Mexico’s Ministry of Health Updated Regulation for Software as a Medical Device (Appendix X)

By Nélyda González Lara and Pedro Omar Sánchez Neri

Mexico’s Ministry of Health has updated its regulation for software as a medical device (SaMD), known as Appendix X.

Continuing with our updates over the recently released 5.0 edition of the Supplement of Medical Devices of the Mexican Pharmacopoeia (hereafter: Pharmacopoeia), we discuss the new Appendix X inserted for the regulatory requirements for SaMD.

This edition of Pharmacopoeia includes the concept of SaMD in the medical device definition. Mobile applications and apps are referenced interchangeably.

Scope of Appendix X

The purpose of Appendix X is the following:

• standardize definitions and terminology.
• discuss general considerations for its lifecycle (design, development, testing and maintenance requirements).
• set guidelines over applicable QMS practices.
• provide a common understanding of the clinical evaluation required.
• propose guidelines concerning mobile applications.

This appendix contains a risk classification and a section that delves into general concepts and SaMD functions to understand the classification criteria of Rule 16. It discusses clinical treatment and diagnostic functionality, serious or non-serious conditions, and other details about possible scenarios. It does not include any information specific to the rules and the risk assessment (referencing instead the new rule for classification of SaMD  (rule 16 from Appendix II)).

The appendix also has chapters with references to IEC 62304, SaMD design and development, vigilance, information security, clinical evaluation considerations and applicable QMS principles, such as risk management, validation, implementation and maintenance.

Specific considerations for the SaMD

The  SaMD definition considers that software can provide information and suggestions to mitigate disease, to determine the compatibility, detection, diagnosis, monitoring or treatment of health conditions and their predisposition, as well as the determination of the physiological state. As with any other medical device, this new category must comply with Good Manufacturing Practices as well as the post-market surveillance related to the product to ensure scientific, technical, clinical, and analytical validity during its lifetime. Manufacturers must consider any applicable maintenance (such as adaptative, improvement, corrective and/or preventive maintenance) to ensure the correct use in a clinical environment.

Considerations for risk assessment

The SaMD is often part of a clinical workflow sequence that provides support and information to improve diagnosis, treatment and patient management. Therefore, for the appropriate classification of the SaMD, the following should be assessed:

• If the software is intended to treat and diagnose: the information provided by the SaMD will be used to take immediate or medium-term action.
• If the software is intended to target a clinical treatment: The information provided by the SaMD will be used to aid in the treatment, diagnosis, classification or identification of early signs of a disease or condition, or to predict the risk of a disease or condition.
• If the software is intended to provide information for clinical treatment: The information provided by the SaMD will not cause immediate or short-term action but will provide instead options for treatment, diagnosis, prevention or mitigation of a disease or condition.

Mobile applications

In addition to the above considerations, section 7 of this appendix discusses mobile applications that are subject to regulation. It includes examples of mobile applications that will be considered class I, II or III medical devices and provides the regulatory justification based on the underlying intended purpose of the app. The specific cases include:

• Mobile apps that act as an extension of the medical device through a connection with the purpose of controlling it, actively monitoring the patient or analyzing information from the devices (such as PACS or insulin pump controllers).

• Mobile apps that render the mobile platform into a medical device by making use of accessories, screens, sensors or by including similar functions to otherwise regulated medical devices (such as applications to monitor or track trends for blood pressure, diet or other health parameters).
• Mobile apps that become a regulated medical device on its own, by performing specific tests on the patient, and providing a diagnosis or specific treatment recommendations (similar to software devices that have been previously approved as systems under the medical equipment category, such as radiotherapy management systems).

The previous criteria provided a broad scenario of software which is a SaMD. However, the Health Authorities will exert discretion over certain mobile applications because of the  low risk to the patient, such as:

• Apps that help patients manage conditions on their own without providing specific treatments or suggestions.
• Apps that provide the patient with tools to organize and track their health information.
• Apps that provide access to information related to patients' health conditions or treatments.
• Apps that help patients to document, display, or communicate potential medical conditions to their healthcare providers.
• Apps that automate simple tasks for healthcare providers.
• Apps that allow patients or providers to interact with Personal Health Record (PHR) or Electronic Health Record (EHR) systems.
• Apps that match the definition of medical device information systems.

Concluding remarks

The new rule to classify SaMD in Mexico will become official on July 10 (60 calendar days after the publication of May’s 10^th Notice on the Diario Oficial de la Federación (link in Spanish). Although it represents a new challenge for manufacturers and regulators, further understanding the surrounding definitions and features associated with SaMD will help stakeholders in adopting this language sooner than expected.

In the meantime, Emergo by UL will participate in conferences to determine the accurate classification of SaMD and its regulatory requirements for registration before COFEPRIS in Mexico.

Nélyda Georgina González Lara is Lead Quality and Regulatory Affairs Consultant for Mexico, Peru and Costa Rica Services and Pedro Omar Sánchez Neri is Consulting Manager, Mexico at Emergo by UL.