@MichaelHall everything I could find was on the context of manufacturer provided software, or software separate to a medical device in a medical context. Not about the specific combination of non-medical software on regulated devices.

Manufacturer provided software is clearly regulated, non-medical software on a non-medical device is clearly unregulated. Non-medical software on a medical device by a non-manufaturer, such as has the potential to significantly effect the risk of use of the device? A lot less clear.

Fairly common to see medical scanners etc running a varient of windows, and as described in the motivating example, there's a strong incentive to install antivirus on those systems, which could then lead to issues.

The FDA has no mandate to regulate users.

What kind of "cause" are we talking about? Are you suggesting that the malfunction of the non-medical software could directly harm the patient, e.g. by radiation overdose? Are these devices actually built such that this is possible? Or are you thinking that the failure would just stop the machine from working at all, thus keeping the patient from receiving a needed treatment and "causing injury" in that sense?

@NateEldredge potentially either, or in the case of scanners corruption of scan data, leading to misleading scans.

@ScottSeidman that leads to a potentially interesting loophole if no one covers this, as that would suggest you can build medical devices however you like to whatever quality specs you like, so long as you are the hospital organisation using them.

"The FDA has no mandate to regulate users" [unsubstantiated claim] and "you can build medical devices however you like to whatever quality specs you like" would depend entirely on the location of such a "device" on the probability and severity risk assessment matrix.

@MichaelHall The "device" seems entirely irrelevant. What matters to that question is the meaning of 'user'. In the context of this question, I did not mean patients, but hospitals and similar medical organisations. I assumed Scott meant likewise, and interpreted his comment as meaning the FDA only regulates devices that are bought/sold, not devices that are constructed by the organisation that uses them without ever being sold.

I disagree. A device intended to circulate blood during a heart transplant will be regulated far differently than the probe that clips to the end of your finger to measure oxygen level in the blood. Because if the first one fails without a backup the patient will die within minutes with 100% certainty, if the second one fails you simply lack the information it provides. Who manufactures them, and whether they are sold commercially or intended for use by the developer would seem less relevant to me.

Ideally yes. In practice it's this doesn't usually come up because hospitals don't manufacture such devices themselves (though this is starting to happen with software as a medical device) and the FDAs mandate is limited in constitutionality, as it derives from the commerce clause. My understanding is in aviation this is closed as the FAA also has regulation of the practise of flight requiring use of approved equipment.

Or in other words: the FAA can't stop you building a plane however you like. But they can stop you flying it.

I admit to no real world medical device experience, and yes my experience is in aerospace. But, I think there are parallels, and I have worked with many people who have come from medical device companies. From conversations over the years I have formed an impression that that industry is at least as regulated as aerospace, if not more so. And I would expect, and want it to be that way. Regarding your example; the FDA can't stop me from building a pacemaker however I like either, but I presume they can stop me from implanting it in someone.

fda.gov/medical-devices/…. "The FDA's Center for Devices and Radiological Health (CDRH) is responsible for regulating firms who manufacture, repackage, relabel, and/or import medical devices sold in the United States." Yes, this means that the FDA does NOT regulate doctor's practice, and they DO NOT regulate patients or device users. They specifically regulate the marketing and shipping of product.

And yes, surgeons jury-rig or build tools all the time.

More specifically, from fda.gov/media/151975/…., "Does the FDA regulate medical services, availability of medical products, pricing and health insurance? No. The FDA does not regulate the practice of medicine, medical services, the price or availability of medical products and whether they are reimbursed by health insurance or Medicare. "