1. Compliance with FDA Regulations: Collecting, Transmitting and Managing Clinical Information Dan C Pettus Senior Vice President iMetrikus, Inc.

2. Confused? 25 Years in technology development 20 Years in Healthcare Informatics When it comes to FDA (HIPAA, and others) regarding regulatory requirements for telemedicine and clinical data …. and I’m still confused?

4. What does Regulation Mean? For devices, drugs, etc., it means the manufacturer is held accountable for GMP and QSR under Title 21 parts 1 to 1299 (e.g., part 801- Labeling, part 820 – Quality System) For devices, drugs, etc., it means the manufacturer is held accountable for GMP and QSR under Title 21 parts 1 to 1299 (e.g., part 801- Labeling, part 820 – Quality System) Ability to electronically authenticate is permitted under 21 part 11 of the FDA regulations Ability to electronically authenticate is permitted under 21 part 11 of the FDA regulations The FDA issued guidance documents which identify portions of title 21 part 11 as being applicable for clinical trials submissions The FDA issued guidance documents which identify portions of title 21 part 11 as being applicable for clinical trials submissions NOTE: Clinical Information may be regulated by additional state and federal agencies. HIPAA is a good example.

5. A Device is… According to the FDA, a device is: "an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article, including a component part, or accessory which is: "an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article, including a component part, or accessory which is: recognized in the official National Formulary, or the United States Pharmacopoeia, or any supplement to them, recognized in the official National Formulary, or the United States Pharmacopoeia, or any supplement to them, intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man or other animals, or intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man or other animals, or intended to affect the structure or any function of the body of man or other animals, and which does not achieve any of it's primary intended purposes through chemical action within or on the body of man or other animals and which is not dependent upon being metabolized for the achievement of any of its primary intended purposes." intended to affect the structure or any function of the body of man or other animals, and which does not achieve any of it's primary intended purposes through chemical action within or on the body of man or other animals and which is not dependent upon being metabolized for the achievement of any of its primary intended purposes." If the primary intended use of the product is achieved through chemical action or by being metabolized by the body, the product is usually a drug. Human drugs are regulated by FDA's Center for Drug Evaluation and Research (CDER).

6. When is a device a device? Diagnostic Patient Monitoring – yes Diagnostic Patient Monitoring – yes Electronic Medical Record Systems – no? Electronic Medical Record Systems – no? ICU Clinical Data Management Systems – no? ICU Clinical Data Management Systems – no? Anesthesia Data Management Systems – depends on who you ask? Anesthesia Data Management Systems – depends on who you ask? Telemedicine – maybe? Telemedicine – maybe?

7. Case History - ARKIVE 1985-1986: Ohmeda develops a semiautomatic electronic anesthesia record keeper as an “accessory” to its gas machine 1986 Arkive files 510(k) as an anesthesia information system. FDA classifies Arkive a gas machine accessory. FDA is informed that Arkive is a stand-alone information management system and not an accessory to anything. …FDA response – reclassify Arkive – no longer an accessory – it’s now a “gas machine”?

8. Is Telemedicine device? Although FDA does not regulate the delivery of health care services or the transmission of information related to care between physicians and patients, FDA does regulate the commercialization of technologies associated with health care delivery (devices). As FDA has stated; “The use of advanced telecommunications technology to deliver health care brings with it a host of concerns about safety and effectiveness.” In its White Paper, FDA’s Center for Devices and Radiological Health (CDRH) declared that many “products” used in telemedicine are medical devices subject to regulatory authority.

9. Clinical Data is Regulated When: It is part of a clinical trial It is part of a clinical trial It is embedded as part of a regulated device It is embedded as part of a regulated device The data acquisition is an accessory to a regulated device The data acquisition is an accessory to a regulated device  Accessory to a regulated device is a bit fuzzy

10. In General The collection, transmission, and management of clinical data for the purpose of care management and medical treatment is not usually regulated by the FDA The collection, transmission, and management of clinical data for the purpose of care management and medical treatment is not usually regulated by the FDA (May be regulated by other agencies and laws, e.g., HIPAA) (May be regulated by other agencies and laws, e.g., HIPAA) Reasonable efforts should be used to avoid deliberate or accidental disclosure Reasonable efforts should be used to avoid deliberate or accidental disclosure Patients have rights under state laws and HIPAA regarding privacy and disclosure Patients have rights under state laws and HIPAA regarding privacy and disclosure

11. Best Practice Policies and operating procedures that clearly describe your organization’s collection and use of clinical data Policies and operating procedures that clearly describe your organization’s collection and use of clinical data Business Associate Agreement under HIPAA Business Associate Agreement under HIPAA Best practice to protect a patient’s privacy Best practice to protect a patient’s privacy Best practice to ensure security throughout the network Best practice to ensure security throughout the network Regular audits that validate your process Regular audits that validate your process

12. Example of Technology Security

13. Summary With regards to clinical information, the FDA regulates devices and drug submissions (clinical trials) With regards to clinical information, the FDA regulates devices and drug submissions (clinical trials) Your organization may be required to comply with FDA if the clinical information is part of a clinical trial Your organization may be required to comply with FDA if the clinical information is part of a clinical trial May be subject to other state and federal (HIPAA) regulations May be subject to other state and federal (HIPAA) regulations