A Manufacturer Liability for Product Defects

B Physician Liability for Lack of Informed Consent and Negligence

The learned intermediary doctrine is also related to the doctrine of “informed consent,” which imposes on physicians a duty to obtain, prior to treatment, patient consent by informing them of the material risks associated with the treatment. In some jurisdictions, the sufficiency of informed consent is based on whether “the physician’s failure to inform fell below the medical community’s standard of care.”Footnote ³⁴ In others, the question of sufficiency is based on a record of the disclosure of facts that would influence the patient to consent to a particular procedure or treatment.Footnote ³⁵

Informed consent is often considered part of tort law’s general requirement to act reasonably under the circumstances – a requirement that applies to physicians as well as manufacturers. Like the standard for manufacturers in negligence actions, the standard for physicians in negligence actions focuses on the reasonableness of the physician’s behavior. Unlike the standard of negligence for manufacturers, however, the standard of negligence for physicians is often determined by custom. What is reasonable, in other words, is determined by the jury based on what an actual doctor in that field of expertise would actually have done in the situation, rather than on what a reasonable doctor under the circumstances would have done.Footnote ³⁶ This standard of care, however it is determined, applies to physicians who prescribe and use RPM devices. Thus, tort law will hold physicians liable if their failure to warn of device risks (if the learned intermediary doctrine applies) or to take reasonable care in monitoring or treating a patient, which can include inadequate training on how to use a device, causes harm to the patient.Footnote ³⁷

C Defenses

Both physicians and manufacturers may have various defenses to claims involving defective products or negligent care. One is that the patient was negligent in using the device, and that negligence caused some or all of the harm suffered. In tort, a plaintiff’s negligence can affect his or her claims by (1) barring recovery entirely (contributory negligence), (2) reducing recovery by the percentage the plaintiff is at fault (pure comparative negligence), or (3) reducing recovery if the plaintiff’s fault is as great as or not greater than the defendant, otherwise barring recovery (modified comparative negligence). Most jurisdictions apply some version of modified comparative negligence when the plaintiff asserts a negligence claim. When the plaintiff asserts a claim in strict liability, contributory and comparative negligence defenses may still be available,Footnote ³⁸ though they may be limited to certain evidentiary issues, such as risk-utility balancing or causation,Footnote ³⁹ and circumscribed by statute.Footnote ⁴⁰ Of course, even when comparative negligence applies, parceling liability may be challenging.

A Regulation

How a device reaches the market can influence manufacturer liability for injuries caused by the device. RPM devices reach the market in two principal ways. New, high-risk devices (class III) must file a premarket notification approval (PMA) application that requires the manufacturer to demonstrate “reasonable assurance of the safety and effectiveness” of the device.Footnote ⁴¹ By contrast, if a manufacturer can justify that its device is “substantially equivalent” to a device already legally on the market, the device qualifies for clearance under section 510(k) of the Food, Drug, and Cosmetic Act (FDCA), an exception to the PMA process (class II).Footnote ⁴² Almost all devices that require premarket review enter the market through the 510(k) pathway, though the FDA does have the power to reclassify devices based on data showing novel risks.Footnote ⁴³

Which of these two pathways applies to an RPM device can have important liability implications for the manufacturer and injured patient because the Supreme Court ruled that the Medical Device Amendments of 1976 (MDA) expressly or impliedly preempted state tort claims for high-risk devices that meet the “federal requirements” necessary for the approval of a PMA application.Footnote ⁴⁴ Express preemption does not apply to devices cleared through the 510(k) pathway, which lacks the close regulatory review for safety and effectiveness present in a PMA review (Table 8.2).Footnote ⁴⁵

Implied preemption defeats only those parallel claims that would not exist but for the FDCA.Footnote ⁴⁶ For 510(k)-devices, for example, implied preemption bars claims only when the manufacturer’s fraudulent representations caused the FDA to allow the marketing of a device it otherwise would not have (so-called state-law “fraud-on-the-FDA claims”) (Table 8.3).Footnote ⁴⁷

As a result, a manufacturer’s liability exposure may turn on the type of product it manufactures and whether any similar product currently exists on the market. For example, if the heart rate monitoring feature of an implantable pacemaker is cleared through a 510(k) pathway, then the manufacturer would be liable for most harm that occurs as a result of a product defect.Footnote ⁴⁸ If, by contrast, the feature required a PMA, then the manufacturer for which the PMA is granted would be immune from most lawsuits alleging injuries caused by the monitoring features of the device. Generally speaking, then, devices that undergo a more complete FDA review before market entry are subject to less tort liability than devices that undergo a less complete or no FDA review before market entry.

Consider the Sunrise Sleep Disorder Diagnostic Aid, which uses jaw movements to detect sleep apnea.Footnote ⁴⁹ The device had no analogue on the market, but Sunrise filed to have its product cleared for the market without a PMA through an alternative mechanism, which may be treated similarly to the 510(k) process for preemption purposes.Footnote ⁵⁰ While this choice likely saved Sunrise substantial capital, it could also increase its potential liability exposure. When deciding between a less stringent review and a PMA, Sunrise may have determined that the lower costs associated with less stringent review outweighed the benefits of liability protection afforded by a PMA.

Complicating things further, devices with a PMA are not immune from all lawsuits in all jurisdictions; such devices can be the subject of so-called “parallel claims” – state law causes of action that mirror FDA requirements but are not based solely upon them. For example, a state law manufacturing defect claim premised on, but not dependent on, a violation of federal manufacturing regulations could be a parallel claim provided that state law did not impose additional requirements on the manufacturer.Footnote ⁵¹ Here, jurisdictional issues can reappear because federal courts differ on what counts as a “parallel” claim that evades preemption.Footnote ⁵²

B Path to Market and Patient

How an RPM device reaches the consumer can also influence physician and manufacturer liability. For example, Phillips manufactures the BioSticker System, which is an RPM device that attaches to the skin and measures physiological data, such as heart rate, respiratory rate, skin temperature, and other symptomatic or biometric data. This information is displayed on a dashboard that physicians can access and monitor.

The device, which was cleared under the 510(k) process,Footnote ⁵³ originally required a physician’s prescription but, under a COVID-19 Emergency Use Authorization (EUA), is now available over the counter.Footnote ⁵⁴ Before the EUA, this meant that the manufacturer could discharge its duty to warn by providing adequate instructions and warnings to the physician prescribing the device. The physician would then have an independent duty to obtain informed consent from the patient. After the EUA, however, consumers could access the device without a physician’s prescription, requiring that the warnings be made to the patient directly.

Because the learned intermediary doctrine affects manufacturer liability only for failure-to-warn claims, Phillips could still be liable for harm caused by manufacturing defects in the BioSticker System even prior to the EUA. Consider a situation in which, because of a manufacturing defect, the Biosticker device failed to transmit information to a physician showing an irregular heart rate and respiratory function. If the patient died as a result of the physician’s failure to intervene, and if the failure to intervene was caused by the device not having been manufactured according to specifications, then Phillips could be liable for the patient’s death.

Manufacturers may also be liable for some design defect claims even when the learned intermediary doctrine applies. The scope of this liability may depend on whether the device is prescribed by a physician and the type of device at issue. Phillip’s Biosticker was previously used by prescription, making it likely that Phillips could obtain immunity from strict liability design defect claims by adequately warning the physician of the risks posed by the device – for example, its inability to be used for more than a certain period of time or in water.Footnote ⁵⁵

Once the FDA issued the EUA authorizing the device to be sold directly to consumers without a prescription, no amount of warning to physicians would likely insulate Phillips from strict liability design defect claims; however, in some, but by no means all, jurisdictions, adequately warning consumers may immunize manufacturers from design defect claims. A company like Empatica, for example, may try to immunize itself by warning physicians and consumers about the Embrace2’s ability to notify only emergency contacts, potentially foreclosing claims that Empatica defectively designed the Embrace2 since it lacked the capability to notify physicians or emergency responders. Regardless of whether strict liability immunity applies, a showing of adequate warning would not necessarily make Phillips immune from negligent design defect claims because of jurisdictional differences.

Besides the jurisdictional variations, it is unclear how courts would resolve such claims. While design defect claims often turn on the existence of available safer designs, along with the costs of developing and implementing them, some courts have been reluctant to apply this reasoning to prescription drugs.Footnote ⁵⁶ Prescription RPM devices may be treated similarly. If they are not, however, such claims will turn on a fact-intensive analysis of the costs associated with changing the device to make it safer – rarely a question that can be resolved definitively and early in litigation.

In addition to its effect on manufacturer liability for information-based claims like failure to warn, the learned intermediary doctrine also opens physicians to more claims from patients injured by RPM devices. For example, suppose a physician prescribes to a patient, and the patient uses, a bracelet like the Embrace2 to detect seizure activity that automatically notifies designated caregivers.Footnote ⁵⁷ If a seizure occurs and the device contacts a caregiver who cannot respond in time, the injured patient may attempt to sue the physician based on the theory that he or she would not have used the device if it was impossible for the device to alert someone who could more immediately help.Footnote ⁵⁸

To avoid liability, physicians will need to properly inform and educate patients and caregivers about the devices’ risks and limitations. For devices like the Embrace2, part of this risk may be avoided by working with device manufacturers to notify parties who can respond in case of emergency and obtaining written and verbal consent, after explanation, for patient responsibilities in using the device and how the physicians can and will monitor the device data.

For example, physicians who recommend or prescribe a device like the Biosticker have a duty to understand how to use the product, including its limitations, as well as how and when they will be monitoring the data from the device. These physicians also have a duty to explain this clearly to the patient. If a physician will not be monitoring the device for real-time alerts, but instead using it as a data-gathering tool to obtain a more complete picture of the patient, they would do well to say so (and to document that conversation with the patient). The duty might include explaining to patients what to do if the device detects unusual behavior, including who they should contact and how they should interpret the data. Simply advising patients to “call 911” if there is an emergency may seem like a failsafe, but it also may create undue stress on the health care system if a device provides a variety of alerts. This may require new office procedures, points of contact, and protocols for reassessments of patients whose devices create particular kinds of alerts.

C Patient and Caregiver Use

Physicians are not the only individuals who can affect the liability of RPM device manufacturers. When patients use RPMs, they may be responsible for some or all of the harm the device causes, and their damages could be reduced or eliminated under the doctrine of comparative negligence. Similar to device manufacturers, how responsible patients are may turn on the type and nature of the device at issue.

Some RPM devices operate automatically and without any patient initiation, reducing the probability that a patient is responsible for harm suffered when using the device. RPM devices like the BioSticker or a pacemaker that monitors cardiovascular status, for example, collect information with minimal patient engagement. Without any patient action, it may be harder to show that the patient’s negligence, rather than the device, is the cause of any harm that occurred while the patient used the device.

However, other devices may require the patient to initiate, operate, or respond to them, and to do so under particular conditions or in a particular manner. For example, Google announced that it was developing a dermatology app that deploys artificial intelligence and machine learning to analyze user-uploaded photographs to track skin lesions over time and provide diagnostic information.Footnote ⁵⁹ Hyfe, a smartphone app that likely will apply for 510(k) clearance,Footnote ⁶⁰ uses similar technology to monitor cough data that the patient captures by affirmatively initiating the application. Patients who fail to track skin lesions at certain intervals using Google’s dermatology app or fail to initiate Hyfe may find that false negatives are their own fault, rather than the device’s. Moreover, patients who do not reasonably act on alerts from devices like RPMs may reduce or eliminate their ability to recover if they are injured as a result.

Patients could also see damages reduced or claims eliminated entirely when they use and rely on these devices in environments where manufacturers specifically state that they will not operate accurately. Thus, a patient who does not operate Hyfe or Google’s app in the recommended sound or lighting conditions, does not track coughs or skin lesions at the intervals required for the app to function optimally, or uses the device to predict asthma attacks or detect skin cancer (purposes for which they are not designed) may eliminate or reduce the probability of liability for manufacturers or physicians.

Similar issues apply to devices – like ResMed’s AirSense Elite 10 continuous positive airway pressure (CPAP) machine with built-in RPM – which not only treats sleep apnea, but also collects information about the person wearing it, that could be used to detect important health events, including a lack of oxygen being delivered to the user.Footnote ⁶¹ Patients who improperly place the mask on their face or use the device only sporadically will encounter challenges when suing manufacturers because a device did not detect a respiratory event. This may be true even if the device itself did not function properly.

Additionally, RPM devices may require manual patient data input to function properly. Medtronic offers a patient management system that uses both sensor-based RPM and self-reporting by patients to monitor and evaluate respiratory health, in particular patients with COVID-19.Footnote ⁶² Patients who enter information incorrectly may cause the system to incorrectly not recommend further care or alert the appropriate parties. If that happens and the patient is injured or dies as a result of the delay or absence of care, the patient may bear some or all of the responsibility for the harm, reducing or eliminating their recovery under the doctrine of comparative negligence.

Finally, third parties, like those who are “emergency contacts” alerted by a seizure detection device like the Embrace2, may have their phones turned off or may not respond to the patient in time to treat them. If their failure to respond causes harm to the patient, they could face liability, potentially reducing the liability of other actors. But if the third party’s inaction is caused by the patient’s failure to inform the third party that they would be notified, how they would be notified, or what they were expected to do when notified, then the patient may be responsible for the harm.

In short, the more patients can control what goes into the RPM, the more likely both the manufacturer and prescribing physician are to argue that any injury was caused not by them, but by the patient. To reduce the probability of patient-caused injury, manufacturers and physicians should carefully instruct patients on how, when, and for what purposes they should use RPM devices, and they should emphasize the limitations of the devices.

A Post-Market Trials and Registries

Two common ways in which manufacturers and regulators continue to monitor the ongoing safety and effectiveness of medical devices are via post-market clinical trials and patient registries.

One or more post-approval studies may be required by regulators at the time of a Pre-Market Approval (PMA), Humanitarian Device Exemption (HDE), or Product Development Protocol (PDP) application. The FDA may require that manufacturers commit to conducting such studies before it grants regulatory approval, and failure to complete studies may be grounds for the FDA to withdraw a device’s approval.Footnote ⁹ For example, the Post-Approval Study on Patients Who Received a HeartWare HVAD® During IDE Trials (HW-PAS-03), a multi-center study sponsored by the device’s manufacturer, provided continued evaluation and follow-up on patients who had received the HeartWare^® Ventricular Assist System during earlier clinical trials.Footnote ¹⁰ The FDA may request that post-approval studies be conducted for both moderate- and high-risk devices. In practice, post-market studies are often delayed or terminated after the manufacturer changes the indication for use of the studied medical device.Footnote ¹¹

Patient registries may be device-specific or embedded in larger surveillance initiatives. For example, as a condition for the approval of transcatheter heart valves, the FDA required all manufacturers to “continue to follow patients enrolled in their randomized studies for 10 years to further monitor transcatheter aortic valve safety and effectiveness….” As part of this initiative, the manufacturers agreed to participate in the Society of Thoracic Surgeons/American College of Cardiology Transcatheter Valve Therapy (TVT) Registry.Footnote ¹²

B Plant Inspections

Another important component of post-market medical device regulation includes the inspection of plants where devices with hardware components are manufactured. Ball et al. (2017) summarized the rationale for manufacturing plant inspections by noting that “governments cannot feasibly sample every manufactured product before its release to customers; therefore, they frequently depend on plant inspections to appraise a plant’s quality systems.”Footnote ¹³

Generally speaking, device-manufacturing plant inspections are conducted according to the process described in the Quality System Inspection Technique Guide, which, in turn, follows the requirements contained within 21 CFR § 820.Footnote ¹⁴ Such plant inspections involve the detailed documentation of various processes – including those associated with quality system requirements, various forms of controls (e.g., design, production, and process), corrective and preventative actions, and so on. Notably, investigators do not inspect actual products, but, instead, examine the systems that guide the device manufacturing process.

Inspectors typically arrive at a plant unannounced, tour the facility, interview managers, and perform a process documentation review. There are three different types of such inspections: (1) Surveillance inspections – those that occur regularly and routinely to assess plant quality; (2) compliance inspections – those that are part of the establishment of new or modified manufacturing processes or new product launches; and (3) complaint inspections – those that occur in response to serious complaints by customers/device users.Footnote ¹⁵ In response to inspections, remedial actions may or may not be indicated; remedial actions may be “voluntary” or “official,” depending on the severity of issues identified.Footnote ¹⁶

C Medical Device Reporting

Once devices are legally marketed, a system of voluntary and mandatory medical device reporting serves to track adverse events and identify emergent safety issues. The FDA receives several hundred thousand medical device reports (MDRs) related to suspected device-associated malfunctions, injuries, and deaths annually.Footnote ¹⁷ These reports are collected in the Manufacturer and User Facility Device Experience (MAUDE) database, which is maintained by the FDA. Reports are mandatory for certain users – namely device manufacturers, importers, and health care facilities – and voluntary for others, including patients, consumers, and clinicians.

MDRs are input into the MAUDE database along with detailed product information, which includes a device’s manufacturer, product code, and FDA clearance/approval identifiers. This information allows individual MDRs to be linked to specific products. Although MDRs and the accompanying MAUDE database represent rich and well-organized sources of information, the FDA warns that the surveillance system may be incomplete, unverified, or inaccurate because of biased reporting, reporting lags, and other factors, and therefore cautions against using MAUDE data to understand the frequency or causality of adverse events. Nevertheless, MAUDE remains an important source of information about product quality issues, and its open-source format lends itself to empirical research in medicine and health policy.Footnote ¹⁸

D Recalls

Finally, post-market regulation includes the oversight of formal medical device recalls. Although recalls are typically manufacturer-initiated, they are overseen by the FDA, which classifies recalls according to risk/severity:

• Class I recalls (most severe) occur where “there is a reasonable chance that a product will cause serious health problems or death” – for example, a faulty pacemaker lead that would prevent proper functioning.

• Class II recalls (moderate severity) occur where “a product may cause a temporary or reversible health problem or where there is a slight chance that it will cause serious health problems or death” – for example, an insufficiently tight surgical clamp.

• Class III recalls (low severity) occur where “a product is not likely to cause any health problem or injury” but where an issue nevertheless should be corrected – for example, a labeling issue.Footnote ¹⁹

The FDA’s medical device recall database publishes data on all classes of product recalls. The database links recall information to specific clearance/approval decision identifiers, enabling researchers to link a recall to at least one specific previously regulated product.

A Data Sources and Sample Construction

We identified all 510(k)-track and PMA-track medical devices (i.e., moderate and high-risk devices) cleared or approved by the FDA from 2008–2018 in the five common regulatory medical specialties (associated with CDRH Advisory Committees of the same name) most likely to include RPM devices: Cardiology, clinical chemistry, gastroenterology, general hospital, and general and plastic surgery. We then identified all recalls and adverse events associated with these devices that occurred between 2008 and 2020 using the FDA’s MAUDE and recall databases, respectively. We limited data from MAUDE to only include adverse events from mandatory reporters to reduce non-random differences in reporting across device types.

B Identifying Software-Driven Medical Devices

We employed a supervised document classification algorithm to identify SdMDs. For each medical device in our sample, we downloaded its associated public statement or summary document from the FDA’s website. These documents are required for all submissions and each “includes a description of the device such as might be found in the labeling or promotional material for the device.”Footnote ²⁰ We then used optical character recognition software to search each document for the word “software” to identify devices with a software component.

This text search technique was demonstrated to work well in manual review: In comparison to a manually coded random sample of summary documents, the document classification had a 0 percent false negative rate, meaning devices flagged as including a software component via supervised document classification always included a software component. Accordingly, we identified a medical device as including a software component if “software” appeared at least once in its public summary of evidence. Additional details on the supervised document classification are provided elsewhere.Footnote ²¹

C Outcomes of Interest

We focused on two primary outcomes of interest: (1) Class I/II recalls (i.e., those of moderate or greater severity) and (2) mandatorily reported adverse events. For recalls, we identified all class I/II recalls that occurred within two years of regulatory approval/clearance for each device. We chose to use two years of follow-up, as most medical device recalls occur shortly after a medical device comes to market.Footnote ²² For adverse events, we similarly created a count of all adverse events from mandatory reporters in the two years following a device’s clearance/approval.

D Statistical Analysis

We compared differences in adverse events and recalls by software status by performing two-sided, two-sample t-tests comparing the outcomes between SdMDs vs. non-SdMDs. To understand the changes over time, we plotted the number of recalls or adverse events in a given calendar year divided by the number of approvals/clearances in the two preceding years, such that the frequency of outcomes was scaled by the number of devices recently placed on the market in each year. All statistical analyses were performed using data from the entire sample, as well as within individual medical specialties.

A The Medical Device Definition and the FDA’s Enforcement Discretion

Under FDCA section 201(h)(1), a “device” is

From the outset, the FDA can only regulate software functions that are classified as medical devices under FDCA section 201(h)(1) (so-called “device software functions”).Footnote ²⁸ In other words, the FDA has no statutory authority to regulate software functions that are not considered medical devices under FDCA section 201(h)(1).Footnote ²⁹ There are different types of software classifications. A relevant one is “Software as a Medical Device” (SaMD), which is standalone software and, as such, counts as a medical device.Footnote ³⁰ The International Medical Device Regulators Forum defines SaMD as “software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device.”Footnote ³¹ For example, Apple’s ECG and irregular rhythms notification feature apps are both SaMD because they are software-only apps intended for a medical purpose.Footnote ³²

Only recently, in September 2022, the FDA updated its Guidance for Device Software Functions and Mobile Medical Applications (Mobile Medical App Guidance) to reflect recent changes, such as the issuance of the FDA’s final Guidance on Clinical Decision Support Software.Footnote ³³ Although the Mobile Medical App Guidance contains nonbinding recommendations, it represents the FDA’s current thinking on its regulatory approach to device software functions, including mobile medical apps.Footnote ³⁴ The FDA defines “mobile medical apps” as mobile apps that incorporate device software functionalities that meet the medical device definition in the FDCA, and either are “intended … to be used as an accessory to a regulated medical device; or … to transform a mobile platform into a regulated medical device.”Footnote ³⁵

The “intended use” is relevant for determining whether a mobile app is considered a medical device.Footnote ³⁶ The term means “the objective intent of the persons legally responsible for the labeling of devices.”Footnote ³⁷ Such persons are usually the manufacturers whose expressions determine the intent.Footnote ³⁸ The intent can also be shown by the circumstances surrounding the product’s distribution.Footnote ³⁹ For instance, the objective intent can be derived from advertising materials, labeling claims, and written or oral statements by the product’s manufacturer or its representatives.Footnote ⁴⁰

In its Mobile Medical App Guidance, the FDA clarifies that it intends to focus its regulatory oversight on only those device software functions whose functionality could present a risk to the safety of patients if they were not to function as intended.Footnote ⁴¹ This means that the FDA intends to exercise enforcement discretion over those software functions that are or may be medical devices under FDCA section 201(h)(1) but present a lower risk to the public.Footnote ⁴² Enforcement discretion means that the agency does not aim to enforce requirements under the FDCA.Footnote ⁴³

For example, the FDA intends to apply its regulatory oversight to device software functions that analyze images of skin lesions using mathematical algorithms and provide users with risk assessments of the lesions.Footnote ⁴⁴ In contrast, for instance, the FDA considers apps exclusively intended for patient education, such as an app that helps guide patients to ask the right questions to their physician concerning their disease, as not being medical devices, and, thus, those apps fall outside of the FDA’s statutory authority.Footnote ⁴⁵ An example of a mobile app that may meet the medical device definition, but for which the FDA intends to exercise enforcement discretion because it poses a lower risk to the public, is an app that provides a “Skill of the Day” behavioral technique that patients with diagnosed psychiatric conditions can access when experiencing increased anxiety.Footnote ⁴⁶

When applying the FDA’s current thinking in the Mobile Medical App Guidance to DTC medical self-diagnosing AI apps, some of these apps are considered device software functions that are the focus of the agency’s regulatory oversight. Take as an example Apple’s ECG and irregular rhythms notification feature apps. Both apps are considered class II (moderate-risk) medical devices and had to undergo a premarket review by the FDA via the so-called De Novo process before being placed on the US market.Footnote ⁴⁷

However, even if DTC medical self-diagnosing AI apps are considered medical devices because they help individuals identify a disease or other condition and are considered to be “intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease,”Footnote ⁴⁸ the FDA may exercise enforcement discretion over some of them if they are considered to pose a low risk to the public. For example, as mentioned previously, the consumer app Ada is currently CE-marked as a class I (low-risk) medical device in the European Economic Area.Footnote ⁴⁹ However, it seems that Ada has not undergone a premarket review by the FDA.Footnote ⁵⁰ One option why this is likely the case is that Ada (may) meet(s) the medical device definition in FDCA section 201(h)(1),Footnote ⁵¹ but falls within the FDA’s enforcement discretion because it is considered to pose a lower risk to the public. This analysis also seems to be consistent with the Mobile Medical App Guidance. In Appendix B of its Guidance, the FDA lists examples of software functions that may meet the medical device definition but for which the agency exercises enforcement discretion, including:

• – “Software functions that use a checklist of common signs and symptoms to provide a list of possible medical conditions and advice on when to consult a health care provider” and

• – “Software functions that guide a user through a questionnaire of signs and symptoms to provide a recommendation for the type of health care facility most appropriate to their needs.”Footnote ⁵²

In addition, most class I medical devices under the FDCA are also a priori exempt from premarket notification (510(k)) requirements.Footnote ⁵³

B The Medical Device Exception, FDCA Section 520(o)(1)(B)

Section 3060(a) of the 21st Century Cures Act introduced five exceptions to the medical device definition for certain software functions. One of these exceptions is particularly relevant for DTC AI apps – namely FDCA section 520(o)(1)(B), which states that “the term device, as defined in section 201(h), shall not include a software function that is intended … for maintaining or encouraging a healthy lifestyle and is unrelated to the diagnosis, cure, mitigation, prevention, or treatment of a disease or condition; … .”

In 2019, the FDA issued nonbinding Guidance on Changes to Existing Medical Software Policies Resulting from Section 3060 of the 21st Century Cures Act (Cures Act Guidance), in which the agency, among other things, expresses its current interpretation of FDCA section 520(o)(1)(B).Footnote ⁵⁴ In particular, the FDA clarifies that FDCA section 520(o)(1)(B) means software functions that belong to the first category of general wellness intended uses, as defined in the FDA’s nonbinding Guidance on General Wellness: Policy for Low Risk Devices (General Wellness Guidance),Footnote ⁵⁵ and that are “unrelated to the diagnosis, cure, mitigation, prevention, or treatment of a disease or condition.”Footnote ⁵⁶ Software functions that fall within the first category of general wellness intended uses are intended for “maintaining or encouraging a general state of health or a healthy activity.”Footnote ⁵⁷ For example, an app that assists users with weight loss goals and does not make any reference to diseases or conditions falls under FDCA section 520(o)(1)(B), and, thus, is not considered a medical device under FDCA section 201(h)(1).Footnote ⁵⁸

In its Cures Act Guidance, the FDA also clarifies that software functions that fall within the second category of general wellness intended uses, as defined in the General Wellness Guidance, are not covered by FDCA section 520(o)(1)(B).Footnote ⁵⁹ Software functions that fall within the second category of general wellness intended uses have “an intended use that relates the role of healthy lifestyle with helping to reduce the risk or impact of certain chronic diseases or conditions and where it is well understood and accepted that healthy lifestyle choices may play an important role in health outcomes for the disease or condition.”Footnote ⁶⁰

In contrast to the first category of general wellness intended uses, this second category relates to the prevention or mitigation of a disease or condition, and, thus, software functions that fall within this second category are not excluded from the medical device definition.Footnote ⁶¹ For example, if the app in the previous example makes reference to diseases or conditions – for instance, if it claims that maintaining a healthy weight will aid living well with type 2 diabetes – this app falls outside of the scope of FDCA section 520(o)(1)(B).Footnote ⁶²

As understood here, DTC medical self-diagnosing AI apps help users to identify a disease or other condition based on entering, for example, symptoms. They are related “to the diagnosis, cure, mitigation, prevention, or treatment of a disease or condition” and, thus, do not fall under the medical device exception in FDCA section 520(o)(1)(B).Footnote ⁶³ To sum up, DTC medical self-diagnosing AI apps are medical devices under FDCA Section 201(h)(1) that are either the focus of the FDA’s regulatory oversight or for which the agency exercises its enforcement discretion. Figure 10.1 summarizes the regulation of mobile health apps, including DTC medical self-diagnosing AI apps.

Figure 10.1 Regulation of mobile health apps, including DTC medical self-diagnosing AI apps^a

^aFigure inspired by the FDA’s Mobile Medical App Guidance, supra note 33; the FDA’s Cures Act Guidance, supra note 54; the FDA’s General Wellness Guidance, supra note 55.

A Labeling

Device software functions are organized into one of three classes based on their risk level, ranging from class I (lowest risk) to class III (highest risk).Footnote ⁶⁴ Depending on the device classification, manufacturers must follow the associated controls – that is, General Controls, Special Controls, and/or Premarket Approval.Footnote ⁶⁵ In principle, General Controls apply to all device software functions.Footnote ⁶⁶ For instance, the General Device Labeling Requirements in Part 801 of Title 21 of the Code of Federal Regulations (CFR) are General Controls.Footnote ⁶⁷ 21 CFR Part 801 includes, among other things, general labeling provisions, such as the name and place of business, adequate directions for use, and the use of symbols, as well as special requirements for specific devices, such as hearing aids, and labeling requirements for unique device identification and over-the-counter devices.Footnote ⁶⁸

Labeling is defined in FDCA section 201(m) as “all labels and other written, printed, or graphic matter (1) upon any article or any of its containers or wrappers, or (2) accompanying such article.” It is a generic term that also includes all labels.Footnote ⁶⁹ Under FDCA section 201(k), the term “label” means

In the context of DTC medical self-diagnosing AI apps, the label will usually be available in non-physical form through the app itself.

It is also worth noting that if the “labeling is false or misleading in any particular,” the device is considered misbranded under FDCA section 502(a)(1). The term “misleading” means that the labeling proves deceptive to device users and creates or leads to a false impression in their minds.Footnote ⁷⁰ For example, this can be the case if the label contains exaggerated claims or if it fails to inform users about relevant facts.Footnote ⁷¹

B Challenges

DTC medical self-diagnosing AI apps raise labeling challenges. This section will discuss two: First, the concern of labeling DTC medical self-diagnosing AI apps as what I call “information-only” tools, and second, particular issues associated with the use of AI, ranging from bias to adaptive algorithms. It will also make suggestions on how to address these challenges. While the following remarks focus on medical devices, they may also have implications for those DTC apps that fall outside the FDA’s statutory authority.

A The Development of “Internet Plus Health Care” in China

China’s health system has long been criticized for its inequitable distribution of health resources and unequal access to health care. To address these deeply rooted problems, particularly the weak provision of primary health care at grassroots level, the Chinese central government initiated a new round of health reform in 2009. Digital technologies, across a range of measures, have been employed as a feasible modern channel for promoting equitable, affordable, and universal access to health for all.Footnote ⁷

As far back as the 1990s, some of the first attempts at using digital technologies to improve access to quality health services were initiated. In 1988, the first remote consultation center was founded, which enabled the discussion of neurosurgery cases between Chinese and German hospitals via satellite.Footnote ⁸ With the development of information technology (IT), many medical institutions in urban areas started to establish remote consultation centers for exchanging knowledge and sharing experience with lower-level medical institutions. More importantly, the government made special efforts to support remote diagnosis in rural and mountainous regions as a means of addressing geographic barriers to access health care services. For example, many village clinics were equipped with computer terminals, despite the then poor IT infrastructure in these regions. As a result, a relatively robust physical and IT infrastructure was deployed for IPHC.

Since the beginning of the twenty-first century, a variety of regulatory and policy instruments have been adopted to facilitate the development of IPHC. With supportive policies, giant IT companies such as Alibaba and Tencent began to leverage their advances in digital technologies to establish online platforms and mobile applications to provide health-related services. In the meantime, public medical institutions also started to establish their own internet platforms. In 2012, the first public online hospital platform was founded in Guangdong Province.Footnote ⁹ Provinces with scarce health resources took the initiative to issue favorable policies to attract medical companies to set up internet hospitals as a means of improving access to health for their residents. The favorable policies and innovative technologies have stimulated the rapid development of IPHC during this period. In 2018, the aforementioned Opinions on Promoting the Development of “Internet Plus Health Care” (Opinions) document was released, with an overall aim to promote IPHC and guarantee equitable, affordable, and universal access to health for all. For quality assurance purposes, platform-based internet hospitals with no offline facilities were no longer allowed. In particular, this document required authorities to develop implementation rules and action plans for governing IPHC. A preliminary regulatory framework was thus established (see details in Section II.B). In September 2018, the National Health Commission (NHC) and the Government of Ningxia Hui Autonomous Region signed a strategic agreement to establish the first national IPHC pilot demonstration area, and in May 2019, the NHC signed similar agreements with another ten provinces and municipalities. In short, tremendous efforts had been made to promote the development and use of IPHC before the COVID-19 pandemic. However, the use of IPHC remained limited in practice due to regulatory restrictions and poor technical maintenance.

The COVID-19 outbreak has become a turning point in this area. The Chinese government has made several regulatory changes to make IPHC more widely used and to ensure the continued provision of health care when in-person services were not available during the health emergency. These changes include the relaxation of limitations on the scope of IPHC services and the expansion of health insurance coverage. The NHC also issued guidelines urging public hospitals to introduce or further develop IPHC as a means of relieving pressure on overloaded offline facilities. As a result, IPHC has obtained greater acceptance and its use surged during the pandemic. Statistical reports show that, by 2021, the number of licensed internet hospitals in China exceeded 1,600, while the user size of IPHC amounted to 298 million, accounting for 28.9 percent of all Internet users.Footnote ¹⁰

B Current Regulatory Framework of “Internet Plus Health Care”

In 2018, the NHC and National Administration of Traditional Chinese Medicine (NATCM) issued three consecutive normative documents for trial implementation as a response to the requirements of the Opinions mentioned above: The Administrative Measures for Internet-based Diagnosis and Treatment (AMIDT), Administrative Measures for Internet Hospital (AMIH), and Administrative Regulations on Remote Medical Service (ARRMS).Footnote ¹¹ The AMIDT and ARRMS provide norms and guidelines for the provision of “internet-based diagnosis and treatment” and “remote diagnosis and treatment.”Footnote ¹² These two documents also make it clear that medical institutions and qualified health personnel are eligible to provide such services. According to the AMIH, there are two different operating models of internet hospitals. The AMIH stipulates stringent licensing and operation requirements for each type of internet hospital. It also sets out registration and practicing requirements for physicians who practice at internet hospitals.

In addition, as will be discussed further in Section III.C, the National Health Security Administration (NHSA) issued a series of guidance documents regarding the reimbursement and coverage of internet-based medical services during the pandemic, so as to make IPHC more widely affordable to patients.

Safety is at the heart of health care services, and internet-based diagnoses are no exception. After three years of trial implementation, the NHC published its Regulatory Rules on Internet-based Diagnosis and Treatment in March 2022, with an aim to reinforce governance structures and oversight mechanisms for internet-based diagnosis as well as the related medical institutions and health personnel.Footnote ¹³ The new Regulatory Rules set out guiding principles for the supervision of internet-based diagnosis and outlined explicit regulatory requirements for medical institutions providing such services. This regulatory document requires provincial health administrations to establish their own regulatory platforms and implement real-time supervision of medical institutions that provide internet-based diagnosis within their jurisdiction, to ensure that internet-based diagnoses meet the same quality as in-person services. Built on these documents, a preliminary regulatory framework for IPHC has been created. Table 11.1 summarizes the legal and policy documents that have an impact on IPHC.

C Types of “Internet Plus Health Care” Services

A Restrictions on Internet-Based Diagnosis

As internet-based diagnosis is a brand-new model of medical service delivery, the NHC has taken a deliberate approach and limited it to “follow-up” diagnoses for “common diseases” and “chronic diseases” in the interests of patient safety and quality of care. Yet, after years of trial implementation, this restriction has raised considerable controversy.

First, the definition and scope of common and chronic diseases is not clear. The AMIDT stipulates that internet-based diagnosis is restricted to “certain” common and chronic diseases, without specifying which diseases fall within that scope. Even though detailed implementation plans of the AMIDT were formulated by provincial health administrations, the wording remained the same. In real practice, the interpretation of this guidance depends largely on the discretion of physicians due to the lack of legal clarity.

Second, it is difficult to verify whether a common or chronic disease was first diagnosed in an offline hospital. According to the AMIDT and other provincial implementation plans, internet hospitals should request to see medical records directly from patients or from other medical institutions with patients’ authorization before diagnosis. Yet, for information security, internet hospitals are less likely to access other institutions’ EMR databases, unless there is a preexisting partnership (e.g., a medical consortium). Patients, in particular the elderly, may neither reserve paper medical records nor understand how to upload their records onto the Internet. In practice, physicians collect patient medical records simply to fulfil regulatory requirements. It is not feasible for them to authenticate patients’ first in-person diagnoses. During the COVID-19 emergency, the NHC lifted the requirement for first in-person diagnoses. Patients with suspected coronavirus symptoms would have an internet-based diagnosis before going to the hospital. This gives rise to the question: Is it still necessary to prohibit internet hospitals from providing a first diagnosis, even just for common or chronic diseases?

After many years of IPHC development, there are plenty of discussions in academia and industry about relaxing the restrictions on the scope of internet-based diagnosis. Arguably, internet hospitals have an obvious limitation: Medical services, such as physical examinations and diagnostic tests, must be conducted in-person in offline hospitals. Therefore, because of quality and safety concerns, strict measures have been taken to regulate the operation of internet hospitals. Prior to the COVID-19 pandemic, internet hospitals just served as a supplement to offline hospitals. Yet the demand for IPHC significantly increased during the health emergency. As such, national and provincial health administrations have issued a number of guidance documents to provide temporary regulatory flexibility, so as to make internet hospitals more widely accessible. Internet hospitals have now become a part of mainstream medical service delivery, and the NHC, in its newly released National Health Informatization Program in the Fourteenth Five-year Plan, intends to set up electronic health files and electronic medical records for every citizen. These provide a good opportunity to conduct further research on the potential and proper trades-offs between convenience of access to health care and safety of service and privacy, while loosening the regulations on internet-based diagnosis.

B Physician Multi-site Practicing

Physician multi-site practicing (PMP) is expected to advance the implementation of IPHC.Footnote ¹⁴ PMP is designed as a mechanism to address health professional shortages and improve efficient and equitable allocation of medical resources.Footnote ¹⁵ For example, as Haodaifu (“good doctor” in Mandarin) Online (one of the biggest platform-based internet hospitals in China) claims, there are more than 240,000 physicians registered on its platform, more than 70 percent of whom are from tertiary hospitals across the country.Footnote ¹⁶ PMP makes it possible for patients living in remote rural areas to receive internet-based diagnoses provided by physicians in big cities, such as Beijing and Shanghai, at home.

PMP needs regulatory clarification. Since the new round of health system reforms in 2009, the Chinese government has issued various guidance documents to encourage physicians to practice at multiple sites. In 2017, the Administrative Measures for the Registration of Practicing Medical Doctors took effect and released limitations on the number and geographic location of medical institutions at which a physician is permitted to practice.Footnote ¹⁷ More importantly, the measures simplified the registration procedures for PMP. Approval from the primary practice institution is no longer necessary. Nevertheless, this requirement was once again included in the 2018 Administrative Measures for Internet-based Diagnosis and Treatment. As a result, physicians have to obtain the approval from their primary practice institution before practicing at any internet hospital. Therefore, further clarification is needed regarding the regulation of PMP.

To a lesser extent, even though prior approval would not be necessary for multi-practicing online, it does not mean that the primary practice institution has no de facto discretion when it comes to PMP. In China, most physicians are hired by medical institutions (in most instances their primary practice institution) and are, thus, subject to the personnel management of the institution. Physicians are the most valuable medical resources and the core competence of any medical institution. Arguably, PMP would have a considerable impact on the operation of the primary practice institution. Also, given the high workload in public medical institutions and especially tertiary hospitals, some institutions may take administrative measures to restrict de facto PMP, except for in their affiliated online or offline institutions.

There are also concerns over the affordability and quality of care regarding PMP. On the one hand, prices for medical services provided by public medical institutions, whether online or offline, are capped by governments, while those provided by non-public medical institutions (e.g., platform-based internet hospitals) are self-determined. In addition, as will be discussed further in the next section, medical services provided by non-public medical institutions are generally not covered by the country’s mandatory basic medical insurance (BMI) schemes, unless these institutions choose to negotiate prices and sign contracts with local health insurance bureaus (i.e., insurers).Footnote ¹⁸ Consequently, the service fees charged by non-public medical institutions are higher than public ones and patients have to pay all the service fees out-of-pocket, unless the patient has extra commercial insurance to cover all or parts of the expenses. For instance, for the same specialist, the outpatient service fee charged by the aforementioned Haodaifu Online could be ten times higher than that of the tertiary hospital. On the other hand, physicians are better paid under this circumstance. Financial incentives could motivate them to allocate more (free) time to platform-based internet hospitals, and waiting times for hospital admission would, thus, be significantly reduced. However, there is a dilemma for patients: PMP at platform-based internet hospitals makes medical services provided by specialists more accessible, yet less affordable. In other words, patients need to pay more money in exchange for a shorter waiting time for specialist medical services. PMP may also have a negative impact on the quality of care provided by the specialist’s primary practice institution. Therefore, national and provincial health administrations have made some principal guidelines on PMP, requiring physicians to give priority to the work at their primary practice institution. It would thus be important for policy makers to consider complementary measures to encourage as well as to regulate PMP, so as to further improve the accessibility, affordability and quality of health care.

C Affordability of IPHC

Affordability is one of the key determinants of IPHC. The NHSA has, therefore, issued a series of policies to make IPHC more affordable to patients. In 2019, the NHSA announced for the first time that all eligible “internet plus” medical services would gradually be covered by medical insurance in the Guiding Opinions on Improving the “Internet Plus” Medical Service Price and Medical Insurance Coverage Policy.Footnote ¹⁹ This document authorizes provincial health insurance bureaus to set prices for internet-based diagnoses and other medical services provided by public medical institutions, while non-public medical institutions are allowed to set their own service prices. Nevertheless, prior to the COVID-19 pandemic, internet-based medical services had not started to be covered by BMI schemes.

In response to the COVID-19 outbreak, the NHSA and NHC issued their Guiding Opinions on Promoting “Internet Plus” Medical Insurance Service during the Prevention and Control of COVID-19, expanding the BMI coverage to make internet-based diagnosis and other medical services more affordable.Footnote ²⁰ The pricing policy remains unchanged in this guidance document. BMI programs would cover and reimburse internet-based diagnoses for common and chronic diseases provided by designated public medical institutions that voluntarily signed a supplementary contract with local health insurance bureaus. Internet-based diagnoses provided by designated non-public medical institutions would also be reimbursed, but at the same rate as public medical institutions if non-public institutions choose to provide such services. Multiple provinces and municipalities have also taken actions to temporarily broaden provincial BMI schemes to cover internet-based diagnoses, as well as expand the types of internet hospitals which may provide such services.

Several months later, the NHSA issued another document, Guiding Opinions on Actively Promoting Medical Insurance Coverage of “Internet Plus” Medical Service, establishing concrete measures to promote the reimbursement and coverage of internet-based medical services.Footnote ²¹ The new Guiding Opinions make clear that a voluntary supplementary contract between designated medical institutions and local health insurance bureaus is a prerequisite for BMI coverage. Payment parity is granted, which means that internet-based diagnoses will be reimbursed at the same rate as the equivalent in-person services provided by public medical institutions offline. However, this document does not require service parity. Provincial health insurance bureaus are authorized to determine the coverage of services in their own insurance plans. Research suggests that twenty-one Chinese provinces have so far expanded their provincial BMI coverage of internet-based diagnoses, while the scope of coverage varies from province to province.Footnote ²² In addition, as just explained, non-public medical institutions could set their own pricing for medical services, no matter whether they are provided online or offline. Such services will not be covered nor reimbursed by BMI schemes, unless these institutions choose to negotiate prices and sign contracts with local health insurance bureaus.Footnote ²³

To sum up, affordability was, is, and may still be a major barrier for the utilization of IPHC. Although the NHSA has issued a number of polices to expand coverage, most of them only provide principal guidelines, without an integrated regulatory framework for “internet plus” health insurance coverage and reimbursement.