Three Years Later, FDA Finalizes Medical Device Data Systems Rule

This post was written by Catherine A. Hurley and Areta L. Kupchyk.

On February 15, 2011, the Food and Drug Administration (“FDA”) published a final rule reclassifying Medical Device Data Systems (“MDDS”) as Class I medical devices exempt from 510(k) premarket notification requirements. FDA defined MDDS as medical devices that are intended to transfer, store, convert from one format to another according to preset specifications, or display “medical device data.” FDA explicitly excluded electronic health record (“EHR”) and computerized physician order entry (“CPOE”) systems from the MDDS Final Rule. Because MDDS do not “provide new or unique algorithms or functions,” FDA concluded that general controls, such as the Quality System Regulations are sufficient to mitigate any risks associated with MDDS.

The final MDDS rule will become effective April 18, 2011. By May 18, 2011, all manufacturers of MDDS must register their establishments and list their MDDS products with FDA. No later than April 18, 2012, all manufacturers of MDDS must develop and implement procedures to ensure compliance with the QSRs and the Medical Device Reporting requirements. FDA does not intend to enforce design control requirements retroactively to any currently marketed device that is classified as “MDDS” under the final rule. However, FDA stated that it will enforce design control requirements for design changes made after the April 18, 2011 effective date to currently-marketed MDDS.

For more information, read our full alert.

HHS Announces First Ever Civil Money Penalty for Violations of HIPAA Privacy Rule

This post was written by Gina M. Cavalier.

Earlier today the Department of Health and Human Services' (HHS), Office for Civil Rights (OCR) announced the imposition of the first ever civil money penalty for violations of the HIPAA Privacy Rule. The penalty - which is $4.3 million - was assessed against Cignet Health of Prince Georges County, a health insurer. The underlying HIPAA violations include (1) failing to provide patients with access to their medical records, and (2) failing to cooperate with OCR's investigation into the failure to provide access. The HHS press release is available here.

To discuss this or any other HIPAA or data privacy/security issue, please contact Mark S. Melodia or Gina M. Cavalier.

"Sunshine in Litigation" Bill Introduced Again

Law360 is reporting that Rep. Jerrold Nadler (D-NY) is seeking to revive the 2009 "Sunshine in Litigation Act," a bill we covered previously.  H.R. 592 would turn around the Supreme Court's Seattle Times Co. v. Rhinehart, 467 U.S. 20, 33 (1984), which concluded that discovery materials are not public components of a civil trial.  As a result, litigation protective orders are permissible to protect the confidential and proprietary information of parties to civil litigation, at least until information produced in discovery is filed with the court or introduced into evidence for determination of a merits issue (such as on a motion for summary judgment or at trial.  These bills are introduced regularly, even though in 1996 the Federal Judicial Center confirmed there was no basis for the primary justification articulated by proponents of such measures, reporting that its "empirical study showed that the orders did not impact public safety or health. . . . The empirical data showed no evidence that protective orders create any significant problem of concealing information about public hazards."