O.N. Diagnostics, LLC

WARNING LETTER
CMS 730301

9/1/2026

Dear Ms. Wong,

During an inspection of your firm located in Berkley, CA, from March 12-17, 2026, investigators from the United States Food and Drug Administration (FDA) determined that your firm manufactures (or markets) the VirtuOst and VirtuOst Vertebral Fracture Assessment (VFA) software products. Under section 201(h) of the Federal Food, Drug, and Cosmetic Act (the Act), 21 U.S.C. § 321(h), these products are devices because they are intended for use in the diagnosis of disease or other conditions or in the cure, mitigation, treatment, or prevention of disease, or to affect the structure or any function of the body. The VirtuOst and VirtuOst VFA software products are device software functions because they analyze medical images for use in the diagnosis of existing vertebral fractures and the management of osteoporosis. As such, your firm has responsibility for maintaining full compliance with all applicable pre- and post-market requirements associated with these device software functions.

Unapproved Device Violation(s)
Our inspection revealed that the VirtuOst VFA 3.0.0 is adulterated under section 501(f)(1)(B) of the Act, 21 U.S.C. § 351(f)(1)(B), because your firm does not have an approved application for premarket approval (PMA) in effect pursuant to section 515(a) of the Act, 21 U.S.C. § 360e(a), or an approved application for an investigational device exemption (IDE) under section 520(g) of the Act, 21 U.S.C. § 360j(g) for the device as described and marketed. The VirtuOst VFA 3.0.0 is also misbranded under section 502(o) of the Act, 21 U.S.C. § 352(o), because your firm introduced or delivered for introduction into interstate commerce for commercial distribution this device with changes or modifications in the device that could significantly affect the safety or effectiveness of the device without submitting a new premarket notification to FDA as required by section 510(k) of the Act, 21 U.S.C. § 360(k), and 21 CFR 807.81(a)(3)(i).

Specifically, the VirtuOst VFA was cleared under K171435 with the following indications: VirtuOst VFA uses sagittal sections from a spine-containing CT scan, with or without contrast enhancement, to visualize and measure vertebral deformities, classify the type and grade of any existing vertebral fracture, and from this identify patients at high risk of a future osteoporosis-related fracture. This information can be interpreted by a physician to diagnose existing vertebral fractures and to manage patients for osteoporosis.

A review of the Software Version Control Log and “3.0.0 Release Notes” dated June 11, 2024, shows that a new machine learning algorithm was introduced for vertebral landmarking. A new model trained on different data, with different architecture, or optimized for a different objective may perform differently across patient populations, imaging equipment types, or clinical settings. This new feature fundamentally changes how the device performs, fails, and affects patients in ways that go beyond what was originally cleared and therefore the feature must be adequately validated. Inadequate validation of this new feature may lead to a device that is unable to perform clinically as expected, which may result in patient harm such as missed or inadequate diagnosis, absence or delay of results, leading to missing, inaccurate, or delayed patient assessment. It can also lead to incorrect patient management due to misinterpretation of device output or overreliance on device output for radiological image interpretation. Thus, a new premarket notification is required.

Additionally, the VirtuOst VFA 3.0.0 version involves two other changes that each independently raise significant regulatory concerns. First, the device has migrated from a desktop application to a web-based architecture, which introduces network-exposed attack surfaces, authentication vulnerabilities, and other cybersecurity risks inherent to internet-accessible platforms. As your firm acknowledged during the inspection, the change from a desktop application to a web-based architecture expanded the “cyberattack surface area.” Second, the technology platform has been migrated from (b)(4) to (b)(4) only, which necessitates comprehensive re-verification and re-validation of the entire software codebase, including changes to third-party libraries and dependencies. FDA has not reviewed your device's Software Bill of Materials (SBOM) or documentation of third-party components affected by this migration.

Each of these changes could significantly affect the safety or effectiveness of the device by introducing new software and cybersecurity risks. Furthermore, these changes require a new premarket notification pursuant to 21 CFR 807.81(a)(3)(i).

For a device requiring premarket approval, the notification required by section 510(k) of the Act, 21 U.S.C. § 360(k), is deemed satisfied when a PMA is pending before the agency. 21 CFR 807.81(b). The kind of information that your firm needs to submit in order to obtain approval or clearance for the device is described on the Internet at http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/HowtoMarketYourDevice/default.htm. The FDA will evaluate the information that your firm submits and decide whether the product may be legally marketed.

Our office requests that O.N. Diagnostics cease any activities that result in the misbranding or adulteration of the VirtuOst VFA 3.0.0, such as the commercial distribution of the device for the uses discussed above.

Quality Management System Regulation Violation(s)
This inspection also revealed that these devices are adulterated within the meaning of section 501(h) of the Act, 21 U.S.C. § 351(h), in that the methods used in, or the facilities or controls used for, their manufacture, packing, storage, or installation are not in conformity with the current good manufacturing practice requirements of the Quality Management System Regulation found at Title 21, Code of Federal Regulations (CFR), Part 820. We received a response from Dr. Kopperdahl, Director of Research and Development, dated April 1, 2026, concerning our investigator’s observations noted on the Form FDA 483 (FDA 483), List of Inspectional Observations, that was issued to your firm. We address this response below, in relation to each of the noted violations. These violations include, but are not limited to, the following:

1. Failure to document procedures for corrective actions and take action to eliminate the cause of nonconformities in order to prevent recurrence, as required by ISO 13485:2016, Clause 8.5.2.

Review of your CAPA procedure, DOC: SOP-017, and related records found:

A. Failure to take necessary corrective actions without undue delay. For example:

i. Within CAPA-0080, procedural updates from four other CAPA records identified as necessary to eliminate the cause of nonconformities and prevent their recurrence were not made for over a year and a half.

ii. Additionally, your organization was made aware of the underlying issue related to the need to update your (b)(4) software three times over three years. Although CAPA-0088 was opened the day before our inspection began to address this three yearlong software issue, it was unsigned (even to demonstrate opening a new record) and no corrective actions had been identified or initiated within the record.

B. Failure to clearly define the requirements to evaluate the need for action to ensure that nonconformities do not recur. For example:

i. Your procedure allows use of a (b)(4) ticket instead of a corrective action when there are “Individual and sporadic instances of issues that need correction do not require a CAPA”. This is one reason for some of the untimely corrective actions discussed in item A above. The procedure needs to more clearly define when a (b)(4) ticket may be used vs. opening a CAPA to ensure corrective action is taken appropriately.

ii. Your organization has changed the requirements used to evaluate the need for action / determine when a corrective action is necessary. CAPA-0083 included a corrective action to update to your CAPA procedure. Your findings stated the language governing when a CAPA should be opened was too broad and did not include the potential for process based CAPAs to be opened. The language targeted for update stated, “In general, a CAPA investigation will be initiated for any quality problem that is a non-conformance with respect to medical device requirements that has an associated safety hazard.”

Therefore, in revision 11 released 10/2/2024, your organization implemented a change to “narrow the CAPA triggers and place more emphasis on systemic or recurring issues”. This update also included allowance to document other issues as a (b)(4) ticket, as previously mentioned above. These changes altered the threshold of when to open a CAPA from a safety hazard focus to systemic issues and allowed more flexibility to handle “individual and sporadic instances” through the (b)(4) system. In doing so, it appears your procedure now lacks clarity for when it is necessary to open a corrective action, based on risk.

Additionally, the impact of these changes was not evaluated prior to implementation. To maintain the integrity of the QMS, all changes must be evaluated to determine their potential impact on it. This evaluation must be conducted before implementing the change.

C. Failure to require documentation of verification of effectiveness following corrective action implementation.

The procedure allows closure after “A failure investigation has been completed, a corrective action has been defined and implemented, and the effectiveness of the implemented action has been evaluated.”

Within CAPA-0080, the record includes verification of implementation, but not of effectiveness. There is no developed plan to determine how to verify effectiveness or a place to do so within the form, only a yes / no checkbox.

We reviewed your firm’s response regarding items 1A and C above and conclude that it is not adequate. We understand your intent is to update the CAPA procedure to “strengthen requirements for effectiveness verification, including predefined acceptance criteria and sufficient prospective evidence, to ensure nonconformities do not recur”, as well as train staff, conduct a retrospective review to include performing additional analysis where necessary, and document findings. You anticipate an overall timeline of 90 days to complete all these steps (early August 2026). The CAPA documenting these actions will be closed when 100% of CAPAs over a six-month period and at least three CAPAs have demonstrated correct implementation of the revised procedure. This overall approach seems reasonable, however your response is inadequate because the requirement of ensuring necessary corrective actions are taken without undue delay has not been addressed to complete necessary procedural updates, and no records were provided for evidence of implementation of corrective actions.

Your response related to item 1B states you intend to require documented risk assessments prior to implementation as part of change control procedures, establish criteria for when a change is ‘critical’ or ALARP, create a new form for this assessment following ISO 14971, train staff, perform a retrospective review of QMS changes over the last six months and act on those that meet new criteria, and summarize findings. You estimate all these actions to take about 90 days (early August 2026) and state this CAPA will be closed if no recurrence over a six-month period defined as failure to identify critical process changes or perform risk assessments of those changes. The adequacy of your response to item 1B cannot be determined as no records were provided for evidence of implementation of corrective actions.

2. Failure to adequately document procedures to ensure that purchased product conforms to specified purchasing information and plan the monitoring and re-evaluation of suppliers, as required by 21 CFR 820, ISO 13485: 2016 Clause 7.4.1.

For example: the procedural requirements in your organization’s Purchasing Controls procedure, rev 11, concerning how your firm will re-evaluate and conduct monitoring and trending of suppliers / vendors is vague. Specifically, none of these give details of when action should be taken. For example, the procedure mentions re-evaluation frequency will be every (b)(4) which maybe increased based on the criticality, but gives no specific criteria or examples of when this should occur. Regarding monitoring the procedure, it discusses “periodic progress reports and incremental deliverables” but doesn’t explain when they should be run or how those will be assessed. The extent of monitoring should be commensurate with the risk of the device, or impact on the device or QMS. The procedure also mentions trending of vendor performance but contains no limits or criteria stating when action might be necessary.

This was discussed during your recent inspection, but as it was not cited in the 483, your response did not address this violation.

Medical Device Reporting (MDR) Violation(s)

Our inspection (also) revealed that your firm has failed to adequately develop, maintain, and implement written MDR procedures as required by 21 CFR 803.17.

For example, during the inspection, your organization presented the document titled “Complaint Management Procedure”, SOP-014, Revision 15, dated January 15, 2026, as its guidance for MDR reporting. Specifically, the purpose and scope of the procedure highlights that the SOP is intended to address the requirements of 21 CFR 803. However, after reviewing the procedure, the following deficiencies were noted:

1. Your procedure does not establish internal systems that provide for timely and effective identification, communication, and evaluation of events that may be subject to MDR requirements, as required by 21 CFR 803.17(a)(1).

a. Your procedure does not include adequate definitions of what constitutes a reportable event under 21 CFR Part 803. The fact that the procedure does not include definitions from 21 CFR 803.3 for the terms “become aware” and “caused or contributed”, and the definition described in 21 CFR 803.20(c)(1) for the term “reasonably suggests”, may lead your firm to make an incorrect reportability decision when evaluating a complaint that may meet the criteria for reporting under 21 CFR 803.50(a).

b. Your procedure’s definition of “serious injury” is not consistent with 21 CFR 803.3(w) and will not allow you to correctly identify complaints as reportable events.

Specifically, DC03055, MDR Reportability Review Memorandum 4 the regulatory definition includes both injury and illness, whereas the procedure limits the definition to injury only.

2. Your procedure does not establish internal systems that provide for timely transmission of complete medical device reports, as required by 21 CFR 803.17(a)(3). Specifically, the procedure does not include:

a. Instructions for submitting information that corresponds generally to the format of Form FDA 3500A, including how you will ensure that all information reasonably known to you is submitted for each event. Specifically, which types of information corresponding generally to the format of Form 3500A will need to be submitted, including the information in your firm’s possession when the initial report is filed and any required information later obtained that was not available when the initial report is filed.

b. Instructions for complying with the 21 CFR 803.12(a) requirement to submit reports to FDA in an electronic format that the FDA can process, review, and archive.

3. Your organization’s MDR event files do not contain all documentation of its deliberations and decision-making processes used to determine if a device-related death, serious injury, or malfunction was or was not reportable under 21 CFR Part 803, as required under 21 CFR 803.18(b)(1)(i). Specifically, although Sections 2.2 and 2.3 of the procedure describe documentation requirements, your firm’s ONG-FRM-007 Event Report reviewed for Event 0047 did not demonstrate implementation of these requirements for reportability determination.

A device is deemed to be misbranded under section 501(t)(2) of the Act, 21 U.S.C. § 352(t)(2), if there was a failure or refusal to furnish any material or information respecting a device required by or under section 519 of the Act, 21 U.S.C. § 360i, including adverse event reports required under CFR Part 803.

Your firm’s response dated April 1, 2026, does not address the procedural deficiencies, given that such deficiencies were not cited on the FDA 483.

We also note your organization’s SOP-014 procedure includes references to baseline reports in Section 4.4. Baseline reports are no longer required, and we recommend that all references to a Baseline Report be removed from your firm’s MDR procedure; see: 73 Federal Register Notice 53686, dated September 17, 2008.

Additionally, we recommend your organization establish an active Electronic Submission Gateway Next Generation (ESG NextGen) production account for the electronic submission of MDR reports. FDA verified that, as of April 24, 2026, your firm does not have such an account. Information about the ESG NextGen can be found at: Electronic Submissions Gateway Next Generation (ESG NextGen) | FDA.

Your firm should take prompt action to address any violations identified in this letter. Failure to adequately address this matter may result in regulatory action being initiated by the FDA without further notice. These actions include, but are not limited to, seizure, injunction, and civil money penalties.

Other federal agencies may take your compliance with the Act and its implementing regulations into account when considering the award of federal contracts. Additionally, should FDA determine that you have Quality Management System Regulation violations that are reasonably related to premarket approval applications for Class III devices, such devices will not be approved until the violations have been addressed. Should FDA determine that your devices or facilities do not meet the requirements of the Act, requests for Certificates to Foreign Governments (CFG) may not be granted.

Please notify this office in writing within fifteen business days from the date you receive this letter of the specific steps your firm has taken to address the noted violations, as well as an explanation of how your firm plans to prevent these violations, or similar violations, from occurring again. Include documentation of the corrections and/or corrective actions (which must address systemic problems) that your firm has taken. If your firm’s planned corrections and/or corrective actions will occur over time, please include a timetable for implementation of those activities. If corrections and/or corrective actions cannot be completed within fifteen business days, state the reason for the delay and the time within which these activities will be completed. Your firm’s response should be comprehensive and address any violations included in this Warning Letter. If you believe that your products are not in violation of the Act, include your reasoning and any supporting information for our consideration as part of your response.

Your firm’s response should be sent via email to Jeff Wooley at CDRHEnforcement@fda.hhs.gov. Please include in the subject line, “CMS Case 730301” when replying. If you have any questions about the contents of this letter, please contact: Lauren Priest at Lauren.Priest@fda.hhs.gov.

Finally, you should know that this letter is not intended to be an all-inclusive list of the violations at your firm’s facility. It is your firm’s responsibility to ensure compliance with applicable laws and regulations administered by FDA. The specific violations noted in this letter and in the Inspectional Observations, FDA 483, issued at the close of the inspection may be symptomatic of serious problems in your firm’s manufacturing and quality management systems. Your firm should investigate and determine the causes of any violations and take prompt actions to address any violations and bring the products into compliance.

Sincerely,
/S/

Barbara C. Marsden
Director
Office of Regulatory Programs
Office of Product Evaluation and Quality
Center for Devices and Radiological Health