FDA Regulation of Mobile Health
Upcoming SlideShare
Loading in...5

FDA Regulation of Mobile Health



It can come as a bit of a shock to people in the ...

It can come as a bit of a shock to people in the
consumer electronics, IT and telecommunications
industries that FDA might regulate certain equipment like cell phones that companies are planning to put at the center of connected health services. My goal is to outline the factors that FDA considers when deciding whether to regulate such equipment.



Total Views
Views on SlideShare
Embed Views



1 Embed 2

http://www.linkedin.com 2


Upload Details

Uploaded via as Adobe PDF

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
Post Comment
Edit your comment

FDA Regulation of Mobile Health FDA Regulation of Mobile Health Document Transcript

  • FDA REGULATION OF MOBILE HEALTH mobi health news© Copyright June 2010 Chester Street Publishing, Inc. All Rights Reserved.
  • Contents 1 About the Author 2 Letter from the Editor 3 FDA May Regulate Certain Mobile Phones, Accessories 6 Step-by-step: FDA wireless health regulation10 How to get FDA to clear a mobile health appI7 Should mHealth companies want FDA regulation?22 How to Avoid mHealth Regulation29 Washington signals possible FDA regulation of mHealth32 Will the FDA regulate mHealth care providers?37 The Dynamic Future of FDA Regulation of mHealth
  • About the Author Bradley Merrill Thompson Bradley Merrill Thompson is a shareholder in the law firm of Epstein Becker & Green, P.C. There he counsels medical device and other life science companies on a wide range of FDA regulatory, reimbursement and clinical trial issues. At the firm, Mr. Thompson leads the Medical Device Regulatory Practice, the Clinical Trials Practice and the Connected Health Practice, and serves on the firm’s Health & Life Sciences Steering Committee. For trade associations, Mr. Thompson has served as counsel to AdvaMed for payment issues, as General Counsel to the Combination Products Coalition, and for 17 years as General Counsel and Secretary for the Indiana Medical Device Manufacturers Council. Connected Health Practice: In EBG’s Connected Health Practice, Mr. Thompson focuses on the federal regulatory requirements—FDA, reimbursement, privacy and others—that impact remote monitoring, mobile health, HIT and device interoperability. The firm’s Connected Health Practice brings together a multidisciplinary team of attorneys and consultants trained and experienced in Medicare and private insurance payment, regulatory, scientific, IT, clinical, and security disciplines. Mr. Thompson serves as outside counsel to Continua Health Alliance, conducts educational programs on connected health regulation and blogs for Mobihealthnews.com. Teaching, Writing and Serving: Mr. Thompson has taught food & drug law at Indiana University School of Law- Indianapolis and Columbia Law School. He also serves on the editorial boards for Medical Device & Diagnostic Industry (1993-present), Food & Drug Law Journal (2007 – present) and BNA’s Medical Device Law & Industry Report (2007-present) Mr. Thompson also serves as Co-Chair of the Food & Drug Law Committee of the Administrative Law Section of the American Bar Association, and as Chair of the Medical Device Committee of FDLI. Mr. Thompson has written extensively on the topics of medical device regulation, including a book entitled FDA’s Regulation of Medical Devices (Interpharm Press, 1995). He has co-authored chapters in “Off-Label Communications: A Guide to Sales and Marketing Compliance” published by FDLI (2008-2009) and in a book entitled “Guide to Medicare Coverage Decision- making and Appeals” published by the American Bar Association (2002). Honors: Mr. Thompson was included in 100 Notable People in the Medical Device Industry (Medical Device & Diagnostics Industry, June 2004), has earned an AV rating in Martindale Hubble (its highest rating), has been named a “SuperLawyer” in Indiana, has been elected as a Fellow in the American Bar Foundation and is listed in Chambers USA: A Guide to America’s Leading Business Lawyers. Education: Mr. Thompson received his B.A. cum laude, and an M.B.A. from the University of Illinois and his J.D. cum laude from the University of Michigan Law School. Page 1
  • Letter from the Editor One morning last summer I got my first email from Brad. He wrote that he and a couple of colleagues had just conducted a day-long seminar on regulatory topics for the Vancouver gathering of the Continua Health Alliance. One session was a case study of FDA regulation of a mobile health platform. “Is that the kind of topic that interests you?” Brad had asked. For the next year -- about every six weeks -- I would receive the latest chapter in Brad’s FDA regulation series. It pulled from FDA workshop meetings, political speeches, questions posed by mHealth luminaries, and Brad’s vast wealth of knowledge regarding FDA policies. Brad’s series of articles quickly proved to be the some of the most talked about features published in MobiHealthNews’ weekly newsletter. At Brad’s request, and with great pleasure, we at MobiHealthnews have compiled the series on mHealth regulation into this free special report for our readers. I am confident it will quickly become a seminal text for the budding mobile health industry. Our heartfelt thanks to Brad for taking the time to provide direction for navigating these otherwise murky regulatory waters. Brian Dolan Editor, MobiHealthNews mobi health newsPage 2
  • I. FDA May Regulate Certain Mobile Phones, AccessoriesIt can come as a bit of a shock to people in theconsumer electronics, IT and telecommunicationsindustries that FDA might regulate certain equipmentlike cell phones that companies are planning to put atthe center of connected health services. My goal is tooutline the factors that FDA considers when decidingwhether to regulate such equipment.Defining a medical device Components Vs. AccessoriesThe natural place to start is with the definition of a In the area of mobile health technology, it’s importantmedical device. Since it is so central to the analysis, to understand that an accessory or a component ofI’m going to quote the statute verbatim. Section 201(h) a medical device is itself a regulated medical device.of the Federal Food, Drug, and Cosmetic Act defines a Further, the difference between an accessory and amedical device as: component is who buys it. End-users buy accessories, while manufacturers buy components. Thus the exact“… an instrument, apparatus, implement, machine, same piece of equipment could be either an accessorycontrivance, implant, in vitro reagent, or other similar or a component depending on the target purchaser.or related article, including any component, part, oraccessory, which is … [either] intended for use in That makes a big difference in terms of applicablethe diagnosis of disease or other conditions, or in the regulatory requirements. Components are exemptcure, mitigation, treatment, or prevention of disease, from most FDA regulatory requirements, with thein man or other animals … [or] intended to affect the regulatory burdens being borne by the finishedstructure or any function of the body of man or other device manufacturer. Accessories, on the other hand,animals.” since they go right to the end user, must meet the FDA requirements before they leave the hands ofSo at a high-level, we look for two things: (1) a device the accessory manufacturer. These differences arewith (2) a medical intended use. The first prong of summarized in Figure 1 on the next page.the test — that there must be an actual product —means FDA doesn’t regulate, for example, medical The level of regulation imposed by FDA on accessoriesprocedures. The thing in question must be a thing, and and components is determined by the parent device tonot information or something else intangible. Software which they relate. So if the accessory relates to a highcan be a medical device if it’s written on computer risk device, say an implantable cardiac defibrillator, itmedia, as opposed to printed on paper. The media will be subject to a high level of regulation even if thewith the code written on it is enough of a “thing” for accessory is relatively benign in and of itself.FDA to regulate. Page 3 MobiHealthNews.com
  • Having decided that the product meets the “thing” Columbia Law School, and I generally begin thetest, determining the intended use of the article can be session by taking out a popsicle stick. To employ amuch more difficult. As a preliminary matter, in the case study, I tell the students that I’m the CEO of adefinition above you can see that the so-called medical company that makes these sticks, and I want to knowuses are very broad, and include some conditions whether I have to comply with FDA regulations. Atpeople may not ordinarily consider medical. For that point I encourage them to ask questions of me inexample, equipment used for exercise could become my hypothetical role as CEO, and then ultimately toa medical device if the claims take on more of a advise me.therapeutic nature instead of simply suggesting If they have done their homework, they will startgeneral fitness. So if the piece of fitness equipment to ask me how I promote the stick. In my answers,is specifically advocated for use in the treatment of I’m pretty coy at first, simply explaining that I sellobesity or rehabilitation of cardiac patients, it can sticks and what my customers do with them is theirbecome a medical device. Further, the definition is not business. I explain that my labeling for the productlimited to disease, but also relates to articles that affect merely identifies the product as a stick without goingthe structure or function of the body (for example, into its possible uses.pregnancy). Moreover, devices that merely monitora body function, with no therapeutic effect, can fall Hopefully my students have read enough to knowinto the device category if the intended use suggests a that the regulations define “intended use” as: “thehealth-related purpose. objective intent of the persons legally responsible for the labeling of devices. The intent is determined by such persons’ expressions or may be shown by the circumstances surrounding the distribution ofDetermining “intended use” the article. This objective intent may, for example, be shown by labeling claims, advertising matter, orFiguring out the actual intended use of the article oral or written statements by such persons or theirdepends entirely on the facts. I teach this topic at representatives. It may be shown by the circumstancesFigure 1. Types of Devices Finished Stand alone Device Accessory Component A medical device in finished form, An article intended for use in or An article intended for use in or Definition ready to use perhaps with with a finished medical device, with a finished medical device, accessories, intended for sale to intended for use by the end user intended for use by a the end user manufacturer FDA Clearance Yes, unless exempt Yes, unless exempt No required? GMPs No, but quality must satisfy Yes, unless exempt Yes, unless exempt required? finished device manufacturerPage 4 MobiHealthNews.com
  • that the article is, with the knowledge of such personsor their representatives, offered and used for a purposefor which it is neither labeled nor advertised. …” Sowhat I say in my labeling is not the last word, butultimately what matters is the totality of what I havedone to promote the article and to some extent what Iknow about how my customers are using it.Eventually my students start asking me about what If it is a medical device, what next?trade shows I attend, what types of magazines I useto advertise the sticks, what my salesmen say to This analysis only answers the threshold question ofcustomers, and what I know about the actual usages of whether an article is a medical device. If it turns outthe sticks. And it turns out, in my hypothetical, I know to be a regulated article, a second step is to figure outthat many of my customers are using them as pediatric the degree of that regulation. A fair number of medicaltongue depressors, I promote them in advertisements devices are exempt from FDA premarket clearance,in hospital journals, and at least some of my salesmen and others are exempt from the obligation to employmight encourage their use as tongue depressors. So good manufacturing practices. The risks associatedeventually my students come to the view that my with the intended use determine the level of regulatorysimple popsicle sticks might in fact qualify as medical requirements, including validation and other designdevices and be subject to FDA regulation. rigor that FDA would require.Advice for wireless health start-ups Not the end of the worldCompanies engaged in making mobile phones (or Merely being a medical device is by no meansrelated articles or software apps) need to go through the end of the world, just the starting point forthe same analysis to figure out if they are selling the analysis. Companies need to be mindfulmedical devices. They need to look first and foremost of these consequences as they develop theirto the labeling and other promotional materials they promotional programs for hardware anduse, but then also consider how they promote the software in this mobile health space. FDA isproducts. In this regard, it’s important to remember almost certainly looking.that we’re looking for either an intended use directlyas a medical device, or an intended use as an accessoryto a medical device. It’s more likely a cell phone orrelated software might end up as a regulated accessory,than a stand alone medical device. Page 5 MobiHealthNews.com
  • II. Step-by-step: FDA wireless health regulationIn the last chapter I outlined the triggers that could of the orthopedic devices, for example, are in one partcause an ordinary mobile phone to become an FDA- of the regulations. So you might get lucky and find oneregulated medical mobile phone. In this chapter I will that directly describes your product. A quick searchoutline the FDA requirements that would apply to a of the regulations revealed that the word “computer”mobile phone that crosses that line. appears in 225 regulations, “software” in 431 and “network” in 43. There is, for example, a classification To summarize the last chapter “FDA may regulate for remote medication management systems in 21 certain mobile phones, accessories”, a mobile CFR 880.6315. phone could become a regulated medical device if the manufacturer, through its words and deeds, But if you can’t find one that directly describes your conveys an intention that the phone be used product, perhaps it’s because FDA considers your in medical applications. I also pointed out that product to be merely an accessory to a “parent” medical devices come in at least three different device. I’ll give you an example. In 2009 FDA cleared flavors: (1) standalone medical devices, (2) an updated version of the Polytel glucose meter accessories and (3) components to such devices. accessory, which is a small module that plugs into the port of a glucose meter, receives data from the meter and transfers it wirelessly to an Internet capablePremarket clearance or approval communication device like a cell phone or an APT. In clearing the device, FDA agreed with its classificationIn contrast to components that are simply sold to in 21 CFR 862.1345, which covers all glucose testanother manufacturer, standalone medical devices and systems, including the “parent” glucose meters.accessories sold to end users may require some formof premarket clearance or approval. Once you know Step two. Read the second half of theyou have an FDA-regulated device or accessory, here’s classification regulation to see how FDAhow you figure that out, following a five-step process. regulates that particular article. Step one. Figure out the most appropriate FDA will assign each product into one of three classification for your product. classifications, cleverly called class I, II and III. Class I devices represent the least risk, while classThere is a bit of both art and science to this. FDA III represent the greatest. Associated with thosehas published about 1700 classification regulations. classifications are specific regulatory requirements.Each of those regulations has a description or Many class I devices will be exempt from premarket“identification” of the types of devices covered by that clearance, and some products will be exempt fromregulation. FDA has a searchable database of these other regulatory requirements that I’ll describe in aregulations accessible through their website. minute. Some class I and most class II devices require filing a premarket notification (or 510(k)) with FDA.Some articles of hardware and software are so These submissions are manageable documents thatimportant that FDA has separately classified them, compare the new device to those lawfully on theand you can find them directly through searching. The market. The specific data requirements are discussedregulations are organized by clinical application so all below.Page 6 MobiHealthNews.com
  • The highest risk devices-class III-usually requirepremarket approval (PMA) from FDA, which can Step four. Consider your options.cost millions. Most IT devices can avoid that, unlessthey are an accessory to a high risk device. If your Even once you know how a device is classified and thedevice is classified as an accessory, it is subject to all of specific regulatory requirements, you may well havethe regulatory requirements applicable to the parent options for how you get marketing clearance. Let’s saydevice. your device is in class II, and some sort of premarket notification or so-called 510(k) is required. 510(k)s Step three. Research the requirements. come in lots of different flavors, including traditional, special and abbreviated. For some, as an alternativeFDA has published scads of guidance documents to filing at the FDA, you can seek to have your deviceon its website that cover many different aspects of reviewed by an independent third-party who thenthe technologies they regulate. There are guidance certifies its review to the FDA. Going through each ofdocuments on using wireless technologies, off-the- those options is beyond the scope of this article, butshelf software, and specific medical technologies such it’s important to understand that you have options. Ias blood glucose meters. It’s important you find all of have tried to illustrate the major options inthese so-called “special controls” because you’ll need Diagram 1 below.to make sure that your product complies with thosetechnical standards.Diagram 1. Some Major Pathways to Market for IT Devices Is it a device or an Unregulated Petition for accessory to a by FDA Re-classi cation device? No yes de novo 510(k) It is PMA Does a classi cation automatically regulation cover it? Not Class III Covered Traditional 510(k) Covered Special 510(k) Exempt What options are Abbreviated 510(k) available for gaining 510(k) marketing clearance 510(k) or approval? 3rd Party Review PMA Page 7 MobiHealthNews.com
  • Step five. Determine the type of evidence needed for FDA clearance.Even more choices need to be made here. The amount In addition to the premarket clearance or approvaland type of data needed to secure approval depends question, devices must comply with other FDAdirectly on the types of claims you want to make. In requirements, as described in the next section.many cases, you might have the option to merely makea “tool” claim: a claim that your product simply doesa specific function. In the accessory example I gaveabove regarding the Polytel product, the company Quality system requirementsmakes a tool claim that its article merely connects onemedical device to the Internet. The other big hurdle is ensuring compliance with the quality system regulations. As the name suggests, theseYou might also wish to make an outcome type claim: requirements are focused on ensuring manufacturersa claim that your device will help treat or diagnose a produce quality products commensurate with thespecific disease or condition. For example: “Using this risks associated with using the device. So the exactdevice to transmit your blood glucose readings to your nature of the quality system will depend on thephysician typically allows for better control of diabetes intended use of the article. For companies that are ISOand will help you wean yourself of dependency on 13485 certified, becoming compliant with the qualityinsulin.” system regulations is mostly a matter of creating documentation systems so that you can prove yourThe types of data you need to provide FDA will compliance. More substantial changes are required ifdepend on which type of claim you make and indeed the company is only ISO 9001 certified.on the exact wording of the claim. Typically, you couldsupport a tool type claim with bench testing or other These quality system regulations apply cradle-to-grave,non-clinical evaluation. Basically you need to prove so the minute you begin the design process, the designthat your tool works. If you choose to make outcome- controls must be observed. Design Controls specifybased claims, you’ll need to prove that the device the process used and the records to be created duringindeed achieves those outcomes. That’s much harder, the design, development, and manufacturing scale-and requires testing in a clinical setting. up of a device. They extend all the way to postmarket issues such as complaint handling, risk management,If you are following the 510(k) pathway, the and failure analysis and feedback to the design andfundamental standard is whether your device is manufacturing organizations.substantially equivalent to other lawful devices. Somost submissions follow a comparative format where In the medical device world, component suppliersthe submitter compares his device to others in the are exempt from these regulatory requirementsmarketplace. (though sometimes they are contractually required).Page 8 MobiHealthNews.com
  • That doesn’t mean the components need not be high Other regulatory requirementsquality, but rather it means that the finished devicemanufacturer has the regulatory burden of assuring FDA has a variety of other requirements thatthe quality of the components it uses. While this may apply, including such things as registeringcould mean incoming inspections of raw materials, manufacturing facilities, listing the productscomponents and subassemblies, it more often means manufactured, specific requirements for investigatingthat a device manufacturer must apply all necessary the safety and effectiveness of an unapproved device,controls on a supplier-by-supplier basis to make sure export and import restrictions, and labeling andthat any controls the supplier is missing, the device advertising requirements. FDA also has a variety ofmanufacturer provides. requirements that apply to postmarket distribution to ensure that products can be identified and traced back.Adverse event reportingAs kind of a belt and suspenders, in addition to From hererequiring premarket review of the product andimposing quality system requirements, FDA expects There is no doubt that these requirements cancompanies to be vigilant for reports of people getting be quite burdensome. But to state the obvious,hurt or products malfunctioning. In some cases thousands of companies have found it possiblethose incidents might rise to the level of needing to and worthwhile to enter the medical devicebe reported to FDA. These so-called Medical Device realm. In the coming chapters, I will explore theReports are time sensitive (an assessment is due in a unique aspects of FDA regulation of software,matter of days or weeks), and require the company a business assessment of whether entering theto have in place systems for reviewing all relevant FDA-regulated realm is worthwhile, optionsincoming information to assess the potential of each for staying out of regulated territory, and somereport to be categorized as an Adverse Event. If the thoughts on where future FDA regulation couldcompany decides to take corrective action, in some go in this space.cases the company needs to notify FDA. Page 9 MobiHealthNews.com
  • III. How to get FDA to clear a mobile health app(I would like to thank John Murray of FDA, ScottThiel of Roche Diagnostics and Russ Gray of theAnson Group for their comments on a draft of thischapter. The views expressed — right or wrong — areonly the author’s and should not be attributed to thecommenters.) Most people in the wireless health industry have heard by now that FDA has started to can be divided into three categories: (1) standalone clear applications for cell phones with medical devices, (2) accessories and (3) components. indications. A widely-reported example is AirStrip Standalone are those devices that are intended to OB, cleared to deliver patient waveform data — directly provide the diagnostic or treatment, while including fetal heartbeat and maternal contraction accessories are sold directly to end-users and work patterns — in virtual real-time directly from with standalone devices. Components, in contrast, the hospital labor and delivery unit to a doctor’s are purchased by manufacturers of standalone or mobile wireless device, specifically to an iPhone accessory devices for incorporation before sale. Mobile or a Blackberry. Other software developers are device (e.g. cell phone apps) can be an accessory, as probably interested to learn when FDA clearance opposed to a component, if they are sold or even given is required, and what it takes to accomplish that directly to the end-user: the patient. They can also FDA clearance. In this chapter, I’ll address both of be standalone if they do not connect physically or those questions at a high-level. virtually to any device other than the mobile device platform. In the first chapter I outlined the factors FDA considers generally when deciding which products Understanding that is important because determines need to be regulated and which fall outside of the the regulatory requirements that apply. If the app is scope of a medical device regulation. In Chapter designed, for example, to facilitate the downloading 2, I outlined the basic steps for getting a medical of information from a blood glucose meter, the device cleared by FDA. This chapter will focus on app and maybe even the software environment are the unique aspects of those two questions in the accessories and will be regulated in the same manner context of mobile device apps. as the blood glucose meter. The classification and most of the requirements for the submission to FDA will be dictated by how the parent standalone deviceSoftware Roles is regulated. So, the Airstrip OB app is regulated as part of a perinatal monitoring system generally, justFrom those two prior chapters, it’s important to as the sensors and other hardware that gather theremember that medical devices, including software, information.Page 10 MobiHealthNews.com
  • Some apps will not be simply enablers of transmitting So the following is just my personal observationsdata from a medical device, but will actually serve about how FDA regulates software in practice, as Ia standalone purpose. From the prior two chapters, can glean from watching FDA enforcement actions,remember that it’s the claims the software developer/ podium policy, and the informal statements FDA hasseller choose to make, within reason, that triggers made in concept papers.FDA regulation in the first place, and the degree ofthat regulation when it comes to obtaining clearance.Once you properly figure out which of the three rolesthe software plays, you can figure out its regulatory Unregulated Softwarestatus. Typically that’s one of the following threechoices: In its explanation surrounding the agency’s proposed classification of Medical Device Data Systems published in 2008, FDA explains: Software that does NOT meet the legal It is FDA’s long-standing practice to not regulate those definition of a device and is not regulated by manual office functions that are simply automated FDA. for the ease of the user (e.g., office automation)… For example, the report-writing functions of a Software that does meet the legal definition of a device but is currently not actively computer system that allow for the manual (typewriter regulated, and FDA is unlikely to require like) input of data by practitioners would not be… pre-market review. [regulated] because these systems are not directly connected to a medical device. In addition, software Software that does meet the definition of a that merely performs library functions, such as device and FDA is actively regulating and storing, indexing, and retrieving information not would require a pre-market review. specific to an individual patient, is not considered to be a medical device. Examples include medical texts or the Physician’s Desk Reference on CD-ROM that are indexed and cross-referenced for ease of use.Except for a few specific exempt device typesidentified in the classification regulations, that middle FDA goes on to say it won’t regulate “software thatcategory isn’t today a regulatory classification you’ll allows a doctor to enter or store a patient’s healthfind defined in any FDA records. Fortunately or history in a computer file.” On its face, that descriptionunfortunately, depending on your perspective, FDA of unregulated software is somewhat narrowly written.has been very reluctant over the last dozen years to That is not surprising since FDA always takes andefine with any real precision its policy on which expansive view of its jurisdiction, and is not likely totypes of software must undergo premarket review and concede much ground in that regard.clearance, or even approval. The agency has held openpublic meetings and floated concept papers, and more Beyond that passage, I would add that there are tworecently has proposed a limited device classification key features for most unregulated software.for medical device data systems, but by and large hasnot with any certainty clarified its policy on when The data are entered manually; they are not inputtedsoftware trips the premarket requirement. directly from any machine that touches the patient Page 11 MobiHealthNews.com
  • or a patient specimen. That’s important to avoidbecoming an accessory to a medical device.Depending on how inputted, the output amounts In that policy, there are two categories of softwaresimply to providing the stored data back to the patient products that were technically regulated but alsoor professional. The system does not automatically considered exempt from the major requirements:guide the diagnosis, nor does it guide any other (1) general purpose articles as defined in a regulationinstrument. In other words the software does not and (2) software that involves competent humancontain any algorithms that provide clinical-like intervention. Unfortunately FDA never got aroundfunctions that go beyond what FDA often refers to as to actually codifying the competent humanlibrary functions. It merely displays the data for the intervention exemption. In its classification process,user to read and interpret. FDA has adopted certain general purpose or low risk exemptions that cover software, such as laboratoryMany mobile device apps do indeed fit this category of information management systems (LIMS) (21 CFRunregulated software. But it is important to remember 862.2100) used as calculators or data processingto conduct an honest evaluation of the intended use modules for clinical use.of your product. The evaluation should focus on theclinical intended use of the product and less on the About 7 years after FDA published the 1989technical characteristics of your software or your draft policy, it appeared FDA was moving towardsystem. In FDA’s eyes, your software product does not formalizing its computer product policy. In additionhave to provide a complete cure, mitigation, treatment, to publicly announcing that intention, FDA hostedor prevention of disease to meet the legal definition a large meeting in Washington and invited manyof a device. If your software is intended to provide stakeholders to discuss what the policy should be. Inany part of cure, mitigation, treatment, or prevention preparing for that meeting, FDA drafted a summaryof disease, FDA will probably consider it a device. of what it considered to be its then existing policyUnderstanding the limits on the unregulated category on computer products. Those workshop materialsis probably best explained, though, by looking at the explained that much of the software the agency wasother two categories. seeing constituted accessories to medical devices, and the competent human intervention concept was only intended to apply to truly standalone software. The agency also argued that the conceptRegulated Software Exempt from of what constitutes competent human interventionPremarket Clearance had become increasingly complex and difficult to administer. FDA observed:Since the late 1980s, FDA has been publicly declaringthat there exists a category of software that technically In general, to permit competent human intervention,qualifies as a medical device but for which FDA has no the software decision process must be completelyintention of requiring the submission of a premarket clear to the user, with a reasonable opportunity fornotification or approval application. For those who challenging the results. There must also be adequateare really interested in this topic, it probably makes time available for reflection on the results.the most sense to start with the “FDA Policy for theRegulation of Computer Products, 11/13/89 Draft”.Page 12 MobiHealthNews.com
  • But again, FDA never followed through to adopt a new This category is only available as an exemption fromregulation or policy. premarket clearance so long as the data set is intended for professional use and does not produce irreversibleIn early 2008, departing somewhat from the 1989 data compression.approach, FDA proposed a new category of softwarethat would fit within this general category of regulated Based on the following preamble from the proposedsoftware exempt from premarket clearance. They MDDS rule, I would suggest that through this processproposed to call the new category medical device data FDA is seriously rethinking its software policy.systems (MDDS), and they defined it to include: Since 1989, the use of computer-based products and software-based products as medical devices has grown exponentially. In addition, device interconnectivity The electronic transfer or exchange of medical device data from a medical device, without and complexity have grown in ways that could altering the function or parameters of any not have been predicted in 1989. This growth connected devices. For example, this would and expansion have created new considerations include software that interrogates a ventilator for elements of risk that did not previously exist. every 15 minutes and transfers information FDA realized that the Draft Software Policy was about patient CO2 levels to a central patient not adequate to address all of the issues related to data repository; the regulation of computer based and software- The electronic storage and retrieval of medical based medical devices. Based on this history and device data, without altering the function or the complexity and diversity of computer software, parameters of connected devices. For example, FDA decided it would be impractical to prepare one this would include software that stores ‘‘software’’ or ‘‘computer’’ policy that would be able historical blood pressure information for later to address all the issues related to the regulation of review by a healthcare provider; computer- and software based medical devices. The electronic display of medical device data, without altering the function or parameters While FDA has proposed the MDDS category, as of of connected devices. For example, this would this writing the agency has not adopted it in final include software that displays the previously form. During the interim, however, it seems to be stored electrocardiogram for a particular the best guidance available for deciding whether a patient; premarket clearance is required. The electronic conversion of medical device data from one format to another format in accordance with a preset specification. For example, this would include software that Dividing Line Between Software converts digital data generated by a pulse Requiring Premarket Notification And Not oximeter into a digital format that can be printed. Examples of medical device data In defining medical device data systems, FDA was systems that would be used in the home are systems that periodically collect data from merely trying to define one relatively narrow, cohesive glucose meters or blood pressure devices for type of data set that the agency would regulate but later review by a healthcare provider. exempt from premarket notification. However, that is Page 13 MobiHealthNews.com
  • only one example, and it is not meant in any way to The amount of time available before using thebe the only example of software that would be treated information provided by the medical softwareas regulated but exempt. Indeed my understanding device, i.e., the time until a therapeutic or additional diagnostic intervention must beis that the agency plans to publish future proposals implemented by the health care provider afterdefining other regulated – exempt and nonexempt– the results of the software have been provided.categories. Example: Is the device an EKG reading and analysis package whose output is “SHOCKBut what are software companies supposed to do in NOW” or does it provide a proposed readingthe meantime? What else fits within this regulated but with notation that the rhythm itself should beexempt category? The unfortunate answer is that this checked?represents a huge gray area. The best anyone can do Whether the data output is provided oris look at a variety of risk factors to figure out which manipulated in a novel or non-traditionalside of the premarket clearance line again a piece of manner, or whether decision trees within thesoftware falls. Based on FDA comments and actions software depart from customary use. Example:over the last 20 years, I would propose the following Do the system’s algorithms, parameters,list of factors be considered: internal decision trees, or other output manipulations depart from customary use or traditional data presentation? Whether the software is intended or Whether the medical software device provides designed to provide any real time, active, or individualized patient care recommendations, online patient monitoring functions. e.g., whether the software suggests or recommends specific treatment for a specific patient. Example: How specific is the software The capability to display, create, or detect output with regard to particular patients? alarm conditions, or actually sound an Is the software providing general advice or alarm, or the capability to create alarms information, like a library, article, or textbook, that are not already present from the or is the software designed to provide a specific connected medical devices. recommendation for a specific patient whose individual data have been entered as input? The seriousness of the particular disease or condition which the medical software Whether the mechanism by which the medical device is intended to diagnose, cure, software device arrives at a decision is hidden mitigate, treat or prevent and how or transparent, i.e., does the product use the software contributes to the user’s undisclosed parameters or internal decision decision-making for diagnosis or clinical trees or other mechanisms that are not management of the patient. Example: available for review by the health care provider. Is it software designed to call attention Example: How transparent is the software to imminent hazard conditions or is it manipulation to the intended user community? software that provides long-term storage Included in transparency is the extent to which for diagnostic information? limitations on the process are made known to the user, such as data contraction, deletion, editing, or simplification. Also, how are comparisons made to normative databases and how are normative databases created?Page 14 MobiHealthNews.com
  • Does the product provide new capabilitiesor intended uses for the user?Until FDA decides to further clarify the middle meter and regulated to the same degree. As anothercategory of regulated but exempt from premarket example, if the app is designed to help with medicationnotification, a practical consideration of those factors management, there is a specific classification forshould help the company decide whether in FDA’s such software in 21 C.F.R. § Sec. 880.6315. This caneyes the software is risky enough to require premarket obviously get very complex in an interconnectedclearance. As I said, you won’t find that in any existing system, perhaps on a wireless network, but that’s tooFDA guidance or regulation. That’s just based on much for this report.practical observation. Usually in the context of clearing an app, FDA will check to ensure that the software manufacturer is complying with any published special controls. The special controls are typically stated in FDA guidanceSoftware Requiring FDA Pre-market documents and include, for example:ClearanceIn the second chapter, I outlined generally the Guidance for Industry – Wireless Medicalapproach for securing FDA clearance. In the case Telemetry Risks and Recommendationsof software, the first step is identifying the mostappropriate classification from among the roughly Guidance for Industry, FDA Reviewers and1700 classification regulations. The word software is Compliance on Off-The-Shelf Software Use incontained in 431 different regulations, so it’s not an Medical Deviceseasy task. General Principles of Software Validation;Remember that software that accessorizes a medical Final Guidance for Industry and FDA Staffdevice is classified with that medical device. So if a cellphone app allows for the downloading of blood glucose Guidance for the Content of Premarketdata, the app is classified with the blood glucose Submissions for Software Contained in Medical Devices Cybersecurity for Networked Medical Devices Containing Off-the-Shelf (OTS) Software Device-specific guidance (e.g. glucose monitors) Page 15 MobiHealthNews.com
  • The submission will need to be based on an And of course, before you can actually bring theappropriate level of validation for the software. If the product to market, you will need to make sure thatapp is an accessory, the parent device determines your manufacturing meets the FDA requirementsthe level of validation required. If not an accessory, for quality systems. In the case of software, thoseto determine the validation required, you will need requirements are acutely felt in the development stageto figure out whether FDA classifies the software as as the software needs to be developed under special“major”, “moderate” or “minor” “level of concern.” FDA design controls and in the post-launch stage as the manufacturer deals with product recalls, updates, event reporting, product lifecycle management and so It’s major if the software directly affects the forth. patient or anyone else such that a failure could result in death or serious injury It’s moderate if the injuries would be non- serious Conclusion An app’s risk and the associated “level” determine: Those are the basic FDA requirements that apply to bringing an app or other piece of software to market in the mHealth field. the depth and degree of hazard analysis Undoubtedly, to those not accustomed to the and mitigation that is expected FDA regulated world, those hurdles might seem high. In the next chapter, we’ll tackle the the depth and degree of documentation benefits and burdens of going through those admittedly rigorous FDA requirements from a what needs to be submitted vs. merely business standpoint. In particular we’ll focus on documented the competitive advantages that can be derived from entering the regulated space, weighed the rigor applied to the verification and against the cost of achieving those advantages. validation of the software the degree to which the device manufacturer’s software development process is scrutinizedPage 16 MobiHealthNews.com
  • IV. Should mHealth companies want FDA regulation?(I would like to thank Dr. Deepak Ayyagari of SharpLaboratories of America and Dane Stout of the AnsonGroup for their comments on a draft of this chapter. Theviews expressed, right or wrong, are only the author’sand should not be attributed to the commenters.) At the risk of insulting my new friends in Silicon of artificial restraints on competition, especially those Valley, I submit that traditionally-unregulated IT from the government. In the IT industry, cooperation companies may want to adopt a different view around the development of industry standards sets the of federal regulation. Over the last couple years, rules of engagement for the market, and then everyone I’ve had the opportunity to observe firsthand the competes intensely based on those rules and execution culture clash as free-spirited, libertarian Silicon of their business plan. Innovation can flourish, with Valley meets Rockville, Maryland, the home of the upstarts appearing and challenging big, established decidedly more buttoned-down U.S. Food & Drug companies’ dominance of any particular portion of Administration. Rather than fleeing in fear of the the business. The big companies accept it because they federal bureaucracy, I would argue that at least are moving aggressively too; adjacent markets can some IT companies should consider embracing be pretty attractive if it appears there is money to be federal regulators. Well, maybe start with at least made by offering a faster, better, cheaper alternative shaking hands. to the current market leaders. The goal of unrestricted competition is great, and undoubtedly benefits In the first chapter, I started off by explaining the customers in terms of producing products that they scope of FDA regulation, and then in the second want at the best possible prices. and third chapters explained how companies could comply with FDA regulation in the cell phone However, as IT companies consider entering the accessory and software app fields. With that basic health market, they need to appreciate the differences. framework behind us, in this chapter we will In traditional IT and telecommunications markets, explore the burdens and benefits of entering FDA if a product doesn’t work, such as a server crashing, regulated territory. Yes, I said benefits. people can become really annoyed when they can’t check their email from their mobile phone every second. Inconvenient and somewhat costly, for sure, but all will be forgiven once the server is back upIt’s Okay to Consider the Benefits of and running. If it happens with any frequency, theFederal Regulation Limiting Competition company that produced the technology will get a reputation for poor reliability, and may go out ofAs I’ve learned recently working with Silicon Valley business.companies, IT companies generally seem to lovenothing more than a good, competitive, bare-knuckled But companies in the health space that producefight with their competitors, and abhor the first hint products, using many of the same components as Page 17 MobiHealthNews.com
  • what goes into the email server, face a much different space affects both the company’s cost structure andproblem set. If their product doesn’t work consistently opportunities to earn a higher return. For a specificand reliably, they can hurt people, or even cause company, this would require a fairly detailed analysis,their deaths. So we don’t, and can’t, rely simply on but let me provide you with an overview here.competition to weed out the good from the bad. To conduct this analysis, I’ve chosen the competitiveInstead, we regulate them. strategy framework developed by Prof. Michael Porter at the Harvard Business School. It’s familiarThat’s more than just a legal framework: that’s a to many and reasonably well-suited to assessing thephilosophy for how the marketplace in health works. impact of a regulatory scheme on a business. In aYou can think of federal regulation as just a bunch of pair of roughly 500 page books, Prof. Porter detailshealth and safety laws that prescriptively require that an entire methodology for considering a company’syou do this and not do that, but it’s more accurate to strategic options in light of the markets and businessthink about federal regulation as saying we only want environment in which they operate. I’ll focus on twocompanies willing to invest the significant resources tools he uses in his analysis.required to get the product right the first time theyenter the market, and to take the risk of failure tomeet high standards of safety and effectiveness. FDA Regulatory Impact on the ValueTo put it in business school terms, federal regulation Chainamounts to a significant barrier to entry for the healthmarkets. And that is quite deliberate. FDA law means In his value chain tool, Prof. Porter focuses on thedon’t enter this business unless you’re willing to do individual firm, and how the firm creates value. Init right. And, as classic economic theory suggests, Diagram 1 below, Prof. Porter shows conceptuallycompanies that are willing and able to invest the along the bottom the sequence of steps necessaryadditional resources required and take greater risk to produce a product, and in the rows at the top theget rewarded with greater return. That’s as it should overhead necessary for the firm to function.be, to protect the public from unsafe protects and tofurther the public health by encouraging companiesto invest in medical innovation. In that later regard,FDA law rewards innovation in a manner similar to Diagram 1. Value Chain Activitiesthe patent laws. We simply do not want all companiesto be able to make health care products. We choose to firm infrastructureimpose much higher standards in that field, and for human resource management m arcompanies willing and able to meet those standards gi technological development nwe allow them to earn a potentially higher return. procurement service operations marketing outbound & sales n logistics inbound logisticsBenefits and Burdens of FDA Regulation gi ar mLet’s bring it down from the 100,000 ft. view and getmore specific about how entering FDA-regulated source: Michael Porter, competitive advantagePage 18 MobiHealthNews.com
  • The specific activities that the company selects to FDA Approval. One of the most challenging stepsengage in directly determine its profit margin. Certain of FDA regulation is securing premarket clearanceactivities are high-value and produce higher margins, or approval; there is no “beta testing” allowed inwhile others not surprisingly are lower. A firm’s healthcare. You can’t offer someone the chance to signcompetitive advantage derives from its ability to select up for a discount if they help you test the product firstand execute the most highly value-added functions. to see if it works as you intended. For an innovative device, that requires substantial effort to design andMuch more could be said, but let’s move on to look then test the device to ensure that it meets its intendedat how FDA regulation impacts the value chain. use safely and effectively, and perhaps highly regulatedTo convey this impact at a high-level, I’ve drawn clinical trials. In the diagram, I suggest that the effectsthe intensity map included as Diagram 2 below. of this requirement are felt as a part of validation andTo understand an intensity map, think National design controls, as well as in the regulation of theGeographic magazine and a map showing population claims that can be made.density through colors. I’ve borrowed that approachhere to show the intensity of FDA regulation on each Marketing regulation. In addition to FDA rulesof the different elements of the value chain analysis. regarding securing approval of specific claims, other federal and state regulators impose stringentThis is a bit subjective, so others might disagree. I also requirements on the marketing function. Thusmade an assumption that the company has a basic ISO federal regulation is perhaps most intensely felt in9001 type quality system already. the marketing function of the company. Again, this will feel quite foreign in Silicon Valley, where battlesHere’s how I came up with the intensities depicted. between “Marketectures” wage almost daily. “Cloud”Diagram 2. FDA impact on value chain activities Validation firm infrastructure FDA requirements will be very similar to ISO Training human resource management m systems ar gi technological development Design Controls n procurement Supplier Controls FDA requirements will be more stringent Complaints Quality Controls service and Purchasing Validations In Process Regulation operations marketing Shipping outbound controls & sales Claims n logistics AEs inbound logistics FDA requirements gi ar will be far more m demanding than ISO Page 19 MobiHealthNews.com
  • pitches regulated by FDA would require detailed In their analysis of the opportunity health marketsatmospheric reporting of the composite gases in the present, many companies go no further than this.cloud, as well as an accurate forecast of how the cloud But this is exactly where some companies shouldwill impact the weather, good or bad. persevere in their assessments, and consider the dynamics of the medical device market place.In the postmarket servicing function, companies inthe medical device field must adopt systems designedto vigilantly watch for and report any problems,and take perhaps significant corrective action when FDA Regulatory Impact on Competitiveproblems arise. ForcesIn the quality system area, companies that are certified In Diagram 3 below, Prof. Porter depicts the fiveto ISO standards will have the most new work to do in forces that in his model drive the industry dynamics.the design control and validation areas. Those five forces include:In the modest impact category, the quality system 1. The threat that new companies will enterrequirements will require that the device manufacturer the markettake greater measures to assure the quality of inputs 2. The threat that new products will becomebeing supplied. This will include periodic auditing of substitutes for the marketed productssuppliers to ensure their systems are robust enough.The wide spread decision to outsource and off-shore 3. The bargaining power of supplierscustomer service functions, prevalent in IT, wouldhave to be considered in light of these requirements. 4. The bargaining power of customersThey could still be done, but doing so could takelonger, be more involved, and actually end up costing 5. The competitive rivalry within the industry itself.more than keeping it in-house. Diagram 3. Five Forces: Impact of FDA RegulationThe changes necessary in the actual production of theproducts are perhaps least burdensome for a companythat is ISO compliant. threat of newIn general, all of those measures: entrants Impose added cost. Lengthen lead times in product development. bargaining bargaining power of competitive power of suppliers rivalry Add complexity. buyers Can be difficult to implement from a cultural standpoint for a company unaccustomed to that environment because they require threat of discipline and rigor. substitute products And of course multiply the paperwork.Page 20 MobiHealthNews.com
  • The degrees of those threats and powers determine the ability of the company to earn a profit. With regardto the threat that new companies will enter the market, Prof. Porter identifies several barriers to entry, andone of them is government policy or regulation.Assessing the five competitive forces, in some cases the analysis reveals some interesting opportunities. Indiagram 3, again using an intensity map where darker yellow represents more competition, I suggest whereI perceive the greatest sources of competition to reside for the medical device industry generally.In the industries regulated by FDA, the greatest competition tends to be from established firms in thesame industry. This is true for the simple reason that entering the regulated industry often requires a verysignificant investment to create the innovations and establish the manufacturing systems necessary toproduce them, as well as considerable lead time to get through the FDA clearance or approval process.Thus the threat of new entrants is lower than the competition created by existing firms that have well-established systems in place for bringing new regulated products to market. Indeed a company’s ability tocope with the regulated environment becomes a key asset, determining competitive advantage.There is an important limitation to this, however. Companies that follow the premarket clearance route,if they don’t have patent or other intellectual property protection for their products, might find thatother established device companies can quickly follow them through the FDA clearance process. This issometimes referred to as a first mover disadvantage. Further, the laws administered by the FDA do notcreate any private cause of action that an individual company can use to force competitors to abide by thelaw. FDA is solely responsible for enforcement of its laws, and if the agency isn’t paying attention or simplydoesn’t have the needed resources, less reputable competitors might get away with taking shortcuts. Page 21 MobiHealthNews.com
  • V. How to Avoid mHealth Regulation Strategies for mHealth Companies Wishing to Avoid FDA Regulation(I would like to thank Leah Kendall ofEpsteinBeckerGreen and Dane Stout of the AnsonGroup for their comments on a draft of this chapter.The views expressed, right or wrong, are only theauthor’s and should not be attributed to anyone else.) Most people know the difference between tax think of it as all or nothing. In other words, a company avoidance and tax evasion. Tax avoidance is is either a manufacturer of medical devices and subject the lawful planning of such things as charitable to the full panoply of FDA requirements, or they’re not contributions to minimize taxes, while tax evasion and likewise are not subject to any FDA restrictions. is the unlawful and usually deceitful actions taken But that’s not an accurate depiction. to hide income. In this chapter, I will share some tips for the avoidance of FDA regulation, not the Instead, companies should think of FDA regulation as evasion of FDA regulation. a continuum. Diagram 1 on the next page illustrates the two extremes and a few of the cases in between. The first three chapters in this report dealt with understanding the scope and nature of FDA On the far right side, the diagram depicts the regulation for mHealth, and the fourth chapter traditional manufacturer of finished medical devices advanced the notion that IT companies wanting to that is indeed subject to all of the FDA requirements make money in health ought to consider entering for medical devices. Even here, though, there are the FDA-regulated zone. Nonetheless, subjecting different levels of FDA requirements depending on the your company to FDA regulation is not for novelty and risk associated with a particular device. As everyone, so this chapter is designed to help those outlined in the second chapter, devices are classified who have decided to stay out of the production into three different classifications, and the types and of FDA-regulated finished medical devices. In burdens of FDA regulations vary considerably. Class particular, I explain four ways to connect to health III medical devices include such things as pacemakers, markets, and the pluses and minuses of each such embody the greatest risk and thus must meet the most approach. demanding requirements. Class I devices include such things as tongue depressors and have very minimal FDA requirements. Indeed, most class I devices do not even need to be approved by FDA, and the quality system requirements might be very basic. ManyThe Binary Misunderstanding mHealth devices might fall into class I or class II. All of this was covered in much greater detail in theSome IT companies new to the health field seem to second chapter in this report.misunderstand the nature of FDA regulation, andPage 22 MobiHealthNews.com
  • Four Ways to Connect to The Health Market While Reducing or Avoiding FDA Requirements Before I go through the four strategies, it probably goes without saying that each one is predicated onOn the far left side, the diagram includes unregulated the company fully implementing the strategy in goodarticles such as personal computers that contain no faith. Anything less potentially becomes FDA lawmedical references at all and over which FDA has no evasion, rather than avoidance. Okay, so here they are:regulatory authority. It’s the stuff in the middle that isinteresting for mHealth purposes. Strategy 1: avoid medical devices and theirThe cases in the middle include, for example, accessories.companies that merely make components for othersto use in manufacturing medical devices, distributors About now you’re wondering whether this article isof finished product that have no control over the worth reading, but stick with me for a second, there’spromotional claims or the design specifications of the a more subtle and profound observation to be made.device, and contract manufacturers that make finished In your mind, go back to the very first chapter on themedical devices at the direction of another company. scope of FDA regulation. I went through an exampleThese different functional responsibilities all have of a stick, and how it could be either a popsicle sticknarrower sets of FDA requirements that apply to them, or a pediatric tongue depressor, depending on whatdirectly or indirectly. It’s important to understand the claims the company chooses to make. My point isrange of possible relationships before talking about that in many cases, the design of the product doesways to reduce or avoid FDA requirements, and not determine its regulatory status, but rather theexactly what that means. promotional claims determine its status. So if yourDiagram 1. Continuum of Potential Involvement in the Device Industry 1 2 3 4 5 6 7 8 No FDA Good Full FDA Reach Distribution Full FDA Compliance Practices & Compliance 510(k) Inspections Marketing Full FDA by Finished Compliance Full FDA GMP Compliance Device Compliance But Often MFR Compliance PMA Exempt Finished Component Contract Finished Class I And Kit Part rt Medical Class III Medical Suppliers Device Finished Medical Device MFR Medical Device MFR Unregulated Medical Device Finished MFR Article Device MFR Class II MFR Distributors, That uses Medical Retailers Contractors for Device & Servicers Compliance MFR Page 23 MobiHealthNews.com
  • company can reach its commercial objectives without A number of startups in mHealth have come up withmedical claims, and if the product has legitimate and very innovative business plans that put them squarelymaterial nonmedical uses, you might be able to avoid in the gray area between medical and nonmedicalFDA regulation by avoiding medical claims. intended uses. For example, there are companies developing strategies for remote monitoring of people,A simple cell phone provides another example. A rather than their disease or condition. There arecell phone can be promoted merely as a cell phone, gray areas between wellness programs and diseaseand no FDA compliance issues will arise. But if the programs where FDA needs to give industry clearermanufacturer of the cell phone starts to make claims guidance. Obesity, as a disease, is often difficult tothat the phone is suitable specifically for healthcare distinguish from general physical conditioning.applications, the cell phone manufacturer runs the Unfortunately, I suspect we will all need to feel ourvery real risk of turning its simple phone into a way along in the dark for the time being.regulated medical device. Finally, to employ this strategy, the maker of theRemember from the first chapter that the equipment must be duly diligent in avoiding makingmanufacturer might get into trouble making claims medical claims. That means it needs to have somethat its product is specifically intended to accompany a level of compliance and training systems in place tomedical device. That may very well make the product ensure, for example, that sales representatives do notan accessory to the medical device, which makes go rogue. Even unauthorized sales activity can comeit a regulated device. Again, claims are pivotal in back to haunt the company if the government decidesdetermining whether something is an accessory or that the company wasn’t careful enough in managingnot. its people.In the last couple years as I’ve been watching what’scoming out of Silicon Valley, I’m seeing a tremendous Strategy 2: avoid controlling the productnumber of hardware and software products that specifications or the claims made.probably could be sold as unregulated articles, butwhere the manufacturer, possibly quite inadvertently, Most FDA requirements, including the need to obtainis making claims that would cause FDA to regulate FDA clearance or approval, and the responsibility forthem. FDA is stretched pretty thin these days, so reporting adverse experiences fall on the companythey aren’t watching everything coming out of the IT that owns and controls the product specifications andindustry, but someday I suspect FDA will get more the claims made. Because most of the risk of a medicalactive in this space. device stems from its design and the claims made about it, whoever controls those two features has mostThere are limits to this strategy. I can’t make a of the FDA compliance responsibilities. So, if you don’tpacemaker, for example, and try to pass it off as a want those responsibilities, don’t own or control thosesimple, generic piece of electrical equipment. In two features of the device.designing the pacemaker, I’ve done too much to makethe design specific to a medical use to later disclaim Some examples probably would help. In most cases, athat use. Remember intended use is judged by contract manufacturer does not control the productwords, actions, and in some cases, inaction. If you’re specifications or the claims made about the product.interested in this strategy, you ought to go back and That’s true even if the contract manufacturer producesreview the first chapter of this report. finished product and drop ships it to the ultimatePage 24 MobiHealthNews.com
  • purchaser on behalf of the specification owner. In discussed. Even though the article is a finished one,that case, FDA looks to the specification owner for if it is bundled together with another product beforecompliance with most of the agency’s requirements, it is sold to the end user, the company that does theeven if the specification owner never even touches the bundling has responsibility for ensuring that eachdevice. product in the bundle has the requisite regulatory compliance. Sometimes the supplier for the article toIndeed, ownership of the product and the control of be bundled will undertake compliance with the FDAthe specifications and labeling determine regulatory requirements itself, and sometimes the bundler takesresponsibility instead of who in fact engaged in the that job. But because the bundler is considered to owndesign process or wrote the label. Companies often the specifications of the bundle and whatever claimsask a contract manufacturer to help with the design are made for the bundle, it generally has the ultimateprocess, or enlist the services of an engineering firm. regulatory responsibility.None of that matters. The only thing that mattersis who, at the end of the day, owns the product and Let’s take, for example, a common cell phone,controls the specifications and the label for the hypothetically call it a mePhone. If the cell phoneproduct. manufacturer makes no medical claims about it, the cell phone manufacturer will have no direct FDAThis control rule is also the basis for organizations responsibilities. But let’s say a blood glucose metersuch as distributors and retailers to pass regulatory manufacturer claims, in promotional materials, “ourresponsibility up the chain of distribution to meter will pair with the mePhone to download datawhichever entity controls the specifications and the for analysis on our special app.” Arguably the bloodlabeling. Although distributors and retailers have glucose meter manufacturer has made the mePhonelimited FDA responsibilities, the responsibilities and the app into components of its medical devicefor seeking FDA clearance and ensuring the quality system. So the blood glucose meter manufacturerof the product remain with whoever controls the may, for example, either need to prove through a riskspecifications and labeling. assessment that mePhones available in the market place will remain suitable for that intended use, orComponents suppliers similarly avoid much of the need to enter into an agreement with the mePhoneonerous elements of FDA regulation. If a company maker such that the two companies, throughmakes an article that is incorporated into a finished cooperation and control, will ensure the futuremedical device, the maker of that component is not compatibility of the two devices. I’ve kept this simpledirectly subject to FDA regulatory requirements but in real life these facts are usually much morefor premarket clearance or even the quality complex.system requirements. Instead, the finished devicemanufacturer is obliged to have in place supplier I want to underscore something I said earlier:controls sufficient to ensure the quality of the almost none of the organizations in this section arecomponents it uses. These controls might include, for completely outside of FDA’s jurisdiction. They all haveexample, periodic inspections of suppliers. some, albeit perhaps minor, FDA responsibilities. Even distributors and retailers have to ensure theirAnother strategy is to supply finished medical devices promotion remains consistent with the approvedto a firm that will co-package its own device with labeling, and their facilities appropriately safeguardyours. From a regulatory standpoint, this is essentially the integrity of the products. Components suppliers,the same as the component supplier scenario just while technically exempt from the quality system Page 25 MobiHealthNews.com
  • regulations, often must nonetheless ensure that they It probably won’t surprise anyone to know that thereare not selling adulterated components for use in are whole industries designed to conduct variousmedical equipment. responsibilities of medical device specification owners in compliance with FDA requirements. For example,Over the last several years, I have read a dizzying array there are clinical research organizations that canof corporate agreements that provide for various kinds do all of the clinical research, soup to nuts, and oneof collaborations like these between companies. Some of their main selling points invariably is that theyof them are fashioned as supply agreements, while take responsibility for the FDA compliance for thatothers look like contract manufacturing agreements, function. There are regulatory consultants who canand yet others look like intellectual property license quite ably prepare premarket submissions. There areagreements. contract manufacturers who specialize in producing product under FDA quality system requirements,As a regulatory lawyer, when I read these agreements, and there are other consultants who can help bringoften I’m asked to make a judgment as to who has the specification owners’ facilities up to code, so tothe FDA regulatory responsibilities. And sometimes, speak. There are design organizations well-versed inhonestly, it just isn’t clear. I’ve read agreements where conducting the design process in compliance withall the specifications and promotional claims have FDA design controls. Bottom line: if there’s someto be mutually agreed upon between two parties. In feature of FDA regulatory compliance that makes youother cases, one party maintains a general level of nervous, there’s probably a whole industry out therecontrol over the specifications and claims, while the quite willing to help you do it.other party is able to exercise wide latitude withincertain limits. In those cases, where it is genuinely That said, it bears repeating that you can contractunclear which party has the FDA responsibilities out the work but not the responsibility. If yourunder the regulations, I believe FDA permits the organization is the one that controls the specificationsparties to specify in the agreement who has those and the labeling, your organization will bear ultimateresponsibilities, so long as that division is reasonable responsibility for FDA compliance. As a practicalto resolve the gray area. So my advice: have your matter, if you choose to contract out any of that work,regulatory lawyer work closely with your corporate it means you have the obligation to be duly diligentlawyer to make sure that your various collaboration in selecting the right qualified firm to help you doagreements specify a reasonable – and your intended the work, and providing reasonable oversight for the— division of labor on the regulatory compliance side. function. So the handoff isn’t complete.Strategy 3: contract out the hard stuff. Strategy 4: sell a service or be a user, not a product producer.Even if your company markets what is admittedly amedical device and controls the specifications and the This strategy is sometimes risky, but sometimes itpromotional claims so that your company is clearly can work. FDA’s jurisdiction is very clear: the agencyregulated by FDA, that doesn’t mean your company regulates products. In the very first article, I discusseditself must do the hard stuff. The regulatory work can the need for a physical product that is the subject ofgenerally be contracted out, even if the regulatory FDA regulation. FDA does not regulate services, norresponsibility has to remain with the specification do they regulate the practice of medicine.owner.Page 26 MobiHealthNews.com
  • That circumstance has led some professions to be able intrusion. The sixth chapter in this report will discussto do things that product manufacturers and sellers this latitude specifically.cannot. For example, clinical laboratories routinelydevelop their own clinical tests that they use with theirown customers. For decades, FDA has taken a nearlyhands-off approach to that practice, saying that clinical The Trade-offslabs are sufficiently regulated under a different pieceof legislation, the Clinical Laboratory Improvement As Milton Freidman observed, there ain’t no suchAmendments of 1988. Likewise, pharmacists who are thing as a free lunch. Each of these strategies involvesregulated under state pharmacy laws have a certain trade-offs, and I’ve tried to depict those at a high-levellatitude to compound drugs. In these cases, FDA has in Diagram 2 below.decided that these are professional service businessesrather (already regulated by others) than the sellers of As with some of my other diagrams, this one reflectsdevices or drugs. subjective judgments concerning the magnitude of the benefits and burdens associated with a few of theConceptually, it may be possible to position certain strategies. I’ve used blue stars to depict features wherehealthcare services as services, rather than the sale more is better, and I’ve used black stars to indicateof products. But be mindful that this is not simply attributes where less is better.converting outright sales to rentals. That makes nodifference to FDA. Further, as you might guess, if So, if we look in the column for FDA regulateda particular operation starts to look too much like articles (#8 for class III), we see my assessment thatmanufacturing, FDA will regulate it. My only point the potential profit margins are the greatest and theis that healthcare professionals have a certain latitude product life cycle length is the longest and barriers toto provide services to their patients without FDA entry are the greatest, but on the negative side internal Diagram 2. Trade-offs FDA Contract Component Not Regulated out tasks supplier regulated 8 5 2 1 Profit margins Product life cycle length Internal over head costs Barriers to entry Page 27 MobiHealthNews.com
  • overhead costs are the greatest. I chose to characterize climate for US industries over the past forty years,product lifecycle length as good simply because it calculates the average return on assets (ROA) for themeans the company has a longer time in which to entire U.S. economy had fallen to almost one-quarterrecoup its investment. I realize some IT companies of its 1965 levels by 2008, while performance in thelike the short product lifecycles because they consider Health Care industry has run contrary to the trend.speedy new product innovation to be a competitive That occurred while the ROA in healthcare rose fromadvantage for the firm. 1.7 percent in the early 1970s to 3.8 percent in the same period, nearly doubling.On the other end of the spectrum, I indicate thatunregulated articles normally have much lower profit Choosing a strategy is a very complicated exercisemargins and shorter product lifecycles and fewer that involves looking at these issues, plus most of thebarriers to entry, but lower overhead costs. However, competitive issues discussed in article 4 of the series.I’m sure everyone can think of examples where that’s The dynamics of the marketplace and the competitivenot true. In some cases companies are able to develop strengths of the firm itself will play major roles in anypatent protection around truly novel technologies assessment of the optimal strategy. My only point hereand earn tremendous profit margins over the full is that each strategy has its own rewards and risks.length of the patent life. Further, the development ofthose innovative products might be a tremendouslyhigh cost. But I’m treating those as the exception,not the rule. Perhaps I’m wrong, but in the consumerelectronics area, it seems as though competition isfierce and technologies quickly become commoditized Conclusiondespite whatever patent protections might be available. This chapter is meant to give you a high-levelIn the middle you find compromises between those understanding of some broad strategies fortwo extremes. In scenario 5 where the company avoiding or at least reducing your company’ssimply contracts out certain difficult tasks, the profit FDA compliance obligations. Within each ofmargins go down correspondingly as the costs of these broad strategies are multiple variationscontracting go up, but the company still benefits from that raise complexities well beyond the scopesome barriers to entry and earns a comparatively of this chapter. The last strategy, selling servicesbetter profit margin than the far right side of that or being a user of products, is complicatedtable. Likewise, component suppliers often enjoy fewer enough that it deserves its own chapter. Thebarriers to entry and have comparably lower profit next chapter will focus on hospitals and othermargins to the finished medical device manufacturers, providers of care that might employ their ownbut they also face a lower cost structure. tailored technology to diagnosing, monitoring or treating patients, and the corresponding FDAThere is a quantitative basis for this judgment that obligations that may apply.bears noting. According to Thomson Reuters, medicalequipment manufacturers enjoy an average five-yeargross margin of 59%, compared with 45.8% for theS&P500. Recent research coming from the DeloitteCenter for the Edge, which has studied the businessPage 28 MobiHealthNews.com
  • VI. Washington signals possible FDA regulation of mHealth“Under the Federal, Food, Drug, and Cosmetic Act,HIT software is a medical device.” That’s according toDr. Jeff Shuren, the new director of the Device Center What happened?within FDA. Yikes. In February 2010 Dr. Shurentestified at a hearing of the HIT Policy Committee, At the hearing, after expressing his view that HITAdoption/Certification Workgroup. The workgroup software is a medical device, Dr. Shuren observed FDAinvited numerous speakers from different sectors has “largely refrained from enforcing our regulatoryto discuss the safety of HIT, and possible regulatory requirements with respect to HIT devices.” That, Dr.approaches. Shuren suggests, is about to change. In explaining the change of heart, he revealed FDA has received 260Dr. Shuren’s conclusion portends a new and perhaps voluntary reports of HIT-related malfunctions withmore demanding regulatory environment for the potential for patient harm. Of those reports, 44mHealth. So far in this report, I’ve outlined the FDA included injuries and six even reported deaths. In arequirements that might apply, depending on the table attached to his written testimony, he providedcircumstances, to the hardware and software used in de-identified examples of these reports, several ofmHealth. Notice how I qualified that. I’ve suggested which involved one patient’s data being substitutedthat manufacturers should be aware of certain nuances for another’s. Since FDA at this juncture only relies onin FDA law related to intended use claims and other voluntary reports, Dr. Shuren asserted this might belimits on the scope of FDA regulation. the tip of an iceberg.But in his written statement, Dr. Shuren did not In talking about how these products operate, Dr.equivocate. He did not limit his conclusions, for Shuren observed that HIT software applicationsexample, depending on the specific intended uses for typically do not operate as standalone devices.the HIT. He just swept it all into FDA regulation and Instead, they are interconnected with one another intomoved on. I don’t know whether Dr. Shuren and I networks of varying degrees of complexity. Soundswould truly disagree on the scope of FDA regulation if kinda like mHealth software.we discussed it, but he seems to want to move quicklypast that to talking about how FDA should regulate Dr. Shuren’s bottom line: while HIT software has thethis area. potential to improve patient care, given the reported safety issues, federal regulation is needed and FDA isOn the eve of the hearing, Sen. Grassley, the the right agency to provide that oversight.ranking Republican on the powerful Senate FinanceCommittee, sent out letters revealing his interest in As to what that oversight should look like, he seemedFDA regulating HIT. These events are significant and very open to a range of possible solutions. Dr. ShurenI want to discuss what happened, and its implications described three different possible regulatory strategies.for mHealth. At the lowest level of oversight, HIT vendors could register with FDA and be required to file reports on Page 29 MobiHealthNews.com
  • adverse events associated with their products. In themiddle tier of oversight, on top of that FDA could What does all that mean forrequire compliance with its quality system regulations. mHealth?These regulations operate similar to ISO standards,but can be more demanding in that they require such I’ll offer seven observations.things as rigorous design controls. As the highest levelof possible oversight, these HIT software products First, when electronic stuff directly impactscould be subjected to the premarket clearance or health, the folks at White Oak get interested. It’sapproval scheme used for other medical devices. That really that simple. They take the public healthapproval scheme is itself a tiered approach based on very seriously, and any IT people new to therisk. health industry need to appreciate that.Just before the hearing, anticipating FDA’s testimony, Second, when confronted by a situation suchSen. Grassley sent HHS Sec. Sebelius a letter asking as this, FDA’s natural reaction is to interpret theher to explain the Department’s approach to assuring scope of their authority very broadly, and thenthe safety of electronic health records, subsidized by propose a tiered approach based on risk. Sothe $20 billion investment in the stimulus package. He they want everything in the tent, but once in therecited concerns he’s heard from the public about HIT tent they’re willing to make distinctions. A lotproducts that don’t function properly, and hospital of people back in 2008 thought FDA’s proposedadministrators and HIT vendors who turn a deaf ear regulation on Medical Device Data Systemsto complaints. Sen. Grassley suggests FDA revisit its was expansive, but Dr. Shuren’s declaration thatresponsibilities in regulating HIT products. HIT software is a medical device is orders of magnitude broader in scope.In his letter, quoting from a 1997 article in the Journalof the American Medical Informatics Association, Third, FDA is not deterred simply because aSen. Grassley points out that industry groups regulatory task is complex or the technology isdeveloped a consensus approach to regulation 13 important to the point where speedy innovationyears ago. He asks what progress the Department has is desirable. If that were the case, FDA would’vemade in evaluating those recommendations. Those abandoned regulating pacemakers long ago.recommendations included FDA regulation of higher- Actually, high complexity and high public-risk HIT products, the adoption of industry codes to health importance are archetypal circumstancesallow for self-regulation, and the use of so-called local for FDA to get involved.or regional software oversight committees to provideadditional protection. The article suggests these Fourth, prior to this hearing, our orientationcommittees would be patterned after institutional was to think about traditional medical devicesreview boards which monitor clinical research at as the stuff that touches the patient, and thenhospitals and other such institutions. to believe that the software and hardware that moves farther and farther away from thatSen. Grassley, that same day, sent a letter to HIMSS, patient contact is less likely to be regulated.asking for the society’s position on these issues. The But the conclusion that FDA can even regulateSenator also had sent letters earlier to hospitals and the electronic health record (in many cases theothers trying to gather information. He would appear point farthest from the patient) means that weto be on an earnest campaign.Page 30 MobiHealthNews.com
  • now need to rethink the agency’s view on all the stuff that connects those two points. We must think aboutthe various hardware and software tools used for the communication between those elements.Fifth, from there, it is a short hop to looking at the hardware and software that typifies mHealthapplications. If the sensor that collects the data from the patient is a medical device, which we always knewif the use was medical, and if the EHR that is the ultimate repository of that information might also be aregulated medical device, we need to seriously think about whether FDA intends to regulate cell phonesthat are anything other than generic communication instruments. In the first chapter, I described howFDA might indeed regulate cell phones based on the claims made about them. That was theory, which nowseems more likely to materialize as reality. As I did in the first chapter, I would argue that a phone for whichthe seller makes no special medical claims is not a medical device in the hands of that seller. But any movetoward suggesting that the phone is a specialized tool useful for medical communication apparently meansFDA might get interested.Sixth, frankly I interpret Dr. Shuren’s comments as the beginning of a conversation. I did not hear himdogmatically say what the future will look like. Quite the opposite, I heard him reaching out to stakeholdersfor input. While he was fairly emphatic on the point that these software products are within their legalauthority, he was expressly inviting comments on the degree of regulation required. I did hear him put astake in the ground on the issue that something should be done, and I think industry needs to respond. TheFDA public meeting on interoperability held during the last week of January similarly showed a willingnessby FDA to collaboratively discuss the best approach.And seventh, however the HIT and mHealth industries respond, as with anyone who participates in thehealth industry, the approach will need to meet one critical criterion. As a wise, old food and drug attorneyonce told me (please don’t tell my Dad I called him “old”), it all starts and ends with concern for the patient.Whatever approach emerges, whether it’s FDA regulation or a voluntary industry code that allows for self-regulation, it needs to have as its essence a focus on protecting the patient.In the last chapter of this report, I will offer some views on specifically where I think the regulatoryenvironment is going for mHealth. But before I get there, my next chapter will focus on FDA’s relationshipwith hospitals and other users of the technology. I’ll be examining what discretion users have to modify thestuff they buy. Hopefully you’ll find it useful. Page 31 MobiHealthNews.com
  • VII. Will the FDA regulate mHealth care providers?(I would like to thank Tim Gee of Medical ConnectivityConsulting and Mike Robkin for their comments ona draft of this chapter. The views expressed, rightor wrong, are only the author’s and should not beattributed to anyone else.) At mHealth meetings, I keep hearing representatives from hospitals and other healthcare caregivers say FDA Care Provider Regulation Examples they don’t believe FDA regulations extend to them. They seem to believe that an institution must have If, as an example, a large hospital were to buy a a smokestack and an assembly line before it needs medical device company, FDA would not all of a to worry about FDA regulation beyond clinical sudden lose authority over the products the medical research. But that’s just not true. FDA can regulate device company sells. In fact, it’s actually somewhat even those engaged in the practice of medicine, if common for FDA to regulate activities of healthcare they are also engaged in FDA-regulated activities. providers and professionals who tread into product waters. I’ll give four examples. FDA regulation covers making “devices,” regardless of who engages in that activity. In this report, I’ve First, over the last couple of decades, in FDA’s view described the types of hardware and software FDA some pharmacies went beyond the traditional practice might regulate as “devices,” and provided some of pharmacy services into the production of new background on what the regulatory framework looks like. In the last chapter, I noted that recent drugs. Pharmacies have always compounded drugs, activity at FDA suggests the agency is preparing which can include mixing various ingredients to make to expand its scope to most areas of HIT, and by them taste better or easier to digest. But according to implication into both the patient-end and the FDA, in some cases pharmacies started to basically caregiver-end of mHealth. In fact, as revealed by the make their own versions of commercially-available Huffington Post, in February of this year, FDA sent drugs. Apparently some of those pharmacies also a letter to 350 hospitals inviting them to voluntarily did so in advance of receiving a prescription, and report problems with HIT systems (including EHRs in large quantities unrelated to any one patient. So and hand-held devices), as a part of FDA’s MedSun FDA adopted an enforcement policy declaring those program. activities to be regulated drug manufacturing. In this chapter, I review examples of where FDA Second, some clinical laboratories develop their own has regulated caregivers to identify the factors that chemical reagents and software for conducting tests on lead the agency in that direction, and provide a blood and other specimens. FDA declared it has the high-level overview of the relevant law. With that as background, I also examine some mHealth right to regulate those chemical products just as if they care provider practices that might end up FDA- were made by commercial manufacturers. Indeed, regulated, and offer suggestions for how care FDA has proposed to regulate a subset of laboratory- providers can avoid FDA regulation if that prospect developed tests that combine multiple variables (e.g. doesn’t excite them. gender, age, and weight) using an interpretationPage 32 MobiHealthNews.com
  • function (i.e. algorithm) to generate a patient specific to be thrown away, FDA says in industry guidanceresult. that the reuse is a new use beyond what the original clearance contemplated. As the promoter of the newThird, physicians and other clinicians sometimes use, the hospital needs to satisfy FDA regulatorydirectly sell drugs to, or use medical devices on, requirements just as any other manufacturer, securingpatients. When they do so, these clinicians also might approval and following good manufacturing practices.promote their services. If they promote uses the FDAhas not approved for the products, FDA may enforce The point of these examples is FDA has shown noits regulatory requirement on the caregivers. In the reluctance to impose its requirements on any type1960s and 70s, FDA took several clinics to court that of healthcare organization that engages in what thewere hawking various remedies for cancer and all sorts agency believes to be manufacturing. Smokestacks areof other maladies. As recently as last year, FDA went not required.after a clinic that was offering hyperbaric chambersto treat conditions like stroke, coma, and multiplesclerosis. When the clinicians stand to directly gainfinancially and use aggressive promotion beyond thecleared label, FDA tends to get involved. Legal OverviewFourth, and perhaps most analogous to mHealth, A warning to lawyers: this is not a law review article.FDA regulates the hospital reprocessing and reusing These issues are complicated, but I’d like to distill theseof “single use devices.” Manufacturers of disposable complex laws down to an executive summary.products do not validate cleaning and re-sterilizationof their products. So when hospitals decide, as a Being a math nut, I developed the following formulamatter of saving money, to reuse devices intended to describe how FDA jurisdiction is established:Diagram 1. Forumla for FDA Jurisdiction Medical Device + Connection To Commerce = FDA Jurisdiction Device + Intended Use + Held for Sale + Interstate Commerce = FDA Jurisdiction Page 33 MobiHealthNews.com
  • In its simplest terms, FDA regulates medical devices who are regulated by state boards of medicine underthat have an adequate connection to commerce. As professional standards, with regard to the activitiesalready mentioned, in the first chapter I described traditionally within that realm. The statute does notwhat it takes to be a medical device. The definition contemplate giving freedom to software engineersincludes both a tangible device such as software and working away from patients, developing software andan intended use for a medical purpose. In the last hardware configurations.chapter, I explained how FDA may be treating eventhe back-end HIT systems of mHealth providers as It is also true that manufacturing custom devices fallsregulated articles. within an exemption from most FDA regulations. While the exact scope of that exemption has been theSo the question becomes whether these articles in subject of much debate, most agree the custom devicethe hands of hospitals and other providers satisfy exemption is directed to the practice of tinkering withthe connection to commerce necessary for FDA approved devices to make them suitable for individualjurisdiction. One piece of that required connection patients or individual doctors or other professionals. Itis the interstate element. While I won’t bore you with does not contemplate producing HIT systems used bya dissertation on interstate commerce, most lawyers multiple patients or multiple caregivers.realize that almost any commerce now is connectedenough to interstate commerce to give the federal The bottom line is that the Act can quite comfortablygovernment jurisdiction. Indeed, in medical device be read as applying to hospitals and other caregiverslaw, that connection is presumed. engaged in the development and production of software and hardware configurations that supportThe Federal Food, Drug & Cosmetic Act says that if mhealth.an organization, when holding a device for sale, doesanything to cause it to be “adulterated or misbranded”,including promoting for an unapproved use, theorganization has committed a prohibited act. So in this Implicated Hospital Activitiescase the issue really comes down to whether an articleis “held for sale.” Broadly speaking, there are a variety So what mhealth hospital activities might fall withinof judicial cases over the last 40 years which suggest FDA regulation? The following are just hypotheticalthat healthcare providers may be holding devices for and broad categories of activities that under certainsale if they resell the device to the patient, or even use circumstances FDA might decide to regulate.the device on a patient. When enforcing this particular Let’s say a hospital wants to use mhealth to betterprovision, FDA seems to look for instances where the manage the care of people with diabetes. Let’s also saycaregiver is in the distribution chain and engaged in there are commercial products that allow people withpromotion. diabetes to download their glucose readings into an app on their smart phones. As I’ve explained before,Upon learning this, many doctors will quickly point that app is quite likely to be FDA-regulated itself. Let’sout that they are engaged in the practice of medicine further say the plan is for that app to transmit the dataand section 906 of the Act says that FDA will not back to a hospital.regulate that. That is true. But there is a line thedoctors can cross leaving the practice of medicine Now here is where it gets interesting. What if thebehind and entering the business of selling devices. hospital wants to develop its own proprietaryThe statute contemplates giving freedom to those system that sits on its own servers to collect the dataPage 34 MobiHealthNews.com
  • from patients and manage a database into whichphysicians can tap? Let’s say the hospital pursues work with an accrediting organization or somethis route because either it’s simply not satisfied with other body that could oversee this activity,the commercially-available software products, or they may well keep FDA from getting involved.there’s some need to develop a better, more integrated However, it’s unlikely the current CCHITapproach that fits the hospital’s legacy systems. certification is demanding enough to give FDA much comfort.That proprietary system might be FDA-regulated.Even though the system is one-of-a-kind, in this Second, these hospitals and clinics may wishhypothetical it is used for each and every patient to avoid mhealth applications that involveenrolled in the program. If that system hiccups and too much public health risk. That includesswitches the identities of two patients, care can be the disease or condition being treated (canceraffected. compared to sinus infections) and the clinical role of the technology, as well as the noveltyCompounding this, hospitals are apparently starting of the software applications. FDA is much lessto sell access to their own HIT systems to smaller likely to regulate software applications thathospitals and physician practices. HealthLeadersMedia merely embody tried and true algorithms thandescribed this recent trend. In these cases, the those that advance novel approaches. Further,hospitals risk even more likely becoming resellers of the more proactive a hospital is in conductingthe software. That practice frankly makes it easier for quality assurance of the kind a manufacturerFDA to assert jurisdiction. would pursue, the less likely FDA will regulate. Third, the hospital should stay as far away Avoiding FDA Regulation of Care as possible from the actual parent medical Providers device. FDA is more likely to regulate software or hardware that more directly accessorizes a As before, I’m not giving advice on the evasion blood glucose meter or other traditional medical of detection, but rather on staying outside of the device. Further, the less tailored the software regulated territory. The following is merely my or hardware is to the particular medical device, personal list of eight factors that may keep FDA the less likely FDA will regulate. These factors from deciding to regulate a hospital’s software or all revolve around close functionality, not the hardware development. physical proximity of the hardware or software to the medical device. First, it would help if some regulatory authority stepped in and oversaw this area of hospital Fourth, FDA will be less likely to regulate activity. In the examples above, FDA was most hospitals if the hospital is filling an important likely to stay away from regulating a given void. If there are already commercially-available activity if the agency felt another agency already products and the hospital is making its own was doing the job. FDA avoids duplicating either to save money or because of some other the efforts of the state boards of pharmacy, idiosyncratic preference, FDA may view the state boards of medicine, and federal and state activity as trying to skirt its authority. In a regulators of clinical laboratories. If hospitals fast-moving area like mHealth, the question Page 35 MobiHealthNews.com
  • is not only whether there already is a product Conclusions available commercially, but whether there could be a commercial product. FDA would not want At the end of January 2010, FDA held a public to see hospitals jump in simply because they meeting on the interoperability of medical are impatient with commercial manufacturers devices. At that meeting, many of the speakers conducting a more diligent but time-consuming talked about the need for systems integrators. development process. The favorite analogy was the aircraft industry where two primary manufacturers are big Fifth, in all of the examples above where FDA enough to set specifications for individual chose to regulate, the agency was responding to component suppliers to assure interoperability. aggressive promotion. The more aggressive the By analogy, some people at the meeting promotion and the more outside of traditional suggested hospitals and other end-users play FDA clearances, the more likely FDA is to that role with medical devices. regulate. For mHealth, that’s problematic if neither the Sixth, scale is a big factor. In nearly all of the systems integrator nor the individual component examples above, FDA only got interested when suppliers secure the necessary FDA clearance the practices grew big. That’s a practical factor for the system as a whole. FDA regulates systems in the sense the technology starts to affect more as systems. So if the individual component patients, and commercial manufacturers could companies don’t take on the responsibility of actually supply that need. FDA compliance for the system, it’s up to the integrator. Perhaps some hospitals want to take Seventh, sharing the hardware and software on that role and secure the necessary clearance with others makes it easier for FDA to assert the from FDA. That could make some sense. hospital is in the business of reselling. But frankly it seems far more likely that an independent third party would play the systems Eighth, and perhaps most obviously, if integrator role, securing FDA clearance, and the hospital is engaged in modification of then selling that system to multiple hospitals and commercial systems, staying within any existing other caregivers. Either way, FDA will want to FDA clearance avoids FDA interest. Obviously make sure the systems are safe and effective. “modification” can encompass a wide range of activities from life-critical changes to changes in There are probably many different ways FDA can the user interface, and configuration changes to assure the safety and effectiveness of the systems. hardware and network design and support. The In the next chapter I’ll offer some suggestions for regulatory risk of each type of change needs to where I personally think all of this is heading. be considered on a case-by-case basis.Page 36 MobiHealthNews.com
  • VIII. The Dynamic Future of FDA Regulation of mHealth(Several friends commented on a draft of this chapter, and I would like to thank them.)Warning, this chapter contains explicit and sometimes graphic depictions of possible FDA regulation.If you’ve hung in until now, you know I’ve been leading up to this last chapter in which I offer some predictionsas to where FDA regulation will end up with regard to mHealth technology. Rather than just give you mypredictions, however, I’m going to show you how I arrive at them. In this chapter, as the basis for my prediction,I use the political science equivalent of Newton’s second law of motion: the acceleration of an object is directlyproportional to, and in a direction determined by, the net force acting on it. I also throw in a little portfoliotheory, just to spice it up.Borrowing from Newton’s law, I identify the vector forces that represent each of the primary social and politicalconstituents affecting FDA regulation. As I identify them, I estimate both the magnitude and the direction of theforce. Actually it’s easier to communicate this in a graph. Calculation of Net Force in mHealth Regulation Protection Against Adverse Events Efficient Fronteir of Regulation Existing FDA Regulation Industry s Me res ng dia FDA o C Freedom to Innovate Page 37 MobiHealthNews.com
  • FunctionIf that graph doesn’t help you, just forget it, and go tothe next section. But if you’d like to know more abouthow I designed it, read on. I’m a visual person, so Ialways try to draw myself a picture.Innovation and protecting against adverse events obscure reference to an economic theory developed bycan be inversely related, at least in certain instances. Nobel prize winner Harry Markowitz. In his famousRequiring medical devices to go through FDA graph, he shows the trade-off between risk and returnapproval, for example, restricts the freedom to from owning various bundles of stocks. His efficientinnovate in some measure (you can’t just put a beta frontier was a curved line representing the best trade-version out on the market and see how it does), while offs you could make in terms of risk and return. Thatpresumably reducing the risk of adverse events if FDA line represented choices in the perfect market.reviewers catch problems. On the other hand, thereare places where regulation may actually enhance At my frontier, I show different best case trade-innovation by providing a framework to ensure offs between levels of regulation and the associatedthe vigor of the analysis. Some argue that design freedom to innovate in a perfect world. In a perfectcontrols lead to better, and in a sense more innovative, world, we have flawlessly written regulations that:products. But for purposes of this analysis, let’sassume that there’s a trade-off between innovation and Communicate clearly the regulatoryprotecting against adverse events. requirements, fully answering any question you might haveSo basically Congress and FDA pick where on thisgraph they want to be in terms of that trade-off Are perfectly sensible in that they completely avoid any unnecessary impediment tobetween permitting innovation and protecting against innovation, always imposing the least burdenadverse events. But what determines their choices? to get the safety job doneIdeally they would like maximum innovation andmaximum protection against adverse events. So they Are soundly supported by evidencewant to be at the far, upper right hand corner. Are clever and creative, choosing the mostUnfortunately, it’s not that easy. Their choices are efficient and effective way to achieve safety, and never the product of historical anomalyconstrained by reality. Perhaps limited by our or political compromise.collective creativity but also by the fundamentalconflict between a business process that encouragescreativity and innovation, on the one hand, and a We don’t live in that world.business process that drives toward zero risk on theother, trade-offs are necessary. We haven’t invented the That’s why I have current FDA regulation inside theperfect regulation that allows both maximums. efficient frontier. I’ve done that if for no other reason than because I believe we could increase innovation,On the right-hand side of the graph, I depict with no compromise in public health protection, if wethose constraints, calling it the efficient frontier of simply clarify the regulatory scheme so that everyoneregulation. I got kind of carried away, making an understands what it is. Everyone—whether you are atPage 38 MobiHealthNews.com
  • FDA or in industry—should want to move as close as this in part because of Nick Hunn’s thought-provokingpossible to that line. The difficult question is, to where article on whether we should even discuss theon that line should we aim? likelihood of FDA regulation of mHealth. Nick’s article advances the argument that too much talk aboutClearly I could have added another dimension in possible FDA regulation scares away potential entrantswhich we evaluate whether regulation advances the into the US mHealth market, those who might havepublic health by allowing important new products allergic reactions to graphic discussions of such topics.onto the market. But I don’t know how to draw in (I tried to warn them away.) Nick’s article is worth athree dimensions, and Brian Dolan was no help. read, and not just because he calls my article series on MobiHealthNews “excellent”.Forces At the same time, I have to disagree with Nick’s conclusions.At a high-level, this graph depicts how industrygenerally pushes in the direction of innovation. Many Over the years, I’ve learned that business peoplein industry don’t mind at least some regulation if it of all types, and particularly investors, highlykeeps unscrupulous companies out. Such companies value information about changes in the regulatoryhurt the reputation of the whole industry, and drive environment on the horizon. While Nick seems todown consumer confidence in their products. feel discussion of FDA regulation is tantamount to fear mongering, my hope is that this informationAt the other extreme, in my subjective view, the media will provide the reader a rational basis for business(except Brian) often flagrantly seizes upon indications planning.of patient risk, while not being terribly concernedabout the need for innovation. FDA’s mission, by In the end, you can decide the value of thisstatute, tends to be predominantly focused on assuring information by whether you feel there is an objectivesafety and effectiveness through regulation, while basis for the conclusions offered. That’s why I’mCongress must be concerned with jobs and assuring going to take a little bit of time to lay out my specificadequate access to the best health care (and getting observations. You be the judge.elected). So the task now is to tease apart each of thoseforces. II. The Nature of FDA RegulationPart one of this chapter will identify those existingforces at work, and part two of this chapter to be I understand full well some readers will never believepublished next week will calculate the applied net FDA regulation is anything but bad news for anforce, and show at least where I think FDA regulation industry. Frankly some people (like me) simply havewill likely end up. trouble accepting authority. So I understand they will never welcome the idea of Washington telling them what to do. They blog for a living (just kidding Nick),I. Framework: Crying Wolf or Chicken Little? or only enter businesses that are largely unregulated. I honestly get that.Before I dive into this analysis, because portions ofit are subjective, in the interests of good journalism But throughout this report, I have advanced theI should disclose my own biases. I’m prompted to do idea FDA regulation can benefit the industry. At Page 39 MobiHealthNews.com
  • the most fundamental level, assuring the safety oftechnology helps protect the image of an industryand the confidence of its customers. Beyond that, the Healthcare costs are high, and getting higher.regulatory system itself becomes a barrier to entry, Throughout the last year, we’ve all beenand helps ensure that companies willing to make a bombarded by stories discussing the risinghigher investment are protected enough to earn profits cost of health care, and the need for reform.proportionate to the investments they must make. Whether or not you believe the recentlyThe proof is in the pudding, of course. The medical enacted health-care reform will drive downdevice industry has been one of the healthiest costs, it’s fair to say in the foreseeable futureindustries over the last 20 or 30 years, and particularly we will need to identify every possible waymeasured by most indicators of the robustness of to reduce those costs. mHealth technologiesinnovation. The industry has attracted high levels have been touted as one possible way to treatof venture capital, and has produced high numbers people in lower cost care settings, and betterof patents. More anecdotally, the breakthrough manage chronic conditions that are drivingtechnologies reaching the medical device market over up the cost of healthcare.the last 20 years in many cases have been breathtaking. Outside of healthcare, the world is goingAt the same time, it goes without saying that we can digital. The growth of mobile phones intohave too much regulation, and misdirected regulation a nearly ubiquitous communication tool iscan stifle innovation. The trick is to find the right well-established.balance, the sweet spot where regulation is flexibleenough to allow innovation and strong enough toprovide adequate protection to the public health. So it’s no great revelation to anyone readingAbiding by that regulation constitutes the dues that MobiHealthNews that the societal forces drivingany company must pay if it wants to supply medical the adoption of mHealth are strong. One way ortechnology that can impact the health and safety of another, society in general and our healthcareour citizens. system in particular will demand access to mHealth technologies.III. Society and the Healthcare SystemIn this chapter, I’m not even going to try to analyzewhere the health-care system is headed. Instead, based IV. Industry and Technology Trendson reading probably many of us have done, I will listthe major trends (assumptions) I’ve factored into my Scores of articles in MobiHealthNews describeanalysis. where the industry is going. Allow me just to highlight a few trends pertinent to FDA regulation. Many U.S. citizens live in areas underserved by the health-care system. mHealth technologies, as with other remote The predicted growth of mHealth is monitoring and telehealth devices, can be enormous. Driven by the trends identified used to expand access in these underserved above and more, most folks in the industry areas. expect it to grow by leaps and bounds.Page 40 MobiHealthNews.com
  • While many of the apps used in mHealthreflect nothing more than portableinformation sources, some are muchmore than that. The future is wide open totechnologies that will facilitate collectinginformation directly from sensors on thebody and transmitting the data back tocaregivers for treatment decisions. In therealm of medicine, even with sophisticatedcaregivers such as nurses, erroneousinformation can affect treatment. Further,it is not hard to imagine moving beyondsimply sending information from the patientto the caregiver, but actually giving some ofthe devices along the way an ability to make Traditional medical device companiestherapeutic adjustments affecting the patient. are diving into the connected healthAll those factors affect risk, and that draws arena. Seeing the benefits of having theirFDA’s interest. sophisticated medical devices plugged into HIT systems, these companies are exploringIn terms of business and technology models, ways to connect most effectively.in many quarters there is a clear desire toachieve interoperability. In a perfect future Reimbursement for most areas of mHealthworld, we may well have many technologies and indeed remote monitoring generally hasout there that can all speak to each other been stingy. As a result, many companiesin a common language, working as one exploring these markets are focusing onintegrated system to share information and direct to consumer sales where the patientpotentially make machine-driven decisions. would pay out-of-pocket. That’s importantThe regulatory implications of what would to FDA, because it directly implicates theeffectively be an open network are mind- agency’s recently announced medical deviceboggling, and discussed below. home use initiative. In that initiative, FDA expresses both the positive benefits ofSome hospitals and other care providers providing better care in the home, but alsoare moving in the direction of purchasing questions the risks associated with untrainedcomponents and developing integrated users trying to manage sophisticatedcare systems. Further, some of these system equipment and the use of wirelessdevelopers, to achieve economies of scale communications.and efficiencies, are renting out accessto their systems to smaller hospitals andcare providers. The implications of this Each of those trends directly affects thewere discussed in my last article on FDA likelihood and possible nature of any future FDAregulation of care providers. regulation of mHealth. More on that later. Page 41 MobiHealthNews.com
  • V. Political and Regulatory Trends With Congress and FDA focused on the safety of HIT systems, many policymakers have apparentlyIn chapter 6, I noted that Washington was signaling concluded they need more data. To that end, FDAlikely FDA regulation. I won’t repeat that chapter here, sent a letter to numerous hospitals a couple monthsbut rather highlight a few trends in Washington. ago asking them to more systematically and regularly report any problems associated with HIT. FDA apparently is trying to build a database on which to The most direct trend is the language coming base future policy. out of FDA quite specifically suggesting they plan to regulate HIT, and presumably many of its This spring, the FCC released The National incarnations. Dr. Jeff Shuren, the Director of the Broadband Plan: Connecting America, which FDA’s Center responsible for regulating devices, included sections encouraging FDA to work with said basically that in a February speech. Part FCC to devise a coordinated regulatory approach of the basis for his declaration was the injuries for connected health. On the one hand, it should be reported to FDA due to hiccups in HIT systems. welcome news that FDA and FCC would coordinate In the early chapters of this report, I outlined the to avoid duplication and inconsistency. On the other legal basis for FDA regulation of certain hardware hand, that news probably prompts the fear of the and software involved in mHealth. unknown, since we really do not know where the agency collaboration might lead. Over the last six months, Sen. Grassley, an influential Republican, has been sending out Over the last couple of months, in discussions letters expressing concern and asking questions before the HIT Policy Committee, FDA’s role in about risks associated with HIT, and what FDA regulating HIT has been actively discussed, including is doing about those risks. If you’ve read those the testimony of Dr. Shuren mentioned above. letters, you might very well conclude the senator On April 25, the HIT Policy Committee sent its is not done addressing this topic. recommendations to Dr. Blumenthal. With regard to FDA, after discussing the pros and cons, the Early in his presidency, near the height of the committee suggested that “the ONC work with the recession, Pres. Obama obtained authority to FDA and representatives of patient, clinician, vendor, invest roughly $20 billion in HIT. That’s the good and healthcare organizations to determine the role news. Some critics have said the investment is that the FDA should play to improve the safe use of premature because rolling out new systems is a Certified EHR Technology.” Wow, that’s helpful. In complicated and delicate task that will take quite a speech on April 29, Dr. Blumenthal is quoted as a while to do safely. As a result, while the Obama saying “although [the] advisory committee concluded Administration seems committed to proceeding that more information was necessary, he called the with its plan, clearly they will want to do so in a evidence of the reports “anecdotal and fragmented” at way that also protects the public from weaknesses best. I would infer Dr. Blumenthal wants to keep FDA in those systems. out of mHealth. Indeed, the committee discussed creating its own regulatory scheme that would feature adverse event reporting. Last time I checked, though, ONC doesn’t tell FDA what to do. Page 42 MobiHealthNews.com
  • VI. The Fourth Estate That’s the media. And in our political and regulatory systems, the role of the media is In a May 24 workshop on the medical device important. Media attention to an issue routinely home use initiative referenced above, the spurs our elected officials and even our regulators FDA confirmed it was drafting a guidance to act. For the good of society or for profit, the document on medical device use in the home media has been paying attention to the question environment with a particular interest on of FDA regulation of HIT and mHealth. clarifying “wireless issues” related to medical devices used in the home. It is unclear what In some of the more ominous attention paid aspects of “wireless issues” the agency hopes to this topic, the Huffington Post has been to focus on, how broad that focus will be conducting an investigative report on injuries and what guidance is likely to come from the and other adverse effects of HIT systems. agency. The Huffington Post has been sifting through FDA records analyzing trends associated with FDA has started to receive premarket the use of these software-based products. notifications for new cell phone apps related to Throughout this spring they have been mHealth. Apparently the agency is struggling publishing articles quite critical of the risk somewhat to grant clearances for new apps associated with these software products, and on the basis they lack what is referred to as a what they claim to be as FDA’s inattention to predicate device. Consider the experience of the problem. MIMvista reported earlier this year, whose iPhone app for medical imaging failed to Aunt Minnie’s website in similar fashion has clear FDA reportedly because there was no been doing investigative reporting on the predicate. As explained in the third chapter on need for FDA regulation of devices in this software, for a new medical device to reach the area. market through the clearance process, there must be an existing, substantially equivalent Even more mainstream publications have software device on the market. If no such focused on this issue. In April, an article in substantially equivalent device exists, the Scientific American raised questions about manufacturer is forced to go through the much how these important mHealth devices could more expensive and demanding premarket escape FDA regulation. approval route. Those feature articles have caused a fair amount of discussion among bloggers.Those developments each affect the likelihood and And before Nick says anything, this reportmanner of possible future FDA regulation. has been educational, not critical. So those are, in my view, the major vector forces to consider as we ponder what the future might look like for FDA regulation of mHealth. The next task is to add all those vectors up to see where they might take us. I’ll do that in part two of this final chapter. Page 43 MobiHealthNews.com
  • Part Two — Calculating Applied Net ForceIn part one of this chapter, I described the major First, as I mentioned in Part I of this chapter, FDAforces bearing on the question of if and how FDA has undertaken to define home use medical devicesshould regulate hardware and software used in through the creation of a special initiative. UntilmHealth. I laid out almost a Newtonian analysis of now, FDA has not articulated a clear regulatorythose political science forces. In this part, I add all of pathway for devices intended for home use. In orderthose forces together to calculate (okay, guess) where to facilitate the development of medical devices thatFDA is going. Actually, I wish it were as simple as the are safe for home use, FDA will develop a guidancediagram below. document within 8-10 months recommending actions manufacturers should take to receive FDA approval.I’m guessing you want to know a little more During a May 24 workshop, FDA signaled a strongspecifically where FDA might end up. intention also to address “wireless issues” pertaining to home use medical devices.I. Where do these forces collide? Second, various trade associations such as the Continua Health Alliance are engaged inThe starting point is to understand where exactly dialogues with FDA regarding the requirements forthese existing forces collide. In broad terms, interoperable devices. An important example of thatthey collide in two areas: proactive and reactive is an ad hoc roundtable discussion among severaldiscussions. participants in the FDA’s January public meeting on medical device interoperability. That group meetsThere currently are a half dozen forums sponsoring periodically to develop what would basically be aproactive, constructive discussion. mock FDA submission for an interoperable medical Calculation of Net Force in mHealth Regulation Protection Against Adverse Events Efficient Fronteir of Regulation Future FDA Regulation Industry ss Me gre dia FDA on C Freedom to InnovatePage 44 MobiHealthNews.com
  • device platform. The goal is to develop a submission Sixth, at least some industry participants arethe agency would find acceptable, such that other folks beginning a dialogue with members of Congressin industry can use that submission as a model for regarding the nature and scope of the regulatorytheir own. issues. At this juncture, those meetings seem to be mostly educational for members of Congress, but theyThird, there is a very good opportunity to discuss may at some juncture result in further letters fromthese issues in an upcoming public workshop members to the Administration expressing opinionson “Identifying Unmet Public Health Needs on where the Administration should take mHealthand Facilitating Innovation in Medical Device policy.Development.” This June 24 workshop will focuson identifying health needs that 1) affect many Those proactive discussions may not be the last word:individuals (2) could be significantly improved by new we may see some reactive discussions. As an observerdevices and (3) the devices are not being developed of FDA over the years, I’m guessing that in additiondue to barriers caused by FDA. To me, they might as to the direct dialogue, we will see the agency reactingwell have said we would like to hear about mHealth. through an enforcement action or two against whatAs I discuss below, the ambiguities around FDA the agency considers to be egregious conduct. Oftenregulation are significantly impeding investment in the agency will pick activity that is both egregioustechnologies that could make an enormous difference and high profile to be the subject of a warningfor those suffering from chronic disease. I would letter. Sending such a letter begins a dialogue withurge people to consider attending or commenting in the recipient, but also communicates to a broaderwriting, but don’t mention I suggested it. audience. There may be some high profile products out there stepping over the line in a way that makesFourth, there are governmental policy forums them likely targets.beginning to study and debate FDA regulation ofmHealth. An example is an NIH initiative to gatherleaders from throughout government and the privatesector to look broadly at the policy and regulatory II. The open substantive questionsissues associated with mHealth research. A smallgroup of those people met June 7-8 to debate some Okay, so these forces collide in either proactive orof the basic issues, and then the NIH Foundation reactive communication: where does that mean FDAwill hold a broader meeting on November 8-10 to is going? To address that, I will identify six basic open“convene leaders in research, technology and policy questions, and suggest how they might be resolvedto share their expertise and draft a blueprint for the through these discussions.future of mobile health.”Fifth, per the National Broadband Plan, the FCC 1. Scope of FDA Regulationwill engage FDA directly in a meeting at the end ofJuly. While that announcement has not yet come out Hardware and software companies need to know(expect it very soon), the meeting is likely to address which mHealth products FDA regulates, butspecifically the areas of overlap between the two unfortunately the answers aren’t always clear. Foragencies. At the same time, it’s clear that FCC sees example, FDA generally regulates medical intendedthe benefit of mHealth and wants to identify ways to uses for products, but not products directed at generalencourage it through public policy. wellness or fitness. The problem is there’s a whole lot a Page 45 MobiHealthNews.com
  • gray area between those categories. As examples, thereare mobile phone apps focused on helping people withweight loss and everyday management of diabetes.When might certain claims in those areas trigger FDAregulation?Further, it might be obvious that a blood glucose 3. Network Intended Usemeter is a medical device. But as that device connectsto a cell phone which connects to a server somewhere The existing medical device regulatory scheme doeswhich connects to a doctor’s computer, where does not embrace a network mentality. Individual medicalFDA regulation begin and end? devices are cleared or approved for specific, individual uses. Very rarely would FDA clear a medical device forRather than just focusing on what the statute unspecified interoperability with a whole class of otherauthorizes, I would hope that industry and FDA medical devices. But that interoperability is preciselythrough discussion could arrive at a risk-based model Continua’s business model. Further, FDA has a long-that limits FDA’s active regulation to those devices standing rule that when two articles are sold togetherwhere a malfunction could realistically hurt someone. expressly as a kit, the combination of devices changes their intended use and requires special clearance for the kit unless exempt or the individual clearances2. The Level of FDA Regulation already contemplate the kit.FDA’s medical device regulatory scheme is deliberately FDA will need to come up with a regulatory modelrisk-based and stratified. Currently, high-risk medical to address devices cleared to a standard that allowsdevices such as certain cardiovascular therapeutic them to interoperate with other such devices, wheredevices are regulated quite extensively. When those the range of other possible devices is open-ended. Asdevices get connected to a doctor’s office either with its other regulatory challenges, FDA likely willthrough a dedicated pathway or through a mobile develop this model on the basis of risk managementphone, it is unclear whether the communication tools. The agency will have to identify the featuresdevices that carry the signal should also be considered and characteristics that produce risk, and developmedical devices regulated to that same highest level. appropriate regulatory requirements to assure the safe and effective performance of devices with thoseHere again the resolution is likely to be risk-based. features and characteristics. Compliance currently isIndustry and FDA will need to bring many of their especially difficult in the area of design controls, whichvarious risk assessment tools to bear on assessing do not contemplate open-ended, interoperable claims.at which junctures in the connected lines ofcommunication risk is the greatest, and the regulatory The development of this new regulatory model willrequirements will likely focus on those junctures. By require substantial interaction with industry tousing risk assessment tools, industry may be able to arrive at something practical. Indeed, this is part ofconvince FDA the cell phone is not a significant source the work of the ongoing dialogue between Continuaof risk, and therefore should not be subject to much and FDA, stemming from the January meeting onregulatory scrutiny. interoperability.Page 46 MobiHealthNews.com
  • 4. Standards for ClearanceFor those mHealth products that do require FDA guidance to define the circumstances in whichclearance, manufacturers need to know whether FDA hospitals and others can serve as systems integratorshas any minimum requirements addressing such areas without having to meet the specific requirements ofas: FDA’s medical device laws. This can be done under the FDA’s enforcement discretion. The factors that Latency FDA might consider would be probably similar to the ones contained earlier in this report, including Human factors design issues the risk associated with the specific activities of the hospital, the scale of the activities, and the availability Limits on appropriate user of suitable systems designed and made by FDA- Ability to use open source platform registered manufacturers. Acceptable use environments 6. Multiple Vendors—Post Market Compliance Usability issues Issues Protection against interference by other software Often multiple hardware and software components are connected to form an mHealth system, for example a Security blood glucose meter, a cell phone, a server, and a PC in the doctor’s office. In those cases, when somethingAgain working with industry, I suspect FDA will goes wrong and an erroneous result is displayed ondevelop basic standards in those areas based on risk, the doctors monitor, which component manufacturerbut don’t expect those standards to be written any has the postmarket obligations to report the so-calledtime soon. Normally FDA hangs back on committing adverse event to the FDA? If it’s not clear where thesuch information to writing until they have substantial hiccup occurred, who would have responsibility toexperience with a new technology. investigate and fix the breakdown? The medical device laws contemplate relatively clear5. Hospital-Directed Modifications responsibility, and do not take into account the concept of a network of interconnected devices. As aAs I discussed in the seventh chapter, hospitals and result, these postmarket obligations are ambiguous inother healthcare providers often modify systems or this context. FDA will have to work out some practicaleven act as integrators of a variety of components rules for assigning responsibility to one particularto produce mHealth remote monitoring systems. manufacturer when a network produces erroneousUnder the law, when they do so, FDA might decide results for unknown reasons. Through discussionthe hospitals are functioning as manufacturers and with industry, the FDA will probably come up withregulate them. In chapter, I ran through a variety of rules of thumb for identifying the device that eitherfactors that impact the likelihood of FDA regulation. embodies the most risk or is otherwise most likely toEventually, FDA hopefully will come out with some be responsible for the failure. Page 47 MobiHealthNews.com
  • III. Suggestions for Advocacy1. Arguments to Use 2. A New, Temporary CoalitionI don’t want to pick on Nick, but the sentiments he Nick and I probably share quite a bit of commonexpresses in his Crying Wolf post are similar to what ground in that I suspect we both believe there aremany in the IT industry are saying. At its essence, a number of technologies used in mHealth wherethey’re suggesting mHealth technologies are too balancing those factors would lead a reasonableimportant for FDA to regulate. To be blunt, I would person to conclude that regulation is unnecessary.urge all those connected with the mHealth industry to Because of that, recently several of us got together andstop making that argument. Rather than helping, it’s announced the formation of a coalition—the mHealthhurting your cause. Regulatory Coalition or MRC– to develop a consensus among industry participants regarding the scope ofThe issue of importance actually cuts the other way, what FDA should and should not regulate in the areain favor of regulation. Saying that mHealth is too of mHealth technologies, and propose that approachimportant for FDA to regulate is a little bit like saying to FDA for adoption. Dr. Jeffrey Shuren, the Directora patient is too sick to need a doctor. FDA only of the Center for Devices and Radiological Health ofregulates products that are important, and the more FDA, as the recent annual meeting of FDLI invitedimportant they are, the more FDA feels the need to industry to propose guidance documents on policyregulate. FDA expends its greatest amount of time issues of importance to industry. FDA will take thoseand resources on class III medical devices, which are documents, make any changes they feel are necessary,arguably the most “important” in a clinical sense. and then propose them for formal adoption. We think this topic is ideal for a proposed guidance.Second, please don’t simplistically argue FDAshouldn’t regulate mHealth because we need The MRC is very narrowly focused on the one task,innovation. The argument suggests that we don’t and indeed is only temporary. It will only continue soneed innovation for those areas FDA does regulate, long as it takes to complete that task, hopefully withinlike traditional medical devices, but that’s kind of months. We are inviting members of the mHealthsilly. I suspect most patients would say that they want industry to participate alongside existing trade groupsinnovation in medical devices that can save their lives. to be inclusive. We plan to have our first meeting on July 8 in Washington, to get organized.At the end of the day it’s not the importance of thetechnology or the need for innovation that determines Our concern is that there are a variety of companieswhether FDA should regulate, but rather balancing the and investors sitting on the sidelines out of fear theybenefits of regulation against the harm of regulation. may be regulated. The uncertainty is helping no one.And the benefit of regulation is the protection of the We plan to tackle the scope of FDA regulation head onpatient. So in my mind, the policy debate should be by developing a proposed list of mHealth technologiesaround whether the risks of any particular mHealth and intended uses that FDA should regulate, and a listtechnology merit the cost of regulation, where that of those they should not. Our preference is to achievecost includes not just the cost of compliance by the as much specificity as possible, so we can move closercompany but also the inhibition on innovation of to the efficient frontier.helpful products.Page 48 MobiHealthNews.com
  • IV. SpeculationsFDA obviously will regulate at least certain hardware and software used in mHealth, suchas the blood glucose meters they already regulate. As to exactly where the line will be drawnaround the scope of FDA regulation is yet to be determined, and I suspect will be very muchrisk-based, and determined by an evaluation of the evidence. FDA doesn’t have to activelyregulate everything the statute says is a medical device, and the agency routinely draws linesshort of everything it could theoretically regulate. Helping them figure out where to draw thatline is industry’s job, subject to all of the other forces being exerted on the process.The mHealth industry will thrive: it has to. We need it to. But along the way industry willadapt to whatever regulatory scheme ultimately emerges, and likely much of that adaptationwill be accomplished through partnerships typical of a network technology industry. So, toensure mHealth reaches its potential, we need to figure out creative and effective ways towork together. I’m confident we will succeed. mobi health news Page 49