An HHS workgroup unveiled its preliminary recommendations on how to regulate health information technology Aug. 7 in Washington.

The recommendations emphasize the need to focus regulatory attention on high-risk products, while minimizing requirements for the large swath of health IT offerings that are low risk. The proposals also describe the need for a strong adverse event reporting system and for better coordination between the relevant federal agencies.

The workgroup is mandated by the FDA Safety and Innovation Act to provide input to the Health IT Policy Committee, which in turn may directly convey the workgroup’s recommendations to FDA, the Federal Communications Commission and HHS’ Office of the National Coordinator for Health Information Technology, which need to submit a report to Congress by January detailing plan for regulating health IT. (See Also see "HHS Health IT Regulations Work Group Sets Path Forward" - Medtech Insight, 6 May, 2013..)

The preliminary recommendations presented last week at a meeting of the HHS Health IT Policy Committee were meant to gather comments and criticisms in preparation for revision. The workgroup has until September to hand over a proposal to the Policy Committee.

In general, health IT “should not be subject to FDA pre-market requirements, except for medical device accessories … [and] certain forms of high-risk clinical decision support, such as computer-aided diagnostics,” the report states.

Harvard School of Public Health professor David Bates, chair of the workgroup, presented the recommendations. Members of the workgroup include representatives from the device, diagnostics, health IT and software industries, as well as venture capitalists, health care providers and attorneys. Industry representatives include IBM, Phillips and Roche Diagnostics as well as representatives from trade organizations like the Medical Imaging & Technology Alliance.

Bates began by noting that while “the literature suggests that HIT clearly appears to improve safety overall,” some examples and anecdotes of adverse events have surfaced. For example, he pointed to a case where the mortality rate in one hospital ward more than doubled after introduction of a computerized physician order entry system. And he noted that it can be difficult to determine the chain of responsibility when something goes wrong with software, in particular, whether the problem is the software itself, the combination of two software programs, or the manner in which the tools were implemented.

Because of such reports, the workgroup argues that it is necessary to classify, regulate and track health IT functions.

The draft report relies on a matrix to sort specific functions of product types into low-, medium- and high-risk categories. Among the potential factors recommended to consider for risk classification: the purpose of the product (for example, does it automate decision-making or does it simply convey information); the intended user; the potential severity of injury if something goes wrong; the transparency of operations; the complexity of software and maintenance; and a product’s use as part of comprehensive software/hardware suite. As a product is scored along the matrix, it would be up- or down-classified into separate categories.

In general, “[It’s] easier to classify lower-risk applications,” Bates observed.

Low Risk, Low Regs

The report envisions a regulatory system imparting minimal oversight on a broad array of health IT tools that are likely to be classified as low risk.

At minimum, the workgroup recommends, “Vendors should be required to list products [in an FDA registry] which are considered to represent at least some risk if a non-burdensome approach can be identified to doing so.”

But, in general, health IT “should not be subject to FDA pre-market requirements, except for medical device accessories … [and] certain forms of high-risk clinical decision support, such as computer-aided diagnostics,” the report states. It leaves open the possibility of pre-market requirements for other higher-risk software products, and asks for more clarification from FDA on issues including accessories, the border between a “wellness” and a “health” use, and on the issue of software modularization.

The report also asks FDA to exempt lower-risk health IT from good manufacturing practice requirements, and also to quicken its pace of releasing guidance documents on software and mobile medical apps. But the prospect of accelerated release of guidance FDA on these topics has been a point of contention. In June, a coalition of signatories led by the Bipartisan Policy Center asked FDA to delay guidance on health IT matters, including mobile medical apps, until FDA, ONC and FCC are able to release their report to Congress in January. (See Also see "Digital Health In Brief" - Medtech Insight, 1 July, 2013..)

The draft recommendations also suggest the need for changes in the structure of FDA itself. The agency “lacks internal coordination on HIT software, and mobile medical apps policies and regulatory treatment,” the report says. It also advocates for better education of the public on the impact of regulation. “There may exist a need for additional funding to appropriately staff and build FDA expertise in HIT and mobile medical apps.”

Others have made a similar argument. In June, Rep. Mike Honda, D-Calif., introduced a bill that would – among other things – create an Office of Wireless Health in FDA to add personnel and expertise to the agency. (See Also see "Rep. Honda Reintroduces Bill To Create FDA Office Of Wireless Health" - Medtech Insight, 24 June, 2013..)

The workgroup further argues that more coordination is needed between FDA and ONC, and FDA and FCC. With FDA and ONC, it writes, there is “unclear and incomplete responsibility over ensuring needed [device] interoperability,” citing confusion over responsibility for infusion pumps as an example.

“More generally, who will require interoperability when products need to be interoperable to be used safely?” the report asks.

FCC and FDA could also do a better job with coordinating their review processes of devices that require use of wireless spectrum, the report notes. (See Also see "FCC Simplifies Process To Access Wireless Spectrum For Device Clinical Trials" - Medtech Insight, 6 May, 2013..)

Post-Market Approach

On the post-market end, the report states that “approaches are needed to allow aggregation of safety issues at the national level, including federal support.”

Specifically, the report argues, it is “difficult to obtain data for system performance analysis,” elaborating that “when medical device-HIT ‘system-related’ adverse events occur, it is often difficult or impossible to find the root cause of the failure. Data logs may be incomplete, inaccessible, non-existent [and] not in standardized format.”

The report also charges that regulations are “broken at the written-law level” for determining how to report the root cause of events that involve both regulated and non-regulated products. “What is the best model for reporting and analyzing issues with systems of devices [and] equipment that span [multiple agencies’] regulated and non-regulated space?” it asks. “Further analysis [is] needed.”

Regulations are similarly flawed in making adverse events accessible early and to a broad audience. The “current reporting pathway often does not facilitate timely resolution,” the report notes, emphasizing the need for better access to safety and performance data.

The lack of data may stem from limits imposed by vendors, the workgroup warns. “FDA and other agencies need to take steps to strongly discourage vendors from engaging in practices that discourage or limit the free flow of safety-related information.”

FCC also needs to do more with “spectrum management and identification,” the report adds.

Since some of the problems with health IT can occur with the implementation of software rather than any inherent design problem, hospital regulators and accrediting agencies like the Joint Commission may need to get involved to ensure best practices, Harvard’s Bates indicated in an answer to a question from outgoing ONC director Farzad Mostashari.

The report also advocates for further development – perhaps with the cooperation of private and public sectors – of adoption and creation of standards, and “a public process for consumer rating of HIT to enhance transparency.”

Workgroup Unveils Preliminary Health IT Regulation Proposals

More from Archive

More from Medtech Insight