FDA Releases Details and Timelines in Its Digital Health Innovation Action Plan

On July 27, FDA published its Digital Health Innovation Action Plan. The plan provides details and timelines for the agency’s Digital Health Innovation Plan, announced by FDA Commissioner Scott Gottlieb last month.

The action plan describes the agency’s “next steps” over the coming year to “encourage digital health innovation by redesigning [FDA’s] policies and processes and modernizing [the agency’s] tools so that they match the needs of digital health technology, and provid[e] clarity on those policies and processes so that manufacturers and developers know what they need to do.” The action plan includes three action items: (1) issuing new guidance regarding the regulation of digital health, (2) developing new regulatory approaches to oversight of digital health, and (3) building expertise on digital health within the agency.

Issuing New Guidance

The Digital Health Innovation Action Plan presents FDA’s intent to issue new guidance implementing the 21st Century Cures Act and to expand on the agency’s prior guidance regarding digital health. FDA plans to issue the following guidance documents:

  1. 21st Century Cures Act Implementation: FDA intends to issue new draft guidance that would explain the effect of the software provisions of the 21st Century Cures Act on existing FDA policy. The new draft guidance would interpret how Cures affects:
  • Mobile Medical Applications. The new guidance would update FDA’s February 2015, final guidance on Mobile Medical Applications.
  • Medical Device Data Systems (MDDS), Medical Image Storage Devices, and Medical Image Communications Devices. The new guidance is expected to harmonize FDA’s February 2015 final guidance, announcing an enforcement discretion policy for these devices, and section 3060 of the 21st Century Cures Act, exempting many of the same software products from the definition of a device. Hopefully, the new guidance will address discrepancies between existing guidance and the 21st Century Cures Act (the new statutory provisions, of course, now govern). For example, the existing guidance states that FDA exercises enforcement discretion for MDDS that are not intended to be used in connection with active patient monitoring, whereas the statutory provision includes no similar explicit limitation.
  • Low-Risk General Wellness Products. Under FDA’s July 2016, final guidance, General Wellness: Policy for Low Risk Devices, FDA exercises enforcement discretion for general wellness products (both software and non-software products). The 21st Century Cures Act exempts from the definition of a device software functions intended to maintain or encourage a healthy lifestyle that are unrelated to the diagnosis, cure, mitigation, prevention, or treatment of a disease or condition. The new guidance is expected to address whether FDA will read the 21st Century Cures Act provision to be broader or narrower than the scope of FDA’s enforcement discretion for general wellness devices.
  • Laboratory Workflow. The 21st Century Cures Act exempted from the definition of a device a software function intended for administrative support of a health care facility, including laboratory workflow, which the new guidance will address.
  1. Clinical Decision Support Software: The 21st Century Cures Act exempted from the definition of a device, software functions intended to support or provide recommendations to a healthcare professional, so long as the software enables the healthcare professional to independent review the recommendation and the software is not intended to “acquire, process, or analyze a medical image or a signal from an intro diagnostic device or a pattern or signal from a signal acquisition system.” FDA has not addressed such clinical decision support software in prior guidance, and the meaning of many key terms in this provision will benefit from FDA guidance, including what it means for a health care professional to “independently review” the basis for clinical decision support recommendations. FDA intends to issue a much-needed new draft guidance for public comment during Q1 2018 describing the scope of this provision.
  2. Multifunctionality: FDA intends to issue draft guidance by Q1 2018 on how FDA will address products with multiple software functions (a pivotal statutory term in section 3060 of the 21st Century Cures Act). The 21st Century Cures Act exempted from the device definition specific health software functions, but FDA still may assess the “impact” of a non-device function(s) on a regulated device function(s). Many digital health solutions, of course, will include a function(s) that meets the device definition and a function(s) that does not meet the device definition. The new FDA guidance presumably will address not only how FDA will undertake the “impact” assessment of a non-device function(s) on a regulated device function(s), but also provide additional insights on how developers should subdivide digital health solutions into specific “functions” for the purpose of charting a regulatory path forward on particular functions.
  3. Deciding When to Submit a 510(k) for a Software Change to an Existing Device: In August 2016, FDA released a draft guidance intended to help manufacturers determine whether a modification requires premarket submission and clearance of a new 510(k). FDA intends to issue the final guidance before the end of 2017.
  4. International Medical Device Regulators Forum approach to clinically evaluating software as a medical device (SaMD): In October 2016, FDA issued as draft guidance the IMDRF proposed document on the clinical evaluation of SaMD. FDA intends to issue final guidance once the IMDRF votes on the final document in September 2017.

Reimagining Digital Health Oversight

FDA intends to develop a precertification (“Pre-Cert”) program, under which CDRH could pre-certify “eligible digital health developers who demonstrate a culture of quality and organizational excellence based on objective criteria.” Pre-certified developers could qualify to be able to market their lower-risk devices without additional FDA review or with a more streamlined premarket review.

As an initial step, the agency is launching a Pre-Cert Pilot Program for nine participating companies to help the agency assess the appropriate criteria and structure for the Pre-Cert Program.

For more details on the Pre-Cert Program and pilot program, see our blog post.

Building Agency Expertise

FDA plans to grow the agency’s digital health expertise by hiring new staff for the Digital Health Program within CDRH. FDA will launch an Entrepreneurs in Residence program this fall to allow the agency to obtain input from those with experience in software development.


Europe Consults on Digital Health

Digital health solution providers, and users of digital health services, should take note of three recently launched EU public consultations in the digital health space, and may wish to make submissions to help shape the future of digital health initiatives in the EU.  The earliest deadline for submissions is 16 August 2017.

EU Commission Transformation of Health Care in the Digital Single Market Consultation

On 20 July 2017, the European Commission launched a consultation on the “Transformation of Health and Care in the Digital Single Market”.  This Consultation covers three broad areas:

  • Cross-border access to and management of personal health data.
  • A joint-European exploitation of resources (including digital infrastructure), to advance health research, disease prevention, treatment and personalised medicine.
  • Promoting the uptake of digital innovation to support citizen feedback and interaction between patients and health care providers.

Submissions to the Consultation close on 12 October 2017.

Consultation results will feed into a European Commission policy document known as a “Communication”, which is expected to be announced by the end of the year.

EU Commission Communication on Digital Transformation of health and care in the context of the Digital Single Market Roadmap

On 19 July 2017, the European Commission published a roadmap outlining the European Commission’s intentions for Communication.  The roadmap aims to:

  • Enable citizens’ secure access to electronic health records and e-prescriptions and the possibility to share them across borders when traveling, working or living in another Member State.
  • Advance research, disease prevention and personalised health and care in key areas by enabling access to data sets and medical expertise across borders.
  • Promote widespread uptake of digital tools to facilitate patient feedback and better interaction/cooperation between citizens and healthcare providers, leading to better health care services and empowered citizens.

From the roadmap, it does not look like any legislation is anticipated (e.g. there is no reference to an “e-health Directive” that would provide for a pan-EU basis for secondary use of patient data).  The roadmap is also silent on the European Commission’s wider free flow of data legislative intentions.  The Commission is accepting feedback on the roadmap until 16 August 2017.

EU Presidency Digital Health Society Consultation

Finally, we note that the Estonian Presidency of the Council of the European Union has also launched a brief Digital Health Society consultation.  This consultation includes questions relating to whether citizens are sufficiently informed of the benefits of the sharing of data for health care services or research, ensuring there is adequate precaution to guarantee the privacy, confidentiality, and security of data, and interoperability challenges.  This consultation is open until 30 August 2017.

Getting involved

Interested parties, including digital health solution providers, operators and users of digital health tools, public authorities, hospitals, insurers and researchers and research institutions should consider making submissions to these consultations help shape digital health policy in the EU on wide-ranging matters including data privacy, medical device and healthcare regulation, and consumer rights.

For further information please contact:

Daniel Pavin

Grant Castle

Brian Kelly

Sarah Cowlishaw

Joshua Gray

ICO Rules UK Hospital-DeepMind Trial Failed to Comply with UK Data Protection Law

The UK Information Commissioner’s Office (“ICO”), which enforces data protection legislation in the UK, has ruled that the NHS Royal Free Foundation Trust (“Royal Free”), which manages a London hospital, failed to comply with the UK Data Protection Act 1998 in providing 1.6 million patient records to Google DeepMind (“DeepMind”), requiring the Royal Free to sign an undertaking committing to changes to ensure it is acting in line with the UK Data Protection Act.

On September 30,  2015, the Royal Free entered into an agreement with Google UK Limited (an affiliate of DeepMind) under which DeepMind would process approximately 1.6 million partial patient records, containing identifiable information on persons who had presented for treatment in the previous five years together with data from the Royal Free’s existing electronic records system.  On November 18, 2015, DeepMind began processing patient records for clinical safety testing of a newly-developed platform to monitor and detect acute kidney injury, formalized into a mobile app called ‘Streams’. Continue Reading

European Cloud in Health Advisory Council Calls For Review of eHealth Rules and Ethics of Medical Data Re-Use

On May 11, 2017, the European Cloud in Health Advisory Council (ECHAC) – a group of healthcare organizations, technology companies and patient representatives  –  launched its second whitepaper focused on use of data to improve health outcomes and delivery of care.

ECHAC launched the whitepaper at an eHealth Week 2017 session attended by ECHAC participants and members of the European Parliament, European Commission and several national health ministries.

The whitepaper identifies the advances that technologies like cloud computing and artificial intelligence are driving in areas such as telemedicine, clinical decision support software, carer productivity, health service optimization and research.  The paper also highlights regulatory and policy “blockers” to the roll out of technology in the healthcare sector — including national rules that unduly restrict (or are perceived to restrict) processing or storage of patient data in the cloud.

The paper recommends that as EU Member States take measures to implement the new EU General Data Protection Regulation (“GDPR”), they consider whether there is an opportunity to update national laws that unnecessarily restrict cloud usage in the health sector, such as localization requirements for patient data and burdensome national certification regimes that do not map to international standards.  The paper also points, as a best practice, to those national health services that are pioneering a “cloud first” IT strategy (Ireland being a leading example).

The whitepaper also considers appropriate regulatory frameworks for “secondary” re-use of patient data (i.e. use of data to improve health, care and services through research and planning).  The whitepaper concludes that unlike use of data for primary purposes, where there is a broad consensus on the need for expanded data use, more dialogue is needed on the appropriate parameters for secondary uses.

Acknowledging the tremendous opportunities of health data re-use, but also the sensitivities, the whitepaper set out a “maturity model” that it proposes be used to begin a dialogue around the controls that should be in place for secondary re-use of patient data – for instance different opt-in/opt-out models.  The whitepaper also backed calls for research into schemes that could encourage consensual, altruistic “data donation.”

Bipartisan Bill To Test Telehealth Services for Medicare Beneficiaries

Last week, Senators Cory Gardner (R-CO) and Gary Peters (D-MI) introduced new legislation to test expanded Medicare coverage of telehealth services.  The Telehealth Innovation and Improvement Act requires the Department of Health and Human Services (HHS) to allow selected, eligible hospitals to offer telehealth services in cooperation with the Center for Medicare and Medicaid Innovation (CMMI), which develops and tests new service delivery models for cost, effectiveness, and improvement in quality of care.  Models that are successful under the CMMI’s criteria could be expanded and covered by the Medicare program.

The stated goal of the Senators introducing the Telehealth Innovation and Improvement Act is to improve access to healthcare for rural Medicare beneficiaries, who sometimes live far away from hospitals and medical centers.  The bill’s sponsors also believe the proposed legislation will lower health care costs and reduce emergency room visits, hospitalizations and readmissions.

Senators Gardner and Peters previously introduced similar telehealth legislation in 2015.  That bill was referred to the Senate Finance Committee, but it was never given a hearing or voted on.

Vote on HHS Secretary Nomination Expected as Early as this Week; Nomination Hearings Included Little Discussion of Health IT

The full Senate could vote as early as this week on the nomination of Rep. Tom Price (R-GA) to be Secretary of the U.S. Department of Health and Human Services (HHS). In January, two Senate Committees held hearings on Rep. Price’s nomination. These hearings focused largely on Rep. Price’s stance on repeal of the Affordable Care Act (ACA) and on reform of the Medicare and Medicaid programs. Senators asked few questions related to health information technology, and the limited discussion on this topic centered primarily on the burdens placed on providers by HHS initiatives to promote the “meaningful use” of electronic health records (EHRs). Continue Reading

Twenty-First Century Cures Act Includes HIPAA Provisions

On December 13, 2016, President Obama signed the 21st Century Cures Act (“Cures Act”), Pub. L. 114-255, which aims to expand medical research and expedite the approvals of drug therapies for patients.  The Cures Act also contains several provisions related to the HIPAA Privacy and Security Rules.  None of these provisions make substantive changes to the HIPAA regulations at this time; in several instances, they direct the Secretary of Health and Human Services (“HHS”) to study whether the HIPAA regulations should be revised or clarified to remove any potential barriers to optimal patient care and communication or to the availability of patient information for medical research.

Continue Reading

Incoming HHS Secretary Tom Price Brings Physician-Focused Perspective to Health IT

Tom Price, the Republican representative from Georgia, has been tapped by President-elect Trump as the new Secretary for the Department of Health and Human Services (HHS). Rep. Price is himself an orthopedic surgeon and comes from a family of doctors and, as a result, is focused closely on the ways in which government regulations burden the doctor-patient relationship. At an American Enterprise Institute event this past June, Rep. Price criticized the Affordable Care Act for allowing the government, rather than doctors and patients, to control the manner in which healthcare is offered.
Continue Reading

Update on Telemedicine Parity

We have followed (here and here) the adoption of the Interstate Medical Licensure Compact (“IMLC”) by various states and the subsequent formation of a commission under the IMLC.  We believe that the IMLC presents one promising avenue for the proliferation of telemedicine.  In this post, we explore another initiative designed to encourage the development of telemedicine; parity laws.

Telemedicine parity laws require reimbursement for telemedicine services in the same manner and at the same reimbursement amount as for analogous in-person medical treatment. According to the American Telemedicine Association, 7 States have proposed or pending parity legislation, 31 States have already enacted some kind of parity law and 48 States have implemented parity in their Medicaid programs through regulation or legislation.

While these laws have spread quickly, there are many important distinctions among them. Some of these distinctions are worth careful consideration.  For example, some States have adopted laws or policies that apply only to Medicaid.  Other States have passed legislation that binds private payers as well.

There are plenty of advocates on both sides of the private payer issue. Many telemedicine proponents argue that parity legislation ought to apply to private payers because parity requirements will spur development of cheaper and more effective delivery of services.  Critics point out that market forces make such legislation unnecessary; if telemedicine is actually more effective, private payers would have their own incentives to pay as much or more for it, and if telemedicine services are not as effective but are attractive mainly for their cost-saving potential, private payers should be able to adjust the reimbursement and reap the savings accordingly.  While this fight continues to rage, most States have concluded that parity, at least with respect to Medicaid, makes sense.

Some States have also adopted separate requirements for obtaining informed patient consent (Michigan is set to become the most recent).  Since telemedicine is a relatively new way for patients to obtain care, some States have mandated that patients receive information about what to expect prior to treatment.  Proponents of these laws describe them in terms of consumer protection and laud the transparency that they create.  Critics tend to argue that state-wide disclosure requirements stifle innovation by implementing a one-size-fits-all regime that places telemedicine at a competitive disadvantage to in-person care, which does not have to meet additional informed consent requirements.  They argue that creating this kind of advantage for in-person care might inappropriately slow the implementation of telemedicine solutions.

In March, Florida inched toward telemedicine parity by creating the Telehealth Advisory Council to recommend ways to “increase the use of accessibility of services provided by telehealth.”  The Council, which has already begun to hold meetings, will base its recommendations on research conducted by the Agency for Health Care Administration and other regulators into the types, prevalence, cost savings, and reimbursement practices of telemedicine services.  While Florida created a council to analyze the issue before enacting substantive legislation, many states adopted legislation without studying the issue or studied it more informally. Florida’s approach is not entirely new, as Indiana completed a one-year pilot program before enacting permanent legislation this year.

States also vary in their methods of regulation. Some States have treated the regulation of telemedicine as an element of preexisting medical regulations, while others have conceptualized it as wholly new and requiring its own regulatory paradigm. For example, while Indiana empowered its existing State Licensing Board to develop regulations to implement the legislation, Idaho created a new Telehealth Council for the same purpose.  This example illustrates the difficult balance States will need to create as they integrate telemedicine regulation with preexisting practice rules and try to address the wholly new problems and opportunities that it presents.