Using software with COVID-19 rapid antigen self-tests

Sponsors can apply for inclusion of COVID-19 rapid antigen self-tests in the Australian Register of Therapeutic Goods (ARTG). Each application for inclusion is required to undergo evaluation by the TGA to ensure appropriate clinical performance requirements are met and risk mitigations are in place.

Many of these tests may be supplied for use with a consumer mobile app and/or a web-based system that the user logs into. Features of software that enable production or update of a digital health record would not necessarily be regulated by the TGA, whereas other software that enables or assists in the interpretation of a COVID-19 test result would be considered a medical device and regulated by the TGA.

For more public health context, please see our guidance on Understanding performance requirements and risk mitigation for COVID-19 rapid antigen tests.

The Medical Device Regulations for software are technology agnostic; this means that the product can be any kind of technology such as a mobile app, web app, server-based system, traditional desktop package, cloud based, or any combination of these. It can also be a combination of software and/or hardware.

Many sponsors and manufacturers of rapid antigen tests also supply software for use with the tests. What determines whether the product is regulated by the TGA is what it does and how it does it - as described in the "intended purpose" for the software.

Regulated by TGA

If your software analyses or enables interpretation of the test sample or results in any way (whether by the user or another person), it is regulated as a medical device and must be included in the ARTG. This also applies to secondary analysis or quality checking of a result that is performed by the software

Software that analyses/interprets results from COVID-19 rapid antigen self-tests would be regulated as a Class 3 in vitro diagnostic (IVD) medical device analysis software and require separate inclusion in the ARTG.

Software that allows a user to combine their test result with other symptoms to provide an indication or likelihood of having COVID would also be regulated as an IVD medical device.

Not regulated by TGA

Software that is used simply for registration, viewing, recording of results and tracking, or for generation or update of a digital health record, would not be a medical device and so would not be regulated by the TGA.

Software that solely enables uploading of results to a database for the purpose of facilitating contact tracing or follow-up testing would not be regulated by the TGA.

Note

Software that combines regulated and non-regulated features are regulated by TGA, and sponsors will need to apply for inclusion in the ARTG for these products.

The assessment of such a product would predominantly focus on the medical device aspects but would also look at evidence showing that the performance of regulated features is not impacted by the other, non-regulated features, and that any shared data stores or other components are validated accordingly.

Example scenarios

Many tests have a QR code printed on the test kit to enable quick linking to the provider website and accurate upload of the test identification (ID) number. The inclusion of the QR code does not affect whether the software is regulated as a medical device.

Some example scenarios are listed below for illustration.

Scenario 1

Johan follows the instructions provided with the COVID-19 rapid antigen test kit and runs a test.

Using his phone, Johan opens the app and hovers the phone over the test kit's QR code.

The phone prompts Johan to enter the result and uploads this to the website of the test provider. The provider records the result in their database.

Regulatory status: Not a medical device - no analysis is performed by the software.

Scenario 2

Jane follows the instructions provided with the COVID-19 rapid antigen test kit and runs a test.

Jane opens the app and hovers the phone over the test kit's QR code.

Jane types in the result and takes a photograph of the test. The result is saved and displayed on the screen. The app offers an optional quality assurance (QA) check which interprets the image of the test result and gives a second opinion of the result.

Regulatory status: IVD Medical device as the software is enabling interpretation of the result from the image for the purpose of providing a QA check or second opinion.

Scenario 3

Jules follows the instructions provided with the COVID-19 rapid antigen test kit and reads the result on the test strips.

Jules takes a photograph of the test showing a result and uploads the photograph to the website of the test provider. After uploading the image, it is analysed by software and the software indicates a positive, negative, or invalid result.

Regulatory status: IVD Medical device as the software is analysing the image and making the decision on the result.

Scenario 4

Jay uses the app on their mobile phone to capture an image of their test kit showing a result.

The app prompts Jay to enter the result on the screen. The result is saved and displayed on the screen. A printable certificate is generated.

Regulatory status: Not a medical device - no analysis or interpretation is performed by the software.

Scenario 5

Jackson follows the instructions provided with the COVID-19 rapid antigen test kit and reads the result on the test strips.

Jackson types the test result into the app. The result is saved and displayed on the screen. Jackson is also prompted to enter any other symptoms such as temperature, sore throat etc. The app uses the test result and the symptom data to work out the likelihood of a COVID-19 diagnosis.

Regulatory status: IVD Medical device as the software is determining the likelihood of a person having COVID-19.

Scenario 6

Juanita follows the instructions provided with the COVID-19 rapid antigen test kit and reads the result on the test strips.

Juanita takes a photograph of the test result. The app allows the photograph to be uploaded to the website of the test provider where they can be viewed by another person.

Regulatory status: Not a medical device - enables transmission of the photograph for viewing and storage purposes only. No analysis is performed by the software to enable a secondary interpretation of results.

Privacy and data protection

Note 

Even if the product is not regulated as a medical device, all other Australian privacy and data protection laws would still apply (e.g. Privacy Act 1988).

COVID-19 rapid antigen self-tests are tests for the SARS-CoV-2 virus and are intended to be used in the home or similar environment by a lay person. Accordingly, the design and usability of the associated software is critically important, as are the instructions for using the software.

Instructions should be well-designed, easy to read, locally adapted and user friendly. Instructions should clearly describe what the software does and how to set up and use it, including what to do when there are problems.

Note

For software and IVD medical devices for self-testing, a lay person is defined as an individual who does not have formal training in a medical field or discipline to which the self-testing relates.

For the full definition, refer to the Therapeutic Goods (Medical Devices) Regulations 2002.

Minimum certification requirements for software developers

Software developers must:

• meet the minimum conformity assessment certification requirements for Class 3 IVD medical devices, including implementing a quality management system. This means that conformity assessment evidence from a recognised third party (such as the TGA or a comparable overseas regulator) will be required prior to submitting an application for inclusion
• have evidence that demonstrates compliance of their product with the relevant essential principles. The essential principles can be found in Schedule 1 of the Therapeutic Goods (Medical Devices) Regulations 2002.

Manufacturer's conformity assessment certification issued by overseas regulators and assessment bodies that will be considered by the TGA for the purpose of applying for inclusion of an IVD medical device in the ARTG includes:

• certificates and reports issued under the Medical Device Single Audit Program (MDSAP)
• ISO 13485:2016 certificates issued by:
  • a certification body that is also a Notified Body designated under the IVDD 98/79/EC (for IVD inclusion applications only until 26 May 2022).
  • a body that is an accredited body that is a signatory to the Multilateral Recognition Arrangement of the International Accreditation Forum (IAF MLA) (for IVD inclusion applications only until 26 May 2022)
• certificates issued by Notified Bodies designated by the medical device regulators of European member states, under the medical device regulatory frameworks of the IVD Regulation
• United States Food and Drug Administration (FDA) premarket approval (PMA).

Further information on acceptable certification (also referred to as manufacturer's evidence or market authorisation evidence) can be found on the TGA website.

Note

Manufacturers need to hold appropriate certification before an application for inclusion can be submitted. In some cases, the manufacturer of the test may also be the manufacturer of the app. In other cases, the manufacturer of the app may be another party. Some examples are provided below to illustrate this point.

Scenario 1

ABC manufactures COVID-19 rapid tests and decides to build an app specifically to use with their tests. Since ABC does not have in house software expertise, they sub-contract XYZ to build the app and associated website for them (i.e., ABC will be the legal manufacturer of the app).

Separate applications will need to be submitted for the tests and the app. The applications will be assessed in conjunction with each other. The manufacturer, ABC, will require certification that covers the design and manufacture of the test as well as the app. ABC will also need to be able to provide evidence of the app development and validation process (full list on pages 9and 10).

Scenario 2

ABC manufactures COVID-19 rapid tests. Another manufacturer XYZ, has developed an app that can be used with ABC's test as well as other manufacturer's tests.

The manufacturer of the test, ABC, will require certification that covers the design and manufacture of the test. The manufacturer of the app, XYZ, will require certification that covers the design and manufacture of the app. XYZ will need to be able to provide evidence of the app development process and validation with the specified rapid antigen self-tests it can be used with (full list on pages 9 and 10).

Clinical performance and usability studies

Software that is intended to read or analyse results of a COVID-19 rapid antigen test should not affect the clinical performance of the test (i.e., clinical sensitivity and specificity of the test should not be negatively impacted). Generally, it is expected that any software that analyses or reads rapid antigen test results would improve the overall accuracy of results interpretation, rather than decrease it.

Studies should be undertaken that evaluate the clinical and comparative performance between when:

• the software is used in combination with the specific COVID-19 rapid antigen test(s), and
• when the test(s) is used alone without any software.
• Usability and user comprehension studies should consider the ability of the user to interpret the software instructions and ensure that they are clear and easy to follow.
• Studies should also include the interpretation of contrived results for the particular COVID-19 rapid antigen test(s) it is intended to be used with. The results should:
• evaluate the ease of use of the software with a minimum of 100 lay users;
• reflect a range of results including non-reactive, reactive, weak reactive and invalid; and
• Provide a determination of concordance against visual reading of the test result by the lay user without the software (if applicable).

It needs to be demonstrated that the software used for interpretation of the results does not impact the clinical sensitivity and specificity of the rapid antigen test.

Technical requirements

A primary consideration for design is that the software is simple and easy to use, since it will be used by lay persons who may not have any previous experience using this type of software.

For all kinds of software, there are some general requirements that the technical file should include evidence for. This applies whether the software development methodology is agile (or a variant of agile) or other methodology. These requirements are:

• Overall description of functions such as user stories (or equivalence for the development methodology used).
• Software architecture and design, physical and logical.
• Validation artefacts - overall test strategy and approach, test cases, requirements traceability matrix, test data, test results and defect rates. This should include functional, performance and sociability testing. Where the software relies on a camera in a smartphone, the validation evidence must show how validation of the camera has been addressed.
• Defect management process and list of known defects in software at release.
• Human factors - showing how usability and accessibility have been incorporated into the design and take account of the needs of the general population who are not technically or medically trained.
• Cybersecurity risks and how they have been addressed.
• Data privacy - how it has been managed as it relates to patient safety and Australian privacy and data protection law.
• Clear instructions for lay people on how to use the software, as part of the Instructions For Use (IFU).
• Minimum specifications for the device (e.g., smartphone) for the software to operate on (e.g., memory, processor capability, minimum operating system requirements, browsers, smartphone models, etc).
• The minimum resolution for images used by an app for recording images of results should be 1920x 1080 (horizontal) resolution. The test itself should occupy at least 80% of the vertical height of the image.

Requirements for software using artificial intelligence

In addition to general software requirements, for software that uses artificial intelligence (AI) or machine learning (ML), the manufacturer is required to show evidence that is sufficiently transparent to enable evaluation of safety and efficacy of the product. Transparency means that a ‘black box' approach would not be considered acceptable (i.e., the TGA will not accept that no evidence can be provided because it is ‘black box' technology).

While this is a rapidly evolving area, this will typically include artefacts for the following:

• overarching statement of the objectives of the AI/ML model
• algorithm and model design, including tuning techniques used
• data used for training and testing machine learning models - and generalisability where applicable
  • synthetic data would not be considered suitable
  • size of data sets must be sufficiently large to be statistically credible
  • information about populations that this data is based on and justification for how this data would be appropriate for the Australian population who will be using the tests.

In this case, the manufacturer is the organisation or individual that develops the software.

Requirements for the instructions for use (IFU)

In addition, the manufacturer/sponsor of the software is also required to clearly outline which COVID-19 rapid antigen tests it is designed for use with and provide clear advice, in the IFU and/or other information provided with the software, including the following:

• clear and simple instructions on how to download or install the software, set up, register a test and what to do with the result such as uploading (this may involve images or visual representation of the instructions, flow diagrams or QR codes linking to online demonstrations);
• available either in print or online in multiple languages (e.g., including local languages)
• information on what to do if a positive result is received
• how to contact locally available support services including phone lines and websites; and
• how to contact the TGA to report poor performance or usability issues in the self-test environment (report an issue via the Users Medical Device Incident Report, email iris@tga.gov.au or call 1800 809 361).

Other requirements for the IFU and information provided with a device, including product labelling, are detailed in essential principle 13 of the Therapeutic Goods (Medical Devices) Regulations 2002.

Post-market monitoring and standard conditions of inclusion

All sponsors of software included in the ARTG have ongoing responsibilities under the Therapeutic Goods Act 1989 (the Act), the Therapeutic Goods (Medical Devices) Regulations 2002 and the Therapeutic Goods Advertising Code (the Advertising Code), including conditions that apply automatically to all ARTG entries. These conditions facilitate post-market monitoring and include, but are not limited to, the following:

• allowing entry and inspections of premises.
• delivery of device samples upon request.
• availability of information, such as facilitating access to technical documentation that demonstrates compliance with the essential principles.
• ensuring any advertising material relating to the medical device complies with regulatory requirements.
• reporting details of certain incidents and performance issues to the TGA, and any overseas regulatory actions to the TGA if the product involved is from the same batch or production run that was supplied in Australia.

All sponsors are also required to report adverse events to the TGA.

Additional conditions that may be applied

Depending on the performance of the software, the information provided in the IFU and how the software works with the test, the TGA may impose additional non-standard conditions to mitigate any residual risk identified relating to the effective and safe use of the product or to facilitate the monitoring of potential trends. These are likely to include a requirement that the sponsor:

• provide additional support for users of the software through provision of information that will direct users to on-line support services and/or phone lines.
• submits to the TGA through the medical device Incident Reporting and Investigation Scheme (IRIS) all complaints (including adverse events) that relate to false positive and false negative results as they are received by the sponsor.
• provide the TGA with regular annual reports on the distribution of the product, numbers of apps downloaded, users registered, services provided and numbers of any reported false positive or false negative results or problems with poor in Australia and worldwide (this may be a combination of monthly and annual reporting requirements).
• may potentially only supply the device through specified distribution channels that allow relevant information/education to be provided to users at the time of purchase. This will be considered on a case-by-case basis and will depend on what risks need to be mitigated.

Any further conditions would be applied on a case-by-case basis and would depend on the evaluation of an individual product, the overall benefits, and how well any risks have been mitigated.

Post-market review

The TGA can conduct a post-market review of certain kinds of devices included in the ARTG. ARTG entries for COVID-19 rapid antigen self-tests and associated software may also be subject to a post-market review. Sponsors may be asked to provide a number of test kits for independent laboratory evaluation of the clinical sensitivity and specificity to verify their performance with the software.

• Check all the Requirements for COVID-19 rapid antigen self-test software that is an IVD medical device.
• As a potential sponsor, you will need to establish a client identification number (Client ID) to access the secure online TGA Business Services (TBS).
• You will then need to submit and have your manufacturer's evidence (conformity assessment certification) accepted by the TGA prior to being able to submit your application for inclusion.
• Once your manufacturer's evidence is accepted you will be able to submit an application for your software product to be included in the ARTG.
• Ensure that you are complying with Australian privacy and data protection laws.
• If you need further information, there is detailed guidance on the regulation of software based medical devices.

Note

Separate applications for ARTG entries will be required for COVID-19 rapid antigen self-tests and the associated apps.

Advertising requirements

Advertisements in the public domain for IVDs, including self-tests and associated apps, are subject to the requirements of the Act, including the requirement to comply with the Advertising Code.

The Advertising Code specifies the requirements for advertising therapeutic goods to consumers. Notably, the Advertising Code requires that advertising for therapeutic goods must:

• be accurate, balanced, and not misleading or likely to be misleading and that all information presented has been substantiated
• be consistent with the intended purpose on the ARTG
• present the good in accordance with the directions/instructions for use.

Additionally, advertisements for therapeutic goods must not:

• contain any claim, statement, implication or representation that the goods are safe, their use cannot cause harm, that they have no side effects or that the goods are effective in all cases
• exaggerate the efficacy or performance of the product or encourage inappropriate use
• state or imply that the goods are approved or endorsed by a government authority (e.g., stating "TGA approved")
• must not be likely to lead people to delay necessary medical attention
• must not be inconsistent with public health campaigns.

It is also important to be aware that representations in consumer advertising that refer to the detection of COVID-19, are "restricted representations". Under the Act, restricted representations must not be used in consumer advertising without prior approval or permission from the TGA. 

Notices of approved and permitted representations are published on the TGA website at https://www.tga.gov.au/how-we-regulate/advertising/restricted-and-prohibited-representations-advertising/restricted-and-prohibited-representations.

More information:

• Complying with advertising requirements
• Advertising hub

Enquiries about the legislative requirements for advertising therapeutic goods can be lodged online at https://compliance.health.gov.au/ac-enquiry/.