FDA Poised to Regulate HIT

The newly enacted reauthorization of the user fee program for the Food and Drug Administration (FDA)— the Food and Drug Administration Safety and Innovation Act — was more than a bi-partisan effort to prevent drug shortages and speed federal approval of medicines, including lower-cost generic versions. It set the stage for the FDA to regulate health information technology (HIT), which could be a game changer. 

Hidden away in Section 618 is this nugget that has been flying under the HIT radar: the Department of Health and Human Services (HHS) would have 18 months following enactment to publish a report “that contains a proposed strategy and recommendations on an appropriate, risk-based regulatory framework pertaining to health information technology, including mobile medical applications, that promotes innovation, protects patient safety and avoids regulatory duplication.” 

The report would be based on input and recommendations from a working group of external experts and stakeholders, convened by the HHS Secretary. The regulatory strategy and recommendations would be published on the websites of the FDA, Federal Communications Commission (FCC), and Office of the National Coordinator for Health Information Technology (ONC) (See the text of the bill here). Congress passed the conference version of the legislation (S.3187) on June 26. It was signed into law on July 9 by President Obama.

Regulation of medical devices by the FDA is nothing new. It has the statutory authority to regulate medical devices and has been doing so for years. It has recently been pushing regulation of some aspects of HIT, mostly under the auspices of protecting patient safety. This desire to expand its scope has high-level support in Congress and other such key stakeholders as the Institute of Medicine (IOM).

The wording of the legislation is broad enough to cover all kinds of HIT — from ePrescribing to electronic health records to personal health records. Mobile health applications are specifically called out. While some of technologies are regulated on an ad hoc basis by federal agencies, the vast majority are not. Moreover, the legislative language is so broad that it may cover health information exchanges, even though they are not specifically identified.

This all gives rise to a number of suppositions and critical questions. Here’s a summary of what we think we know and what we don’t know.

What We Think We Know

Based on what we know so far, we can surmise the following.

Although roughly 20 percent of bills were signed into law this year, the President was sure to sign S.3187 once it reached his desk because: 

• FDA user fee reauthorization was supported by an unusual cohort of stakeholders. It had bipartisan support coming through the House and Senate.  The administration also posted a supportive policy position. Consumer groups and pharmaceutical companies strongly supported the legislation.
• Without its passage, the current review process for pharmaceutical, medical device and biotech companies — which is said to cut review times in half — will expire in September. Neither the government nor the companies involved want this to happen.
• Reauthorization would generate about $720 million in FY 2013, according to the Congressional Budget Office. Without these funds, the FDA would need to lay off as many as 4,000 employees.
• The reauthorization legislation also contains provisions addressing mother-hood-and-apple-pie issues related to pharmaceuticals. These include several steps to combat drug shortages; enabling delivery systems to repackage drugs in shortage and distribute them to affiliate hospitals; creating new user fee programs for biosimilar biological products and generic drugs; increasing incentives for the development of new antibiotics; renewing and enhancing mechanisms to ensure that children's medicines are appropriately tested and labeled; and expediting the development and review of certain drugs for treatment of serious or life-threatening diseases and conditions.

The HIT aspects of this legislation seem to be a direct outgrowth from an IOM working group in November 2010. It recommended the HHS Secretary should direct the FDA to exercise all available authority to regulate a number of specific HIT applications and that the FDA should develop the necessary framework for regulation.

This legislation reflects a maturation of the HIT industry. The lines are blurring as medical devices are becoming more HIT-like and HIT applications are becoming more like medical devices.

What We Don’t Know

Having the FDA as a regulator of HIT could be a real game changer. However, the extent and potential impacts of the agency’s involvement are unknown at this point. They do give rise to a number of questions:  

• What will be the scope of FDA’s regulatory oversight of HIT?
• Will this create a regulatory turf battle within HHS? Although the recommendations of the workgroup would presumably sort that out, it puts the FDA in a new arena with other HHS agencies and the FCC. The FDA surely is the biggest dog on the porch. 
• Is this really a move to protect patient safety or is it a power grab to expand the reach of the FDA?
• Will FDA have the resources and expertise to undertake regulation of current and future HIT applications? Will user fees be imposed and would they be enough to cover it all?
• Will FDA regulation and imposition of user fees stifle innovation and time-to-market for HIT applications?
• Will the workgroup truly represent the broad spectrum of HIT interests? How will it be convened and staffed?
• What harmonization will be needed down the line to align the FDA’s potential HIT regulatory activities with those for standards, privacy, security and Medicare Part D?
• What will FDA regulation mean for the ONC’s Permanent Certification Program for Health Information Technology (EHR certification)? What challenges will arise from potential overlap and even conflicting requirements?

Looking Ahead

To be sure, these questions will be answered as this all unfolds — which could take four years or more.    The first step will be to convene the workgroup and select its membership. Next, it should take the workgroup roughly a year to hold hearings and issue recommendations in order to meet the statute’s 18 month deadline. Finally, resulting regulations would take at least another couple of years to promulgate.  

This gives the HIT industry some time to get ready for what comes next. Welcome to the party, FDA.