37 Offices in 18 Countries

mHealth:Regulation and How to AvoidPracticing Medicine on theWeb

Scott A. Edelstein, Esq.PartnerSquire Sanders

Karl M. Nobert, Esq.Of CounselSquire Sanders

2

mHealth Trends

• 81% of physicians have a smartphone1

• 45% of U.S. adults own smartphones

• 52% of smartphone owners have used their phone to look forhealth information

• 19% of smartphone owners have at least one health app on theirphone.2

• 13,000 health, medical and fitness apps

1. 2011 Manhattan Research

2. 2012 Pew Research Mobile Health Report

3

The Medical Device

Classification System

4

Medical Device Classification

• 3 Classes of Medical Devices

• Class I (low risk)

• Class II (medium risk)

• Class III (high risk and novel devices)

• Classes based on control levels

5

Risk Based Classification

1700+ Generic Devices

510(k) Exempt Class I Class II Class III

Very low Low (~782) Medium (~799) High (~119)

General Controls(may or may not beGMP exempt)

General Controls

PremarketNotification or 510(k)

General & SpecialControls

510(k) submission

General & SpecialControls

Premarket Approval

Level of Risk & Level of Regulatory Control

6

Examples

• Medical Device Classes:

–Class I–General Controls–Most exempt from premarketsubmission

»Class II»Special Controls»Premarket Notification [510(k)]

–Class III–Require Premarket Approval [PMA]

7

Device Classification

Class I – Low Risk Devices

- Registration and Listing

- Labeling

- Good Manufacturing Practices (QualitySystem Regulation)

- Medical Device Reporting

CONTINUED

8

What are General Controls?

• Basic authorities thatprovide FDA with themeans to regulate medicaldevices.

• Applies to all medicaldevices regardless ofclassification, are subjectto premarket andpostmarket regulatorycontrols.

- Establishmentregistration and devicelisting

- Premarket notification or510(k), if not exempt

- Labeling

- Misbranding

- Adulteration

- Quality Systems

- Records and Reports / -Medical Device Reporting(MDR)

9

Device Classification

Class II – Medium Risk Devices

• General Controls Plus Special Controls

- Performance Standards

- Post-Market Surveillance

- Patient Registries

- Guidelines

- Other Appropriate Actions

CONTINUED

10

What are Special Controls?

• PostmarketSurveillance Study

• Patient Registries

• Guidelines (e.g., GloveManual)

• MandatoryPerformance Standard

• Recommendations orOther Actions

• Special Labeling (e.g.,882.5970, CranialOrthosis)

• General controls alone areinsufficient to assure safety andeffectiveness of Class II devices

• Existing methods are available toprovide such assurances.

• Special controls may includespecial labeling requirements,mandatory performance standardsand postmarket surveillance.

• A few Class II devices are exempt

from the premarket notification.

11

Device Classification

Class III – High Risk Devices

- Life Sustaining

- Life Supporting

- Implants

- Unreasonable Risk Of Injury Or Illness

CONTINUED

12

FDA’s Regulation

of Mobile Medical Devices

and Smartphone Applications ("apps")

13

Statutory Authority

(h) The term "device" … means an instrument, apparatus,implement, machine, contrivance, implant, in vitro reagent, orother similar or related article, including any component, part, oraccessory, which is

(1) recognized in the official National Formulary, or the UnitedStates Pharmacopeia, or any supplement to them,

(2) intended for use in the diagnosis of disease or otherconditions, or in the cure, mitigation, treatment, or preventionof disease, in man or other animals, or

(3) intended to affect the structure or any function of the body ofman or other animals, and which does not achieve any of itsprincipal intended purposes through chemical action within or onthe body of man or other animals and which is not dependent uponbeing metabolized for the achievement of any of its principalintended purposes.

14

What is an “app”?

• A Mobile Application or “app” is:

a software program that runs on smartphones and

other mobile communications devices

Examples: apps to monitor caloric intake for healthy weight

maintenance, to allow doctors to view a patient's X-rays on

their mobile device

FDA intends to apply its regulatory requirements solely to asubset of mobile apps that it is calling mobile medical

applications or "mobile medical apps."

15

Apps that FDA Intends to Regulate

• Only those that meet the statutory definition of adevice; and either:

• are used as an accessory to a regulatedmedical device; or

• transform a mobile platform into a regulatedmedical device.

16

FDA’s Proposed Regulatory Approach

Mobile

Medical Apps

Other mobile apps thatmeet “device” definition

Not considered mobile apps

17

FDA’s Proposed Regulatory Approach

• Apps that FDA intends to regulate

• May be classified as class I (general controls), class II(special controls in addition to general controls), or classIII (premarket approval)

• Other Apps + Enforcement Discretion

• The Applicability of the Quality System Regulation

18

App Categories and Classifications

1) Displaying, storing or transmitting patient-specific medicaldevice data in its original format – An MDDS (21 CFR880.6310) (Class I)

2) Controlling the intended use, function, modes, or energysource of the connected medical device- An Accessory -Required to comply with the controls applicable to thatconnected device.

3) Transforming or making the mobile platform into aregulated medical device – Radiological Image Display (21CFR 892.2050) (Class II)

4) Creating alarms, recommendations or creating newinformation (data) by analyzing or interpreting medicaldevice data – Cardiac Monitoring Software (21 CFR 870.2300)

19

Examples of Regulated Apps

Reg. # Medical Device Class # Filing

868.1900 Calculator, Pulmonary FunctionInterpretation (Diagnostic)

II 510(k)

870.1110 Computer, Blood-Pressure II 510(k)

892.2010 Device, Digital Image Storage,Radiological

1 510(k)Exempt

870.2800 Electrocardiograph, Ambulatory,With Analysis Algorithm

II 510(k)

868.2377 Monitor, Apnea, Home Use II 510(k)

884.2660 Monitor, Ultrasonic, Fetal II 510(k)

878.4810 Over-The-Counter Powered LightBased Laser For Acne

II 510(k)

880.2700 Scale, Stand-On, Patient 1 510(k)Exempt

884.2900 Stethoscope, Fetal 1 510(k)Exempt

20

Examples of Recently FDA ReviewedMobile Medical Apps

21

FDA Cleared Mobile Medical App

ASTRA Picture Archiving Communications Systems(K111694) (Candelis, Inc.) (9/15/11)

• Device Description: ASTRA is a web-enabled software appthat provides image processing and viewing tools and access tostudies and reports from a Local Area Network, Wide AreaNetwork, remote workstation, personal computer, or an iPhone,or iPad via a Virtual Private Network connection.

• Intended Use: ASTRA is software image managementintended to receive, process, review, display, print and archivemedical images and data from imaging modalities (e.g., CR andDR).

22

FDA Cleared Mobile Medical App

Carestream PACS (K110919) (Carestream Health, Inc.)(10/20/11)

• Device Description / Intended Use: is an imagemanagement system whose intended use is to providecompletely scaleable local and wide area PACS solutions forhospital and related institutions/sites, which will archive,distribute, retrieve and display images and data from all hospital

modalities and information systems.

23

FDA Cleared Mobile Medical App

Mobile MIM PACS (K112930) (MIM Software, Inc.)(12/2/11)

• Device Description: In addition to SPECT, PET, CT, MRIfmodalities, Mobile MIM can be used for the viewing Mnd/or

display for diagnosis of X-ray and Ultrasound medical images.

• Intended Use: The Mobile MIM software program is used forthe viewing, registration, fusion, and/or display for diagnosis ofmedical images from the following modalities: SPECT, PET, CT,MRI, X-ray and Ultrasound.

24

Regulatory Collaboration

and Enforcement

25

Regulatory Collaboration

• Agency Cooperation

• FTC’s Broad Mandate- Publications:

• Report: “Mobile Apps for Kids: Current Privacy Disclosures are Disappointing”(Feb. 2012)

• Guidance Document: “Marketing Your Mobile App: Get It Right from the Start”(Aug 2012)

• Other Agencies with Potential Involvement

26

Regulatory Enforcement

• Potential FDA Enforcement Action

- Untitled and Warning Letters

- Failure to comply with the device regulations

- Unsupported labeling claims

• FTC Enforcement Action

- Deceptive Advertising

- Unsubstantiated Claims

- Financial Forfeiture

- Recent mHealth Examples

27

Pursuing Medicare / MedicaidReimbursement for Medical Devices

28

FDA / CMS Parallel Review Program

• A recently created joint-Agency program that

• allows for the simultaneous review for FDA medicaldevice clearance and Medicare reimbursement approval

• is designed to reduce the time between receiving FDAmarketing approval and a Medicare national coveragedetermination.

29

Candidates for Parallel Review

FDA and CMS have restricted this phase of parallel review forthose innovative medical devices that meet one of the followingcriteria:

• New technologies for which the applicant has had sufficient pre-investigational device exemption (“IDE”) interaction with FDA oran approved IDE application;

• New technologies for which an original or supplemental approvalor petition for de novo review would be required; or

• New technologies that fall within the scope of a Part A (inpatient)or Part B (outpatient) Medicare benefit category and are notsubject to the NCD.

30

Parallel Program Phases

• Nomination – The sponsor of an innovative therapeutic ordiagnostic device may nominate its device for participation in theparallel review program.

• FDA/CMS Review – FDA and CMS will meet to consider anomination within 30 days of receipt of nomination package.

• Notification of Acceptance – After the agencies’ meeting, theapplicant will be notified whether its device is an appropriatecandidate for the program.

• Acceptance Meeting – If the applicant is deemed to be anacceptable candidate, FDA and CMS will meet with the applicanteither in person or by telephone.

• FDA Review – Parallel review candidates will be reviewedaccording to the normal FDA review process.

• CMS NCD Review and Timing – CMS will beginits informal review process sometimeafter the submission of the PMA or de novo petition.

31

Regulatory Implications of

Using Apps for Telemedicine

Telemedicine

Telemedicine practitioners

Hospital Hub

33

Developing Areas in Telemedicine

• Licensure

• Reimbursement

• Confidentiality

• Liability

34

Interstate Practice of Medicine

• Statutes in several states specifically provide that furnishingtelemedicine services to a patient constitutes the practice ofmedicine in that state.

E.g., Oregon law requires a license for the practice of medicine across

state lines and defines the practice of medicine across state lines as:

– (1) The rendering directly to a person of a written or otherwisedocumented medical opinion concerning the diagnosis or treatment ofthat person located within this state for the purpose of patient care by aphysician located outside this state as a result of the transmission ofindividual patient data by electronic or other means from within thisstate to that physician or the physician's agent

35

Interstate Practice of Medicine (cont’d)

• Exceptions to general licensure requirement:

Consultation Exception

Emergencies

Special or Temporary Telemedicine License

Licensure by Endorsement

36

Consultation Exception

• Most states allow physicianslicensed in another state to provideconsultations to local physicians

• Scope of the exception varies bystate

No Statutory Exception

Narrow Exceptions

Broad Exceptions

Consultation Exceptions

38

Consultation Exception (cont’d)

• Exceptions can be grouped into 9 categories:

General Consultation Exception

Infrequent Consultation Exception

Prohibition of Local Office

Local Physician Responsibility

Local Physician Request

Primary vs. Secondary Requirements

Combination Exceptions

Unique Exceptions

Uncompensated Consultations

39

Consultation Exception (cont’d)

• Typical “general” consultation exception statute provides:

“The following persons under the following limitations may practice

medicine within the state without a license: (3) Any physician who is

licensed in another state or country and who is meeting a physician

licensed in this state, for purposes of consultation, provided such

practice is limited to such consultation[.]” N.Y. Educ. L. § 6526(3).

40

Special or Temporary Licenses

• 9 states issue special or temporary telemedicine licenses

Alabama

Arizona

Arkansas

California Colorado

Connecticut

Delaware

Florida

Georgia

Idaho

Illinois Indiana

Iowa

Kansas

Kentucky

Louisiana

Maine

Maryland

Massachusetts

Michigan

Minnesota

Mississippi

Missouri

Montana

NebraskaNevada

NewHampshire

New Jersey

New Mexico

New York

North Carolina

North

Dakota

Ohio

Oklahoma

Oregon

Pennsylvania

Rhode Island

SouthCarolina

SouthDakota

Tennessee

Texas

Utah

Vermont

Virginia

Washington

WestVirginia

Wisconsin

Wyoming

41

Licensure by Endorsement

• Many states provide for licensure of physicians who are licensedin another state

• Process typically requires:

Application

Payment of fee (typically around $200)

Verification of licensure from all other states where applicant is

licensed

Score reports from exams

Fingerprinting

Strategies for Interstate Practice

Strategy Pros/Cons

Using only physicians licensedin state where they will practice

Least efficient model, but lowestregulatory risk

Structuring arrangement to fitwithin some combination ofvarious consultation exceptions

Most efficient model. Allows foroperation in many, but not allstates.

Combination of all of the above Can allow for operation in allstates

43

Interstate Practice and Nurse Licensure

Interstate Nurse Licensure Compact Allows nurse licensed in any participating state to

practice without additional licensure in any other

participating state

Introduced in 1999

24 states now participate in the compact

Interstate Nurse Licensure Compact:Participating States

Alabama

Arizona

Arkansas

California Colorado

Connecticut

Delaware

Florida

Georgia

Idaho

Illinois Indiana

Iowa

Kansas

Kentucky

Louisiana

Maine

Maryland

Massachusetts

Michigan

Minnesota

Mississippi

Missouri

Montana

NebraskaNevada

NewHampshire

New Jersey

New Mexico

New York

North Carolina

North

Dakota

Ohio

Oklahoma

Oregon

Pennsylvania

Rhode Island

SouthCarolina

SouthDakota

Tennessee

Texas

Utah

Vermont

Virginia

Washington

WestVirginia

Wisconsin

Wyoming

45

Nurse Licensure: Non-Compact States

• Every state allows for licensure by endorsement, so long aslicensure requirements of applicant’s state are as stringent asrequirements in endorsing state

• Some states require nurses licensed by endorsement to completestate-specific continuing-education requirements

E.g., Florida requires completion of a course on Florida laws and

rules relating to the practice of nursing

46

Malpractice and General Liability

• Physician-patient relationship

• Standard of care

• Jurisdiction

• Choice of law

• Insurance coverage

• Recording encounters

47

Informed Consent

• Oral and written consent

• Translation

48

Requirements Related to PrescribingDrugs

Ryan Haight Online Pharmacy ConsumerProtection Act of 2008 (Pub. L. No. 110-425)

Prohibits online pharmacies from dispensing

controlled substances without a valid prescription

from a physician who has examined the purchaser

in person

49

Requirements Related to PrescribingDrugs

Many states require that a physician

physically examine a patient before

prescribing drugs for the patient (but not IL,

PA, NY, NV and a few others)

Every state prohibits “unprofessional

conduct”

Numerous state medical boards have issued

policies prohibiting prescriptions “based

solely on an on-line questionnaire or

consultation.”

Exceptions

50

Requirements Related to PrescribingDrugs

• Exceptions:

“Prescribing for a patient whom the physician has not personally

examined may be suitable under certain circumstances. These may

include, but not be limited to . . .prescribing for a patient of another

physician for whom the prescriber is taking call, or continuing

medication on a short-term basis for a new patient prior to the

patient’s first appointment. Established patients may not require a new

history and physical examination for each new prescription, depending

on good medical practice.” Alabama State Board of Medical

Examiners Rule 540-X-9-.11

51

Corporate Practice of MedicineRestrictions

• Many states prohibit lay corporations from practicing medicine

• In such states, physicians cannot be employed by a laycorporation

• Presents challenges for multi-state corporations

• Captive or “friendly” PC as a work-around

• 14 states allow for an exception to licensing rules to allowdoctors to practice telemedicine in certain circumstances

52

Captive PC Model

PC

Licensedpractioner

Telemedicine Company

ManagementAgrmt.

Stock TransferRestriction Agrmt.

Consulting Agrmt.

$

$

53

Medicare Reimbursement

OriginatingSite

(HPSA ornon-MSA)

Eligible Sites•Physician or practitioner office•Inpatient or outpatient hospital•Critical access hospital•Federally qualified health ctr.•Rural health clinic•Hospital-based or criticalaccess hospital ESRD•Skilled nursing facility•Community mental health ctr.

Distant Site

Eligible Providers•Physician•Nurse Practitioner•Physician Assistant•Nurse midwife•Clinical nurse specialist•Clinical psychologist•Clinical social worker•Registered dietitian

54

Medicare Eligible Medical Services

• Initial inpatient and follow-up inpatient consultations

• Subsequent hospital care services

• Subsequent nursing facility care services

• Office or other outpatient visits

• Individual psychotherapy

• Pharmacologic management

• Psychiatric diagnostic interview examination

• End stage renal disease related services

55

Medicare Eligible Medical Services (cont’d)

• Individual and group medical nutritional therapy

• Neurobehavioral status exam

• Individual and group health and behavior assessment andintervention

• Individual and group kidney disease education services

• Individual and group diabetes self-management training services

• Smoking cessation

56

CY 2013 Proposed Medicare EligibleServices

• Alcohol and/or substance abuse assessment and intervention

• Alcohol misuse screening and behavioral counseling

• Depression screening

• Behavioral counseling to prevent STIs

• Behavioral therapy for cardiovascular disease

• Behavioral counseling for obesity

57

Medicare Reimbursement

Conditions of Payment

• Telehealth provider reimbursed per Medicare fee schedule

• Telepresenter not required

• Facility fee for originating site (currently $24.24)

No Medicaid Reimbursement

Medicaid Reimbursement

Medicaid Reimbursement

59

Private Payor Reimbursement

• Slow adoption

• Only thirteen states have government mandated private payorreimbursement

60

Legal Issues

• Fraud and Abuse

Federal and state antikickback laws

OIG opinions (98-18, 99-14, 03-4)

61

Legal Issues

• Self-Referral Laws

Federal and state laws

• False Claims Act

• Civil Monetary Penalties

62

Data Privacy and Security

• HIPAA

• State laws

• EU Privacy Directive

• Other foreign data privacy laws

• FTC

Truth in advertising

Honor your privacy promises

Clear, easy-to-read on small screen

Revisions

• Voluntary Privacy Code of Conduct

Short-form notice

63

HIPAA Risks of Telemedicine

• Computerization enables storage of large amounts of data insmall spaces.

• Networked information is accessible from anywhere at any time.

• New databases and different types of data sets are more easilycreated.

• Information is easily gathered, exchanged and transmitted.

• HIPAA and OCR

OCR enforces HIPAA, and it clearly applies to thetransmission of protected health information by smartphones

The loss of a smartphone may trigger breach notificationrequirements

ONCHIT notes that mobile phones on the market meet nomore than 40% of the security requirements of HIPAA ormeaningful use Stage 2 standards; after manual configuration,compliance runs as high as 60%, according to some experts

64

State Data Breach Laws

• 40 states have enacted legislation requiring disclosure forsecurity breaches

• Legislation pending in 8 states

• Applies to businesses that maintain computerized data

• Requires written notification

• Personal information acquired by unauthorized person

6565

Mission Impossible?

66

Contact Information

Scott A. EdelsteinPartnerSquire Sanders (US) LLP1200 19th Street, NWWashington DC 20036scott.edelstein@squiresanders.com202.626.6602415.954.0205

Karl M. NobertOf CounselSquire Sanders (US) LLP1200 19th Street, NWWashington DC 20036karl.nobert@squiresanders.com202.626.6630