FDA recently released guidance (“Manufacturers Sharing Patient-Specific Information from Medical Devices with Patients Upon Request”) finalizing its policy on medical device manufacturers sharing patient-specific information from devices with patients at the patients’ request.

In response to the more active roles patients are playing in their health care, and increased frequency with which patients are seeking information that has been recorded, processed or stored on medical devices from the device manufacturers, FDA initially sought to provide clarification on manufacturers’ responsibility with respect to such requests in a draft guidance issued June 10, 2016. In the draft guidance and the recently finalized version, FDA clarifies that a device manufacturer may provide patient-specific information to patients who request it, but that the manufacturer is not obligated to do so under the Food, Drug, and Cosmetic Act (the “Act”). Importantly however, FDA states that the device manufacturer’s responsibility to provide patient-specific information under the Act is distinct and separate from its obligation to provide patients with protected health information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”), and the HIPAA Privacy Rule.

For the purpose of this guidance, FDA defines “patient-specific information” as “information [that is] unique to an individual patient or unique to that patient’s treatment or diagnosis that has been recorded, stored, processed, retrieved, and/or derived from a legally marketed medical device.” Examples of such information include data on pulse oximetry, blood pressure, and blood glucose reading. Patient-specific information may further include, but is not limited to, the following categories of information:

  • Data a health care provider inputs in the device to record the status and ongoing treatment of an individual patient
  • Information stored by the device to record usage, alarms, or outputs
  • Patient-specific case logs entered into a medical device by a health care provider

Patient-specific information, however, does not include “any interpretations of data by the manufacturer,” except for interpreted data that is “normally reported by the device to the patient or the patient’s healthcare provider.” In addition to clarifying the scope of definition of patient-specific information as described above, FDA notes that patient-specific information will not be considered “labeling” as that term is defined within the Act, and a manufacturer will not be required to undergo additional premarket review by FDA in advance of sharing such information with the patient.

Further, although FDA requires all patient-specific information shared with patients to be “comprehensive and contemporary,” the manufacturer may format the information in such a way that would facilitate “usability by the patient.” Ultimately, however, FDA recommends that manufacturers advise patients to contact their health care providers when they have questions about their patient-specific information in order to provide “proper interpretation of and context to the patient-specific information.”

Finally, FDA acknowledges that there are circumstances in which it is not feasible for a manufacturer to share patient-specific information with patients. Such circumstances include when the device at issue was not designed to record or transmit the patient-specific information, or when the device records or retains information in a system that is not accessible to the manufacturer.

This guidance highlights FDA’s increasing interest in Digital Health issues. Further, the medical devices and technologies impacted by this guidance may have the capability to receive, transmit, and store patient-identifiable health information, which triggers a variety of FDA and other health care regulatory compliance issues, including, but not limited to, compliance with privacy, telemedicine, and fraud and abuse laws. Reed Smith’s cross-disciplinary Health Care Group is tracking the development of these technologies and is able to assist health care entities operating in this space.