Interoperability and User-Friendliness Key to the Future of Health IT

Interoperability and User-Friendliness Key to the Future of Health IT

Interoperability, interoperability, interoperability. During the AdvaMed 2012 medtech conference in early October, a panel discussing the impact of health information technology (IT) regulations on the industry focused on the significance of interoperability in healthcare IT.

Convened to discuss the future of health IT were Shami Feinglass, M.D., (the moderator), a former regulator and lobbyist, now vice president of global medical affairs and regulatory policy at Zimmer Holdings Inc.; Patricia Katzman, director of interoperability and clinical decision support for Philips Healthcare’s patient care and clinical informatics business; Anna McCollister-Slipp, co-founder of Galileo Analytics, member of an advisory board to the Center for Devices and Radiological Health within the U.S. Food and Drug Administration (FDA), and patient advocate; and Robert Jarrin, senior director of government affairs at Qualcomm Inc.

According to the Office of the National Coordinator (ONC) for Health IT, a division within the U.S. Department of Health and Human Services, health IT makes it possible for healthcare providers to better manage patient care through secure use and sharing of health information. Health IT includes the use of electronic health records (EHRs) instead of paper medical records to maintain people’s health data.

McCollister-Slipp began the conversation by describing her personal experience with Type I diabetes, which she has been living with for 27 years. At any given time, she could have up to four different devices on her physically tracking glucose and other substance levels in her blood, and other devices relating to various complications with the disease. Advocating for more patient empowerment, McCollister-Slipp insisted that data, whether it be EHRs or real-time monitoring information, should be more freely available to patients.

“There is so much patronization of patients,” McCollister-Slipp said. “There is the attitude that they will be overwhelmed and unable to understand [data]. I don’t know anything about cars, but if I have to spend $60,000 on one, I will engage, learn, and make the right decision. Patients learn and patients care in the same way.”

She recalled “e-patient Dave.” David deBronkart was diagnosed in January 2007 with stage IV, grade 4 renal cell carcinoma (kidney cancer) at a very late stage. His median survival time at diagnosis was just 24 weeks. Now a cancer survivor and motivational speaker, he often displays 3-D images of his tumor at speaking engagements, visually explaining how it began, how it shrunk, and its characteristics.

“He saw and understood the cancer, and that was very important for him to get his head around the disease,” explained McCollister-Slipp.

But, as an audience member asked, interoperability with what? There has to be a backbone on which the data rests. Who will build, own, and regulate the data and the systems that house the data?
“Some would argue that that’s what the ONC is doing,” said Jarrin. The ONC is working on several initiatives in the health IT space, including cybersecurity, rural health IT, and a nationwide health information network. “Others,” continued Jarrin, “would argue that there is already an existing [data] cloud that anyone can access, and that it’s more an issue of security.”

The issue of who owns data can become very complicated. For instance, Katzman pointed out that while hospitals don’t share data very much with each other, they each have a huge network of their own. The goal of those who work in health IT, she said, is to make one worldwide network. “Imagine what kind of progress we could make, the products we could develop from that wealth of data.”

And is a patient’s health information her own property, the property of the device maker that records that data, or of the physicians and hospitals that interpret and house the data? The fact that there is no easy answer to that question is what fuels the debate surrounding health IT.

Speaking of ownership, most everyone now owns a mobile device. “Mobile telephony is the most important technology we have now,” said Jarrin. “Everything is done through it. Everyone has it. Yet we have very sick people. According to the Center[s] for Disease Control [and Prevention], half of all people now have a chronic disease, and it’s getting worse.”

Jarrin’s statistic is correct. As of 2005, almost one in two American adults had at least one chronic disease.

What if we could harness mobile telephony, wondered Jarrin. As the panel joked that Apple computer founder Steve Jobs’s mistake was never registering the iPad as a medical device, Jarrin pointed out how close the device came to being regulated by the FDA.

“Steve Jobs held up an iPad and showed an ECG [electrocardiography] wave form, which caught the attention of federal regulators. Intended use is important. It goes beyond what you say about what the device is for. The act of showing ECG on an iPad could make it a medical device. It can be loaded with medical device software.”

This touched on McCollister-Slipp’s point of putting control in the hands of patients, and trusting them to take charge of their own health to an extent. She encouraged device makers in attendance to divorce themselves from the notion of making devices and technology geared to a specific use. Like the iPad, there are technologies that could and should be user-friendly (easy for the layperson or patient to use) and open to a variety of uses.

“Don’t assume that you know what people are going to do with your data,” said McCollister-Slipp. “There are smart people out there, they will think of creative ways to use the data that others wouldn’t have.”

Despite Jarrin pointing out how hard a line it is to walk—no one wants patients taking diagnosis totally into their own hands—McCollister-Slipp stayed true to her conviction.

“Yes, not everyone will be able to handle information perfectly, but they may not even handle information that comes straight from the doctor perfectly,” she said. “It’s not our role as the manufacturer to figure out what’s OK or not [in terms of data access]. We have to think of the many ways in which people can use data.”

The Hackable Body: How Severe is the Threat?
The convergence of medical technology and an increasingly wireless world. It’s a new frontier of opportunity. But with that opportunity—as with most things in life—also comes an equally fair share of risk. During the recent AdvaMed 2012 meeting in Boston, Mass., in early October, a panel discussed the “hackable body” and whether the issue is one in which companies should be paying more attention.

Clearly, the answer is a resounding yes.

Included in the panel were Dale Nordenberg, M.D., founder of the Medical Device Innovation, Safety and Security Consortium; Lynnette Sherrill, deputy director of the health information security division of the U.S. Department of Veterans Affairs; Brian Fitzgerald, deputy director of the electrical and software engineering division at the U.S. Food and Drug Administration’s (FDA) Center for Devices and Radiological Health (CDRH); and Santhosh Nair, general manager of the intelligent systems group at Wind River, a software company now owned by Intel Corporation.

Although there has not been an actual case of medical device hacking, in October 2011 security software company McAfee Inc. revealed it had exposed a weakness in a Medtronic Inc. insulin pump by “ethically hacking” the device (performed specifically to demonstrate it could be done). This incident, and the rise in mobile health products, has prompted a close review of such devices and their security.

Panelists discussed what they considered to be the appropriate level of concern that should exist in the industry.

Nordenberg outlined key considerations for medica device manufacturers. Among them are the breadth of a device’s exposure, its potential impact, and the ability to prevent a potential adverse impact.

According to Nordenberg, there are about 1 billion patient encounters with physicians or other medical care professionals annually, both inpatient and outpatient. Those encounters do not include exposure to medical devices—sometimes, a patient receives a X-ray, and other times, as in an emergency room visit or a stint in the intensive care unit, a patient comes into contact with hundreds of devices and pieces of equipment.

“From an epidemiological perspective, if you’re not looking for something, you’re not going to find it,” Nordenger said regarding breaches of device security. “The fact that we haven’t found anything doesn’t mean anything. We haven’t established systematic surveillance for hacking. We don’t have the necessary infrastructure systems to quantify that.”

“From an FDA perspective, it falls into the realm of reasonably foreseeable risk,” replied Fitzgerald.
“Not long ago, we would never have thought that [device hacking] would be intentional.”

Nair highlighted that medical devices primarily are designed to be safe and effective. Unlike technology designed for entertainment, for instance, medical devices specifically are meant to heal or save lives, so safety is a given. The notion of additional “security” does not instinctively come into play. Technology in other industries such as aerospace, which is much more advanced, must undergo constant certification to ensure the security of software and components. “We have a long way to go,” Nair said of medical devices, “but we’re going in the right direction.”

Sherrill outlined some of the ways in which enterprise (non-embedded) medical devices and equipment used in veteran care already have successfully manually managed security systems, but Nair pointed out the problem with that. “When you have a secure, manually managed system, there is no incentive to upgrade, and intended use of medical devices gets very outdated very quickly. It causes different kind of problems, and that’s common in any industry—unintended consequences.”

Sherrill agreed. “For years in the energy sector, those devices were isolated like medical devices, not intended to connect to networks. As soon as you do that it opens the door [to vulnerability].”

Sherrill was referring to the cyber attack on Iran’s nuclear energy plant in 2010. The virtual “worm” reportedly was capable of assuming control of systems at the plant. This is disastrous enough in terms of a nuclear plant, but for medical devices, the direct result could potentially lead to death, or at the very least, an invasion of privacy.

Last year, three senior U.S. House of Representatives Democrats—Rep. Donna F. Edwards (D-Md.), Anna G. Eshoo (D-Calif.), and Edward J. Markey (D-Mass.)—requested a report from the Government Accountability Office (GAO) on wireless medical device security.

The GAO report, “Medical Devices: FDA Should Expand Its Consideration of Information Security for Certain Types of Devices,” released in September, found that both the FDA and medical device manufacturers have responded slowly to this emerging threat. “FDA has not considered information security risks resulting from intentional threats,” the GAO concluded in its report. More specifically, the agency failed to consider “intentional threats” in the pre-market approval and evaluation of two medical devices that successfully were hacked—an implantable cardiac defibrillator and an insulin pump. The GAO report also noted that the FDA has not utilized available resources from other government agencies such as the National Institute of Standards and Technology, which maintains a federal computer security vulnerability database and provides guidance and standards related to computer security.

Because technology and reactions to it tend to change very quickly, the GAO may not have reported on the most recent actions of the FDA. “We now routinely ask what the manufacturer has done for confidentiality, security, and so on for cleared devices,” Fitzgerald said. “For PMAs [premarket approvals], we ask for that plus a lot more information and technical specifications.” He also said the FDA is developing better procedures for determining appropriate device security, and bringing in employees with the skills and expertise necessary for this new shift in device examination.

Fitzgerald also admitted the FDA’s market surveillance needs to improve: “Currently we have a passive reporting system—the MAUDE [Manufacturer and User Facility Device Experience Database] system relies on certain criteria and triggers to be met, and these clinical outcomes are triggered by keywords. We end up being blind to the field. We have a chunk of the CDRH that actively monitors this passive system, but cyber threats do not routinely show up—just a handful.”

St. Jude Battling Supplier Over Durata Insulation
AorTech International plc, a Scottish company that manufactures insulation for St. Jude Medical Inc.’s Durata lead wires, is accusing St. Jude of breaching their contract. AorTech has served St. Jude a rectification notice that accuses the company of material breaches. AorTech is giving St. Jude 30 days to correct the breaches, but company officials are not convinced the breaches can be corrected. If AorTech is not satisfied after 30 days, the company can end its relationship with St. Jude.

AorTech specializes in biostable implantable polymers used in cardiology, orthopedic and urological applications. Products include pacing leads, cardiac cannulas, neurostimulation devices, stents and implantable sensor technology. St. Jude is AorTech’s largest existing contract.

“The allegations raised by AorTech are without merit,” said a St. Jude company spokesperson. “The rectification notice St. Jude Medical has received from AorTech is based on inaccuracies and misrepresentations, and we will vigorously defend against these claims. St. Jude Medical has a sufficient supply of inventory from AorTech to continue manufacturing Optim-insulated leads and we have adopted other contingencies that will prevent any supply disruptions of Optim in the future. The manufacture and supply of our Optim-insulated leads will not be interrupted.”

AorTech officials acknowledge that St. Jude still would be able to manufacture polymers if their relationship ends, but assert that the company no longer will have rights to AorTech’s intellectual property and “know-how” to make proprietary AorTech materials. Meanwhile, in September AorTech informed shareholders that it had failed to attract a buyer for the company but received offers for various segments of its business, including its polymer business. In a letter to shareholders, however, the company said there was “no guarantee the transaction can be consummated.”

Headquartered in St. Paul, Minn., St. Jude manufactures medical devices across a range of applications, mostly cardiovascular.

Stryker Inks Deal to Buy Neurotechnology Company
Kalamazoo, Mich.-based medical device company Stryker Corp. will buy Surpass Medical Ltd. in an all-cash transaction for $100 million and up to an additional $35 million of milestone payments.

Founded in 2005, Surpass is headquartered in Tel Aviv, Israel, and has a manufacturing and research and development facility in Miramar, Fla. The company develops and commercializes next-generation flow diversion stent technology to treat brain aneurysms using a mesh design and delivery system.

Surpass’ key product is the NeuroEndoGraft family of flow diverters, which are designed to redirect blood flow away from an aneurysm, thereby allowing a stable clot to be formed within the aneurysm pouch. The diverters are CE Marked, and are undergoing a limited launch outside the United States.

“The acquisition of Surpass Medical further builds on Stryker’s global platform in the fast-growing and highly innovative neurovascular market and helps broaden our offering in complete stroke care,” said Kevin A. Lobo, Stryker’s recently appointed president and CEO. “We remain committed to furthering care in the interventional neurovascular space by offering patients and care givers differentiated products that improve outcomes and help save lives.”

Stryker has been going through a lot of changes this year. The company recently closed two of its manufacturing facilities in New York, eliminating more than 100 jobs, and abruptly lost former CEO Stephen P. MacMillan in February. Lobo officially replaced MacMillan as CEO in the beginning of October.

Leerink Swann Analyst Richard Newitter noted that Lobo’s vision is not known yet, as his appointment is so fresh, but it is safe to say that the purchase of Surpass is a comfortable one for Stryker.

“This is more a beefing up of their portfolio, rather than an expansion into new territory,” Newitter told Medical Product Outsourcing. “ This year has been a ‘digestion period,’ while 2009 to 2011 saw multi-
billion-dollar deals take place.”

Flow diverters specifically are a new area for Stryker, but the company already has significant neurovascular holdings. Neurotechnology is a fast growing market, unlike orthopedics, a slower growing market in which Stryker is a major player.