What’s on FDA’s new Diagnostics Chief’s mind? Transitions, the LDT rule and cybersecurity

COURTNEY LIAS will now serve as OHT7 Office Director in a permanent capacity

• Quick background: The Center for Devices and Radiological Health (CDRH) is organized into seven main Offices, of which one – the Office of Product Evaluation and Quality (OPEQ) – is a “super office.” The office, which is responsible for directly reviewing and regulating medical devices and diagnostics, was established under a major restructuring of CDRH in 2018-2019 as part of CDRH’s “Total Product Lifecycle (TPLC)” approach. At a high level, the establishment of OPEQ brought together previously disparate offices involved in pre-market review (the Office of Device Evaluation and its divisions) and post-market work related to compliance and surveillance (the Office of Compliance) and Office of Surveillance and Biometrics). The reorganization also saw the Office that regulated in vitro diagnostics (IVDs), then known as the Office of In Vitro Diagnostics and Radiological Health (OIR), under OPEQ as a division.
• OPEQ is organized into eight “Offices of Health Technology” (OHTs), which are structured by therapeutic area (e.g., OHT2 is cardiovascular devices). The regulatory oversight of diagnostic products is in OHT7; while this OHT previously included radiological health products, the agency formally established its newest OHT, OHT8 (radiological health and mammography) in 2022, effectively separating out these divisions.
• OHT7 in transition: The Covid-19 pandemic put extreme pressure on OHT7, with that Office facing high levels of Emergency Use Authorization (EUA) submissions for Covid-19 test products. At the end of 2023, former OHT7 Director TIMOTHY STENZEL retired from the agency. Stenzel had joined the agency as Office Director in 2018 and helmed the OHT7 through the pandemic.
• Following Stenzel’s departure, COURTNEY LIAS was named Acting Director of OHT7. Lias has been with the agency for over 20 years, and prior to being named Acting Director of OHT7 served as the Director of OHT3 (Office of Gastrorenal, ObGyn, General Hospital and Urology Devices) within OPEQ.
• At the NextGenDx Summit in DC this week, former OIVD (as it was then called) Director ALBERTO GUTIERREZ announced that Lias will serve as the Office’s permanent Director. Introducing Lias for a plenary at the event, Gutierrez said: “Courtney is in the paperwork for the seminar, she’s put down as the Acting Director. She actually is now officially the Director for the Office of In Vitro Diagnostics, OHT7. So I would like to congratulate Courtney on moving up and becoming the director. I know that she’s got a tough road ahead of her with everything that is going on with [laboratory developed tests] LDTs and everything, but I do also know that Courtney is probably the right person to be leading the office this time.”

Speaking at the NextGenDx summit, Lias provided an overview of the landscape she faces as OHT7 Director

• Up first: There have been a lot of changes at the top of CDRH. Lias acknowledged the recent retirements of longtime CDRH Director JEFF SHUREN and OPEQ Director BILL MAISEL.
• Details about the transition of CDRH and OPEQ: Notably, according to Lias, Shuren is still technically at the agency, “currently in a position of Center Director Emeritus up at the agency level to help with the transition to a new Center Director,” she said. Deputy Center Director MICHELLE TARVER is serving as Acting Center Director; “she’s the right person for this acting position, and I’m really thrilled to see what she can do in the next coming months in this role,” said Lias. The agency is currently looking for a permanent replacement for Shuren as the head of CDRH; for now, it’s not entirely clear whether Shuren will stay on until that person is found. Maisel, who has led OPEQ since the super office was established, was replaced on an acting basis by OPEQ Principal Deputy Director OWEN FARIS, but a new permanent Director will be starting in September, Lias confirmed: “They have announced a permanent director who’s scheduled to start in September, Dr. Rusty Segan will be joining as permanent OPEQ Director in about a month,” she said. FDA has not made a formal public announcement, but Lias was referring to ROSS D. SEGAN, a longtime medical device executive who uses the nickname “Rusty” and confirmed the appointment to AgencyIQ.
• As OHT7 Director, Lias will oversee much of the work in implementing the Laboratory Developed Test (LDT) final rule. This rule, finalized in May 2024, represents a significant change in the way that FDA regulates certain test products known as LDTs. While the agency previously expressed a general enforcement discretion over LDTs (in effect, not requiring their regulatory compliance as medical devices), the agency is phasing out that policy over the next few years. The rule has significant implications for the way that LDTs are regulated in general, but also has additional impact on the use of LDTs in the context of drug development (i.e., tests leveraged during investigations of therapeutic products) and companion diagnostics (CDx).
• Lias provided a status update on a pilot program administered by OHT7 and the Oncology Center of Excellence (OCE) that sought to formalize a system for LDTs being used as CDx. This project was announced in June of 2023, and the agency has not provided much information about the ongoing work since a December 2023 webinar recapping its design. At a high level, the pilot program was intended to offer sponsors of certain drug products that would need a CDx with the opportunity to submit information about their Clinical Trial Assay (CTA) – the assay they’re using in a pivotal trial – to the FDA [see here for background on that topic]. While the submission of this data would not result in authorization of the CTA as a diagnostic, the FDA would, under the pilot, allow that information to inform a set of minimum analytical performance characteristics on the use of a test with the corresponding drug, which in turn would inform the drug’s labeling. In short, drug sponsors would submit information on the CTAs used in their development programs, the FDA would determine if that information has established clinical validity for use, and the agency would then outline a series of baseline performance specifications for the tests which could be leveraged by additional test developers. The pilot was only open to certain drug sponsors with oncology products regulated by the Center for Drug Evaluation and Research (CDER).
• Lias confirmed that “this pilot is ongoing” and described some lessons learned. “We’ve been in this pilot for about a year, and we are currently sort of thinking about what’s going well in the pilot, what types of things need to be adjusted,” she said, but stopped short of describing what adjustments those might be. She was able to outline some high-level trends, particularly noting that “we’ve noticed… that it has been difficult for drug manufacturers to get information on the clinical trial assays that they’re using.” She went on, “A lot of the clinical trial assay laboratories are unwilling to provide information on the test performance for the clinical trial assays, and that makes it difficult for us to accept them into a pilot. There’s also been variability across the clinical trail assay sites,” she noted. While the pilot included the opportunity for a retrospective cohort, according to Lias’s presentation it appears that there were additional challenges with accepting programs that had already been done or started into the pilot, given the challenges with getting information out of laboratories. As she explained, “understanding how you don’t have a pre-specified performance criteria, trying to understand the performance from the trial sites is really the only way you can do this, and without the cooperation of laboratories providing that type of validation, it makes it difficult to have them in the pilot.”
• There are several high-level takeaways from these updates for drug developers. First, Lias put to rest any concerns that the pilot may have been shuttered following the issuance of the LDT final rule. Notably, some lawmakers had recently asked FDA for a status check on the pilot following the final LDT rule’s publication. Second, the operational challenges that Lias has cited with the pilot – in effect, working more closely with clinical laboratories who conduct testing as part of a trial – remain of significant concern to the drug industry under the LDT rule. Per that rule, the investigational device exemption regulations, which outline regulatory expectations for medical devices used in investigations (either of the device itself or a device used in an investigation of another product, like tests or digital health technologies in a drug trial), would come into force during Stage 2 of the final rule in 2026.
• The reclassification initiative: In February 2024, CDRH announced a new initiative to review the risk-based classifications of “most” IVDs that are regulated as “high risk” (Class III) devices to see if they could be appropriately regulated in a lower risk-based category (Class II, moderate risk). This project, which is focused first on CDx (which are largely Class III products) and IVDs for infectious diseases, was also seen as a key aspect of implementing the LDT rule. Per the LDT final rule, the agency intends to have the reclassification initiative completed by Stages 4-5, which are the pre-market submissions stages of the rule. In effect, the agency should have “most” Class III IVD types re-classified to Class II in advance of when a pre-market submissions would be required by the rule, as the risk-based categorization of the test will inform both when a submission is needed and what application type they will need to prepare. “We have to go through a pretty long process” for reclassification, Lias acknowledged, “but we will be providing updates as we have them, and we’re trying to move through them as quickly as we can,” she said.

Two big things on Lias’s mind for the diagnostics industry: Artificial Intelligence and Machine Learning (AI/ML) and cybersecurity

• First, on AI/ML, Lias acknowledged that tests and diagnostics are already using AI/ML tools, and the field of AI/ML-based research in diagnostics is advancing quickly. She highlighted FDA’s new authority related to Pre-Determined Change Control Plans (PCCPs), which allows the agency to authorize a medical device along with a plan to make changes to the device after its authorization without needing to re-submit the device. Lias highlighted areas where OHT7 has already made use of these application types, and noted that PCCPs are likely to be of increased relevance to diagnostics going forward, even beyond its use case in AI/ML. “It doesn’t have to be an AI/ML device,” Lias said. “It can be any device… and I will say that IVDs are a little ahead of the curve for PCCPs.”
• Cybersecurity “is the most important topic because it’s causing a lot of problems for a lot of people right now,” said Lias. She went over the new regulatory changes in the last few years related to cybersecurity for medical devices, specifically the statutory requirement that certain device developers submit cybersecurity information as part of their required regulatory submission to the FDA. This requirement applies to all “cyber devices” [ see AgencyIQ’s explainer here], which Lias described as “a device that includes software that’s validated, installed or authorized by the sponsor as a device or in a device, has the ability to connect to the internet, and contains any such technological characteristics validated, installed or authorized by the sponsor that could be vulnerable to cybersecurity threats.” Per Lias, “it applies to a lot of different devices,” including diagnostic tests. “Cybersecurity mandates apply whether you made the device or not,” she said, “so if you’re a diagnostic test developer and you have a device that you’re using in your system, it needs to be cybersecure even if you didn’t make it,” she confirmed. This includes test or diagnostics that aren’t intended to be connected to the internet, including when their labeling states “do not connect” – per Lias, those “are not going to be adequate mitigations for this type of thing.”
• What does this mean for diagnostic test developers? “If you take anything away from this talk, I think it is ‘learn more about cybersecurity and what you need to do about it’,” Lias concluded. Specifically for diagnostic test developers, “if you are developing a test and you are making an instrument or some other cyber device, build that cybersecurity in, understand what type of cybersecurity testing and evaluation you should be doing and have it done, and build in the ability to create or to make appropriate cyber security updates,” she urged. She went on, “the second point I want to make is, if you are a test developer and you do not make the instrument that you are using, you should choose one that is cybersecure, and you should choose one that either is separately regulated – for example, it’s an exempt product where they have to meet the cybersecurity requirements on their own, and they’re being inspected, and they have a quality system, and all these requirements applied to them – or you have access to all this information you need to address these cybersecurity questions, because this is going to be a challenge for test developers who are trying to leverage instruments that are not cybersecure and for which they cannot get the information.”
• According to Lias, this is already an issue. In effect, diagnostic test developers who are using components or devices in their test for which they either do not have the required cybersecurity information (if they did not make the instrument) or for which they did not understand the cybersecurity requirements are already facing challenges when submitting their tests to the FDA. “I think that’s one of the biggest things we’re going to see coming over the horizon as challenges for test developers who are leveraging legacy, outdated or other types of instruments that have not been designed this way,” Lias cautioned.

To contact the author of this item, please email Laura DiAngelo ( ldiangelo@agencyiq.com).
To contact the editor of this item, please email Alexander Gaffney ( agaffney@agencyiq.com)

Key Documents and Dates

• Next Generation Dx Summit