University of Pittsburgh logo

Research Involving Device Software Functions and Mobile Applications in Human Subject Research

Contents:

Is the Use of a Device Software Function or Mobile Application in Human Subject Research Subject to FDA Oversight?

Software functions are now integral to healthcare delivery and human subject research. Many medical devices rely on software to function, and these software functions can be deployed across various platforms. When software is used on smartphones, mobile communication devices, or their accessories, it is considered a Mobile Application.

Whether FDA regulations apply a software function depends on its intended use.  A software function may be regulated by the FDA in one context but not in another, even when the software is identical. Additionally, certain functions within a software application may be subject to FDA oversight, while others are not. This determination hinges on whether the software's intended purpose meets the definitions of a Medical Device and whether the software’s failure to function as intended could a risk to the public.

A Mobile Application that meets the definition of a medical device is a Mobile Medical Application. 

What Are the Possible Levels of FDA Oversight?

There are three possible levels of FDA oversight:

  1. No oversight for software functions that are not medical devices
  2. Exercise enforcement discretion for software functions that pose lower risk to the public
  3. Full regulatory oversight for software functions that meet the definition of a medical device and their functionality poses risk to the public if it does not function as intended

The FDA’s website Digital Health Policy Navigator is a helpful tool in determining whether a software function may be subject to FDA oversight.  Note that the results from the Navigator are not formal FDA determinations.

What are the IRB Requirements for Human Subject Research Involving a Software Function?

When a human subject research protocol involves a software function, the PittPRO submission must include sufficient information to demonstrates compliance with the criteria for IRB approval at 45 CFR 46.111 and/or 21 CFR 56.111.

Relevant information to include in PittPRO may include but are not exclusive of:

  1. Name of software function.  Ensure that software information is included in the Electronic Data Management section for Pitt Data Security review.
  2. Intended purpose of the software function
  3. Type of data that will be accessed by and/or stored by the software
  4. Risks associated with the use of the software and any risk mitigation plan for software malfunction if such malfunction may pose risk to participants
  5. Information about the use of the software function and the requirements of its use such as Terms of Use for third party software

When a software function qualifies as a medical device in its use in a human subject research protocol, additional IRB requirements apply, even if the use of the software qualifies for FDA enforcement discretion.  Refer to Guidance on the Use of Investigational Medical Device in Human Subject Research for additional device related requirements.

Resources

FDA: Policy for Device Software Functions and Mobile Medical Applications

FDA: Digital Health Policy Navigator

FDA: Device Software Functions Including Mobile Medical Applications

FDA: Software as a Medical Device (SaMD)

FDA: Clinical Decision Support Software

5/28/2025