William Hyman lead the group through the Byzantine world of the FDA. He described the content of the FDA's draft Medical Device Data System (MDDS) rule. There were several great questions from the audience, and a humorous exchange about manufacturer's statements meant to limit liability. Hyman characterized the most extreme examples as "lies." He suggested that the most effective liability-limiting text was, "Do Not Use This Product."
Steve Grimes attributed the increasing complexity of medical device systems and "systems of systems" where installations with multiple systems result in unanticipated integration and interactions -- that were not tested by the respective medical device manufacturers. The risk management standard in development, IEC 80001is intended to address these risks.
Under 80001, the primary responsible party is the health care provider. Manufacturers are responsible for providing information that providers then use to complete their risk analysis and mitigation. The risk management process described in the draft standard is similar to that required by the FDA for medical device manufacturers.
Like HIPAA includes the Business Associate agreement to ensure effective HIPAA privacy policies, the draft 80001 standard calls for a Responsibility Agreement, where manufacturers disclose risk analysis and mitigation data to customers.
It seems to me that IEC 80001 imposes the kind of risk management that biomedical and clinical engineers have been doing (albeit informally) for many years, onto the IT department and broader hospital. It is medical device connectivity, the converging of medical device and enterprise networks. For years, medical device networks that fail can kill patients -- risks that have been managed successfully by biomeds. When medical device and enterprise networks are merged, enterprise network failures can kill patients. This is a new situation for hospital CIOs, and the implications of this change has yet to really dawn on many of them.
Steve Rakitin pointed out that the FDA requires medical device manufacturers to provide training in risk management for their products, yet it is obvious that manufacturers aren't doing anything in this area. As I noted during my presentation, how manufacturers do their verification testing and how they're actually installed and used, are quite different. Arguably, the vast majority of providers with medical device systems are using them "off label."
Rob Renck asked how 80001 is percolating into the mindset of Clinical Engineers, and how it's impacting the management of enterprise networks in hospitals. Steve noted that there's a significant education and training challenge in these new kinds of risk management efforts. Steve sees clinical engineers as taking a leadership role in hospitals on 80001.
All of this reminds me of a
job description that Steve Grimes posted a several years ago when he was at Vanderbilt.
Next up a panel discussion on MDDS and 80001. First question: what will the FDA's verification and validation requirements be for MDDS? The answer to this question is rather complicated and revolves around the product's intended use (or marketing claims) and the product regulatory strategy (the risk analysis, how specifications are written, the design approach, etc.).
Peter Kelley with Capsule, suggested it would be some time after the final rule for the market and the FDA to figure out exactly what the regulatory impact will be from MDDS. He noted that many of the FDA's regulations are open to interpretation and so you can't just look up your answer in the regulations and the discern a risk-free regulatory way forward.
Randy Lance, Cerner, said it's a good thing that the FDA's recognizing the importance of connectivity and systems.
Bill Hyman noted that using a standard can be leveraged with the FDA with what they call an abbreviated 510k.
Rick Hampton with Partners, asked the question who is a manufacturer? If the hospital puts a medical device on an enterprise network? The FDA's current position is this does not place the hospital in the role of a manufacturer. What if the hospital implements something like an MDDS? Not known.
Rick said that they've tired to use 80001 to evolve their organization and facilitate deploying medical devices on the enterprise network. This has not been an easy transition, but they've made progress. Partners is looking at an organizational structure like an Internal Review Board to evaluate medical device/IT combinations.
For hospitals without the clinical engineering support that large academic medical centers have, Steve Grimes suggested that mid to smaller hospitals will look to consultants or third party service providers to come in and lay the foundation for 80001 implementation and some initial education. Over time, all this will be internalized and provided by in house staff.
Risk and responsibility for the implementation of connectivity solutions is falling to the providers. The delta between what manufacturers subject to verification test and the environment in which they're actually installed are miles apart.
(tag: Medical Device Connectivity conference, MDDS, FDA, IEC 80001)
