In our previous articles we looked at FDA (Food and Drug Administration) clearance and NRTL (Nationally Recognized Testing Laboratory) certification for IVD instruments exported to the US. NRTL certification ensures the safety of electrical equipment in the workplace under OSHA rules (29 CFR 1910 Subpart S).
IVD instruments with wireless functions must additionally comply with the rules of the FCC (Federal Communications Commission), which in practice means obtaining an FCC ID.
1. Legal basis of FCC certification
FCC requirements are set out mainly in Title 47 of the Code of Federal Regulations (CFR), covering technical standards and authorisation procedures for radio equipment. The FCC manages the use of the radio spectrum and ensures that devices do not cause harmful interference to public communication networks or other equipment.
Any radio device sold or used in the US – including medical devices with wireless functions – must therefore go through FCC equipment authorisation. Note that digital electronics without radio functions are also subject to FCC Part 15 rules as unintentional radiators, usually via the Supplier’s Declaration of Conformity (SDoC) procedure.
2. Wireless functions in IVD instruments and the FCC ID
More and more IVD instruments integrate Wi-Fi, Bluetooth or cellular connectivity for data transfer, remote monitoring or device control. This adds convenience and functionality but also brings challenges in electromagnetic compatibility and radio-frequency interference.
The FCC ID identifies a radio device certified by the FCC and shows that it operates within the permitted RF limits without interfering with other equipment or networks. IVD instruments with wireless functions must therefore be certified before entering the US market, with the grant issued by a Telecommunication Certification Body (TCB). Using a pre-certified radio module can simplify this considerably, provided the module’s grant conditions are met.
3. RF exposure and SAR
For wireless devices used close to the human body, RF exposure must be assessed. The Specific Absorption Rate (SAR) measures how fast body tissue absorbs RF energy, in watts per kilogram (W/kg). The FCC limit for the head and trunk is 1.6 W/kg averaged over 1 g of tissue. Benchtop laboratory instruments used at a distance from the body can usually demonstrate RF exposure compliance by a simpler maximum permissible exposure (MPE) evaluation, while portable point-of-care devices may require SAR testing.
4. FDA cybersecurity requirements for wireless medical devices
Besides FCC RF rules, the FDA also sets cybersecurity requirements for medical devices with connectivity. Under Section 524B of the FD&C Act (in force since March 2023) and FDA guidance, manufacturers of “cyber devices” must ensure cybersecurity throughout the device lifecycle, including:
- Risk management: identifying and assessing cybersecurity risks and defining mitigations.
- Design controls: building in security features such as authentication and data encryption.
- Testing and verification: security testing such as penetration tests and vulnerability scanning.
- Postmarket management: monitoring, coordinated vulnerability disclosure and timely updates and patches, plus a software bill of materials (SBOM) in the premarket submission.
These requirements need to be considered from the start of design and development.
5. How FDA and FCC regulation fit together
FDA and FCC cooperate on wireless medical devices: the FDA focuses on safety and effectiveness, the FCC on radio communication and RF compliance. A wireless medical device must meet both sets of requirements – together with NRTL safety certification for use in hospitals and laboratories – to enter the US market successfully.
How EVERBIZ can help
- Regulatory consulting: interpreting the latest FDA and FCC requirements and helping you meet them.
- Testing and certification support: coordinating the necessary tests for FCC RF compliance and FDA cybersecurity expectations.
- Documentation review: checking technical documentation against regulatory requirements to improve the chances of approval.
- Ongoing compliance: postmarket monitoring and support throughout the product lifecycle.
Contact us to discuss your project.
This article is for general information only and does not constitute legal advice.