Presentation by Hogan Lovells, EU MedTech and eHealth Regulatory Framework. Best practices and key changes in the European medtech regulatory environment, 2018.

1. March 5, 2018
Prepared by Hogan Lovells
mHealth Women Presentation

2. Hogan Lovells | 2
• Medical device clients
– range in size from small start-ups to
established Fortune 500 companies
– Represent 500 – 600 companies
– 80 – 100 are in Israel
• Separate practice groups
specializing in
– US FDA
– CE certification
– Privacy
– Corporate
Hogan Lovells

3. Upcoming regulatory and
policy changes in the EU
IVDR
26 May 2022
MDR
26 May 2020
Brexit
29 March 2019CTR
2019?
GDPR
25 May 2018

4. 1. The new MDR and IVDR

5. | 5Hogan Lovells
• In the EU medical devices are currently regulated by three Directives:
– Directive 90/385/EEC on active implantable medical devices (AIMD);
– Directive 93/42/EEC concerning medical devices (MDD);
– Directive 98/79/EC on in vitro diagnostic medical devices (IVDD).
• Directives are supplemented by guidelines published by the European
Commission referred to as “MEDDEVs”.
• Directives have been amended several times.
• Each Directive lays down the technical and procedural obligations which
must be followed by the manufacturer of a medical device prior to affixing of a
CE mark to the product.
– A medical device cannot be used or marketed in the EU unless a CE mark has been validly
affixed to the product in accordance with the provisions of the relevant Directive.
Current Regulatory Framework

6. Hogan Lovells | 6
• Clear provisions concerning the role and responsibilities of "economic
operators":
– legal manufacturer, importers, distributors authorised representative and person
responsible for regulatory compliance;
• Authorised representatives would be held legally responsible and liable
for defective products placed on the EU market;
– What about the importer and distributor?
• Increased traceability of medical devices following the introduction of a
Unique Device Identification (UDI) system;
Main changes introduced by the Regulations

7. Hogan Lovells | 7
• Strengthening of the clinical data requirements related to medical
devices;
• Additional scrutiny during the conformity assessment procedure for high
risk medical devices;
• Strengthening of the designation and monitoring processes governing
notified bodies;
• Establishment of EUDAMED III to increase transparency;
– The new EUDAMED will include several databases concerning economic operators, CE
Certificates of Conformity, conformity assessment, clinical investigations, the UDI
system, adverse event reporting and market surveillance
– Regulation of certain products without an intended medical purpose;
• New classification rules.
Main changes introduced by the Regulations

8. Hogan Lovells | 8
• Entry into force of the MDR and IVDR: on 25 May 2017
• Application:
– three years after entry into force for the MDR (spring 2020): 26 May 2020
– five years after entry into force for the IVDR (spring 2022):26 May 2022
• CE Certificates of Conformity issued by notified bodies in accordance with the current
Directives will remain valid until the end of the period indicated on the certificates and
– for maximum four years after application of the MDR, i.e. 27 May 2024; and
– two years after the application of the IVDR, i.e. 27 May 2024.
• Conditions:
– the medical devices continue to comply with the relevant current Directives;
– no significant changes in the design and intended purpose of the medical devices;
– The requirements of the MDR relating to post-market surveillance, market surveillance, vigilance,
registration of economic operators and of devices shall apply in place of the corresponding
requirements in those Directives.
Entry into Force and Application of the MDR and IVDR

9. | 9Hogan Lovells
• Medical devices must comply with the relevant general safety and
performance requirements laid down in in Annex I;
• Demonstration of conformity with the general safety and performance
requirements must include a clinical evaluation;
• Confirmation of conformity with relevant general safety and performance
requirements laid down in Annex I under normal conditions of the
intended use of the device, and the evaluation of the undesirable side-
effects and of the acceptability of the benefit-risk- ratio must be based on
clinical data providing sufficient clinical evidence.
– One general exception: Article 61.10 of the MDR
Clinical Evaluation - General Principles

10. | 10Hogan Lovells
• 'clinical evidence' means clinical data and clinical evaluation
results pertaining to a device of a sufficient amount and quality to allow
a qualified assessment of whether the device is safe and achieves the
intended clinical benefit(s), when used as intended by the
manufacturer
• = Clinical data + Clinical evaluation
Clinical Evidence

11. | 11Hogan Lovells
• Clinical evaluation means a systematic and planned process to
continuously generate, collect, analyse and assess the clinical data
pertaining to a device in order to verify the safety and performance, including
clinical benefits, of the device when used as intended by the manufacturer.
– 'clinical benefit' means the positive impact of a device on the health of an individual,
expressed in terms of a meaningful, measurable, patient-relevant clinical outcome(s), including
outcome(s) related to diagnosis, or a positive impact on patient management or public health;
– Manufacturers are required to specify and justify the level of clinical evidence necessary to
demonstrate conformity with the relevant general safety and performance requirements.
– This level of clinical evidence must be appropriate in view of the characteristics of the device
and its intended purpose.
– To that end, manufacturers shall plan, conduct and document a clinical evaluation in
accordance with Article 61 and Part A of Annex XIV.
Clinical Evaluation

12. | 12Hogan Lovells
• "clinical data" means information concerning safety or performance that
is generated from the use of a device and is sourced from the following:
– clinical investigation(s) of the device concerned,
– clinical investigation(s) or other studies reported in scientific literature, of a device
for which equivalence to the device in question can be demonstrated,
– reports published in peer reviewed scientific literature on other clinical experience of
either the device in question or a device for which equivalence to the device in question
can be demonstrated,
– clinically relevant information coming from post-market surveillance, in particular
the post-market clinical follow-up;
Clinical Data - Definition

13. Hogan Lovells | 13
Clinical Evidence
syste
Clinical Data CER
Systematic and
planned
process
Clinical
Investigations
Scientific Literature for the
same or equivalent devices
PMS
Demonstrate
compliance with
safety and
performance
requirements
Clinical Benefit
Clinical Evidence

14. Hogan Lovells | 14
Collection of Clinical Data – Clinical Investigations
Clinical
investigations are
required for:
All innovative medical devices
Class III and implantable medical devices
 Some exceptions
Products without an intended medical purpose listed in Annex
XVI
 Unless reliance on existing clinical data from an analogous medical
device is duly justified
Medical devices for which equivalence to a marketed product
cannot be demonstrated

15. Hogan Lovells | 15
• Exception: Article 61.4 MDR
Collection of Clinical Data – Clinical Investigations
The
requirement to
perform clinical
investigations
shall not apply
if:
• the device has been designed by modifications of a device already
marketed by the same manufacturer
• the modified device has been demonstrated by the manufacturer
to be equivalent to the marketed device and this demonstration
has been endorsed by the notified body, and
• the clinical evaluation of the marketed device is sufficient to
demonstrate conformity of the modified device with the relevant
safety and performance requirements.
NB shall check that the PMCF plan is appropriate and includes post market studies to
demonstrate the safety and performance of the device.

16. Hogan Lovells | 16
• Exception: Article 61.6 MDR
Collection of Clinical Data – Clinical Investigations
The requirement to perform clinical investigations does not apply to implantable medical
devices and Class III devices:
1. which have been lawfully placed on
the market or put into service in
accordance with the AIMD or MDD and
for which the clinical evaluation:
• is based on sufficient clinical data, and
• is in compliance with the relevant product-
specific common specification for the clinical
evaluation of that kind of device, where such
a CS available
2. that are sutures, staples, dental fillings, dental braces,
tooth crowns, screws, wedges, plates, wires, pins, clips or
connectors for which the clinical evaluation is based on
sufficient clinical data and is in compliance with the
relevant product-specific common specification, where
such a CS is available
• =well established technologies
• The European Commission can amend the list of exempted
devices by delegated acts.

17. Hogan Lovells | 17
Conditions to be able to claim compliance with another medical device
• The two manufacturers have a contract in place that explicitly allows the manufacturer of the second device full
access to the technical documentation on an on-going basis;
• The original clinical evaluation has been performed in compliance with the requirements of the MDR;
• The device has been demonstrated by the manufacturer to be equivalent to the marketed device and this
demonstration has been endorsed by the notified body, and
• The clinical evaluation of the marketed device is sufficient to demonstrate conformity of the modified device
with the relevant safety and performance requirements.
Collection of Clinical Data – Equivalence
 NB shall check that the PMCF plan is appropriate and includes post market studies
to demonstrate the safety and performance of the device.

18. Hogan Lovells | 18
• Understanding the changes and the timelines
• Determine the appropriate budget to support transition to the new
Regulations
• Obtain the management's support to ensure the transition
• Identify appropriate resources:
– Internal: hiring new employees
– External: authorised representative, notified body, consultants/experts
• Determine if clinical/performance data will be sufficient/if new clinical
data is required
MDR and IVDR: Potential Challenges

19. Hogan Lovells | 19
• Take the right strategic decisions for the company
o Change to the business model: EU first?
o In light of the transition provisions in the Regulation, is it a good time to launch a new
product on the EU market?
• Assessing new obligations for economic operators (e.g. Legal
manufacturer in Switzerland permitted?)
• Understanding the consequences for the ROW
• Plan and implement plan according to agreed timeline
o Internal discipline
o External factors (NB, implementing/delegated Acts, guidance, Brexit, harmonised
standards…)
MDR and IVDR: Potential Challenges

20. Hogan Lovells | 20
• Rationalise portfolio
• Reevaluate the priorities of the companies
• Business opportunities – growing through acquisition?
• Market opportunities – taking advantage of competitors not ready for the
MDR/IVDR (e.g. in tenders)
• A lighter transition process for SMEs and start-ups?
– Easier to adapt for new/small businesses
MDR and IVDR: Potential Opportunities

21. 2. Consequences of the GDPR for clinical investigations

22. Hogan Lovells | 22
• On 25 May 2018 the GDPR will replace the Data Protection Directive
• Regulation = directly applicable in all EU Member States without the
need for national implementing measures
• Among the changes introduced by GDPR :
– applies to all companies processing the personal data of data subjects residing in the EU,
regardless of the company’s location;
– Breaches of GDPR can lead to fines of up to 4% of annual global turnover or €20 Million
(whichever is greater).
Some of the many changes resulting from the GDPR

23. 23
Privacy by design & by default
• Implement appropriate
measures (e.g.
pseudonymisation) designed to
implement data protection
principles (e.g. data
minimisation)
• Ensure that only necessary
personal data is processed
• At the
development stage
• During
implementation

24. Hogan Lovells | 24
• Rights of patients concerning their personal health data
– Provides patients expanded right to obtain confirmation from the data controller
concerning whether or not their personal data is being processed, where and
for what purpose
– Requires the controller to provide a copy of the personal data, free of charge, in an
electronic format. This includes the obligation to provide data in a "commonly use and
machine readable format" and the right of the patients to transmit that data to another
controller
– Patients' right to be forgotten which provides the right to have the data controller
erase their personal data, cease further dissemination of the data, and potentially have
third parties halt processing of the data
GDPR – implications for clinical trials

25. Hogan Lovells | 25
• Should trial patients be re-consented?
– Recital 171 of the GDPR provides that processing activities already commenced on the
basis of the Data Privacy Directive should be brought into compliance with the GDPR
within two years.
– However, the Recital also provides that patients who were consented on the basis of the
Data Protection Directive need not be re-consented "if the manner in which the consent
has been given is in line with the conditions of this Regulation, so as to allow the
controller to continue such processing after the date of application of this Regulation".
• Article 13.3 - Scope of patient consent
– "Where the controller intends to further process the personal data for a purpose other
than that for which the personal data were collected, the controller shall provide the
data subject prior to that further processing with information on that other purpose
and with any relevant further information as referred to in paragraph 2."
GDPR – implications for clinical trials

26. | 26Hogan Lovells
• Processing for scientific research purposes must be subject to
appropriate safeguards for the rights and freedoms of individuals
– must ensure that technical and organisational measures are in place particularly to
ensure data minimisation and may include pseudonymisation
• Where purposes of scientific research can be fulfilled by processing which
does not permit or no longer permits identification of individuals,
this approach should be used
• EU or EU Member State law may provide for derogations from rights of
access, rectification, restriction and the right to object in so far as those
rights are likely to render impossible or seriously impair the
achievement of the scientific research purposes and such derogations
are necessary (Article 14.5(b))
GDPR and processing of data for scientific research

27. Hogan Lovells | 27
• New informed consent form;
• Data breach procedure;
• Data transfer agreements to govern transfers of personal data;
• Data retention policy to determine the retention period of each category
of personal data
• Conduct privacy impact assessment (PIA) if processing operations are
likely to result in a high risk to the rights and freedoms of data subjects
Policies, procedures and mechanisms to ensure compliance

28. Hogan Lovells | 28
• Maintain relevant documentation and records of all procedures and
measures adopted to comply with the GDPR according to the
accountability principle;
• Implement privacy by design and privacy by default principles each time
the company intends to launch new projects involving the processing of
personal data:
– These principles intend to ensure that the data controller has considered and integrated
data protection into its processing activities at the stage of the conception of a new
service/product, such as a connected medical device.
• Implement a procedure to manage and answer requests to access, rectify
or delete personal data received by the company from data subjects.
Policies, procedures and mechanisms to ensure compliance

29. Hogan Lovells | 29
• "Where personal data are processed for scientific or historical
research purposes or statistical purposes, Union or Member State
law may provide for derogations from the rights referred to in
Articles 15, 16, 18 and 21 subject to the conditions and safeguards referred
to in paragraph 1 of this Article in so far as such rights are likely to render
impossible or seriously impair the achievement of the specific purposes,
and such derogations are necessary for the fulfilment of those purposes."
(Article 89.2)
Future processing of data – is this possible?

30. 3. Consequences of Brexit for medical devices and clinical
investigations

31. Hogan Lovells | 31
Major issues to be addressed:
• Potential changes in the regulatory framework for medical devices
• The consequences for and of UK based notified bodies
• The consequences for and of UK based Authorised Representatives
• Role and influence of the MHRA
• The consequences for EU funds and clinical research in the UK
Brexit and the medical device industry

32. Hogan Lovells | 32
• Manufacturers and Authorised Representatives
– Like all other non-EU manufacturers, to continue to market their products within the EU
UK manufacturers may be required to appoint a European Authorised Representative
established within an EU Member State.
– Alternatively, they could decide to completely relocate their activities in the EU
– EU Manufacturers may not be able to continue to rely on Authorised Representative
established in the UK
o European Authorised representatives established in the UK may have to stop their
activities
o UK has the largest number of Authorised Representatives established in the EU
Potential consequences of for Medical Device Companies

33. Hogan Lovells | 33
• Notified Bodies
 Currently 5 notified bodies in the UK
– BSI, SGS United Kingdom Limited, Lloyd's Register Quality Assurance Ltd., Amtac
Certification Services LTD, UL International (UK) Ltd.
 UK notified bodies may lose their right to conduct conformity assessment procedures
 Manufacturers working with UK notified bodies may be required to appoint a new notified
body established in an EU Member State.
– This is likely to lead to a new conformity assessment to permit the continued marketing of
their medical devices in the EU
– Notified bodies are already refusing clients due to workload. What will be the effect of the
Brexit on new requests? Will manufacturers have to face delays in conformity assessment
procedures? What will be the impact for patients?
– Some UK notified bodies such as SGS and BSI have already other offices in another EU
Member States: this may be the solution to maintain relationship with manufacturers
Potential consequences for Medical Device companies (2)

34. Hogan Lovells | 34
• The transitional period
 There may be transitional arrangements between the UK and the EU
 There will need to be a related UK domestic law transition
• EU Institution communications
• 22 January 2018, European Commission notice to stakeholders
https://ec.europa.eu/docsroom/documents/27401
• Possibility of three relationship scenarios after the "divorce":
 The "Norwegian model"
 The "Swiss model"
 The "hard" Brexit – leaving the European Single Market and trading with the EU as if the
UK were any other country not part of the EU
Future considerations

35. Consequences for on-going clinical trials
Consequences for completed clinical trials
Consequences for future clinical trials
The new Clinical Trials Regulation
Clinical Trials

36. Hogan Lovells | 36
• Many on-going trials will be completed in the next two years
• For those trials that will begin in the next two years or will continue after this
period there will be uncertainty
– Related questions of governing law
– Minimum requirements to ensure patient safety
– Informed consent – will a new consent be required?
• Will data generated in clinical trials conducted in the UK in accordance with
EU law applicable at that time remain valid?
• Can this data be used to support an application for marketing authorisation in
the EU two years' hence?
• Will a new entity established by UK MAHs in the EU require an agreement
with the UK entity regarding ownership of this data?
Consequences for on-going clinical trials in the UK

37. Hogan Lovells | 37
• UK sites will not benefit from the multi-centre approval process provided
in the new Clinical Trial Regulation
• UK sponsors will be required to appoint a Legal Representative in the EU
• UK sponsors will be required to appoint Data Protection Representatives
in all EU Member States where sites are based
• What consequences for Clinical Trial Agreements concluded:
– By UK sponsors?
– With UK sites?
Clinical trials under the New Clinical Trials Regulation

38. Hogan Lovells | 38
• How many applications for marketing authorisation of your non-
authorised products rely on results of clinical trials conducted in the UK?
• How many on-going Clinical Trial Agreements do you have with sites in
the UK and/or with UK sponsors?
• Which of your UK clinical trial sites are benefiting from EU research
funding such as FP7?
Practical checklist

39. Hogan Lovells | 39
• Will informed consent previously given by UK patients remain valid?
• Transfer of patient data from EU Member States to the UK. What if UK is
not considered a third country granting the same level of protection as the
EU?
– Unambiguous prior written informed consent of patient
– Standard contractual clauses
– Binding corporate rules reflecting the new EU data privacy rules
• As UK sponsor/data controller:
– Have you designated a Data Protection Representative in each EU Member State where
clinical trial site is established?
Data privacy implications

40. Hogan Lovells | 40
• Closely follow developments and understand timelines for implementation of
the consequences of Brexit
• Identify manufacturers' notified bodies and consider consequences of having
a UK notified body
• Conduct an assessment of current CE Certificates of Conformity including
duration and the name and country of establishment of the issuing notified
body
• Determine shelf life of medical devices that have current CE Certificates of
Conformity and/or European Authorised Representatives in the UK
• Where necessary begin negotiations with a new notified body and negotiate
transition from existing body
Understand areas of implication

41. "Hogan Lovells" or the "firm" is an international legal practice that includes Hogan Lovells International LLP, Hogan Lovells
US LLP and their affiliated businesses.
The word “partner” is used to describe a partner or member of Hogan Lovells International LLP, Hogan Lovells US LLP or
any of their affiliated entities or any employee or consultant with equivalent standing.. Certain individuals, who are
designated as partners, but who are not members of Hogan Lovells International LLP, do not hold qualifications equivalent
to members.
For more information about Hogan Lovells, the partners and their qualifications, see www.hoganlovells.com.
Where case studies are included, results achieved do not guarantee similar outcomes for other clients. Attorney
advertising. Images of people may feature current or former lawyers and employees at Hogan Lovells or models not
connected with the firm.
© Hogan Lovells 2017. All rights reserved
www.hoganlovells.com
Thank you