Virtual And Digital Health Digest – Healthcare

Welcome to the second installment of Arnold & Porter’s
Virtual and Digital Health Digest. This edition primarily covers
November highlights across the virtual and digital health space.
This digest focuses on key virtual and digital health and
telehealthrelated developments in the United States, United Kingdom
and European Union in the healthcare, regulatory, privacy, and
corporate transactions space.

US News

FDA REGULATORY UPDATE

FDA Updates Medical Device Cybersecurity
Playbook for Healthcare Organizations. On November 15,
2022, FDA, in collaboration with MITRE, released an update to the
Medical Device Cybersecurity Regional Incident Preparedness and
Response Playbook (Cybersecurity Playbook). First published in
2018, the Cybersecurity Playbook outlines a stakeholder-derived,
open source and customizable framework for healthcare delivery
organizations (HDOs) and other stakeholders to prepare for and
respond to medical device cybersecurity incidents, namely attempted
or successful unauthorized access, use, disclosure, modification,
or destruction of information or interference with systems
operations in medical devices. FDA asked MITRE to update the
Cybersecurity Playbook due to the recent growth in ransomware
attacks, the increasing connectivity of medical devices and
emerging healthcare technologies. The healthcare and public health
sector has continued to experience growing numbers of cyber
incidents, with 82 percent of healthcare systems reporting a cyber
incident between mid-2020 through 2021 (34 percent of which
involved ransomware). As updated, the Cybersecurity Playbook
includes more explicit alignment with the Hospital Incident Command
System for managing complex incidents, considerations for the
widespread impacts and extended downtimes that are common during
cyber incidents, and an appendix of resources.

The high-level structure of the recommendations in the
Cybersecurity Playbook follow the incident response lifecycle from
the National Institute of Standards and Technology (NIST) Special
Publication (SP) 800-61r2, Computer Security Incident Handling
Guide. This lifecycle has four phases: (1) preparation phase; (2)
detection and analysis phase; (3) containment, eradication and
recovery; and (4) post-incident activity. Preparation phase
recommendations include ones relating to medical device
procurement, medical device asset inventory, hazard vulnerability
analysis, medical device cybersecurity support to the hospital
incident management team, incident response communication plan, and
user awareness training and cybersecurity exercises. Detection and
analysis phase recommendations include ones relating to incident
detection and validation, incident categorization and
prioritization, incident reporting, incident analysis, and incident
documentation. Under containment, eradication and recovery, the
Cybersecurity Playbook discusses considerations for selecting the
appropriate containment strategy and recommends that HDOs plan for
a potentially lengthy recovery period of weeks or even months
because resolving incidents is not always straightforward. During
the post-incident phase, the Cybersecurity Playbook suggests
examining what went well and what did not with regards to the
HDO’s response to the incident and using that information to
improve the response plan for future incidents.

In conjunction with the updated Cybersecurity Playbook, FDA and
MITRE also released a Quick Start Companion Guide (Quick Start
Guide”. The QuickStart Guide as a shorter version of the
playbook that discusses preparedness and response activities
healthcare organizations might want to start with as they are
developing their medical device incident response program. The
Quick Start Guide consists of tables that distill the high-level
tasks presented in the corresponding section of the Cybersecurity
Playbook.

FTC, FDA, Other Agencies Create Mobile
Health App Interactive Tool. On December 7 2022, the
FTC released a mobile health app interactive tool (Mobile Health
App Navigator) to help app developers navigate the various US
federal laws and regulations that may apply to such apps.
Representing a cross-agency effort, the Mobile Health App Navigator
was produced in cooperation with the US Department of Health and
Human Services (HHS), the FDA, the Office of the National
Coordinator for Health Information Technology (ONC), and the office
for Civil Rights (OCR) within HHS. The Mobile Health App Navigator
is intended “for anyone developing a mobile app that will
access, collect, share, use, or maintain information related to an
individual consumer’s health, such as information related to
diagnosis, treatment, fitness, wellness, or addiction.”
However, the FTC cautions that the Mobile Health App Navigator is
provided for informational purposes only and use of the tool
“can[not] guarantee compliance with applicable federal
requirements.” Instead, the Mobile Health App Navigator is
meant to provide app developers with a snapshot of potential
compliance obligations and point them to educational materials and
best practices for delivering safe, accurate services while
safeguarding the privacy and security of consumer information.

The interactive tool provides an overview of various federal
laws and regulations that may apply to a mobile health app, such as
the following:

• Health Insurance Portability and Accountability Act (HIPAA)
  Rules




• Federal Food, Drug and Cosmetic Act (FDCA) and FDA
  Regulations




• 21st Century Cures Act and ONC Information Blocking
  Regulations




• FTC Act (e.g., Sections 5 and 12)




• FTC’s Health Breach Notification Rule




• Children’s Online Privacy Protection Act

The Mobile Health App Navigator uses a series of questions to
help guide app developers through an analysis of whether all or
certain of the above laws and regulations could apply to a proposed
mobile health app. Examples of questions covered in the interactive
tool include ones about the app’s functionality, whether the
app is intended for use by consumers, the type of information the
app collects, shares or uses, whether the app is being offered by
or on behalf of a HIPAA-covered entity, whether the app connects
with wearables or other devices, whether the app accesses
information in or sends information to personal health records or
provides services to an entity that maintains health records for
consumers, and whether the app is intended for children or uses
child-oriented activities or design.

Questions relating specifically to whether a proposed app is
potentially regulated as a medical device by the FDA are covered in
questions 7-10 of the Mobile Health App Navigator. These include
questions intended to assess whether an app is intended to
diagnose, prevent or treat a disease or condition, whether the app
could potentially fall under one of the 21st Century Cures Act
statutory exemptions from the device definition for certain low
risk software functions, or whether the app, even if not
statutorily exempt, could potentially be subject to enforcement
discretion under FDA policies for certain low risk device software
functions. For an overview on the latest FDA digital health
guidances, including the agency’s recently issued final
guidance on clinical decision support tools, please refer to the November 2022 issue of Arnold &
Porter’s Virtual and Digital Health Digest.

FDA Releases List of Augmented Reality and
Virtual Reality Medical Devices. On December 7, 2022,
FDA released a list of medical devices authorized for marketing
that incorporate augmented reality (AR) and virtual reality (VR).
This move follows FDA previously releasing a list of artificial
intelligence (AI)/machine learning (ML)-enabled devices authorized
for marketing by the agency and signals continued FDA efforts for
greater transparency about advancements in the digital health
space. Additional information about FDA’s list of AI/ML-enabled
devices can be found in the November 2022 issue of Arnold &
Porter’s Virtual and Digital Health Digest.

In conjunction with release of the AR/VR devices list, FDA
provided background information on AR/VR technologies. FDA defines
AR as “a real-world augmented experience with overlaying or
mixing simulated digital imagery with the real world as seen
through a camera or display, such as a smartphone or head-mounted
or heads-up display,” and defines VR as “a virtual world
immersive experience that may require a headset to completely
replace a user’s surrounding view with a simulated, immersive
and interactive virtual environment.” FDA highlights a few
examples of AR and VR applications already being used to treat
patients, including a VR system that is used to treat
post-traumatic stress disorder in army veterans and an AR system
that overlays medical images onto a patient during an operation to
help guide the surgeon’s techniques. FDA identifies a number of
treatment domains where AR and VR are used to treat patients,
including pediatric diagnostics and treatments, pain management,
neurological disorders, surgery planning, telemedicine, virtual
care, and ophthalmic diagnostics. While acknowledging potential
benefits of AR/VR devices, FDA also identifies potential risks,
such as cybersickness, head and neck strain, cybersecurity risks,
privacy risks, and distraction in the operating room.

FDA’s initial list of AR/VR devices authorized for marketing
contains 39 devices that the agency identified by searching
FDA’s publicly facing information. The vast majority of the
devices on the list appears to have been cleared for marketing
through FDA’s premarket notification (510(k)) process, while a
few appear to have been authorized through the de novo
classification process for novel devices. FDA explains that the
list is not intended to be exhaustive or comprehensive, but rather
that it is a list of devices that incorporate AR and VR based on
information provided in the summary descriptions of their marketing
authorization documents. FDA plans to update the AR/VR devices list
on a periodic basis.

FDA Publishes Digital Health Regulatory
Science Opportunities Spotlight. FDA’s Digital
Health Center of Excellence (DHCoE) recently issued a publication
entitled “Spotlight: Digital Health Regulatory Science
Opportunities” (Digital Health Spotlight). The Digital Health
Spotlight describes areas of research that stakeholders, both
internal and external to the FDA, identified as important and is
intended to advance digital health regulatory science by
encouraging discussions and stakeholder collaborations throughout
the healthcare ecosystem and beyond. The Digital Health Spotlight
identifies three main categories of research: Advancing Patient
Engagement, Leveraging Connectivity and Improving Healthcare
Through Software. Under Advancing Patient Engagement, the Digital
Health Spotlight highlights patient-generated health data (PGHD)
and the development of medical extended reality devices as
important areas of research. PGHD, including biometric data,
symptoms and patient-reported outcomes, can be used in patient
monitoring, diagnosis and prognosis, shared decision-making, and
assessment of patient safety. FDA notes PGHD data can be used not
only to improve the quality of clinical care, but also to evaluate
innovative medical products and treatment paradigms, especially
decentralized clinical investigations. The Digital Health Spotlight
identifies several PGHD-related research areas, such as maintenance
and management of large volumes of PGHD, standardization of PGHD
from different sources, performance specifications for use when
considering interchangeability of wearables (e.g., “bring your
own wearable” approaches to clinical investigations), and
reliable metrics to compare standard disease outcomes as measured
by digital health technologies.

Under Leveraging Connectivity, the Digital Health Spotlight
focuses on cybersecurity, wireless connectivity and
interoperability as important areas of research. FDA explains that
it is actively engaged in both internal and external efforts to
help mature cybersecurity, interoperability and wireless
connectivity efforts. A few examples of cybersecurity-related
research areas discussed in the Spotlight include cybersecurity
considerations for cloud domains, cybersecurity considerations for
AI and ML technologies, and cybersecurity standards development.
And under Improving Healthcare Through Software, the Digital Health
Spotlight emphasizes the importance of research involving advanced
manufacturing technologies, AI and ML, and digital imaging.
Examples of AI/ML-related research areas include transparency of
AL/ML-enabled devices, AL/ML algorithm training for clinical
datasets, robustness and resilience of algorithms to withstand
changes in patients, data and sources, and real-world performance
monitoring for AI/ML software.

In issuing the Digital Health Spotlight, FDA explained that the
spotlight on research areas is for informational purposes only, and
that it is not meant to indicate that the identified topics are
areas for regulation. Further, the Digital Health Spotlight is not
intended to propose or implement policy changes regarding
regulation of any of the digital health topic areas described
within.

FDA Report Highlights Potential Use of
Modeling & Simulation in Digital Health Product
Reviews. In November 2022, FDA released a report
entitled “Successes and Opportunities in Modeling &
Simulation for FDA.” The report explores how modeling and
simulation (M&S) tools are used throughout FDA and presents a
selection of M&S case studies from across FDA centers. M&S
tools are used, for example, for premarket product review,
postmarket product assessment, policy development, and policy
implementation. The report also identifies opportunities for FDA to
better harness M&S in upcoming years by embracing computational
advances and new (and big) data streams to develop improved public
health solutions. As relates specifically to digital health, one of
the M&S opportunities highlighted in the report is to provide
evidence supporting safety or effectiveness of medical imaging
devices and computer-aided diagnostic software. Specifically,
leveraging radiation transport simulations to generate evidence
that can assist in the regulatory process for medical imaging
devices and computer-aided diagnostic software. Noting that
industry already invests heavily in developing tools that can
simulate radiological devices for internal R&D, the report
states that there is an opportunity to use these tools in the
regulatory process, especially for submissions which do not
normally require clinical data (e.g., some 510(k) devices). Another
opportunity discussed in the report is establishment of Good
Simulation Practice to foster harmonization across the FDA, and
where appropriate, with international regulatory bodies. The report
explains that it is critical to develop a common set of
expectations or guidelines for model verification, validation,
credibility assessment and maintenance between industry and
regulators, as well as between regulatory scientists/modelers and
reviewers within the FDA, and states further publication and/or
usage of relevant guidance documents will promote better alignment
on best practices and expectations between stakeholders (e.g.,
International Council on Harmonization items Q13 and M7, and the
International Medical Device Regulators Forum on Software as a
Medical Device).

Please click here to continue reading.

The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.