On April 3, FDA published the much-anticipated report proposing a regulatory framework for health information technology (also referred to as health IT and HIT), including mobile medical applications (apps). Mandated by the Food and Drug Safety and Innovation Act (FDASIA), the Proposed Risk-Based Regulatory Framework and Strategy for Health Information Technology, developed by FDA in collaboration with the Office of the National Coordinator for Health Information Technology (ONC), and the Federal Communications Commission (FCC), divides health IT into three categories with associated risk levels that warrant different levels of regulation. FDA plans to hold a public workshop to discuss the report May 13-15, 2014, and is accepting comments on the report through July 7, 2014.
The report identifies administrative HIT functions – such as billing and claims processing – as having limited or no risk and thus warranting no additional oversight. Health management HIT functions – such as data exchange, electronic access to clinical results, and some clinical decision support software (CDS) – are identified as low-risk and thus, FDA would not "focus" oversight on this category, even if the HIT met the statutory definition of a medical device. FDA's primary focus would be on the third, higher-risk category of medical device HIT functionality. As examples of this third category, the report offers computer-aided detection software, remote display or notification of real-time alarms from bedside monitors, and robotic surgical planning and control, claiming that these types of products have always been regulated by FDA.
Notwithstanding the three categories and examples provided for each, the report still lacks key information on how HIT manufacturers can determine whether their products will be regulated by FDA. In particular, the distinction between the health management HIT and medical device HIT functionalities is not clear. This lack of clarity is made most obvious by the report's own example of "some CDS" falling into the health management HIT category. Regulated industry is left to wonder what defines "some" and where will the rest of CDS be regulated. The first panel at the May public workshop is entitled Risk Based Framework: Points of Clarification/ Ambiguities in Report, so perhaps FDA will offer more clarity at that time.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
