An RSS Feed from melniklegal.com

What is an FDA Guidance document and do Guidance documents bind the FDA?

Wed, 23 Oct 2013 20:33:57 EST

FDA Guidance sets forth the FDA's "current thinking on a topic and should be viewed only as recommendations, unless specific regulatory or statutory requirements are cited." As the FDA explains,

[The guidance] does not create or confer any rights for or on any person and does not operate to bind FDA or the public. You can use an alternative approach if the approach satisfies the requirements of the applicable statutes and regulations...FDA's guidance documents, including this guidance, do not establish legally enforceable responsibilities.

But, guidance documents should not be ignored because the FDA does tend to follow its own guidance.

What is the difference between laws, regulations, and guidance documents?

The FDA must follow a set of laws, which are passed by Congress, and the FDA routinely issues regulations and guidance documents.

Laws

One of the primary laws establishing the framework within which the FDA operates is the Federal Food, Drug, and Cosmetic Act (FD&C Act). The FD&C Act is amended by Congress from time to time. Some of the more significant amendments include the Orphan Drug Act of 1983, Food Quality Protection Act of 1996, and the FDA Food Safety Modernization Act of 2011.

Regulations

The FDA develops regulations based on the laws that are set forth in the FD&C Act as well as the other laws under which the FDA operates. Regulations issued by the FDA are federal laws and are codified in the Code of Federal Regulations.

When issuing regulations, the FDA follows the procedures set forth in the Administrative Procedure Act (APA). Broadly speaking, the APA sets for a Notice and Comment Rule Making process, which requires that regulatory agencies issue a proposed regulation, allow time for public input, and then issue a final regulation. More information about this process is available here (PDF, Federal Register FAQ), here (Center for Effective Government), and here (LSU Public Health Map).

Guidance Documents

After a regulation is issued, the FDA may determine that it needs to provide industry, academia, and other stakeholders with more information on how the FDA intends to exert (or decline to exercise, as the case may be) its regulatory authority. The FDA does this through issuing what it has termed 'Guidance' documents. The FDA follows the procedures required by its "Good Guidance Practice" regulation to issue FDA guidance.

Guidance documents must not set new legal standards or impose new requirements. Unlike regulations, guidance documents do not contain amendments to the Code of Federal Regulations and are not subject to the notice and comment process.

Are FDA Guidance Document Law?

No. The FDA guidance documents are not legally binding on the public or the FDA. BUT, the FDA has come to rely on guidance documents as a means of informal policy making. By telling industries when it does and does not plan to act, the FDA is giving industry stakeholders notice of its position on certain issues (e.g., how the FDA intends to treat mobile medical apps). As a result, impacted industries would be wise to take heed and pay attention to the guidance documents. So, for practical purposes, FDA guidance documents are laws.

Do Guidance documents bind the FDA?

In other words, can the FDA base its legal action against a company on an FDA Guidance document or can a company use an FDA Guidance document in its own defense?

This is a complicated question due to several cases that were decided by the U.S. Supreme Court: (1) Christensen v. Harris County, 529 U.S. 576 (2000); (2) United States v. Mead Corporation, 533 U.S. 218 (2001), and (3) Barnhart v. Walton, 535 U.S. 212 (2002). For a good summary of these case and the current standing, see the article reference below by Kevin Michael Lewis.

For more on the FDA and why it issues guidance documents, please see:

Erica Seiguer & John J. Smith, Perception and Process at the Food and Drug Administration: Obligations and Tradeoffs in Rules and Guidances, Food and Drug Law Journal (2005)

Kevin Michael Lewis, Informal Guidance and the FDA, Harvard Law School Student Papers (2011)

And the Data Breach Train Keeps Rolling

Tue, 15 Oct 2013 20:13:04 EST

In the last few days, two hospitals have announced data breaches involving protected health information.

The first data breach incident, announced on October 1, 2013, involved St. Mary's Janesville Hospital, a 50-bed facility serving residents of Rock County Wisconsin.

According the press release posted on the facility's website:

Circumstances: Laptop was stolen from an employee's car
Incident date: August 26 or 27, 2013
When discovered (by hospital): August 27, 2013
How discovered: Presumably when employee notified hospital
Patient notification date: September 30, 2013
Public notice date: October 1, 2013

Number of patients' impacted: 629
When/where patients' received treatment: Patients who were treated in the emergency department of St. Mary's Janesville Hospital between January 1, 2013 and August 26, 2013
Stolen information included: May have included patient name, date of birth, medical record and account numbers, provider and department of service, bed and room number, date and time of service, visit history, complaint, diagnosis, procedures, test results, vaccines, if administered, and medications. The laptop did not contain any Social Security numbers, addresses, credit card numbers, or financial information of any kind.

St. Mary's advised in its press release that the hospital "inspected all laptops to ensure they all have encryption software" and that the hospital "will actively be monitoring consistency of laptop encryption and conducting monthly audits to ensure compliance with [the hospital's] encryption policies." But, given this public notice and the notification to patients, it appears that the stolen laptop was either not encrypted or that the PHI was stored in the unencrypted portion of the laptop.

St. Mary's has partnered with ID Experts to provide the impacted patients with identity theft monitoring services for one year.

The second data breach incident was announced on October 2, 2013 by UnityPoint Health, a healthcare system providing services throughout Iowa and Illinois. According to the UnityPoint's press release (which appears to have been released to the media, but which could not be located on the system's website at https://unitypoint.org):

Circumstances: UnityPoint's electronic medical record (EMR) system was accessed by an unauthorized individual using the login details from authorized individuals
Incident date: Records accessed over a period from February 2013 - August 2013
When discovered (by hospital): On or around August 8, 2013
How discovered: Incident discovered during a "regular audit", when "UnityPoint detected a pattern of unusual access to certain patient data in its hospital EMR system"
Patient notification date: Sometime on or before October 2, 2013
Public notice date: October 2, 2013
Number of patients' impacted: 1,800

When/where patients' received treatment: Patients treated at UnityPoint Health system offices/locations anytime prior to when UnityPoint "shut off the unauthorized access by forcing a password reset"

Stolen information included: Names, home addresses, dates of birth, medical and health insurance account numbers, and health information related to patient treatment. For less than ten percent of impacted patients, patient Social Security number and/or Driver�s License number may have been viewed. For four impacted patients, the unauthorized user also accessed information about the patients� financially responsible party.

UnityPoint is offering credit monitoring services to the impacted individuals.

Materials

Press Release from UnityPoint Health (retrieved from the Sioux City Journal here)
Press Release from St. Mary's Janesville Hospital

FTC Takes a Closer Look at Competition in Healthcare

Mon, 05 May 2014 12:26:33 EST

The FTC has become increasingly interested in the competition in the healthcare sector. The FTC held a workshop on March 20 and 21, 2014 to more closely examine fives areas related to healthcare competition that are of interest to the Commission. As previously described by the FTC, these issues included:

1) Professional regulation of health care providers - The FTC has long been interested in the professional regulation of health care providers. The workshop will bring together experts to discuss developments relating to accreditation, credentialing, licensure, and scope of practice, and the ways in which these regulatory tools may affect competition and consumers.

2) Innovations in health care delivery - In recent years, several new models for health care delivery have emerged, including retail clinics and telemedicine. Some of these models may offer significant cost savings while maintaining, or even improving, quality of care. These models may also increase the supply of health care services, which may expand consumer access to care. The FTC intends to consider the potential benefits of these new health care delivery models, as well as the impact of regulatory frameworks on their development.

3) Advancements in health care technology - The FTC intends to explore the potential competitive implications of recent advances in health care technology, such as electronic health care records, health data exchanges, technology platforms for health care payers and providers, and certain other consumer-oriented technological advances.

4) Measuring and assessing quality of health care - The FTC intends to examine how recent developments in measuring and assessing health quality may impact competition and health care choices made by providers, consumers, and others.

5) Price transparency of health care services - Improved price transparency, often in conjunction with quality information, may help consumers and others understand the actual costs of health care services, and may help to control costs. Some forms of price transparency, however, may facilitate price coordination among health care providers, thereby dampening competition. The FTC intends to explore the competitive implications of recent efforts to make price information more transparent to patients, providers, employers, payers, and other health care decision-makers.

The workshop was recorded. The materials are available here: https://www.ftc.gov/news-events/events-calendar/2014/03/examining-health-care-competition (scroll down to the Event Details section).

The FTC also announced on May 5, 2014 that it was extending the comment period to May 16, 2014.

-------------------------
See Press Release, FTC Extends Public Comment Period for Healthcare Competition Workshop Through May 16, 2014, FTC (May 5, 2014), available at https://www.ftc.gov/news-events/press-releases/2014/05/ftc-extends-public-comment-period-healthcare-competition-workshop?utm_source=govdelivery.

See Press Release, FTC to Host Public Workshop Examining U.S. Health Care Competition (Feb. 14, 2014), available at https://www.ftc.gov/news-events/press-releases/2014/02/ftc-host-public-workshop-examining-us-health-care-competition.

FTC, Events Calendar: Examining Health Care Competition, https://www.ftc.gov/news-events/events-calendar/2014/03/examining-health-care-competition (last visited May 5, 2014).

-------------------------
Posted by Tatiana Melnik May 5, 2014.

IBM and the EEOC Experiment with BYOD

Sun, 13 Oct 2013 22:11:49 EST

Many companies are moving to a BYOD system. And the move is understandable given anticipated employee efficiency and productivity increases as well as cost savings for employers. On the other hand, companies also need to be aware of the problems that can arise when moving to a BYOD environment, including employee push back and increased security concerns.

BYOD Can Garner Cost Savings - A BYOD Case Study

In 2012, the U.S. Equal Employment Opportunity Commission (EEOC) undertook a BYOD pilot, during which the EEOC was able to significantly reduce the information technology budget for BlackBerry mobile devices. The EEOC explained,

Last year [2011], the EEOC was paying $800,000 for its Government issued BlackBerry devices. Subsequently, the EEOC�s FY2012 IT budget was cut from $17.6 million to $15 million, nearly a 15% reduction. The EEOC�s Chief Information Officer, Kimberly Hancher, significantly reduced contractor services, eliminated some software maintenance, and slashed the agency�s budget for mobile devices -- leaving only $400,000 allocated for Fiscal Year 2012. . . . [As a result of several cost saving measures discussed below,] FY 2012 costs were reduced by roughly $240,000[.]

Importantly, before implementing changes, the EEOC evaluated use of existing devices. Specifically, the EEOC found that,

75% of our users never made phone calls from their BlackBerrys � Email is the killer app. They either used the phone on their desk or they used their personal cell phone to make calls because it�s just easier. We also found there were a number of zero-use devices. People have them parked in their desk drawer, and the only time they use it is when they travel.

After evaluating the existing environment, the EEOC was able to form a plan to implement several cost saving measures, including pressing their "wireless carrier, a GSA Networx contract provider, to help cut costs or risk losing the EEOC�s BlackBerry business." The EEOC also eliminated zero-use devices and moved the remaining BlackBerry devices to a bundled rate plan with shared minutes.

But, moving to a BYOD environment can also be problematic. While employees desire to use their own devices, they may also push back on a company's efforts to monitor and track the devices. Moreover, as IBM learned in its implementation, employees must be trained on best practices to protect their devices and avoid security pitfalls.

IBM Experiments with BYOD

IBM is a sophisticated technology company whose storied history of innovation dates back to 1880. IBM holds more patents than any other U.S. based IT company and has lead the list of top patent recipients for 19 consecutive years. Yet, when IBM adopted a BYOD policy in 2010, similar to other companies, it too encountered technology challenges

In an interview with the MIT Technology Review in 2012, Jeanette Horan, IBM's Chief Technology Officer, reported that her IT department was bogged down with security issues brought about by employees using certain apps (e.g., Dropbox), forwarding internal e-mail to public e-mail services, and creating open Wi-Fi hotspots with their mobile devices.

According to the MIT Technology Review, Horan's team "surveyed several hundred employees using mobile devices, [and found that] many were 'blissfully unaware' of what popular apps could be security risks." In general, her team "found a tremendous lack of awareness as to what constitutes a risk."

Given the lack of awareness among IBM employees of security risks associated with mobile apps and time spent addressing these concerns, "[t]he trend toward employee-owned devices isn�t saving IBM any money . . . Instead, [Horan] says, it has created new challenges for her department of 5,000 people, because employees� devices are full of software that IBM doesn�t control."

BYOD Is Not For Everyone

It is important for companies to recognize that a bring your own device approach is not appropriate for every company. True, IBM, the EEOC, and many other organizations have managed to make BYOD work for them. But, that does not mean that this approach is the best approach for every organization. As is clear from IBM's experience, companies may not see an immediate cost savings from moving to a BYOD environment. On the other hand, companies could realize immediate cost savings by eliminating zero-use devices as did the EEOC.

Resources and Supporting Materials

White House Digital Government - Bring Your Own Device - A Toolkit to Support Federal Agencies Implementing Bring Your Own Device (BYOD) Programs (August 23, 2012)

Includes three BYOD Case Studies:

Alcohol and Tobacco Tax and Trade Bureau (TTB) Virtual Desktop Implementation
U.S. Equal Employment Opportunity Commission (EEOC) BYOD Pilot
State of Delaware BYOD Program

Includes Sample Policies

Sample #1: Policy and Guidelines for Government-Provided Mobile Device Usage
Sample #2: Bring Your Own Device � Policy and Rules of Behavior
Sample #3: Mobile Information Technology Device Policy
Sample #4: Wireless Communication Reimbursement Program
Sample #5: Portable Wireless Network Access Device Policy
**Disclaimer - inclusion does not constitute endorsement or approval.

https://www.whitehouse.gov/digitalgov/bring-your-own-device or PDF copy

Brian Bergstein, IBM Faces the Perils of "Bring Your Own Device": After letting its employees use their own phones and tablets for work, the company confronted a flood of insecure apps from the open Web, MIT Technology Review (May 21, 2012).

IBM Press Release, IBM Breaks U.S. Patent Record; Tops Patent List for 19th Consecutive Year: IBM inventors received more than 6,000 patents in 2011. Jan 11. 2012.

When Looking at Security, Consider Every Device

Sat, 28 Mar 2015 20:49:09 EST

Internet of Things to Complicate Compliance.

When evaluating security, organizations must evaluate every device that is connected to the Internet, whether directly or through the company's network. This includes everything from radiology software systems, to VPNs, to video conferencing equipment, to printers and faxes. The more devices that are connected, the more difficult this process becomes. The move to the Internet of Things is sure to exacerbate this problem as organizations have that many more devices to monitor and control. Healthcare providers should take steps to prepare now by enrolling their devices into device management programs, taking stock of devices that are owned by the company or owned by employees but used for company purposes (e.g., smartphones, tablets, etc.), and implementing processes to receive and address security incident warnings from those outside of an organization, who may not be business associates.

In February 2014, the SANS Institute, with support from Norse, published a report summarizing findings from a year-long analysis of cybersecurity threats in the healthcare industry. The amount of data collected was specific to the healthcare industry:

During the sample period [(September 2012 and October 2013)], the Norse threat intelligence infrastructure�a global network of sensors and honeypots that process and analyze over 100 terabytes of traffic daily�gathered data. The intelligence data collected for this sample included:
49,917 unique malicious events
723 unique malicious source IP addresses
375 U.S.-based compromised health care-related organizations [1]

The organizations that were compromised varied in size and financial resources:

About a third of the organizations represent small providers, while the rest represented clearinghouses, health plans, pharmaceutical companies and other types of medical organizations. Some of these providers were also quite large, with renowned research centers and teaching hospitals among the sources sending out the malicious packets. [2]

Interestingly, while most of the largest data breaches reported to the HHS Office of Civil Rights to date involved business associates, SANS found that a large percentage of the malicious IP traffic emanated from healthcare providers, with covered entities accounting for 78.6% of the compromised organizations:

Health care providers�72.0% of malicious traffic
Health care business associates�9.9% of malicious traffic
Health plans�6.1% of malicious traffic
Health care clearinghouses�0.5% of malicious traffic
Pharmaceutical�2.9% of malicious traffic
Other related health care entities�8.5% of malicious traffic [3]

Most strikingly, SANS noted:

Many of the organizations were compromised and, therefore, out of compliance for
months, and some for the duration of the study�meaning they never detected their compromises or outbound malicious communications, nor did they acknowledge warnings from the Norse response team.[4]

While it seems surprising that any organization would ignore a direct notice of an on-going security compromise, particularly an organization trusted with sensitive healthcare data, it is not unheard of (see e.g., the pending FTC case against LabMD, which was allegedly brought to the FTC by a security firm, and the FTC settlement with HTC America, where the FTC alleged that HTC ignored vulnerability reports from security experts [5]). But, as we continue to see data breaches in the healthcare space as well as healthcare providers becoming the victims of cyberattacks�such as the attacks against each of Anthem Inc. and Premera Blue Cross�healthcare providers will need to implement stronger policies and procedures to ensure that security warnings are not ignored.

These monitoring programs must include all systems and devices on the organizations' infrastructure. In its analysis, SANS evaluated the types of systems and devices emanating malicious traffic and found a wide variety of systems and edge devices. See Figure 1 below[6]. Many of these devices�particularly network-connected edge devices such as printers, faxes, web cameras, and video conferencing systems are often overlooked as the source of security vulnerabilities, despite being recognized as potential entry points for hackers and cybercriminals.[7]

Specifically:

Connected medical endpoints. The findings of this study indicate that 7 percent of traffic was coming from radiology imaging software, another 7 percent of malicious traffic originated from video conferencing systems, and another 3 percent came from digital video systems that are most likely used for consults and remote procedures. . . .

Internet-facing personal health data. The study shows 8 percent of malicious
traffic was emitted through a web-based call center website, backed by a VoIP PBX,
in use by a medical supply company. Also we found indications of a compromised
personal health record (PHR) system. . . .

Security systems and edge devices. In this study, most of the malicious traffic passed through or was transmitted from VPN applications and devices (33 percent), whereas 16 percent was sent by firewalls, 7 percent was sent from routers and 3 percent was sent from enterprise network controllers (ENCs). This indicates that the security devices and applications themselves were either compromised, which is a common tactic among malware families, or that these �protection� systems are not detecting malicious traffic coming from the network endpoints inside the protected perimeter�inside the firewall or behind the VPN concentrator. . . . [8]

When evaluating security, organizations must take a broad look at their environment and consider any network-connected device a potential source of a security vulnerability.

-------------------------------------

[1] Barbara Filkins, Health Care Cyberthreat Report: Widespread Compromises Detected, Compliance Nightmare on Horizon, SANS Institute Whitepaper, 3, Feb. 2014.

[2] Id.

[3] Id.

[4] Id.

[5] LabMD Inc. v. Tiversa Holding Corp. et al., Case No. 2:15-cv-00092, U.S. District Court for the Western District of Pennsylvania (Jan. 21, 2015); Press Release, Federal Trade Commission, HTC America Settles FTC Charges It Failed to Secure Millions of Mobile Devices Shipped to Consumers: Company Required to Patch Vulnerabilities on Smartphones and Tablets, Feb. 22, 2013, https://www.ftc.gov/news-events/press-releases/2013/02/htc-america-settles-ftc-charges-it-failed-secure-millions-mobile.

[6] Filkins, supra note 1, at 8.

[7] Nicole Perlroth, Cameras May Open Up the Board Room to Hackers, NYTimes.com, Jan. 22, 2013, https://www.nytimes.com/2012/01/23/technology/flaws-in-videoconferencing-systems-put-boardrooms-at-risk.html

[8] Filkins, supra note 1, at 7.

-------------------------------------

Posted by Tatiana Melnik on March 28, 2015