Assns. urge new EHR regulatory framework

Letters to Health & Human Services Secretary Kathleen Sebelius call for a new risk-based regulatory framework for EHR systems and other health IT tools.

The Healthcare Information and Management Systems Society (HIMSS) and the HIMSS EHR Association sent the letters. In its correspondence, HIMSS states that technologies used to manage, store or transmit health data--such as EHRs and clinical decision support tools--"neither fit the definition of, nor would be appropriately regulated as, medical devices."

HIMSS argues that an effective regulatory framework should do the following:

• Balance costs and benefits of any program proposal;
• Ensure clear, consistent and non-repetitive language and enforcement;
• Be affordable; and
• Avoid adding burdens that delay improvements to healthcare delivery and safety.

Additionally, HIMSS wrote that "it is essential that regulation and oversight recognize the importance of focusing on manufacturers' intended use for a product as opposed to the full range of possible customizations reflecting end users['] clinically informed judgment, with a focus on usability throughout."

The Food and Drug Administration Safety and Innovation Act directs FDA, the Office of the National Coordinator for Health IT and the Federal Communications Commission to publish a report by January 2014 that expresses "a proposed strategy and recommendations on an appropriate, risk-based regulatory framework pertaining to health IT including mobile medical applications that promotes innovation, protects patient safety and avoids regulatory duplication."

In its letter, the HIMSS EHR Association agrees that EHRs and some other health IT technologies should not be considered medical devices, and therefore should remain unregulated. The association recommends that HHS:

• Ensure that the definition of health IT used in a risk-based regulatory framework is aligned with existing market definitions;
• Use a patient safety risk framework to develop a plan that allows for oversight based on level of risk, as well as associated costs and benefits; and
• Use enforcement discretion in a way that creates greater predictability as opposed to regulatory uncertainty.