Commonwealth Numbered Regulations Commonwealth Numbered RegulationsPart 1 -- Classification rules
Therapeutic Goods (Medical Devices) Regulations 2002
1 Schedule 2 (note to Schedule heading)
Repeal the note, substitute:
Note: Regulation 3.2 provides for the making of classification rules. Regulation 3.3 sets out the principles for applying those rules.
2 At the end of Part 4 of Schedule 2
Add:
(1) A programmed or programmable medical device, or software that is a medical device, that is intended by the manufacturer to be used to:
(a) provide a diagnosis of a disease or condition; or
(b) screen for a disease or condition;
is classified as:
(c) in the case of a disease or condition that:
(i) may lead to the death of a person, or a severe deterioration in the state of a person's health, without urgent treatment; or
(ii) may pose a high risk to public health;
Class III; or
(d) in the case of a serious disease or serious condition or a disease or condition that may pose a moderate risk to public health, and where paragraph (c) does not apply--Class IIb; or
(e) in any other case--Class IIa.
(2) A programmed or programmable medical device, or software that is a medical device, that is intended by the manufacturer to be used to provide information to a relevant health professional for the purposes of the health professional making a diagnosis of a disease or condition:
(a) in the case of a disease or condition that:
(i) may lead to the death of a person, or a severe deterioration in the state of a person's health, without urgent treatment; or
(ii) may pose a high risk to public health;
is classified as Class IIb; or
(b) in the case of a serious disease or serious condition or a disease or condition that may pose a moderate risk to public health, and where paragraph (a) does not apply--is classified as Class IIa; or
(c) in any other case--is classified as Class I.
4.6 Programmed or programmable medical device or software that is a medical device for use for monitoring the state or progression of a disease or condition etc.
A programmed or programmable medical device, or software that is a medical device, that is intended by the manufacturer to be used to provide information that is to be used for monitoring the state or progression of a disease or condition of a person or the parameters in relation to a person:
(a) in the case where the information to be provided could indicate that the person or another person may be in immediate danger or that there may be a high risk to public health--is classified as Class IIb; or
(b) in the case where the information to be provided could indicate that the person or another person may be in other danger or that there may be a moderate risk to public health--is classified as Class IIa; or
(c) in any other case--is classified as Class I.
(1) Subject to subclause (2), a programmed or programmable medical device, or software that is a medical device, that is intended by the manufacturer to be used to specify or recommend a treatment or intervention:
(a) in the case where the absence of the treatment or intervention or where the treatment or intervention itself:
(i) may lead to the death of a person or a severe deterioration in the state of a person's health; or
(ii) may pose a high risk to public health;
is classified as Class III; or
(b) in the case where the absence of the treatment or intervention or where the treatment or intervention itself:
(i) may otherwise be harmful to a person; or
(ii) may pose a moderate risk to public health;
is classified as Class IIb; or
(c) in any other case--is classified as Class IIa.
(2) A programmed or programmable medical device, or software that is a medical device, that is intended by the manufacturer to be used to recommend a treatment or intervention (the recommended treatment or intervention ) to a relevant health professional for the purposes of the health professional making a decision about the treatment or intervention:
(a) in the case where the absence of the recommended treatment or intervention or where the recommended treatment or intervention itself:
(i) may lead to the death of a person or a severe deterioration in the state of a person's health; or
(ii) may pose a high risk to public health;
is classified as Class IIb; or
(b) in the case where the absence of the recommended treatment or intervention or where the recommended treatment or intervention itself:
(i) may otherwise be harmful to a person; or
(ii) may pose a moderate risk to public health;
is classified as Class IIa; or
(c) in any other case--is classified as Class I.
A programmed or programmable medical device, or software that is a medical device, that is intended by the manufacturer to provide therapy to a person through the provision of information to the person:
(a) in the case of therapy that may result in the death of the person or a severe deterioration in the state of the person's health--is classified as Class III; or
(b) in the case of therapy that may cause serious harm to the person and where paragraph (a) does not apply--is classified as Class IIb; or
(c) in the case of therapy that may cause harm to the person and where neither paragraph (a) nor (b) applies--is classified as Class IIa; or
(d) in any other case--is classified as Class I.
3 Schedule 2A (note to Schedule heading)
Repeal the note, substitute:
Note: Regulation 3.2 provides for the making of classification rules. Regulation 3.3 sets out the principles for applying those rules.
4 Dictionary (at the end of the definition of active medical device )
Add:
Software that is a medical device is an active medical device .
Part 2 -- Essential principles
Therapeutic Goods (Medical Devices) Regulations 2002
5 Clause 12.1 of Schedule 1
Repeal the clause, substitute:
12.1 Programmed or programmable medical device or software that is a medical device
(1) A programmed or programmable medical device, or software that is a medical device, that is intended to make use of either or both of data and information must be designed and produced in a way that ensures that:
(a) the safety, performance, reliability, accuracy, precision, useability, security and repeatability of the device are appropriate for the intended purpose of the device; and
(b) any consequent risks, or impairment of performance, associated with one or more fault conditions is eliminated or appropriately reduced; and
(c) the device is resilient with respect to interactions that could occur during the use of the device and that could result in unsafe performance of the device; and
(d) if relevant to the safety of a patient, or the safety and health of the user or any other person, the device provides suitable warnings in a timely manner:
(i) following the disruption to services upon which the device is dependent for the device's operation; and
(ii) following the performance of the device being adversely affected; and
(e) if relevant to the safety of a patient, or the safety and health of the user or any other person, the device provides a means by which the user can verify correct operation of the device; and
(f) if relevant to the safety of a patient, or the safety and health of the user or any other person, the integrity and quality of the data or information is maintained; and
(g) if relevant, the privacy of the data or information is maintained.
(2) A programmed or programmable medical device, or software that is a medical device, must be developed, produced and maintained having regard to the generally acknowledged state of the art (including for design, development life cycle, development environment, version control, quality and risk management, security, verification and validation, change and configuration management and problem resolution).
(3) A programmed or programmable medical device, or software that is a medical device, that is intended to be used in combination with computing platforms must be designed and developed taking into account the capability, resources and configuration of the platforms and the external factors (including information technology environments) related to the use of the platforms.
(4) The manufacturer of a programmed or programmable medical device, or software that is a medical device, must provide instructions or information with the device that sets out requirements (including requirements about hardware, software, information technology environments and security measures) necessary to operate the device as intended.
(5) A programmed or programmable medical device, or software that is a medical device, must be designed, produced and maintained with regard to best practice in relation to software, security and engineering to provide cybersecurity of the device, including where appropriate the following:
(a) protection against unauthorised access, unauthorised influence or unauthorised manipulation;
(b) minimisation of risks associated with known cybersecurity vulnerabilities (including either or both of remediation of known vulnerabilities and application of compensating controls);
(c) facilitation of the application of updates, patches, compensating controls and other improvements;
(d) disclosure of known vulnerabilities in the device or its components and associated mitigations;
(e) making available sufficient information for a user to make decisions with respect to the safety of applying, or not applying, updates, patches, compensating controls and other improvements.
(6) The manufacturer of a programmed or programmable medical device, or software that is a medical device, having regard to the intended purpose of the device, the generally acknowledged state of the art and best practice, must ensure that the data that influences the performance of the device is:
(a) representative; and
(b) of sufficient quality; and
(c) maintained to ensure integrity; and
(d) managed to reduce bias.
6 Subclause 13.2(3) of Schedule 1
Repeal the subclause, substitute:
(3) If it is not practicable to comply with subclause (1) or (2) in relation to the provision of the information required under subregulation 10.2(1) or clause 13.3:
(a) for a medical device that is not software--the information must be provided on a leaflet supplied with the device; or
(b) for a medical device that is software--the information must be provided on a leaflet supplied with the device or the information must be provided electronically.
7 After clause 13A.4 of Schedule 1
Insert:
13B Software--version numbers and build numbers
(1) For a medical device that is software, or that incorporates software, the current version number and current build number of the software must be accessible by, and identifiable to, users of the device.
(2) The current version number and current build number of the software:
(a) must be in English; and
(b) may also be in any other language.