FDASIA WG Regulations Sub-Group Report Out HIT Policy Committee FDASIA WG May

Breakout Topics Clarification of “regulation” – FDA vs non FDA – Written vs. applied Notion of scope of “safety” Review of published literature for regulatory duplication and ambiguity – Deliverables will be: prioritized list of ambiguities and duplication requiring resolution Potential new issues that need to be avoided Proposed solutions – Will assess recommendations / work products from other groups to guide our recommendations

Examples to help clarify regulatory recommendations EHR-medical device data representation/gaps – Hazards cross FDA regulated and other spaces Data time stamping Technology complexity is not necessarily aligned with severity of risk – PCA example Interoperability Need for surveillance of HIT systems – Data logging / black box recording as a basis for improving system safety

Experiment Experiment: Simulator is set to create transient desaturation 99%->70%->99% 2 sec averaging time 8 sec averaging time Pulse Ox is set to: 16 sec averaging time What is the real O 2 saturation? Which value will be recorded in EHR? Averaging time should be included in EHR data Julian M. Goldman, MD / MGH Photos of pulse ox screens when they display the lowest saturation

Monitor GE Monitor Recorded Low SpO 2 Alarm Event “84%” No evidence of low SpO 2 in EHR Example: Low pulse oximetry value created an alarm. Low sat data is not recorded by EHR Alarm event is not captured in EHR WHY? Configuration? Intended performance? What if caused by performance issue with IT h/w (“Cisco router”) Julian M. Goldman, MD / MGH

Sources of variation in EHR documentation d/t Data Sampling Patient’s “actual” SpO2 minimum = 70% Pulse Oximeter Displayed SpO2 at 8-second averaging time SPO2= Seconds Example of possible EHR sample points for 1-minute recording Based on this example, EHR May record SpO2 as: 98% 92% 80% 75% Etc.

Device Clock Time Errors: Undermine system integrity and can create emergent hazards Clock time may originate in medical device, be consumed by other systems.

Medical Devices

EMR EMR time stamp error Blood gas analyzer in OR

Consolidated 4 Hospital Summary (Draft) Device Type CountStdDev OffsetAverage OffsetMaximum Offset Medical Devices (Excl. Workstations & Wall Clocks)13241:32:340:33:2616:42:10 All devices 17321:22:12 0:25:58 16:42:10 Networked Devices that Auto-Sync2910:02:160:00:530:31:16 Stand-alone Devices9501:46:380:46:0616:42:10 Hospital A520:31:110:30:251:52:00 Hospital B4951:41:230:32:5516:42:10 Hospital C4680:47:120:17:1013:39:28 Hospital D7171:27:240:26:3513:18:47 Draft – unpublished data

Incorrect dates Device Location Device Location (Room) Device Type Manufacturer/ Model Date Picture Taken Date on Device Device Offset (DAYS) General UnitPatient TowerBladder ScannerBVI /7/20111/8/201262D Adult ER Emergency Department Bladder Scanner Verathon Medical/ BVI /22/201111/2/ D Adult ER Emergency Department Bladder Scanner Verathon Medical/ BVI /22/201111/16/2011-6D ORHallway 1Imaging System Volcano S5 Cart Monitor 7/8/20117/7/20111D Neuro Angio Radiology Display *N/A*11/21/201111/18/2011-3D PACU Ultrasound Sonosite M- Turbo 11/29/20111/1/ years NICU VentilatorDrager/ Evita XL11/29/201111/1/20165 years Draft – unpublished data

Device Clock Time Errors: Undermine system integrity and can create emergent hazards Treatment errors, barriers to analysis of adverse events Is this an example of an “interop problem” that should be solved in the proposed framework?

Patient-Controlled Analgesia (PCA) system safety concerns PCA Pump (With patient button) Nurse call Patient Patients can call to request more analgesia, but, cannot call for help when over-medicated. Over-medication can cause respiratory and cardiac arrest Comprehensive monitoring is not typically used due to high false/nuisance alarm rate How can we improve safety of this system? Solution: Smarter alarms with sensor fusion + capability to stop medication infusion prior to injury

PCA Safety Issues continue saved-leah-2/ This is the story of an 11 year old who died from narcotic-induced respiratory depression. "Ten years after my daughter's death, nothing has changed in the codes of monitoring post- op patients continuously, until they leave the hospital. Alive." This is a statement from a multi-hospital coalition frustrated by ongoing adverse patient events: "A closed-loop system, which stops or pauses opioid dosing if respiratory depression is detected, is desirable. Systems are most ideally centrally monitored. In any case, alarms should be audible or otherwise available to the primary caregiver, and a mechanism for prompt response should be in place." "Carly Ann Pritchard... suffered an ankle injury and then underwent surgery to reduce lingering pain from her ankle injury. Unfortunately, although she survived surgery, she suffered brain damage because of an accidental overdose from a morphine-filled pain pump - after surgery. A California appeals court recently upheld a jury's award of about $9.9 million in damages."

Newsletter “A particularly attractive feature may be the ability to automatically terminate or reduce PCA (or PCEA) infusions when monitoring technology suggests the presence of opioid-induced respiratory depression. To facilitate such capabilities, we strongly endorse the efforts to develop international standards for device interoperability and device-device communication. It is critical that any monitoring system be linked to a reliable process to summon a competent health care professional to the patient's bedside in a timely manner.” Risk to patient of adding these capabilities is very low, although technology is sophisticated

Reporting … PCA as example Injury due to pump failure -> FDA report Injury due to HIT-related contribution (body weight error, allergy data lost, etc.) no report? Injury due to INABILITY integrate devices and HIT systems to prevent error – not reported

Interoperability Key enabler of HIT-based healthcare transformation Un-disciplined system integration has been introducing new hazards.

“Reporting” Leverage HIT for Surveillance IT’s strength is surveillance Can we reduce pre-market regulatory burden by improving surveillance of system – medical device + HIT components Single point of reporting adverse events and means to resolve issues – especially that cross regulated and “non regulated” spaces

Data Logger or Clinical Black Box Recorder Data Log supports Analysis and Playback for two complementary purposes: – Analysis of device / system interactions (debugging) – Analysis of adverse events involving patients (clinical) The log may include: – Commands – Button presses – Information about the status of devices – Device connections and disconnections Planes, Trains, Automobiles …

Proposed Next Steps wrt safety and regulatory framework Develop use cases to tease out Regulatory Framework requirements – Include high and low acuity – Usage venues: mHealth etc. Identify common needs across use cases (these or others)