McKesson Corporation Ann Richardson Berkey One Post Street Vice President San Francisco, CA 94104 Public Affairs May 8, 2008 The Honorable Andrew C. von Eschenbach, M.D. Commissioner Food and Drug Administration 5630 Fishers Lane, Room 1061 Rockville, MD 20852 Re: Docket Number 2007N-0484 21 CFR Part 880 Devices: General Hospital and Personal Use Devices; Reclassification of Medical Device Data System Dear Dr. von Eschenbach: On behalf of McKesson Corporation (hereinafter “McKesson”), I am pleased to submit comments on the proposed rule issued by the Food and Drug Administration (FDA) on February 8, 2008 in Docket Number 2007N-0484, Devices: General Hospital and Personal Use Devices; Reclassification of Medical Device Data System. For 175 years, McKesson has led the industry in the delivery of medicines and healthcare products to drug stores. Today, a Fortune 18 corporation, we deliver vital medicines, medical supplies, care management services, automation and health information technology solutions that touch the lives of over 100 million patients in healthcare settings that include more than 25,000 retail pharmacies, 5,000 hospitals, 200,000 physician practices, 10,000 extended care facilities, 700 home care agencies, the Department of Veterans Affairs, the Department of Defense and other government facilities. As the largest health information technology company in the world, McKesson is actively engaged in the transformation of healthcare from a system burdened by paper to one empowered by interoperable electronic solutions that improve patient safety, reduce the cost and variability of care and improve healthcare efficiency. McKesson has medical device systems registered with the FDA, and we provide comprehensive information technology solutions to healthcare providers and payors. Our perspective on the proposed rule is based on our extensive experience with health information technology and medical devices used by hospitals, health systems and pharmacies. Section III. Device Description We commend the FDA for proposing medical device reclassification to improve device and patient safety and for providing guidance for device manufacturers.

McKesson Comments on FDA Docket Number 2007N-0484 21 CFR Part 880 Devices: General Hospital and Personal Use Devices; Reclassification of Medical Device Data System

In order to minimize industry confusion as to the devices that might be classified under this rule, we urge the FDA to provide greater specificity and clarification on the definition of a Medical Device Data System (MDDS). In these comments, we have detailed specific items in the proposed regulation where we believe more guidance would be helpful. We also recommend the exclusion of two categories of data systems from MDDS classification: clinical data repository systems and electronic health records (EHR) certified by the Certification Commission for Healthcare Information Technology (CCHIT). Existing laws define a medical device as “an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article, including a component part, or accessory which is:

• recognized in the official National Formulary, or the United States Pharmacopoeia, or any supplement to them,

• intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man or other animals, or

• intended to affect the structure or any function of the body of man or other animals, and which does not achieve any of its primary intended purposes through chemical action within or on the body of man or other animals and which is not dependent upon being metabolized for the achievement of any of its primary intended purposes.”

1) In the proposed MDDS regulation, the first bullet states that a MDDS is intended to provide “the electronic transfer or exchange of medical device data from a medical device, without altering the function or parameters of any connected device.” This description is very broad and could apply to any system which incorporates information related to healthcare, but which is not subsequently “used in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man or other animals.” Such information systems would include, but are not limited, to:

• health information systems (HIS), such as clinical data repositories or other passive receptacles of healthcare data, including administrative, financial and archived information; and

• claims eligibility, billing and adjudication systems that interface with clinical information systems.

In the case of a large HIS, clinical and medical device data are electronically attached to a healthcare claim. We do not believe it is FDA’s intention to regulate these systems under the proposed MDDS regulation when the application itself does not meet the definition of a medical device. We are seeking confirmation that this interpretation is accurate.

2) The second bullet in the proposed regulation defines a MDDS as “the electronic storage and retrieval of medical device data without altering the function or parameters of connected devices. For example, this would include software that stores historical blood pressure information for later review by a health care provider.” In a broad interpretation of this definition, a MDDS could include any clinical information system where results from devices can be stored or retrieved. Examples of such systems which are not currently defined by the FDA as medical devices would include:

• pharmacy information systems linked to a clinical system to allow the review of blood pressure data as a part of medication therapy management;

McKesson Comments on FDA Docket Number 2007N-0484 21 CFR Part 880 Devices: General Hospital and Personal Use Devices; Reclassification of Medical Device Data System

2

• billing and eligibility checking systems that interface with clinical information systems; and

• clinical documentation systems used by nurses and physicians to store, document and review data for clinical decision making.

We do not believe these types of systems should be considered a MDDS. Based on the cited examples, McKesson seeks clarification as to the criteria and the basis for MDDS classification, including intended use as well as connectivity and/or the level of analytic function, particularly with respect to electronic transfer, exchange and retrieval of medical device data. Clinical data repositories, web portals, and administrative systems that serve as passive receptacles of healthcare data, including administrative, financial and archived information systems, do not meet the definition of a medical device and should be explicitly excluded from the MDDS classification. Such exclusion should also apply to EHRs which do not meet the FDA definition of a medical device. Many EHRs can be certified by the CCHIT through a rigorous process, which tests products against the clinical needs of providers and the quality and safety needs of healthcare consumers. According to CCHIT Chairman, Mark Leavitt, M.D., Ph.D., “Physicians who purchase certified products have the assurance that the products have been reviewed by a panel of judges, including practicing physicians, and that the products are being evaluated against standards set by professionals in the field and successfully piloted with products from large and small companies... the quality and safety of EHR products can now be measured using certification criteria that were developed specifically for that purpose.” This process aligns with the FDA’s goal to provide reasonable assurance of safety and effectiveness and should support an exemption from MDDS classification for any CCHIT-certified EHRs.

3) The third bullet in the proposed regulation defines a MDDS as a device intended to provide

“the electronic display of medical device data without altering the function or parameters of connected devices. For example, this would include software that displays the previously stored electrocardiogram for a particular patient.” As written, any monitor or computer screen that displays device data, including a computer terminal in a nursing station or a screen on an infusion pump that displays the infusion rate or amount infused, could be considered a MDDS. We do not believe these are defined as medical devices. We request that the FDA confirm that software and devices with electronic displays of medical device data are excluded from the classification of a MDDS.

We also have questions concerning the interpretation of the term “direct connection” and request FDA guidance as to whether a clinical HIS system that transmits data stored within a device is to be classified as a MDDS, even if the device is not directly connected to the HIS. If an EKG is stored in a remote database such as a data repository, is that considered a direct connection? Would the data repository be considered a MDDS? If the FDA interprets “direct connection” to include remote systems, we believe that an HIS system or billing system that stores and transmits healthcare claims and clinical data could be considered a MDDS. Finally, we seek guidance on diagnostic and clinical decision-making functions and the FDA’s interpretation of “altering” such functions. A MDDS is defined in the proposed regulation as “the electronic display of medical device data without altering the function of the connected device.” Further, in the same paragraph, the regulation states “MDDS is not intended to provide real-time, active or online patient monitoring functions” and “By themselves, MDDS do not

McKesson Comments on FDA Docket Number 2007N-0484 21 CFR Part 880 Devices: General Hospital and Personal Use Devices; Reclassification of Medical Device Data System

3

provide any diagnostic or clinical decision making functions.” We interpret the proposed rule to mean that the display of historical data is considered a MDDS; the real time display of the same data is not. We recommend that FDA clearly define the phrase “altering the function of connected devices.” We also recommend that FDA define the time interval associated with the term “real-time,” and confirm that “diagnostic and clinical decision-making functions,” which are included in the definition of MDDS, do not include administrative data systems. Section IV. Proposed Reclassification The proposed rule would exempt a MDDS from premarket notification requirements when it is indicated for use only by a healthcare professional and does not perform irreversible data compression. We recommend that FDA remove irreversible data compression as a criterion for submission of a premarket notification for MDDS. The majority of irreversible data compression is used in medical image storage devices and medical image communications devices, which are currently regulated under 21 CFR 892.2010 and 21 CFR 892.2020. Under these regulations, medical image storage devices and medical image communications devices do not require premarket notification submission. We urge the FDA not to inadvertently alter the regulations that currently apply to these devices. Section VI. Summary of Reasons for Reclassification As proposed, the design controls of the Quality System Regulation (QSR) (21 CFR 820.30) apply to class I devices with software. The FDA does not intend to apply design controls retroactively to legally marketed MDDS devices. We applaud the FDA for this decision; the retroactive requirement for design controls for MDDS devices could create an unnecessary burden for software developers. However, the statement “… changes to existing designs or to currently marketed devices must be made in accordance with design control requirements, even if the original design was not subject to these requirements,§ 820.30,” is of concern because the designs of software based medical devices are frequently changed. Consequently, an application for design controls and other relevant sections of the QSR would be required as of the effective date of the final rule or 60 days after the publication of the final rule, as stated in Section VII. Most software development generally follows a systematic process with design and technical specifications, reviews, verification and validation. Firms that design and manufacture products to meet the proposed definition of MDDS will not have established business processes to be compliant with the QSR or another medical device quality system standard. Companies require sufficient time to establish business processes and verification procedures to ensure compliance with the QSR. Therefore, we recommend that FDA set the effective date for implementation of the rule a minimum of two years from the date of publication of the final rule. We also recommend that FDA provide education sessions and written materials on the application for the QSR, and in particular, design controls for MDDS during this two-year period. The FDA’s reference to a “legally marketed MDDS” is confusing in that many products currently on the market were not originally marketed as a MDDS. As written, the proposed rule could be interpreted as requiring products currently on the market and subject to the proposed definition of a MDDS to be registered with the FDA and in compliance with the QSR. Given FDA’s proposed MDDS reclassification and the fact that devices have been on the market for several decades, we suggest that FDA replace the phrase “legally marketed MDDS” with “device meeting the requirements for a MDDS.”

McKesson Comments on FDA Docket Number 2007N-0484 21 CFR Part 880 Devices: General Hospital and Personal Use Devices; Reclassification of Medical Device Data System

4

McKesson Comments on FDA Docket Number 2007N-0484 21 CFR Part 880 Devices: General Hospital and Personal Use Devices; Reclassification of Medical Device Data System

5

Section VIII. Effective Date For the reasons identified above, we recommend that this section be modified to indicate the following effective dates:

• 60 days after final rule publication: Establishment registration and device listing sections of 21 CFR 807

• Two years after final rule publication: Compliance with Quality System Regulation 21 CFR 820

Additionally, we recommend that premarket notification submissions and their effective dates be removed from this section. Conclusion McKesson supports the FDA’s MDDS reclassification to provide a reasonable assurance of the safety and effectiveness of a MDDS device. However, we urge FDA to strengthen the proposed rule to:

• ensure that the definition of MDDS covers only medical devices in accordance with the FDA definition of medical devices;

• provide detailed criteria for classification, particularly with respect to electronic transfer, exchange, storage and retrieval of medical device data;

• exempt CCHIT-certified EHRs from MDDS classification; • exclude clinical data repositories, web portals, and administrative systems or other

passive receptacles of healthcare data from MDDS classification; • provide clarification of the term “real-time” and the phrases “altering the function of

connected devices” and “diagnostic and clinical decision-making functions”; • remove irreversible data compression as a criteria for submission of a premarket

notification for MDDS; • ensure that a minimum of two years be allowed for manufacturers to meet the QSR; and • replace the phrase “legally marketed MDDS” with “device meeting the requirements for

a MDDS.” We appreciate the opportunity to provide our comments on the proposed rule and look forward to working with you as you finalize and implement this MDDS reclassification. Should you have questions or need further information, please contact me at (415) 983-8494 or ann.berkey@mckesson.com. Sincerely, Ann Richardson Berkey