DIGITAL THERAPEUTICS AND SOFTWARE AS A MEDICAL DEVICE (SaMD)

DETAILED EXPLANATION WITH CASE LAWS

1. INTRODUCTION

Digital Therapeutics (DTx) and Software as a Medical Device (SaMD) are important developments in modern healthcare law. They involve the use of software, mobile applications, artificial intelligence, and digital platforms for the prevention, diagnosis, treatment, monitoring, and management of diseases.

Digital therapeutics are evidence-based therapeutic interventions delivered through software to prevent, manage, or treat medical conditions. Examples include applications for insomnia, diabetes management, substance-use disorders, and certain mental health conditions.

Software as a Medical Device refers to software intended to perform medical purposes independently of a physical medical device. Examples include software that analyses medical images, detects cardiac abnormalities, or calculates disease risks.

The principal objective of regulating these technologies is to ensure patient safety, clinical effectiveness, data protection, transparency, and accountability while encouraging technological innovation.

2. MEANING AND DEFINITION

A. Digital Therapeutics (DTx)

Digital therapeutics are software-based interventions that deliver therapeutic benefits through scientifically supported programmes. They may use cognitive behavioural therapy, behavioural modification, personalised feedback, and structured treatment protocols.

The main characteristics of digital therapeutics are:

Delivery of therapeutic interventions through software.

Scientific evidence supporting therapeutic claims.

Monitoring of patient progress and treatment outcomes.

Personalised interventions based on patient information.

Compliance with applicable healthcare and medical-device regulations.

B. Software as a Medical Device (SaMD)

SaMD is software intended for one or more medical purposes that performs those purposes without being part of a hardware medical device.

Examples include diagnostic software, medical-image analysis applications, disease-risk prediction systems, and certain digital treatment applications.

Not every health application qualifies as a medical device. Fitness trackers, general wellness applications, and appointment-booking software may fall outside medical-device regulation depending on their intended purpose and functionality.

3. DIFFERENCE BETWEEN DIGITAL THERAPEUTICS AND SaMD

Digital therapeutics primarily deliver therapeutic interventions, whereas SaMD is a broader category covering software performing medical functions such as diagnosis, monitoring, prediction, and treatment.

Digital therapeutics may qualify as SaMD, but not every SaMD product is a digital therapeutic.

4. LEGAL AND REGULATORY FRAMEWORK

A. Regulation in India

The principal legal framework includes the Drugs and Cosmetics Act, 1940, and the Medical Devices Rules, 2017, together with applicable amendments and regulatory notifications.

Software intended for a medical purpose may fall within the definition of a medical device depending on its intended use, functionality, claims, and applicable classification.

Important regulatory requirements may include:

Risk-based medical-device classification.

Applicable registration, licensing, or import permissions.

Quality-management requirements.

Clinical investigation or performance evaluation, where required.

Safety, performance, labelling, and post-market surveillance.

Adverse-event reporting and corrective action where applicable.

The Digital Personal Data Protection Act, 2023, and other applicable privacy and information-security laws may also be relevant to patient-data processing, subject to their commencement, scope, and applicable rules.

B. Regulation in the United States

The United States Food and Drug Administration (FDA) regulates qualifying medical software under the Federal Food, Drug, and Cosmetic Act and relevant regulatory guidance.

The applicable regulatory pathway depends on the intended medical purpose and level of risk. Some low-risk software functions may fall outside active FDA oversight, while other products may require premarket notification or premarket approval.

C. Regulation in the European Union

The Medical Device Regulation (EU) 2017/745 governs qualifying medical devices, including medical software. Rule 11 of Annex VIII is particularly important for software classification.

The General Data Protection Regulation (GDPR) may also apply when personal and health data are processed.

5. CLINICAL VALIDATION AND EVIDENCE REQUIREMENTS

Digital therapeutics and SaMD must be supported by evidence appropriate to their intended medical purpose and associated risks.

The major requirements are:

Clinical validity: The software must reliably measure or predict what it claims to measure or predict.

Clinical utility: Therapeutic claims should be supported by evidence of meaningful clinical benefits.

Technical validation: The software must be tested for accuracy, reliability, interoperability, and foreseeable failures.

Human factors testing: The interface should minimise errors arising from misunderstanding or incorrect data entry.

Algorithmic validation: AI-based systems should be assessed for bias and performance across relevant patient populations.

Post-market monitoring: Manufacturers should monitor malfunctions, cybersecurity risks, adverse events, and performance after deployment.

Popularity, downloads, and positive user reviews do not by themselves establish clinical effectiveness.

6. PATIENT RIGHTS AND DATA PROTECTION

Digital therapeutics may process sensitive information, including medical histories, mental-health records, medication information, and biometric measurements.

The main legal concerns are:

Informed consent: Patients should understand the intervention and its limitations.

Privacy: Patient information must be processed according to applicable data-protection laws.

Data security: Encryption, access controls, and secure updates should be implemented where appropriate.

Transparency: Patients should receive appropriate information about the software's capabilities and limitations.

Human oversight: Automated recommendations should not replace professional judgement where clinical circumstances require it.

Accountability: Developers, manufacturers, distributors, and healthcare providers may have different responsibilities under applicable law.

A disclaimer describing an application as informational does not automatically exempt it from medical-device regulation if its intended purpose and functionality fall within the relevant legal definition.

7. LIABILITY FOR DEFECTIVE DIGITAL THERAPEUTICS

Liability may arise when defective software, inadequate warnings, misleading claims, or negligent deployment causes harm.

A. Product liability: A manufacturer may face liability for defective design, manufacturing defects, or inadequate warnings under applicable law.

B. Negligence: A developer or healthcare provider may be liable where a duty of care is breached and the breach causes foreseeable injury.

C. Misrepresentation: Unsupported claims about therapeutic effectiveness may attract consumer-protection or advertising-law consequences.

D. Cybersecurity failures: Inadequate security may result in privacy claims, regulatory penalties, or liability for patient injury.

E. AI-related errors: Incorrect treatment recommendations or risk assessments may raise questions concerning validation, clinical supervision, and allocation of responsibility.

The applicable cause of action depends on the jurisdiction and the facts of the case.

8. IMPORTANT CASE LAWS

1. Riegel v. Medtronic, Inc., 552 U.S. 312 (2008)

Facts: The case concerned injuries allegedly caused by a medical balloon catheter that had received FDA premarket approval.

Judgment: The United States Supreme Court held that certain state-law requirements imposing requirements different from or additional to applicable federal requirements for the relevant Class III device were pre-empted.

Legal Principle: Medical-device regulation may limit certain state-law claims where federal pre-emption applies.

Relevance: The case is relevant by analogy to liability involving high-risk medical software subject to FDA premarket approval.

2. Medtronic, Inc. v. Lohr, 518 U.S. 470 (1996)

Facts: The case involved an allegedly defective pacemaker lead and the effect of federal medical-device regulation on state-law claims.

Judgment: The Supreme Court held that the relevant claims were not pre-empted in the circumstances of the case.

Legal Principle: The regulatory pathway and the nature of federal requirements are important when determining whether state-law claims are pre-empted.

Relevance: The judgment assists in analysing liability involving medical software regulated through different FDA pathways.

3. Buckman Co. v. Plaintiffs' Legal Committee, 531 U.S. 341 (2001)

Facts: Plaintiffs alleged that a consulting company had made fraudulent representations to the FDA concerning medical devices.

Judgment: The Supreme Court held that the relevant fraud-on-the-FDA claims were impliedly pre-empted by federal law.

Legal Principle: Certain claims based specifically on alleged violations of federal regulatory duties may be pre-empted.

Relevance: The case illustrates the distinction between regulatory non-compliance and independently actionable injury claims involving digital medical products.

4. Wyeth v. Levine, 555 U.S. 555 (2009)

Facts: A patient suffered serious injury after a medication was administered using an allegedly unsafe method. The dispute concerned the adequacy of warnings.

Judgment: The Supreme Court held that the state-law failure-to-warn claim was not pre-empted in the circumstances presented.

Legal Principle: Regulatory approval does not necessarily eliminate all state-law duties concerning adequate warnings.

Relevance: Medical-software manufacturers may need to provide appropriate warnings about limitations, foreseeable risks, false positives, and false negatives.

5. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1

Facts: The case concerned whether privacy is protected as a fundamental right under the Constitution of India.

Judgment: A nine-judge bench of the Supreme Court of India unanimously recognised privacy as a fundamental right.

Legal Principle: Privacy, dignity, autonomy, and informational self-determination receive constitutional protection.

Relevance: The judgment is important when analysing patient-data protection and privacy in digital healthcare systems.

6. Samira Kohli v. Dr. Prabha Manchanda, (2008) 2 SCC 1

Facts: The case concerned medical consent and treatment undertaken beyond the scope of consent given by a patient.

Judgment: The Supreme Court explained the requirements of valid informed consent in medical treatment.

Legal Principle: Consent must be genuine and informed, subject to recognised exceptions.

Relevance: The principles are relevant by analogy to digital therapeutic programmes involving patient treatment, data collection, and AI-supported interventions.

7. Indian Medical Association v. V.P. Shantha, (1995) 6 SCC 651

Facts: The case considered whether medical services fall within the scope of consumer-protection law.

Judgment: The Supreme Court clarified when medical services constitute services under consumer-protection legislation.

Legal Principle: Medical services may attract consumer-protection remedies where the applicable legal requirements are satisfied.

Relevance: The case assists in analysing complaints involving deficient digital healthcare services, depending on the facts and applicable law.

8. Spring Meadows Hospital v. Harjol Ahluwalia, (1998) 4 SCC 39

Facts: The case concerned serious injury to a child following negligent medical treatment.

Judgment: The Supreme Court addressed medical negligence and consumer remedies in the circumstances of the case.

Legal Principle: Healthcare providers and institutions may be held accountable for negligent treatment causing injury.

Relevance: The judgment is relevant by analogy where hospitals or clinicians rely on digital decision-support software. A software error does not automatically establish negligence.

9. Federal Trade Commission v. Lumos Labs, Inc. (2016)

Facts: The Federal Trade Commission challenged claims that Lumosity brain-training games could improve real-world performance and prevent or delay cognitive decline without adequate scientific substantiation.

Outcome: The company entered into a settlement involving a payment and restrictions on unsupported advertising claims.

Legal Principle: Health-related claims made for digital products must be supported by appropriate scientific evidence.

Relevance: The matter is particularly relevant to digital therapeutics because it demonstrates the risks of exaggerating clinical benefits.

10. Federal Trade Commission v. LearningRx Franchise Corp. (2016)

Facts: The FTC challenged claims concerning the ability of brain-training programmes to improve cognitive performance and health-related outcomes.

Outcome: The defendants agreed to settle the FTC's allegations, including restrictions on certain unsupported claims.

Legal Principle: Promotional claims about therapeutic and cognitive benefits require adequate scientific substantiation.

Relevance: Digital therapeutic developers must ensure that advertising accurately reflects the available clinical evidence.

Note: The last two matters were regulatory enforcement proceedings resolved through settlements, rather than appellate judgments establishing general precedent. The cited judgments concerning medical devices and healthcare provide analogous legal principles; they should not be represented as direct decisions on SaMD unless a case specifically addresses that technology.

9. MAJOR LEGAL CHALLENGES

The principal legal challenges are:

Rapid technological development and frequent software updates.

Artificial intelligence and changing algorithmic performance.

Different regulatory requirements across countries.

Difficulties in demonstrating clinical effectiveness.

Cybersecurity threats and patient-data breaches.

Uncertainty regarding liability among developers, manufacturers, and healthcare providers.

Discrimination and unequal access to digital healthcare.

Misleading therapeutic claims and inadequate patient information.

10. RECOMMENDATIONS FOR EFFECTIVE REGULATION

An effective regulatory framework should:

Establish clear, risk-based classification rules for medical software.

Require suitable clinical evidence before therapeutic claims are made.

Regulate significant software updates and AI model changes.

Strengthen cybersecurity and patient-data protection.

Ensure clear warnings concerning limitations and foreseeable risks.

Establish effective post-market surveillance and adverse-event reporting.

Promote accessibility and interoperability.

Clarify the responsibilities of manufacturers, developers, clinicians, and healthcare institutions.

Encourage international cooperation while preserving patient safety.

11. CONCLUSION

Digital therapeutics and Software as a Medical Device represent a significant transformation in modern healthcare. They can improve access to treatment, support disease management, enable personalised interventions, and assist healthcare professionals in clinical decision-making.

However, their benefits depend on scientific validity, patient safety, reliable software performance, and responsible handling of health information. The judgments in Riegel v. Medtronic, Medtronic v. Lohr, Buckman v. Plaintiffs' Legal Committee, Wyeth v. Levine, K.S. Puttaswamy v. Union of India, and Samira Kohli v. Dr. Prabha Manchanda provide important principles for analysing regulatory compliance, product liability, informed consent, and privacy.

In India, the Medical Devices Rules, 2017, the applicable provisions of the Drugs and Cosmetics Act, 1940, and relevant data-protection and consumer-protection laws form important parts of the regulatory framework.

Ultimately, the objective of digital-health regulation is to balance technological innovation with clinical evidence, patient autonomy, privacy, accountability, and public health. A strong legal framework can help ensure that digital therapeutics and medical software deliver genuine therapeutic value without compromising patient safety and fundamental rights.