Findings
FDA considers electronic records and signatures to be equivalent to paper records and handwritten signatures when they meet the requirements of 21 CFR part 11. Advances in technology, including Digital Health Technologies (DHTs) and cloud computing, necessitate updated guidance on ensuring the authenticity, integrity, and confidentiality of electronic data in clinical investigations. Records submitted to the FDA under predicate rules (e.g., marketing applications) are subject to part 11. FDA does not intend to assess the compliance of external Real-World Data (RWD) sources like Electronic Health Record (EHR) systems with part 11, but the sponsor remains responsible for the quality and integrity of all submitted data.

Recommendations
Risk-Based Validation: Regulated entities should use a risk-based approach to validation for all electronic systems deployed, proportionate to the risks to participant safety and reliability of trial results. Validation must cover system functionality, trial-specific configurations, customizations, and interoperability.
Data Retention & Audit Trails: Electronic records must be retained for the applicable period in a secure and traceable manner. Audit trails must capture all changes (old/new value, user ID, date/time) and should be protected from modification.
Security & Access Controls: Logical and physical access controls (e.g., strong login credentials, multi-factor authentication) must limit system access to authorized users based on a documented risk assessment. Security safeguards (e.g., encryption, antivirus) must be in place to protect data at rest and in transit.
DHT Use: DHTs should be selected and validated to be fit for purpose. The data originator (person, system, or DHT itself) must be associated with every data element as part of the audit trail. The final location of source data for inspection is the durable electronic data repository, not the individual DHT.
Outsourcing: Regulated entities must have a written agreement with IT service providers (including for cloud computing) detailing roles, responsibilities, and the service provider's ability to provide data integrity and security safeguards. The sponsor must maintain oversight.

Regulatory Considerations
FDA does not certify electronic systems or signature methods; they are evaluated during inspection. Users of electronic signatures must submit a letter of non-repudiation to the FDA certifying that the electronic signature is the legally binding equivalent of a handwritten signature. Security breaches impacting participant safety or privacy should be reported to the IRB and FDA in a timely manner.

Findings
Regulatory inconsistencies across different FDA divisions and international jurisdictions create inefficiencies in the approval process for digital health products.
Lack of alignment between regulatory approval and payer reimbursement requirements poses a significant barrier to commercialization and widespread adoption of digital health innovations.
There are limited regulatory pathways for novel digital health products, including AI-enabled solutions, requiring new frameworks to address iterative software development and real-world data integration.
Existing health technology assessment (HTA) models do not fully accommodate digital health technologies, limiting their inclusion in reimbursement decisions.
Industry stakeholders emphasize the need for clearer guidelines on cloud-based infrastructure, third-party AI model validation, and digital health interoperability.

Recommendations
FDA and international regulatory bodies should improve coordination to establish standardized approval processes and consistent clinical evidence requirements.
New regulatory pathways should be introduced for AI-driven and software-based digital health products, considering their unique lifecycle and iterative development models.
Greater transparency and communication between FDA divisions should be established to ensure consistent decision-making and regulatory interpretations across centers.
Policymakers should prioritize payer alignment strategies, incorporating real-world evidence (RWE) to streamline reimbursement and market access processes.
The digital health industry should collaborate with regulators to create standardized best practices for AI validation, cloud security, and digital biomarker evaluation.

Regulatory Considerations
FDA should clarify the evidentiary standards for AI-enabled medical devices and establish predefined change control plans for software updates.
Digital health products should adhere to globally recognized standards such as HL7 for interoperability and ISO regulations for data security.
Market access pathways must integrate pricing and reimbursement considerations to facilitate the commercial viability of digital health technologies.
The use of real-world data (RWD) should be expanded in regulatory decision-making, supporting the approval and post-market surveillance of digital health innovations.
Regulatory frameworks should be updated to accommodate cloud-based health platforms, addressing issues such as data privacy, operational security, and compliance with HIPAA and GDPR.

Findings
Decentralized Clinical Trials (DCTs), which shift activities away from sites, rely heavily on technology to reduce participant burden and improve access to trials. Digital platforms are essential for this shift, providing centralized data capture, remote monitoring, and streamlined workflows. Benefits include allowing participants to be monitored remotely, which can improve self-management and clinical outcomes, and giving researchers better insight into the real-world variability of disease activity. Currently, commercial platforms are often limited in functionality and face major challenges due to a lack of interoperability and specific data standardization protocols for clinical trial platforms, making it difficult to integrate third-party modules.

Recommendations
The paper strongly recommends the adoption of unified, integrated, and DCT-specific digital platforms to fully realize the benefits of decentralization. Platform developers should adopt international standards for health data exchange, such as HL7 FHIR and CDISC standards (PRM, CDASH, ADaM), to address the lack of data standardization and improve interoperability and modularity. Platforms should incorporate features that enhance participant engagement and adherence, such as customization options, simple user interfaces (UIs), push notifications, gamification, and allowing access to participant data . Security and governance teams are paramount to manage risks associated with malware, lost devices, and ensuring compliance with local legislation and data security protocols.

Regulatory Considerations
Digital platform design must maintain digital security and compliance with local legislation and data standards. The paper notes that a fully integrated, unified digital platform in a best-case scenario would use pre-existing standards (like CDISC and HL7) to guarantee interoperability. Adopting these standards and recommendations for data sharing, privacy, and security, as recommended by organizations like the Healthcare Information and Management Systems Society, is critical for future digital components used in DCTs. Improved data integrity and accountability in platforms could be further explored using technologies like blockchain to create an immutable ledger.

Findings
Regulatory inconsistencies across FDA divisions create uncertainty and inefficiencies in the approval process for digital health products.
Misalignment between FDA regulatory requirements and payer expectations hinders the commercialization and adoption of digital health innovations.
The absence of clear alternative regulatory pathways for novel digital health products discourages investment and innovation.
The lack of standardized regulatory frameworks for AI-driven healthcare technologies, including large language models (LLMs), poses challenges for industry adoption.
Limited international harmonization in digital health regulation makes it difficult for companies to scale innovations globally.

Recommendations
FDA should improve communication and coordination across divisions to ensure consistent regulatory interpretations and processes.
Regulatory pathways for novel digital health products should be modernized, including the introduction of alternative approval mechanisms tailored to iterative software development and AI-enabled devices.
A regulatory framework for third-party large language models (LLMs) should be developed to support their integration into digital health applications.
Greater alignment between FDA and payer decision-makers is needed to streamline market access and ensure reimbursement for digital health products.
International regulatory harmonization efforts should be expanded to facilitate global adoption of digital health technologies.

Regulatory Considerations
The FDA should clarify and refine regulatory requirements for AI-driven digital health products, including predefined change control plans for software updates.
Cloud-based health platforms require clear regulatory guidance on security, data ownership, and compliance with HIPAA and international privacy laws.
Real-world evidence (RWE) should be incorporated into regulatory decision-making to facilitate faster approvals and post-market surveillance of digital health products.
Standardized regulatory frameworks for digital biomarkers and digital drug development tools (DDDTs) should be developed to support clinical research applications.
Policymakers should collaborate with industry stakeholders to establish education and training programs on digital health innovation and regulatory science.

Findings
The use of Intended Use and Indication for Use is crucial for digital health products to ensure the product is used appropriately and effectively to meet the needs of the intended population. This information helps establish clear expectations for a product's performance and safety, facilitates regulatory approval, and ensures compliance. The Intended Use provides a general description of the digital health product's purpose or function. The Indication for Use describes the disease or condition the device will diagnose, treat, prevent, cure, or mitigate, including a description of the patient population. A change in a product's indication for use from general to specific usually results in a narrower indication concerning function, target population, or disease entity. Levels of specificity for diagnostic and therapeutic products can be categorized, ranging from the identification of a physical parameter (most general) to the identification of an effect on the clinical outcome (most specific).

Recommendations
The Intended Use statement should include the name of the product, the medical purpose, and what it is trying to do for the user. The Indication for Use statement should include the name of the product, the specific condition or disease state it is addressing, the patient population being targeted, what the product features do, whether other technology components are used with the product, and whether it is for "prescription" or "over-the-counter" use. Developers should characterize the users (e.g., by age, knowledge, or language) and describe the usage context (e.g., hospital ward, emergency room, web-based app). The Indication for Use statement should clearly state the product's clinical capabilities and what it is not intended for (e.g., not intended to provide a diagnosis or replace traditional methods).

Regulatory Considerations
The information provided in the Intended Use and Indication for Use statements is used to inform the product's design and development, as well as to guide regulatory decisions about its approval and marketing. Defining these statements facilitates the regulatory approval process and helps ensure compliance with relevant regulations and standards. The FDA defines the levels of specificity as a qualitative ranking of the proposed indications for use. The document provides examples of FDA's "Indications for Use" from submissions, such as the use of an Atrial Fibrillation History Feature, illustrating the necessary detail for regulatory submissions like a 510(k).