1. Work product for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views NEEDED REGULATORY CHANGES A report of the typist for the Regulation Subgroup (i.e. no one has approved this) Draft 07/11/13

2. Work product for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views Questions considered 1. Are the three regulatory systems – ONC, FCC and FDA – deficient in any way with regard to how HIT is regulated? 2. Are there ambiguities in the three regulatory systems that need to be clarified so that HIT vendors and others can proceed more easily to innovate? 3. Do any of the three regulatory systems duplicate one another, or any other legal, regulatory or industry requirement? 4. Is there a better way to assure that innovation is permitted to bloom, while safety is assured?

3. Work product for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views FDA issues ItemIssue: A or B Description of challenge Wellness/disease borderline A & BFDA needs to explain how to discern disease related claims from wellness, and needs to deregulate low risk disease related claims Accessory issuesA & BFDA needs to explain its position on which basic IT elements are regulated when connected to a medical device, and deregulate or down-regulate those that are low risk CDS softwareAFDA needs to explain which forms of clinical decision support software it regulates Software modularization AFDA needs to specify its rules for deciding the regulatory status of software modules either incorporated into a medical device, or accessed by a medical device A = Ambiguous and B = Broken at the written law level

4. Work product for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views FDA issues ItemIssue: A or B Description of challenge QS application to standalone software AFDA needs to explain how the quality system requirements and facility registration apply to manufacturing of standalone software Premarket requirements for interoperable devices AFDA needs to adopt a paradigm for reviewing software that is intended to be part of a larger, but unspecified, network Postmarket requirements for networks A & BResponsibilities for reporting adverse events and conducting corrective actions can be clarified, but also likely need a new approach that reflects shared responsibility across users, producers, and across regulatory agencies A = Ambiguous and B = Broken at the written law level

5. Work product for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views FDA Program Administration FDA lacks internal coordination of policy on HIT software, and mobile medical apps  Inconsistent regulatory treatment and information dissemination by FDA officials, reviewers and staff to public inquiries about HIT, mobile medical apps  FDA should coordinate internal understanding of policy positions and regulations to maximize consistency and help eliminate ambiguity and misinformation FDA should utilize external facing resources to proactively educate the public about how policies and regulation impact HIT  CDRH Learn, Device Advice, DSMICA should be used more effectively FDA lacks policy and guidance on HIT software, mobile medical apps  Lack of informational policy material or timely guidance documents on HIT  Lack of final guidance on 2011 Mobile Medical Apps  Lack of updated guidance on issues that affect HIT: 2007 Draft RF Wireless Tech, 1997 Deciding When to Submit Change (510(K) Modification) FDA should actively establish policy of “Enforcement Discretion” for lowest-risk HIT, where enforcement of regulations is inappropriate  Enforcement Discretion is deregulatory and immediate  Enforcement Discretion would quickly provide transparency and eliminate regulatory ambiguity and industry fear FDA should assess exemption from GMP for lower-risk HIT

6. Work product for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views ONC issues ItemIssue: A or B Description of challenge Mandatory elements BONC program does not include capability in law enforcement, nor its programs framed with mandates where necessary Assurance of Safe Configuration ASafety depends on appropriate post-installation configuration. No means to educate or require compliance with documented and evolving best practices Certification program BONC should avoid its certification approach because the certification approach is most damaging to innovation and, by defining specific solutions, potentially damaging to patient safety by endorsing less optimal solutions. A = Ambiguous and B = Broken at the written law level

7. Work product for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views FCC issues ItemIssue: A or B Description of challenge Post-installation Surveillance ASpectrum management and identification, diagnosing, and resolving wireless co-existence/EMC problems that affect HIT and medical device performance (in healthcare facilities and mHealth environments) A = Ambiguous and B = Broken at the written law level

8. Work product for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views Cross agency issues ItemDescription of challenge Coverage of interoperability issues FDA/ONC Unclear and incomplete responsibility over ensuring needed interoperability. ONC may regulate HIT/medical device interface and FDA regulates med device/med device interface. But same med device (e.g. infusion pump) could be installed in either configuration. Who is responsible for resolving? More generally, who will require interoperability when products need to be interoperable to be used safely?* FCC/FDA reviewFCC and FDA do not coordinate their review processes on converged medical devices that are brought before both agencies (FCC’s equipment authorization program and FDA’s premarket review). Coordination between agencies should be transparent and help ensure consistency thereby eliminating duplicative, time consuming, and costly hurdles. FCC/FDA conformity assessment Incomplete/missing clinically focused wireless conformity assessment tools that would facilitate safety and co-existence analysis *See interoperability FDA Pre-IDE regulatory research project: http://www.mdpnp.org/MD_PnP_Program___MDISWG.html

9. Work product for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views Improvements to adverse event reporting ItemIssue: A or B Description of challenge Difficult to obtain data for system performance analysis AWhen medical device-HIT “system related” adverse events occur, it is often difficult or impossible to find the root cause of the failure. Data logs may be incomplete, non-existent, not in standardized format. See exemplar doc and WG meeting slides. (note: linkage to interoperability issues) Root cause of events may span regulated and non-regulated space BWhat is best model for reporting and analyzing issues with systems of devices/equipment that span (multiple agency) regulated and non-regulated space? Group surveyed existing approaches: NHTSA, CPSC, ASRS, FDA MedSun and ASTERD, NTSB, and PSOs. Further analysis needed. Notion of a new construct - Health IT Safety Administration (“HITSA”) was discussed. Broad stakeholder involvement emphasized. Adverse events should be accessible early and broadly BEarly access to safety and performance data to enable rapid improvements was emphasized. Example of efficiency of modern “social media” for aggregation and dissemination. A = Ambiguous and B = Broken at the written law level

10. Work product for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views Big picture improvements Classification--FDA should classify in clear terms any HIT software that qualifies as a medical device  Take the taxonomy workgroup report and classify all of it as unregulated (enforcement discretion) by FDA (Class 0) except for certain carve outs, as follows: MDDS Medical device accessories (to be defined clearly by FDA) Certain forms of high risk CDS (to be defined clearly by FDA) Higher risk software use cases per the Safety WG report  This classification would be provisional, to be re-examined in 3-5 years to consider The enhanced data collected under changes made pursuant to the slide before The development of active private sector initiative in the slide that follows

11. Work product for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views Big picture improvements In lieu of FDA regulation for HIT as delineated in the slide before, we recommend that FDA/ONC/FCC use their collective powers of persuasion to encourage and organize private sector oversight including,  Creation and adoption of needed standards  Private certification of interoperable products to be used in networks  A public process for customer rating HIT  Local responsibility for oversight of end user modifications