Legal Analysis of the Medical Device Classification and Regulatory Compliance of Digital Therapeutics Products

This article is reposted from the official account of AnJie Law Firm, authored by Cai Hang, Gu Long, and Liu Dayu. Reposted with authorization by VCBeat.

Traditionally, disease diagnosis and treatment have been the domain of hospital-based physicians. However, thanks to advances in information technology, “digital therapeutics” have enabled AI-driven medical software to become an essential tool for clinical consultations, with some digital therapeutic products even capable of providing definitive diagnostic opinions directly. In the past two years, investment in digital therapeutics has emerged as one of the hottest topics within the healthcare segment of the investment community. According to a recent report by McKinsey, annual investment in digital therapeutics in the United States has grown at an average rate of 40% over the past seven years [1]. Compared with the United States, digital therapeutics started later in China but have developed rapidly.

Recently, the research task force on “Research on the Evaluation and Certification Standard System for Digital Therapeutics,” jointly initiated by the Preparatory Committee of the Digital Therapeutics Professional Committee of the China Health Promotion Association for Science and Technology and other entities, was officially established. This initiative will facilitate the establishment of a national evaluation and certification standard system for digital therapeutics and promote the development of China’s digital health industry. From the perspectives of digital therapeutics product classification and corporate business models, this article analyzes the pharmaceutical compliance requirements and legal implications associated with digital therapeutics products, aiming to provide feasible practical recommendations for enterprises.

Digital Therapy (or DTx) was first proposed by Dr. Joseph Kvedar, a dermatologist at Massachusetts General Hospital in Boston, for the care of patients with diabetes.^[2]. In 2017, the U.S. Food and Drug Administration (FDA) approved the first digital therapeutic product, reSET, an app developed by Pear Therapeutics for the treatment of non-opioid use disorder.^[3]. Based on unofficial data, nearly 30 digital therapeutics products had received FDA approval by early 2021^[4]。

According to the definition provided by the Digital Therapeutics Alliance (DTA), a non-profit organization established in the United States, digital therapeutics (DTx) deliver evidence-based therapeutic interventions driven by high-quality software to treat, manage, or prevent a medical disorder or disease.^[5]Digital therapeutics are often confused with the concepts of digital medicine and digital health. In reality, these three terms have a hierarchical, inclusive relationship: digital health has the broadest definition, encompassing technologies, platforms, and systems that intervene in consumers’ lifestyles, health status, and other health-related aspects; digital medicine refers to technologies, platforms, or products that fall under the concept of digital health and are evidence-based, suitable for use in medical processes; digital therapeutics have the narrowest scope, referring to therapeutic interventions that align with the concept of digital medicine, are driven by core software, and are used to prevent, manage, or treat diseases. As all three concepts are imported from abroad, China has not yet established unified definitions, particularly for digital therapeutics and digital medicine (sometimes translated as “digital drugs”), whose definitions overlap. Similarly, these concepts have not yet been adopted in normative documents issued by the National Medical Products Administration (NMPA). Currently, official Chinese concepts analogous to these include “AI-based medical software” and “mobile medical devices.”

Given the close connection between healthcare and the right to life and health, countries impose strict regulations on products with medical attributes. Taking the United States as an example, the Digital Therapeutics Alliance (DTA) categorizes digital health products into three types: (1) treating a specific disease; (2) managing a specific disease; and (3) improving a specific health condition [6]. In terms of risk levels, category (3) is considered low-to-moderate risk, while categories (1) and (2) are regarded as moderate-to-high risk. According to FDA regulations, digital health products are regulated as Software as a Medical Device (SaMD) and generally require clinical trials to demonstrate safety and efficacy.

According to ClinicalTrials data,^[7]Currently, there are 4,584 digital therapeutics clinical trials worldwide, with the United States, Europe, and China ranking in the top three with 1,644, 1,340, and 375 trials, respectively. By indication, the highest numbers of clinical trials for digital therapeutics products are in mental disorders (789), psychotic disorders (788), and central nervous system diseases (507). Commercially available digital therapeutics products include Somryst, developed by Pear Therapeutics for insomnia; EndeavorRx, developed by Akili Interactive for attention-deficit/hyperactivity disorder (ADHD); and Limbix Spark, developed by Limbix for depression.^[8]etc. Furthermore, digital therapeutics products are also applied to indications such as endocrine disorders (e.g., diabetes, obesity), respiratory diseases (e.g., asthma, sleep apnea), and circulatory system diseases (e.g., hypertension, arrhythmia).

The primary issue to clarify is whether digital therapeutics (DTx) products qualify as medical devices. If they do, clinical trials or equivalence comparisons with predicate devices must be conducted (as applicable, with detailed analysis provided below), and a Medical Device Registration Certificate must be obtained. Relevant manufacturing and distribution enterprises are required to obtain the corresponding qualifications for medical device production and operation, comply with the Good Manufacturing Practice (GMP) and Good Supply Practice (GSP) for medical devices, and remain subject to ongoing post-market compliance supervision (such as establishing an adverse event monitoring system). If they do not qualify as medical devices, they are not subject to medical device regulations, and regulatory oversight of product sales, usage, promotion, and other activities will be relatively less stringent.

Pursuant to the Regulations on the Supervision and Administration of Medical Devices, medical devices refer to instruments, equipment, appliances, in vitro diagnostic reagents and calibrators, materials, and other similar or related articles, including the necessary computer software, that are used directly or indirectly on the human body. Their efficacy is primarily achieved through physical or other means, with the purpose of diagnosing, preventing, monitoring, treating, or alleviating diseases. According to the 2015 Rules for the Classification of Medical Devices, medical devices include standalone software (active non-contact medical devices), which serves one or more medical purposes, can fulfill its intended purpose without medical device hardware, and operates on general-purpose computing platforms. As such, software products have a legal basis and classification grounds for registration as medical devices. Digital therapeutics products generally manifest as software products or contain software components; however, whether specific digital therapeutics products are classified as medical devices primarily depends on how health management software is distinguished from software-based medical devices.

Regarding this issue, the first normative document of reference value issued was the “Announcement on the Technical Review Guidelines for the Registration of Mobile Medical Devices” (the “Mobile Medical Device Guidelines”) released by the China Food and Drug Administration (CFDA) in 2017. Under this Announcement, “mobile medical devices” refer to devices and/or software that utilize non-invasive “mobile computing terminals” to achieve one or more medical purposes. Mobile medical devices contain medical device software or are themselves standalone software, and are specifically categorized into: (1) mobile medical equipment; (2) mobile standalone software; and (3) mobile medical accessories (including control-type and data-type) [9]. The Mobile Medical Device Guidelines further clarify that the intended use of mobile computing devices or software serves as the criterion for determining their status as medical devices: generally, mobile computing devices or software intended for health management, targeting healthy populations, and recording or statistically analyzing health information do not have a medical purpose and do not constitute mobile medical devices; whereas those intended for disease management, targeting healthcare professionals and patients, controlling or driving medical devices, or processing, analyzing, and monitoring medical data/images have a medical purpose and constitute mobile medical devices.

Subsequently, in 2021, the National Medical Products Administration (NMPA) issued the “Notice on Guidelines for the Classification and Definition of Artificial Intelligence Medical Software Products” (the “AI Medical Software Guidelines”), which introduced and elaborated on the concept of “artificial intelligence medical software products” for the first time. AI medical software refers to standalone software that utilizes artificial intelligence technologies to achieve its intended medical purposes based on medical device data. To be regulated as a medical device, such software must simultaneously meet three criteria: (1) the data processed by the product must be medical device data; (2) its core functions involve the processing, measurement, model-based calculation, analysis, etc., of medical device data; and (3) it is intended for medical purposes.

The Guidelines for Mobile Medical Devices issued in 2017 and the Guidelines for AI-Based Medical Software issued in 2021 both serve as references for determining whether a digital software product qualifies as a medical device and for establishing the criteria for such classification. The regulatory standards of these two guidelines are further organized and differentiated as follows:

According to the Regulations on the Supervision and Administration of Medical Devices, the state classifies medical devices into three categories based on their risk levels, from low to high, and implements classified management. According to the latest version of the Catalogue of Medical Device Classification, standalone medical software falls under Category 21, which includes six primary product subcategories: treatment planning software, image processing software, data processing software, decision support software (software that provides decisions such as auxiliary diagnosis or medication recommendations), in vitro diagnostic software, and others (primarily rehabilitation training software). The Catalogue of Medical Device Classification further stipulates that the risk level of diagnostic function software is determined based on factors such as the risk level, maturity, and transparency of the algorithms employed, rather than solely on the objects being processed (e.g., images of diseases such as cancer or malignant tumors). If diagnostic software provides diagnostic recommendations through its algorithms, serving only an auxiliary diagnostic function without directly issuing a diagnostic conclusion, it is regulated as a Class II medical device. If diagnostic software automatically identifies lesions through its algorithms (e.g., Computer-Aided Detection/Diagnosis [CAD], excluding bone mineral density) and provides clear diagnostic prompts, it is considered to have a relatively higher risk level and is regulated as a Class III medical device.

Given that the “Medical Device Classification Catalog” struggles to encompass the ever-emerging medical software products on the market (particularly novel medical software that has not yet been marketed or whose safety and effectiveness have not been fully demonstrated), the aforementioned guidelines for AI-based medical software provide new criteria for classification determination:

1) For AI-based medical software with low maturity in clinical applications (i.e., not yet marketed or whose safety and effectiveness have not been fully demonstrated), if used for decision support—such as providing clinical diagnostic and therapeutic recommendations including lesion feature recognition, determination of lesion nature, medication guidance, and treatment planning—it shall be regulated as a Class III medical device; if used for non-decision-support purposes—such as data processing and measurement to provide clinical reference information—it shall be regulated as a Class II medical device.

2) For AI-based medical software with a high level of maturity in clinical applications (i.e., safety and effectiveness have been fully demonstrated), the regulatory classification shall be implemented in accordance with the current “Medical Device Classification Catalog” and related classification determination documents.

In accordance with the Regulations on the Supervision and Administration of Medical Devices and the Measures for the Administration of Medical Device Registration and Filing, Class II and Class III medical devices are subject to product registration management. Domestic Class II and Class III medical devices are reviewed by provincial-level drug regulatory authorities and the National Medical Products Administration (NMPA), respectively. Upon approval, a Medical Device Registration Certificate is issued, valid for five years. However, it should be noted that if standalone medical software undergoes updates after obtaining the relevant class of Medical Device Registration Certificate, changes to licensed items may be required depending on the circumstances. According to the Technical Review Guidelines for the Registration of Medical Device Software, such updates are handled differently based on whether they constitute major or minor software updates: Updates affecting the intended use, use environment, or core functions of the medical device are classified as major software updates and require changes to licensed items; minor enhancement updates and corrective updates are classified as minor software updates, which need only be controlled through the quality management system without requiring registration changes, with the corresponding submission materials to be provided at the time of the next registration.

According to the Measures for the Administration of Medical Device Registration and Filing promulgated in August 2021, not all medical devices are required to conduct clinical trials once classified as such; however, clinical evaluation is generally mandatory (except under special circumstances). Clinical trials constitute one of the two approaches to clinical evaluation, the other being comparison with equivalent devices. Based on differing requirements for clinical studies needed for medical device registration, regulatory oversight levels are ranked from low to high as follows:

1) Exemption from Clinical Evaluation: Limited to specific circumstances, including: a) devices with well-understood mechanisms of action, finalized designs, and mature manufacturing processes, where identical medical devices have been marketed and used clinically for many years without records of serious adverse events, and their intended use remains unchanged; b) other devices for which safety and effectiveness can be demonstrated through non-clinical evaluation. According to the Catalogue of Medical Devices Exempt from Clinical Evaluation, effective October 1, 2021, medical standalone software currently exempt from clinical evaluation includes trace analysis software, clinical management software, radiotherapy record and verify system software, radiotherapy contouring software, Picture Archiving and Communication Systems (PACS) software, medical image processing software, data processing software, and semi-quantitative allergen analysis software.

2) Comparison with equivalent devices: Clinical evaluation of medical devices may be conducted through clinical trials, or by analyzing and evaluating clinical literature and clinical data on equivalent medical devices.

3) Clinical Trials: For medical devices whose safety and effectiveness cannot be confirmed based on existing clinical literature and data, clinical trials shall be conducted.

It should be noted that the Measures for the Administration of Medical Device Registration and Filing (the “New Regulations”) have made certain revisions to the provisions related to clinical evaluation and clinical trials of medical devices in the original Measures for the Administration of Medical Device Registration (the “Original Regulations”). The New Regulations no longer refer to the “Catalogue of Medical Devices Exempt from Clinical Trials” established under the Original Regulations, but instead directly refer to the “Catalogue of Medical Devices Exempt from Clinical Evaluation.” We understand that this arrangement provides applicants with greater discretion to choose whether to conduct clinical trials or perform same-variety comparison. Furthermore, pursuant to the Announcement of the National Medical Products Administration on Matters Concerning the Implementation of the Measures for the Administration of Medical Device Registration and Filing and the Measures for the Administration of In Vitro Diagnostic Reagent Registration and Filing (Announcement No. 76 of 2021 of the National Medical Products Administration), the Catalogues of Medical Devices Exempt from Clinical Trials issued under the regulatory framework of the Original Regulations (No. 94 of 2018, No. 91 of 2019, and No. 3 of 2021) have all been repealed.

Based on publicly available information and project experience, we understand that determining whether a medical device requires clinical trials or clinical evaluation is highly specialized and technical. While relevant regulations and catalogs provide references and guiding principles, we recommend that applicants consult with professional agencies for opinions on whether a specific technology falls within the scope of the relevant catalogs.

If a digital therapeutics company manufactures or distributes digital therapeutics products classified as Class II or Class III medical devices without obtaining a Medical Device Registration Certificate, the competent drug regulatory authority shall, in accordance with the Regulations on the Supervision and Administration of Medical Devices, confiscate the illegal gains, the products involved, and the production equipment and raw materials. Where the value of the goods is less than RMB 10,000, a fine of not less than RMB 50,000 but not more than RMB 150,000 shall be imposed; where the value of the goods is RMB 10,000 or more, a fine of not less than 15 times but not more than 30 times the value of the goods shall be imposed. In serious circumstances, orders shall be issued to suspend production and business operations, and applications for medical device licenses submitted by the relevant responsible individuals and the entity shall not be accepted for a period of 10 years. Senior executives and key personnel directly responsible at the violating entity shall have their income derived from the entity during the period of the illegal activity confiscated, and shall be fined an amount equal to not less than 30% but not more than three times such income; they shall be permanently prohibited from engaging in the production and distribution of medical devices. Furthermore, the original issuing authority shall revoke the Medical Device Production License or the Medical Device Distribution License.

Although the Regulations on the Supervision and Administration of Medical Devices set a very high upper limit of liability for enterprises and individuals that engage in the production and operation of Class II and Class III medical devices without obtaining registration certificates, our preliminary search indicates that administrative penalty cases involving digital therapeutics products lacking medical device registration certificates are relatively rare in practice. Such cases have primarily focused on Picture Archiving and Communication Systems (PACS) for imaging information, suggesting that regulatory authorities have not yet established a unified enforcement standard on this issue. Reference cases include the case titled “Case of Fujifilm Medical Equipment (Shanghai) Co., Ltd. Suspected of Producing Class II Medical Devices—Medical Image Storage and Transmission System—Without Obtaining a Medical Device Registration Certificate,”[10] decided by the Shanghai Pudong New Area Market Supervision Administration in September 2017. In this case, the “Symbiont 1.0” system developed by the party involved featured functions for the transmission, processing, archiving, and storage of medical images and was classified as a Class II medical device. However, it had not obtained a Medical Device Registration Certificate. The system was installed and used in 1,667 hospitals across China between 2010 and April 2015, resulting in a fine of RMB 75,000. Another reference case is the “Case of Shanghai Huoliang Enterprise Management Consulting Center Suspected of Producing Class II Medical Devices—Medical Image Storage and Transmission System—Without Obtaining a Medical Device Registration Certificate,”[11] decided by the Binhai County Market Supervision Administration in July 2020. In this case, the PACS system sold by the party to hospitals included functions such as medical image storage, transmission, viewing, and processing, and was classified as a Class II medical device. Due to the lack of a Medical Device Registration Certificate, a fine of RMB 80,000 was imposed.

In practice, some digital therapeutics companies, due to the nature and characteristics of the diseases they address, have a need to establish offline facilities or stores to conduct rehabilitation-like management activities, while integrating digital therapeutics products into these offline operations. Whether such stores are required to obtain medical institution qualifications, and whether practitioners must hold professional credentials as licensed physicians, nurses, or medical technologists, depends on whether the offline store provides medical services to the public, specifically diagnostic and therapeutic activities for diseases. Furthermore, the use of digital therapeutics products that have obtained medical device registration certificates in business operations will further increase the likelihood that the relevant activities will be deemed to have a medical nature.

Based on our anonymous inquiries to relevant local Health Commission departments, from the perspective of strict regulatory oversight, offline stores conducting similar business activities are prohibited from engaging in disease diagnosis and treatment, prescribing medications, or using medical devices for therapeutic purposes without obtaining a Medical Institution Practice License. Furthermore, promotional materials must avoid characterizing services provided at these offline locations as “treatment” or “rehabilitation” activities. If digital therapeutics companies intend to align with medical activity regulations and adopt the most stringent compliance standards, the relevant stores must apply for a Medical Institution Practice License and register as medical institutions. Both the medical institutions and their practitioners must meet the hardware and qualification requirements stipulated in the Basic Standards for Medical Institutions (Trial) as well as any specific requirements imposed by local health administrative authorities (if applicable).

If digital therapeutics companies intend to use digital therapeutics software for auxiliary diagnosis or auxiliary treatment by establishing their own offline stores or collaborating with other medical institutions, the relevant medical institutions shall separately comply with the basic requirements and standards set forth in the Management Specifications for Artificial Intelligence-Assisted Diagnostic Technology, Quality Control Indicators for Clinical Application of Artificial Intelligence-Assisted Diagnostic Technology, the Management Specifications for Artificial Intelligence-Assisted Therapeutic Technology, and Quality Control Indicators for Clinical Application of Artificial Intelligence-Assisted Therapeutic Technology.

Furthermore, relevant medical institutions shall also comply with applicable laws and regulations in areas such as internet-based healthcare, diagnosis and treatment management, hygiene and epidemic prevention management, healthcare data, handling of medical disputes, and medical advertising.

In the past one to two years, China’s digital therapeutics (DTx) sector has entered a phase of vigorous development, playing a positive role in addressing the imbalance between the supply and demand of medical services in China. As a supplement and optimization to traditional treatment methods, digital therapeutics hold significant value for patients, physicians, pharmaceutical and medical device companies, and the entire healthcare industry. However, the development of new technologies has also introduced new challenges for legal compliance. China has not yet issued supporting regulatory measures comparable to the U.S. FDA’s framework for Software as a Medical Device (SaMD). The existing normative documents are of a relatively low legal hierarchy, and their practical effectiveness remains to be observed. In practice, there is a certain degree of disconnect among industry practices, regulatory enforcement standards, and these normative documents. On one hand, we anticipate that regulatory authorities will issue more systematic guidance on digital therapeutics at an early date. On the other hand, under the current legal framework, digital therapeutics companies should simultaneously enhance their product and corporate pharmaceutical compliance: strictly adhere to regulations concerning medical device classification, clinical evaluation, registration, and production and operation based on the nature of their products; and, during business operations, pay close attention to compliance issues related to the production and operation of medical devices, as well as those involving medical institutions and healthcare professionals.

[1] https://www.mckinsey.com/industries/life-sciences/our-insights/the-promise-of-digital-therapeutics

[2] https://www.cn-healthcare.com/articlewm/20200815/content-1138167.html

[3] https://peartherapeutics.com/products/reset-reset-o/

[4] https://xueqiu.com/2539442652/187928525

[5] https://dtxalliance.org/understanding-dtx/

[6] https://dtxalliance.org/wp-content/uploads/2021/01/DTA_FS_DTx-Product-Categories_010521.pdf

[7] https://clinicaltrials.gov/ct2/results/map?term=digital+Therapeutics&map= Accessed on October 20, 2021

[8] “White Paper on China’s Digital Therapeutics Industry: From Definition and Classification to Value Discussion—A Comprehensive Analysis of Digital Therapeutics” https://vcbeat.top/YzVlMzQ5YWFkMWQ4Zjc2YjUxOGEyMzVkMGM1NDhjNDY=

[9] In accordance with relevant laws and regulations, the classification and registration of mobile medical devices as medical devices shall refer to equivalent traditional medical devices. Mobile medical accessories are categorized into control-type (controlling the operation of medical devices) and data-type (engaging in electronic data exchange with medical devices). Control-type accessories shall be registered together with the medical device product as a whole. Data-type accessories may be registered together with the medical device product as a whole; those not opting for holistic registration shall be classified as mobile medical devices or standalone mobile software.

[10] Shanghai Food and Drug Administration (Pudong) Penalty Decision No. 2220170027 [2017]

[11] Bin Market Supervision Penalty Decision No. [2020] 00119