CDRH’s New Post-Market Paradigm: Why The Public Should Be Worried

Strengthening the flow of real-world evidence on medical devices is at the heart of US FDA's evolving paradigm of device oversight. An underlying promise of the new approach is that a better post-market safety net will allow the agency's device center to take more risk in the pre-market phase, accelerating product development. But while safety surveillance is an important goal, the device center's recent actions and its April-issued Medical Device Safety Action Plan signal that it wants dramatic changes in its authority to decide how best to respond to perceived post-market safety signals, carrying potentially significant negative consequences for the public health, argues attorney Bradley Merrill Thompson in this guest column.

About The Author

Bradley Merrill Thompson is an attorney with Epstein Becker & Green, PC, where he counsels medical device, drug and combination product companies on a wide range of US FDA regulatory, reimbursement and clinical trial issues. He is also general counsel to the CDS Coalition and the Combination Products Coalition, among other groups that advocate for government policies.

US FDA is working on several projects intended to improve the flow of real-world evidence to its Center for Devices and Radiological Health. That is the core goal of the nascent National Evaluation System for health Technology (NEST). It is also a major component of the pilot-stage Digital Health Software Precertification Program. In establishing these programs, CDRH wants to receive more data that may reveal potential post-market safety signals. While these programs raise a range of important policy issues, one of the most pressing issues is what CDRH will choose to do with this new data.

According to the device center’s recently proposed Medical Device Safety Action Plan, CDRH wants to use the data to direct manufacturers to engage in post-market corrective actions, whether recalls, notification, or some other step. If the past is prologue, even though FDA lacks the legal authority to simply order the corrective actions without following some sort of due process (see sidebar), CDRH will pressure manufacturers to engage in corrective actions by threatening to conduct its own marketplace notification if the manufacturer doesn’t cooperate.

If that was all CDRH had planned, it would be reason enough for concern. But the center seems to want more than just the power of coercion. In the Medical Device Safety Action Plan, as well as other recently proposed new programs, the center is signaling that it wants dramatic changes in its authority to decide how best to respond to perceived post-market safety signals, and those changes carry with them potentially significant negative consequences for the public health.

Post-Market Regulatory Oversight Changes Sought

While CDRH has not been terribly specific about the changes the center wants to see, it has given us some very definite clues.

First, the device center is apparently contemplating a global special control that would apply to a broad swath of medical devices that would give the center the ability to order post-market risk mitigations. It’s the breadth of that concept that should strike device-makers as a bit scary.

In CDRH’s Medical Device Safety Action Plan released in April 2018, the center explains that, in its opinion, “it is currently cumbersome for CDRH to require that a company implement new mitigations, such as labeling and user training, to address new or increased known safety risks of a device. For example, if new information about an increased known risk changes the benefit-risk profile of a type of marketed device, CDRH must engage in rulemaking to create or amend the applicable special controls – a process that is time- and resource-intensive.”

The center goes on: “As a result, CDRH often works with individual manufacturers to voluntarily implement mitigations, an approach that is not always effective.” Consequently, CDRH announces that it intends to explore “whether, under current statutory authorities, FDA can impose special controls, when warranted to address new or increased known risks, more quickly through the issuance of an umbrella regulation; and if not, explore what additional actions might be taken, including considering potential new authorities.”

Second, with regard to software that functions as a medical device, CDRH is developing an entirely new regulatory approach that it refers to as its Precertification Program.  The center's headline for the program, detailed in its most recent working model, is that companies can volunteer to be appraised in how they measure up against standards for "excellence" in software design that are currently being formulated in a pilot program. In return, they may be able to qualify for reduced pre-market requirements to market new software.

But a crucial underlying component of the Pre-Cert program is that companies will agree to engage in better post-market data collection. And it's clear that CDRH doesn’t expect companies to simply collect data post-market and do nothing with it. Nor does it seem conceivable that CDRH would be satisfied for the company to do whatever the company chooses to do post-market. The working model doesn’t yet explain how the center will oversee post-market risk mitigation decisions, but we can rest assured that it plans to take an active role in that decision-making. The center has been quite vague with regard to its underlying authority to implement the entire Pre-Cert Program, including post-market risk mitigations based on the collection of real-world data.

It would seem that CDRH wants to ramp up the center’s ability to share, at low cost, product-related alerts. This comes at an enormous sacrifice to the quality of the center's regulatory decision-making.

Third, CDRH apparently plans to seize an opportunity presented by the creation of its new NEST safety net, and use the new network not just to collect data, but also to disseminate information.  In one of the underlying documents explaining the goals of the program, "The National Evaluation System for health Technology: Priorities for Effective Early Implementation," under a section entitled “Developing NEST’s Multi-Directional Communication Platform,” the working group developing NEST explains that the operators of NEST “should support FDA’s process for disseminating warnings and safety information. To do this, the NEST Coordinating Center should create and maintain a platform for sharing CDRH information in clear, accessible and understandable language for patients, doctors and caregivers.”

It would seem that CDRH wants to ramp up the center’s ability to share, at low cost, product-related alerts. Honestly, that’s to be expected given how effective it’s been in the past in coaxing manufacturers to take steps the center wants to take.  But this comes at an enormous sacrifice to the quality of the center's regulatory decision-making.

Importance Of Balanced Decision-Making In Initiating Recalls

Recalls are, of course, absolutely necessary to protect the public health. And they are inevitable. There will always be some quality or other type of issue that creates risk to the public that needs to be addressed through a recall. Achieving zero defects (complete flawlessness in manufacturing has never been achieved) or acquiring perfect knowledge about the safety and effectiveness profile of a device are not only impossible, but even an effort to try to do so would drive the cost of medical technology up to the point where the technology would become unavailable, and substantially delay the availability of the product. So, some recalls will always be expected in the medical device industry.

But there’s another side to this. Conducting more recalls than necessary imposes its own costs. Here are just a few of the societal problems created by recalling products for problems that are minor.

• Disruption, burden, cost and confusion for users. When users receive a recall notice, they need to decide what they need to do to comply. Oftentimes, this means they must conduct the laborious process of pulling back product that the user has distributed to individual health-care professionals.

• Recall fatigue. Too many recalls covering too many different products frankly makes users skeptical that each recall is actually necessary. As a consequence, product users – whether professionals or consumers – may be less likely or willing to assist.

• Product shortages. Large recalls, or recalls of specific items for which there are few alternatives, can create significant product shortages that impact patient care. In a December 2016 guidance document on "Factors to Consider Regarding Benefit Risk in Medical Device Product Availability, Compliance and Enforcement Decisions," CDRH acknowledges the importance of not inadvertently creating shortages or other harm when making decisions on product availability. (Also see "US FDA Pilot Programs Identified Need For Post-Market Benefit Awareness" - Medtech Insight, 13 Feb, 2017.)

• Recalls are expensive for the manufacturers. Lest anyone dismiss the importance of this because it only impacts manufacturers: If manufacturers don’t have a viable business model, they go out of business and product supply is impacted. At a minimum, manufacturers need to raise the price of their products to cover anticipated recalls. The diversion of resources also means that less money is available to spend on innovation.

Recalls are important and good in the right circumstances, but we can easily have too much of a good thing.

Post-Market Decisions Require A Delicate Balance Between FDA And Industry Power

Post-market corrective action decision-making is a highly subjective decision, despite the availability of data. We don’t have a corrective action system that could be simply administered by computers. There is significant human judgment involved.

Part of the issue is timing. Safety signals show up sometimes in a very weak form and require investigation. As the investigation proceeds and more is learned, the path forward becomes clearer.

But often in the real world, complete clarity is never available when it comes to deciding the need for a recall. Instead, we find ourselves needing to make explicit and implicit assumptions about risk and benefit. Here are a few examples where often it’s not possible to have truly reliable and complete data in a reasonable period of time:

• Field actions with respect to IVDs often include uncertainty because most are cleared as aids to clinical diagnosis as opposed to standalone tests. How a potential error will affect clinical decision-making cannot be quantitatively assessed in most cases.

• Literature to assess the risk of a device may not exist. For example, assume that a device failure increases dermal exposure to a pathogen, but transmission from dermal exposure has not been studied.  Further, there may be other factors (e.g., vaccinations or other prophylactic measures) that substantially mitigate risks, but in ways that cannot be reduced to a single number.

• Sometimes the source of a manufacturing problem cannot be determined with 100% certainty, and, as a consequence, understanding what product lots are affected requires some educated guesses, and judgment.

Further, let’s say a company receives reports of device failures. Some percentage of failures is often expected, but the company needs to look at the nature of the failures to determine whether what occurred is a recall issue or simply an expected problem. That exercise is often not reducible to a single quantitative formula. It requires reviews of manufacturing records, trends, testing, et cetera. Often there is not a cut-and-dried answer – it requires judgment.

And the more complex medical devices become, the more assumptions we typically need to make. Of course, to adequately protect the public health, where we lack data, we need to make credible assumptions in favor of public health protection. But we also can’t always simply assume the worst conceivable case.

The fact that the decision-making around the need for post-market corrective action is subjective is important because the center and industry have well-recognized biases. To produce good decisions, those opposing biases need to be resolved through an appropriately balanced process that leads to the best decisions for the patient.

Industries biases are well known:

• Industry has the profit motive. Selling more generally means making more money.

• Industry is very close to the technology and has the maker’s bias. Inventors fall in love with their inventions.

• And those in the weeds on a daily basis can sometimes miss the bigger picture.

Those biases are tempered by the very real threat of product liability as well as the loss of reputation that can destroy a business.

The agency's biases are less well known, but still very real:

• CDRH has a structural bias toward avoiding the mistake of allowing an unsafe product on the market. CDRH gets publicly criticized for making those mistakes, while mistakes of keeping safe products off the market usually do not produce the same negative outcome for the center.

• The center must compete for talented employees with an industry that, in most cases, pays considerably more. As a consequence, CDRH has a recruiting strategy that targets people with activist personalities. People are recruited by FDA to “come and make a difference.” Consequently, many of them mistrust industry decision-making, and many perceive that the best way to make a difference is to force industry to do something industry does not want to do, sometimes despite the factual record.

• While agency employees have a broader perspective than many people in industry because they see a wide variety of technologies, the center will also always know less about a particular problem, involving a particular product, than its industry counterparts. The data that CDRH will see will be only part of the story, and there will always be a bigger context to what’s going on in the marketplace with users. CDRH will have to rely on the data, while industry will have a deeper understanding of the particular problem that comes with working more intimately with users.

Of course, those biases are tempered by the fact that FDA hears, sometimes loud and clear, from physicians and other health-care professionals regarding annoyance, cost, confusion and shortages created by recalls.

Adverse Publicity Requires Due Process

Only through some observance of due process will the best decisions be made.

CDRH wants to be able to direct companies to either remove a product from market or engage in some supplemental labeling or other communication with users. But there will still need to be some due process. For comparison, look at what Congress has required in the context of mandatory recalls and mandatory repairing and refunding. (See sidebar story, "FDA’s Present Authority To Require Post-Market Corrective Action," above.)

The law typically requires some sort of opportunity to be heard, and limits CDRH’s authority to only the most dangerous products. Partly to ensure the best decision-making, and partly to ensure the legal protections for privately owned property, similar due process should always be observed for post-market decision-making. There needs to be an honest give-and-take, with no one side having unlimited authority or power.

In making liberal use of adverse media, CDRH is exploiting a legal gap. Law professors and experienced food and drug counsel have for years been observing the fundamental flaw in the law that allows agencies such as CDRH almost complete discretion with regard to using adverse publicity, or even just the threat of adverse publicity, to bully companies into taking the post-market corrective action the center wants. (For example, see Ernest Gellhorn's "Adverse Publicity By Administrative Agencies" – 86 Harv. L. Rev. 1380 [1973].)

Moreover, the laws surrounding FDA's use of publicity and information dissemination with regard to marketed products were written nearly 50 years ago, long before we truly entered the information age and the time of social media, and other essentially costless means of disseminating information, according to Nathan Cortez in "Adverse Publicity by Administrative Agencies in the Internet Era" (2011 BYU L. Rev. 1371 (2011).

In the old days, one of the biggest checks or balances in this realm was that it simply would cost CDRH a lot of money to mail out notices or warnings through the US mail to an entire marketplace of users. If an issue wasn’t big enough for the mainstream media to report on, CDRH simply didn’t have a viable mechanism for getting the word out. But, of course, that’s no longer true in our digital and online society. This greatly expands CDRH’s power. Thus, now we need an updated approach to ensuring due process in CDRH’s decision-making around how it chooses to disseminate information about a company’s products.

Special controls ... are not a vehicle for CDRH to gut the statutory limits placed on the center with regard to ordering post-market corrective action.

In the same vein, the NEST database, for example, will never produce the full story around the safety and effectiveness of a particular product. There will always be the need to weave in a broader factual, often qualitative, context. If CDRH is allowed almost limitless power to share information derived from NEST (through NEST) regarding what CDRH subjectively believes about the safety and effectiveness of a device, CDRH will have a very big stick – in fact too big of a stick – to use against industry. The reasonable truth arrived at through a balanced discussion between CDRH and industry that brings in the broader factual context will no longer prevail. Forcing manufacturers to do what the center pleases through the use of an enormously enlarged power to beat up companies through social media and other information dissemination, make the resulting industry actions no longer “voluntary.”

In a similar vein, in its working plan for the software Pre-Cert Program, CDRH observes that the program is voluntary, and further suggests that it does not need any additional legal authority at least presently. But that’s not true. Properly understood, CDRH in effect is amending its existing regulations addressing classification and pre-market notification, among others, to add an alternative. An alternative to an existing legal requirement is not simply a voluntary addition, but a substantive amendment to the existing legal requirement. As such, it requires congressional authorization. (Also see "US FDA's Software Pre-Cert Program: Is The Authority On The Books?" - Medtech Insight, 31 Jul, 2018.)

The Limits On CDRH’s Use Of Special Controls

By statute, special controls are additional controls added to class II medical devices, beyond the so-called general controls of the statute, which include requirements like quality system implementation, registration and listing, as well as adverse event reporting. They are not a vehicle for CDRH to gut the statutory limits placed on the center with regard to ordering post-market corrective action.

According to Section 513(a)(1)(B) of the Act, CDRH can place a medical device in class II if “there is sufficient information to establish special controls to provide … [reasonable assurance of the safety and effectiveness of the device], including the promulgation of performance standards, post-market surveillance, patient registries, development and dissemination of guidelines (including guidelines for the submission of clinical data in pre-market notification submissions in accordance with section 360[k] of this title), recommendations, and other appropriate actions as the Secretary deems necessary to provide such assurance.”

In trying to use this provision to give the center new authority beyond what the statute has already proscribed with regard to ordering post-market corrective action, CDRH is trying to push an elephant through a keyhole. Special controls serve the purpose of identifying, for example, a specific quality parameter or clinical standard that a specific product should meet. A document whose purpose is to grant CDRH additional power to order post-market corrective action for all class II devices – beyond the powers already delineated in the statutes – hardly qualifies as a special control. Special controls cannot grant CDRH additional powers beyond what the statute has defined for the center. Congress clearly did not intend to render the entire Medical Device Amendments of 1976 meaningless by giving CDRH the power to do whatever it wanted to do so long as the center called that power a “special control.” Rather, special controls are designed to work within CDRH’s existing statutorily-authorized power to fill in specific requirements for specific devices, on the basis of “sufficient information” that CDRH has found about the particular device.

The statutory limits on CDRH’s authority exist for several reasons.  They are there in recognition of the subjectivity of decision-making and the built-in biases both government regulators and industry have. They are there to provide the regulated industry with the due process that is required under the Constitution for decisions about private property. They are there to help to ensure that we reach the right decision for patients.

FDA Ups Its Sales Game

CDRH correctly tells its overseers on Capitol Hill that to protect the public, it needs to be able to move quickly with respect to post-market problems. The center also tells everyone who will listen that it is underfunded, and that it can’t expend scarce resources on what it might call excessive due process. But CDRH has really upped its sales game in recent years and is using the tactic of enticing the industry to support these initiatives through, frankly, a very vague promise of quicker approval times. CDRH argues that a better post-market safety net would allow it to take more risk in pre-market decision-making. In recent years, the center’s tweets and public speeches have sounded much more like a well-oiled public relations machine than the work of a regulatory center.

While I am sure that there is merit in CDRH’s arguments, those arguments are only one side of the issue. There are problems with CDRH having too much power in this realm. We need Congress to lay out a system that specifies both the process through which CDRH decides to make use of adverse publicity, and standards that define the circumstances in which the center can use that tactic. We will also need Congress to authorize the creation of the final software Precertification Program.

Guest columns do not necessarily reflect the views of Medtech Insight.