1. FDASIA Taxonomy Subgroup HIT Policy Committee FDASIA Workgroup Virtual Meeting 14 June 2013

2. Follow-on Activities Reviewed/consolidated feedback and discussion points from on-site meeting Reviewed additional materials forwarded to subgroup: — Bipartisan Policy Center Health Innovation Initiative, Draft/Work-in-Progress: “Defining and Characterizing Risk of Health Information Technology” Teleconference with additional group-level discussion, consensus building

3. Scope Dimensions User Type ﹣ … Phases of product lifecycle ﹣ … Developer/ ‘Manufacturer’ Type ﹣ … Distribution Model ﹣ … Conditions of use ﹣ … Intended use ﹣ … Product Categories ﹣ … New as of 31 May 2013  Miscellaneous - …

4. User Types Health Care Providers – institutional and individual Clinical Researchers using on human subjects Patients under care by a provider General public user/consumer under own use/health management In ScopePotentially Out of Scope No Change From 31 May 2013

5. Product Lifecycle Design phase Implementation-Installation Maintenance Availability-Downtime Hazard Recall End-of-Life Support Cybersecurity In ScopePotentially Out of Scope New as of 31 May 2013

6. Product Lifecycle Design phase Implementation-Installation Maintenance Availability-Downtime Hazard Recall End-of-Life Support Cybersecurity Methods and modes of end-user training In ScopePotentially Out of Scope Consensus

7. Miscellaneous Regulation around Privacy (HIPAA) In ScopePotentially Out of Scope New as of 31 May 2013

8. Developer/ ‘Manufacturer’ Types Entity who develops/markets/licenses/distribut es products with commercial interest Entity who develops/ advertises/distributes via public channel products intended for general public users, even if no commercial interest Healthcare provider* who develops products de novo for use on patients, even if no direct or indirect commercial interest Healthcare provider* who modifies functionality of previously licensed, ‘finished’ products Individual who develops for personal private use Individual who develops/distributes via private channel to limited individuals without commercial interest In ScopePotentially Out of Scope *institutional or individual provider Clarification and refinement

9. Distribution Model Marketed-licensed- distributed-sold in a restricted manner, with credentialing requirements Marketed-licensed- distributed-sold in a restricted manner, without credentialing requirements Made available for download via an unrestricted public channel, with or without credentialing requirements Available under a SaaS model In ScopePotentially Out of Scope No Change From 31 May 2013

10. General Conditions of Use By prescription, recommendation or under direction of licensed/credentialed healthcare provider Independently by general public consumer/user For management of defined illness or chronic condition For research purposes on human subjects ? For health maintenance or fitness In ScopePotentially Out of Scope New as of 31 May 2013

11. General Conditions of Use Intended use Foreseeable misuse Non-foreseeable, willful misuse Use clearly beyond labeled intended use In ScopePotentially Out of Scope No Change From 31 May 2013

12. Specific Product Types - Categories In ScopePotentially Out of Scope

13. Decision Tree Approach Intended Use - Functionality – Potential for Harm

14. Diagram Is use intended to inform or change decision making about: - initiating - discontinuing - modifying care interventions or personal health management ? Is use intended to inform or change decision making about: - initiating - discontinuing - modifying care interventions or personal health management ? NO YES Out-of-scope … defer to existing regulatory framework Potentially in-scope

15. Diagram 2 Does malfunction, foreseeable misuse have potential to cause patient injury, via: Delay or failure to present clinical data/ information at time of need Presentation of outdated information Patient-data mismatch ? Does malfunction, foreseeable misuse have potential to cause patient injury, via: Delay or failure to present clinical data/ information at time of need Presentation of outdated information Patient-data mismatch ? YES NO Potentially in-scope Potentially out-of-scope

16. Diagram 2 Is the data/information that is managed by system the sole or 1 o source of data at point of care (i.e., no alternate sources of data / info that can be used for confirmation) ? Is the data/information that is managed by system the sole or 1 o source of data at point of care (i.e., no alternate sources of data / info that can be used for confirmation) ? YES NO Potentially in-scope Potentially out-of-scope

17. Diagram 2 Through design and intended use, is patient or provider reliant on data/information to initiate or modify prescribed intervention or treatment ? Through design and intended use, is patient or provider reliant on data/information to initiate or modify prescribed intervention or treatment ? YES NO Potentially in-scope Potentially out-of-scope

18. Examples of Scoping Using Decision Tree Approach Claims processing Health benefit eligibility Practice management / Scheduling / Inventory management Healthcare provider communication tools (e.g., email, paging) Population management tools Software using historical claims data to predict future utilization/cost of care Cost effectiveness analytic software In ScopeOut of Scope

19. Examples of Scoping Using Decision Tree Approach Diseases severity scoring algorithms Electronic guideline distribution Disease registries In ScopeOut of Scope

20. Examples of Scoping Using Decision Tree Approach EHRs (installed, SaaS) Hospital Information Systems-of- systems Decision support algorithms Visualization tools for anatomic, tissue images, medical imaging and waveforms Health Information Exchanges — advanced functionality Electronic/robotic patient care assistants Claims processing Health benefit eligibility Practice management / Scheduling / Inventory management Healthcare provider communication tools (e.g., email, paging) Population management tools Software using historical claims data to predict future utilization/cost of care Cost effectiveness analytic software Diseases severity scoring algorithms Electronic guideline distribution Disease registries In ScopeOut of Scope

21. Diagram Does product currently meet FDA (Act 21 CFR) definition of Medical Device (including MDDS) ? Does product currently meet FDA (Act 21 CFR) definition of Medical Device (including MDDS) ? NO YES Potentially in-scope

22. Possible revisions or re-engineering of risk assessment and regulatory framework around certain products — Currently explicitly regulated by FDA — Meet definition but through enforcement discretion, regulatory framework is not actively enforced Explicitly Enter Into Scope For Deliberation and Discussion

23. Examples: — Software only products — Archiving systems — MDDS — Calculators Explicitly Enter Into Scope For Deliberation and Discussion

24. Rationale: — Boundaries very blurred — In some cases, nearly identical functionality and risk profile for explicitly regulated and non-regulated/non-enforced products — Examples: PACS Explicitly Enter Into Scope For Deliberation and Discussion

25. Strive to: — develop a framework that is able to meet future undefined needs — avoid a discrete, static and specific defined list of named products Favor the decision tree approach that emphasizes functionality as a primary scoping criterion Final Conclusions

26. Be cautious of wide-spectrum use cases that span a risk-spectrum within a single functionality — E.g. prescribing or alerting functions, but are used on both negligible-risk and high-risk medications/drugs Consider that any products that relies on patient lookup/patient data retrieval/data- patient matching should be evaluated for risks of patient-data mismatch Final Conclusions

27. In preparation: — Matrix and formal decision tree tool Final one-page summary of taxonomy, process and rationale Final Conclusions

28. Questions and Discussion