Tom Health LLC

Please see the attached comments from Tom Health, LLC., a Lumeris company.

October 16, 2026

The Honorable Kyle Diamantas
Acting Commissioner
Food and Drug Administration
United States Department of Health and Human Services

Re: Docket No.: FDA - 2026 - N - 7874 Considerations for the Regulation of Generative AI -
Enabled Medical Devices: Discussion Paper and Request for Feedback

Dear Acting Commissioner Diamantas:

Tom Health LLC, a Lumeris Company (Tom Health) welcomes the opportunity to provide
feedback on the Center for Devices and Radiological Health’s discussion paper, Consideratio ns
for the Regulation of Generative AI - Enabled Medical Devices .

Tom Health connects patients, care teams, and clinical workflows to make primary care more
accessible, proactive, and continuous while giving physicians more capacity to focus on the care
only they can provide. Our multidisciplinary team of clinicians, sof tware engineers, and
regulatory specialists is dedicated to advancing safe, evidence - based, and equitable integration
of artificial intelligence (AI) across outpatient and ambulatory care set tings. As an organization
building for the future of primary care, Tom Health operates at the direct intersection of patient
engagement, asynchronous clinical communication, decision support, and administrative
workflow orchestration.

Tom Health encourages FDA to frame its consideration of the discussion paper feedback not
only as the regulation of a novel technology, but as the development of a new patient - safety
infrastructure for an increasingly capacity - constrained healthcare system . Current care is no t a
risk- free baseline. Patients experience harm when clinically relevant information is not identified,
follow - up does not occur, specialist expertise is unavailable, care teams lack capacity, and
evidence - based interventions are inconsistently delivered. These risks are often diffuse, delayed,
and difficult to attribute, but they are no less real.

A forward - looking framework should therefore evaluate both sides of the benefit - risk equation:
the risk introduced by an AI - enabled function and the risk patien ts would face if the function
were unavailable. FDA should permit increasing levels of bounded autonomy when a sponsor
demonstrates that the AI - enabled care model, including its technical controls and deployment
environment, is at least as safe and effecti ve as the care reasonably likely to occur in its absence.

Tom Health does not suggest that AI should displace healthcare professionals. Clinicians provide
judgment, accountability, context, and human connection that remain indispensable to care. At

3251 Riverport Ln, Maryland Heights, MO 63043 | 1.888.586.3747 lumeris.com
the sam e time, preserving the clinician’s role should not require preserving every manual task or
requiring ceremonial review of actions that can be performed safely, consistently, and promptly
through validated automation. The objective should be appropriate hum an accountability,
supported by technology , that allows each member of the care team to practice at the top of
their license.

Within this framing, our experience underscores three core tenets that should guide CDRH's
policy formulation:

• A Total Product Lif e Cycle (TPLC) Approach Centered on Post -Market Assurance: The
non - deterministic, open - ended nature of GenAI cannot be adequately or exhaustively
validated purely via static premarket clinical trials. Excessive premarket evidentiary
hurdles risk locking mo dels into obsolescence and withholding transformative access
from patients. Premarket competency benchmarking should be coupled with rigorous,
real- time post - market monitoring and safety guardrails.
• Preserving Access, Equity, and Patient Agency: GenAI pres ents an unprecedented
opportunity to close health equity gaps, raise baseline health literacy, and democratize
access to timely clinical navigation for underserved populations. Regulatory definitions
distinguishing informational from action - directing softw are should recognize patient
agency and avoid treating patient - facing tools with disproportionate risk classifications.
• Deterministic Scaffolding and Human - on- the - Loop Safeguards: In complex ambulatory
care, patient safety is maintained through hybrid arch itectures, combining generative
models for empathetic patient engagement, synthesis, and translation with deterministic
clinical protocols and clear clinical escalation paths.

Section IV: Considerations for the Assessment of Risk for
GenAI - Enabled Devices (Questions 1 - 4, 6)
Question 1:
Does the two - axis risk framework, organized around device activity and the consequence of
relying on an incorrect output, appropriately capture the dimensions most relevant to the risk
of a GenAI - enabled software function? If there are additional dimensions — such as the
reversibility of a resulting action, the availability of downstream safeguards, the time pressure
of the deployment setting, or the traceability of the output (i.e., to primary source materials) —
that should b e represented in a risk framework, please describe and provide examples of how
they should be represented.

Tom Health Response :
Tom Health supports the two - axis framework (Device Activity vs. Consequences of Incorrect
Output) as a conceptual heuristic, but we urge CDRH to incorporate the following moderating
factors that can downgrade a device's effective coordinate on the consequence axis when
robust technical or clinical safeguards exist:

©2026 Lumeris | Proprietary & Confiden tial 2
 • The Risk of Unavailability: The risk patients face if the device is unavailable (e.g., severe
delays in access or complete lack of care) should actively moderate the consequence
axis. The consequences of an incorrect output should be characterized independently,
but FDA’s overall benefit - risk assessment should also accoun t for the care reasonably
available without the function. In settings where the practical alternatives are delayed
care, fragmented care, patient self - navigation, or no intervention, the expected benefit
of timely and appropriately bounded assistance may b e material. Sponsors relying on this
factor should identify the relevant population, document the access constraint, and
evaluate outcomes against the actual care pathway rather than an idealized alternative.
FDA should permit increasing levels of bounded autonomy when a sponsor demonstrates
that the AI - enabled care model is as safe and effective as the care reasonably likely to
occur in its absence.
• Reversibility and Latency of Harm : In outpatient primary care, many recommendations
have substantial time windows for clinician intervention or patient course - correction
(e.g., self - monitoring a mild skin rash vs. an immediate medication administration error).
Risk should be inversely prop ortional to the reversibility of the suggested action.
• Presence of Determi nistic Guardrails and Downstream Safeguards: A generative model
wrapped in deterministic algorithmic fences (e.g., symptom triage bounded strictly by
validated clinical triage protocols that cannot be overridden by the LLM) carries
significantly lower risk than an unconstrained agent.
• Traceability and Grounding (Source Attribution): When an output is deterministically
tethered to verifiable primary clinical evidence (via Retrieval - Augmented Generation
[RAG] citing established practice guidelines or the pati ent's verified EHR record) and
made transparent to the user, the risk of unvetted reliance is substantially mitigated.

Question 2:
CDRH seeks input on how to account for the spectrum of GenAI - enabled informational
functions that vary in the degree to which they direct a user to a particular action (i.e., between
“non- directive” and “action - directing”). What characteristics of an outpu t— such as its wording,
specificity, personalization, or context — could be considered as modifiers of the risk associated
with an informational function, after accounting for the device’s overall functionality and
intended use? What additional information would provide manufacturers with sufficient clarity
and predictability around risk assessment for informational functions whil e recognizing that
directiveness may exist along a continuum rather than as a binary distinction?

Tom Health Response :
Treating "directiveness" as a binary trigger for higher risk classification could inadvertently
capture standard health communication, pr eventive care education, and care navigation,
worsening healthcare capacity constraints. Personalized health information should not
automatically be treated as higher risk if the software does not independently diagnose
conditions or prescribe treatment.

©2026 Lumeris | Proprietary & Confiden tial 3
To provide regulatory predictability, CDRH should adopt an objective standard based on clinical
autonomy and prescriptive specificity. Relevant factors should include whether the output: (1)
identifies a specific diagnosis or treatment; (2) recommends a par ticular action and
communicates urgency; (3) is personalized using patient - specific clinical data; (4) allows the
user to independently review the basis for the recommendation; (5) operates within a clinician -
approved protocol; and (6) permits a qualified healthcare professional a meaningful opportunity
to review or intervene before an irreversible or high - consequence action occurs. No single factor
should be dispositive.

Non - Directive to Guided Informational (Enforcement Discretion / Non - Device) : Outputs t hat
synthesize recognized clinical consensus, offer lifestyle guidance, explain potential symptom
causes, provide condition - specific discussion prompts for the patient’s next visit, as well as
directive guidance anchored to physician approved protocols and tailored to patient
demographic or historical context, do not inherently convert information into an autonomous
medical directive; rather they enhance patient comprehension, engagement, and compliance
with prescribed protocols. Providing an opportunity t o patients that was not available to them
prior to the introduction of the tool.

Autonomous Action - Directing Device Functions (Regulated SaMD) : Functions that provide
conclusive diagnostic assertions without intermediate physician adjudication and independently
prescribe treatments or drugs outside of a strict physician protocol.

Question 3:
CDRH seeks input on whether and when a GenAI - enabled function that results in delivery of
clinical information to patients, as opposed to HCPs, could present different or higher risks,
while also recognizing the potential benefits associated with improved patient empowerment,
engagement, and access to clinical information. What device characteristics, output features,
or safeguards might mitigate risks that could arise when a user lacks the domain knowledge to
independently evaluate an output, without unnecessarily underestimating patient capability?

Tom Health Response :
While patients may lack specialized medical training, CDRH should be cautious not to adopt a
overprot ective stance that assumes patient - facing delivery inherently creates severe risk. In an
increasingly capacity - constrained healthcare system, patient - facing tools serve as critical
patient - safety infrastructure bridging critical access deserts, raising bas eline health literacy, and
enabling proactive self - advocacy.

To mitigate risks without denying patients critical access:

Explicit Boundary Signposting: The communications should clearly state that the tool is an AI
agent or assistant and not a medical prof essional.

Automated Escalation Triggers: When validated Red Flag symptoms appear, the agent should
transition from conversational informational dialogue to clear, structured navigation instructions

©2026 Lumeris | Proprietary & Confiden tial 4
to direct immediate human clinical connection (e.g., "Please call 911 or proceed to the nearest
emergency department immediately").

Health Literacy Calibration: The communication should be targeted at 6th –8th grade reading
and vocabulary levels.

Question 4 :
CDRH seeks input on whether and how the distinction b etween generalist and specialist
physicians might inform the assessment of risk for HCP - facing GenAI - enabled functions. Under
what circumstances, if any, might risk be affected when an HCP who lacks the relevant clinical
specialist knowledge receives infor mation that falls within a specialist area of practice? What
device characteristics or safeguards might mitigate such risks?

Tom Health Response :
A primary objective of Tom Health is to expand the capacity of primary care teams. Today there
is a lack of ac cess to specialists, and long waits for appointments. Using GenAI to provide
specialized clinical decision support (e.g., complex workup recommendations) empowers
primary care clinicians to manage complex conditions within the patient’s medical home,
avoid ing costly and harmful delays in specialty care.

• Top - of - License Practice: This approach allows members of the primary care team to
practice at the top of their license, directly addressing specialist capacity constraints.
• Risk Calibration & Safeguards: Ris k increases only when the output involves highly
technical, irreversible interventions. This is mitigated by presenting the complete clinical
rationale, referenced guidelines, and explicit contraindications, allowing the primary care
provider to exercise i ndependent clinical judgment.

Question 6:
For GenAI - enabled care escalation functions, CDRH is considering how the evaluation may
account for both under - escalation and over - escalation. How could manufacturers
characterize and weigh these two directions of error, given that they may not be
commensurable and that acceptable trade - offs may vary by clinical context?

Tom Health Response :
Consistent with our approach to the two axis risk framework, we recommend a balanced
approach to the risks of under and over escalation that should take into consideration current
healthcare system capacity:

• Under - escalation risks direct clinical harm from delayed intervention in acute conditions.
• Over - escalation degrades patient - safety infrastructure by driving unnecessary
emer gency department utilization, worsening clinician burnout, and causing patient “cry
wolf” fatigue.
• Calibration Strategy: For potential life - threatening emergencies, sponsors should
establish a high - sensitivity operating point that is prospectively justified based on the
severity and time sensitivity of missed cases, while also characterizing the resulti ng

©2026 Lumeris | Proprietary & Confiden tial 5
 burden of false - positive escalation. For lower - acuity conditions, acceptance criteria may
place greater weight on specificity and resource utilization. Sp onsors should report
under - escalation and over - escalation separately and explain why the selected trade - off
is clinically acceptable for the intended use environment.

Section V: A Competency - Based Approach for Premarket
Evaluation of GenAI - Enabled Devices (Questions 11 - 15)
Question 11:
CDRH is considering that clinical confirmation for a GenAI - enabled device might not require a
prospective clinical study in every case, and has described above a range of approaches of
increasing rigor and patient exposure. H ow might a sponsor select and justify a confirmation
approach tailored to a device’s intended use and proportionate to the device’s risk profile? Are
there device types or risk profiles for which one or more of these approaches would be
insufficient or ina ppropriate? How might the anticipated distribution of real - world inputs be
taken into consideration? Are there other methods of clinical confirmation that might help
inform the evaluation of GenAI - enabled devices?

Tom Health Response :
For AI - powered primar y care platform tools, including for example, care navigation, triage
support, and clinical workflow enhancement that enhance patient access and engagement, we
support clinical confirmation that is based on real world data without requiring full randomized
controlled trials (RCT).

• Standardized patient interactions, retrospective evaluation on real patient interactions,
and real time review of outputs provide superior, real - world safety data compared to a
rigid, fixed in time, slow RCTs.
• Full prospective RC Ts should be reserved almost exclusively for autonomous, closed -
loop diagnostic or therapeutic action - taking software where there is no opportunity for
intermediate clinical intervention.

Question 12:
How should sponsors achieve statistically meaningful performance measurement for GenAI -
enabled devices? Where synthetically generated inputs supplement real patient data, how
should sponsors account for differences between the synthetic and real - world dist ributions
when estimating performance, and under what conditions, if any, is it appropriate to combine
benchmarking evidence and clinical confirmation evidence to support a single performance
estimate?

Tom Health Response :
Because open - ended GenAI outputs cannot be evaluated with simple binary metrics, sponsors
should evaluate performance relative to the real - world healthcare baseline:

©2026 Lumeris | Proprietary & Confiden tial 6
Agreement Among Clinicians: Sponsors should have independent clinicians review the outputs
against clinical guidelines to assess safety and use standard measures to show how oft en the
reviewers agree in real world deployments.

Using Synthetic and Real - World Data: Synthetic data can be used to test rare edge cases, stress
limits, and confirm whether safety protections work. Results from synthetic data should not be
combined with results from real patients into one overall number. The results should be reported
sepa rately, along with evidence showing how closely the synthetic data matches real - world
cases.

Question 13:
For which clinical domains, device functions, or subpopulations is synthetic data particularly
well - suited, or particularly inadequate, as a supplement to real - world evidence? What
safeguards would mitigate the risk that synthetic data generated by models of the same class
as the device under evaluation reproduces the very performance gaps the evaluation is
intended to detect, particularly for underrepresented subgroups?

Tom Health Response :
Synthetic data allows a manufacturer to test at scale rare acute primary care emergencies and
edge cases where empirical sample s izes in standard clinical workflows are near zero. Synthetic
data is uniquely suited for validating safety - critical escalation at scale. It is also highly effective
for testing system robustness against varied patient personas, including health literacy le vels
and non - standard dialects.

Safeguards: To ensure the synthetic data does not replicate existing healthcare disparities or
performance gaps, synthetic scenarios should undergo independent clinician review and
validation prior to being ingested into the evaluation pipeline.

Question 14:
For open - ended device outputs, how should performance comparators and acceptance
criteria be selected? When a panel of qualified clinicians serves as the comparator, how should
the applicable standard (for example, the standard of care versus the performan ce of a median
clinician in practice) be defined and justified? Should generalist or specialist physicians be used
as a performance standard? When should human - AI team performance, rather than the device
operating alone, serve as the basis for evaluation?

Tom Health Response:
Standard of Care Baseline: The comparator should reflect the prevailing standard of care in the
target clinical environment, not an idealized subspecialist perfection. Holding primary care
GenAI to tertiary subspecialist standards would create an insurmoun table barrier that ignores
the actual clinical baseline.

Human - AI Team as the Gold Standard: As AI - powered primary care platform tools, including for
example, care navigation, triage support, and cli nical workflow enhancement that enhance
patient access and engagement, are designed to augment care teams, evaluation should

©2026 Lumeris | Proprietary & Confiden tial 7
consider assessing the Human - AI team performance compared to human performance alone.
This directly measures whether the care model is safer, faster, and more effective than the care
likely to occur in its absence, while preserving appropriate human clinic al accountability.

Evaluation should take into consideration the current lack of patient access and delay of care, in
weighing the performance standard.

Question 15:
Are there ways in which performance might be assessed relative to the care, technology, or
course of action likely to occur in the absence of the device, rather than to the comparators
described in this section? What approaches might be used to identify an d justify a comparator
such as unaided clinical judgment, delayed specialist review, or no intervention?

Tom Health Response :
In modern primary care, the true counterfactual to an AI tool is frequently no care, weeks o f
delayed care waiting for an appointment, or unregulated internet searches.

Realistic Baselines: CDRH should permit sponsors to demonstrate performance against these
realistic real - world baselines (e.g., comparing the rate of inappropriate ED visits or time - to- care
initiation between patients using GenAI - assisted triage and those using standard self -
navigation).

Two - Sided Benefit -Risk: Showing that an AI - enabled care model can outperform the
fragmented status quo of patient self - navigation provides clinic ally meaningful evidence of a
positive benefit - risk balance.

Section VI: Postmarket Monitoring for GenAI - Enabled Devices
(Questions 18 - 20)
Question 18:
CDRH is considering whether it may be appropriate to accept greater premarket uncertainty
regarding a GenAI - enabled device’s benefit - risk profile through greater reliance on postmarket
monitoring. Under what conditions might such an approach be appropriate , and what
characteristics of a monitoring program would need to be in place to justify reduced premark et
evidence? Are there device types or risk profiles for which this approach would not be
appropriate?

Tom Health Response :
We support this paradigm shift. For AI - powered primary care platform tools, including for
example, care navigation, triage support, and clinical workflow enhancement that enhance
patient access and engagement, accepting some premarket uncertainty before approval, with
appropriate safeguards, and mitigated by robust post market oversight, is prudent for avoidance
of unnecessary regulato ry uncertainty and delays in care improvements.

Required Safeguards: This approach is justified when sponsors implement:

©2026 Lumeris | Proprietary & Confiden tial 8
 • Active, real - time post market safety monitoring (e.g., real - time LLM surveillance for red
flag escalations, detecting drift, and critical under - escalations)
• Verifiable, rapid rollback and “kill - switch” mechanisms that allow a tool to quickly come
offline in the event of a safety concern
• Pre- established clinical escalation paths to human clinicians
• Periodic sample - based clinician review
o Ex clusions: This approach is not appropriate for high - risk, autonomous diagnostic
or life - sustaining systems operating without human - on- the - loop oversight

Question 19:
Please comment on the potential approaches to postmarket performance evaluation, including
periodic re - benchmarking, sample - based clinician review, and performance degradation
monitoring. What additional approaches should CDRH consider, and how should the cadence
and triggering events for reassessment be determined?

Tom Health Response :
Tom He alth recommends a hybrid post market protocol that ensures continuous safety without
imposing unnecessary review burdens:

• Event - Driven Re - Benchmarking: Trigger automated benchmark testing immediately
upon any update to the underlying foundation model, changes to the prompting, or
observation of performance degradation.
• Periodic Sample - Based Clinician Review: Clinicians should review a representative
sample of real - world user interactions on a defined cadence (e.g., semiannually or
quarterly). This maintains appropriate human accountability over the system’s life cycle.

Question 20:
Please comment on whether the proposed approaches to postmarket monitoring can be
facilitated by machine - based supervisory agents. What considerations, including the
evaluation and reliability of the supervisory agent itself, should CDRH take into account for
such an approach?

Tom Health Response :
Supervisory agents ("LLM as a Judge" or "guardrail" models) are vital for scalable, real - time safety
monitoring across high - volume prim ary care platforms.

Validation of the Supervisor: The supervisory agent itself should be validated against
standardized safety test suites to establish its sensitivity for detecting hallucinations and under -
escalations prior to deployment.

Human Oversight of the Supervisor: Supervisory agents should not act as autonomous
regulators; their primary role should be to flag risk interactions for further human clinician review
and adjudication.

©2026 Lumeris | Proprietary & Confiden tial 9
Conclusion
Tom Health appreciates CDRH’s thoughtful approach to moder nizing medical device regulation
for generative AI. Tom Health encourages FDA to use the responses to the RFI to develop a
balanced approach to patient safety within the context of an increasingly capacity - constrained
healthcare system. Recognizing both sides of the benefit - risk equation: the risk introduced by
an AI - enabled function and the risk patients would face if the function were unavailable.

By balancing the risk of constrained patient access in the current primary care landscape with
risk mitigat ions such as premarket benchmarking, workflows with a human on the loop,
deterministic clinical guardrails, and prioritizing post market real - world surveillance, FDA can
foster an environment where AI enabled tools safely expand primary care access and all eviate
clinician burnout. We look forward to continuing our engagement with the FDA on this critical
initiative.

Sincerely,

Tom Health LLC, a Lumeris Company

©2026 Lumeris | Proprietary & Confiden tial 10