FDASIA Taxonomy Subgroup

1. FDASIA Taxonomy Subgroup HIT Policy Committee FDASIA Workgroup Virtual Meeting 14 June 2013

2. Follow-on Activities • Reviewed/consolidated feedback and discussion points from on-site meeting • Reviewed additional materials forwarded to subgroup: • Bipartisan Policy Center Health Innovation Initiative, Draft/Work-in-Progress: “Defining and Characterizing Risk of Health Information Technology” • Teleconference with additional group-level discussion, consensus building

3. Scope Dimensions New as of 31 May 2013 • User Type • … • Phases of product lifecycle • … • Developer/ ‘Manufacturer’ Type • … • Distribution Model • … • Conditions of use • … • Intended use • … • Product Categories • … • Miscellaneous • - …

4. User Types No Change From 31 May 2013 In Scope Potentially Out of Scope • Health Care Providers – institutional and individual • Clinical Researchers using on human subjects • Patients under care by a provider • General public user/consumer under own use/health management

5. Product Lifecycle New as of 31 May 2013 In Scope Potentially Out of Scope • Design phase • Implementation-Installation • Maintenance • Availability-Downtime Hazard • Recall • End-of-Life Support • Cybersecurity

6. Product Lifecycle Consensus In Scope Potentially Out of Scope • Design phase • Implementation-Installation • Maintenance • Availability-Downtime Hazard • Recall • End-of-Life Support • Cybersecurity • Methods and modes of end-user training

7. Miscellaneous New as of 31 May 2013 In Scope Potentially Out of Scope • Regulation around Privacy (HIPAA)

8. Developer/ ‘Manufacturer’ Types Clarification and refinement In Scope Potentially Out of Scope • Entity who develops/markets/licenses/distributes products with commercial interest • Entity who develops/ advertises/distributes via public channel products intended for general public users, even if no commercial interest • Healthcare provider* who develops products de novo for use on patients, even if no direct or indirect commercial interest • Healthcare provider* who modifies functionality of previously licensed, ‘finished’ products • Individual who develops for personal private use • Individual who develops/distributes via private channel to limited individuals without commercial interest *institutional or individual provider

9. Distribution Model No Change From 31 May 2013 In Scope Potentially Out of Scope • Marketed-licensed-distributed-sold in a restricted manner, with credentialing requirements • Marketed-licensed-distributed-sold in a restricted manner, without credentialing requirements • Made available for download via an unrestricted public channel, with or without credentialing requirements • Available under a SaaS model

10. General Conditions of Use New as of 31 May 2013 In Scope Potentially Out of Scope • By prescription, recommendation or under direction of licensed/credentialed healthcare provider • Independently by general public consumer/user • For management of defined illness or chronic condition • For research purposes on human subjects • ? For health maintenance or fitness

11. General Conditions of Use No Change From 31 May 2013 In Scope Potentially Out of Scope • Intended use • Foreseeable misuse • Non-foreseeable, willful misuse • Use clearly beyond labeled intended use

12. Specific Product Types - Categories In Scope Potentially Out of Scope

13. Decision Tree Approach Intended Use - Functionality – Potential for Harm

14. Diagram • Is use intended to inform or change • decision making about: - initiating - discontinuing - modifying • care interventions or personal health • management ? NO Potentially in-scope YES Out-of-scope … defer to existing regulatory framework

15. Diagram 2 • Does malfunction, foreseeable misuse have • potential to cause patient injury, via: • Delay or failure to present clinical data/ • information at time of need • Presentation of outdated information • Patient-data mismatch ? YES Potentially in-scope NO Potentially out-of-scope

16. Diagram 2 Is the data/information that is managed by system the sole or 1o source of data at point of care (i.e., no alternate sources of data / info that can be used for confirmation) ? YES Potentially in-scope NO Potentially out-of-scope

17. Diagram 2 Through design and intended use, is patient or provider reliant on data/information to initiate or modify prescribed intervention or treatment ? YES Potentially in-scope NO Potentially out-of-scope

18. Examples of Scoping Using Decision Tree Approach In Scope Out of Scope • Claims processing • Health benefit eligibility • Practice management / Scheduling / Inventory management • Healthcare provider communication tools (e.g., email, paging) • Population management tools • Software using historical claims data to predict future utilization/cost of care • Cost effectiveness analytic software

19. Examples of Scoping Using Decision Tree Approach In Scope Out of Scope • Diseases severity scoring algorithms • Electronic guideline distribution • Disease registries

20. Examples of Scoping Using Decision Tree Approach In Scope Out of Scope • EHRs (installed, SaaS) • Hospital Information Systems-of-systems • Decision support algorithms • Visualization tools for anatomic, tissue images, medical imaging and waveforms • Health Information Exchanges • advanced functionality • Electronic/robotic patient care assistants • Claims processing • Health benefit eligibility • Practice management / Scheduling / Inventory management • Healthcare provider communication tools (e.g., email, paging) • Population management tools • Software using historical claims data to predict future utilization/cost of care • Cost effectiveness analytic software • Diseases severity scoring algorithms • Electronic guideline distribution • Disease registries

21. Diagram Does product currently meet FDA (Act 21 CFR) definition of Medical Device (including MDDS) ? NO Potentially in-scope YES Potentially in-scope

22. Explicitly Enter Into Scope Possible revisions or re-engineering of risk assessment and regulatory framework around certain products Currently explicitly regulated by FDA Meet definition but through enforcement discretion, regulatory framework is not actively enforced For Deliberation and Discussion

23. Explicitly Enter Into Scope Examples: Software only products Archiving systems MDDS Calculators For Deliberation and Discussion

24. Explicitly Enter Into Scope Rationale: Boundaries very blurred In some cases, nearly identical functionality and risk profile for explicitly regulated and non-regulated/non-enforced products Examples: PACS For Deliberation and Discussion

25. Final Conclusions Strive to: develop a framework that is able to meet future undefined needs avoid a discrete, static and specific defined list of named products Favor the decision tree approach that emphasizes functionality as a primary scoping criterion

26. Final Conclusions Be cautious of wide-spectrum use cases that span a risk-spectrum within a single functionality E.g. prescribing or alerting functions, but are used on both negligible-risk and high-risk medications/drugs Consider that any products that relies on patient lookup/patient data retrieval/data-patient matching should be evaluated for risks of patient-data mismatch

27. Final Conclusions In preparation: Matrix and formal decision tree tool Final one-page summary of taxonomy, process and rationale

28. Questions and Discussion