Wearable Computing Technologies and Regulations

Transcription

1 Wearable Computing Technologies and Regulations Anura Fernando Principal Engineer, Underwriters Laboratories (UL) Wearables TechCon - March 10, UL LLC Copyright 2015 UL LLC All rights reserved

2 Anura S Fernando Anura S. Fernando is UL s Principal Engineer for Medical Software & Systems Interoperability. Background: Degrees in Electrical Engineering, Biology/Chemistry, and Software Engineering 17 years experience at UL with safety critical software and control systems certification; as well as research across many industries process automation, alternative energy, medical, hazardous locations, appliances, optical radiation, nanotechnology, battery technologies, etc. Research and publications in Predictive Modeling and Risk Analysis, Cybersecurity, Systems of Systems, Software, Health IT, Apps, and Medical Device safety. Projects with numerous Fortune 500 companies, DoD, DoE, DHS, FDA, FCC, ONC, NASA and several U.S. National Laboratories Additional experience relevant for this discussion/audience: Contributed to the development of several standards involving software and Functional Safety as a member in IEC, ISO, ASME committees and Expert Task Force member. UL lead for the development of the AAMI/UL 2800 family of ehealth standards for interoperable medical device interface safety. Member of the Federal Advisory Committee FDASIA WG to the Health IT Policy Committee, FDA Medical Device Interoperability Coordinating Council, Medical Device Interoperability Safety Working Group, Health Information Management Systems Society, Association for the Advancement of Medical Instrumentation, and the International Council on Systems Engineering

3 Three Key Points for WT Developers Understand use cases Manage risk and address safety concerns with wearables Use standards strategically for market access and to address regulatory concerns

4 It used to be that people had to go inside the computers to use them Slide 4

5 now computers can go inside people Slide 5

6 Wearable computing technologies are pervasive Slide 6

7 with many sensors creating many possibilities Accelerometer Gyroscope Magnetometer Barometer Proximity Touch screen GPS WiFi Bluetooth GSM/CDMA Cell NFC Camera Light sensor

8 In a microbiome of wearable sensors

9 we can become the quantified self Slide 9

10 Combining wearables with network technologies Slide 10

11 we can become the ubiquitous self Slide 11

12 All this data can also improve healthcare delivery Slide 12

13 Using big data for customized or remote care 13

14 Wireless Devices FCC or FDA or both? Usage of the MHz frequencies are restricted to indoor operation at health-care facilities and are subject to registration and site approval by coordinators to protect aeronautical telemetry primary usage. Operation in the MHz band is not subject to registration or coordination and may be used in all areas including residential. ALL cell phones must meet the FCC s RF exposure standard, which is set at a level well below that at which laboratory testing indicates, and medical and biological experts generally agree, adverse health effects could occur. 14

15 Consumer product or medical device? A medical device 1 is "an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article, including a component part, or accessory which is: recognized in the official National Formulary, or the United States Pharmacopoeia, or any supplement to them, intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man or other animals, or intended to affect the structure or any function of the body of man or other animals, and which does not achieve any of its primary intended purposes through chemical action within or on the body of man or other animals and which is not dependent upon being metabolized for the achievement of any of its primary intended purposes." 15

16 Labeling can make all the difference Treat Obesity vs. Manage Weight esitydevices/ucm htm 16

17 The struggle to characterize relative risk Proposed in 2015 draft guidance on low risk general wellness devices Whether a device is low risk for purposes of this guidance is determined by whether or not the product: 1) is invasive; 2) involves an intervention or technology that may pose a risk to a user s safety if device controls are not applied, such as risks from lasers, radiation exposure, or implants; 3) raises novel questions of usability; or 4) raises questions of biocompatibility. 17

18 UL participates with government agencies to establish perspectives on risk FDA Safety and Innovation Act (FDASIA WG) ds/ehr.jpg

19 So, what is risk? Slide 19

20 Risk comes in many forms Slide 20

21 Risk defined in general terms The ISO (2009) /ISO Guide 73:2002 definition of risk is: the effect of uncertainty on objectives Uncertainty: The lack of complete certainty, that is, the existence of more than one possibility. The "true" outcome/state/result/value is not known. Measurement of uncertainty: A set of probabilities assigned to a set of possibilities. Example: "There is a 60% chance this market will double in five years" Risk: A state of uncertainty where some of the possibilities involve a loss, catastrophe, or other undesirable outcome. Measurement of risk: A set of possibilities each with quantified probabilities and quantified losses. Example: "There is a 40% chance the proposed oil well will be dry with a loss of $12 million in exploratory drilling costs". Douglas Hubbard "The Failure of Risk Management: Why It's Broken and How to Fix It, John Wiley & Sons, Slide 21

22 Analyzing Risk: Hazard Based Safety Engineering or Data or Process 22

23 Analysis Drives UL s Safety Testing and Certification Hazardous Energy Source or Data HBSE Premise Transfer Mechanism Susceptible Part or Process HBSE Process IDENTIFY ENERGY SOURCE IS SOURCE HAZARDOUS? No HBSE Standard Injury Fault Tree INJURY Yes IDENTIFY MEANS BY WHICH ENERGY CAN BE TRANSFERRED TO A BODY PART AND DESIGN SAFEGUARD WHICH WILL PREVENT ENERGY TRANSFER TO A BODY PART HAZARDOUS ENERGY ENERGY TRANSFER BODILY EXPOSURE MEASURE SAFEGUARD EFFECTIVENESS AND AND (EVENT) (EVENT) INADEQUATE EQUIPMENT SAFEGUARD INADEQUATE EQUIPMENT SAFEGUARD INADEQUATE PERSONAL SAFEGUARD INADEQUATE PERSONAL AVOIDANCE No IS SAFEGUARD EFFECTIVE? Yes OR OR OR OR OR OR DONE EQUIPMENT SAFEGUARD FAILURE NO EQUIPMENT SAFEGUARD EQUIPMENT SAFEGUARD FAILURE NO EQUIPMENT SAFEGUARD PERSONAL SAFEGUARD FAILURE NO PERSONAL SAFEGUARD AVOIDANCE NOT POSSIBLE AVOIDANCE NOT ATTEMPTED Slide 23

24 Applying HBSE to Wearable Technologies HBSE Premise Hazardous Energy Source or Data Transfer Mechanism Susceptible Part or Process Are there any hazards? 24

25 We can see some wearable technology risks Optical Radiation (LASER, UV, etc ) Privacy, Security, Performance if used by Dr (Cryptographic verification, HIPAA) Acoustic Energy Data Integrity, Usability 25

26 Where is all this data stored? Is it secure? Is it correct? Slide 26

27 What could go wrong? What happens if bits of my diagnostic image data get lost? What happens if my prescription data gets corrupted? What happens if my surgeon gets someone else s record? 27

28 What if my wearable interacts with health IT systems? Acme Insurance WWW

29 Are there new risks to consider? Acme Insurance WWW 29

30 Risks With Safety-Related Exchange?

31 Incorrect Information Exchange EXAMPLE: Single Event Upset or Data Corruption X 31

32 Information Not Provided EXAMPLE: No Data 32

33 Incorrect Timing of Information EXAMPLE: Information provided when app is inactive

34 Premature Termination EXAMPLE: Dropped Signal 34

35 Regulators are balancing risk and innovation FCC Requirements for MBAN and FDA MOU 24 May 2012 FDA Guidance: RF Wireless Technology 13 Aug 2013 FDA Guidance for Home Use Devices 24 Nov 2014 FDA Draft Guidance: General Wellness (Low Risk) 20 Jan 2015 FDA Guidance: Mobile Medical Applications 25 Sept 2013 EC Guidance Document Qualification and Classification of stand alone software (MEDDEV 2.1/6) Jan 2012 FDA Final Rule: MDDS 15 Feb 2011 FDA Guidance: Medical Device Data Systems, Medical Image Storage Devices, and Medical Image Communications Devices 9 Jan 2015 FDA Guidance: Management of Cybersecurity 2 Oct 2014

36 and continually evolving Regulatory Science FDASIA Health IT Report Proposed Strategy and Recommendations for a Risk-Based Framework Apr 2014 FDA Draft Guidance: Applying Human Factors and Usability Engineering to Optimize Medical Device Design 22 June 2011 IMDRF Document: Software as a Medical Device : Possible Framework for Risk Categorization and Corresponding Considerations 18 Sep 2014

37 Regulations - weighing benefits and risks Use Product Enabling Technologies 37

38 UL can provide standards-based testing and certification to address hazards at all levels Use Hazards Safety & Effectiveness (e.g. interoperability, performance, reliability, co-existence, usability, biocompatibility, satisfying claims) Data Hazards Acquisition, Storage, Propagation (e.g. Integrity, Security, Accuracy, Precision, Protocol Compliance) Energy Hazards Kinetic and Potential (e.g. electricity, batteries, optical radiation, ionizing radiation, RF emissions, acoustic, pinch-points, etc ) Assurance Cases, Safety Certifications, Certificates of Conformance, Product Marks 38

39 Testing to Support Safety Claims Modified from:

40 Testing to Support Security Claims Cryptographic Verification ))))))) 40

41 Assurance cases can help support safety claims Slide 41

42 Standards Can Help Guide Assurance Cases Safety Standards Slide 42

43 Regulators Leverage Standards Aug 6, 2013 FDA Recognized Consensus Standards Support Interoperability: There are 25 new standards grouped mainly into three categories: 1. Managing risk in a connected and networked environment; 2. Nomenclature, frameworks and medical device specific communications, including system and software lifecycle process; 3. Cybersecurity standards from the industrial control systems arena that are relevant to medical devices. Coming soon: AAMI / UL 2800 interoperable medical device interface safety

44 Technology is enabling rapid product innovation and new safety standards and regulations are emerging IDEA PRODUCT & SERVICE Managing innovation and regulatory change 44

45 Different kinds of wearables bring different risks Created by Beecham Research in Partnership with Wearable Technologies Group Slide 45

46 Plan early to avoid unintended consequences Mars Climate Orbiter - Mismatched units Ariane 5 Floating point value too large to be represented by signed integer Therac unlikely sequence of keystrokes - Integrated re-used sw into incompatible hardware (no interlocks) - Improper V&V no pre-release integration testing Slide 46

47 Ask yourself some questions Is there optical radiation? Do I need to worry about security / HIPAA? Do I need to worry about acoustic energy? Are there usability related hazards? 47

48 and ask yourself some more questions Can this cause skin irritation? Are surface temperatures ok? Do I use Lithium Ion Batteries? How do I deal with shipping and storage? How do I assess and control quality and stability of materials? How do I deal with cleaning, reprocessing, sterilization? And there are many more questions to consider Slide 48

49 Please let us know if you need help. Thank you! ehealth 49