mHealth: Regulation and How to Avoid Practicing Medicine on the - - PowerPoint PPT Presentation

37 Offices in 18 Countries

mHealth: Regulation and How to Avoid Practicing Medicine on the Web

Scott A. Edelstein, Esq. Partner Squire Sanders Karl M. Nobert, Esq. Of Counsel Squire Sanders

2

mHealth Trends

• 81% of physicians have a smartphone1
• 45% of U.S. adults own smartphones
• 52% of smartphone owners have used their phone to look for

health information

• 19% of smartphone owners have at least one health app on their

phone.2

• 13,000 health, medical and fitness apps
• 1. 2011 Manhattan Research
• 2. 2012 Pew Research Mobile Health Report

3

The Medical Device Classification System

4

Medical Device Classification

• 3 Classes of Medical Devices
• Class I (low risk)
• Class II (medium risk)
• Class III (high risk and novel devices)
• Classes based on control levels

5

Risk Based Classification

1700+ Generic Devices

510(k) Exempt Class I Class II Class III Very low Low (~782) Medium (~799) High (~119)

General Controls (may or may not be GMP exempt) General Controls Premarket Notification or 510(k) General & Special Controls 510(k) submission General & Special Controls Premarket Approval

Level of Risk & Level of Regulatory Control

6

Examples

• Medical Device Classes:

–Class I –General Controls –Most exempt from premarket submission »Class II »Special Controls »Premarket Notification [510(k)] –Class III –Require Premarket Approval [PMA]

7

Device Classification

Class I – Low Risk Devices

• Registration and Listing
• Labeling
• Good Manufacturing Practices (Quality

System Regulation)

• Medical Device Reporting

CONTINUED

8

What are General Controls?

• Basic authorities that

provide FDA with the means to regulate medical devices.

• Applies to all medical

devices regardless of classification, are subject to premarket and postmarket regulatory controls.

• Establishment

registration and device listing

• Premarket notification or

510(k), if not exempt

• Labeling
• Misbranding
• Adulteration
• Quality Systems
• Records and Reports / -

Medical Device Reporting (MDR)

9

Device Classification

Class II – Medium Risk Devices

• General Controls Plus Special Controls
• Performance Standards
• Post-Market Surveillance
• Patient Registries
• Guidelines
• Other Appropriate Actions

CONTINUED

10

What are Special Controls?

• Postmarket

Surveillance Study

• Patient Registries
• Guidelines (e.g., Glove

Manual)

• Mandatory

Performance Standard

• Recommendations or

Other Actions

• Special Labeling (e.g.,

882.5970, Cranial Orthosis)

• General controls alone are

insufficient to assure safety and effectiveness of Class II devices

• Existing methods are available to

provide such assurances.

• Special controls may include

special labeling requirements, mandatory performance standards and postmarket surveillance.

• A few Class II devices are exempt

from the premarket notification.

11

Device Classification

Class III – High Risk Devices

• Life Sustaining
• Life Supporting
• Implants
• Unreasonable Risk Of Injury Or Illness

CONTINUED

12

FDA’s Regulation

• f Mobile Medical Devices

and Smartphone Applications ("apps")

13

Statutory Authority

(h) The term "device" … means an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or

• ther similar or related article, including any component, part, or

accessory, which is (1) recognized in the official National Formulary, or the United States Pharmacopeia, or any supplement to them, (2) intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention

• f disease, in man or other animals, or

(3) intended to affect the structure or any function of the body of man or other animals, and which does not achieve any of its principal intended purposes through chemical action within or on the body of man or other animals and which is not dependent upon being metabolized for the achievement of any of its principal intended purposes.

14

What is an “app”?

• A Mobile Application or “app” is:
• a software program that runs on smartphones and
• ther mobile communications devices

Examples: apps to monitor caloric intake for healthy weight maintenance, to allow doctors to view a patient's X-rays on their mobile device FDA intends to apply its regulatory requirements solely to a subset of mobile apps that it is calling mobile medical applications or "mobile medical apps."

15

Apps that FDA Intends to Regulate

• Only those that meet the statutory definition of a

device; and either:

• are used as an accessory to a regulated

medical device; or

• transform a mobile platform into a regulated

medical device.

16

FDA’s Proposed Regulatory Approach

Mobile Medical Apps Other mobile apps that meet “device” definition Not considered mobile apps

17

FDA’s Proposed Regulatory Approach

• Apps that FDA intends to regulate
• May be classified as class I (general controls), class II

(special controls in addition to general controls), or class III (premarket approval)

• Other Apps + Enforcement Discretion
• The Applicability of the Quality System Regulation

18

App Categories and Classifications

1) Displaying, storing or transmitting patient-specific medical device data in its original format – An MDDS (21 CFR 880.6310) (Class I) 2) Controlling the intended use, function, modes, or energy source of the connected medical device- An Accessory - Required to comply with the controls applicable to that connected device. 3) Transforming or making the mobile platform into a regulated medical device – Radiological Image Display (21 CFR 892.2050) (Class II) 4) Creating alarms, recommendations or creating new information (data) by analyzing or interpreting medical device data – Cardiac Monitoring Software (21 CFR 870.2300)

19

Examples of Regulated Apps

• Reg. #

Medical Device Class # Filing 868.1900

Calculator, Pulmonary Function Interpretation (Diagnostic)

II 510(k) 870.1110

Computer, Blood-Pressure

II 510(k) 892.2010

Device, Digital Image Storage, Radiological

1 510(k) Exempt 870.2800

Electrocardiograph, Ambulatory, With Analysis Algorithm

II 510(k) 868.2377

Monitor, Apnea, Home Use

II 510(k) 884.2660

Monitor, Ultrasonic, Fetal

II 510(k) 878.4810

Over-The-Counter Powered Light Based Laser For Acne

II 510(k) 880.2700

Scale, Stand-On, Patient

1 510(k) Exempt 884.2900

Stethoscope, Fetal

1 510(k) Exempt

20

Examples of Recently FDA Reviewed Mobile Medical Apps

21

FDA Cleared Mobile Medical App

ASTRA Picture Archiving Communications Systems (K111694) (Candelis, Inc.) (9/15/11)

• Device Description: ASTRA is a web-enabled software app

that provides image processing and viewing tools and access to studies and reports from a Local Area Network, Wide Area Network, remote workstation, personal computer, or an iPhone,

• r iPad via a Virtual Private Network connection.
• Intended Use: ASTRA is software image management

intended to receive, process, review, display, print and archive medical images and data from imaging modalities (e.g., CR and DR).

22

FDA Cleared Mobile Medical App

Carestream PACS (K110919) (Carestream Health, Inc.) (10/20/11)

• Device Description / Intended Use: is an image

management system whose intended use is to provide completely scaleable local and wide area PACS solutions for hospital and related institutions/sites, which will archive, distribute, retrieve and display images and data from all hospital modalities and information systems.

23

FDA Cleared Mobile Medical App

Mobile MIM PACS (K112930) (MIM Software, Inc.) (12/2/11)

• Device Description: In addition to SPECT, PET, CT, MRIf

modalities, Mobile MIM can be used for the viewing Mnd/or display for diagnosis of X-ray and Ultrasound medical images.

• Intended Use: The Mobile MIM software program is used for

the viewing, registration, fusion, and/or display for diagnosis of medical images from the following modalities: SPECT, PET, CT, MRI, X-ray and Ultrasound.

24

Regulatory Collaboration and Enforcement

25

Regulatory Collaboration

• Agency Cooperation
• FTC’s Broad Mandate
• Publications:
• Report: “Mobile Apps for Kids: Current Privacy Disclosures are Disappointing”

(Feb. 2012)

• Guidance Document: “Marketing Your Mobile App: Get It Right from the Start”

(Aug 2012)

• Other Agencies with Potential Involvement

26

Regulatory Enforcement

• Potential FDA Enforcement Action
• Untitled and Warning Letters
• Failure to comply with the device regulations
• Unsupported labeling claims
• FTC Enforcement Action
• Deceptive Advertising
• Unsubstantiated Claims
• Financial Forfeiture
• Recent mHealth Examples

27

Pursuing Medicare / Medicaid Reimbursement for Medical Devices

28

FDA / CMS Parallel Review Program

• A recently created joint-Agency program that
• allows for the simultaneous review for FDA medical

device clearance and Medicare reimbursement approval

• is designed to reduce the time between receiving FDA

marketing approval and a Medicare national coverage determination.

29

Candidates for Parallel Review

FDA and CMS have restricted this phase of parallel review for those innovative medical devices that meet one of the following criteria:

• New technologies for which the applicant has had sufficient pre-

investigational device exemption (“IDE”) interaction with FDA or an approved IDE application;

• New technologies for which an original or supplemental approval
• r petition for de novo review would be required; or
• New technologies that fall within the scope of a Part A (inpatient)
• r Part B (outpatient) Medicare benefit category and are not

subject to the NCD.

30

Parallel Program Phases

• Nomination – The sponsor of an innovative therapeutic or

diagnostic device may nominate its device for participation in the parallel review program.

• FDA/CMS Review – FDA and CMS will meet to consider a

nomination within 30 days of receipt of nomination package.

• Notification of Acceptance – After the agencies’ meeting, the

applicant will be notified whether its device is an appropriate candidate for the program.

• Acceptance Meeting – If the applicant is deemed to be an

acceptable candidate, FDA and CMS will meet with the applicant either in person or by telephone.

• FDA Review – Parallel review candidates will be reviewed

according to the normal FDA review process.

• CMS NCD Review and Timing – CMS will begin

its informal review process sometime after the submission of the PMA or de novo petition.

31

Regulatory Implications of Using Apps for Telemedicine

Telemedicine

Telemedicine practitioners Hospital Hub

33

Developing Areas in Telemedicine

• Licensure
• Reimbursement
• Confidentiality
• Liability

34

Interstate Practice of Medicine

• Statutes in several states specifically provide that furnishing

telemedicine services to a patient constitutes the practice of medicine in that state.

• E.g., Oregon law requires a license for the practice of medicine across

state lines and defines the practice of medicine across state lines as:

– (1) The rendering directly to a person of a written or otherwise

documented medical opinion concerning the diagnosis or treatment of that person located within this state for the purpose of patient care by a physician located outside this state as a result of the transmission of individual patient data by electronic or other means from within this state to that physician or the physician's agent

35

Interstate Practice of Medicine (cont’d)

• Exceptions to general licensure requirement:
• Consultation Exception
• Emergencies
• Special or Temporary Telemedicine License
• Licensure by Endorsement

36

Consultation Exception

• Most states allow physicians

licensed in another state to provide consultations to local physicians

• Scope of the exception varies by

state

No Statutory Exception Narrow Exceptions Broad Exceptions

Consultation Exceptions

38

Consultation Exception (cont’d)

• Exceptions can be grouped into 9 categories:
• General Consultation Exception
• Infrequent Consultation Exception
• Prohibition of Local Office
• Local Physician Responsibility
• Local Physician Request
• Primary vs. Secondary Requirements
• Combination Exceptions
• Unique Exceptions
• Uncompensated Consultations

39

Consultation Exception (cont’d)

• Typical “general” consultation exception statute provides:
• “The following persons under the following limitations may practice

medicine within the state without a license: (3) Any physician who is licensed in another state or country and who is meeting a physician licensed in this state, for purposes of consultation, provided such practice is limited to such consultation[.]” N.Y. Educ. L. § 6526(3).

40

Special or Temporary Licenses

• 9 states issue special or temporary telemedicine licenses

Alabama

Arizona

Arkansas California

Colorado

Connecticut

Delaware Florida Georgia Idaho Illinois Indiana Iowa Kansas Kentucky Louisiana

Maine

Maryland

Massachusetts

Michigan

Minnesota

Mississippi Missouri Montana

Nebraska

Nevada

New Hampshire

New Jersey New Mexico New Y

• rk

North Carolina

North

Dakota

Ohio Oklahoma

Oregon

Pennsylvania

Rhode Island South Carolina South Dakota T ennessee

Texas

Utah

V ermont

Virginia W ashington W est Virginia Wisconsin W yoming

41

Licensure by Endorsement

• Many states provide for licensure of physicians who are licensed

in another state

• Process typically requires:
• Application
• Payment of fee (typically around $200)
• Verification of licensure from all other states where applicant is

licensed

• Score reports from exams
• Fingerprinting

Strategies for Interstate Practice

Strategy Pros/Cons Using only physicians licensed in state where they will practice Least efficient model, but lowest regulatory risk Structuring arrangement to fit within some combination of various consultation exceptions Most efficient model. Allows for

• peration in many, but not all

states. Combination of all of the above Can allow for operation in all states

43

Interstate Practice and Nurse Licensure

Interstate Nurse Licensure Compact

• Allows nurse licensed in any participating state to

practice without additional licensure in any other participating state

• Introduced in 1999
• 24 states now participate in the compact

Interstate Nurse Licensure Compact:

Participating States

Alabama

Arizona

Arkansas California

Colorado

Connecticut

Delaware Florida Georgia Idaho Illinois Indiana Iowa Kansas Kentucky Louisiana

Maine

Maryland

Massachusetts

Michigan

Minnesota

Mississippi Missouri Montana

Nebraska

Nevada

New Hampshire

New Jersey New Mexico New Y

• rk

North Carolina

North

Dakota

Ohio Oklahoma

Oregon

Pennsylvania

Rhode Island South Carolina South Dakota T ennessee

Texas

Utah

V ermont

Virginia W ashington W est Virginia Wisconsin W yoming

45

Nurse Licensure: Non-Compact States

• Every state allows for licensure by endorsement, so long as

licensure requirements of applicant’s state are as stringent as requirements in endorsing state

• Some states require nurses licensed by endorsement to complete

state-specific continuing-education requirements

• E.g., Florida requires completion of a course on Florida laws and

rules relating to the practice of nursing

46

Malpractice and General Liability

• Physician-patient relationship
• Standard of care
• Jurisdiction
• Choice of law
• Insurance coverage
• Recording encounters

47

Informed Consent

• Oral and written consent
• Translation

48

Requirements Related to Prescribing Drugs

Ryan Haight Online Pharmacy Consumer Protection Act of 2008 (Pub. L. No. 110-425)

• Prohibits online pharmacies from dispensing

controlled substances without a valid prescription from a physician who has examined the purchaser in person

49

Requirements Related to Prescribing Drugs

• Many states require that a physician

physically examine a patient before prescribing drugs for the patient (but not IL, PA, NY, NV and a few others)

• Every state prohibits “unprofessional

conduct”

• Numerous state medical boards have issued

policies prohibiting prescriptions “based solely on an on-line questionnaire or consultation.”

• Exceptions

50

Requirements Related to Prescribing Drugs

• Exceptions:
• “Prescribing for a patient whom the physician has not personally

examined may be suitable under certain circumstances. These may include, but not be limited to . . .prescribing for a patient of another physician for whom the prescriber is taking call, or continuing medication on a short-term basis for a new patient prior to the patient’s first appointment. Established patients may not require a new history and physical examination for each new prescription, depending

• n good medical practice.” Alabama State Board of Medical

Examiners Rule 540-X-9-.11

51

Corporate Practice of Medicine Restrictions

• Many states prohibit lay corporations from practicing medicine
• In such states, physicians cannot be employed by a lay

corporation

• Presents challenges for multi-state corporations
• Captive or “friendly” PC as a work-around
• 14 states allow for an exception to licensing rules to allow

doctors to practice telemedicine in certain circumstances

52

Captive PC Model

PC Licensed practioner Telemedicine Company

Management Agrmt. Stock Transfer Restriction Agrmt. Consulting Agrmt.

$ $

53

Medicare Reimbursement

Originating Site (HPSA or non-MSA) Eligible Sites

• Physician or practitioner office
• Inpatient or outpatient hospital
• Critical access hospital
• Federally qualified health ctr.
• Rural health clinic
• Hospital-based or critical

access hospital ESRD

• Skilled nursing facility
• Community mental health ctr.

Distant Site Eligible Providers

• Physician
• Nurse Practitioner
• Physician Assistant
• Nurse midwife
• Clinical nurse specialist
• Clinical psychologist
• Clinical social worker
• Registered dietitian

54

Medicare Eligible Medical Services

• Initial inpatient and follow-up inpatient consultations
• Subsequent hospital care services
• Subsequent nursing facility care services
• Office or other outpatient visits
• Individual psychotherapy
• Pharmacologic management
• Psychiatric diagnostic interview examination
• End stage renal disease related services

55

Medicare Eligible Medical Services (cont’d)

• Individual and group medical nutritional therapy
• Neurobehavioral status exam
• Individual and group health and behavior assessment and

intervention

• Individual and group kidney disease education services
• Individual and group diabetes self-management training services
• Smoking cessation

56

CY 2013 Proposed Medicare Eligible Services

• Alcohol and/or substance abuse assessment and intervention
• Alcohol misuse screening and behavioral counseling
• Depression screening
• Behavioral counseling to prevent STIs
• Behavioral therapy for cardiovascular disease
• Behavioral counseling for obesity

57

Medicare Reimbursement

Conditions of Payment

• Telehealth provider reimbursed per Medicare fee schedule
• Telepresenter not required
• Facility fee for originating site (currently $24.24)

No Medicaid Reimbursement Medicaid Reimbursement

Medicaid Reimbursement

59

Private Payor Reimbursement

• Slow adoption
• Only thirteen states have government mandated private payor

reimbursement

60

Legal Issues

• Fraud and Abuse
• Federal and state antikickback laws
• OIG opinions (98-18, 99-14, 03-4)

61

Legal Issues

• Self-Referral Laws
• Federal and state laws
• False Claims Act
• Civil Monetary Penalties

62

Data Privacy and Security

• HIPAA
• State laws
• EU Privacy Directive
• Other foreign data privacy laws
• FTC
• Truth in advertising
• Honor your privacy promises
• Clear, easy-to-read on small screen
• Revisions
• Voluntary Privacy Code of Conduct
• Short-form notice

63

HIPAA Risks of Telemedicine

• Computerization enables storage of large amounts of data in

small spaces.

• Networked information is accessible from anywhere at any time.
• New databases and different types of data sets are more easily

created.

• Information is easily gathered, exchanged and transmitted.
• HIPAA and OCR
• OCR enforces HIPAA, and it clearly applies to the

transmission of protected health information by smartphones

• The loss of a smartphone may trigger breach notification

requirements

• ONCHIT notes that mobile phones on the market meet no

more than 40% of the security requirements of HIPAA or meaningful use Stage 2 standards; after manual configuration, compliance runs as high as 60%, according to some experts

64

State Data Breach Laws

• 40 states have enacted legislation requiring disclosure for

security breaches

• Legislation pending in 8 states
• Applies to businesses that maintain computerized data
• Requires written notification
• Personal information acquired by unauthorized person

65

65

Mission Impossible?

66

Contact Information

Scott A. Edelstein Partner Squire Sanders (US) LLP 1200 19th Street, NW Washington DC 20036 scott.edelstein@squiresanders.com 202.626.6602 415.954.0205 Karl M. Nobert Of Counsel Squire Sanders (US) LLP 1200 19th Street, NW Washington DC 20036 karl.nobert@squiresanders.com 202.626.6630