TELEMEDICINE Telemedicine: comparing EU and US application regulation EU Directives’ ‘essential used alone or in combination, Alexis Gilroy, Cristiana Spontoni, requirements.’ Of interest is a including the software necessary Colleen Heisey and Indra public consultation launched by for its proper application intended Bhattacharya of Jones Day review the European Commission (‘EC’) by the manufacturer to be used for the regulation of telemedicine on 23 September 2015 on the human beings for the purpose of: applications in the EU and the US, technical standards that are needed (i) diagnosis, prevention, to achieve the Digital Single monitoring, treatment or and how medical device regulation Market, which was looking for alleviation of disease; underpins this. stakeholders’ input on the (ii) diagnosis, monitoring, development of such standards in a treatment, alleviation of or Telemedicine (‘TM’) applications number of fields, including compensation for an injury or typically involve the collection, specifically eHealth applications2. handicap; storage and/or transmission of In the EU, similarly to the US, (iii) investigation, replacement or data or health services using medical devices are divided into modification of the anatomy or of telecommunication services. In four distinct classes depending on a physiological process; or certain cases, the underlying risk assessment and (iv) control of conception, software systems and the associated characterisation. The European and which does not achieve its hardware may be regulated as classes are Class I, Class IIa, Class principal intended action in or on medical devices. IIb and Class III3. The classification the human body by of the medical device determines pharmacological, immunological Regulation of TM in the EU the assessment route(s) available to or metabolic means, but which The regulation of medical devices show compliance with the essential may be assisted in its function by in the EU is governed by three key requirements, leading to a CE such means. Medical Device Directives mark. A key feature of the There are a number of aspects of (‘MDDs’)1, providing a European system is that medical TM systems that may fall within harmonised framework. Although devices are not subject to any pre- this definition if the relevant there are differences between market authorisation by a product or service is intended to Member States (‘MS’) in how these government regulatory authority have a medical purpose (as defined have been implemented into law, (unlike in the US) and the more above). This is assessed by having the core legislative framework set limited conformity procedures regard for both the expressed up under the MDDs provides that often allow medical devices to intention of the manufacturer (i.e. medical devices must conform reach the market more quickly by looking at labelling, instructions with certain ‘essential than in other jurisdictions. MS and/or promotional materials) as requirements.’ These vary nominate a ‘Competent Authority’ well as the surrounding depending on the class and type of (government agency) to monitor circumstances and context in device, though broadly they seek to and ensure compliance with the which the product or service is ensure that medical devices are provisions of the MDDs, and each made available. designed and manufactured in in turn designates ‘Notified Bodies’ Stand-alone software has been such a way that, when used under (‘NBs’) (private entities contracted explicitly regulated as a medical the conditions and for the by industry) to carry out the device in the EU since 2007, when purposes intended, they will not relevant assessment procedures. a revision of the MDDs was compromise the clinical condition The procedure for conformity introduced through Directive or the safety of patients or users. assessment is risk-based, taking 2007/47/EC4 to ensure that The EU regulatory framework is into account the classification of ‘software in its own right, when not prescriptive as to how the medical device, the intended specifically intended by the compliance is demonstrated. clinical mode of use and the nature manufacturer to be used for one or Typically compliance with ‘essential and characteristics of the device; more of the medical purposes set requirements’ described in the EU class I devices are not externally out in the definition of a medical Directives is demonstrated through assessed by NBs but are self- device, is a medical device.’5 At the compliance with harmonised certified by the manufacturer. time it was also specified that technical standards, where these Under the MDDs a ‘medical software for general purposes exist. Compliance with such device’ is broadly defined as any when used in a healthcare setting is standards provides a presumption instrument, apparatus, appliance, not a medical device. of compliance with the applicable material or other article, whether eHealth Law & Policy - December 2015 09 TELEMEDICINE

Diagnosis and therapy software There is assessment may not always be achievement of its primary The most obvious example is significant straightforward given these intended purposes.’8 The regulation stand-alone software specifically market products often sit on the of MM Apps and MDDS conform designed for use in formal medical interest in borderline between a medical and to the FDA’s risk-based regulatory telemedicine diagnosis and/or therapy directed applications’ wellbeing/leisure purpose (e.g. an regime, the requirements of which at individual patients (e.g., potential. app that provides heart rate may include establishment software systems that enable However, monitoring with remote data registration and medical device remote presentation of heart rate). there is still a processing functions). The UK’s listing, labelling, investigational These are likely regulated as either great deal of Competent Authority (the device exemption requirements, uncertainty Class IIa or IIb medical devices, regarding ‘MHRA’) recently issued some pre-market submission for requiring oversight from a how the EU guidance7 suggesting that certain approval or clearance, Quality designated NB. Similarly, stand- and US words defining an app’s function System regulation, medical device alone picture archiving and medical (e.g. amplify, analysis, calculate, reporting, correcting problems, devices communication systems (‘PACS’) regulatory detect, diagnose) may be indicative and reporting corrections. that are intended by the regimes will of a medical rather than a manufacturer for viewing, deal with the wellbeing/leisure purpose, but Mobile medical apps archiving and transmitting medical associated acknowledged that in the context The FDA cites industry estimates images remotely in the context of technologies of telehealth the difference between that ‘by 2018, 50 percent of the and direct diagnosis will be usually applications social care, wellbeing and health more than 3.4 billion smartphone classed as IIa devices though where can be blurred. In the meantime, and tablet users will have these devices either drive or until there is further clarity from downloaded mobile health influence the use of a source device the regulatory authorities, applications.’9 More than a few of they will be classified in the same manufacturers can take some these apps will qualify and be class as the source device6. comfort in the fact that most regulated by the FDA as MM Apps, consumer apps, even if they are a device either intended to be used Communications software regulated, are likely to be Class I as an accessory to a regulated Communications software (and devices and therefore can be self- medical device or to transform a the associated IT and hardware certified (without the need to mobile platform into a regulated infrastructure) used with involve any NBs). medical device. The FDA released telemedicine systems will usually and finalised its thoughts on how be regulated as medical devices if Telemedicine in the US MM Apps will be regulated via a they facilitate the monitoring Mobile medical apps (‘MM Apps’) document aligned with the and/or delivery of healthcare and medical device data systems Agency’s risk-based approach10. services remotely. For instance, (‘MDDS’) are considered medical Where regulatory requirements virtual reality technology and devices regulated by the US Food apply, manufacturers will be hardware that is designed to be and Drug Administration (‘FDA’). required to follow appropriate used to conduct surgical Under the Federal Food, Drug, and rules, namely general controls and procedures from a remote location Cosmetic Act, a ‘device’ is defined potentially, specific controls, pre- will most likely be regulated as in pertinent part as ‘an instrument, market notification, and pre- Class IIb or Class III devices. On apparatus, implement, machine, market approval. the other hand, systems that are contrivance, implant, in vitro The FDA intends to regulate only more administrative in nature (e.g. reagent, or other similar or related those MM Apps whose video appointment software, article’ that is ‘intended for use in functionality could pose a risk to virtual patient management the diagnosis of disease or other patient safety if the app does not systems) are unlikely to be classed conditions, or in the cure, function as intended. The FDA is as medical devices. mitigation, treatment, or focusing oversight on those apps: prevention of disease, in man’ or that connect a medical device to Mobile ‘apps’ ‘intended to affect the structure or control it, actively monitor Even in more consumer-focused any function of the body of man’ patients, or analyse medical data; settings applications may be and ‘which does not achieve its that transform the mobile platform regulated as medical devices if they primary intended purpose through into a medical device with the use are clearly intended to be used for chemical action within or on the of attachments or inclusion of a medical purpose. This is a tricky body and which is not dependent functionalities similar to those of area however because the upon being metabolized for the currently regulated medical

10 eHealth Law & Policy - December 2015 TELEMEDICINE

devices; and that perform patient and does not control the functions FDA is continuing to evaluate the specific analyses, diagnosis, or or parameters of any connected evolving field and application of its treatment recommendations. medical device. The definition of risk-based scheme. The FDA has determined the MDDS does not include devices relative risk of certain types of apps intended for active patient Alexis Gilroy Partner Cristiana Spontoni Partner as being appropriately low as to monitoring or those devices that Colleen Heisey Partner require no oversight. The FDA are to be relied upon in deciding to Indra Bhattacharya Associate extends enforcement discretion to take immediate clinical action, Jones Day, Washington DC, Brussels patient-facing MM Apps that help where the circumstances require a and London [email protected] self-management of a timely response. [email protected] disease/condition generally or Historically, the FDA has [email protected] provide simple tools to organise regulated MDDS as high-risk, [email protected] and track health information. For Class III, but in February 2011, the 1. (i) Directive 90/385/EEC regarding healthcare providers, it includes Agency reclassified MDDS to low- active implantable medical devices, (ii) those automating simple tasks or risk, Class I, subject to general Directive 93/42/EEC regarding medical supporting patient/provider controls, determining that these devices, and (iii) Directive 98/79/EC regarding in vitro diagnostic medical interaction with personal health technologies pose a low risk to the devices. records or electronic health record public. Consequently, the FDA 2. http://ec.europa.eu/digital-agenda/ systems11. The FDA does not intend decided it would not enforce en/news/have-your-say-standards-help- to enforce regulatory requirements compliance with regulatory achieve-digital-single-market 3. The classification depends on criteria for mobile apps that transfer, store, controls that apply to MDDS such as the duration of contact with the convert format, and display devices, medical image storage body and the degree of invasiveness. medical device data in its original devices, and medical image 4. Directive 2007/47/EC of the European Parliament and of the Council of 5 format from a medical device, as communication devices, including September 2007 amending Council defined by the MDDS regulation. registration and listing, pre-market Directive 90/385/EEC on the Apps the FDA does not consider review, post-market reporting, and approximation of the laws of the Member to be medical devices include those quality system regulation for States relating to active implantable 13 medical devices, Council Directive intended to provide access to manufacturers of these devices . 93/42/EEC concerning medical devices electronic copies of certain and Directive 98/8/EC concerning the reference material; those for use as Conclusion placing of biocidal products on the market. educational tools for medical There is significant market interest 5. See Recital 6 of Directive 2007/47/EC. training; for general patient in TM applications’ potential. 6. See for example, EC Manual on education; to automate general However, there is still a great deal Borderline and Classification in the healthcare office operations; and of uncertainty regarding how the Community Regulatory Framework for Medical Devices, v 1.16 (2014). general purpose products. EU and US medical devices 7. https://www.gov.uk/government/ regulatory regimes will deal with publications/medical-devices-software- Medical device data systems the associated technologies and applications-apps/medical-device-stand- Products that contain or consist of applications. Both regimes appear alone-software-including-apps 8. FDCA §201(h) / 21 U.S.C. §321(h). computer and/or software to be mostly taking a sensible risk- 9. FDA, Mobile Medical Applications. htt components are also subject to based approach, though this may p://www.fda.gov/MedicalDevices/Produc device regulation if they meet the change as adoption of technology tsandMedicalProcedures/ConnectedHeal th/MobileMedicalApplications/default.htm definition of a device, including develops. There are a number of 10. Mobile Medical Applications: MDDS. MDDS is a device important developments underway Guidance for Industry and Food and intended to, without controlling or that could dramatically change the Drug Administration Staff; US Food and altering the functions or regulatory landscape. The EC is Drug Administration (9 February 2015). 11. The MM App policy, however, does parameters of any connected presently undertaking a review of not apply to apps that function as an devices, perform: the electronic mHealth technologies including a electronic health record system or transfer, storage, or display of focus on TM products and personal health record system. 12. 21 C.F.R. § 880.6310. medical device data, and/or the services. The existing European 13. Medical Device Data Systems, electronic conversion of medical MDD regime is also in the process Medical Image Storage Devices, and device data from one format to of being completely revamped and Medical Image Communications another format according to a a radically new regulatory system is Devices: Guidance for Industry and Food 12 and Drug Administration Staff. US Food preset specification . An MDDS expected to come into effect within and Drug Administration (5 February does not modify the data it handles the next four to five years. The 2015). eHealth Law & Policy - December 2015 11