1
There’s an App for That! April 13, 2015
Colleen J. Hittle, RAC | Managing Director | Navigant Consulting, Inc.
Sharon R. Klein | Partner | Pepper Hamilton LLP
DISCLAIMER: The views and opinions expressed in this presentation are those of the author and do not necessarily represent official policy or position of HIMSS.
#32302162v.2
2
Conflict of Interest
Sharon R. Klein has no real or apparent conflicts of interest to report. Colleen J. Hittle, RAC, has no real or apparent conflicts of interest to report.
3
Learning Objectives
• Explain what kinds of health care applications are currently regulated and what kinds may be in the future
• Define the current Federal regulatory landscape, including FDA, FTC, and OCR
• Define policies, procedures, training, and compliance strategies to mitigate regulatory risks
• Discuss protocol for taking a mobile medical application through the regulatory process — quality manufacturing practices including risk assessment as well as privacy and security by design
• Explain practical tips for handling PHI in mobile medical applications throughout the cycle of collection, transmission, storage, and destruction of PHI
.
4
An Introduction to the Benefits Realized for the Value of Health IT This presentation addresses the following HIMSS value STEPSTM :
T = Treatment/Clinical Improvement in treatment /clinical outcomes should be achieved by wellness and health applications being in the hands of the consumer/patient.
E = Electronic Information/Data Electronic Information/Data is the foundation of mobile medical applications. A pre-requisite of data sharing is privacy and security best practices.
P = Prevention Many health applications are centered around prevention and patient education. The more a patient takes control of his/her health problems, the better health outcomes can be achieved.
S = Savings Savings will be realized when patients with chronic conditions such as diabetes are engaged in managing their own health through applications.
http://www.himss.org/ValueSuite
5
Today’s Topics
• Mobile Health
• Regulatory Framework
• Compliance Processes
• Questions
6
Mobile Health
7
Mobile Health: A Brave New World Of Regulation
Proliferation of smart medical devices comes with vulnerabilities and a confusing web of regulations
• Cybersecurity incidents increasingly likely in wireless and network-connected devices transferring data electronically
• With increased risk comes increased regulation
8
Expansion Of Regulatory Purview
• Regulatory overlap
• Mobile health and medical devices are subject to multiple privacy/security regulations
– Food and Drug Administration (“FDA”)
– Federal Communications Commission (“FCC”)
– Federal Trade Commission (“FTC”)
– Department of Health & Human Services Office for Civil Rights (“”HHS/OCR”)
– State Law
9
It’s a Regulatory Spider’s Web…
FTC
HHS/OCR
ONC
FDA
States
FCC
10
… that can complicate an App very quickly!
FTC
HHS/OCR
ONC
FDA
States
Securities/ Shareholder Lawsuits
Regulators
Individual Plaintiff
Class Action
Media
Loss of Trust
Customer Loss
Fines
Civil Penalties
Sales/Profitt Loss
HR Issues
Audits
Investigations
Remediation
FCC
11
Regulatory Framework
12
Regulatory Framework
• HIPAA/HITECH/Omnibus Final Rule – Covered Entities
– Business Associates & Subcontractors
– Focused on Protected Health Information • Protected Health Information or PHI is “individually identifiable
health information” (IIHI), including demographic information collected from an individual, that:
– is created or received by a CE
– relates to the health of an individual
HHS – Office of Civil Rights
13
Regulatory Framework
Breach Reporting
Privacy Rule – Patient Access
– Permitted disclosures for FDA regulated activities
– Sale and marketing of information
– Research
Security Rule – Risk assessment
– Technical, Physical, Administrative Safeguards
– Policies & Procedures
HHS – Office of Civil Rights
14
Regulatory Framework Non-HIPAA Regulated Medical Data • Information sharing not from CE • Wellness Tracking • Data to person directly from medical device • Mobile medical applications
15
Regulatory Framework
• Congress has been unable to pass a Federal Privacy Bill
• Protecting Consumer Privacy in Era of Rapid Change (Report, Mar 2012)
• Mobile Privacy Disclosures, Building Trust Through Transparency (Report, Feb 2013)
• Internet of Things – Privacy & Security in a Connected World (Report, January 2015)
Federal Trade Commission
16
Regulatory Framework
• Protecting Consumer Privacy in Era of Rapid Change (Report, Mar 2012)
– Privacy by Design: • Promote privacy throughout the organization and at every
stage of development of products and services • Delete consumer data no longer needed and allow
consumers to do the same • Provide reasonable security for data • Limit collection of data (consistent with context of particular
transaction) • Implement reasonable data retention and disposal policies • Maintain reasonable accuracy of data
Federal Trade Commission
17
Regulatory Framework
• Protecting Consumer Privacy in Era of Rapid Change – Simplify Consumer Choice:
• Simplify Consumer Choice: • Provide Consumer choice for any communications not
related to original transaction • “Do Not Track” mechanisms allow consumer to control
collection and use of their online data • Certain choices require consumer to “opt in”
– Improve Transparency to Consumers: • Clearer and shorter privacy notices • Provide access to consumer data • Educate consumers about company’s data privacy practices
Federal Trade Commission
18
Regulatory Framework
IOT – Benefits of Mobile Devices Connected health devices can “improve quality of life and safety by providing a richer source of data to the patient’s doctor for diagnosis and treatment[.] . . . improve disease prevention, making the healthcare system more efficient and driving costs down],] . . . [and] provide an incredible wealth of data, revolutionizing medical research and allowing the medical community to better treat, and ultimately eradicate, diseases.”
Comment of Consumer Elec. Ass’n, #484 cmt. #00027 at 16.
19
Regulatory Framework
• Regulates the airwaves
• Wireless technology issues
• Wireless co-existence with electromagnetic compatibility
• Root cause analysis of problems with connectivity
• 802.11 wireless data security not robust
Federal Communications Commission
20
Regulatory Framework
• Mobile Medical Applications (Final Guidance, Sep 25, 2013)
– Software as a Medical Device
– FDA intends to regulate mobile medical software that poses a threat to public safety
– The key regulatory factor is the intended use of the mobile health application
– Software application is what it claims
Food & Drug Administration
21
Regulatory Framework
• Mobile Medical Applications – Regulated Applications:
• Extending the medical device to control the device or to display device data
• Using attachments, screens, sensors to transform a mobile platform into a medical device
• Performing patient specific analysis
• Assisting with diagnosis or treatment recommendations
Food & Drug Administration
Visual Acuity Test
22
Regulatory Framework
• Mobile Medical Applications – Non-Regulated Applications
• Supplementing clinical care by helping patients manage their health
• Providing patients with tools to organize/track health information
• Providing easy access to patient’s health conditions
• Helping patients document or communicate medical information to providers
• Performing simple calculations used in clinical practice
• Enabling individuals to interact with Personal Health Records (“PHRs”) and Electronic Health Records (“EHRs”)
Food & Drug Administration
EHR / PHR
23
Regulatory Framework
• Remote Urine Analyzer—FDA regulated – Uses mobile phone to
• analyze reagent dipstick
• communicate with analyzer device
– Intended Use • extension of medical device analyzer
• efficient remote way to analyze dipstick
Food & Drug Administration
24
Regulatory Framework
• Wellness Tracking—Not FDA regulated – Uses mobile phone to
• track steps
• monitor sleep
• bio feedback
– Intended Use • fitness information
• lifestyle changes not part of treatment
Food & Drug Administration
25
Regulatory Framework
• Mobile Diabetes Manager—FDA regulated – Uses mobile phone to
• input data about glucose level
• communicate with provider
– Intended Use • medication adherence
• treatment plan
• data analytics
Food & Drug Administration
26
Regulatory Framework
• Mobile Medical Applications – Regulatory Requirements
• Establishment Registration and Medical Device Listing
• Investigational Device Exemption requirements
• Labeling requirements
• Premarket submission for approval or clearance
• Quality System Regulation
• Medical Device Reporting (Adverse event reporting)
• Correcting Problems
Food & Drug Administration
27
Compliance with FDA Regulatory and Quality
Systems
28
Bringing a regulated app to FDA
• If you’re reasonably confident in your pathway: – Request an alignment meeting with FDA to
outline approval strategy
• FDA Guidance Documents govern, but typically held with 60 days of request
– Telecon, face to face, written response
• Provides non-binding feedback on approval pathway, predicate selection if applicable, feedback on clinical studies and overall validation of performance data strategy
29
Bringing a regulated app to FDA
• If you’re NOT confident in your pathway: – File a 513(g)
• 60 day review, minimal filing fee
• Provides non-binding feedback on whether or not the product is regulated, and how
• Most successfully executed when the submitter presents a strategy and asks for comments
30
SOFTWARE AS A MEDICAL DEVICE
(1) 2008 comprehensive survey on benchmarking commissioned by The Global Benchmarking Network. Over 450 organizations responded from over 40 countries.
(2) European Centre for Best Practice Management 2010 Research Paper (RP-ECBPM/0005)
Software Type Classification
Lab Information Software Class I
Medical Device Data Systems Class I
Blood Banking Software Class II
Imaging Software (Radiology) Most are Class II
Drug Dosing Calculator Class II
Software for Diagnosis/Treatment Class II
Medical Computers and Software for Ophthalmic Use Class III
Medical Computers and Software Unclassified
Software that Controls a Device Firmware
31
UNDERSTANDING RISK
(1) 2008 comprehensive survey on benchmarking commissioned by The Global Benchmarking Network. Over 450 organizations responded from over 40 countries.
(2) European Centre for Best Practice Management 2010 Research Paper (RP-ECBPM/0005)
BMI calculator
Trending algorithm for determining next clinical action
Radiation dose calculator
Medical image analyzer for disease/anomaly detection
Medication reminder
Drug-drug interaction/ allergy verification
Cancer treatment recommendation
Complex analyzer for untrained user
Low Risk High Risk
Influenced by: • General acceptance • Pervasiveness • Complexity • Extent of Reliance
32
510(k) clearance process • Predicate selection • Intended Use • Validation data • Labeling • Performance Data • Software details
33
(1) 2008 comprehensive survey on benchmarking commissioned by The Global Benchmarking Network. Over 450 organizations responded from over 40 countries.
(2) European Centre for Best Practice Management 2010 Research Paper (RP-ECBPM/0005)
Mobile MIM – medical image software (K103785)
Mobile MIM is a professional use diagnostic imaging app for the iPad®, iPhone®, and iPod touch®
Mobile MIM provides wireless and portable access to medical images
Review X-rays and ultrasounds as well as PSECT, PET, CT and MRI
This device is not intended to replace full workstations and should be used only when there is no access to a workstation
This device is not to be used for mammography
http://www.mimsoftware.com/products/mobile/
34
(1) 2008 comprehensive survey on benchmarking commissioned by The Global Benchmarking Network. Over 450 organizations responded from over 40 countries.
(2) European Centre for Best Practice Management 2010 Research Paper (RP-ECBPM/0005)
AliveCorp ECG
A clinical-quality, low-cost mobile, single-lead ECG device
Can send GPS data with ECG and accelerometer and gyroscope readings from phone
Available for sale. Recently cleared for sale as a medical device in the USA (K122356)
http://alivecor.com/
35
(1) 2008 comprehensive survey on benchmarking commissioned by The Global Benchmarking Network. Over 450 organizations responded from over 40 countries.
(2) European Centre for Best Practice Management 2010 Research Paper (RP-ECBPM/0005)
ResolutionMD Mobile – radiological image processing
Delivers anytime, anywhere full-functionality advanced visualization of medical images without storing patient data on the mobile device
ResolutionMD Mobile is approved by Health Canada and CE Mark for diagnostic use
Calgary Scientific also has FDA clearance for ResolutionMD Mobile within the United States (K111346)
Product requires access to a configured ResolutionMD Server
Web version cleared in April 2012 (K120076)
http://itunes.apple.com/ca/app/resolutionmd-mobile/id354551580?mt=8
36
iVitals
Manual entry of healthcare information
Demonstration highlights cardiovascular and diabetes information and trend reports/graphs
http://myvitalsigns.com/
37
(1) 2008 comprehensive survey on benchmarking commissioned by The Global Benchmarking Network. Over 450 organizations responded from over 40 countries.
(2) European Centre for Best Practice Management 2010 Research Paper (RP-ECBPM/0005)
MBC Burn Care
Stand-alone and interactive tool developed by Euro-Mediterranean Council for Burns and Fire Disasters for the Emergency/Critical Care Burn Management
It is intended to be a support for not specialized medical staff of emergency wards, peripheral hospitals and general medicine
App allows rapid calculation of %TBSA and the personal fluid requirements considering all patient’s data (adult & child)
http://itunes.apple.com/app/mbc-burn-care/id539490121?mt=8
38
(1) 2008 comprehensive survey on benchmarking commissioned by The Global Benchmarking Network. Over 450 organizations responded from over 40 countries.
(2) European Centre for Best Practice Management 2010 Research Paper (RP-ECBPM/0005)
iStethescope Pro
Turns your iPhone into a stethoscope, allowing you to listen to your heat beat and see your heart waveform, or listen to other quiet sounds around you
The professional version includes the ability to see and email a spectrogram of the audio, shows tips and information, and has no advertisements
Please note that this app is intended to be used for entertainment purposes and as a demonstration of the technology. It is not intended to be used for the diagnosis of disease or other conditions, or the cure, mitigation, treatment, or prevention of disease and should not be used as a medical device
http://itunes.apple.com/us/app/istethoscope-pro/id322110006?mt=8
39
(1) 2008 comprehensive survey on benchmarking commissioned by The Global Benchmarking Network. Over 450 organizations responded from over 40 countries.
(2) European Centre for Best Practice Management 2010 Research Paper (RP-ECBPM/0005)
Medi-Calc
Allows the user to calculate the proper medication infusion rate
Since it is based on infusion rates, (i.e. mcg/kg/min), not specific medications, it is versatile enough to be used with ANY medication
To be used in all clinical environments: EMS, Emergency Department, ICU, medical offices and even veterinary medicine
Also included are weight and temperature conversions, common pediatric calculations, medication bolus calculations, and the Parkland Burn Formula for fluid resuscitation
http://itunes.apple.com/kz/app/medi-calc/id529797939?mt=8
40
(1) 2008 comprehensive survey on benchmarking commissioned by The Global Benchmarking Network. Over 450 organizations responded from over 40 countries.
(2) European Centre for Best Practice Management 2010 Research Paper (RP-ECBPM/0005)
Easy ECG
Application that helps the user interpret cardiac rhythms in Lead 2 by having the user answer a series of simple questions based on the presence, absence, or measurement of various characteristics on a patient’s ECG printout
While it is intended for case review or studying, EasyECG is written to be easy enough to allow someone with no ECG training whatsoever to interpret an ECG rhythm
http://itunes.apple.com/kz/app/easy-ecg/id400719632?mt=8
41
(1) 2008 comprehensive survey on benchmarking commissioned by The Global Benchmarking Network. Over 450 organizations responded from over 40 countries.
(2) European Centre for Best Practice Management 2010 Research Paper (RP-ECBPM/0005)
Infuse
A medication infusion and bolus calculator built for healthcare providers of all backgrounds. Infuse provides you all the tools you need to quickly calculate drug dosing whether by infusion or bolus.
Medications are able to be added, edited and removed and even remain editable once selected so that the specific concentration or dose/rate can be adjusted.
Bolus section adds items such as route, frequency and duration of administration.
15 common drugs are included to get you started with more coming in future updates.
http://itunes.apple.com/kz/app/infuse/id312617951?mt=8
42
Quality System challenges
43
Design Documentation Considerations
• Development activities must be documented • This needs to start early in the process
– Validation • Software version control
– Documented process • Training, Supplier Controls
44
Practical Takeaways
45
Practical Takeaways
• Appoint committee to monitor relevant regulatory guidance
• Educate developers of mobile medical applications when regulatory line(s) are crossed
• Keep software separate from regulated medical devices
• Follow and document privacy/security and quality principles
• Take precautions to eliminate malware contamination
46
Practical Takeaways
• Monitor network connectivity for misuse
• Perform and update risk analysis for security/privacy
• Develop incident response programs especially for life sustaining devices
• Obtain consent for collection of personally identifiable information
• Look for common compliance principles across regulatory agencies
• Document compliance with privacy/security criteria
47
A Review of Benefits Realized for the Value of Health IT This presentation addressed the following HIMSS value STEPSTM :
T = Treatment/Clinical Improvement in treatment /clinical outcomes should be achieved by wellness and health applications being in the hands of the consumer/patient.
E = Electronic Information/Data Electronic Information/Data is the foundation of mobile medical applications. A pre-requisite of data sharing is privacy and security best practices.
P = Prevention Many health applications are centered around prevention and patient education. The more a patient takes control of his/her health problems, the better health outcomes can be achieved.
S = Savings Savings will be realized when patients with chronic conditions such as diabetes are engaged in managing their own health through applications.
http://www.himss.org/ValueSuite
48
Questions?
Sharon R. Klein Pepper Hamilton LLP [email protected] 949.567.3506
Colleen J. Hittle, RAC Managing Director Navigant Consulting, Inc. [email protected] 317.228.8730
Top Related