Objectives DEVELOPMENTS IN EU MDD & IVDD SOFTWARE REGULATION Some brief remarks on data protection Current regulation of medical devices software Overview of EU medical devices directives revision process Axon seminar 16 October 2013 Erik Vollebregt www.axonlawyers.com EU political background ehealth Action Plan 2012 2020 Struggles with Lisbon competences ( EU action shall respect the responsibilities of the Member States for the definition of their health policy and for the organisation and delivery of health services and medical care. ) Pretty big changes in Health data protection Currently in flux with General Data Protection Regulation proposal Horizontal approach to all data causes excessive collateral damage in healthcare sector What we hate in marketing and social media, we actually want in healthcare (e.g. monitoring, profiling, further processing, traceability) Regulation of medicinal products and medical devices / IVDs Regulation of collection and processing of health data 1
General Data Protection Regulation Data protection as fundamental right EU approaches data protection from the angle of fundamental right this means less attention to pure internal market interests and more to data subject interests Definitions & scope Implementation of Art 29 WP opinions on scope ( singling out, unique identifiers, pseudomisation, reasonably likely means ) Consent requirements New disqualifiers: imbalance and consent to process data and necessary for execution of the contract Impact assessment Mandatory sign-off national authorities prior to processing but no methodology / standards and no deadlines Impact assessment for each individual instance of processing General Data Protection Regulation Privacy by design Prior approval of impact assessment of each act of processing Literally Parliament proposes that software and devices have to be designed and built as to enable GDPR and data subject s rights by default Intelligible explanation of automated processing logic Exemptions for processing of health data without consent With uncertainties around concept of consent derogations for public health and scientific purposes become crucial Exemptions not suited for outsourced processing in ehealth / mhealth services and not drafted for regulatory clinical data obligations Technical standards Commission can issue technical standards related to implementation of GDPR requirements General Data Protection Regulation Data subject s rights How to Right to correct, information, be forgotten and of erasure problematic in clinical context Right to request interoperable and open source format copy of processed data Company burden Mandatory privacy officer Large fines Many open ends still that are subject to implementation by implementing act or regulation by delegated act Commission is not obliged to use these powers and EU legislator may change the scope or revoke power, which increases uncertainty 2
Regulation of software as MD / IVD MEDDEV 2.1/6 on standalone software, currently under revision Differences in interpretation of what software constitutes a medical device New essential requirements for mobile computing platform EN 62304 standard FAQ by Team NB Lack of harmonised interoperability standards MEDDEV 2.1/6 medical devices simple version 1. Computer program? 2. Stand alone? 3. What action does it perform on data? [beyond storage, archival, lossless compression, simple search] 4. For benefit of individual patients? 5. Intended purpose in scope of MDD? 6. Accessory? MEDDEV 2.1/6 IVDs simple version 1. In scope MDD? 2. In scope IVDD? 3. Data obtained only from IVD? 4. Data obtained from medical device? 5. Accessory? 6. Accessory? How to 3
Proposal to redefine medical device Accessories New accessory definition Includes devices that assist Essential requirements Essential requirements and mobile computing platform New essential requirements re software in MDR 11.2. Devices shall be designed and manufactured in such a way as to remove or reduce as far as possible and appropriate: (e) the risk associated with the possible negative interaction between software and the environment within which it operates and interacts; 4
Software clinical IVDs: everything becomes a lot more complex 6.1. Pre-clinical and clinical data (b) detailed information regarding test design, complete test or study protocols, methods of data analysis, in addition to data summaries and test conclusions regarding: software verification and validation (describing the software design and development process and evidence of the validation of the software, as used in the finished device. This information should typically include the summary results of all verification, validation and testing performed both in-house and in a simulated or actual user environment prior to final release. It should also address all of the different hardware configurations and, where applicable, operating systems identified in the information supplied by the manufacturer); Conformity assessment Biggest changes because of implementation of GHTF classes A-D The existing modules established under the 'New Approach do not change see annexes VIII to X, however EC verification module was deleted The concept of batch testing has been clarified Recommendation on unannounced audits Requires manufacturers to amend agreement with NoBo to accommodate all aspects of unannounced audits (visa, security etc) Requires manufacturers to better manage agreements with Critical subcontractors Critical suppliers Critical suppliers and subcontractors must be able to accommodate an unannounced audits Manufacturers must Source: BSi integrate the quality system of critical subcontractors and of crucial suppliers with their quality system; control the quality of services provided and of components supplied and the quality of production thereof regardless of the length of the contractual chain between the manufacturer and the subcontractor or supplier. 5
IGZ enforcement 2013: 5 June: conference for software manufacturers held by Dutch Health Inspectorate (IGZ). As of 1 January 2014 IGZ will enforce medical devices law against medical software that they consider a medical device. August: IGZ starts collecting information from the market. Results will be published in December. 2 October: conference for users of software held by IGZ. IGZ announces to enforce against both manufacturers and users of software. Enforcement capacity expansion with 25 inspectors. Revision of enforcement policy. Scenarios 1. Request for enforcement - will be rejected if there is no violation or the violation can be legalized in foreseeable future 2. Enforcement based on enforcement strategy IGZ Step 1: Inspection and documentation Step 2: Receipt of warning or enforcement decision Elements enforcement decision: Name of offender Violation Amount of the fine or the imposition of a restore in previous condition sanction and the motivation thereof Possible grace period to end the violation Step 3: Execution of sanction Obligation to cooperate? Based on Article 5.16 and 5.20 of the General Administrative Law Act: yes, but think about it Switch from information gathering to enforcement mode Self-incrimination? Sensitive information such as trade secrets and proprietary information Cooperate, but also think about your response to IGZ and the information you provide because it may be used against you! Legal remedies Imposed sanctions must, among others, be proportionate to the gravity of the violation and the intended effect of the sanction Policy IGZ in Beleidsregels bestuurlijke boete Wet op de medische hulpmiddelen, will be amended in view of 1 January 2014 An enforcement decision or a decision to reject a request for enforcement can be challenged in: 1. Administrative appeal 2. Interim injunction 3. Appeal at District Court 4. Appeal at Administrative Supreme Court Beware of various 6-week non-extendable deadlines for appeal! 6
16-10- 13 THANKS FOR YOUR ATTENTION THANKS FOR YOUR ATTENTION Erik Vollebregt Axon Lawyers Piet Heinkade 183 1019 HC Amsterdam T +31 88 650 6500 F +31 88 650 6555 M +31 6 47 180 683 E erik.vollebregt@axonlawyers.com @meddevlegal B http://medicaldeviceslegal.com Sofie van der Meulen Axon Lawyers Piet Heinkade 183 1019 HC Amsterdam T +31 88 650 6500 F +31 88 650 6555 M +31 6 53 440 567 E sofie.vandermeulen@axonlawyers.com READ MY BLOG: http://medicaldeviceslegal.com Axon seminar 16 October 2013 www.axonlawyers.com Axon seminar 16 October 2013 www.axonlawyers.com Legal stuff The information in this presentation is provided for information purposes only. The information is not exhaustive. While every endeavour is made to ensure that the information is correct at the time of publication, the legal position may change as a result of matters including new legislative developments, new case law, local implementation variations or other developments. The information does not take into account the specifics of any person's position and may be wholly inappropriate for your particular circumstances. The information is not intended to be legal advice, cannot be relied on as legal advice and should not be a substitute for legal advice. 7