This article is for: Early-stage life science software startups who have not yet hired a regulatory consultant or expert and want to begin learning important life science regulatory concepts.
This article will give a general overview of concepts that founders should dig into. Founders should eventually consult with regulatory experts before making important decisions. The information herein should not be taken as direct legal or regulatory advice.
Written by: Alex Senson, Ashley Burton, Tyler Boulanger
When designing a software product for the life science industry, startups do not just need to focus on the design elements going into the product, they also need to follow all the regulations in place. These regulations ensure that the software product being developed is safe for its users based on the level of security and privacy being provided.
In this article, we will outline the importance of life science regulations in the development of life science software products. Additionally, we will explain some key market trends that are influencing these regulations.
This article is for startup founders, who plan on developing a software product for the life science industry. Your startup may have a development team and it is important for everyone involved to understand the importance of following these regulations. Alternatively, your startup may out-source or sub-contract the work, so you need to be able to communicate the importance of regulation to the hired development team.
Use this resource to learn more about the different types of regulations that startups need to follow when creating software products for the life science industry. Also learn how you can follow these regulations by yourself without having to hire a regulatory consultant until later on in the development process. Ultimately, the goal is that through learning about the regulations in place, your startup will be able to create a stellar software product that follows these regulations, all without having to redo work since they were followed from the project’s inception.
Main topics to be covered:
- Life Science Regulations – Introduction
- Insights from Life Science Company 3Terra
- New Market Trends that are Influencing Life Science Software
- Software as a Medical Device
- Hosting a Life Science Software Product on the Cloud
- When Should Startups Begin to Think About Regulations?
Life Science Regulations – Introduction
Key Takeaway: Regulations for life science software products were created to ensure consistency between products, as well as to promote security and development control. These regulations, however, are continuously evolving as a result of the technological advancements.
The regulatory environment can be very challenging to navigate for startups. Its complexity is further increased as the regulatory bodies are also trying to stay up-to-date with the latest technological advances around the world. Their focus is to bring new solutions quickly to market that are a benefit to patients and ensure safety.
Additionally, the regulations that are applicable to your software solution vary depending upon a number of factors. The regulations applicable to each software product varies based on the type of software product being produced, if it is patient or physician focused, and whether or not it is accessible by the internet.
The accelerated advancement of technology has brought both benefits as well as increased challenges regarding patient safety and privacy. As a result, it is critical to have the appropriate controls in place during the entire product life cycle to ensure that all applicable regulations are followed.
Insights from Richard Obuhowich, 3Terra
Data security and privacy are some of the key topics within the field of software for the life science industry. This is because the information stored within life science software commonly consists of private user data that is identifiable, as well as location information.
Some companies, however, try and sell this private user data because they need money to fund their project, or the more likely answer, they are just greedy. Many startups believe that they can collect this data without consulting the end users and monetize it to fund their research, or just for some extra money in the bank. Many regulations in place, however, do not allow user data to be collected and sold without the user consenting to its collection. Additionally, if they are collecting user data, startups need to be aware that a lot of resources are required to sort though and organize all the user data to be able to fully understand it.
To navigate the collection of user data, and other regulatory concerns during the design process, startups should take the time to research any regulations that might apply to them. This can be done through a regulatory consultant, or by taking online courses or attending industry events.
Startups need to remain up to date on any changes with the regulations as they evolve whenever there are advancements in the related technology. For example, there have been recent policy changes by the FDA regarding cyber security for the prevention of hacking Bluetooth medical devices such as a heart device. Just because engineering allows you to do something does not mean that you always should. Startups need to remember to review the intended and unintended uses of their software products when thinking about security and privacy to ensure your product can not be exploited by malicious people.
New Market Trends that are Influencing Life Science Software
Key Takeaway: Recent trends in the life science industry, such as patient-centric smart tools and big data collection, have influenced the development of software products for the life science industry. Regulations need to adapt based on each new technology that becomes prevalent within the industry.
Regulations regarding the development of life science-related software are in flux and change with changing technology trends. Below are some examples of new market trends that have influenced life science software regulations.
Development of Patient-Centric Smart Tools and Devices
Patients do not always want to visit a physician for a simple ailment. As a result, there has been an increase in products that allow patients to monitor and track their own health and transfer their data to physicians. The physicians can then interpret the information and recommend a course of treatment without needing to meet the patient.
These solutions can make it easier for patients to collaborate with physicians on health-related issues and get faster and easier access to healthcare.
Innovations within the field of wearable technologies is increasing, both for devices as part of a therapy and as a method of data collection. The costs of these technologies are decreasing, making their insights more available to all parties to collect useful data.
Big Data Collection and Analysis
The collection and analysis of big data is becoming increasingly prevalent within the life sciences industry. This data is being being leveraged to enable the true personalization of care.
Companies are migrating to the cloud as it allows for simpler and more cost effective processing, due to its pay-as-you-go option. This migration is slow, but they the industry is embracing leading edge computational tools to manage and process data faster.
The big driving force for the increased collection and analysis of big data is the decreased overall cost. This is because startups and other corporations are adopting open-source technologies and commodity infrastructure that allows companies to accelerate implementation of big data and recognize the benefits while saving money.
Software as a Medical Device
Key Takeaway: Medical devices are no longer solely hardware products; they have also evolved to include software products as well. Software as a medical device is still monitored and approved by the FDA, with a streamlined process that continues to evolve based on emerging technologies.
Software can be used within the life science and health care industries as a medical device to improve the lives of patients.
Since medical devices no longer need to be solely hardware products, the FDA recognizes that the traditional process of reviewing medical devices no longer fits. As a result they have developed a more streamlined process for premarket review and clearance of software products regulated as medical devices. The improved process is intended to be better calibrated to the development, maintenance, and lifespan of software products and services.
The FDA has also announced that there is now a Software Precertification Pilot Program which is the new regulatory review process for software as a medical device. This precertification is for digital health developers to ensure that the developers manufacture high-quality, safe and effective digital heath devices while providing patient safeguards. This allows developers to market their lower-risk devices without additional FDA review or with a more streamlined premarket review.
While developing software as a medical device, startups should remember to review the following questions to ensure that all the appropriate regulations are being followed during the design and development of the medical device software product:
- Do you have the right policies and procedures in place to develop medical device software?
- Do you have an appropriate quality management system established for developing software that is considered a medical device?
- Do you have a robust software development lifecycle with processes established that ensure quality and patient safety?
- Do you have appropriate and effective risk management processes established?
- Do you know what regulations and guidance are required to meet the requirements for bringing Medical Device Software to market?
- Are you utilizing best practices for developing Medical Device Software?
- Does your organization maintain a Culture of Quality and Organizational Excellence that meets the expectations of the regulatory precertification program?
Hosting a Life Science Software Product on the Cloud
Key Takeaway: When hosting a software product on the cloud the number of regulations that need to be followed increases. This is due to the increased security concerns held by the users and regulators. Startups should review the cloud service providers’ security protocols and certifications to ensure that they are a good fit for hosting a life science software.
Hosting a software product within the life science industry on the cloud is a way for startups to save money on the server infrastructure compared to hosting the product themselves. Global regulations dictate that when a software product for the life science industry is hosted on the cloud it must have:
- Applications that are fully validated
- Information technology infrastructure that is qualified
- Data availability, integrity, and security that is to be maintained
Startups and hired regulatory consultants should ensure that the controls in place are regularly audited or certified against industry standards. This is used to demonstrate that the hosted platform is maintained in a state of control that is in accordance to the applicable regulatory requirements.
Challenges Associated with Hosting a Life Science Software Product on the Cloud
Key Takeaway: Hosting on a life science software product on the cloud is challenging due to the increase in the number of parties responsible for the success of the software product. Startups need to ensure that they are confident in the cloud hosting provider chosen as well as have clear roles and responsibilities to ensure success.
Hosting your startup’s software product on the cloud introduces some unique challenges during the development, approval, and marketing stages of development. These challenges need to be addressed by startups early on to ensure the company does not spend additional resources redoing work that was not done correctly in the eyes of the regulatory authorities. The challenges faced by startups who host their software product for the life science industry on the cloud include:
- Unclear ownership and responsibility between the service provider and themselves — have clear roles and responsibilities with the cloud hosting provider selected to ensure that regulatory compliance is maintained.
- Startups are unable to control all aspects of the cloud environment —though you might not be in total control of the cloud, it is important to demonstrate that due diligence has been performed and that the any risks associated with this lack of control have been mitigated to an acceptable level of risk.
How to Select a Cloud Service Provider for Your Life Science Product
Key Takeaway: Selecting a cloud service provider that has experience in hosting life science software products is essential for success. These providers have the credentials and protocols in place to ensure that your life science software product is maintained correctly on the cloud.
Startups should look for a cloud service provider that has specific expertise around the quality and compliance requirements within the life science industry. These ensues that the provider fully understands the regulatory requirements surrounding this field of software development.
Startups should understand how each cloud service provider approaches disaster recovery. Entrepreneurs should also review how often the providers undergo audits or certifications from the ISO or SOC, which review their quality systems against industry standards.
Most reputable cloud hosting providers, Microsoft™ for example, will provide its users with documentation that demonstrate the controls that they have in place to satisfy the requirements set forth by the regulatory agencies. These providers can also provide regulatory authorities statements of compliance when their cloud satisfies the regulatory requirements for data integrity, disaster recovery, validation, and more.
When Should Startups Begin to Think About Regulations?
Key Takeaway: Life science software product regulations should be thought about early on in the development process. Startups are able to begin designing and developing their software product without the help of a regulatory consultant early on, however, one should be consulted prior to commercialization.
Founders should begin to think about regulations early on in the design and development. By keeping key regulation concepts in mind, they will be able to design and develop a software product that is suitable for use within the life science industry.
Startups are able to begin the design and development process early on without the help of a regulatory consultant. Development work should not need to be repeated as long as startups follow proper documentation, protocols, guidances and do some preliminary regulatory research themselves. Any questions or uncertainties that come up during this research phase should be clarified by consulting experts. Hiring an expert for a few hours here and there is a lot cheaper than having to redo large parts of software development.
Beware, there are regulations in place that force startups to start paying attention a lot earlier than they may have anticipated. An example of one is for medical devices where you have to maintain a log of the design and development history, which is used to track any flaws that are introduced into the system. Do your homework to ensure you aren’t missing some of these ‘early requirements’. Whether that means hiring someone, or doing detailed research yourself.
Should Your Starup Hire a Regulatory Consultant?
Key Takeaway: Hiring a regulatory consultant is an expense that many early stage startups are unable to afford. Startups should consult with a regulatory consultant part way through the development process to ensure that your startup is on the right path. Some consultants may offer a ‘free sample’ before you commit to engaging them formally. However, beware of ‘you get what you pay for’.
Most likely you or a member of your startup is not an expert in the field of regulations for life science software products. As a result, hiring a regulatory consultant, who has this knowledge and experience, is a good idea. Hiring a consultant, however, is timing dependent.
Many regulatory consultants offer a half an hour to an hour of free advice to help provide information about the general concepts that your startup should be aware of. The consultant, however, will not be able to provide you all the information regarding every regulatory agency in the world, and you probably will not understand it anyway. Consultants can be focused on specific areas of expertise. You need to hire the right consultant at the right time, for the right purpose.
Thinking About Regulations Prior to Hiring a Consultant
Key Takeaway: Prior to hiring a regulatory consultant, startups are able to begin to take the required steps themselves to ensure compliance. These steps include having clear documentation in place, as well as attending courses regarding privacy and security to ensure that their team is developing a software product that follows current regulations.
To anticipate these regulatory hurdles, startups should keep clear documentation in place throughout the entire design and development process to ensure that they think about regulations early and have a quality mindset in place.
One example of clear documentation is the creation of a system description document that is produced and maintained for software products hosting on-premise or on the cloud. The scope of this document varies; however, its overall purpose is to identify the main system functionality, its regulatory impact, system architecture, and the main computing components. The document should also cover how access if given to the system, the security features employed, as well as the types or electronic records and associated signatures that are created and managed within the system.
Startups can also take online courses, such as those offered by the Privacy by Design Centre of Excellence, to learn about certain regulations if your startup is at the conceptual stage. That way your startup does not have to backtrack because they did not think of complying with regulation early on.
Conclusion
Due to the constantly evolving nature of technology and how humans interact with it, the regulations that focus on software products for the life science industry are extremely important. These regulations are in place to ensure that the privacy and security of these software product’s users’ data are maintained.
Startups should conduct regulatory research and preparation themselves before they hire a costly regulatory consultant. Startup founders should educate themselves on life science software regulations, as well as utilize good documentation practices throughout the design and development process to ensure that the product is being developed by the regulations in mind without even having to include formal expertise.
Founders should keep up to date on all the changing regulations to ensure that their technology, which is most likely cutting edge, properly adheres to the applicable regulations. These regulations were put in place for a reason, to protect all users. Ensure your software product follows these regulations to ensure that you product can become adopted, rather than being unable to enter the market.
Lessons Learned
Congratulations! You have now learned about how to go about understanding and navigating the regulations surrounding developing a life science software product. After reading this article you should have learned the following key concepts:
- Regulators are continuously trying to keep up with the technological changes impacting the life science industry
- Software products within the life science industry are focusing on patient-centric smart tools and devices to allow for patients to better monitor their own health, and allow for increased collaboration between users and physicians
- There has been a switch within the life science industry where medical devices no longer are solely hardware devices, but rather software products as well
- Hosting a life science software product on the cloud requires startups to follow more regulations. This is because of the increase security concerns surrounding the cloud
- Startups should begin to think about following regulations by having clear documentation protocols in place to ensure that all design and development decisions are thoroughly documented
- Hiring specialized regulatory consultants at the right time may be critical to saving a lot of money and time in the long run
