The mHealth Policy Conundrum: Keeping Pace with Technology

April 12, 2015

Robert Jarrin, QualcommBrian Balow, Dickinson Wright

PLLC

DISCLAIMER: The views and opinions expressed in this presentation are those of the author and do not necessarily represent official policy or position of HIMSS.

Conflict of Interest

Brian R. Balow, JD

Has no real or apparent conflicts of interest to report.

© HIMSS 2015

Conflict of InterestRobert Jarrin, Qualcomm

Salary: Qualcomm Incorporated Royalty:Receipt of Intellectual Property Rights/Patent Holder:Consulting Fees (e.g., advisory boards):Fees for Non-CME Services Received Directly from a Commercial Interest or their Agents (e.g., speakers’ bureau):Contracted Research:Ownership Interest (stocks, stock options or other ownership interest excluding diversified mutual funds): (Ticker Symbols): QCOM, RAD, TS, GE, EFTC, SIRI, C, LTS and various diversified mutual funds and 529’s.

Other:

© HIMSS 2015

Learning Objectives

1. Identify current policy issues which impact mHealth adoption

2. Describe the impacts of FDA regulation

3. Discuss opportunities for policy improvement

A Case Study – Scene 1� “Harry” – 42, diabetic, 20 (or so) pounds overweight, weekend

warrior athlete�Dons running gear, including “wearable” device to record length

of run, pace, estimated calories burned, etc.�Checks mobile app where records of prior workouts are stored�Checks his personal health record on his laptop to ensure that

the settings on his recently “installed” insulin pump are correct

Federal Landscape

Federal Landscape - HHS

• Responsible for implementing and enforcing HIPAA Privacy and Security Rules

• HIPAA Privacy Rule provides individuals with specific rights with respect to their identifiable health information (called “protected health information”) when maintained by a health plan, a health care provider that engages in certain electronic transactions, and certain other entities (collectively “covered entities”)

Federal Landscape - FTC

• Works for consumers to prevent fraudulent, deceptive, and unfair business practices (usually tied to privacy policy violations in IT space)

• FTC enforces the Health Breach Notification Rule which requires certain entities to notify consumers when there has been a breach involving their electronic health information

Federal Landscape - NIST

• NIST's mission is to promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life.

• The Computer Security Division, one of six divisions within NIST’s Information Technology Laboratory, is responsible for developing standards, guidelines, tests and metrics for the protection of non-national security Federal information and information systems.

Federal Landscape - FCC

• FCC decides which frequency bands are to be used by different services; it establishes technical rules for the operation of RF devices; it authorizes RF equipment as compliant with its rules; and it authorizes users including individuals or network service providers, as appropriate

• In health care area, the FCC authorizes a wide variety of RF-based medical devices including both implanted devices (e.g., heart pacemakers) and patient monitoring devices (e.g., wireless telemetry)

Federal Landscape - FDA

• FDA has a public health responsibility to oversee the safety and effectiveness of a small subset of mobile medical applications that present a potential risk to patients if they do not work as intended

• The FDA has defined “mobile medical applications” and in February of 2015 provided updated guidance on the regulation of those applications

• Privacy and Data Security Breaches (HHS; FTC)

• Unauthorized use of PHI (HHS; FTC)

• Medical Device Clearance and Compliance (patient safety concerns) (FDA)

Federal Landscape – Requirements and Risks

• HHS innovation grants aimed at healthcare technologydevelopment (through its “Open Government Plan”)

• FDASIA Workgroup – FDA, FCC, ONC (to “inform thedevelopment of a report on an appropriate, risk-based regulatoryframework pertaining to health information technology includingmobile medical applications that promotes innovation, protectspatient safety, and avoids regulatory duplication.”)

• OCR has stepped up enforcement of HIPAA violations; 2015audit plan pending

• HHS promoting use of NIST encryption methods in connectionwith HIPAA Breach Notification Rule

Federal Landscape – Cooperation?

• Medical malpractice• Eprescribing requirements• Licensure requirements• Credentialing and privileging• State data breach notification laws• State consumer protection laws

State Legal and Regulatory Landscape

Interstate Medical Licensure Compact• The practice of medicine is defined as taking place where the

patient receives care, requiring the physician to be licensed in that state and under the jurisdiction of that state’s medical board.

• Regulatory authority will remain with the participating state medical boards, rather than being delegated to an entity that would administer the compact.

• Participation in the compact is voluntary for both physicians and state boards of medicine.

Interstate Compact, Cont’dBlue: Enacted; Yellow: Introduced; Grey: No Status

Case Study – Scene 3� En route to hospital, EMS wirelessly transmits vital signs to ER� Upon arrival at ER, on duty nurse transmits Harry’s EHR and data received from

EMR to on-call resident� During examination, resident initiates video consultation with Harry’s primary care

physician, who is enjoying herself at Mardi Gras� Following consult, resident e-prescibes a new dosage of insulin to correct Harry’s

condition

Scene 3 Implications

� Wireless transmission of vital signs to ER� Internal tranmission of Harry’s EHR and other data to resident physician� Video consult with primary care doc across state lines� E-prescribing

Questions

• Use this as your last slide

• Add speaker contact information and Twitter handle, if available

• Company logo(s) can be placed on this slide