Software Pirates

Congress never gave the FDA power to control medical practice. But the agency seized it anyway--by regulating software and computers.

Alexander Volokh from the November 1997 issue

(Page 2 of 3)

Software developers also feel the costs of FDA regulation. Frank Houston, a software validation consultant with Taratec Development Corp. in Bridgewater, New Jersey, tells the story of a company "who shall remain nameless" that sells software to keep copies of medical images for insurance purposes. Insurance adjusters use the pictures when deciding whether a claim was justified, but because an X-ray scanned into the computer isn't as good as the original X-ray, doctors are advised not to use the computer images to diagnose disease. In fact, the software constantly displays on the screen, "Not approved for diagnostic use." After about two hours of telephone calls to various parts of the FDA, Houston and the company decided the program might qualify to escape regulation. But the gray areas of device regulation are large enough that they decided they'd better file for FDA clearance anyway. The manufacturer spent weeks preparing the documentation, and the FDA has been sitting on it for a year. All this "for a product," says Houston, "that, in the end, lacks any significant risk to health. Something's wrong with this picture."

All this should have been expected. Software, unlike most physical devices, evolves rapidly and is sometimes changed daily, according to the user's needs. The FDA, on the other hand, takes its time. It began talking about software regulation in 1985. The first written draft policy came out in 1987 and was revised in 1989. Once the guidelines were finally out, the floodgates did not open; the approval process is inherently unsympathetic to quick innovation. The most routine form of FDA approval for low-risk devices is called the "510(k)" or "premarket notification," and it is reserved for products that are "substantially equivalent" to those already on the market. Imagine telling a
software developer that to be easily introduced into the U.S. marketplace, its product had better be the same as or based on an existing program. "It's patently obvious that any agency that requires congressional approval is not going to move faster than market-driven technologies," says Avrohom Gluck of Neuromedical Systems, a Pap smear screening device company in Suffern, New York. "The agency has been, and still is, severely handicapped in that they need to regulate in the face of many in both government and industry who understand neither the technology nor the quality systems needed to ensure public safety."

It doesn't help that software is not like drugs or even like most traditional devices. Drugs are approved for "safety and efficacy" in treating particular diseases. But this is less true for devices, and much less true for software, which is often used for many different tasks. Nancy George, of Software Quality Management, a Towson, Maryland-based consulting firm that assists companies with regulatory compliance, describes a device that lets patients do their own testing at home, collects and transmits data 24 hours a day, makes video home visits, generates hospital-like charts, and even teaches the patient. "It does everything but serve coffee," George explained to the FDA. "Is it record keeping? Is it training? Is it telemedicine? Is it critical?" Concludes Harry Burke, the New York Medical College professor, "Really, what we've got is a can of worms. I mean, it could get really dicey here if we're not careful."

Because software evolves rapidly and has 1,001 different uses, it is particularly easy to stifle through regulations that are just a bit too inflexible. And because software changes constantly, it is never perfect, though it is often vastly superior to the manual, paper-based processes it is meant to replace. Imperfection has never sat well with the FDA, which gets a great deal of bad publicity if something it approves hurts someone but none at all if someone dies because of regulatory delay. Accordingly, the FDA dreams, in the words of T.S. Eliot, "of systems so perfect that no one will need to be good."

After 12 years of software regulation, the FDA admits that its efforts have "not been completely successful." FDA officials have toyed with regulating software differently according to whether it's in source code or executable code. As anyone who knows anything about software could have told them, source code can be easily converted into executable code, so that distinction makes no sense. The FDA has also tried to regulate software differently depending on whether it's distributed for free or for profit. Such a distinction has nothing to do with risk, which is the only conceivable justification for the FDA's existence. The FDA is now trying to reinvent its software regulations. The rules are in flux or, as one NIH conference participant put it, "loosey-goosey."

While software regulation may be loosey-goosey, there are certain constants in the FDA's approach. One of them is the agency's ongoing crusade against "off-label uses" of drugs and devices. Drugs and devices are approved and labeled for particular uses. The FDA doesn't just approve, say, AZT or excimer lasers. It approves AZT for the purpose of treating patients with HIV, or excimer lasers for the purpose of performing certain procedures to correct nearsightedness. Drug companies can advertise and label approved drugs only for approved uses. But once a drug is approved, a doctor can prescribe it for any use, on- or off-label. The FDA hates that. What's the use of demanding clinical trials proving a drug's efficacy in treating a particular condition if a patient can then go and take the drug for a different condition?

The FDA has a long history of fighting off-label use of medicines. When Congress passed the 1938 Food, Drug, and Cosmetic Act, it made it clear that once a drug was approved, consumers could buy it over the counter, with or without a prescription. Disregarding Congress's intent, the FDA carved out a category of drugs that are available only by prescription, and it tried to limit doctors' ability to prescribe drugs for uses not approved by the agency. In 1951 Congress upheld the prescription-only rules but reaffirmed that the FDA couldn't control what doctors prescribe. Even in 1962, when the FDA was given sweeping new powers over drugs, Congress stressed that the agency could control consumers and manufacturers but not doctors.

Congress attacked the FDA anyway in 1971 for not doing more to protect consumers from off-label uses of prescription drugs. In 1972, the FDA proposed criminalizing off-label prescriptions. The FDA's creative theory was that prescribing a drug for unapproved uses adds to the drug's "label"--a metaphysical construct that goes beyond the paper wrapped around the bottle--and since the new "label" has no instructions for the new use, the drug is then "misbranded." And naturally, there's no way to fix the (real) label to reflect the new use, since only FDA-approved information can go there. Doctors protested, arguing that off-label prescription is fundamental to sound medical practice. The FDA backed down. To this day, once a drug is approved, it is up to the doctor and patient to use it properly.

Excimer lasers are now caught in the off-label controversy. They have been approved for phototherapeutic keratectomy (PTK), which is used to treat diseased, scarred corneas. They have also been approved for photorefractive keratectomy (PRK), but only to treat certain degrees of nearsightedness and some forms of astigmatism. In other countries, the best refractive surgeons use PRK to treat farsightedness and a wider variety of astigmatisms. These surgeons also use excimer lasers to perform a procedure called LASIK (laser-assisted in situ keratomileusis), which is essentially the same as PRK but performed inside the cornea instead of on the surface. Many surgeons prefer LASIK to surface PRK because it can lead to less regression and scarring. The FDA only recently (in July 1997) gave its final, conditional approval to LASIK.

If excimer lasers were drugs, doctors would not care that these other uses were not approved. They would simply buy the drug and use it for whatever purpose they thought best. But excimer lasers are not drugs. They are devices that include software, and the software itself is considered a device. John Calfee, an economist at the American Enterprise Institute, explains the implications: "Imagine that the oncologist using a combination drug therapy uses a computer-controlled device to administer the drugs. Suppose the computer software determines all dosages, and does so according to settings provided by the physician. Now suppose that when the FDA approves the drug-administration device for marketing, it also approves the software in every detail. If the FDA forbids physicians or others from reprogramming the device, it could effectively tell doctors how to administer the drug and could even exercise considerable control over which kinds of patients receive the drug and even which illnesses are treated."

Consider how this sort of thing happens with excimer lasers. Only two companies are approved to sell excimer lasers in the United States: Summit Technology of Waltham, Massachusetts, and VISX of Santa Clara, California. When the FDA approved Summit's and VISX's excimer lasers, it mandated that the machines be activated by a keycard, available from the companies, that allows only approved software to be loaded. These keycards, which cannot be used more than once, cost $250 per operation and are available only from the laser manufacturers. The $250 royalty goes to a company called Pillar Point Partners, which is owned by Summit and VISX. In effect, the FDA has not only established a duopoly, in which Summit and VISX are the only companies allowed to manufacture excimer lasers, but has also enshrined a royalty payment system as part of the approved laser design. Some suspect the FDA is in the pockets of the laser manufacturers, but the FDA's explanation is also plausible: This is a convenient way to restrict the software that can be used with the lasers. As long as correction of nearsightedness and some forms of astigmatism are the only approved uses for the laser, the keycards will allow you to load software only for those procedures.

The FDA claims this is not regulation of medical practice. Using an approved device for an unapproved use is medical practice, but using an unapproved device is just illegal, and always has been under the FDA's device approval authority. The laser-plus-nearsightedness-software is an approved device; the laser-plus-farsightedness-software is an unapproved device. FDA software restrictions, therefore, are entirely appropriate. Says FDA spokeswoman Sharon Snider, "If a product can't be used any other way because that's all the software is programmed for, that's all [the doctors] can use it for. That has nothing to do with FDA restricting the practice of medicine."

Nothing to do with restricting the practice of medicine? Only if you're fixated on technical definitions. Regulating the choices of medical practitioners means restricting the practice of medicine, whether it's called "off-label use" or "using an approved laser with unapproved software." The software, by FDA approval, sets the treatment area at a diameter of six millimeters, though this may not be the best size for all patients. Also by FDA approval, the software will not allow a doctor to change the curvature of the eye by more than six diopters, a limit that would exclude people with the worst cases of nearsightedness. This is not restricting the practice of medicine?

Imaginative doctors can get around some of the restrictions. Operating on eyes with the LASIK procedure was possible (but far from ideal) before LASIK was approved, though companies couldn't advertise that fact and doctors couldn't load LASIK software into the laser. Also, it's possible to change the curvature of the eye by more than six diopters by running the program twice, though this, too, is not ideal: It costs twice as much, since it requires two keycards, and the patient has to sit there with an exposed eye while the machine is configured a second time.

But even the most imaginative doctor's options are limited by the available software. Treating farsightedness, for example, is extremely difficult, though not unheard of. "I think you have to be a pretty brave, committed soul to do some of these new and innovative things, what with the FDA looking over one shoulder and the plaintiffs' attorneys looking over the other," says Trevor Woodhams. Dr. Stephen Trokel, who spoke to an FDA panel in July 1996 on behalf of the American Society of Cataract and Refractive Surgery, reported that "the current micromanagement by the FDA of innovations in refractive surgical technology encourages `offshore' investigations, encourages the movement of patients to foreign surgical centers, encourages the proliferation of unregistered, noncommercial, and totally unregulated lasers, and, most importantly, encourages the development of combination surgery where arcane and untested, imaginative mixtures of surgical techniques are created to overcome FDA labeling."