FDA, FCC, ONC Release Risk-Based HIT Regulatory Framework

After months of delays, the Food and Drug Administration, Federal Communications Commission, and the Office of the National Coordinator for Health Information Technology today released a proposed strategy and recommendations for a risk-based regulatory framework for health IT meant to "promote innovation, protect patient safety, and avoid regulatory duplication." Mandated under the FDA Safety and Innovation Act (FDASIA), the draft report to Congress was compiled by the FDA in collaboration with the FCC and ONC.

"The Agencies’ strategy and recommendations for a risk-based framework for health management health IT include four key priority areas: promote the use of quality management principles; identify, develop, and adopt standards and best practices; leverage conformity assessment tools; and create an environment of learning and continual improvement," states the draft report. "The Agencies also recommend the creation of a Health IT Safety Center as a public-private entity with broad stakeholder engagement, that includes a governance structure for the creation of a sustainable, integrated health IT learning system that avoids regulatory duplication and leverages and complements existing and ongoing efforts."

NEW DEVELOPMENT: Clinical decision support software now in the regulatory crosshairs

The report on a risk-based health IT framework, which was due to Congress by January, includes mobile medical applications--a technology area previously addressed by the FDA's September 2013 final guidance on mobile medical apps.

However, one area that wasn't covered in the final guidance but is included in the FDASIA-mandated report to Congress is the topic of clinical decision support software. In the proposed regulatory strategy for health IT released today, the report states that "most clinical decision support (CDS) functionalities can be categorized as health management health IT and that the "FDA does not intend to focus its oversight on CDS with health management health IT functionality."

Instead, the agencies recommend that the four priority areas identified in the report "should be selectively applied to mitigate the safety risks posed." In addition, they recommend that "health IT stakeholders work together to develop policies for the transparent disclosure of the rules and information sources underlying individual health management CDS functionalities/products."

For the small subset of CDS software where medical device health IT functionality "present higher risks, and generally have been subject to active oversight by FDA, such active oversight should be continued," the draft report states. "FDA will work with federal and private stakeholders to clarify the types of medical device clinical decision support that should be the focus of FDA’s oversight."

Nevertheless, legislation currently before Congress would ostensibly remove from FDA regulation high-risk clinical decision support software, mobile medical apps and other medical device functionality currently under the oversight of the regulatory agency. In February, Senators Deb Fischer (R-Neb.) and Angus King (I-Maine) introduced the PROTECT Act bill in the Senate in a legislative effort to amend the Federal Food, Drug and Cosmetic Act and to ensure that clinical and health software would not be subject to regulation. 

In a Feb. 14 letter to Senator Tom Harkin (D-Iowa), chairman of the Senate Committee on Health, Education, Labor and Pensions, the Patient, Consumer and Public Health Coalition said that its member groups were "extremely concerned" that this proposed legislation would deregulate a "broad swath of medical devices that rely on software" creating opportunities for "rampant 'gaming' to avoid regulation" for MRIs, CT scanners, and heart monitoring devices that would no longer be regulated by the FDA and would "put the health of millions of Americans at risk."