Given pending mobile medical apps guidance from the FDA, Rock Health has developed a guide for digital health entrepreneurs trying to navigate the FDA process. The report covers the current scope of regulatory oversight, device classification and premarket requirements for digital health companies creating regulated products. Digital health entrepreneurs that have successfully navigated the process offer pointers and best practices to startups. Purchase this report here: https://gumroad.com/l/uaBu

1. A R O C K R E P O R T B Y
A guide for
digital health
entrepreneurs
FDA 101

2. Rock Health funds and supports startups building the next generation of technologies
transforming healthcare.
Rock Health partners include Aberdare Ventures, Accel Partners, Genentech, Harvard
Medical School, Kaiser Permanente, Kleiner Perkins Caufield & Byers, Mayo Clinic,
Mohr Davidow Ventures, Montreux Equity Partners, NEA, Nike, Qualcomm, Quest
Diagnostics, Silicon Valley Bank, UnitedHealth Group, and UCSF.
For more information, visit rockhealth.com
About
REPORT
This is a commonly heard refrain from entrepreneurs who work in healthcare. We
know regulation is for good reason—to protect the safety of consumers—and
companies want the same. However, the FDA clearance/approval process can
seem murky, challenging, and capital intensive. This guide is intended to introduce
entrepreneurs to FDA regulation around medical devices and mobile medical apps.
Please note that this report is partially based on draft FDA guidance and will be
updated as new information is available. Future guides may cover the various
submission processes in more depth and international markets.
Special thanks to Chris Bergstrom, Geoff Clapp, Jeff Engler, Alex Frommeyer,
Sridhar Iyengar, Mohit Kaushal, and Michael Righter for their time and insights, and
to Jenna Green for contributing an early draft focused on medical devices.
Produced by:
this
Deborah Pascoe
@deborahpascoe
Malay Gandhi
@mgxtro
When we learned that we
would be regulated as a
medical device, we were
initially apprehensive
about what this meant to
us as an early stage
company.”
Jeff Engler
Co-Founder, Podimetrics
“
With help from:
Holly May, Health Advances

3. Presentation Ⓒ 2013 Rock Health
The FDA
Department of Health
and Human Services
Food and Drug
Administration (FDA)
Protecting the public health by assuring
the safety, effectiveness, and security of:
“• Human and veterinary drugs
• Vaccines and other biological products
• Medical devices FOCUS OF ROCK REPORT
• Food supply
• Cosmetics
• Dietary supplements
• Products that give off radiation
• Tobacco
MISSIONOVERVIEW
Year formed FY12 budget Employees
1906 $3.8B 13,490
3 Source: FDA

4. Presentation Ⓒ 2013 Rock Health
Why is the FDA looking at digital health?
38K+
WIDESPREAD
AVAILABILITY
PUBLIC
INTEREST
healthcare and
fitness apps 24K+ medical
apps
19%of smartphone owners
have downloaded an
app to track or
manage health
41%
of consumers have
a strong interest in
remote monitoring
devices to check
condition and send
information to
doctor
4 Source: 148Apps, AppBrain, Pew Internet & American Life Project, Deloitte Center for Health Solutions

5. Presentation Ⓒ 2013 Rock Health
Scope of FDA regulatory oversight
States that the FDA intends to apply its regulatory
authority to mobile apps that are medical devices
under current definition:
2012 2013
July 2011
draft guidance
released
March 2013
final guidance
pending
an instrument, apparatus, implement, machine, contrivance,
implant, or in vitro reagent that is intended for use in the
diagnosis of disease or other conditions, or in the cure,
mitigation, treatment, or prevention of disease in man, or
intended to affect the structure or any function of the body
Transforms
one of these
1
Is used as an accessory to one of these2
into this
AND
EITHER
OR
DRAFT GUIDANCE:
MOBILE MEDICAL APPS
5 Source: FDA

6. Presentation Ⓒ 2013 Rock Health
FDA regulation of “apps”
No regulatory requirement
Selective
enforcement
Mobile
medical
apps
60,000+ apps
CURRENT GRAY AREA
A mobile app that meets the definition of a medical device,
but is not necessarily transforming a mobile platform into a
medical device or acting as an accessory to a medical
device, and hence is not a “mobile medical app”
NOT A NEW FOCUS FOR THE FDA
Note: not meant to be representative of % of apps in each category
~100 mobile medical apps
reviewed since 1997
143
67
average days for 510(k) decision
mobile medical
apps only
(1997-2012)
6 Source: FDA, average days for 510(k) decision is based on 98% of all submissions
all submissions
(2011)

7. Presentation Ⓒ 2013 Rock Health
Regulation—a burden, or strategy?
Increased
customer
confidence
New markets
and channels
Reduced
business risk
Discovery and
correction of
problems pre-market
Consistent operating
procedures
Scalable quality
assurance systems
Added work
and expense
Delayed
product
launch
Need for
specialized
expertise
Clearance or
approval
uncertainty
Market entry
barrier
Which lens?
BENEFIT
COST
7

8. Presentation Ⓒ 2013 Rock Health
“
Contact the FDA early to explain your idea, but
developing a detailed regulatory strategy before you
have developed a product is putting the cart before the
horse; you should do both in parallel and iteratively. The
FDA is very willing to give general feedback on whether
you're on the right track and what gaps they see in your
strategy. They are there to help guide you, but they are
not there to act like free consultants, so you will need to
plan to build out your own regulatory resources.
SRIDHAR IYENGAR
Co-Founder and
Chief Technical Officer
iBGStar Blood Glucose Monitoring System
iBGStar Diabetes Manager Application
FDA Class II Clearance
Quantitative measurement of blood
glucose levels; application with the
capability of sending glucose readings
through e-mail to an individual’s
healthcare professional in the review,
analysis and evaluation of glucose
test results to support an effective
diabetes management program.
8

9. Presentation Ⓒ 2013 Rock Health
The regulatory path
START
I’m a medical
device or mobile
medical app
CLASS III
CLASS II
CLASS I
I’m not a
medical device
or mobile
medical app
You require FDA
clearance or
approval
You could still be
regulated by FCC,
OCR or others
9

10. Presentation Ⓒ 2013 Rock Health
Is this a mobile medical app?
• Electronic reference materials
• Training materials
• Log, record, track, evaluate, or make decisions
related to general health and wellness
• Healthcare administration, including billing,
appointments, and insurance transactions
• EHRs or PHRs
• Generic aids not marketed for a medical indication
• Control a medical device or display, store, analyze,
or transmit patient-specific medical device data
• Attachment, display screen, or sensor that
transforms a mobile device into a medical device
• Diagnosis, treatment recommendations, or clinical
decision support by applying formulae or
algorithms to patient-specific inputs
YES
NO
KEY QUESTION: is your app’s intended use (alone or in concert with a device—regulated
or otherwise) to diagnose, treat, mitigate, cure, or prevent a specific disease or condition?
10 Source: FDA, guidance interpretation by Rock Health

11. Presentation Ⓒ 2013 Rock Health
The three classes
11 Source: FDA
CLASS I
CLASS II
CLASS III
Does not support or
sustain human life and
has a significant history of
safety and effectiveness
low
high
Has a similar intended
use and a safety and
effectiveness profile of a
device already on the
market; risk requires
special controls
Supports or sustains life
or high risk of injury;
typically requires clinical
studies demonstrating
safety and effectiveness
CONTROLS
General
General +
Special
General +
Special +
Ad hoc
PREMARKET
RISK TO
PATIENT
Most exempt from
510(k) clearance
Most require
510(k) clearance
Nearly all require
premarket
approval (PMA)

12. Presentation Ⓒ 2013 Rock Health
Hypothetical example
CLASS I
CLASS II
CLASS III
low
high
Bandage
Covering a wound
Reporting on a wound
Treating a wound
+
+
Mobile phoneSmart Bandage
Mobile phoneSmart Bandage
Wound temperature
Wound temperature,
humidity, size
Algorithm-derived
dose for medication
12 Note: Only the FDA can designate a device to be a certain class; above examples are not real
RISK TO
PATIENT

13. Presentation Ⓒ 2013 Rock Health
“
Ask yourself: what’s your product and
what’s your value proposition? Then, marry
those with the appropriate regulatory path
and business model. For example, if your
model is based on reimbursement, then
you’ll likely need published clinical
outcomes and FDA clearance.
CHRIS BERGSTROM
Chief Strategy and
Commercial Officer
DiabetesManager System &
DiabetesManager-Rx System
FDA Class II Clearance
Provides secure capture, storage, and
transmission of blood glucose data as
well as information to aid in diabetes self-
management.
13

14. Presentation Ⓒ 2013 Rock Health
Novelty versus predicate device
SmartTrack System
FDA Class II Clearance
(October 2009)
Intended for single-patient use as an electronic
data capture accessory for recording and
monitoring actuations of prescribed MDI usage.
Unlike patents, demonstration of novelty scores no points with the FDA for Class II—the focus
should be on showing equivalence to a predicate device in order to gain clearance
Asthmapolis System
FDA Class II Clearance
(July 2012, found to be
substantially equivalent to
the SmartTrack system)
Intended for single-patient use to assist physicians and
patients in recording and monitoring the actuations of
prescribed MIDI usage. Technological characteristics of
the Asthmapolis System and the SmartTrack System are
largely equivalent.
14 Source: SmartTrack and Asthmapolis FDA filings

15. Presentation Ⓒ 2013 Rock Health
Too innovative for a predicate
By default, any medical device that presents risk and is without a predicate is Class III, but
through a de novo petition can be re-classified as Class I or II
Proteus Personal
Monitor including
Ingestion Event Marker
FDA Class II de novo
(July 2012)
?
Not substantially equivalent
(NSE) to any cleared or
approved medical device
Intended for ambulatory recording of heart rate, activity,
body angle relative to gravity, and time-stamped, patient-
logged events, including events signaled by swallowing
the Ingestion Event Marker (IEM) accessory.
15 Source: Proteus Digital Health filings

16. Presentation Ⓒ 2013 Rock Health
The 510(k) process
• Define your intended use: this will control how your device
can be used and marketed, ultimately defining your
customer value proposition
• Determine the class of device
• Find predicate device(s)
• Open a dialogue with FDA
• Prepare documentation: intended use statements, software
and mechanical specifications, validation
• Perform risk assessments and put control measures in place
• Develop quality systems and standard operating procedures
• Prepare the 510(k) submission
• Submit a small business qualification certification to pay a
reduced user fee
• Pay the user fee ($2,480)
• Submit the 510(k) electronically and via mail
FDA acknowledges receipt
and assigns a reference
number
A 510(k) is a premarket submission made to the FDA
to demonstrate that the device to be marketed is at
least as safe and effective as (i.e., substantially
equivalent to) a legally marketed device that is not
subject to premarket approval.
Within 15 days
Average of 67 days for mobile medical apps
PRE POST
SUBMISSION
16 Source: FDA
FDA mails and faxes a
decision regarding the
application
Questions and responses
exchanged by FDA and
applicant as needed

17. Presentation Ⓒ 2013 Rock Health
“
What the FDA is asking for is essentially
basic software controls. Good software
engineers do these things naturally—code
reviews, unit testing, system-level testing,
change control, etc. These approaches are
routinely used by experienced developers
who value rigor and process in their
software deployment methods.
MICHAEL RIGHTER
Director, Regulatory Affairs
AliveCor Heart Monitor for iPhone
FDA Class II Clearance
Records, displays, stores and transfers
single-channel electrocardiogram (ECG)
rhythms for licensed medical
professionals or patients.
17

18. Presentation Ⓒ 2013 Rock Health
The PMA process
• Define your intended use: this will control how your device
can be used and marketed, ultimately defining your
customer value proposition
• Open a dialogue with FDA
• Determine whether to use a traditional, modular (application
submitted in components as they are ready) or streamlined
(pilot program for familiar products) PMA approach
• Prepare documentation: intended use statements, software
and mechanical specifications, non-clinical laboratory
investigations, clinical investigations
• Perform risk assessments and put control measures in place
• Develop quality systems and standard operating procedures
• Prepare the PMA application
• If this is the first PMA submission and <$30M revenue, fees
are waived, otherwise, small businesses pay $62,000
• Pay the user fee if required
• Submit the PMA electronically and via mail
FDA mails and faxes a
decision regarding the
application
A premarket approval (PMA) application is a scientific
and clinical submission made to the FDA to
demonstrate that the device to be marketed is safe
and effective; to date, no mobile medical apps have
required a PMA.
Within 45 days
Most likely >180 days to complete review
PRE POST
SUBMISSION
18 Source: FDA
FDA files the PMA if it
meets basic adequacy in
technical elements
Questions and responses
exchanged by FDA and
applicant as needed

19. Presentation Ⓒ 2013 Rock Health
Not so fast: post-market
REQUIREMENTS AND CONSIDERATIONS
Marketing Distribution Tracking
DON’T GET TOO CREATIVE FINDING CUSTOMERS SURVEILLANCE FOR LIFE
• No marketing or labeling
outside of the approved
intended use (for whom
and for what)
• Free to describe the
device as “FDA Cleared”
or “FDA Approved” as
appropriate
• For some device
categories, reimbursement
codes may already exist
• For others, the value
proposition will need to be
taken to payers and
prescribers to secure
reimbursement and
distribution
• FDA can inspect quality
systems agreed to at
clearance/approval any time
• Consistent tracking
procedures are needed
around design,
manufacturing, sourcing,
change control, QA testing,
adverse event reporting,
and customer complaints
19

20. Presentation Ⓒ 2013 Rock Health
“
Remember, the FDA may not be the only
organization you need to work with before
marketing your digital health device. We
were surprised at the number of
authorizations we needed, from the FDA
and FCC to Apple MFi and Bluetooth.
ALEX FROMMEYER
CEO and Co-Founder
Beam Brush / Beam App
FDA Class I Clearance
A toothbrush to remove plaque and
debris from its user's teeth and aid in
the prevention of tooth decay. The
Beam Brush collects brushing usage
data and wirelessly transmits the data to
a software application (Beam App) that
runs on the user's own mobile device.
20

21. Presentation Ⓒ 2013 Rock Health
Pro-tips
STAFFING
BRING IT IN HOUSE
COLLABORATION
EARLY AND OFTEN
DOCUMENTATION
PLAN UPFRONT
• Don’t rely on consultants—bring an experienced regulatory and quality person
in-house that has worked with FDA before
• An in-house person who will have to live with the procedures they design is
more likely to think long-term and develop methods that are workable and
appropriate for the company
• Maintain a positive relationship with FDA—there are real people on the other
side doing their best to protect consumers
• Anticipate FDA's follow up questions, and be proactive about doing additional
studies in parallel while awaiting a response
• Figure out what FDA really wants if they ask for burdensome things—dialogue
can usually uncover underlying needs
• Invest in good tracking tools upfront: project management, quality/bugs,
traceability and document repositories; some of the enterprise tools are FDA
friendly, but can be cost-prohibitive for startups—ensure that they meet your
needs before purchasing
• When you generate policies and procedures for building and testing product,
strike a balance; don't be so conservative that you cannot adjust to market
needs and don't be so flexible that FDA has concerns
21

22. Presentation Ⓒ 2013 Rock Health
What’s next?
22
July 2011
draft guidance
released
20142012 2013
YOU TELL US: What should a future guide cover?
E-mail us at research@rockhealth.org
March 2013
Congressional
hearings held
October 2013
Final guidance issued (likely by this date)
Will clarify selective enforcement but unlikely to
change overall oversight approach
Source: FDA

23. For a huge percentage of digital health companies,
following FDA regulations will actually make them a
better company, with a higher quality process, and
open the door to the entire healthcare market,
including enabling them to bid on contracts with
some of the largest government institutions.
Entrepreneurs should embrace, not fear, the FDA.
“
GEOFF CLAPP
Co-Founder and Former CTO
Health Hero Network
Mentor, Rock Health

24. Presentation Ⓒ 2013 Rock Health
Notes
3 FDA statistics and facts
4 iOS apps
Android apps
Pew Internet & American Life Project: Tracking for Health
Deloitte 2012 Survey of Health Consumers
5 Further reading: FDA Draft Guidance for Mobile Medical Applications
6 Mobile Medical App review length and total reviews (Hearing video)
2011 and 2010 average review length for all 510(k)s
10 Based on FDA Draft Guidance for Mobile Medical Applications
11 Further reading: Device classification
Further reading: General and special controls
14 SmartTrack FDA filing
Asthmapolis FDA filing
15 Proteus Digital Health FDA filing
16 Further reading: 510(k) (premarket notification)
18 Further reading: Premarket approval (PMA)
19 Further reading: Postmarket requirements
22 Expected issuance of final guidance and scope (Hearing video)

25. Presentation Ⓒ 2013 Rock Health
Our portfolio
2011
2012
2013
V1: 15 companies
V2: 13 companies
V3: 7 companies (Boston)
June-November 2011
January-May 2012
June-August 2012
V4: 14 companies
October 2012-February 2013

26. @rock_health
research@rockhealth.org
GET IN
TOUCH