sec-1

1. Introduction

Objective •This guideline takes reference from the IMDRF’s Framework for Software as a Medical Device (SaMD) to determine the risk classification of Standalone Medical Mobile Applications that are Medical Devices (commonly referred as SaMD) •This guideline also provides clarity on the qualification of Clinical Decision Support Software (CDSS) as regulated medical devices or otherwise, as well as the current regulatory approach and requirements for such software that are regulated by HSA •The guidelines reflect HSA’s current policy stance and practice, and should not be misconstrued as new regulatory controls on software medical devices and CDSS IMDRF, Software as a Medical Device (SaMD): Possible Framework for Risk Categorization and Corresponding Considerations, 18 September 2014 Definitions Standalone Medical Mobile Application A software and/or mobile application that is intended to be used for one or more medical purposes that function by itself and are not intended for use to control or affect the operation of other hardware medical devices NOTE: Standalone Medical Mobile Application is intended to run on general computing device (e.g. laptop, tablet, desktop and etc.). These are commonly referred to as Software as Medical Devices (SaMD) Intended Purpose/ Intended Use (as defined in the Health Products (Medical Devices) Regulations 2010) In relation to a medical device or its process or service, means the objective intended use or purpose, as reflected in the specifications, instructions and information provided by the product owner of the medical device

sec-2

2. Classification

Risk Classification Framework The Risk Classification Framework for SaMD will take into consideration the following: i.The significance of information provided by the SaMD to healthcare decision: to treat or diagnose, to drive clinical management, or to inform clinical management and; ii.The state of the patient’s healthcare situation or condition: critical, serious, or non-serious iii.Existing GN-13 Guidance on Risk Classification of General Medical Devices and the risk classification rules therein IMDRF, Software as a Medical Device (SaMD): Possible Framework for Risk Categorization and Corresponding Considerations, 18 September 2014 Risk Classification Framework Treat or to diagnose Treating and diagnosing infers that the information provided by the SaMD will be used to take an immediate or near term action: •To treat/prevent or mitigate by connecting to other medical devices, medicinal products, general purpose actuators or other means of providing therapy to a human body •To diagnose/screen/detect a disease or condition (i.e., using sensors, data, or other information from other hardware or software devices, pertaining to a disease or condition) Risk Classification Framework Drive clinical/patient management Driving clinical/patient management infers that the information provided by the SaMD will be used to aid in treatment, aid in diagnosis, to triage or identify early signs of a disease or condition, will be used to guide next diagnostics or next treatment interventions: •To aid in treatment by providing enhanced support to safe and effective use of medicinal products or a medical device •To aid in treatment as an adjunct to standard clinical treatment •To aid in diagnosis by analyzing relevant information to help predict risk of a disease or condition or as an aid to making a definitive diagnosis •To triage or identify early signs of a disease or conditions Inform clinical/patient management Informing clinical/patient management infers that the information provided by the SaMD will be used: •To inform of options for treating, diagnosing, preventing, or mitigating a disease or condition •To provide clinical information by aggregating relevant information (e.g., disease, condition, drugs, medical devices, population, etc.) Risk Classification Framework Critical situation or condition Situations or conditions where accurate and/or timely diagnosis or treatment action is vital to avoid death, long-term disability or other serious deterioration of health of an individual patient or to mitigating impact to public health. The SaMD is considered to be used in a critical situation or condition where: •The type of disease or condition is: •Life-threatening state of health, including incurable states •Requires major therapeutic interventions •Sometimes time critical, depending on the progression of the disease or condition that could affect the user’s ability to reflect on the output information •Intended target population is fragile with respect to the disease or condition (e.g., pediatrics, high risk population, etc.) •Intended for specialized trained users Note: Devices intended for specialized trained users refer to devices that is to be used by an individual who has undergone such training on the safe and efficacious use of the medical device as is necessary. Risk Classification Framework Serious situation or condition Situations or conditions where accurate diagnosis or treatment is of vital importance to avoid unnecessary interventions (e.g., biopsy) or timely interventions are important to mitigate long term irreversible consequences on an individual patient’s health condition or public health. The SaMD is considered to be used in a serious situation or condition when: •The type of disease or condition is: •Moderate in progression, often curable •Does not require major therapeutic interventions •Intervention is normally not expected to be time critical in order to avoid death, long-term disability or other serious deterioration of health, whereby providing the user an ability to detect erroneous recommendations •Intended target population is NOT fragile with respect to the disease or condition •Intended for either specialized trained users or lay users Risk Classification Framework Non-Serious situation or condition Situations or conditions where an accurate diagnosis and treatment is important but not critical for interventions to mitigate long term irreversible consequences on an individual patient's health condition or public health. The SaMD is considered to be used in a non- serious situation or condition when: •The type of disease or condition is: •Slow with predictable progression of disease state (may include minor chronic illnesses or states), •May not be curable; can be managed effectively, •Requires only minor therapeutic interventions, and •Interventions are normally noninvasive in nature, providing the user the ability to detect erroneous recommendations •Intended target population is individuals who may not always be patients •Intended for use by either specialized trained users or lay users Significance of information provided by SaMD to healthcare decision To determine the risk classification of IVD SaMD please refer to GN-14 Guidance on the Risk Classification of IVD Medical Devices R2 ► * SaMD will be classified as Class B if they are intended to analyse, measure or monitor: (i) a vital physiological process (e.g., heart rate, blood pressure, respiratory rate, body temperature), or (ii) anatomical structure images (e.g., X-rays of bones, ultrasound images of organs, intraoral images) in order to drive clinical/patient management. This is consistent with rule 10(i) of GN-13 ◄ Examples Software intended for healthcare professionals to predict the risk of developing migraine by analysing patient inputs to common migraine triggers such as dietary changes, sleeping habits and duration, self-perceived stress levels and consumption of prescribed medications Significance of information To drive clinical management; software provides information to predict the risk of developing migraine State of Healthcare situation or condition Non-serious condition; migraine can be managed effectively and requires only minor therapeutic interventions Risk Classification of SaMD as per Non-IVD SaMD Risk Classification Table: Class A Software intended for healthcare professionals to acquire and monitor physiological signals from devices to detect early signs of mild sleep apnoea Significance of information To drive clinical management; software provides information to predict and identify the early signs of mild sleep apnoea State of Healthcare situation or condition Non-serious condition; mild sleep apnoea can be managed effectively and requires only minor therapeutic interventions Risk Classification of SaMD as per Non-IVD SaMD Risk Classification Table: Class B* * SaMD will be classified as Class B if intended to image, measure or monitor a physiological process to drive in clinical/patient management Examples Software intended to provide sound therapy to treat, mitigate or reduce effects of tinnitus Significance of information To treat; software utilizes sound therapy to reduce the effects of tinnitus State of Healthcare situation or condition Non-serious condition; Tinnitus is not a medically serious condition which requires only minor therapeutic interventions Risk Classification of SaMD as per Non-IVD SaMD Risk Classification Table: Class B Examples Examples Software intended for lay users to analyse self-taken photographs of moles. The software analyses the photographs taken and flags out unusual or irregular moles that could indicate an increased risk of melanoma Significance of information To drive clinical management; the software provides information to the lay user to assist in the identification of atypical moles that could be a risk factor for melanoma State of Healthcare situation or condition Serious condition; intended target population is not fragile with respect to the disease or condition; intervention is normally not expected to be time critical in order to avoid death, long-term disability or other serious deterioration of health Risk Classification of SaMD as per Non-IVD SaMD Risk Classification Table: Class B Software intended for healthcare professionals to analyse electrocardiogram data to aid in the diagnosis of heart arrhythmias Significance of information To drive clinical management; provides information to clinicians to aid in the diagnosis of arrhythmia State of Healthcare situation or condition Serious condition; do not require major therapeutic interventions. Additionally, the intervention is normally not expected to be time critical in order to avoid death, long-term disability or other serious deterioration of health Risk Classification of SaMD as per Non-IVD SaMD Risk Classification Table: Class B Examples Examples Software intended for healthcare professionals to provide cognitive behaviour therapy as an adjunct to contingency management system, for patients with substance use disorder Significance of information To drive clinical management; intended to aid in treatment of patients with substance use disorder, used as an adjunct to standard clinical treatment State of Healthcare situation or condition Serious condition; do not require major therapeutic interventions. Additionally, the intervention is normally not expected to be time critical in order to avoid death, long-term disability or other serious deterioration of health Risk Classification of SaMD as per Non-IVD SaMD Risk Classification Table: Class B Software intended for healthcare professionals to analyse a patient’s skin lesion images to aid in the classification of malignant and benign lesions Significance of information To drive clinical management; the software provides information to the clinician to assist in the evaluation of potentially malignant lesions State of Healthcare situation or condition Serious condition; do not require major therapeutic interventions. Additionally, the intervention is normally not expected to be time critical in order to avoid death, long-term disability or other serious deterioration of health Risk Classification of SaMD as per Non-IVD SaMD Risk Classification Table: Class B Examples Software intended for healthcare professionals to collect and analyse vital sign readings to triage or risk stratify patients for risk of Major Adverse Cardiac Event (MACE) at the emergency department Significance of information To drive clinical management; software is used to triage, risk stratify or identify early signs of a disease or conditions State of Healthcare situation or condition Critical condition; timely diagnosis or treatment action is vital to avoid death, long-term disability or other serious deterioration of health of an individual patient Risk Classification of SaMD as per Non-IVD SaMD Risk Classification Table: Class C Examples Software intended for healthcare professionals to analyse patient eye images to diagnose for diabetic retinopathy Significance of information To diagnose; software is used to diagnose diabetic retinopathy State of Healthcare situation or condition Serious condition; do not require major therapeutic interventions. Additionally, the intervention is normally not expected to be time critical in order to avoid death, long-term disability or other serious deterioration of health Risk Classification of SaMD as per Non-IVD SaMD Risk Classification Table: Class C Examples

sec-3

3. Clinical Decision Support Software

Background •Clinical Decision Support Software (CDSS) are standalone software (including mobile applications, cloud based and web- based software) that can perform a wide range of functions for healthcare professionals, patients and caregivers to support clinical practice, clinical and patient management •Not all CDSS in the market are medical devices, this document serves to provide clarity in qualification of CDSS i.e. in identifying a CDSS that may be classified as a medical device and on the risk classification of CDSS medical devices based on the Risk Classification Table Intended Use •The intended use of the CDSS, taking into account the way the product is designed and/or presented will determine whether it will be regulated as a medical device •If the intended use meets the definition of a medical device in the First Schedule of Health Products Act (Act), then it would be subject to regulatory controls by HSA and considered a SaMD •CDSS intended for medical purposes such as investigation, detection, diagnosis, prevention, monitoring, treatment or management of any medical condition, disease, anatomy or physiological process; will be classified as a medical device subject to regulatory controls by HSA The CDSS will not be regulated as a medical device if: the intended use does not meet the definition of a medical device in the First Schedule of the Act OR the CDSS is intended solely for the display or printing of medical information* about a patient or other medical information (such as demographic information, drug labelling, clinical guidelines, studies or recommendations) *Does not include real time patient information intended for patient monitoring or treatment decisions R2 ► OR Output/recommendations of CDSS is solely based on established clinical guidelines** **Recognised national or international clinical guidelines such as those published by Agency for Care Effectiveness, American Heart Association, World Health Organization ◄ Qualification (MD/ Non-MD) Non-MD CDSS Software that are solely intended for the display and printing* of medical information or do not meet the definition of a medical device are not regulated as medical devices Such software typically do not analyse any patient specific information and do not provide any recommendations to the prevention, diagnosis, treatment or alleviation of any disease or condition *Does not include real time patient information intended for patient monitoring or treatment decisions Non-MD CDSS R2 ► Software are not regulated as medical devices when the software is designed in a manner that their output or recommendations are solely based on established clinical guidelines. Such software serves as a repository of medical information in digital format and do not generate new or modified clinical recommendations beyond what are established in the clinical guidelines. ◄ *Does not include real time patient information intended for patient monitoring or treatment decisions Is the CDSS intended solely for the display or printing of medical information* about a patient or other medical information? R2 ► Is the output or recommendations of the CDSS solely based on established clinical guidelines? R2 ► Does the CDSS meet the definition of a Medical Device? CDSS is classified as a Non-Medical Device Refer to Non-IVD SaMD Risk Qualification •Patient appointment and surgery schedule management software •Software intended for patient billing purposes •Calculator software for clinicians to perform routine simple medical calculations (Eg: BMI, Water content, Convert from mmol/L to mg/dL) •Laboratory Information Management System (LIMS) or Laboratory Information System (LIS) to support a laboratory work flow and data tracking •Software incorporating a digitised clinical decision flow with no analysis performed on patient information •Software that displays information (Eg: Dosage) about drugs or medical devices that are consistent with approved labels •Software for tracking of the end user’s diet or exercise Non-MD CDSS Examples Non-MD CDSS Examples •Software performing a diary function (Eg: Daily recording of pain scores, bowel function) •Electronic Health Record software intended to display, receive, collect and store patient medical records and data with no processing or analysis •Software intended for providing medical information (Eg: Clinical guidelines) to healthcare professionals for reference, quality assurance or training purposes •Software solely intended to allow healthcare professionals to perform teleconsultation or telecollaboration and communicate between clinicians or patients •Survey or chat-based triaging software that refers user to seek healthcare professional advice based on user indicated symptoms •Software solely to promote general wellness of users Non-MD CDSS Examples •Software that provides calendar tools for tracking of menstrual cycles •Software that provides calendar tools to for tracking of progress through IVF treatment cycles •Drug dosage calculator based on established clinical guidelines •Software performing a library function to allow users to reference information based on established clinical guidelines or literature (Eg: Criteria for diagnosis of diabetes based on plasma glucose readings, clinical decision flow for treatment of patients with diabetes) R2 ► Non-MD CDSS Examples Software intended for healthcare professionals to analyse a patient’s symptoms and test results against accepted clinical guidelines to recommend specific diagnostic tests or therapy R2 ► CriteriaMet? Is the CDSS intended solely for the display or printing of medical information* about a patient or other medical information? No Is the output or recommendations of the CDSS solely based on established clinical guidelines? Yes; recommendations provided by the software is based on clinical guidelines and healthcare professional is able to independently verify the recommendation R2 ► Non-MD CDSS Examples Software intended for healthcare professionals to analyse a patient’s test results to recommend the most appropriate surgical action and describes a surgical workflow based on accepted clinical guidelines R2 ► CriteriaMet? Is the CDSS intended solely for the display or printing of medical information* about a patient or other medical information? No Is the output or recommendations of the CDSS solely based on established clinical guidelines? Yes; recommendations provided by the software is based on clinical guidelines and healthcare professional is able to independently verify the recommendation R2 ► Non-MD CDSS Examples Software intended for healthcare professionals to analyse a patient’s R2 ► IVD HbA1c test ◄ result to provide treatment recommendations for diabetes based on accepted clinical guidelines R2 ► CriteriaMet? Is the CDSS intended solely for the display or printing of medical information* about a patient or other medical information? No Is the output or recommendations of the CDSS solely based on established clinical guidelines? Yes; recommendations provided by the software is based on clinical guidelines and healthcare professional is able to independently verify the recommendation

sec-4

References

IMDRF, Software as a Medical Device (SaMD): Possible Framework for Risk Categorization and Corresponding Considerations, 18 September 2014 Health Canada, Software as a Medical Device (SaMD): Definition and Classification, 03 October 2019 TGA Australia, Clinical Decision Support Software (CDSS): Scope and examples, October 2021 US FDA, Clinical Decision Support Software (CDSS): Draft Guidance for Industry and Food and Drug Administration Staff, 27 September 2019