Health Institution Exemptions for SaMD in Great Britain

Software as a Medical Device (SaMD) is getting easier to build. Because of this many hospitals and other healthcare providers are now developing their own software and AI medical devices in-house to serve their patients. In this article the Hardian team take a look at how these healthcare institutions can become exempt from going through the full regulatory approval process in the UK and EU.

What is a Health Institution Exemption (HIE)?

Health institution exemptions, or “in-house manufacturing”, allows health institutions to manufacture and use medical devices without needing to meet all the regulatory requirements a commercial manufacturer would. Historically, HIEs came about to allow clinicians to modify and use devices as part of their own practice of medicine. Health institutions are any organisation whose main purpose is patient care or treatment, including hospitals, public health institutes and laboratories. It doesn’t include health and wellness companies like spas, gyms or wellness centres. 

Does that mean that a hospital could just manufacture and sell a medical device tomorrow, and bypass all the regulatory hurdles that commercial manufacturers have to follow? Unfortunately, no. There are still requirements for health institutions applying the exemption, and the amount of involvement and oversight from regulatory bodies varies between countries. Let’s focus on the UK (or more accurately, Great Britain).

Current HIE requirements under UK MDR 2002

Under the UK MDR 2002, there is minimal oversight on health institution exempt devices (Article 33). In fact, the regulations only mention HIE in relation to in vitro diagnostic devices but the MHRA has clarified that the regulations apply to all medical devices.

In Great Britain, a health institution can manufacture and use a medical device on the same premises, or in the immediate vicinity, as long as it’s being used for a purpose “intrinsic to the operation” of the institution. For example, the Supra-Regional Assay Service (SAS) manufactures and performs highly specialist blood tests, centralising the processing of these tests to certain laboratories. This service operates under a health institution exemption and doesn’t need formal UKCA marking. They can't, however, begin selling the test, or leasing the technology to other laboratories.  

Under the UK MDR, as soon as you transfer a device to another legal entity, you are classed as a commercial manufacturer and have to comply with the full regulations. Unfortunately, there is no way around this; the MHRA considers “transferring” to include selling, lending, leasing, and gifting - so you really do have to keep it “in-house”. 

Big changes could be on the way

HIEs could soon undergo some big changes. With the UK likely to align with the EU MDR in the not too distant future, the change in requirements for NHS trusts in England, Scotland and Wales applying these exemptions could be pretty extensive. Following Brexit and the Northern Ireland Protocol, the EU MDR is already in force in Northern Ireland, and with it, the updated requirements for health institution exemptions. The MHRA released specific guidance on HIEs in Northern Ireland, which gives us a good idea of what to expect. So, let’s dive into what is already in place in Northern Ireland (and the EU) and what could be coming to the rest of the UK from 2025.

New HIE requirements under the EU MDR 

Under the new general medical device regulations, HIE requirements for SaMD and other devices are now explicitly described in Article 5(5) of the EU MDR (as well as in the EU IVDR). We’ve summarised the key requirements here:

What does that all mean? 

Firstly, as with any medical device, you will need to demonstrate that the device complies with all the relevant General Safety and Performance Requirements (listed in Annex I of the MDR). Let’s take the rest step by step:

1. Nope, you still can’t sell it. However, the MHRA Northern Ireland guidelines make specific allowance for transferring a medical device to another health institution. This second institution would then have to independently apply their own exemption. This is not the case in the EU however, where devices cannot be transferred to another legal entity under any circumstances. 

2. There is some debate about what is meant by an “appropriate” QMS, and appropriateness will depend on the specific device and its use, but ISO 13485 is considered generally appropriate. However, other sector-specific standards may also apply e.g. ISO 15189 for laboratories. 

3. This is new - health institutions have to justify why the target group’s needs cannot be met by a commercial device on the market, and why your in-house device will meet those needs. This must be supported by evidence such as a literature review or market research and repeated to ensure that no commercial alternatives become available. Also, cost is not considered a valid justification! 

4. In theory there is no official review by the MHRA, but you must make information available to them on request. We’ve seen it happen before…

5. This is also new and will make HIEs more transparent to the public. While you don’t currently need to formally register on a database (like PARD or EUDAMED), health institutions have to make a signed public declaration (e.g. on their website) detailing the manufacturer address, the device details and declaration that it meets the GSPRs. 

6. Even though no one is technically auditing it, you still need to draw up and maintain a technical document stack… 

7. …and then make sure you follow it.

8. This is essentially equivalent to “post-market” activities. The surveillance system employed should gather experience on clinical use and identify if any corrective or preventive actions need to be taken. As with any medical device, adverse events still need to be reported to the MHRA.  

Am I operating under a health institution exemption?

Under the EU MDR definitions, it may not be immediately obvious when a health institution can apply the exemption. If you are a health institution that manufactures and uses a medical device on the same premises, you can clearly apply the exemption. However, some situations are less obvious. For example, if you use a device outside of the manufacturer’s instructions (“off-label”), modify a device or its intended use or change the function, performance or purpose, it’s very likely you will also need to apply an exemption and conform with the relevant requirements.

While these new regulations won’t be introduced in Great Britain until 2025, with the growing use of medical devices in the NHS, it’s never too early to start preparing for the changing requirements for health institution exemptions. The Hardian team have worked with numerous healthcare institutions to help them meet the requirements outlined above, as well as to commercialise previous in-house exempt SaMD and AIaMD products, so do get in touch if you are considering HIE or commercialisation.

Hardian Health is a clinical digital consultancy focused on leveraging technology into healthcare markets through clinical strategy, scientific validation, regulation, health economics and intellectual property.