for any reason,” including consent of the petitioner.  In addition, FDA may deny a petition if the Agency “determines that a petition or a supplement to the petition was submitted with the primary purpose of delaying the approval of an application and the petition does not on its face raise valid scientific or regulatory issues, the Secretary may deny the petition at any point based on such determination.”

That last provision—concerning petitions that are intended solely to delay the entry of competing products—was the subject of FDA’s most recent modifications to guidance on FDC Act § 505(q) (see our previous post here), in which FDA identified the various factors it would apply in determining whether or not a petition was submitted to the Agency with with the primary purpose of delay.  And in December 2021, we saw FDA apply those factors in responding to a citizen petition (Docket No. FDA-2021-P-1211) concerning generic VASOSTRICT (vasopressin).

Current FDC Act § 505(q) also includes a provision addressing judicial review of final Agency action.  Specifically, subsection 505(q)(2) deems FDA to have taken judicially reviewable final agency action on a petition if the Agency either makes a final decision within the meaning of 21 C.F.R. § 10.45(d) during the 150-day period (including the common FDA response of denying a petition without comment), or if the 150-day period expires without FDA having made a final decision on the petition.  Under current FDC Act § 505(q)(2)(B), if a civil action is filed against FDA “with respect to any issue raised in the petition before the Secretary has taken final agency action on the petition. . . , the court shall dismiss without prejudice the action for failure to exhaust administrative remedies.”  This statutory provision was tested once without much luck (see our previous post here).

With that background, let’s get back to S. 1067, which first reared its head in Spring 2022 as an amendment to  S.4348, the “Food and Drug Administration Safety and Landmark Advancements Act of 2022” (Section 511).  In addition to amending FDC Act § 505(q) to incorporate the various “intent to delay” factors FDA currently uses to determine whether a petition was submitted with the primary purpose of delaying FDA’s approval of an application, the new bill rewrites FDC Act § 505(q)(2) in a manner that appears calculated to immunize FDA’s actual final approval decisions from timely judicial review.  Specifically, the bill would amend the law to state:

(2) Exhaustion of administrative remedies

(A) IN GENERAL.—A person shall submit a petition to the Secretary under paragraph (1) before filing a civil action in which the person seeks to set aside, delay, rescind, withdraw, or prevent submission, review, or approval of an application submitted under subsection (b)(2) or (j) of this section or section 351(k) of the Public Health Service Act. Such petition and any supplement to such a petition shall describe all information and arguments that form the basis of the relief requested in any civil action described in the previous sentence.

(B) TIMELY SUBMISSION OF CITIZEN PETITION.—A petition and any supplement to a petition shall be submitted within 60 days after the person knew, or reasonably should have known, the information that forms the basis of the request made in the petition or supplement.

(C) FINAL AGENCY ACTION.—The Secretary shall be considered to have taken final agency action on a petition if—

(i) the Secretary makes a final decision within the meaning of section 10.45(d) of title 21, Code of Federal Regulations (or any successor regulation); or

(ii) on or after the date that is 151 days after the date of submission of the petition, the Secretary approves or has approved the application that is the subject of the petition without having made such a final decision.

(D) DISMISSAL OF CERTAIN CIVIL ACTIONS.—

(i) PETITION.—If a person files a civil action against the Secretary in which a person seeks to set aside, delay, rescind, withdraw, or prevent submission, review, or approval of an application submitted under subsection (b)(2) or (j) of this section or section 351(k) of the Public Health Service Act without complying with the requirements of subparagraph (A), the court shall dismiss without prejudice the action for failure to exhaust administrative remedies.

(ii) TIMELINESS.—If a person files a civil action against the Secretary in which a person seeks to set aside, delay, rescind, withdraw, or prevent submission, review, or approval of an application submitted under subsection (b)(2) or (j) of this section or section 351(k) of the Public Health Service Act without complying with the requirements of subparagraph (B), the court shall dismiss with prejudice the action for failure to timely file a petition.

(iii) FINAL RESPONSE.—If a civil action is filed against the Secretary with respect to any issue raised in a petition timely filed under paragraph (1) in which the petitioner requests that the Secretary take any form of action that could, if taken, set aside, delay, rescind, withdraw, or prevent submission, review, or approval of an application submitted under subsection (b)(2) or (j) of this section or section 351(k) of the Public Health Service Act before the Secretary has taken final agency action on the petition within the meaning of subparagraph (C), the court shall dismiss without prejudice the action for failure to exhaust administrative remedies.

Yeah, you read that correctly!  If S. 1067 is enacted, it would require potential litigants to submit a citizen petition to FDA not only before filing suit with respect to issues that were known and could have been raised prior to FDA’s approval of an application, but also before filing suit with respect to previously unknown issues even after FDA has granted a final approval—the quintessential “final agency action” in the FDA context, and of course the subject of hard-fought Administrative Procedure Act litigation in the federal courts for decades.  Taken together, these aspects of the proposed legislation are likely to prevent potential litigants—including brands, generics, public-interest groups, and interested members of the public—from vindicating their rights or protecting their interests in multiple contexts, and ultimately poses a clear and direct threat to the public health by immunizing critical safety-related issues from timely judicial review.

These problems arise because sponsors and other interested members of the public frequently do not know about potential regulatory issues (or cannot reasonably disclose what they may know about those issues because of a protective order in pending litigation or other trade-secret and confidentiality concerns) until after FDA issues a final approval.  Indeed, in many cases, no one beyond FDA and the application’s sponsor has any idea that an application implicating such issues even is pending before the Agency; FDA’s confidentiality regulations preclude the Agency from disclosing the existence of an unapproved application, and sponsors who otherwise might receive notice of a pending application (e.g., by receiving a Paragraph IV notice) nonetheless might remain in the dark because a particular application references a different RLD or lacks a Paragraph IV certification.

S. 1067, however, could effectively preclude potential litigants from protecting their interests in court even if they had no idea about a potential issue prior to approval, even after FDA has fundamentally altered the marketplace by approving an application in alleged violation of the law—for instance, by issuing approval before the conclusion of a thirty-month stay; a pediatric exclusivity period; a new chemical entity (“NCE”) or new-indication exclusivity period; an orphan-drug exclusivity (“ODE”) period; a 180-day exclusivity period; or by approving disputed labeling change. That is so because the proposed bill would condition access to the courts on: (1) potential litigants first filing a post-approval citizen petition asking FDA to unwind its approval decision; and (2) the Agency then taking final action on the post-approval citizen petition, which the statute makes clear can up to 150 days.

Between the time needed to prepare such a post-approval citizen petition; and the 150-day period FDA is granted to address such a petition; and the time it takes to prepare post-petition litigation papers; and the time it takes a court to resolve litigation after it is filed, S. 1067 easily could prevent the sponsor from securing judicial relief for 6-9 months after an allegedly unlawful approval.  That delay would consume the entirety of an NDA holder’s pediatric exclusivity or a first-to-file ANDA sponsor’s 180-day exclusivity, and a considerable portion (if not the entire remaining amount) of a thirty-month stay, new-indication exclusivity, NCE, or ODE period.  Importantly, because FDA has sovereign immunity from damages claims, sponsors trapped in S. 1067’s post-approval citizen petition web can never be made whole for their losses even if a court later agrees that FDA acted unlawfully in approving the application at issue.

S. 1067 isn’t bad just for application sponsors. It threatens grave risks to the public health. While these two authors certainly have seen our fair share of petitions and lawsuits raising dubious “safety concerns,” and indeed have persuaded FDA to refer bad actors to the FTC in past cases, we also have been party to a number of matters that raise indisputably serious potential health risks.  We have the utmost respect for the seriousness with which FDA’s scientists and regulatory professionals approach these matters, and are confident that no one at FDA wants to see potentially dangerous drugs on the market.  But FDA also tends to move slowly and deliberately even under the best circumstances; it is chronically underfunded, overwhelmed by competing demands (including a backlog of unresolved citizen petitions), and—like all federal agencies—constrained in its ability to respond even to the most pressing matters because of the cumbersome bureaucratic procedures inherent in any administrative agency (especially one as sprawling as FDA).

In the many decades we have been practicing in this space, we are fortunate that FDA has never once refused to engage when we’ve brought an urgent matter to its attention.  But it’s one thing to discuss matters with the Agency, and another thing entirely for FDA to take action.  Litigation risk tilts the balance: In our experience, the prospect of taking FDA to court when it makes a mistake, violates the law, or otherwise compromises the public interest is the only tool that reliably ensures FDA will prioritize a given issue and dedicate the resources and personnel needed to resolve it quickly and appropriately.  Put simply, nothing focuses FDA’s attention on a matter more effectively than the risk it might soon be forced to explain its action (or lack of action) to a United States District Judge. We have no doubt the same is true of other federal agencies—which, of course, is a big reason why the Administrative Procedure Act has authorized aggrieved parties to file suit over an agency’s undue delay or its final agency actions for nearly 80 years.

S. 1067 would gut that venerable tool: By curtailing timely judicial review of final approvals—game-changing final agency actions that, to reiterate, have been litigated for generations—the proposed law threatens to remove the only real leverage through which the public can ensure prompt agency action. And without that tool, there is literally nothing to prevent FDA from taking months to evaluate market-transforming legal issues and pressing safety concerns, even as vulnerable patients are exposed potentially dangerous drugs and sponsors see their competitive standing destroyed. Indeed, that appears to be the precise objective of these provisions in S. 1067: to make it more difficult for the public to hold FDA to account after it has approved a product in alleged violation of the law, by shielding FDA from litigation.  The fact that S. 1067 might allow these issues to be litigated months down the road therefore provides no solace: That’s far too late for patients, sponsors, and the broader public.

We certainly hope that Senate HELP will consider these issues as it entertains S. 1067 later this week in its Executive Session, and encourage readers of this blog to consider contacting your Representative and Senators about S. 1067 at the earliest possible opportunity.

Does your firm manufacture a “cyber device”?  A recent amendment to the Federal Food, Drug, and Cosmetic Act (FD&C Act) added a new section about cybersecurity for “cyber devices.”  If a device uses software that connects to the internet, it is most likely a cyber device and subject to new section 524B of the FD&C Act, “Ensuring Cybersecurity of Devices.” This provision became effective as of March 29, 2023.  It will become part of the “refuse to accept” (RTA) checklist on October 1, 2023.

FDA’s New Cybersecurity Authority

Over the past years, FDA has been expanding efforts to encourage mitigation of cybersecurity threats to medical device functionality and device users, but the FDA’s recommendations with respect to the cybersecurity of medical devices were not codified into law prior to the enactment of section 524B of the FD&C Act. The primary vehicle for FDA to request cybersecurity information in premarket submissions has been guidance documents.  However, FDA’s legal standing to insist on cybersecurity features, especially within the substantial equivalence paradigm, has been questionable.  Now, with explicit statutory authority, FDA’s push for cybersecurity has a firm legal footing.

Congress has given FDA the authority to require device manufacturers to provide cybersecurity information in their premarket submissions for a “cyber device.”  Section 524B(a) states:

A person who submits an application or submission under section 510(k), 513, 515(c), 515(f), or 520(m) [i.e., 510(k), premarket approval application (PMA), Product Development Protocol (PDP), De Novo, or Humanitarian Device Exemption (HDE)] for a device that meets the definition of a cyber device under this section shall include such information as [FDA] may require to ensure that such cyber device meets the cybersecurity requirements. . . .

Definition of A Cyber Device

Section 524B(c) defines a “cyber device” as a device that—

(1) includes software validated, installed, or authorized by the sponsor as a device or in a device;

(2) has the ability to connect to the internet; and

(3) contains any such technological characteristics validated, installed, or authorized by the sponsor that could be vulnerable to cybersecurity threats.

The technological characteristics in this context may cover a wide range of device functions, for instance, monitoring features, stimulation parameters, and communications with healthcare providers.  It applies whether the software is the entire device (i.e., Software as a Medical Device, or SaMD) or the software is embedded in a traditional hardware device (i.e., Software in a Medical Device, or SiMD).

Note that section 3060(a) of the 21st Century Cures Act in 2016 amended section 520 of the FD&C Act and removed certain software functions from the statutory definition of a medical device.  Therefore, a firm should first determine whether its product meets the statutory definition of a medical device.  Of course, if a product does not meet the definition of device, it is not subject to the FD&C Act.  We have recently blogged on this topic (“Is my software a medical device?”).

The new requirements

Section 524B(b) requires sponsors to provide the following information in premarket submissions for cyber devices:

(1) submit to the Secretary a plan to monitor, identify, and address, as appropriate, in a reasonable time, postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure and related procedures;

(2) design, develop, and maintain processes and procedures to provide a reasonable assurance that the device and related systems are cybersecure, and make available postmarket updates and patches to the device and related systems to address—

(A) on a reasonably justified regular cycle, known unacceptable vulnerabilities; and

(B) as soon as possible out of cycle, critical vulnerabilities that could cause uncontrolled risks; [and]

(3) provide to the Secretary a software bill of materials, including commercial, open-source, and off‑the‑shelf software components.

Timeline

Section 524B became effective on March 29, 2023.  Through a recent (and very short) Guidance document, FDA indicated that, starting on October 1, 2023, FDA may base “refuse to accept” (RTA) decisions on the information required by section 524B.  Until this deadline, FDA generally intends not to issue RTA decisions based solely on the information required by section 524B.  Instead, FDA “intends to work collaboratively with sponsors of such premarket submissions as part of the interactive and/or deficiency review process.” Id. at 2.

Note that FDA does not conduct an RTA acceptance review for submissions submitted via eSTAR.  As of April 17, 2023, the current eSTAR versions indicate: “A guided walk-through of Section 524B of the FD&C Act is not yet available below. It will be provided in a future eSTAR update.  Please refer to the help text in this section for the content that is required according to this statute.”  Users of eSTAR templates need to add attachments for cybersecurity risk management, cybersecurity management plan, continuing support plan, and cybersecurity labeling.  For those who are not familiar with an eSTAR, please refer to our previous posts: here, here, here, and here.

Loose Ends

IDEs.  There is still uncertainty about section 524B and how FDA is going to marry it to existing programs.  For example, what information needs to be provided in investigational device exemption (IDE) applications with respect to cybersecurity?  In the 2022 draft Guidance for Cybersecurity in Medical Devices, FDA recommends only a subset of the documentation be included in IDE applications, including (1) cybersecurity risks as part of Informed Consent Form, (2) global, multi-patient and updateability/patchability views, (3) security use case views for functionality with safety risks (e.g., implant programming), (4) software bill of materials, and (5) general labeling (connectivity and associated general cybersecurity risks, updateability/process).  Since section 524B(b) of the FD&C Act on its face does not apply to IDEs, it would seem that these recommendations are likely to remain unaltered by the new law.  It would be helpful if FDA would clarify its intentions in this regard.

Special 510(k)s.  If a firm wants to add an additional cyber feature to a currently non-cyber device that is already authorized for commercial distribution through 510(k) clearance or a De Novo classification request, the firm needs to determine if the change can be submitted as a Special 510(k).

The Special 510(k) Program Guidance provides an example of a change involving the addition of wireless control capabilities to a bilevel positive airway pressure (BiPAP) device intended to treat patients with obstructive sleep apnea.  The Guidance notes that “[v]erification and validation should be conducted to ensure that the BiPAP has acceptable wireless quality of service, coexistence, cybersecurity, and maintains EMC in its intended environment of use.”  The Guidance concludes that such a change cannot be reviewed in a Special 510(k), because “there are not well-established methods in an FDA-recognized voluntary consensus standard or in the manufacturer’s previous 510(k) that address the methods to evaluate the addition of wireless control for this BiPAP. The test methods vary depending on the wireless quality of service necessary for the device’s intended use and environment of use.”

This example suggests that the prospects are poor for adding cyber features via a Special 510(k).  However, FDA should update the Special 510(k) Program to clarify if and how the information required by section 524B could be submitted for review in a Special 510(k).

510(k) exempt.  It appears from the plain language that section 524B does not apply to 510(k)‑exempt devices.  An interesting question is whether FDA would take the position that converting a device from non‑cyber to cyber would trip such an exemption and require a 510(k) clearance.

What’s next?

Section 524B(b)(4) of the FD&C Act authorizes FDA to issue regulations with additional requirements for cyber devices.  Given FDA’s track record in issuing regulations, it will likely be many years before that happens, if it ever does.

As noted above, FDA published a draft guidance titled “Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions” just about a year ago.  Per section 3305(e) of the Omnibus, FDA must provide an updated guidance document by December 2024.  Given that it is on the A-list that FDA intends to publish during FY2023, FDA will likely publish the final guidance in a few months.  We look forward to it.