Software Regulation And Validation

Transcription

Software Regulation andValidationKeiichiro OzawaFUJIFILM Corporation12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation1

Agenda0. Introduction1. Qualification and Classification2. Low Risk Software3. Creating Certification Standards4. Pre-market Application and Validation5. Cybersecurity12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation2

Introduction of Keiichiro OzawaName:Keiichiro OzawaCompany Name:FUJIFILM CorporationBusiness Title:Regulatory SpecialistKentingBiography: Member of JFMDA Medical Device Software Working Group(The Japan Federation of Medical Devices Associations) Member of IMDRF SaMD Working Group (InternationalMedical Device Regulators Forum) Chair of DITTA Medical Software WG (Global DiagnosticImaging, Healthcare IT and Radiation Therapy TradeAssociation) IEC Expert of TC62/SC62A/JWG712/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation3

1-1. Qualification of Medical Device SoftwareRevision of Pharmaceutical Affairs Law Japanese Pharmaceutical Affairs Law has been revised as“PMD Act” and it has been in effect since Nov. 25, 2014. One of the significant points of the revision was theimplementation of revised GHTF Essential Principles (2012)which led to the introduction of standalone medical devicesoftware into the Japanese regulatory system.12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation4

1-1. Qualification of Medical Device SoftwareSoftware qualified as a medical deviceNotification on the basic concept of the qualification of medical devicesoftware, MHLW, Nov. 14, 2014 The intended use of the medical device software is based on the definitionof the medical device, installed in general-purpose PC or handheldterminals”.1) Software which creates indices, images, charts for diagnosis or treatmentby means of processing data from medical devices2) Software which supports the decision of treatment plan or treatmentmethod (including simulation software)12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation5

1-1. Qualification of Medical Device SoftwareSoftware qualified as a non-medical device1) Software which transfers, stores and displays data from medial devicesused as medical records2) Software which processes or computerizes data except image data for thepurpose other than diagnosis3) Software for education4) Software for patient explanation5) Software for maintenance6) Software for hospital business support7) Software for health management8) Software equivalent to General Medical Device (Class I equivalent)12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation6

1-2. Classification of Medical Device SoftwarePMD Act employs basic concept of GHTF rule for medicaldevice classification. Principles of Medical Devices Classification, GHTF, Nov. 2,2012Notification on the amendment of the classification rule of medical devices,MHLW, May 10, 2013It says on the top page, “The classification rule of medical devices has beenstipulated based on the rule discussed in GHTF ”And any other special rules has not been issued on the classification ofmedical device software. Therefore this rule should be applied for themedical device software.12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation7

1-2. Classification of Medical Device SoftwareGeneral classification of Medical DeviceScope ofMedical DeviceOther deviceGeneral Medical Device(Class I)Controlled MedicalDevice (Class II)SpeciallyControlled MD(Class III and IV)12/07/2016Certification StandardsApproval Standards4th Joint Conference of Taiwan and Japan on Medical Products Regulation8

1-2. Classification of Medical Device SoftwareScope of Medical Device SoftwareOther deviceScope of MedicalDevice SoftwareSoftware equivalent toGeneral Medical Device(Class I - equivalent)Controlled MedicalDevice (Class II)SpeciallyControlled MD(Class III and IV)12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation9

2-1. Low Risk SoftwareSoftware equivalent to Class I medical deviceGeneral Medical Device, Class I, has been eliminated from themedical device classification for software. It has little risk ofaffecting human life and health in case of the functional failure.This is the special classification rule only for the medical devicesoftware.Example1. Software which performs eyesight test or color perceptiontest by general-purpose PC or handheld terminals2. Software which detects body motion by means of sensors ofhandheld terminals・・・12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation10

2-1. Low Risk SoftwareThe approach of USA for low risk software FDASIA Health IT Report, FDA, Apr., 201412/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation11

2-2. Voluntary Standards by Private SectorsWhat about Japan?12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation12

2-2. Voluntary Standards by Private SectorsGood Health Software Promotion Councilfor GHS(Good Health Software)1. Purpose is to develop guidelines for the non-medical devicesoftware so that software developers can provide goodsoftware to users.2. The guidelines are applied to quality management, riskmanagement, software product safety and software lifecycleprocess. (GHS Development Guidelines)12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation13

2-2. Voluntary Standards by Private SectorsScope of Software for GHSScope ofSoftware forGHSOther deviceSoftware equivalent toGeneral Medical Device(Class I - equivalent )Controlled MedicalDevice (Class II)SpeciallyControlled MD(Class III and IV)12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation14

2-2. Voluntary Standards by Private SectorsGHS Development Guidelines - Three conformance levelsRequirementsAll items required by medicaldevice (ISO 13485 )GHS Development GuidelinesQuality dependon thecountryor jurisdiction.Software Product SafetySoftware Lifecycle ProcessOne or tworequirementsLevel-3Level-2Risk Management12/07/2016Level-1Level4th Joint Conference of Taiwan and Japan on Medical Products Regulation15

2-2. Voluntary Standards by Private SectorsThe list of conforming software on the websiteThe items of the list are Level (Level-1, 2 or 3) Registration number Product name Software version Company name URL of company website・・・12/07/2016The list of conforming softwareProduct nameCompany nameProduct nameCompany nameProduct nameCompany nameProduct nameCompany nameProduct nameCompany nameProduct nameCompany nameProduct nameCompany nameProduct nameCompany nameProduct nameCompany name4th Joint Conference of Taiwan and Japan on Medical Products Regulation16

3. Creating Certification StandardsQualification and classification rules have beenstipulated. But it may take several years to have thedevices reviewed by certification standards whichrequire relatively short review term.Expediting the premarket review process by creatingthe certification standards.12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation17

3. Creating Certification StandardsScope of Medical Device SoftwareOther deviceScope of MedicalDevice SoftwareCertification StandardsSoftware equivalent toGeneral Medical Device(Class I)Controlled MedicalDevice (Class II)SpeciallyControlled MD(Class III and IV)12/07/2016Software for generalpurpose imagingdiagnostic workstationSoftware for stationarydigital general-purposediagnostic X-ray system 4th Joint Conference of Taiwan and Japan on Medical Products Regulation18

3. Creating Certification Standards Current innovative progress of medical device software is sodrastic. Creating every possible certification standard from hardwaremedical devices even though some standards may not be used. Certification Standards, 108 (total 1370):Name, applied standards, intended use and etc. All medicaldevice software are Class II. JMDN (Japanese Medical Device Nomenclature), 150 (total 4258):Generic name, definition and etc. All medical device softwarewith the certification standards are Class II.* The numbers are as of 2014.12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation19

3. Creating Certification Standards[Example]The corresponding hardware medical deviceJMDN Code: 70030000Name: General-purpose imaging diagnostic workstationApplied standard: JIS C 6950-1 (IEC 60950-1)Intended use: It computerizes human image information from image diagnosismedical devices and provides processed image information formedical care (excluding those with automatic diagnostic functions)Medical device softwareJMDN Code: 70030012Name: Software for general-purpose imaging diagnostic workstationApplied standard: JIS C 6950-1 (IEC 60950-1)Intended use: It computerizes human image information from image diagnosismedical devices and provides processed image information formedical care (excluding those with automatic diagnostic functions)12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation20

4. Pre-market Application and ValidationPMD Act employs basic concept of GHTF for essentialprinciples of safety and performance of medical device. Essential Principles of Safety and Performance of MedicalDevices, GHTF, Nov. 2, 2012Notification on the essential principles of safety and performance ofmedical device, MHLW, Nov. 5, 2014One of the new requirements of the amendment is the introduction ofmedical device software and it requires to ensure the repeatability,reliability and performance according to the intended use. And therequirement in the event of a single fault condition is described. Theserequirements are also described in B8 of GHTF document.12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation21

4. Pre-market Application and ValidationEssential Principles Conformity Checklist is requiredfor any medical devices.Essential Principles Conformity Checklist is in tabular format ofEssential Principles dedicated for the medical device with itsrelated information such as applicability, applied standards,documentation information, etc. And it is required to beincluded in the pre-market application document.12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation22

4. Pre-market Application and ValidationRequirement for performanceEssential Principles(Benefits of the medical devices)Article 6All known or foreseeable risks and undesirable effects shall beminimized as far as reasonably practicable and be acceptablewhen weighed against the intended benefits of medical devicesunder normal conditions of use. Each application is required to describe the performancespecification, standard, etc. related to this article in the checklist.12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation23

4. Pre-market Application and ValidationV&V in pre-market application document(Software for general-purpose imaging diagnostic workstation,Class II)Performance evaluation Processing of images and informationimage flip (vertical, horizontal), image rotation, image enlargement,gradation processing Displaying images I/O with external devices Evaluation report accompanied with the applicationdocument12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation24

4. Pre-market Application and ValidationV&V in pre-market application document(Software for radiation treatment planning system, Class III)Performance evaluation Outlining Displaying geometric parameter Dose distribution calculation Evaluation report inthe application documentSafety evaluation Distance and length (JIS Z 4715: 2011, Sec. 7.1) Radiation dose (JIS Z 4715: 2011, Sec. 7.2) Format of date and time (JIS Z 4715: 2011, Sec. 7.3) 12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation25

4. Pre-market Application and ValidationRequirement for development lifecycle of softwareEssential Principles(Consideration of medical devices using programs)Article 122 For devices which incorporate software the software must bevalidated according to the state of the art taking into accountthe principles of development lifecycle, risk management,verification and validation to operate properly. It will be mandatory that each application describes theconformity to the article in the application from Nov. 25, 2017.12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation26

4. Pre-market Application and ValidationRequirement for development lifecycle of softwareHow to describe the conformity to Article 12.2 in theapplication document(Now in progress of discussion within JFMDA to suggest MHLW)Report as the implementation status of development lifecycle1. Summarizing the conformity to JIS T 2304 with itsimplementation status.2. Picking up some significant requirements of JIS T 2304 withits conformity.3. Listing up all the requirements of JIS T 2304 in a tabular form.12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation27

5. CybersecurityNotification on cybersecurity, MHLW, April 28, 20151. Fundamental policyMAHs should ensure cybersecurity by necessary risk control measures 2. Specific measures(i) perform protective risk management to evaluate and reduce the risks limiting the scope of connection and limiting the software, system orservices to those that are confirmed (ii) which necessary cybersecurity is not ensured, the users should beclearly informed of this issue (iii) In accordance with “Guidelines for the Security Management of HealthInformation Systems”, provide HDOs with necessary information * Translated from Japanese to English by JIRA (Japan Medical Imaging and Radiological Systems Industries Association)and all rights reserved.12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation28

5. CybersecurityGuidance on how to implement the cybersecuritynotification(Now in progress of discussion within JFMDA to suggest MHLW) ScopeNecessary consideration of cyber risk including network environment,intended use, operational environment, etc. Cybersecurity measurementManuractures shall conduct risk management and demonstrate it isacceptable. Post-market safety assuranceManufactures are responsible for the cybersecurity of pre-owned devices. Providing information to usersManufactures shall provide necessary information to users to assure thesafety of the device.12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation29

THANK YOU!12/07/20164th Joint Conference of Taiwan and Japan on Medical Products Regulation30

All medical device software are Class II. JMDN (Japanese Medical Device Nomenclature), 150 (total 4258): Generic name, definition and etc. All medical device software with the certification standards are Class II. 3. Creating Certification Standards * The numbers are as of 2014. Current innovative progress o