We all know that some health software products need to be certified as a Medical Device in certain circumstances. But can a customer or potential customer demand that a manufacturer applies a CE Mark? Is it appropriate to say, ‘I’m only going to buy your software product if it’s certified as a Medical Device’. The answer, as is so often the case, is maybe.

[Note that for brevity, I’m going to use the term CE Mark to mean both the EU CE Mark and the UKCA Mark in this article].

A product needs to be CE Marked if its Intended Use meets the definition of a Medical Device. Intended Use depends on the functionality provided by a software product, how the manufacturer describes that functionality and the medical claims made. Yes, there are plenty of grey areas but with the right guidance clarity can be achieved.

Where a healthcare organisation has a problem to solve which can only be met by a Medical Device then it is perfectly reasonable and proper to state that only CE Marked products will be considered. However, in recent times, Safehand has encountered a number of situations where a procuring healthcare organisation has stipulated Medical Device certification as a requirement despite the fact that a Medical Device was not required for the need to be met.

So why might this situation arise? Software development has a relatively low barrier to entry and software products vary enormously in their ability to solve a particular customer’s needs. It’s not uncommon for organisations looking to procure software systems to call upon quality standards and measures as a means of validating the integrity of a particular product or manufacturer. For example, all software systems are potentially susceptible to penetration by hackers. Compliance with standards such as ISO 27001 goes some way to putting appropriate safeguards in place. Certification advertises to potential customers that information security is important to the manufacturer and that extensive work has been undertaken in this regard.

But Medical Device regulation is a bit different. A software product can (and must) only be certified as a Medical Device if its Intended Use qualifies it as such. Indeed, the CE Marking of a product which doesn’t qualify as a Medical Device is unlawful and a manufacturer could face criminal prosecution in these circumstances. It is feasible, and indeed Safehand have observed circumstances, where the NHS has excluded a manufacturer from a procurement because it didn’t meet their ‘quality measures’ – even though the problem being solved didn’t warrant the proposed product being certified as a Medical Device.

It's a bit like this:

  • House buyer: I’d like to buy the city-centre apartment you have for sale
  • Estate agent: Great.
  • House buyer:… but I want it to be Grade II listed.
  • Estate agent: But it’s not a listed building
  • House buyer: Yes, but I stayed in a Grade II listed building in Cornwall last year. It had lovely oak beams and a roaring fireplace and it felt all cosy - so I want it to be Grade II listed.
  • Estate agent: ???

Whilst a Medical Device is indeed likely to have been manufactured in a quality-managed environment, to ask manufacturers to demonstrate ‘quality’ by achieving Medical Device certification is short-sighted.

So, our take-away messages are:

  • Suppliers must certify their products as a Medical Device where the Intended Use brings them in scope of Medical Device law.
  • Those healthcare organisations procuring systems should ensure they take the time to understand the law and specify requirements which are fitting and appropriate to the circumstances and Intended Use of the product