4 Things Digital Health Innovators Need to Know about Compliance

1. Gray areas are the norm.

Laboratory-developed tests (LDTs) have “regulatory discretion” with the FDA, which means that the FDA tends to pass off regulation of these tests to the Center for Medicare and Medicaid Services (CMS). That leaves lots of question marks for digital health.

Digital health founders sometimes think that bringing in a compliance officer will get them a quick answer to the question of “Can we do this?” But there are not a lot of legal precedents or enforcement activity in our space. Market access for digital health is a murky soup—a lot depends on who you are marketing to. A compliance expert can help you clarify what is possible; sometimes you need to take a matrix approach to sort out exactly what applies to your product.

2. Compliance matters after an FDA clearance.

The agencies are saying “Tell us what you’re doing, and keep really good records, because we are all figuring this out.” For example, it’s important to set up a system to track communications. You don’t want to rely only on a verbal agreement. Transcribe all phone calls so you have a permanent record, send them back to the FDA, and say “Did this capture our conversation?”

It’s a requirement to track adverse events, including when the authorization is an emergency use authorization (EUA). The FDA is also interested in usability data, which is information beyond what is required for authorization. It helps with your relationship with the FDA to keep a database. For example, how do people feel about at-home tests? Do they sit on the kitchen counter for several days before they get mailed? What do the instructions say, and does feedback indicate they are easily followed?

Something else about working with regulators: If you make a mistake, and can show that there was a process and internal controls in place for decision making, and after the fact realized you didn’t use super-great judgment in reaching your decision—chances are the regulators won’t be extremely harsh. This was generally the case in life sciences overall, and now we are seeing this in digital health, too. And, it’s important to be proactive when you do discover such a “miss.” Self-disclosure is key.

3. Seize opportunities to influence emerging requirements.

Privacy, for instance, is one area where this is possible: The use of AI is expanding, and the ethical use of data derived by AI is a significant area. Will there be more regulation in this area? Changing regulations? It’s a great time for digital health innovators to get in and mold that regulation, for example, by lobbying, or by joining with other companies to respond with a white paper.

4. Expect a healthy tension between compliance and marketing.

For example, when you’re going through the FDA authorization process, once the FDA is familiar with a product, they will say, based on the product’s intended use, “Ok, this product will be called XYZ.” And it might be a very long name, which for a marketing person might be challenging to use in various media. But in this instance there is no room for negotiation—that is just how the FDA works.

In other instances, as a compliance professional, to find the best path forward I first have to think like a business person. Social media is a great example: How can we say what needs to be said in that media where we may have only a tiny bit of space? The way I think it through is, “What is the risk that I’m protecting the company from? How likely is that risk to be exploited? Can I quantify it—i.e., worst case, what would be the cost to the company? How much wiggle room—if any—do we have to take on a bit more risk?” The decision will be made by consensus of the executives, and rightly so, but the recommendation comes from the compliance person. As a team, we must be aligned to achieve our objectives, so education is a factor in that equation, too.