Findings
Coordination challenges with multiple locations in DCTs.
Variability in data collection across decentralized locations and remote tools.
Challenges in implementing certain statistical approaches in DCTs.
Need for DHTs to be accessible and suitable for all trial participants.
Ensuring compliance with local laws and regulations.

Recommendations
Develop clear protocols for integrating decentralized elements into clinical trials, specifying remote and in-person activities.
Use digital health technologies (DHTs) and electronic systems to streamline data acquisition, informed consent, and investigational product tracking.
Provide training for all stakeholders, including trial personnel, local health care providers, and participants, on decentralized processes.
Implement robust safety monitoring plans to address adverse events in decentralized settings.
Ensure compliance with local and international laws governing telehealth, data privacy, and investigational product use.

Regulatory Considerations
Maintain compliance with FDA requirements under 21 CFR parts 312 and 812 for drug and device trials, respectively.
Document all trial activities and data flows in trial protocols and data management plans, ensuring traceability and integrity.
Ensure informed consent processes meet FDA standards and provide clear communication to participants about decentralized trial activities and data handling.
Address investigational product accountability by documenting IP distribution, storage, and return or disposal.
Design electronic systems for decentralized trials to comply with 21 CFR part 11 requirements for data reliability, security, and confidentiality.

Findings
Cybersecurity threats in healthcare are increasingly frequent and severe, posing risks to device safety and clinical care.
Many vulnerabilities arise from third-party software components and interconnected device ecosystems.
Legacy devices often lack adequate cybersecurity controls, leading to increased patient and organizational risks.
Cybersecurity risk management processes must integrate safety and security assessments throughout the device lifecycle.
Transparency in device cybersecurity is crucial for enabling safe integration and use by healthcare providers and end users.

Recommendations
Implement a Secure Product Development Framework (SPDF) for comprehensive cybersecurity throughout the product lifecycle.
Include a Software Bill of Materials (SBOM) for all premarket submissions to track software dependencies and vulnerabilities.
Perform robust cybersecurity testing, including penetration testing and vulnerability assessments.
Enhance device labeling with clear cybersecurity-related instructions and risks for users.
Develop a coordinated vulnerability disclosure plan for postmarket cybersecurity management.

Regulatory Considerations
Adherence to 21 CFR Part 820 Quality System regulation requirements, including design controls and risk management.
Compliance with Section 524B of the FD&C Act for cybersecurity of cyber devices.
Submission of SBOMs and detailed security risk management reports for premarket applications.
Provision of cybersecurity information as part of device labeling to prevent misbranding under Section 502 of the FD&C Act.
Integration of security testing and validation as part of the FDA review process.

Findings
There is a need for comprehensive validation and verification processes for DHTs.
Ensuring data security and privacy is a significant concern.
Usability issues for diverse populations need to be addressed.
There is a lack of clarity on whether certain DHTs meet the definition of a device under the FD&C Act.
The guidance does not establish legally enforceable responsibilities.

Recommendations
Ensure DHTs are fit-for-purpose for clinical investigations.
Implement robust data security measures to protect participant information.
Conduct usability evaluations to ensure DHTs can be used by intended populations.
Engage with FDA early to discuss the use of DHTs in clinical investigations.
Develop a risk management plan to address potential issues with DHT use.

Regulatory Considerations
Verification and validation should be addressed regardless of device classification.
Sponsors should ensure compliance with data protection and privacy regulations.
FDA evaluates DHT data based on endpoints, medical products, and patient populations. Sponsors can engage with FDA’s Q-Submission Program for feedback on DHT usage in clinical trials.
Sponsors should understand the legal implications of using DHTs in clinical investigations.
The guidance provides recommendations but does not establish legally enforceable responsibilities.

Findings
Pre-Submissions (Pre-Subs) allow submitters to obtain FDA feedback on specific questions before submitting formal IDEs, 510(k)s, PMAs, or other applications. Early feedback can improve submission quality and streamline the review process.
Submission Issue Requests (SIRs) provide a mechanism for addressing issues raised in FDA hold letters (e.g., 510(k) deficiencies) to help expedite resolutions.
Study Risk Determinations help sponsors clarify whether clinical studies are significant risk (SR), non-significant risk (NSR), or exempt from IDE regulations.
Informational Meetings are non-feedback sessions aimed at familiarizing FDA staff with new devices or sharing updates on ongoing development.
The program encourages timely submissions, including supplements for ongoing discussions and amendments to update materials.

Recommendations
Clearly define the purpose and goals of the Q-Sub in the submission to facilitate effective FDA review.
Include specific, well-formulated questions that focus on a limited number of topics to ensure actionable feedback.
For Pre-Subs, align planned testing and submissions with FDA guidance and include detailed device descriptions, testing protocols, and relevant background information.
Use SIRs to discuss proposed solutions to deficiencies raised in FDA hold letters, focusing on timely resolution.
Draft and submit meeting minutes promptly (within 15 days of meetings) to ensure accurate documentation of FDA feedback.

Regulatory Considerations
Submitters should adhere to the timelines specified for different Q-Sub types, including 70 days for Pre-Sub feedback or 21 days for SIRs submitted promptly after a hold letter.
Q-Subs should include all relevant regulatory history and references to prior FDA communications to streamline the review process.
FDA feedback through the Q-Sub program is non-binding and based on the information available at the time; subsequent submissions must align with the provided feedback to maintain consistency.
Informational Meeting requests should clearly state that feedback is not expected and may be used to track interactions outside other formal Q-Sub types.
Confidentiality of Q-Subs is maintained in compliance with FDA’s disclosure regulations and the Freedom of Information Act (FOIA).

Findings
There are various formal and informal engagement pathways available for developers of Digital Health Products and Combination Products to communicate with the FDA to seek advice regarding product classification, regulatory status, and submission strategies. Informal pathways include the Digital Health Inquiry (via the Digital Health Inbox), the DICE Mailbox Inquiry, and the Pre-RFD Process, which provide non-binding feedback. Formal pathways include the 513(g) Program for classification, and the Q-Submission Program (encompassing Pre-Submissions for pre-application feedback and SRD for risk determination).

Recommendations
Manufacturers should use the provided map to determine the appropriate pathway based on their product type (standalone digital health or combination product) and the type of advice they are seeking (informal or formal). The Pre-Submission (Pre-Sub) program is recommended as an opportunity to obtain formal feedback "prior" to submitting an application, particularly if a new product's regulatory pathway is unclear or if planning a study to support a future application. Combination Product manufacturers can use CPAMs to clarify marketing authorization standards or post-market modification requirements.

Regulatory Considerations
The 513(g) Request provides information on a product's classification and applicable regulatory requirements but does not determine substantial equivalence or make final marketing authorization decisions. Programs like the CDRH-Payor Connection and Parallel Review with CMS are voluntary and designed to expedite patient access by aligning clinical evidence for both regulatory clearance/approval and coverage decisions. Participation in these programs, however, does not alter the FDA’s existing, separate standards for regulatory review.

Findings
Patient-Reported Outcome (PRO) instruments are a type of Clinical Outcome Assessment that provides valid scientific evidence for regulatory and healthcare decision-making regarding medical devices. The FDA encourages the integration of patient perspectives throughout the Total Product Lifecycle (TPLC). PRO instruments can be used to measure the effects of a medical intervention, including the impact on patient well-being and Health-Related Quality of Life (HRQOL). The validity evidence needed to support a PRO instrument's use is determined by its specific Context of Use (COU) and role (e.g., primary, secondary endpoint) in the clinical study protocol. To be "fit-for-purpose," a PRO instrument must measure a Concept of Interest (COI) that is meaningful to patients and whose measurement is supported by evidence that is consistent with the intended use population.

Recommendations
Sponsors should establish and clearly define the Concept of Interest (COI) the PRO instrument is intended to capture. It is recommended that sponsors clearly identify the role of the PRO (e.g., primary, secondary, effectiveness, safety) in the clinical study protocol and statistical analysis plan. The development or modification of PRO instruments should measure concepts important to patients to reduce unnecessary patient burden and ensure the outcomes are relevant to a patient's daily lived experience. Cognitive interviews should be conducted to ensure the instrument's instructions and items are understandable to the intended use population, including patients with limited English language proficiency. Sponsors are encouraged to leverage existing PRO instruments (by using them as-is, modifying, or adapting) as a least burdensome approach to take advantage of existing validity evidence. Alternative approaches, such as using Real-World Data (RWD) platforms or conducting parallel development work during clinical studies, are encouraged to efficiently generate validity evidence.

Regulatory Considerations
The FDA encourages sponsors to engage with the Agency regarding the relevance and suitability of a proposed PRO instrument early in the development process, prior to the Investigational Device Exemption (IDE) submission or pivotal study. The Q-Submission program is the recommended pathway for sponsors to obtain feedback from the FDA regarding cognitive interview approaches and the modification or adaptation of existing instruments. The Agency uses the fit-for-purpose concept as a flexible approach to determine the validity evidence needed for a PRO instrument's specified use for a regulatory purpose. The use of PRO instruments that have been qualified under the Medical Device Development Tools (MDDT) program is encouraged. Sponsors should prospectively specify the intent to generate validity evidence in the clinical study protocol and statistical analysis plan, even if the evidence will only support future studies.

Findings
Quantitative imaging extracts numerical values from medical data that are subject to systematic error and random variation. The utility of these values depends on well-characterized performance and sufficient user information for interpretation. Performance specifications often change throughout the operating range of a device, such as volumetric reproducibility varying by structure size. Fully automated functions require more robust analytical validation than manual or semi-automated functions because they lack the opportunity for expert user correction. While phantoms serve as high-quality reference standards for ground truth, they are simplifications that may not fully reflect clinical performance.

Recommendations
Manufacturers should provide a detailed technical description of the quantitative imaging function, including the measurand, algorithm training paradigms, and level of automation. Performance specifications should incorporate objective reference values when available to allow for comparisons between subject and predicate devices. A sensitivity analysis should be conducted to determine the impact of sources of error like patient characteristics, image acquisition protocols, and image processing. Labeling must include clear instructions for user-performed quality assurance and specify any limitations where the function has been found ineffective. For automated devices, manufacturers should help users understand scenarios where the function might generate an incorrect output that is not easily identifiable.

Regulatory Considerations
The FDA recommends following a ten-step technical performance assessment process, ranging from defining the measurand to comparing statistical results against pre-defined acceptance criteria. Premarket submissions should include performance data demonstrating that the device meets claims regarding bias, precision, linearity, and limits of quantitation. Uncertainty should be reported in units of the measurand and cover the entire operating range of the function. Manufacturers are encouraged to use the Q-Submission process to address questions regarding regulatory status or specific requirements. Software implementation details should align with existing FDA guidance for the content of premarket software documentation.

Findings
Early and ongoing engagement with regulatory bodies is essential to align endpoint development with regulatory expectations.
There are distinct pathways for drugs and medical devices, with specific meeting types (e.g., Type B and Type C meetings) available for each.
Qualification programs help establish the utility and validity of digitally-derived endpoints across different drugs, devices, or diseases.
Regulatory agencies provide detailed feedback on analytical and clinical validation, ensuring endpoints meet clinical relevance and reliability standards.
The document emphasizes the importance of understanding and navigating distinct regulatory frameworks (e.g., IND/NDA for drugs and IDE/510(k) for devices).

Recommendations
Engage with regulatory bodies, such as the FDA and EMA, early in the development process to obtain critical input.
Utilize structured programs, like the Drug Development Tool (DDT) and Medical Device Development Tools (MDDT) qualification pathways, to validate endpoints.
Schedule appropriate regulatory meetings, including Type B and Type C meetings for drugs or Q-Submission and Agreement Meetings for devices.
Consider utilizing general advisory sessions (e.g., Critical Path Innovation Meetings or Innovation Task Force Briefings) to enhance endpoint development strategies.
Document and align endpoint development with regulatory frameworks, ensuring compliance with safety, efficacy, and performance standards.

Regulatory Considerations
Use FDA’s IND/NDA and IDE/510(k) pathways for endpoint validation, tailoring engagement to the specific type of medical product.
Schedule Type B and Type C meetings for focused discussions on endpoint development, including context of use and validation.
Engage with EMA through pre-submission meetings for scientific advice, ensuring endpoints meet requirements for clinical relevance and robustness.
Leverage qualification advice meetings with EMA for methodologies applicable across multiple products or diseases.
Seek assistance from regulatory initiatives, such as the FDA’s Digital Health Center of Excellence or EMA’s Qualification Advice Programs, for specialized guidance.

Findings
FDA requires OUS clinical investigations to comply with GCP, ensuring the credibility and accuracy of data and protecting human subjects.
Statements on GCP compliance and supporting information are mandatory for OUS data submissions.
Waivers are permitted in circumstances where GCP compliance is unattainable or where local regulations differ significantly from FDA requirements.
Investigations must demonstrate that OUS data are applicable to U.S. populations and medical practices.
Sponsors must provide robust documentation, including investigator qualifications, site descriptions, IEC reviews, and informed consent processes.

Recommendations
Ensure clinical investigations adhere to GCP standards, including IEC review and informed consent, for all OUS clinical data submitted to FDA.
Include detailed supporting information in submissions, such as investigator qualifications, facility descriptions, protocols, and data summaries.
Clearly identify any deviations from GCP and justify how data integrity and subject protection were maintained.
Use FDA’s Pre-Submission Program to discuss potential challenges with GCP compliance or data validation before submission.
Retain all required records for at least two years after FDA’s decision on the application or submission.

Regulatory Considerations
FDA evaluates OUS clinical data on a case-by-case basis, considering the adequacy of GCP compliance and supporting documentation.
For significant risk device investigations, sponsors must provide the most comprehensive documentation, while non-significant risk and exempt devices require less detailed information.
Waivers may be granted when justified by public health considerations or when local laws prohibit compliance with specific FDA requirements.
FDA retains the right to inspect clinical sites or review source documents to validate data integrity and compliance with GCP.
Sponsors must ensure that OUS data are valid and relevant to the U.S. population and medical practice.

Findings
HFE/UE is essential for identifying and mitigating use-related risks that could compromise device safety or effectiveness.
Preliminary analyses, such as task and fault tree analyses, help identify critical tasks and use-related hazards early in device development.
Human factors validation testing must represent realistic use scenarios, include diverse user populations, and focus on critical tasks with potential for serious harm.
Residual risks that remain after validation testing must be justified in terms of the device's overall benefits and risk management measures.
Effective risk management prioritizes design modifications over labeling or training as the primary method for addressing use-related hazards.

Recommendations
Incorporate HFE/UE into all stages of device development to address use-related hazards through design improvements.
Conduct comprehensive risk analyses to identify and prioritize critical tasks that may lead to serious harm if performed incorrectly.
Design human factors validation testing to reflect real-world conditions and involve representative user populations.
Address use-related risks primarily through design modifications, with labeling and training as secondary measures.
Submit detailed HFE/UE documentation in premarket applications to facilitate FDA review and approval.

Regulatory Considerations
Submit human factors validation testing data as part of premarket applications for devices where use-related errors could result in serious harm.
Risk management processes must align with standards such as ANSI/AAMI/ISO 14971 and IEC 62366, ensuring comprehensive hazard identification and mitigation.
Conduct additional validation testing if modifications to a marketed device impact user interactions or introduce new risks.
For actual-use testing, ensure compliance with Investigational Device Exemption (IDE) requirements where applicable.
Manufacturers should maintain detailed records of HFE/UE processes, which must be available for FDA review upon request.

Findings
The process of obtaining Informed Consent (IC) involves providing adequate information to facilitate comprehension and must allow subjects the opportunity to ask questions, continuing throughout the research. Electronic Informed Consent (eIC) systems, which can use various electronic media, are increasingly used to supplement or replace paper-based IC processes. The eIC process may be conducted on-site or remotely, but the legal responsibility for obtaining consent cannot be delegated to the electronic system. For FDA-regulated clinical investigations, electronic signatures must comply with 21 CFR Part 11 to be considered equivalent to a handwritten signature.

Recommendations
Presentation & Comprehension: eIC information should be easy to navigate, convey information in understandable language, and may use interactive electronic-based technology (e.g., diagrams, video) to facilitate comprehension. Optional questions can be used to assess a subject's understanding of key study elements.
Remote Consent: If consent is obtained remotely, the electronic system must include a reliable method to verify the identity of the subject (e.g., official identification, biometric methods).
Signature & Documentation: Electronic signatures are permitted and can be created using methods like biometrics or username/password, provided they are uniquely linked to the individual. The subject must be given a copy of the signed eIC, which can be electronic or paper.
Privacy & Security: The eIC system must be secure with restricted access and include methods to ensure confidentiality of subject information. If HIPAA applies, information must be encrypted unless otherwise documented.

Regulatory Considerations
IRB Responsibility: IRBs must review and approve all eIC materials and any subsequent amendments, including optional comprehension questions and the usability of the eIC materials. IRBs must maintain records (electronic or hard copy) of the approved versions of the eIC materials.
Submissions & Inspection: For IDE applications, copies of all eIC materials must be submitted to the FDA. During inspections, investigators must have site-specific signed eICs, amendments, and materials available (electronic or paper) for FDA review.
HIPAA: HIPAA authorizations may be obtained electronically, provided the signature is legally valid, and a copy must be provided to the subject.

Findings
Significant changes to device design, basic principles of operation, or clinical protocols require prior FDA approval through an IDE supplement.
Developmental changes made in response to information gathered during a clinical investigation and minor protocol modifications may be implemented with a 5-day notice if they meet specified criteria.
Changes that do not affect the scientific soundness of the investigational plan, risk-benefit profile, or participant rights and safety can be reported in an IDE annual progress report.
Sponsors are responsible for conducting risk analyses and using credible information, such as design controls or peer-reviewed literature, to justify changes.
The FDA reserves the right to question the appropriateness of changes implemented without prior approval.

Recommendations
Conduct a risk analysis for any device or protocol change and ensure no new risks are introduced.
Use credible information, such as design control data, preclinical testing, or published literature, to assess the impact of proposed changes.
Submit IDE supplements for significant design or protocol changes that affect the validity of study data, participant safety, or investigational plan soundness.
Use the 5-day notice process for developmental changes that improve safety or effectiveness but do not represent significant design changes.
Report minor investigational plan changes, such as clarifying instructions or updating IRB information, in the IDE annual progress report.

Regulatory Considerations
IDE Supplements: Required for significant changes to device design, manufacturing processes, or protocols that may impact study data validity, risk-benefit analysis, or participant safety.
5-Day Notices: Applicable for developmental changes and protocol modifications that do not introduce new risks or affect study soundness.
Annual Progress Reports: Used for minor changes, including clarifications to instructions for use or informed consent materials, provided they do not affect participant safety or study data integrity.
FDA reserves the right to reclassify changes implemented under a 5-day notice or annual report if they determine the changes required prior approval.