The Corona App - first example of MDR Class I Software?

In the discussion on the Corona App, most of the attention is headed towards Privacy protection, while no one seems to realize that such an App might also be a Medical Device, as its intended purpose is prevention of a disease.

The ‘Corona App’ is a software application installed on a mobile device (typically a mobile phone) intended by the manufacturer to track (duration, vicinity) contacts of the users with other users of the App. When a user is tested positive for COVID-19, all its contacts (other users of the App) get a message that they have been in contact with an infected person. These contacts are then supposed to stay in quarantine, in order to prevent further spreading of COVID-19. The app informs the lay user, not a clinician. The intended purpose is thus prevention of people being infected by COVID-19, i.e. prevention of a disease.

Now is such an App a medical device?

Today, the Medical Device Directive (MDD, 93/42/EEC) is still in force and the definition of a medical device is therefore:

‘medical device’ means any instrument, apparatus, appliance, software, material or other article, whether used alone or in combination, including the software intended by its manufacturer to be used specifically for diagnostic and/or therapeutic purposes and necessary for its proper application, intended by the manufacturer to be used for human beings for the purpose of: diagnosis, prevention, monitoring, treatment or alleviation of disease, …

So, the MDD limits its validity to software for diagnostic and/or therapeutic purposes. The App does not diagnose or treat any person; therefore, the App would not qualify as a medical device under the MDD.

Now in the MDR, the definition of a medical device is slightly shorter and thereby broader:

‘medical device’ means any instrument, apparatus, appliance, software, implant, reagent, material or other article intended by the manufacturer to be used, alone or in combination, for human beings for one or more of the following specific medical purposes:

— diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease,

The requirement for a specific diagnostic and/or therapeutic purpose has been replaced by “medical purpose”, and prevention of a disease is specifically mentioned as medical purposes. For reason that the app is intended to prevent a disease, a Corona App would qualify as a medical device under the MDR.

Next question is then what is the classification of the Corona App?

For that we apply MDR ANNEX VIII, rule 11, specific for stand-alone software:

Software intended to provide information which is used to take decisions with diagnosis or therapeutic purposes is classified as class IIa, except if such decisions have an impact that may cause:

— death or an irreversible deterioration of a person's state of health, in which case it is in class III; or

— a serious deterioration of a person's state of health or a surgical intervention, in which case it is classified as class IIb.

Software intended to monitor physiological processes is classified as class IIa, except if it is intended for monitoring of vital physiological parameters, where the nature of variations of those parameters is such that it could result in immediate danger to the patient, in which case it is classified as class IIb.

All other software is classified as class I.

For the interpretation of Rule 11 we refer to the "MDCG 2019-11, Guidance on Qualification and Classification of Software in Regulation (EU) 2017/745 – MDR and Regulation (EU) 2017/746 – IVDR,"

The Corona App performs a medical purpose on its own and it creates information, therefore it does qualify as Medical Device Software (MDSW) as defined in the MDCG 2019-11 guidance.

What is risk classification of the Corona App?

The MDCG 2019-11 guidance sub-divides rule 11 into:

• Sub-rule 11a: MDSW which is intended to provide information which is used to take decisions with diagnosis or therapeutic purposes is classified as class IIa.
  the Corona App does not provide information which is used to make a diagnosis, and also not to make a decision on a therapy: rule 11a is not applicable
• Sub-rule 11b: MDSW that is intended to monitor physiological processes will, under most circumstances, provide “information which is used to take decisions with diagnosis or therapeutic purposes
  the Corona App does not monitor physiological processes: rule 11b is not applicable
• Sub-rule 11c) implies that all other MDSW is classified as class I.
  The Corona App would thus be classified as a class I medical device.
  
  Digging deeper into the MDCG 2019-11 guidance, Annex III of this guidance refers to the mapping of the IMDRF risk classification framework ("Software as a Medical Device": Possible Frame work for Risk Categorization and Corresponding Considerations," IMDRF SaMD working Group, IMDRF/SaMD WG/N12FINAL:2014) in the context of MDR rule 11. In that framework three levels of significance are used
• Low: Informs clinical management
• Medium: Drives clinical management
• High: Treat or diagnose
  

Since the Corona App does not inform or drive clinical management, nor treats or diagnose, the IMDRF mapping table is not applicable, which also points to “all other software”, and thus a classification as a Class I device.

The MDCG guidance states that the software must be “for the benefit of individual patients”. This might cause a problem because the intended purpose of the app is not to prevent the user of becoming infected but prevent other persons to become infected by the user. However, the App provides information directly to individual users (also potential patients) AND the intended purpose of the App is to prevent other individuals (potential patients) of getting infected by COVID-19. These “other individuals” are not random, unknown, persons, but family, friends and colleagues of the user. The fact that the user and the potential patient is not the same person does not, in our opinion, change the conclusion that the App is a medical device.

Regulatory implications

• QMS requirements
• Clinical Evaluation, including State-of-the-Art, Clinical Benefit, Safety & Performance
• Risk Management
• Harmonized standards

Conclusion

The Corona App intuitively classifies as a medical device, because its intended purpose is to prevent a disease, and the disease itself is a serious public health threat. Surprisingly, the MDD definition of a medical device is restricted to devices which provide diagnosis or treatment, effectively blocking the possibility that devices who prevent a disease qualify as a medical device.

The MDR definition of a medical device does not upfront require a diagnostic or treatment purpose so that devices which prevent a disease are now also covered by the definition. In our opinion the Corona App would fall under the definition of a medical device. The Corona App will then be one of the first examples of a software product which would fall in Class I medical devices. The reason for this classification would be that the App only provides information to the user and not to a clinician, and without providing a diagnosis.

Jan-Paul van Loon & Jaap Noordmans