The Regulatory Headwinds Facing Lab-Developed Tests
In this Law360 article, partners Kate Hardey and Tasha Gerasimow and associate Caitlin Kierum discuss key areas of concern and possible impacts from the U.S. Food and Drug Administration's final rule regarding laboratory-developed tests (LDTs), including cybersecurity vulnerabilities and product labeling, and important compliance steps companies with LDTs and research use only (RUO) products in their portfolio should consider.
On May 6, the U.S. Food and Drug Administration published its final rule regarding laboratory-developed tests, which modified the FDA's previous policy of exercising enforcement discretion toward LDTs.[1]
This rule makes clear that the agency views LDTs as in vitro diagnostic products and will regulate them as such. Under the final rule, the FDA will end its enforcement discretion in stages over the next four years, ultimately requiring LDT manufacturers to comply with regulatory provisions and the approval framework applicable to IVDs.
As anticipated by many in the industry, the issuance of the final rule has garnered pushback, including recently filed litigation challenging the validity of the rule and its enforcement.
Although legal challenges to the final rule are ongoing, entities manufacturing LDTs and other types of IVDs — such as products that are currently marketed as "research use only," or RUO[2] — should nonetheless review their current portfolio, assess compliance with FDA requirements and evaluate any steps necessary to bring their products into compliance.
In this article we discuss some of the key areas that the FDA has indicated are concerning, including cybersecurity vulnerabilities and product labeling, and discuss important compliance steps companies with LDTs and RUO products in their portfolio should consider.
The Shifting Regulatory Landscape
LDTs are diagnostic tests that are developed by a laboratory for the laboratory's own use, e.g., mass spectrometry drug tests, genetic tests and chemistry tests performed on a body fluid other than blood.
When the term LDT was first coined, LDTs were primarily made manually and in small batches and, as such, were of lower concern to the FDA.
Due to advancements in technology and increased automation, the FDA has suggested that there is an increased need for more regulatory scrutiny, as LDTs have progressed from singular tests performed at local or hospital-based laboratories for specific patients — often with rare diseases — to high-volume tests run for large and diverse populations, performed on complex instruments and are used to diagnose serious medical conditions such as heart disease.[3]
Particularly, the FDA has expressed concerns over the quality control, safety and efficacy of LDTs, which are becoming increasingly complex, as well as public health concerns regarding reliance on these tests for accurately diagnosing patients.
Stemming from these concerns, the FDA amended its regulatory definition of "in vitro diagnostic products" to explicitly include products even when the manufacturer is a laboratory.[4]
Effectively, this means that LDTs will now be regulated as devices in the same manner as other IVDs, putting an end to the era of the FDA's general enforcement discretion.
Beginning May 6, the FDA began its four-year phaseout period of its enforcement discretion, pursuant to the final rule. By May 2028, the FDA expects most LDT manufacturers, subject to certain exceptions, to comply with regulatory requirements for IVDs, including quality system, medical device reporting and premarket review requirements, depending on the product.
The FDA has started to actively engage with the industry to help entities manufacturing LDTs understand the applicability and effects of this notable shift in enforcement posture, product clearance and approval requirements.
On June 25, the FDA released a guidance document, which covers the final rule, expectations for the phaseout period, and critical aspects of IVD regulations and requirements.[5]
Additionally, the guidance alludes to other areas of the FDA's regulatory interest — in particular, cybersecurity and RUO labeling of products, each of which are discussed more fully below.
Because many LDTs rely on complex software and highly technical instrumentation, the guidance acknowledges that LDTs are not immune to technology issues, cybersecurity incidents and threat actor attacks, which are currently on the rise across various sectors and industries.
As IVDs advance and become more reliant on sophisticated technology, these products will continue to collect and store sensitive consumer data, e.g., genetic or other health information, that could be accessed, manipulated, lost or stolen — especially if the manufacturers are not taking proper precautionary and protective measures from a privacy and cybersecurity perspective.
Following an amendment to the Food, Drug and Cosmetic Act, under Section 542B of the FDCA, products that meet the definition of a "cyber device"[6] are subject to additional cybersecurity requirements as a part of the premarket submission process, as well as certain post-market management and monitoring.
While these requirements apply to many modern medical devices, given the FDA's historical enforcement discretion, their application to LDTs was not explicit and may be an area where current LDT manufacturers need to take affirmative steps to comport with the FDA's treatment of IVDs, consistent with the final rule.
For example, the guidance highlights that processes are in place for medical device manufacturers, including the premarket review and medical device reporting, to ensure that cybersecurity issues are addressed. The FDA states that, by no longer exercising enforcement discretion toward LDTs, it will be able to better assist current LDT manufacturers with maintaining more robust cybersecurity standards given the heightened oversight and requirements.
The guidance also briefly mentions RUO products in the context of cybersecurity issues. Beyond just cybersecurity, however, the FDA's skepticism with misuse of RUO with products more generally has increased, as the RUO designation allows for exemption, which was used by some device manufacturers, from many of the FDA regulations for IVDs.
The reference to RUO in LDT guidance, along with recent enforcement activity, suggests heightened FDA interest and enforcement in the medical device space.
For example, in a March warning letter to Agena Bioscience Inc.,[7] a genetic laboratory testing company, the FDA requested that the company cease certain activities that were leading to misbranded or adulterated devices, including the misuse of the RUO designation on an IVD.
According to the FDA, the company had labeled certain products as RUO, but was simultaneously selling to both research and clinical diagnostic companies in a way that suggested the product was effective for diagnostic purposes and could be used in clinical diagnostic settings, rather than just in investigative, research settings.
Although the products at issue in this warning letter were not considered LDTs, the FDA's active focus on the use of RUO and its application only to uses that are investigative rather than diagnostic, in conjunction with the decline of the FDA's enforcement discretion for many LDTs, suggests the potential for a new era in the FDA's engagement with medical device manufacturers and their products, whether that comes in the form of enforcement on products previously considered LDTs or those improperly utilizing the RUO designation.
Recent FDA activity may signal that additional scrutiny and enforcement for RUO products is still to come.
Ongoing Challenges to the Final Rule
As expected, litigation has ensued over the FDA's new requirements for LDTs. The American Clinical Laboratory Association and HealthTrackRx Inc. have challenged the FDA's new interpretation of "in vitro diagnostic products," in American Clinical Laboratory Associaiton v. FDA in the U.S. District Court for the Eastern District of Texas, filed on May 29.[8]
The plaintiffs argue that LDTs are services because they are tools used by trained laboratory professionals to carry out a service. Because the FDCA gives the FDA authority to regulate devices, not services, the plaintiffs believe the FDA is exceeding their current authority and the ability for the FDA to increase their authority to regulate LDTs as devices would require additional legislation from Congress.
The plaintiffs also argue that it was not Congress' intention to give the FDA authority to regulate LDTs under the FDCA, because Congress has considered but not passed legislation that would explicitly expand the FDA's authority to cover the regulation of LDTs.[9]
Further, the plaintiffs claim that the Clinical Laboratory Improvement Amendments signified Congress' intent was for Centers for Medicare & Medicaid Services to regulate LDTs as laboratory testing services, and that regulatory framework in the FDA's final rule would be duplicative and unnecessary given the current regulatory oversight from CMS and the requirements for under CLIA.
Though the lawsuit is in early stages, the plaintiffs have requested that the court enter an order vacating the final rule and enjoining the FDA from regulating LDTs as devices under the FDCA, as well as declare that the final rule was in excess of the FDA's authority.
As the FDA continues its phaseout plan over the next four years, the outcome of this lawsuit or other similar lawsuits filed, could lead to uncertainty for manufacturers of LDTs on how or when to devote significant resources into compliance with IVD requirements.
Adjusting to the Regulatory Headwinds
Despite the active legal challenges, entities manufacturing LDTs should begin to evaluate their FDA compliance with a broader view toward the heightened and evolving regulatory regime.
For LDT manufacturers that previously relied on the FDA's enforcement discretion with respect to LDTs, there are likely multiple steps to complete to come into compliance, including changes or development of new policies and revised processes for existing or new tests they wish to introduce to the market.
As noted throughout this article, there are various compliance opportunities and shifting regulatory headwinds from the FDA that LDT manufacturers should consider and take note of, including the following.
Cybersecurity
LDT manufacturers should confirm which products in their portfolio meet the definition of "cyber device" and consider any changes that may be necessary to prepare for compliance with Section 542B of the FDCA.
This may include creating a software bill of materials, designing processes and procedures to ensure systems are secure, and monitoring and mitigating cybersecurity vulnerabilities.
LDTs that rely on software and internet-connected technology should begin to develop or strengthen their products and systems to ensure data is safe and within the FDA's framework cybersecurity.
Research Use Only
Entities manufacturing products labeled as RUO should evaluate whether any product currently labeled as RUO are being sold to or used in nonresearch or diagnostic settings.[10]
Following such review, all labeling and marketing practices should be updated to align with each product's actual use. Such products should be further evaluated to determine whether any premarket notifications or applications to the FDA are required.
Medical Device Reporting
LDT manufacturers should establish a process for receiving and investigating any complaint received related to their products, and create procedures for complying with medical device reporting requirements and initiating recalls appropriately.
Quality System Requirements
LDT manufacturers will need to ensure that their operations, and those of their relevant vendors or suppliers, are compliant with the FDA's current good manufacturing practices, which include quality control requirements.
Conclusion
Barring judicial or congressional intervention, the FDA will expect many LDT manufacturers to comply with regulations applicable to medical devices.
It is important to note that while the final rule does provide for a phaseout period of the FDA's enforcement discretion, the FDA has made clear that it can pursue enforcement action at any time and suggests that it may pursue entities manufacturing LDTs, if appropriate, prior to May 2028.
Although such early enforcement would likely be targeted toward egregious cases, it is certainly recommended that LDT manufacturers proactively assess their current compliance — and prepare for the time and monetary investment needed to come into compliance — in line with the guidance in the final rule and well in advance of the FDA's waning enforcement discretion in this space.
[1] Prior to the final rule, the FDA exercised enforcement discretion for LDTs, meaning the agency did not enforce applicable requirements of the FDCA against LDTs and generally deferred to the regulatory oversight of the Centers for Medicare & Medicaid Services ("CMS").
[2] Research Use Only products are IVD products in the laboratory research phase of development. See 21 U.S.C. § 360j(g).
[3] Food & Drug Admin., Laboratory Developed Tests: Small Entity Compliance Guide (June 25, 2024), https://www.fda.gov/media/179543/download.
[4] 21 C.F.R. § 809.3(a).
[5] Food & Drug Admin., Laboratory Developed Tests: Small Entity Compliance Guide (June 25, 2024), https://www.fda.gov/media/179543/download.
[6] A "cyber device" is a device which can connect to the Internet, includes that is validated, installed, or authorized as a device or in a device, and contains technological characteristics that could be vulnerable to cybersecurity threats.
[7] See FDA Warning Letter (March 21, 2024) (MARCS-CMS 665159) available at https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/agena-bioscience-inc-665159-03212024.
[8] See Am. Clinical Lab'y Ass'n v. U.S. Food & Drug Admin., No: 4:24-cv-479 (E.D. Tex. May 29, 2024).
[9] See H.R. 2369 — Verifying Accurate Leading-edge IVCT Development Act of 2023 or the VALID Act of 2023 requiring the FDA to regulate in vitro clinical tests.
[10] "Mere placement of an RUO or IUO label on an IVD product does not render the device exempt from otherwise applicable clearance, approval or other requirements." If evidence shows an IVD product is inappropriately labeled RUO or IUO the device is misbranded and adulterated. FOOD & DRUG ADMIN., Distribution of In Vitro Diagnostic Products Labeled for Research Use Only Guidance (Nov. 25, 2013), available at https://www.fda.gov/media/87374/download.
Read more at: https://www.law360.com/articles/1870912/the-regulatory-headwinds-facing-lab-developed-tests?copied=1
