This article was originally published in For the Record.

The realm of digital health has long been dominated by health and wellness apps. These applications typically focus on helping users monitor various health metrics, like blood pressure and blood  glucose levels, and providing reminders for medication schedules. However, their functionalities are limited to tracking and informing without offering diagnostic or treatment decisions, making them exempt from stringent regulatory oversight by authorities such as the FDA in the United States or the Therapeutic Goods Administration in Australia.

Since they don’t fall under the  classification of medical devices and are not subject to regulatory scrutiny, health and wellness apps enjoy significantly simpler development and market entry processes, contributing to their widespread  availability and global adoption. With minimal regulatory barriers, developers can expedite product development cycles, allowing for quicker market launches and widespread consumer access. However, developers of health products need to be aware that market pressures may eventually lead to initial product designs being classified into new regulatory categories.

Regulatory Variability and Product Evolution

Market demands and technological advancements can prompt developers to enhance the functionalities of their apps beyond basic data tracking. The growing demand for personalized, remote health care  has led to the advancement of telemedicine, defined as the use  of electronic information and communications technologies to deliver and support health care across distances. In recent years, the use of wearables in telemedicine has notably surged, bringing numerous advantages to the health care value chain and evolving to offer enhanced medical personalization, early  diagnosis, improved decision-making, and effective patient monitoring.

Digital health products may advance from merely supporting diagnosis to actively diagnosing medical conditions—a  progression that often results in reclassification into higher regulatory categories, for instance, from Class II to Class III in the US regulatory framework. An app that may have initially been designed for fitness monitoring  might evolve to incorporate features that support clinical decision-making or  health diagnosis. Such expansions in functionality could trigger reclassification under more stringent regulatory categories, such as Software  as a Medical Device classifications in the United States. With the increasing use of AI-powered technologies in health and wellness devices and apps, it is expected that regulations will soon catch up.

Although mapping out regulatory requirements for health and wellness applications may seem straightforward, given that they often don’t require stringent compliance, it’s essential to address these requirements during the product’s initial design phase. Developers must not only comply with existing regulations but also anticipate  potential shifts in regulatory frameworks as their products evolve.

Tackling this without a plan is not an efficient approach. Foresight is essential for integrating new features or  functionalities that may transition the product from a nonregulated status to a  more heavily regulated category, as in the previously mentioned example of a fitness app evolving to accommodate health diagnosis.

Navigating Country-Specific Regulatory Demands Amidst Cybersecurity Risks

‍
Complicating things further, the  regulatory classification of these products varies from market to market around  the world. For example, while the FDA applies a risk-based  approach to software as a medical device, which resultantly excludes  many apps from regulation and oversight, Europe follows a function-based  approach based on the device’s intended purpose, regardless of outcomes.  Therefore, it’s extremely important that digital health product developers lay  out the country-by-country medical device-related regulatory requirements with  which their products will need to comply.

Moreover, global regulators have  intensified their security and expectations regarding data protection in  response to the  rise in cybersecurity threats in recent years. This makes ensuring  compliance with privacy and security standards essential for any digital health  regulatory roadmap. The fact that regulatory bodies now mandate that device  companies integrate security-by-design principles throughout the entire  lifecycle of digital health products reflects this reality. This includes  conducting thorough risk assessments and implementing threat modeling to  proactively address potential vulnerabilities. In the United States, this also  involves creating and maintaining a comprehensive and up-to-date software bill  of materials, as mandated by the 2023 US  Consolidated Appropriations Act.

Most digital health technologies will  incorporate some form of protected health information to provide personalized  and effective services, including accurate diagnosis, continuous patient  monitoring, and so on. This large demand for health care data is accompanied by  equally substantial vulnerabilities. Stricter regulations do not come as a  surprise when statistics reveal that nearly 1,000  security vulnerabilities were found across 966 tested medical  devices, which is a 59% year-over-year increase from 2022. Needless to say,  protecting the privacy of collected personal information is critical from a  regulatory point of view.

Balancing  Convenience With Regulation‍

The advancements in  digital health technologies have made health care convenient for many,  including those who don’t have easy access to on-site health care solutions. The  general public, for instance, has been encouraged to use wearables to promote a  healthier lifestyle. And digital health technologies have become popular among  older populations by offering real-time monitoring of potential problems,  giving them the confidence to carry on independently with reassurance. When  digital health technologies are designed with considerations for regulatory  compliance, security, and privacy, they not only avoid potential market  obstacles but also maximize benefits for users.

— Phyllis Meng,  cofounder and CEO of Pure Global, brings a diverse data analytics and  technology background to her role. With experience gained from positions as a key  data expert at Citadel Securities and technical team leader at Google, she  blends artificial intelligence and biomedical engineering to develop innovative  platforms for regulatory and compliance professionals.

‍