FDA Releases Guidance On Digital Health Data Acquisition In Clinical Investigations

Increasingly, FDA digital health technologies (DHT) are becoming part of the conduct of clinical trials for pharmaceuticals and medical devices. They cover an extremely broad range of applications, including ingestible and implantable sensors, wearable devices carried by patients to measure certain health related parameters, digital/remote monitoring of drug intake, electronic signatures on consent forms, health data analytics through processing data that support bioinformatics modelling, and electronic patient diaries. The options are increasing daily.

Consequently, the FDA is taking steps to deliver on its promise to make the U.S. the center for digital health innovation by issuing a draft guidance¹ providing its recommendations to clinical trial sponsors, investigators, IRBs, and others on the use of DHTs for remote data acquisition from participants in clinical trials evaluating drugs and biological products, medical devices, and combination products.

A word of caution: It is crucial for clinical trial sponsors to understand and evaluate whether their DHT meets the definition of a significant risk device under 21 CFR 812.3(m) and as such would require submission of an IDE application to FDA under Part 812 for the same clinical investigation. Equally important, sponsors would have to determine whether the DHT is a medical device (under EU MDR 2017/745) or in vitro diagnostic (under EU IVDR 2017/746).

Goals Of The Draft Guidance

FDA recognizes the large spectrum of DHTs available for potential use in a clinical trial. As such, the draft FDA digital health guidance outlines recommendations intended to facilitate the use of DHTs in a clinical trial and addresses some of the information that should be included in an IND or an IDE (investigational device exemption) application for a clinical investigation in which the sponsor plans to use one or more DHTs or in a marketing application that includes such a clinical investigation. The principal areas of the FDA’s draft guidance are:

• Description, selection, and rationale for DHT use in clinical trials
• Verification, validation, and usability of DHTs
• Evaluation of clinical endpoints and statistical analysis
• Risk and other considerations when using DHTs
• Record protection and retention

Description, Selection, And Rationale For DHT Use In Clinical Trials

FDA outlines the expectation that sponsors must include in their applications an explanation as to why the DHT is fit-for-purpose, and this fit-for-purpose justification is to be based on the clinical event or characteristic of the disease or condition of interest that is to be measured, the proposed clinical trial population, the design of the clinical investigation, and the characteristics of the DHT that may influence trial participant use.

Sponsors would also have to evaluate whether the participant’s own DHT and/or general-purpose computing platform is appropriate to reliably collect or facilitate the collection of data during the clinical trial. It is important to note that while these points seem straightforward and clear, the draft FDA digital health guidance does not provide what level of evidence is required to be fit-for-purpose. As it relates to the selection criteria, FDA sets three overarching topics to be addressed in the fit-for-purpose rationale:

1. Clinical Trial Population – Education, language, age, and technical aptitude to ensure that trial participants will be able to use the DHT as intended for the purposes of the clinical trial.
2. Design and Operation of DHTs – Fit-for-purpose rationale must cover the following:
   1. Design (e.g., material, size, weight, appearance, portability) and ease of use
   2. Power needs (e.g., battery life, charging recommendations)
   3. Operational specifications (e.g., data storage capacity, frequency of data transmission)
   4. Alerts (e.g., low battery, poor signal, data not being recorded or transmitted to the server)
   5. Environmental factors (e.g., temperature) that may affect the performance of DHTs
   6. Availability and capacity of both clinical trial participant and sponsor network systems to handle the volume of data obtained from frequent or continuous recordings
   7. DHT privacy and security to prevent unauthorized access to the DHT and the data it collects.
3. Use of a Participant’s Own DHT or General-Purpose Computing Platform and Telecommunications – The fit-for-purpose rationale must consider whether allowing trial participants to use their own DHTs reduces the burden on the clinical trial participant. FDA did not outline or define “highly specialized or customized measurements,” but those would require sponsors’ DHTs. In the submission, the sponsor would have to enumerate:
   1. minimum technical specifications (e.g., operating system, storage capacity, sensors);
   2. performance specifications (e.g., precision and accuracy); and
   3. brand, model, and/or version that meet the minimum technical and performance specifications.

Verification, Validation, And Usability Of DHTs

FDA outlines that sponsors must confirm, through verification and validation activities, that their proposed DHTs are fit-for purpose. However, the terms “verification” and “validation” as used in this guidance are not the same as in 21 CFR 820.3(aa) and 820.3(z) under the QSR for devices (21 CFR part 820) or the terms “device software function verification” and “validation” as described in FDA’s own guidance General Principles of Software Validation.

According to the draft guidance, FDA uses the term verification in this guidance analogously to analytical validation2 and the term validation analogously to analytical validation and clinical validation.3 The draft guidance spells out considerations that would be expected in the submission regarding the validation and verification of DHT hardware, DHT software, general-purpose computing platforms, as well as interoperability of connected systems with the DHT and usability studies on the DHT.

Be advised that the FDA’s expectations are that sponsors will include usability studies to confirm the suitability of the DHT and/or general-purpose computing platform for the proposed clinical investigation. The guidance establishes several criteria to be met:

1. Enroll a cohort that is similar to intended trial participants;
2. Test the ability of future participants to use the DHT as directed in the trial protocol; and
3. Assess whether users are able to enter all data before being logged out of a DHT.

The direct reference to the 2016 guidance on Applying Human Factors and Usability Engineering to Medical Devices indicates that the FDA would expect to receive from the sponsors human factors validation testing to demonstrate that the DHT can be used by the intended users without serious use errors or problems, for the intended uses and under the expected use conditions.

Evaluation Of Clinical Endpoints And Statistical Analysis

Of particular note is the proposed requirement to establish clinical endpoint or endpoints measured from data collected through a DHT, especially when justifying a novel endpoint using data captured by the DHT, where sponsors are to justify:

1. Whether the endpoint is a clinically meaningful reflection of how a participant feels, functions, or survives;
2. How the endpoint relates to other endpoints of effectiveness that have been used to support a marketing authorization for a similar indication; and
3. Whether the novel endpoint is a sufficiently reliable measure of disease severity or health status.

Similar expectations are extended to the statistical analysis plan, where the definition of the endpoints and the source data from which the endpoints are derived for each trial participant and intercurrent events that may be related to the DHT should be prespecified in the statistical analysis plan. The listed intercurrent events are:

1. Software updates that change how the data are collected or that change the algorithms used to process data
2. Software incompatibility caused by operating system upgrades
3. Trial participant error or noncompliance with study procedures using the DHT
4. DHT failure
5. Data transmission failure

Risk And Other Considerations When Using DHTs

FDA outlines three overarching risks to trial participants associated with use of the DHTs for data collection: clinical, privacy, and informed consent. It is not evident from the draft FDA digital health guidance whether such information is to be part of a submission or simply a documentation of FDA’s current thinking on the matter. Irrespective of the communication status, regarding clinical risks, sponsors are expected to:

1. Analyze DHTs for physical features that could cause injury to participants;
2. Evaluate likelihood of erroneous measurement, especially in situations where measurements provide feedback to modifications or changes in the administration of investigated products; and
3. Assess any cybersecurity threats that may impact the functionality and safe data storage and transmission.

In furtherance of 21 CFR 50, the clinical trial risks and the requisite information on the informed consent process, the FDA emphasizes that the informed consent process must:

1. Describe any reasonably foreseeable risks or discomforts to the subject, including reasonably foreseeable risks or discomforts related to the use of the DHT in the clinical trial.
2. How the risks most likely to occur could be mitigated should also be considered for inclusion.
3. Include a statement indicating that use of the DHT during the clinical investigation may involve risks to the subject that are currently unforeseeable.
4. Explain the type of information that will be collected by the DHT, how that information will be used and monitored and the measures to protect a subject’s privacy and data, and the limitations of those measures.
5. Specify who may have access to data collected through the DHT during or after the clinical investigation and during what time frame.
6. Understand and map the impact of each end-user license agreements or terms of service as a condition of use because they may allow DHT manufacturers and other parties to gain access to personal information and data collected by the DHT. As such, sponsors and investigators should ensure that the informed consent process explains to subjects that their data may be shared by the DHT outside of the clinical trial, according to the end-user license agreement or terms of service.

Record Protection And Retention

FDA outlines that sponsors and investigators are responsible for recording and retaining data captured by the DHT in accordance with FDA’s record retention regulations for sponsors and investigators. It also makes reference to another draft guidance, “Use of Electronic Records and Electronic Signatures in Clinical Investigations Under 21 CFR Part 11—Questions and Answers.”

Summary

Because different regulatory frameworks are applicable, with regulatory oversight provided by different FDA bodies, using DHT in clinical trials is currently rather cumbersome and does not meet the least-burdensome principle that FDA is stiving to meet.

The FDA guidance provides valuable insight on the submission expectations, which would mandate that sponsors wishing to engage DHTs in their clinical trial data acquisition consider usability, privacy, cybersecurity, and interoperability. The recommendations of ICH E6 good clinical practices (GCP) on validation of “computerized systems,” as well as the required standards of data privacy and cybersecurity, should be the basis to prove the acceptability of DHT and facilitate regulatory decision making.

Overall, the draft guidance provides insight into FDA’s current thinking about the use of DHT in remote data acquisition in clinical trials and should be analyzed by sponsors considering using DHT tools. Interested stakeholders can submit comments on this draft guidance for FDA’s consideration until March 22, 2022, to docket FDA-2021-D-1128 available at https://www.regulations.gov/docket/FDA-2021-D-1128.

About The Author:

John Giantsidis is the president of CyberActa, Inc, a boutique consultancy empowering medical device, digital health, and pharmaceutical companies in their cybersecurity, privacy, data integrity, risk, SaMD regulatory compliance, and commercialization endeavors. He is also a member of the Florida Bar’s Committee on Technology and a Cyber Aux with the U.S. Marine Corps. He holds a Bachelor of Science degree from Clark University, a Juris Doctor from the University of New Hampshire, and a Master of Engineering in cybersecurity policy and compliance from The George Washington University. He can be reached at john.giantsidis@cyberacta.com.