1. Work product of EBG for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views REGULATIONS SUBGROUP PLAN June 14,2013 1

2. Work product of EBG for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views Regulations Subgroup Plan For June, take each of the three agencies and study their regulatory requirements applicable to HIT 2

3. Work product of EBG for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views Roadmap—FDA Example 1. Exercise Overview 2. Health IT Use Case 3. Themes regarding HIT 4. FDA Device Regulatory Framework 5. Big Picture Assessment 3

4. Work product of EBG for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views To be clear, what does FDA regulate? Listed in order moving away from the patient. 1. “Classic” medical devices that accomplish a diagnostic or therapeutic purpose through touching the patient. E.g. Pacemakers Monitors Infusion pumps Operating tables and wheelchairs 2. In vitro diagnostic devices that work on human specimens Lab equipment Point of care or home diagnostics like blood glucose or INR 3. HIT connective tissue MDDS—retrieve, store, display, convert data from devices—but not analyze, because that typically triggers a higher level of regulation! LIS 4. Certain standalone software CAD CDS, drug reminders, calculators, certain cancer treatment analytics EHR—could but presently choosing not to HIT unregulated by FDA General purpose network Scheduling software 4

5. Work product of EBG for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views Existing FDA Regulation, visually speaking Certain Standalone HIT HIT Connective Tissue IVDs Classic Device 5 Non FDA-regulated HIT

6. Work product of EBG for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views Exercise Overview Identifying example Health IT Use Cases Review the FDA’s current regulatory framework: Discuss how well does the current regulatory framework function to classify and regulate a Health IT Fits/No Changes Changes Needed/Unique Considerations Doesn’t Fit 6

7. Work product of EBG for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views Health IT Use Cases Identify uses cases that help assess the suitability of the FDA regulatory approach Consider mechanical ventilation weaning A lower acuity use such as mobile health One that presents interoperability issues Perhaps PCA based on AAMI work-- http://ppahs.wordpress.com/2012/02/01/guest-post-yes-real-time-monitoring- would-have-saved-leah-2/ 7

8. Work product of EBG for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views Themes in HIT 1. HIT role in systems a. Open-ended intended use (don’t know what will be part of the system), so it is more difficult to assess risk. b. Product failure investigation. It is difficult to figure out what went wrong, and thus who has regulatory responsibility 2. The boarder between FDA-regulated products/software and non-FDA-regulated software. 3. The fact that end-users routinely modify software significantly. What is that – manufacturing or use? 4. The virtual manufacturing process for software. 5. The virtual nature of the product itself, when it comes to labeling and other requirements 6. The different model for purchasing software, available over the Internet for download 7. The need to constantly update software 8

9. Work product of EBG for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views Subpart A – §801.4 – Labeling - Meaning of Intended Uses Regulatory Requirement: The intended use of the devices is determined by the objective intent of the persons legally responsible for the device Purpose or Risk Mitigated: Ensures that devices which are intended to be medical devices are regulated as such, preventing both over regulation and under regulation. How Does this Fit with Health IT? Unique considerations for labeling that is incorporated in the software product. Labeling changes may require product changes and have design controls impact. What about intended uses that evolve over time? How does FDA cope with interoperable software where the whole system is not defined at the time of market introduction? How does the use of SDKs and APIs by 3rd parties impact a product’s intended use? Does the 3 rd party product impact the intended use? How do claims of compatibility by one manufacturer impact the other product’s intended use? What data are needed to support such claims? How are claims maintained as either product is updated? 9

10. Work product of EBG for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views Part 820 – Quality System Regulation General Purpose: Device manufacturers are required to establish and follow set procedures and policies to help ensure that their products consistently meet set requirements, specifications and are safe and effective. The quality systems for FDA-regulated products (food, drugs, biologics, and devices) are known as current good manufacturing practices (CGMP’s). How does this fit with Health IT? At high level, QSR is focused on traditional manufacturing and needs to consider application to traditional software development. Most Relevant Sections Subpart B: Management Controls Subpart C: Design Controls Subpart E: Purchasing Controls Subpart J: Corrective and Preventive Action Subpart M: Records AAMI published report on application of 5 QSR requirements to MDDS http://www.aami.org/publications/AAMINews/May2012/sw87.html http://www.aami.org/publications/AAMINews/May2012/sw87.html AAMI is now working on a broader project for HIT 10

11. Work product of EBG for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views These sections have Limited or No Application Subpart F--Identification and Traceability § 820.65 - Traceability. Subpart G--Production and Process Controls § 820.70 - Production and process controls. § 820.72 - Inspection, measuring, and test equipment. § 820.75 - Process validation. Subpart H--Acceptance Activities § 820.80 - Receiving, in-process, and finished device acceptance. § 820.86 - Acceptance status. Subpart I--Nonconforming Product § 820.90 - Nonconforming product. Subpart K--Labeling and Packaging Control § 820.130 - Device packaging. Subpart L--Handling, Storage, Distribution, and Installation § 820.150 - Storage. 11

12. Work product of EBG for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views 21 CFR Chapter 1 12 21 CFR Chapter 1: FDA, Subchapter H: Medical DevicesApplies?Fits? 801 Labeling 803 Medical Device Reporting 806 Corrections and Removals 807 Registration and Listing (Part E Pre-Market Notification) 808 Exemption from Fed Preemption of State and Local Reqts 809 In Vitro Diagnostics (IVD) If accessory 810 Recall Authority 812 Investigational Device Exemption (IDE) 814 Premarket Approval (PMA) Small subset of HIT 820 Quality System 821 Medical Device Tracking N/A 822 Post Market Surveillance If required 860 Medical Device Classification 861 Procedures for Performance Standards Development 862-892 Specific Product Classifications 895 Banned Devices Low likelihood 898 Performance Std For Electrode Lead Wires And Patient Cables N/A

13. Work product of EBG for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views Big Picture--July For each of the three agencies, and considering the work of the safety and innovation subgroup, with regard to the studied regulatory requirements, ask: 1. Are there any risks associated with Health IT that are not adequately addressed by these requirements? 2. In the aggregate, considering the risks, are the requirements too much and narrowly focused on the risks? 3. Have the needs for innovation been adequately protected? 4. Is there a better way to regulate these risks? 13

14. Work product of EBG for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views Bigger picture Looking at the three agencies all together and the overall level of risk and needs for innovation, Consider and prioritize lists of Key ambiguities in the three regulatory schemes Areas of duplication among the three agencies Changes in specific regulatory requirements needed to address safety or innovation 14

15. Work product of EBG for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views Biggest picture Looking at the three agencies together, is there a better way to regulate HIT? 15

16. Work product of EBG for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views Development of final work product Regulatory specs, a prioritized list of-- Big picture goals for the agency as they consider revisions Areas of duplication that need to be resolved Regulatory elements that need to be changed, and why (goals for the change) Ambiguous elements that need to be clarified 16

17. Work product of EBG for review and discussion by the FDASIA Regulation Subgroup; May not reflect the subgroup’s views DISCUSSION 17