ITAC Health - Patient Management Software Licensing Working Group

Health Canada Posts New Notice and FAQ

2010-12-07T07:43:00.004-05:00

Health Canada has posted a revised Notice and FAQ on Software Regulated as a Class I or Class II Medical Device (you will note that Health Canada no longer uses the term "Patient Management Software"). The new definition, from the FAQ is as follows:

"Software regulated as a medical device:

(1) provides the only means and opportunity to capture or acquire data from a medical device for aiding directly in diagnosis or treatment of a patient; or

(2) replaces a diagnostic or treatment decision made by a physician.

Software that fits part (1) of this definition would be picture archiving and communication system (PACS) and other types of software that have traditionally been licensed since they are adjuncts or accessories to medical devices.

The FAQ further clarifies that software used for remote patient monitoring (e.g. monitors used at home in a homecare situation), and software that controls or is embedded into a medical device are also medical devices.

These examples are covered under part 1 of the new definition. At this time, we are not aware of any product that meets part 2 of the definition (replaces a diagnostic or treatment decision made by a physician). It is expected that part 2 may come into play in the future when expert systems that replace a physician's judgement become available and are permitted to be deployed in the health system.

ITAC Health recommends that vendors and distributors of health software contact Health Canada to determine whether or not their products meet the new definitions.

EHR safety reporting system launched in US

2010-11-16T16:04:00.001-05:00

Click here for article in Healthcare IT News.

Sources of Safety Risk in Software

2010-11-16T07:35:00.004-05:00

In order to determine the appropriate standards for health software safety, we need to consider the sources of hazards. A scan of the literature reveals the following principal sources of safety risk:

1. Security risks as they relate to the integrity and availability of data and critical system assets (confidentiality doesn't figure in here to much) - This involves pretty much everything that could compromise the integrity and availability of software and associated data and includes viruses and other malicious code unauthorized access, and natural and man-made disasters. Best standards here are ISO/IEC 27001/27002/27799.

2. Software risks as they relate to the manufacture, installation and support of software products (including documentation, change management, and problem resolution processes). This includes software bugs (in both application software and underlying operating systems) and software that fails to meet user and performance specifications. This is essentially a quality issue and ensuring the application of an appropriate system development lifecycle methodology. Best standards here are ISO/IEC 13485/9001/ and their associated implementation guides and SDLC standards IEC 62304/ISO/IEC 12207.

ISO/IEC 14971 - Application of Risk Management to Medical Devices and its companion document IEC 80002-1 Medical device software - Part 1: Guidance on the application of ISO 14971 to medical device software provide guidance on the application of risk management practices to the manufacture and support of Medical Device Software (MDS). If one accepts that Clinical Management Software (CMS) and EHR Infrastructure Component Software (EICS) have similar risk profiles to MDS, then these standards would be appropriate.

3. Human factors engineering risks as they relate to the interface between the human user and whatever software, hardware or communications systems are deployed. This includes user interface (does it eliminate or promote user errors?), training, problem identification, escalation and resolution. This is essentially a quality issue as it relates to the software being developed in consideration of the user environment and user needs. Best standards here are ISO/IEC 13485/9001 and their associated implementation guides and SDLC standards IEC 62304/ISO/IEC 12207.

There is a purchaser/user dimension to human factors risk associated with end-user training (e.g. vendor has training available, but user doesn't apply it), work environment (stressed out or tired workers may make more errors), poor integration into clinical processes, etc. These are not addressed in any standard, but some guidance may be available from institutional certification and accreditation programs.

4. Project/installation risks as they relate to the installation and deployment of software systems. This includes user configuration, integration with clinical and business processes, and end-user training. On the manufacturer/vendor side quality standards 13485 and 9001 will require the vendor to ensure that readable documentation and training are available and are sufficient to enable user installation and configuration where necessary.

On the purchaser side, particularly around configuration management and integration of software into clinical and business processes, available guidance is limited. Some highly general guidance is available in project management standards (e.g. PMBOK). A standard for purchasers or users may be an area where TC215 can develop appropriate guidance for the deployment and support of health software.

5. Operations risks as they relate to the ongoing operation and maintenance of health software. This includes issues of change management, upgrades, bug fixes and patches, and performance levels. On the manufacturer/vendor side ISO/IEC 13485/9001 will require that required support services are in place and maintained.

On the purchaser/user side, technical management can be covered off applying ITIL or CObIT. Little guidance is available for end users activities. Again, this is an area where TC215 could provide some appropriate guidance.

New Definitions - MDS, CMS & EICS

2010-11-14T05:27:00.001-05:00

As we go forward in discussions about standards in software, we need some new definitions. Unfortunately Health Canada has destroyed the term "patient management software". And of course there is the endless debate about whether a standard for medical device software is appropriate for EMRs, EHRs, Etc. There are many ways to slice and dice the definitions of software used in health care. Based on the issues raised during the Health Canada discussions and to clarify our language I propose the following definitions:

Medical Device Software (MDS) is any software that is used to:
- Control a medical device
- Receive and display data output directly from a medical device
- Receive, analyze and display data output directly from a medical device

MDS would include firmware imbedded into medical devices.

Clinical Management Software (CMS) is any software that is used to:
- Collect, process, store and display data used to support clinical decision making
- Combine and display clinical data from multiple sources
- Create and present new data through the analysis of clinical data (e.g. alerts)

CMS would include EMRs and EHRs. Anything below the HIAL.

EHR Infrastructure Component Software (EICS) is any software that is used to:
- Collect, process, store and communicate clinical data other than at the point of care (i.e. not CMS or MDS)
- Network or otherwise connect CMS systems and MDS systems

EICS would include middleware, software supporting security and privacy services, regional and provincial registries and repositories, etc. Anything in the HIAL or above.

Even these definitions can get confusing. For example, hook an electronic stethoscope up to a CMS and it becomes an MDS (at least according to Health Canada's proposed definition of software to be regulated as a medical device. I'm open to suggestions or alternate definitions. However, I will be using these definitions for my own analyses in the coming weeks.

Standards for Software Safety

2010-11-12T07:51:00.001-05:00

Annex B of IEC 62304 provides a useful framework for standards associated with the safety of medical device software. On page 77 it states:

"There is no known method to guarantee 100% safety for any kind of software.

There are three major principles which promote safety for medical device software:

- Risk Management
- Quality Management
- Software Engineering"

In the medical device software world there are three standards that provide the essential guidance on software safety:

Risk Management - ISO 14971 - Medical Devices - Application of Risk Management to Medical Devices
Quality Management - ISO 13485 - Medical devices —— Quality management systems —— Requirements for regulatory purposes
Software Engineering - IEC 62304 - Medical Device Software - Software Lifecycle Processes

At least two of these standards have been adapted from more generic standards to meet the needs of the medical device software industry. In particular:

ISO 13485 is adapted from ISO 9001
IEC 62304 is adapted from ISO/IEC 12207 (Software Life Cycle Processes)

In pursuing this matter for clinical systems including EMRs and EHRs, we have three choices to choose from:

1. Adopt the standards that have been developed for medical device software (13485/14971/62304)
2. Adopt the more generic ISO standards (9001/12207)
3. Develop a unique set of standards for clinical systems including EMRs and EHRs

Thoughts?

Scope and Definition of Software Subject to Quality and Safety Standards

2010-11-11T10:36:00.001-05:00

One of the big challenges in our recent discussions with Health Canada was the scope of software to be considered for licensing and the definition of that scope. The definition that Health Canada is landing on is as follows (from their draft FAQ - note that this has not yet been published and could be subject to change):

Software regulated as a medical device:

1. Provides the only means and opportunity (meaning in real time) to capture and acquire data from a medical device for aiding directly in diagnosis or treatment; or
2. Replaces a diagnostic or treatment decision made by a physician

This is a very restrictive definition that limits the software that is subject to licensing to software that is "adjunct" or connected directly to another medical device. Health Canada can provide no examples of what might fit the second part of the definition... but its expected that it may include expert systems that replace human clinical judgement in the future.

The other wrinkle in the Health Canada definition was that even though something might be considered a medical device, it doesn't require licensing unless it is sold. This then excluded ASP delivered solutions and any software developed in-house.

As an Industry we need to figure out the scope of software to be considered. We found that the Infoway blueprint was a useful frame of reference. So here's the challenge to the ISC - What components of the Infoway blueprint should be subject to quality management and safety standards? Are there software systems not included in the Blueprint that should be included (think consumer health platforms, smartphone apps, etc.)? Should there be an exception for in-house developed applications?

Post your replies on the blog.

Quality and Safety Standards that Apply to Health Software

2010-11-11T10:27:00.001-05:00

I have been researching the various standards that may be considered in upcoming discussions about the ISO TC215 technical report on software and patient safety. Over the next days and weeks I'll email you with any interesting tidbits I uncover that may stimulate discussion. The actual standards themselves are quite expensive so I will provide wikipedia or SCC catalogue references to start you on your own research paths. Comments/reactions are most welcome.

Are there any other standards you think might apply?

To start - Standards in play:

ISO 13485 - Medical devices —— Quality management systems —— Requirements for regulatory purposes

ISO 14969 - Medical devices -- Quality management systems -- Guidance on the application of ISO 13485: 2003

ISO 14971 - Medical Devices - Application of Risk Management to Medical Devices

IEC 62304 - Medical Device Software - Software Lifecycle Processes

ISO 9001 - Quality Management Systems

ISO 90003 - Software engineering Guidelines for the application of ISO 9001:2000 to computer software

ISO 25238 - Health Informatics - Classification of safety risks from health software

ISO 27809 - Health Informatics - Measures for ensuring patient safety of health software

Health Canada to Scale Back Definition of Patient Management Software

2010-11-05T10:08:00.001-04:00

ITAC Health has learned that Health Canada is planning to issue revised guidance in the form of an FAQ that will redefine Patient Management Software. It is expected that the new definition will be more restrictive than the definition in their May 21st Notice. It is likely than many patient management software products previously identified as Class I and Class II devices will no longer fit the new definition and will NOT require Medical Device Licenses. Health Canada has advised that they plan to issue the FAQ before the end of November.

ITAC Health recommends that health software manufacturers and vendors contact Health Canada's Medical Devices Bureau to confirm the status of their products. This includes products on which Health Canada had previously rendered classification decisions. Contact information for Health Canada follows:

Device Licensing Services Division
Medical Devices Bureau
Therapeutic Products Directorate
Health Canada
Room 1605, Statistics Canada Main Building
Tunney's Pasture, Address Locator 0301H1
Ottawa, Ontario
K1A 0K9

Phone: (613) 957-7285
Fax: (613) 957-6345
E-mail: device_licensing@hc-sc.gc.ca

ITAC Health Policy Statement on Medical Device Licensing

2010-09-08T20:16:00.003-04:00

The following policy statement was approved by the ITAC Health Board on September 7, 2010.

Canada’s health ICT companies are committed to meeting the highest standards for patient safety in their products and services. For this reason, ITAC Health supports the application of Health Canada's Medical Devices Regulations (MDR) as they apply to patient management software defined in Health Canada's Notice dated May 21, 2010. This regulation is appropriate for patient management software products that manipulate and interpret clinical data, which require a high standard of quality.

ITAC Health believes the MDR to be an important vehicle to "raise the bar" in terms of software product quality, safety and effectiveness. It is national in scope, is based on recognized international standards, and is overseen by a legitimate authority with its basis in law. ITAC Health sees Medical Device Licensing as an important first step towards the end-to-end adoption and application of existing and emerging national and international standards for all components of the Canadian health information infrastructure. It is also a foundational element in a national strategy for conformance, certification and licensing that addresses the needs of all stakeholders.

We note that the requirements of the MDR include ISO quality management certification, which addresses the product development process, instructions for use, delivery procedures, training procedures, and support procedures. The MDR also includes the safety and effectiveness requirements in sections 10 to 20 of the regulations, labeling requirements, and requires that manufacturers and distributers have processes in place for complaint handling, problem reporting and recalls.

Member companies who manufacture and sell software products which they market as having the capacity to guide clinical behaviour, highlight clinical risks to users, or are otherwise relied-upon by health professionals to be accurate in their representation of clinical data, are complying with the MDR. Many vendors have for many years obtained the necessary licenses for their products consistent with Health Canada's MDR and the regulatory authorities in other countries. Other vendors are currently engaged in the process of obtaining ISO 13485 Certification and MDR Licensing and will be compliant by Health Canada’s deadline of September 1, 2011.

We acknowledge that a transition to such a regulated environment can be a complex and expensive endeavour. We believe Health Canada’s concession to extend the deadline for compliance to September 1, 2011 is supportive of private industry’s capacity to conform. We also acknowledge that budgeting and planning processes for government and other public agencies introduce a further level of complexity possibly warranting a further extension of time. This would involve giving additional time to those public agencies that develop and distribute software to adjust their internal processes and procedures for MDR compliance, and for those public agencies that need to maintain and support health-critical legacy software systems while they migrate to licensed software. ITAC Health would support changes to the Notice to facilitate such a transition provided that patient safety was not compromised in doing so and that such extension is not exploited to avoid the use of private industry solutions, or to circumvent a private company’s obligation to conform.

We believe that compliance with the MDR is in the best interests of vendors, who stand to gain from increased health care provider and consumer confidence in the safety and effectiveness of their products, and of health care providers and consumers who will have evidence that products have been developed under conditions that promote safety and effectiveness.

Are application service providers (ASP) subject to the Medical Devices Regulations?

2010-08-16T18:28:00.000-04:00

Note: Exact text provided by Health Canada

ASPs (application service providers) do not fall within the scope of the Regulations since no sale of a medical device is taking place. However, if the ASP has purchased a medical device with which the ASP is providing a service, the manufacturer of the device is still required to comply with the requirements of the Medical Devices Regulations and obtain the appropriate licence prior to the sale to the ASP.

How will Health Canada treat legacy systems?

2010-08-16T18:25:00.000-04:00

Note: Exact text provided by Health Canada.

For the purposes of this document, “legacy system” is defined as follows:

“legacy system” is software that was designed, sold and deployed prior to February 1, 2011 (Class I) or September 1, 2011 (Class II).

The Medical Devices Regulations prohibit the sale of a Class II, III or IV medical device unless the manufacturer of the device holds a device licence in respect of it. However, as legacy systems have been previously sold without immediate risks to public health having been identified, they have not been prioritized for compliance with this prohibition until September 1, 2011. After that date the sale of a legacy system that is a Class II, III or IV device without a licence will be prioritized for compliance as any other device (according to Policy 001 of the Health Product and Food Branch Inspectorate).

An establishment that imports or sells any medical device must also hold an Establishment Licence (“EL”) to do so. Compliance with that requirement has similarly not been prioritized until February 1, 2011. After that date the import or sale of a legacy system device without an EL will be prioritized for compliance as any other similar device (according to Policy 001 of the Health Product and Food Branch Inspectorate).

Neither servicing, maintenance nor use of a device is governed by these Regulations. Upgrading to a new version of the software, if the functionality, intended uses, or nomenclature of the system is altered, would be a “sale” of a medical device, and the new version would need to be licensed.

Is patient management software developed in-house by health care organizations subject to the Medical Devices Regulations?

2010-08-16T18:20:00.002-04:00

Medical devices developed and used exclusively in-house by healthcare providers do not fall within the scope of the Regulations as they do not meet Section 2 of the regulations:

2. These Regulations apply to
(a) the sale and advertising for sale of a medical device; and
(b) the importation of a medical device for sale or for use on individuals, other than importation for personal use.

[Note: This answer was reviewed by Health Canada]

Is Middleware a Medical Device?

2010-08-16T18:19:00.000-04:00

Note: Exact text provided by Health Canada.

For the purposes of this document, “middleware” is defined as follows:

“middleware” means a piece of software that connects two or more software applications so that they can exchange data. This includes software systems that facilitate the interaction of disparate components through a set of commonly defined protocols. The purpose is to limit the number of interfaces required for interoperability by allowing all components to interact with the Middleware using a common interface.

As defined above middleware would not fit the definition of a medical device.

Are COTS products Medical Devices?

2010-08-16T18:10:00.006-04:00

COTS products (Commercial Off The Shelf) that are developed for general commercial use and are not specific to health care such as database applications, encryption applications, and web portal applications, are not considered medical devices, even when they are integrated into health information systems and infrastructures that process personal health information.

However, where COTS products such as databases and portals are integrated into a patient management software product that is classed as a Class II device, the patient management software manufacturer must verify and validate that the COTS product has been safely and effectively configured and integrated into the patient management software product.

[Note: This answer was reviewed by Health Canada]

Are EMRs Medical Devices?

2010-08-11T22:00:00.007-04:00

NOTE - THIS POST IS NO LONGER VALID. HEALTH CANADA IS CHANGING ITS DEFINITION OF PATIENT MANAGEMENT SOFTWARE AND EMRS AND EHRS WILL NO LONGER BE CONSIDERED MEDICAL DEVICES. CLICK HERE FOR MORE INFO.

ITAC Health and MEDEC met with Health Canada by teleconference on Tuesday, August 10, 2010, to discuss issues surrounding Patient Management Software. One of the issues that required clarification was the question of whether or not Electronic Medical Records (EMRs) were Medical Devices under the Medical Devices Regulations. Health Canada clarified its interpretation as follows:

EMRs that are only intended to store and view patient information, and provide no analysis or decision support respecting diagnosis or treatment, do not fit the definition of a medical device (for example: the system captures and displays age, weight, notes about a patient’s appointment, patient test results, order processing, scheduling, or managing patient movement).

This would include software that would scan all of the patient records in a database, and based on some pre-determined criteria (age, gender, chronic diseases (diabetes, hypertension, heart disease), date of last test or immunization and combinations thereof), would flag to the physician, other heath care provider or admin staff to contact the patient and schedule the appropriate followup visit or test.

Such EMRs are not medical devices and do not require a medical device license unless they also perform one or more of the functions below and are used for diagnostic and/or treatment purposes.

EMRs are classed as Class II devices if they are used for the purpose of monitoring a physiological condition, state of health, illness or congenital deformity. This includes any patient management software involved in data manipulation, data analysis, data editing, image generation, determination of measurements, graphing, flagging of results, identifying a region of interest or performing calculations. Only software performing calculations that directly impact diagnosis and/or treatment of a patient merits a Class II designation.

For example:

1. An EMR that analyzes and provides the necessary information to flag drug interactions and patient allergies for a specific patient is a Class II device.

2. An EMR that receives and analyzes lab data for a specific patient and flags values that are out of the normal range is a Class II device.

There are few, if any, situations where an EMR will be classed as a Class I device. Health Canada is reviewing its definition of Class I devices to include only those devices that use real time data as an adjunct to a monitoring device for the purpose of aiding in treatment and/or diagnosis.

ITAC Health strongly recommends that if a manufacturer, vendor or distributor of an EMR has any doubt as to the appropriate classification of their product, that they contact Health Canada for a ruling. Be sure to maintain documentation of any advice provided by Health Canada on the classification of EMR products.

Patient Management Software Conference

2010-08-11T21:53:00.002-04:00

ITAC Health and MEDEC invite you to an educational conference on Health Canada's recently released Patient Management Software Notice on Wednesday, September 8, 2010 in Toronto.

The conference is open to ITAC Health, MEDEC and COACH members and non-members.

Topics Include:

"Overview of Patient Management Software Notice and the Requirements for Licensing"
Sarah Chandler, Health Canada

"Customer Point of View" presentation and panel discussion
Neil Gardner, CIO, Saskatchewan Health
Lydia Lee, CIO, University Health Network Toronto
William Pascal, CTO, Canadian Medical Association

Vendor panel -- "The Good, the Bad and the Ugly of Navigating the Licensing Process"
Joe Whitney, MedManager
Laila Gurney, GE Healthcare

"Registrar's Outline on How to Prepare for ISO 13485:2003 CMDCAS"
Dion Goncalves, Intertek

Opportunity to network with others working through the process

Allstream Centre
Exhibition Place
105 Princes' Blvd.
Room 200 A/B/C, Toronto, ON M6K 3C3

For more information check out the ITAC Website.

Health Canada Revised Notice Posted

2010-05-25T18:16:00.002-04:00

Health Canada's revised notice on licensing of patient management software can be found at the following URL's:

http://www.hc-sc.gc.ca/dhp-mps/md-im/update-miseajour/index-eng.php and
http://www.hc-sc.gc.ca/dhp-mps/md-im/activit/announce-annonce/index-eng.php

Health Canada Licensing Deadlines

2010-05-17T17:01:00.003-04:00

We have just been notified by Health Canada that the revised notice concerning medical device licensing for patient management software will be issued very soon. In a nutshell, the deadline for obtaining establishment licenses for the sale of Class I medical devices is February 1, 2011. The deadline for obtaining medical device licenses for Class II devices is September 1, 2011. Health Canada is also preparing an FAQ which is not yet available.

ITAC Health encourages all members who manufacture, sell or distribute Class I or Class II patient management software to initiate the ISO 13485 certification and medical device licensing processes as soon as possible. Failure to obtain licenses by the deadlines noted above will mean that you will not be able to sell or distribute patient management software classified as Class I or Class II devices in Canada.

When the notice is available it will be posted at the following URLs.

http://www.hc-sc.gc.ca/dhp-mps/md-im/update-miseajour/index-eng.php and
http://www.hc-sc.gc.ca/dhp-mps/md-im/activit/announce-annonce/index-eng.php

ITAC Health and MEDEC form Collaboration

2010-04-12T11:23:00.001-04:00

On April 5, ITAC Health and MEDEC formed a collaboration to advance healthcare through the use of health technology. The initial focus of the collaboration will be on ensuring that Canadian ICT and medical technology companies are aware of Health Canada’s announcement regarding regulations for patient management software, helping them to understand the medical device licensing process and representing the concerns of industry to Health Canada.

For more information, please see the following news release: ITAC Health and MEDEC collaboration.

Frequently Asked Questions About Patient Management Software Licensing

2010-04-12T11:11:00.002-04:00

ITAC Health has published a guide in the form of an FAQ for ICT vendors who manufacture and sell patient management software in Canada. The FAQ includes more than 60 questions frequently asked by vendors and other health system stakeholders.

In responding to the questions, ITAC Health conducted a review of documentation published by Health Canada on its website, presentations by Health Canada officials, ISO 13485:2003 and various guides to ISO 13485:2003 published on the Internet. ITAC Health also interviewed officials from Health Canada, accredited registrars, Provincial Chief Information Officers (CIOs), CIOs from major health care organizations, and expert consultants.

Comments on a draft of this document were also provided by MEDEC members (Canada’s Medical Device Association) with experience working with Health Canada on the regulation of devices including devices that are stand alone software.

It is recommended that all ITAC member companies download and read this document as soon as possible.

Download FAQ on Patient Management Software Licensing.

ISO Certification of Manufacturing Processes Only?

2010-03-04T18:18:00.004-05:00

The following question was posed to Health Canada by ITAC Health

The wording of the regulations with respect to the ISO 13485
certification for Class II devices, in particular section 32(2)(f),
states that the QMS certificate under which the device is “manufactured”
must satisfy the requirements for ISO 13485. The corresponding sections
for Class III and Class IV devices explicitly state, “designed and
manufactured”. This implies that certification of design processes is
not required for a Class II license.

Section 1.2 of ISO 13485 states, “If regulatory requirements permit
exclusions of design and development controls (see 7.3), this can be
used as a justification for their exclusion from the quality management
system. These regulations can provide alternative arrangements that are
to be addressed in the quality management system. It is the
responsibility of the organization to ensure that claims of conformity
with this International Standard reflect exclusion of design and
development controls [see 4.2.2 a) and 7.3].”

Will Health Canada issue a Class II Licence to a manufacturer whose design and development processes have not been included in their Quality Management Systems Certificate (i.e. only manufacturing processes included), where they have included in their documentation the appropriate disclaimers to that effect as permitted by ISO 13485?

Reply from Health Canada

Section 32 (2) (f) of the Medical Devices Regulations states that the
manufacturer of a Class II device must provide the following:

a copy of the quality management system certificate certifying that the
quality management system under which the device is manufactured
satisfies National Standard of Canada CAN/CSA-ISO 13485:03, Medical
devices — Quality management systems — Requirements for regulatory
purposes

Although it is not stated in the Regulations that for Class II medical
devices the quality management system certificate must also certify the
quality management system under which the device is designed, it is
strongly recommended that design be included in the scope of the ISO
13485:2003 certification when the device is a software product.

If a manufacturer submits a Class II application with a valid ISO 13485:2003 certificate that excludes design and development, Health Canada will not reject the application for that reason. (Note - emphasis in bold added by ITAC Health)

Trouble Negotiating HC Website?

2010-02-16T09:08:00.001-05:00

Many people have complained about the difficulty of navigating the Health Canada website for information about medical device licensing. According to Health Canada the easiest thing to do is Google your query. For example, if you want information about fees for medical device licensing, Google "Health Canada medical device fees". Try it. It works.

Canadian EMR Podcast on HC Licensing

2010-02-03T07:23:00.003-05:00

On October 26, 2009 Dr. Alan Brookstone of Canadian EMR interviewed Gary Folker, Managing Director of xwave's health care practice, Vice-Chair of the ITAC Health Board and Chair of the ITAC Health Working Group on Health Canada Licensing. Gary discussed the industry's position on licensing, special issues for EMR Vendors, and ITAC Health's discussions with Health Canada on the matter. Listen to the podcast.

Questions Every Canadian Healthcare CIO Needs to Ask Now

2010-02-03T06:38:00.002-05:00

Lydia Lee, VP & CIO of the University Health Network and President Elect of COACH presented the following questions every healthcare CIO needs to ask about Health Canada's requirement for licensing patient management software. She was hosting a special meeting of COACH on the Health Canada ruling in Toronto on February 2nd, 2010:

Questions Every Canadian Healthcare CIO Needs to Ask Now:

1.Do you have an inventory of all existing patient management software in use in your organization?

2.How will you communicate with your vendors/partners to inquire about their Class I and Class II licensing status with Health Canada?

3.What, if anything, can you do to assist your vendors/partners to meet their Class I and Class II licensing requirements?

4.What are your vendors’/partners’ plans for obtaining Class I and Class II licenses, if they do not have them already?

5.How will you monitor vendor/partner licensing compliance on an ongoing basis?

6.Are your Board of Directors, Senior Management and Legal Counsel aware of this Health Canada ruling?

a.What is your process to add this requirement to your organization’s Certificate of Compliance process? How will you update this on an ongoing basis?

7.How will you ensure that your organization’s procurement process includes a mandatory requirement for Class I and II Licensing for patient management software?

a.What language will you need to add to IT RFP templates used by your organization?

8.Does your organization develop “patient management software”? If yes:

a.What is the purpose(s) for the in-house developed patient management software?
b.Is the in-house developed patient management software distributed to other users or organizations beyond your own organization?
c.Do you have a documented agreement with the organization to which you distributed the patient management software for the ongoing support commitment, SLAs, etc.?
d.Do you have a set-aside for Class I and II compliance (ISO 13485) in your operating budget?
e.Who in your organization (in your IT department) will be accountable for maintaining ISO 13485?

9.How will you communicate information about this change to the organization at large to create awareness regarding these new requirements?

a.Organization’s responsibilities,
b.Staff responsibilities (IT staff, closet developers, researchers, etc.).

Meeting - ITAC Health and Health Canada - October 15, 2009

2009-10-19T18:10:00.002-04:00

Minutes
Licensing of Patient Management Software
Health Canada, Medical Devices Bureau/ ITAC Health

Date: October 15, 2009

Location: 150 Tunney’s Pasture Driveway, Ottawa

In Attendance: Sarah Chandler, Health Canada
Colin Foster-Hunt, Health Canada
Gary Folker, ITAC Health/xwave
Brendan Seaton, ITAC Health
Dr. Jay Mercer, Canadian Medical Association

1. The meeting was arranged at the request of ITAC Health to discuss the implications of the August 31, 2009 notice concerning the licensing of Patient Management Software and workable transition strategies to enable vendors to achieve compliance with licensing requirements.

2. ITAC represents more than 300 Information and Communications Technology (ICT) companies in Canada, of whom approximately 130 provide ICT products and services to the health sector. Not all companies are members of ITAC. It is estimated that there are approximately 450 ICT companies in Canada providing products and services to the health sector.

3. ITAC Health stressed at the outset that the Association did not dispute the licensing requirement in general, but stressed that a workable transition strategy was critical to enable vendors to achieve compliance without disrupting the delivery of health care or government sponsored initiatives in the health ICT marketplace.

4. ITAC Health reviewed the scope and magnitude of the licensing challenge. Some of the points raised:

• Patient management software covers a wide range of applications including primary care, hospital emergency and acute care, community care, public health, ambulance emergency services, homecare, pharmacy, laboratory and diagnostic imaging, and many other health services.
• According to Canada Health Infoway, in 2006 there were more than 40,000 information systems in active use in the Canadian healthcare system.
• Reviewing the Canada Health Infoway iEHR Blueprint, it was noted that the vision for electronic health records (EHR) in Canada involved a complex array of software products operated by health care providers and provincial and federal government jurisdictions. This includes point-of-service applications operated by health care providers, registries and EHR repositories operated by health regions and provincial governments, and many middleware components to facilitate secure communications between the many systems.
• The Federal and Provincial governments are aggressively promoting wide scale deployment of EHR and Electronic Medical Record (EMR) systems over the next 2 to 5 years. Governments are investing billions of dollars to achieve ambitious targets to have EHRs for the majority of Canadians by 2015 (e.g. the Federal Government has announced $500 million for Canada Health Infoway as part of its economic stimulus package. The Ontario Government has announced $2.1 billion over the next 3 years to implement EHR solutions). This will require the deployment of thousands of Patient Management Software systems over this time period.
• While exact figures are not yet available, it is known that a large number of vendors who develop and sell Patient Management Software in the Canadian healthcare marketplace and their products are not yet licensed.
• Based on the current notice, those vendors who are not currently licensed at the Class I level (i.e. the majority) have no clear “line of sight” to regulatory compliance. There is no transition period or strategy that will enable them to obtain ISO certification and product licensing without compromising their ability to develop, sell and support their products in the intervening period.
• ITAC Health believes that the majority of the products developed and sold by its members would fall into the Class II category.
• Several provincial jurisdictions including British Columbia, Alberta, Saskatchewan, Manitoba and Ontario, and Canada Health Infoway have established software certification programs to ensure interoperability with the provincial EHR infrastructures. Vendors, and in particular those who sell EMRs to the physician community, are currently expending significant resources to achieve compliance with the provincial programs. At present, Class I or Class II licenses are not required under these programs. It is expected that the August 31 notice will compel provincial jurisdictions to make licensing a requirement.

5. ITAC Health expressed the concerns of the vendor and health care provider community over the possible disruption to health services and to the ongoing sale and deployment of health information systems as a result of the notice. For example:

• The Canadian Medical Association is seeking the view of the Canadian Medical Protective Association concerning the legal status and liability of physicians who use unlicensed software products in their practices.
• EMR vendors are concerned that medical device licensing requirements will be adopted immediately by provincial funding programs for EMRs, effectively locking most vendors out of the marketplace.
• There is uncertainty over the status of the 40,000+ systems currently deployed in the Canadian healthcare system and whether or not users and user organizations are at risk of legal liability by their continued operation.

6. Health Canada indicated:

• They appreciated the feedback from Industry.
• It is not the intention of Health Canada to disrupt in any way the delivery of health services or programs promoting the use of EHRs or EMRs.
• Health Canada does plan to amend the August 31, 2009 notice and will consider the issues raised by ITAC Health.

However, they also noted that:

• The requirement for licensing is not new. It has been in effect for at least 4 years.
• It is the responsibility of vendors to undertake their own due diligence to determine regulatory requirements.

7. Health Canada and ITAC Health discussed various options for a transition period to enable vendors to become compliant with licensing requirements. This included the following:

• ITAC Health suggested that one approach would be to have all vendors immediately register their products as Class I devices and obtain establishment licenses, and then transitioning to Class II over a defined period of time. Health Canada indicated that this might not be an efficient way to proceed, as it would only add an additional step for those vendors who must obtain Class II licenses.
• ITAC Health indicated that for most vendors, compliance would involve two major stages. The first stage would be to determine what changes each organization must make in order to obtain ISO certification, and then to undertake those changes. The second stage would involve certification by an authorized ISO registration agent. The vendor would be dependent upon the availability, time and resource constraints of the registrar.
• ITAC Health suggested that a realistic time frame for undertaking both stages would be in the range of 36 to 48 months.
• ITAC Health indicated that whatever transition period is established, consideration must be given to the legal status of products already deployed in the health care system, and the sale of new products during the transition period. Any situation that bars the use or sale of products will disrupt patient care and the deployment of provincial EHR/EMR programs. Health Canada indicated that this is a legal question that requires the advice of Health Canada’s legal branch, and that they would seek advice on the matter.

8. ITAC Health indicated that it has consulted with MEDEC and believes that the two associations are in sync concerning the licensing matter. The two associations will continue to collaborate with each other and with Health Canada to ensure that a workable strategy for industry compliance can be found.

9. Health Canada and ITAC Health discussed communications and messaging concerning any announcement of an extended transition period for vendors whose products are not currently licensed as Class I or Class II medical devices. This included the following:

• ITAC Health suggested that the central message be that licensing, combined with a workable transition strategy over a reasonable period of time, was the best way to protect patients and health care providers who rely on Patient Management Software. Disruptions in the use or sale of Patient Management Software will compromise the ability of physicians and other healthcare providers to provide effective health care and delay the policy objectives of the federal and provincial governments to deploy EHR solutions to improve patient outcomes and the effectiveness of the healthcare system.
• ITAC Health has invited Health Canada to participate in a podcast with CanadianEMR to get its message out to the vendor and health care community. Such a podcast will make sense after Health Canada amends the notice.
• ITAC Health and Health Canada will continue to work together to find ways to effectively communicate with vendors and health care providers.

10. Action items from the meeting are as follows:

• ITAC Health will prepare minutes for this meeting for approval by Health Canada.
• Brendan Seaton and Colin Foster-Hunt will meet by telecon to discuss the table of software scenarios previously submitted by ITAC Health to Health Canada for their advice.
• Health Canada will seek legal advice concerning the status of Patient Management Software used or sold during any transition period.

Classification of Software Scenerios

2009-10-16T13:43:00.004-04:00

ITAC Health recently submitted a number of software scenarios to Health Canada to get a sense of what constitutes a Class I or Class II medical device.

The following list is a guide only and does not represent any definitive rulings by Health Canada. Companies in doubt as to whether their software is a Class I or Class II device can contact Health Canada's Medical Devices Bureau for a ruling. To initiate an action for a ruling, send an email containing a basic description of your company and the software in question (very brief) together with contact information for someone in your company who can discuss the application with Health Canada. The email can be sent to: DEVICE_LICENSING@hc-sc.gc.ca. Health Canada will contact you to discuss the process and any additional information required. More information can be found on the Health Canada website.

For scenarios where it is indicated that the class is (to be determined), this is the class Health Canada is leaning towards, but does not have enough information to provide firm advice at this time. Companies selling such software should contact Health Canada at the email address above.

1. Physician Software System - Scheduling and billing only, no manipulation or alteration of clinical data: Not a medical device

2. Physician Software System - Records and displays demographic and clinical data only with no manipulation or alteration of data: Class I

3. Physician Software System - Electronic Medical Record - contains decision support functions, manipulates and displays data in different formats: Class II

4. Physician Software System - Accesses and uses information and decision support functions provided by provincial or regional electronic health record systems: Class II

5. Electronic Health Record System - Custom developed by a health care organization or government health ministry (e.g. chronic disease registry, public health surveillance) for exclusive use by that health care organization or government health ministry: Not a medical device for sale or distribution

6. Electronic Health Record System - Custom developed by a health care organization or government health ministry (e.g. chronic disease registry, public health surveillance) and is given to, or sold to another health care organization or government health ministry: Class II

7. Electronic Health Record System - Custom developed by a health care organization or government health ministry (e.g. chronic disease registry, public health surveillance) where a private sector developer retains ownership of the end-product which is subsequently sold to another health care organization or government health ministry: Class II

8. Commercial Off-the-Shelf (COTS) Software - that is not healthcare specific but is used for clinical applications or is integrated into a health information system (e.g. office automation software, email software, operating systems, database software, web portal software, etc.): Not a medical device

9. Custom developed middleware that is developed to facilitate communications between health information systems and is distributed to multiple health care organization or jurisdictions (e.g. translation of proprietary clinical codes or messages into standard formats such as HL7 or SNOWMED CT) - Class I (to be determined)

10. COTS middleware that is not healthcare specific but is used to facilitate communications between health information systems: Not a medical device

11. Security system software that is not healthcare specific but is used to control access to and use of health information systems (e.g. encryption software, authentication systems): Not a medical device

12. Hospital administrative and financial systems (e.g. materials management, general ledger, billing): Not a medical device

13. Hospital ADT (admissions, discharge and transfer) systems: Not a medical device

14. Hospital clinical management systems (e.g. pharmacy, lab, diagnostic imaging, computerized physician order entry): Class II (to be determined)

15. Consumer health platforms - software systems available to consumers and healthcare providers on the internet that allow consumers and healthcare providers to enter, view, graph and manipulate personal health information (e.g. Microsoft HealthVault, Google Health): Class II (to be determined)

ITAC Health Working Group

2009-10-09T06:30:00.006-04:00

ITAC Health has established a Working Group to address vendor interests concerning the Patient Management Software licensing issue. At its first teleconference on Wednesday, October 7, 2009 it was decided that the first order of business for the Working Group will be on promoting a workable transition strategy to Health Canada, and to provide information to Health Canada to help them better understand the impacts of the licensing program on the health care system and health ICT marketplace.

Gary Folker, Managing Director, Healthcare for xWave, and a director on the ITAC Health Board, will chair the Working Group.

People interested in participating in the Working Group should contact ITAC Health Executive Director Elaine Huesing at ehuesing@itac.ca.

CanadianEMR to Develop Podcasts on Software Licensing

2009-10-09T06:23:00.004-04:00

CanadianEMR and ITAC Health are in discussions to create a series of podcasts to provide basic information to the vendor and health care communities. Three proposed podcasts are being discussed:

1. A vendor-oriented podcast with an EMR vendor who has gone through the process and the chair of the ITAC Health working group discussing what the licensing means in practical terms for vendors.

2. A podcast with Health Canada to clarify the policy notice and any related issues.

3. A podcast with several jurisdictional programs including PITO, POSP, OntarioMD and perhaps Infoway to discuss what the licensing issue means to the provincial and national programs.

Podcasts 2 and 3 will require discussions with Health Canada and the provincial programs. Watch this blog for progress on these and other communications initiatives.

Class II Application - What's Required?

2009-10-05T13:54:00.005-04:00

Section 32(2) of the Medical Devices Regulations outlines the requirements for a Class II License application.

An application for a Class II medical device licence shall contain, in addition to the information and documents set out in subsection (1), the following:

(a) a description of the medical conditions, purposes and uses for which the device is manufactured, sold or represented;

(b) a list of the standards complied with in the manufacture of the device to satisfy the safety and effectiveness requirements;

(c) an attestation by a senior official of the manufacturer that the manufacturer has objective evidence to establish that the device meets the safety and effectiveness requirements;

(d) an attestation by a senior official of the manufacturer that the device label meets the applicable labelling requirements of these Regulations;

(e) in the case of a near patient in vitro diagnostic device, an attestation by a senior official of the manufacturer that investigational testing has been conducted on the device using human subjects representative of the intended users and under conditions similar to the conditions of use; and

(f) a copy of the quality management system certificate certifying that the quality management system under which the device is manufactured satisfies National Standard of Canada CAN/CSA-ISO 13485:03, Medical devices — Quality management systems — Requirements for regulatory purposes.

Broad Definition of "Sell"

2009-10-05T13:26:00.003-04:00

Compulsory licensing applies to patient management software sold in Canada. The definition of "sell" in the Food and Drugs Act is very broad. The Act states "sell" includes offer for sale, expose for sale, have in possession for sale and distribute, whether or not the distribution is made for consideration.

According to an official of Health Canada contacted on this date, this means that any distribution of any patient management software, even if there is no financial transaction, constitutes a sale. This would include patient management software developed for one provincial Ministry of Health and provided to a Ministry of Health in another province (with or without financial charge).

No Grace Period for Unlicensed Software

2009-10-05T12:58:00.000-04:00

The Health Canada notice dated August 31, 2009 states, "If manufacturers previously received a Class I ruling from Health Canada, but their software now falls into Class II (as defined above), a one-year transition period will be granted to the manufacturers in order to be able to meet all the regulatory requirements outlined under section 32(2) of the Medical Devices Regulations. This transition period is effective as of the date of this notice" (August 31, 2009).

According to an official of Health Canada contacted on this date, this transition applies only to software that has previously ruled as Class I. Software that has not been classified as Class I by Health Canada is subject to licensing immediately. There is no transition or grace period. Nor are there any grandfathering provisions for patient management software currently in use.

Compulsory Licensing for Patient Management Software

2009-10-05T12:47:00.001-04:00

Health Canada has recently issued a notice that patient management software is now considered a medical device and is subject to compulsory licensing. This notice will impact any developer and/or vendor of health care software in Canada. Patient management software can be categorized as a Class I or Class II device.

Any patient management software used only for archiving or viewing information or images, and not involved in the primary acquisition, manipulation and transfer of data, is considered a Class I medical device. Although Class I devices do not require a license, manufacturers, distributors and importers are required to obtain an establishment license.

Patient management software involved in data manipulation, data analysis, data editing, image generation, recording of measurements, graphing, flagging of results or performing calculations is considered a Class II medical device, as is any primary workstation that interfaces directly with a system (imaging or other type) by acquiring data and then sending data to an image generating, viewing or storage device. Prior to selling a device in Canada, manufacturers of Class II, III and IV devices must obtain a medical device license.

Click here for a copy of the notice. More information is available on the Health Canada website at the following URL: http://www.hc-sc.gc.ca/dhp-mps/md-im/index-eng.php.

ITAC Health is establishing a working group to help members address this new requirement. If you are interested in participating in the working group, please contact me at bseaton@itac.ca.

The ITAC Health Blog

2009-10-05T12:13:00.000-04:00

Welcome to the ITAC Health Blog. This blog has been setup to facilitate discussion and the dissemination of information to ITAC Members on issues of concern to the health information and communications technology (HICT) industry. More information about ITAC can be found on our website at www.itac.ca.