To be released.

Findings
Sites must establish effective data privacy and security plans, especially considering regional and global regulations like GDPR.
Risk mitigation is critical, including plans to address unanticipated issues and potential patient disengagement due to technology challenges.
Budgeting and contracting often involve additional considerations, such as storage, training, and technical support requirements for connected devices.
Sites require adequate training to ensure staff and patients are prepared to use connected devices efficiently.
Companion applications or services often play an essential role in device functionality and data transmission.

Recommendations
Develop a clear plan for data pathways, including storage, security, and regulatory compliance.
Establish detailed risk mitigation and management strategies to handle unexpected challenges.
Ensure comprehensive training programs for site staff and patients to enhance device usability.
Incorporate device storage and resource allocation into budgeting and contracting processes.
Facilitate effective communication with sponsors and vendors to resolve operational and technical issues promptly.

Regulatory Considerations
Ensure connected devices comply with CFR 21, Part 11, and other relevant data collection and transmission regulations.
Understand and adhere to local and regional data privacy laws, such as GDPR, when managing patient data.
Verify that appropriate licenses and regulatory approvals are in place for device data transmission and storage.
Assess and address shipping and handling regulations for devices, ensuring safe and compliant transportation.

Findings
Usability gaps in sDHTs remain a barrier to adoption, with many technologies failing to prioritize ease of use, accessibility, and diverse user needs​
Human-centered design is critical for ensuring that digital health solutions are intuitive, functional, and scalable across different healthcare environments​
Standardized usability metrics for evaluating digital health technologies are lacking, leading to inconsistent reporting and validation of usability outcomes​
Use-related risk analysis is essential to identifying and mitigating risks associated with user errors, ensuring the safety and effectiveness of sDHTs​
The V3+ framework provides a structured approach to integrating usability validation into digital health technology development, aligning with global regulatory expectations​

Recommendations
Developers should incorporate human-centered design principles from the outset, ensuring that usability, accessibility, and user needs are central to sDHT development​
Usability validation should be standardized, with clear methodologies for measuring usability, including satisfaction, ease of use, efficiency, and error mitigation​
Regulatory and clinical stakeholders should collaborate on defining best practices for usability evaluation, ensuring that digital endpoints are both meaningful and scalable​
Risk analysis should be iterative, with developers continuously refining their technologies based on real-world user feedback and testing​
The usability validation component of V3+ should be widely adopted to ensure that digital clinical measures meet patient-centered, regulatory, and technical expectations​

Regulatory Considerations
Regulators are emphasizing the need for usability validation to ensure that digital endpoints are both clinically relevant and patient-friendly​
sDHTs must comply with human factors engineering guidelines, aligning with global regulatory frameworks such as ISO 9241-210 and FDA usability requirements​
Data security, privacy, and interoperability must be ensured, particularly as sDHTs become integrated into remote monitoring and decentralized clinical trials​
Real-world evidence (RWE) should support usability validation, helping to bridge the gap between regulatory approval and real-world adoption​
Regulatory bodies should work toward standardizing usability testing methodologies, ensuring consistency across clinical research, digital endpoints, and medical device evaluations​

Findings
Decentralized Clinical Trials (DCTs), which shift activities away from sites, rely heavily on technology to reduce participant burden and improve access to trials. Digital platforms are essential for this shift, providing centralized data capture, remote monitoring, and streamlined workflows. Benefits include allowing participants to be monitored remotely, which can improve self-management and clinical outcomes, and giving researchers better insight into the real-world variability of disease activity. Currently, commercial platforms are often limited in functionality and face major challenges due to a lack of interoperability and specific data standardization protocols for clinical trial platforms, making it difficult to integrate third-party modules.

Recommendations
The paper strongly recommends the adoption of unified, integrated, and DCT-specific digital platforms to fully realize the benefits of decentralization. Platform developers should adopt international standards for health data exchange, such as HL7 FHIR and CDISC standards (PRM, CDASH, ADaM), to address the lack of data standardization and improve interoperability and modularity. Platforms should incorporate features that enhance participant engagement and adherence, such as customization options, simple user interfaces (UIs), push notifications, gamification, and allowing access to participant data . Security and governance teams are paramount to manage risks associated with malware, lost devices, and ensuring compliance with local legislation and data security protocols.

Regulatory Considerations
Digital platform design must maintain digital security and compliance with local legislation and data standards. The paper notes that a fully integrated, unified digital platform in a best-case scenario would use pre-existing standards (like CDISC and HL7) to guarantee interoperability. Adopting these standards and recommendations for data sharing, privacy, and security, as recommended by organizations like the Healthcare Information and Management Systems Society, is critical for future digital components used in DCTs. Improved data integrity and accountability in platforms could be further explored using technologies like blockchain to create an immutable ledger.

Findings
Usability gaps in sDHTs remain a barrier to adoption, with many technologies failing to prioritize ease of use, accessibility, and diverse user needs​
Human-centered design is critical for ensuring that digital health solutions are intuitive, functional, and scalable across different healthcare environments​
Standardized usability metrics for evaluating digital health technologies are lacking, leading to inconsistent reporting and validation of usability outcomes​
Use-related risk analysis is essential to identifying and mitigating risks associated with user errors, ensuring the safety and effectiveness of sDHTs​
The V3+ framework provides a structured approach to integrating usability validation into digital health technology development, aligning with global regulatory expectations​

Recommendations
Developers should incorporate human-centered design principles from the outset, ensuring that usability, accessibility, and user needs are central to sDHT development​
Usability validation should be standardized, with clear methodologies for measuring usability, including satisfaction, ease of use, efficiency, and error mitigation​
Regulatory and clinical stakeholders should collaborate on defining best practices for usability evaluation, ensuring that digital endpoints are both meaningful and scalable​
Risk analysis should be iterative, with developers continuously refining their technologies based on real-world user feedback and testing​
The usability validation component of V3+ should be widely adopted to ensure that digital clinical measures meet patient-centered, regulatory, and technical expectations​

Regulatory Considerations
Regulators are emphasizing the need for usability validation to ensure that digital endpoints are both clinically relevant and patient-friendly​
sDHTs must comply with human factors engineering guidelines, aligning with global regulatory frameworks such as ISO 9241-210 and FDA usability requirements​
Data security, privacy, and interoperability must be ensured, particularly as sDHTs become integrated into remote monitoring and decentralized clinical trials​
Real-world evidence (RWE) should support usability validation, helping to bridge the gap between regulatory approval and real-world adoption​
Regulatory bodies should work toward standardizing usability testing methodologies, ensuring consistency across clinical research, digital endpoints, and medical device evaluations​

Findings
Cybersecurity threats in healthcare are increasingly frequent and severe, posing risks to device safety and clinical care.
Many vulnerabilities arise from third-party software components and interconnected device ecosystems.
Legacy devices often lack adequate cybersecurity controls, leading to increased patient and organizational risks.
Cybersecurity risk management processes must integrate safety and security assessments throughout the device lifecycle.
Transparency in device cybersecurity is crucial for enabling safe integration and use by healthcare providers and end users.

Recommendations
Implement a Secure Product Development Framework (SPDF) for comprehensive cybersecurity throughout the product lifecycle.
Include a Software Bill of Materials (SBOM) for all premarket submissions to track software dependencies and vulnerabilities.
Perform robust cybersecurity testing, including penetration testing and vulnerability assessments.
Enhance device labeling with clear cybersecurity-related instructions and risks for users.
Develop a coordinated vulnerability disclosure plan for postmarket cybersecurity management.

Regulatory Considerations
Adherence to 21 CFR Part 820 Quality System regulation requirements, including design controls and risk management.
Compliance with Section 524B of the FD&C Act for cybersecurity of cyber devices.
Submission of SBOMs and detailed security risk management reports for premarket applications.
Provision of cybersecurity information as part of device labeling to prevent misbranding under Section 502 of the FD&C Act.
Integration of security testing and validation as part of the FDA review process.

Findings
Non-Device-MDDS functions are excluded from FDA regulation, provided they do not interpret or analyze medical data.
Device-MDDS hardware functions are still considered devices but are subject to enforcement discretion.
FDA clarified that functions involving analysis, alarms, or active patient monitoring fall under regulatory oversight due to higher risk.
The guidance addresses scenarios involving multiple function device products with both device and non-device functions.
General-purpose IT infrastructure used for data transfer, storage, or display is not regulated as a medical device.

Recommendations
Clearly delineate whether software functions qualify as Non-Device-MDDS or Device-MDDS under section 520(o)(1)(D) of the FD&C Act.
Avoid adding analysis, interpretation, or real-time monitoring capabilities to Non-Device-MDDS to maintain exemption from regulatory oversight.
For Device-MDDS, adhere to existing classification regulations but note FDA’s intent not to enforce regulatory controls for most low-risk use cases.
Developers of multiple function devices should assess how non-device functions impact the safety and effectiveness of device functions.
Consult FDA guidance on "Multiple Function Device Products" for more details on managing products with both device and non-device functions.

Regulatory Considerations
Non-Device-MDDS functions are not subject to FDA oversight under section 520(o)(1)(D) of the FD&C Act.
FDA does not enforce premarket notification, registration, or quality system requirements for Device-MDDS hardware functions.
Active patient monitoring and alarm systems remain within the scope of FDA regulation due to their higher risk profiles.
The regulatory status of multiple function devices depends on how non-device and device functions interact.
Developers must avoid modifying data or controlling other medical devices unless explicitly regulated as such.

Findings
Sensor-generated health data must be collected in a way that ensures completeness, contextual metadata, and fit-for-purpose accuracy to support clinical applications.
Data security and privacy regulations vary globally, necessitating the implementation of adaptable frameworks such as the FAIR data principles and cybersecurity best practices.
Standardized data transmission and processing protocols are required to ensure interoperability across digital health platforms and prevent data loss or corruption.
Validation frameworks, such as DiMe’s V3 (Verification, Analytical Validation, and Clinical Validation), are essential to confirm the reliability of digital clinical measures.
Equity and accessibility considerations must be prioritized, ensuring that digital health solutions work across diverse populations and healthcare settings.

Recommendations
Digital health developers should follow standardized methodologies for data collection, leveraging frameworks such as the EVIDENCE checklist and DiMe’s V3 validation process.
Privacy-by-design principles should be embedded into sensor-based data systems to comply with HIPAA, GDPR, and emerging digital health privacy regulations.
Data processing workflows must be transparent, well-documented, and validated to ensure consistent, unbiased, and reproducible results in clinical applications.
Organizations should adopt cybersecurity best practices, including end-to-end encryption, authentication protocols, and risk mitigation strategies, to protect sensor data.
Sensor data integration strategies should be aligned with industry standards and open-source protocols to promote interoperability and scalability in healthcare ecosystems.

Regulatory Considerations
Regulatory agencies such as the FDA encourage the use of validated digital biomarkers and structured sensor data processing methodologies to support regulatory submissions.
Sensor data privacy policies must comply with local and international regulations, requiring clear user agreements, informed consent, and transparent data governance.
Secure data transmission protocols must be implemented to prevent unauthorized access, aligning with industry standards for encryption, authentication, and network security.
Organizations deploying sensor-based health technologies should conduct risk assessments and audits to ensure compliance with evolving regulatory requirements for AI and digital health.
Global harmonization of data security and transmission standards is necessary to support cross-border data exchange, facilitating regulatory approval and market access for digital health innovations.

Findings
The MS digital health space is still largely uncharted.
Balancing the needs and desires of different users when creating a digital solution is challenging.
Insufficient adherence to remote digital health solutions presents a challenge to long-term engagement.
Creating a digital solution that is both meaningful to end users and aligned with regulatory standards involves challenges and compromises.

Recommendations
Employ an iterative development process to continually refine digital health solutions.
Collaborate closely with healthcare professionals and patients throughout the design process.
Use behavioral science strategies to enhance user engagement and adherence.
Ensure that digital solutions are scientifically robust and meet regulatory standards.
Implement a prescription-based model to improve adherence and integration into clinical practice.

Regulatory Considerations
Conduct technical verification and clinical validation for each assessment in digital health solutions.
Ensure data privacy and cybersecurity measures are robust and comply with local regulations.
Maintain ongoing post-marketing surveillance to monitor safety and effectiveness.
Adapt solutions to meet diverse regulatory requirements across different geographies.

Findings
The MDR/IVDR enhance the focus on cybersecurity for devices incorporating electronic programmable systems and software. Cybersecurity risk is inherently linked to patient safety and effectiveness; manufacturers must reduce all risks, including security risks with safety impacts, to an acceptable level. The management of security risks should be integrated into the product's overall Risk Management System. Due to the rapid change in the threat landscape, security maintenance is a critical, ongoing requirement across the entire product lifecycle. Other EU legislation, such as GDPR (data protection) and the NIS Directive (network security), also apply in parallel.

Recommendations
Manufacturers must follow a "Secure by design" strategy throughout the Design and Development phase, adopting a "Defense-in-Depth strategy". This includes:
Risk Management: Conduct a Security Risk Assessment (using techniques like Threat Modelling) to identify vulnerabilities and their potential impact on safety and effectiveness.
Risk Control: Prioritize mitigating risks in this order: eliminate/reduce risks through safe design; take adequate protection measures (e.g., encryption, authentication, alarms); provide information for safety and training .
Minimum IT Requirements: Clearly set out the minimum hardware, IT network, and IT security requirements for the device's operating environment and communicate these in the Instructions for Use. Devices should be as autonomous as possible in terms of security and avoid sole reliance on the operating environment.
Vigilance: Establish a robust Post-Market Surveillance (PMS) System to actively collect information, review data, and timely implement corrective actions (e.g., security updates/patches) for security vulnerabilities and incidents throughout the device's lifespan. Manufacturers must report all serious incidents and Field Safety Corrective Actions (FSCA).

Regulatory Considerations
Manufacturers must ensure that technical documentation includes information demonstrating conformity with all general safety and performance requirements, including justification and verification/validation of security solutions. Instructions for Use must include information on residual risks related to IT security and detailed instructions for secure installation, configuration, operation, and deployment of security updates. The entire process is a continuous, iterative cycle, requiring regular updates to technical documentation, risk management, and clinical evaluation

Findings
High-quality data must be complete, accurate, timely, and fit for purpose, ensuring reliability for RWE generation.
Effective governance is critical to ensure transparency, ethical standards, and stakeholder engagement in managing RWD.
Data capture challenges include standardization, provenance tracking, and interoperability, particularly for EHR-based data.
Data curation is iterative and involves organizing, assessing, and preparing raw data to meet study-specific needs.
The maturity model identifies five stages of organizational data capabilities, emphasizing consistency, completeness, and automation.

Recommendations
Implement robust governance frameworks to address transparency, stakeholder engagement, and ethical considerations in RWD use.
Focus on improving data capture at the point of care through standardization and semantic interoperability.
Use common data models and validated extraction-transformation-loading (ETL) processes to enhance data consistency and reliability.
Prioritize iterative data curation practices, supported by metadata and provenance tracking, to improve fitness for use over time.
Leverage the NESTcc Data Quality Maturity Model to benchmark and enhance organizational capabilities in RWD management.

Regulatory Considerations
Ensure compliance with patient privacy laws such as HIPAA and GDPR, especially when linking data across sources.
Align data capture and curation practices with FDA guidance for RWE generation and medical device evaluation.
Establish clear data use agreements to protect patient data while enabling analysis for regulatory and research purposes.
Document data transformations, including metadata and provenance, to support reproducibility and transparency in regulatory submissions.
Embrace standard terminologies and data dictionaries to facilitate interoperability and regulatory acceptance.

Findings
Lack of consensus on the type and scope of digital outcome measures.
Partial integration of mobile health technologies into clinical practice.
Challenges in data presentation and interpretation.
Poorly addressed patient compliance and technology illiteracy.
Validation challenges for mobile health technologies.

Recommendations
Target deficits confirmed to be relevant to patients.
Use a combination of devices with an acceptable benefit-to-burden ratio.
Integrate data into patient management platform standards.
Ensure regulatory approval and adoption by healthcare organizations.
Consider pilot use of competing platforms for better integration.

Regulatory Considerations
Understand and overcome regulatory hurdles.
Ensure sustainable financial models.
Consider pilot use of platforms for regulatory integration.