UK gives guidance for manufacturers on reporting adverse SaMD incidents
Published on 26th Jun 2023
Businesses should consult the guidelines and familiarise themselves with the issues to report and systems to implement
The Medicines and Healthcare products Regulatory Agency (MHRA) has published its guidance for manufacturers on what, when and how to report adverse incidents involving software as a medical device (SaMD). This follows the previous roadmap published by the MHRA. (Read our previous Insight for more.)
Uses of SaMD in the UK are becoming increasingly common. They include software such as software to diagnose medical conditions, provide treatment recommendations for listed conditions or mental health support apps.
What to report?
Events that meet all three basic criteria are considered to be an "incident" and should be reported. The three basic criteria are that an event has occurred; the manufacturer's device is suspected to be a contributory cause of the incident; and the event led (or might have led to) either a death or a serious deterioration in state of a health of an individual.
The guidance has noted that "indirect harm" is the most probable outcome of adverse incidents caused by SaMD. Practically, this would likely involve issues with the SaMD such as providing imprecise results or inadequate quality and calibration controls. This would then lead to "indirect harm" such as misdiagnosis, inappropriate treatment or delays.
Types of incidents
The guidance has provided some practical examples of types of adverse incidents that would need to be reported, including:
- Performance issues – where the SaMD has failed to perform according to the performance characteristics specified by the manufacturer. For example, an AI tool intended to identify "normal" x-rays misses an abnormality on a scan which leads to an incorrect, delayed or missed diagnosis.
- Inaccurate diagnostics – where a diagnostic tool has failed, such as a use-at-home dermatology app providing an inaccurate result which prevents an individual seeking an expert clinical opinion.
- Human-device interface problems – where a user interface fails (for example, keyboard or touch screen) and this leads to an inaccurate input of data.
- Inadequate labelling or instructions – where confusing or inadequate instructions leads to the SaMD being used incorrectly.
- Computer security issues – where the SaMD has vulnerabilities such as a cyberattack and this then leads to a loss of monitoring or alarm or both.
How to report?
As with all medical devices, manufacturers have an obligation to keep a vigilant eye on their products on the market, and alert the MHRA where there are issues, as well as take the appropriate safety action when required. For SaMD, the guidance has confirmed that reports can be provided as individual events, periodic summary reports or a trend report, if relevant.
For SaMD, the MHRA would expect hardware, operating system model and version numbers to provided along with the reports.
Osborne Clarke comment
The guidance reiterates the stringent requirements on SaMD manufacturers to ensure that their products are safe and that there are robust processes in place to continually review the safety performance of these products; for example, through ongoing review of data analytics to ensure the accuracy of diagnostics, to protect patients and the public.
The details of the guidance also recognises the large scope of potential liability of SaMD manufacturers. The guidance has made it clear that the manufacturers will not only be liable for the product itself, but they will also have wider liability risks – for example, in terms of sufficient system security to prevent cyberattacks affecting their SaMD. The potential chain of causation is also extended, with the guidance noting secondary aspects such as failure of connected hardware, or patients not seeking further clinical advice, being considered potential adverse incidents of the SaMD.
Businesses placing SaMD on the market should consult the guidance and familiarise themselves with the types of issues that need to be reported and consider what systems and procedures they may now need to implement to ensure they are carrying out appropriate checks and balances on their SaMD.
