Part III - Designing Medical Device Regulations

In English, as in many (all?) languages there exists a grammatical category known as the “irrealis moods” – a set of grammatical categories that refer to a situation or action that is not known to have happened at the moment the speaker is talking. Andre Aciman has poetically described them as “verbal moods that indicate that certain events have not happened, may never happen, or should or must or are indeed desired to happen, but for which there is no indication that they will happen … the might be and the might have been.”¹ Some of these are familiar in English like the subjunctive (for unlikely events) or conditional (for events that depend on another condition) mood. Others are more common in non-English languages like the optative (for events that are hoped for or expected),² the dubitative (events whose occurrence is doubted or dubious),³ and jussive (events that are pleaded or asked for)⁴ moods.

The irrealis mood is always an exercise in imagined alternatives, and the same is true in each of the chapters in this part – indeed all, in one way or another, imagine a counterfactual world where the FDA rethinks its regulatory approach. Each also has at its core a view that an FDA device regulatory approach that was good (or at least workable) in one context, is a failure as applied to a new set of technologies.

For Mateo Aboy and Jake S. Sherkow’s chapter “IP and FDA Regulation of De Novo Medical Devices” the problem arises in the intersection of the FDA’s recent policy clarifications on permitting a De Novo device as a “predicate” for a follow-on device application under the 510(k) pathway. While from a safety and efficacy perspective it makes sense to require the second applicant to show that the device is “substantially equivalent” to its predicate device including an assessment that it uses the “same technological characteristics” as the predicate, that requirement creates trouble when the relevant aspect of the predicate device is patented, creating a tactic that is as clever as it is problematically anticompetitive: “device manufacturers use patents to protect the very controls required for regulatory approval.”

For Sara Gerke’s chapter, “Digital Home Health During the COVID-19 Pandemic: Challenges to Safety, Liability, and Informed Consent and the Way to Move Forward,” the problem is the intersection with the Emergency Use Authorization (EUA) regime created by the PREP act and activated in COVID-19 and the only partial coverage of digital home health products within the FDA’s regulatory review. Because many digital home health products do not require FDA review, they thus do not require authorization under an EUA (a benefit to the maker) but also do not qualify for the immunity protections of the PREP act (a drawback to the maker). From the perspective of the end user, though, the details of what the FDA reviews or not is at best mysterious and more likely totally unknown, such that their understanding of the liability ramifications are paltry at best. While Gerke discusses whether such gaps can be filled with more robust informed consent processes, in particular during the COVID-19 pandemic one wonders if this is an unlikely might have been!

In some of the chapters in this part, determining which irrealis mood the authors intend is trickier. Matthew Herder and Nathan Cortez offer a chapter on “A ‘DESI’ for Devices? Can a Pharmaceutical Program from the 1960s Improve FDA Oversight of Medical Devices?,” but should we take those question marks and their framing as optative or dubitative? Their chapter takes inspiration from the history of the Drug Efficacy Study Implementation program (DESI) triggered by a major existential shift at the FDA to examine drug effectiveness more which required relying on third parties to examine the effectiveness of more than 3,000 drugs between 1963–84. They argue for a Desi 2.0, reasoning that “[i]f the FDA’s inability to encourage high-quality evidence production are ultimately reflective of a kind of incumbency – both in terms of who is involved in producing and how it is appraised – then regulation may take as its inspiration DESI’s disruptive move to bring outside actors into the regulatory fold.” Perhaps in an attempt to move the reader from dubitative to optative they suggest precursors in the treatment of digital health technologies by the FDA at the moment, in particular the precert program and the involvement of the National Evaluation System for health Technology (NEST).

As a group these chapters also raise the interesting question about the role of the scholar and the irrealis moods. Legal and policy scholarship tends to focus on existing initiatives and regulatory processes, primarily concerned with the “here and now.” Then again, if past is prologue, perhaps we should not be so dubitative about large changes to the FDA’s approach to device regulation – these chapters chart both major sea changes in the past and strong tail winds in the present toward novel regulatory approaches.

9 IP and FDA Regulation of De Novo Medical Devices

Mateo Aboy and Jacob S. Sherkow

If recent changes to the US Food & Drug Administration’s (FDA’s) authority are an indication, the future of medical device regulation could largely be shaped by intellectual property (IP). In an effort to “accelerate innovation of and patient access to novel technologies,”¹ the FDA now has authority to clear medical devices under its “De Novo Pathway,” a shortened path to market for new, innovative devices.² This authority also includes the ability for follow-on applicants (referred to as “510(k) applicants” after the pertinent statutory section) to use approved De Novo devices as predicates upon which to base their devices’ safety and efficacy.³ But the Agency’s guidance in the area – in combination with devices’ increasingly technological sophistication – put De Novo devices’ IP protections at the forefront of the approval process. This raises a host of questions about the intersection of IP and medical devices, including standard essential patents covering medical devices, IP protections for medical device software, and products liability’s relationship with medical device IP.⁴

Section 9.1 of this chapter provides a brief overview of medical device regulation in the United States and, in particular, the De Novo and 510(k) premarketing pathways. It includes a discussion of recent FDA guidance in the area that lend themselves to a variety of intellectual property strategies to potentially hinder follow-on 510(k) applications, as discussed in Section 9.2. Section 9.3 examines the implications for such strategies and explores three areas for future attention: standards essential patents covering core technological features of De Novo devices; intellectual property protection for software critical for medical devices; and products liability regimes that incorporate this approval–infringement gambit.

9.1 Medical Device Premarketing Pathways

Recent attempts to modernize and speed up the FDA’s premarketing clearance and classification process for medical devices have included both new device classifications and new ways of filing abbreviated applications. The FDA’s “De Novo” classification and “Breakthrough Devices” programs, in particular, allow applicants to create entirely new medical device “types,” complete with their own fleet of standardized safety and effectiveness checklists, including sets of specifications on software, hardware, and energy sources.⁵ These safety and effectiveness checklists are enumerated for each device type in the FDA’s rolls under “general” or “special controls.” General controls are a list of safety checks required of all medical devices – proper labeling, for example.⁶ Special controls, by contrast, are safety and effectiveness checks specific to a device type, e.g., a requirement that external cardiac pacemakers deliver a current at a pulse amplitude no greater than 200 mA.⁷ The De Novo pathway, in particular, allows the clearance of devices that can demonstrate a “reasonable assurance” of fidelity to its device type’s general and special controls.⁸

The De Novo and Breakthrough pathways are still a novelty, however, and the vast majority of medical devices – over 85 percent by some metrics – are cleared through what is known as the “510(k) pathway,” named so after the pertinent section in the Food, Drug & Cosmetics Act (FDCA).⁹ Up to now, the 510(k) pathway has been the most widely employed medical device premarket submission program since the enactment of the Medical Device Amendments of 1976 to the FDCA.¹⁰ Significant for the 510(k) pathway is the process by which a new device is categorized into one of three classes based on its risk: Class I, the least risky devices; Class II; or Class III, the most risky devices.¹¹ This initial classification determines the requirements a device must meet prior to market introduction. In particular, non-exempt Class I and Class II devices for which a “predicate” device exists can rely on the 510(k) pathway toward clearance if the new device can show it is “substantially equivalent” to the predicate device.¹² By contrast, Class III devices, for the most part, must instead use the significantly more onerous Premarket Approval (“PMA”) pathway, which may require costly clinical tests.¹³ Accordingly, over the last forty years, the 510(k) program became the preferred and dominant premarketing pathway for medical device manufacturers, and especially those concerning Class II devices.¹⁴

In an effort to encourage innovation and competition, the 21st Century Cures Act allows De Novo devices to serve as “predicates” for subsequent 510(k) submissions, so long as such devices use the same general and special controls as their De Novo predicates, and possess, in most cases, “the same” technological characteristics as the predicate De Novo device.¹⁵ This allows the 510(k) applicant to demonstrate “substantial equivalence” between it and the De Novo device.¹⁶ The substance of the substantial equivalence determination is based primarily on satisfying two inquiries: first, “Do the devices have the same intended use?”; and second, “Do the devices have the same technological characteristics?”¹⁷ The result of failing to satisfy both of these inquiries is a “not substantially equivalent” determination, which traditionally automatically classified the new device as a Class III, that is, high-risk, device, depriving the applicant of the convenience, cost, and speed of the 510(k) pathway.¹⁸

Until recently, this approval structure encouraged applicants to characterize their new medical devices as having the “same intended use” and “same technological characteristics” as a predicate device, independently of their devices’ degree of novelty.¹⁹ Applicants of low- and moderate-risk devices needed to be cautious of introducing significant innovations, however, as these could result in an NSE determination and shunting to the PMA route of approval.²⁰ Some have argued that – at least for some devices – this encouraged slow and incremental changes to preexisting devices at the expense of radical innovation.²¹

On December 7, 2018, however, the FDA published new draft guidance for the De Novo classification process under the 21st Century Cures Act.²² The agency followed the guidance with a September 9, 2019 “Acceptance Guidance” to further support the De Novo process as a pathway to classify novel medical devices for which there is no legal marketed predicate device.²³ This alternative pathway for low- and moderate-risk devices (i.e., Class I and Class II devices) is now available for either applicants who received an NSE determination in a prior 510(k) application; or applicants claiming that there is no legally marketed predicate device upon which to base a 510(k) application.²⁴ This second option, in effect, creates a new regulatory pathway for approval of novel medical devices: the direct submission of a device under a De Novo classification request.²⁵ 510(k) applicants, in turn, may use these “direct” De Novo devices as predicates for their applications.²⁶

At best, this procedure is hoped to accelerate the development of truly novel medical devices. Criticism of the prior regime centered on a flight not to innovation but to mimicry – the fear of innovating too much at the risk of an NSE determination.²⁷ Allowing the rapid entry of truly novel devices through the De Novo and Breakthrough programs, followed by slight variation and market competition through the 510(k) pathway seeks to encourage both innovation and competition.²⁸ Whether this will meet its mark remains to be seen. A 2011 Institute of Medicine report raised hopes that the De Novo pathway “offers a potential basis of a better regulatory model for premarket review of Class II devices.”²⁹ But as of this writing there were fewer than 300 marketed De Novo devices in the United States.³⁰

9.2 Intellectual Property Considerations

9.2.1 IP and Competition

These premarketing pathways, while rooted in classic considerations of safety and effectiveness, lend themselves to a potential intellectual property strategy with the effect of – or designed for – preventing 510(k) applicants from using De Novo devices as predicates. The strategy begins with the general and special controls certification required for the submission of a De Novo application. The application must include “a description of why … general and special controls provide reasonable assurance of safety and effectiveness.”³¹ This certification of “reasonable assurance” based on these controls is, of course, the impetus behind the De Novo pathway: if general and special controls really can ensure a device’s safety and effectiveness, then requiring an applicant to demonstrate safety and effectiveness through robust clinical trials even though there is no appropriate predicate is wasteful.³² Additionally, this certification requirement raises an epistemic problem: how can one be reasonably assured that a device’s special controls will make it safe and effective if there are no other device types like it? To use a new type of pacemaker, for example, how can one know, without robust testing, whether a 200-mA limit, or 250 mA, or 350 mA, provides “reasonable assurance” that the new type of pacemaker is both safe and effective? In an attempt to resolve this question, the FDA, in 2017, began to ask De Novo applicants to propose their own special controls for their own devices.³³ Some of these controls, according to the Agency’s De Novo Acceptance Guidance, can be quite specific and technologically oriented, such as the device’s performance standards, materials used to ensure biocompatibility, its design to ensure safe use, the energy source of the device, data requirements (clinical studies), or its use of software.³⁴ If these controls are accepted by the FDA, and if the device is approved, as noted above, this establishes a new device type, for which any follow-on applications must either use the same controls or otherwise demonstrate substantial equivalency.³⁵

These same technological features, that is, key technological characteristics and the special controls necessarily tied to these technological characteristics through performance standards, can be patented by the De Novo applicant. This establishes an IP barrier of entry for 510(k) applicants wishing to use De Novo devices as predicates for their applications: in determining whether a 510(k) application is “substantially equivalent” to its predicate device, the FDA assesses whether the 510(k) device uses the “same technological characteristics” as the predicate, that is, the same “materials, design, [and] energy source, and other device features” of the predicate device.³⁶ This requires most 510(k) applications to provide “engineering drawings or other figures,” “a complete identification of the detailed chemical formulation used in the materials of construction,” an identification of “energy delivery that is part of the functional aspect of the device,” and a recitation of the device’s “software/hardware features … as appropriate for the specific device technology.”³⁷ To the degree these aspects of the predicate device are patented, this is not just a potential admission of patent infringement but possibly a detailed roadmap of how the De Novo applicant can prove its infringement case.³⁸

All is not lost for proposed 510(k) devices that do not use the same technological characteristics as their De Novo predicates; their applicants can still demonstrate substantial equivalency if their devices’ technological characteristics use the same “performance characteristics” and do not “raise different questions of safety and effectiveness.”³⁹ But these performance characteristics – the De Novo predicates’ “device design, material[s] used, and physical properties” – can substantially overlap with predicates’ special controls, which, if patented, puts 510(k) applicants back in the same trap as before: in order to demonstrate substantial equivalency to the FDA, 510(k) applicants must either admit to patent infringement or confess to the FDA that their proposed devices are not substantially equivalent to their predicates.

In summary, marketers of De Novo devices can tell the FDA which special controls to use to assess their devices, controls that De Novo applicants can then also patent.⁴⁰ If these special controls overlap with a De Novo device’s performance characteristics, this makes filing a 510(k) application on the entire De Novo device type impossibly unattractive; the 510(k) applicant must either essentially admit to infringing the De Novo device predicate’s special controls or choose to acknowledge its device is not substantially equivalent, thus sinking their 510(k) application.

9.2.2 An Example: Alternate Controller Insulin Pumps

Admittedly, this seems like a rather tortuous pathway to quelling competition. But a real-life example proves how easy – and powerful – the strategy can be. As of this writing, Tandem Diabetes Care, Inc. markets, as a De Novo device, the t:slim X2 Insulin Pump, an automatic pediatric insulin pump given the generic device type of “alternate controller enabled infusion pump.”⁴¹ To allow patients control over when they receive insulin, the pump can be operated by a connected smartphone – the “alternate controller” – that raises several concerns over safety and effectiveness for which Tandem identified several special controls.⁴² Those controls include, among other things, the “[s]haring of necessary state information between the pump and any digitally connected alternate controllers” and “[a] detailed process and procedure for sharing the pump interface specification with digitally connected devices.”⁴³ These special controls overlap with the device’s performance controls, which include “validated software protocols intended to ensure secure, accurate, and reliable communication with digital interfacing devices.”⁴⁴ As an illustrative example, these aspects of the device’s communication protocols that have been patented by Tandem, which owns over fifty patents covering various aspects of its insulin pump technology.⁴⁵ Take, for example, US Patent No. 10,478,551, which claims a broad method “of delivering a medicament bolus with a medical infusion pump” via “a remote consumer electronic device.”⁴⁶ Presumably, almost any overlap between the “remote consumer electronic device” enumerated in the claims and a “digitally connected device” that uses a “validated software protocol” to connect to the pump, would at least colorably infringe. US Patent No. 9,833,177, also owned by Tandem, similarly claims a detailed system that includes a “controller communicatively coupled to the pump.”⁴⁷ Again, there is likely little daylight between the “secure, accurate, and reliable communication” protocol identified in the device’s performance characteristics and the detailed system for controller communications in the patent. And US Patent No. 9,492,608 claims a variety of methods of “infusing insulin” using a programmed controller, making design-arounds for follow-on applicants difficult.⁴⁸

Ultimately, any 510(k) applicant seeking to market a follow-on alternate controller enabled infusion pump would need either to admit it uses the same “process and procedure for sharing the pump interface specification” with the controller – a likely admission of infringement of Tandem Diabetes’ patents – or that it uses different special controls but nonetheless hews to the device’s performance characteristics – which are also patented. Denial on both counts, under the FDA’s own guidelines, means the two devices are not substantially equivalent. To be clear, there is currently one approved 510(k) application for an “alternate controller enabled infusion pump” – currently marketed by Insulet Corporation, the Omnipod DASH⁴⁹ – but it seems clear that Tandem Diabetes considers Insulet to be a direct competitor.⁵⁰ Insulet’s 510(k) application, meanwhile, states that while it has different technological characteristics from Tandem’s device, it nonetheless meets the predicate’s performance controls.⁵¹ Whether this will result in a patent infringement suit, or not, remains to be seen, but for now, the pathway presented for any follow-on developer, as with Insulet, seems fraught.

9.3 More Complex Strategies

In some sense, the anticompetitive trap described above is simple: device manufacturers use patents to protect the very controls required for regulatory approval. But several areas of intellectual property practice intersect with this strategy in complex ways. Standard essential patents trouble the relationship between IP and device requirements. IP protection covering medical device software may be both better and worse for follow-on applicants. And patents may exacerbate the role that products liability plays in designing follow-on devices. These more complex forms of protection further demonstrate the thick ties between IP and medical device approval.

9.3.1 Standards Essential Patents

Where patents cover a De Novo device’s special controls or performance characteristics, the patents may be narrow enough to allow 510(k) applicants to design around them. But this becomes greatly complicated – if not downright impossible – where the patents are standards essential patents (“SEPs”) for standards explicitly required to meet safety and efficacy standards.⁵² Certifying that a 510(k) device meets such a standard is, in essence, a certification of infringement of the SEPs.⁵³ Here is an example: the FDA’s evaluation for alternate controller enabled infusion pumps specifically references the use of a Bluetooth Low Energy radio as the means for reliably and securely connecting the controller to the pump.⁵⁴ But the Bluetooth Low Energy technology is, itself, a standard established by the Bluetooth Special Interest Group (“BSIG”), and covered by specific SEPs.⁵⁵ As with the patent strategy describe, above, a 510(k) applicant would need to use the same technology and, therefore, obtain a patent license from BSIG. Where the De Novo marketer has participated in developing the standard or contributing its patents to the SEPs, this makes noninfringing 510(k) applications all but a dream.

At the same time, SEPs may present less of a concern than non-SEP patents held by the De Novo device marketer because SEPs are typically licensed on fair, reasonable, and non-discriminatory terms to all comers; injunctions are rare.⁵⁶ But a recent policy statement from a variety of government agencies recently questioned the wisdom of dispensing with injunctions for SEPs.⁵⁷ If injunctions do begin to become commonplace for SEPs, and if De Novo device marketers robustly participate in setting device standards, 510(k) applicants may find it all but impossible to demonstrate substantial equivalency without facing the threat of an injunction from standards organizations. The future of this area will turn on the effect of this injunction policy and device marketers’ participation in standards setting.

9.3.2 Software IP

A substantial proportion of the De Novo applications are for SaMDs (“Software as Medical Devices”),⁵⁸ “software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device” (e.g., a medical device software application that runs on a consumer grade hardware such as a smartphone).⁵⁹ Such De Novo SaMDs raise important questions at the intersection of IP and the medical device premarket pathways in situations where the key computer-implemented inventions are patented and become the key technological characteristics (i.e., the SaMD itself). Even in the cases of “Software in a Medical Device” (i.e., software that drives or is required by a hardware medical device to achieve its intended function), the interactions between IP, De Novo, and 501(k) can be problematic. De Novo medical devices typically include software, some of which constitute devices’ core technological characteristics or special controls tight to key performance characteristics. Using the t:slim X2, again, as an example, the insulin pump uses a suite of software to ensure that the device’s various functions – basal delivery, bolus delivery, and occlusion detection, for example – functioned properly.⁶⁰ These software controls are, indeed, performance characteristics of the device, follow-on applications of which would need to replicate.⁶¹

Using IP to protect De Novo devices’ controls and performance characteristics adds nuance to how effectively it could potentially hinder 510(k) applications. With respect to patents, many “software” patents – admittedly, a nettlesome term without clear definition – have been rendered invalid after the Supreme Court of the U.S.’ opinion in Alice Corp. v. CLS Bank International.⁶² This is true in both post-issuance proceedings at the US Patent and Trademark Office and in litigation in federal court.⁶³ 510(k) applicants may, therefore, give less credence to software patents covering De Novo devices’ special controls or performance characteristics.⁶⁴ In other instances, due to peripheral claiming practice and software patents’ often overly general claim elements, 510(k) may be able to easily design software patents protecting the features of their predicate devices.⁶⁵

But certain forms of software can be copyrighted as well, a substantially more difficult problem for 510(k) applicants.⁶⁶ Unlike patents, copyrights’ infringement ambit is central rather than peripheral, rooting itself in whether the accused software possesses “substantial similarity” to the copyrighted one.⁶⁷ This also means that “designing around” software copyright is much more difficult.⁶⁸ Assuming that software copyrights cover a De Novo device’s special controls or performance characteristic, it would be extremely difficult for a 510(k) applicant to argue that its device is “substantially equivalent” to the De Novo predicate but does not possess “substantial similarity” to its special controls.

With this said, the vitality of copyright covering software – specifically, application program interfaces (“APIs”) – is in dispute. The Supreme Court of the US is, as of this writing, slated to decide the issue in an upcoming case, Google LLC v. Oracle America, Inc., concerning software covering Java APIs.⁶⁹ Given APIs’ functional nature, many commentators think the Court will ultimately do away with such protections.⁷⁰ Regardless, the case will be important for De Novo and 510(k) applicants alike. Perhaps it is strange to think that the future of medical device competition may substantially turn on the copyrightability of Java APIs, but that may best encapsulate the issues confronting medical device regulation for the twenty-first century.

9.3.3 Patents and Products Liability

Even assuming that 510(k) applicants could design around De Novo predicates’ protected controls and performance characteristics, it is not clear how far they would go. Marketers of 510(k) devices, just like marketers for their predicate devices, are liable for design defects in their devices.⁷¹ This is more than a mere worry – medical device products liability cases are some of the most damage-heavy in the American legal system.⁷²

Fear of products liability suits has dispirited the adventurousness of many follow-on device manufacturers.⁷³ Christopher Buccafusco has recently recounted the ploddingly slow incremental improvements behind wheelchairs, even long after their principal patents had expired.⁷⁴ Wheelchair manufacturers “continued to make wheelchairs following [the patented] established design … [ensuring users] would have a difficult time arguing that the product was fundamentally unsafe.”⁷⁵ By contrast, follow-on manufacturers expressed the belief that “introducing new products, without established safety records, could subject them to massive liability should people get hurt.”⁷⁶ Even with the absence of patent protection and fifty years’ worth of real-world safety data, Buccafusco’s lesson from the wheelchair case is that follow-on manufacturers may not use all of the runway IP otherwise affords them. As applied to De Novo devices, this instruction is likely to have even more force. De Novo devices are, by definition, those without a predicate, devices that are likely to be more novel and potentially more dangerous than wheelchairs. Orthopedic injuries from wheelchair misuse should not be discounted. But faulty insulin pumps are likely to be fatal.

Patents are likely to exacerbate this in the context of 510(k) applications to De Novo devices. If the only path toward noninfringing approval is a radical transition to the predicate device’s design, 510(k) applicants may forgo the opportunity altogether for fear of liability. At the same time, incremental innovation – like that historically characterized by the wheelchair industry – may be enough to gain regulatory approval and avoid products liability suits, but not enough to avoid infringement. This puts an added constraint on 510(k) applicants seeking to design around De Novo predicates – the invisible force of products liability suits for redesigns of approved devices.

9.4 Conclusion

Allowing De Novo or breakthrough device applicants to patent their devices’ special controls and performance characteristics creates an anticompetitive gauntlet for 510(k) device applicants. Those 510(k) applicants seeking to use De Novo or breakthrough devices as predicates are hemmed into either admitting their devices are “substantially equivalent” to their predicates – effectively an admission of patent infringement – or that they use different technological or performance characteristics, a regulatory concession sinking their own applications. These difficulties may be exacerbated in more complex cases involving standards essential patents, IP covering medical software, or design-arounds that raise products liability concerns. This cannot be what Congress intended when it opened the 510(k) pathway to De Novo devices. The FDA should consequently be warier about De Novo applicants that propose special controls or performance covered by the applicants’ own patents. If left unchecked, the future of medical regulation may turn not on innovation of devices’ safety and effectiveness, but strategic avoidance of others’ intellectual property.

10 A “DESI” for Devices? Can a Pharmaceutical Program from the 1960s Improve FDA Oversight of Medical Devices?

Matthew Herder and Nathan Cortez

The US Food and Drug Administration (FDA) has embraced “real-world evidence” (RWE) to evaluate the safety and efficacy of medical devices and drugs. However, the turn towards RWE remains controversial. Securing high-quality evidence after market entry can be a significant challenge. And concerns about the safety of several medical devices – discovered only after real-world use – have renewed calls for more rigorous pre and postmarket evaluation. Here, we discuss the shift toward RWE and the attendant challenges and concerns. Then, through a historical examination of the “Drug Efficacy Study Implementation” program (DESI), we argue that changing how RWE studies are conducted and who evaluates them might mitigate some concerns. Distributing the responsibility for designing, conducting, and assessing RWE beyond industry sponsors and the FDA is critical to producing – and acting upon – more clinically useful information about these products. We explore how the DESI program, which used third parties to examine the effectiveness of more than 3,000 drugs between 1963–1984, coupled with existing flexibilities in the law governing medical devices, provide both the inspiration and necessary conditions to support a DESI 2.0.

10.1 Introduction

A defining dilemma in regulating health products is balancing upfront scrutiny of safety and effectiveness prior to marketing with ongoing oversight during everyday use. Reliable evidence from both the premarket and postmarket phases is essential for both informed regulation and optimal clinical use. Yet the standards for evaluating this evidence are underspecified by law, challenged by innovation, and contested by a range of actors. In this chapter, we bring into conversation two types of products that have traditionally been subject to divergent regulation – drugs and devices – to illustrate both the challenges of, and potential opportunities associated with, increasing reliance upon what can be learned from the real world, so-called “real-world evidence” (RWE).

Since the mid-20th century, the US Food and Drug Administration (FDA) has relied on premarket data collection to demonstrate that products are safe and effective. In recent years, however, the agency has gradually relied more on evidence gathered on the postmarket side of the equation, typically under the auspices of expedited reviews designed to speed up market access to promising (if yet unproven) drugs.¹ Moreover, since the 1976 Medical Device Amendments, the vast majority of devices have gained entry into the US market by demonstrating substantial equivalence to a previously marketed device,² thus inviting the FDA to infer safety and efficacy on the basis of previous clinical use of older devices. Nevertheless, after a number of high-profile cases in which devices entered the market as substantially equivalent to older devices but later proved to carry significant risks,³ the agency is under some pressure to revisit how it sets the evidentiary bar.

The FDA’s evidentiary standards, particularly the important balance between pre and postmarket evidence, are in flux. Section 10.2 details this shift and develops an argument that medical devices are especially ripe for regulatory experimentation. In Section 10.3 we pull from historical experience with drugs to describe key features of a new regulatory approach for devices. We theorize that the “Drug Efficacy Study Implementation” (DESI) program, which the FDA initiated in the 1960s, could be refashioned to improve both the quality of the evidence and the regulatory decisions made about medical devices. We see particular promise in expanding both evidence gathering and evidence evaluation to third parties outside both the FDA and industry. In concluding, Section 10.4 outlines potential stumbling blocks for a “DESI 2.0” for devices, which we hope will guide further development of this idea.

10.2 Evolving Standards for Drugs and Devices

10.2.1 Lifecycle Regulation and Real-World Evidence at the FDA

The idea that a product’s safety or efficacy profile might change significantly once used widely in the “real world” is far from new. Although controlled experiments help evaluate the safety and efficacy of a product in a target population, they may also mask important risks or exaggerate benefits that become apparent when the product is used over longer periods, in larger populations, and beyond the confines of strict trial protocols. Thus, the FDA has always been somewhat alert to how pre and postmarket experience with a product might differ. Even so, the FDA’s recent shift from pre- to postmarket data gathering and evaluation is both marked and remarkable. New sources of postmarket data are influencing the FDA’s upstream decisions about whether, and on what terms, to approve health products.⁴

Of course, postmarket studies that are required by the FDA, or voluntarily undertaken by the sponsor, may still take the form of a randomized clinical trial (RCT). That is not what the FDA and others mean when they refer to real-world evidence (RWE) and real-world data (RWD). The former is essentially any evidence generated outside typical clinical research settings. The latter comes in multiple forms, including “electronic health records (EHRs), claims and billing activities, product and disease registries, patient-generated data including in home-use settings, and data gathered from other sources that can inform on health status, such as mobile devices.”⁵ Some researchers are trying to replicate RCT findings using RWD,⁶ and within at least some corners of the FDA, including recent FDA Commissioners,⁷ the appetite for RWE is growing.⁸

One linear account of this change is that Congress and others outside the agency have pushed the FDA toward a “lifecycle” approach to regulation that incorporates RWE. While the process has been mostly gradual, dating back to the HIV/AIDS crisis of the 1980s, the 21st Century Cures Act of 2016 marked a tipping point. The landmark legislation directed the FDA to consider nontraditional study designs and data analysis to streamline drug reviews;⁹ apply the “least burdensome means” of approving devices, for instance, by factoring in the likelihood of RWD clarifying safety and effectiveness;¹⁰ remove certain medical software from medical devices subject to FDA oversight;¹¹ establish an expedited regulatory pathway for “breakthrough” devices;¹² and develop guidance to incorporate RWE and patient experience data into its decision making for drugs and devices alike.¹³

Another reading of this shift toward lifecycle regulation and RWE suggests that the FDA itself has shaped this regulatory arc. For example, the FDA established the accelerated approval process for drugs and the breakthrough program for devices years before Congressional direction – perhaps to safeguard the agency’s central role in pharmaceutical governance.¹⁴

Whatever the motivations, the shift toward lifecycle regulation and RWE remains a work in progress. Postmarket studies regularly take years to complete¹⁵ and seldom improve the evidence already gathered.¹⁶ The FDA rarely threatens to impose fines or withdraw authorization when postmarket studies are delayed or the evidence does not confirm efficacy.¹⁷ Moreover, the FDA’s legal authorities and resources to enforce postmarketing requirements are inadequate and the continuing dominance of the FDA’s reviewing divisions over its postmarket monitoring divisions compromises the agency’s ability to revisit initial decisions.¹⁸ Meanwhile, numerous studies show – notwithstanding agency claims to the contrary – that the FDA has been applying a lower regulatory bar for approval of drugs, and the vast majority of medical devices escape formal scrutiny of safety and efficacy.¹⁹

In sum, the FDA’s capacity to spur sponsors to generate reliable information about their products²⁰ and to adjust regulatory decisions as the evidence evolves are each in serious question. It is time to consider new mechanisms to counter these shortfalls. The remainder of Section 10.2 details why medical devices, especially digital health products, offer an opportunity for the FDA to pursue this very sort of regulatory experimentation.

10.2.2 Signs of Regulatory Experimentation in Digital Health and Beyond

The FDA’s framework for regulating devices has not changed much since the 1976 Medical Device Amendments, despite radical technological advances.²¹ Although a consensus now favors reform,²² Congress has done little apart from calling for task force recommendations for how to regulate health IT products,²³ and trying to clarify which products fall within FDA jurisdiction.²⁴

In the absence of reform, the FDA itself has begun to experiment with new approaches. The agency’s 2017 Digital Health Innovation Action Plan²⁵ articulates three key departures from the FDA’s longstanding framework for devices: 1) shifting evidence gathering and evaluation from the premarket to the postmarket phase; 2) scrutinizing firms rather than products, using a new “Software Pre-Certification Program” to evaluate companies offering products; and 3) outsourcing market certification to independent, third-party reviewers, moving away from centralized agency review. While the first departure mirrors the agency’s lifecycle approach to drug regulation, the other two departures are unique, as centralized, product-specific reviews have been the lodestar of FDA regulation for roughly a century.²⁶,²⁷

Although the details of these new approaches are still in flux, they revolve around a few core ideas. First, shifting evidence gathering to the postmarket setting effectively grants sponsors a kind of conditional or phased authorization, with the expectation that postmarket evidence might confirm the device’s safety and efficacy.²⁸ The FDA has assigned the task of gathering such evidence to NEST, the National Evaluation System for health Technology,²⁹ a public-private initiative led by the FDA’s Center for Devices and Radiological Health (CDRH).³⁰ NEST is charged with collecting RWE from multiple sources, including electronic health records, insurance claims, pharmacy records, device registries, and patient-generated data (PGD).³¹ As of 2019, the NEST network includes over 195 hospitals, 3,942 outpatient clinics, and fifteen coordinated registry networks that curate and analyze data.³² NEST will organize data “into several standardized common data models (including domains such as demographics, diagnoses, procedures, and laboratory tests).”³³ Importantly, while NEST was originally proposed as a way to conduct postmarket surveillance to identify safety issues early,³⁴ it has broadened its focus to collecting data throughout the entire product lifecycle, using it not only for postmarket surveillance, but also for premarket review.³⁵ For example, the FDA said such evidence could be used to support a sponsor’s petition for device reclassification.³⁶ The data could also be used, ideally, to inform insurance coverage and reimbursement decisions, clinical practice, and patient adoption.³⁷

In 2018 and 2019, NEST solicited proposals for test cases to evaluate how well such data can be used to answer specific questions.³⁸ The latest round includes, for example, a study using insurance claims data to evaluate whether to expand the label for cardiac devices in children with congenital heart disease, and a trial using electronic health records and patient data to evaluate how well the Apple Watch ECG can detect irregular heart rhythms, to inform premarket submissions and postmarket surveillance.³⁹ The twenty approved test cases span a range of therapeutic devices (oncology, cardiology, vascular, orthopedic, etc.), a range of risk profiles (from low-risk 510(k) devices to higher-risk PMA devices), a range of data (retrospective and prospective), and a range of proposed uses (premarket, postmarket, and coverage decisions).⁴⁰ The test cases will also allow NEST to address concerns over the validity of studies using RWE, with expert committees focusing on the quality of the source data and designing appropriate methodologies for data analysis.⁴¹

While the FDA’s shift toward lifecycle regulation has been the subject of growing critique,⁴² NEST can add significant scientific rigor to the process of collecting and analyzing RWE to the benefit of “regulatory, clinical, and coverage decision making” not to mention “the health and the quality of life of patients.”⁴³ However, there are also reasons to be skeptical that this will occur, underscoring the need for even more radical experimentation, which we describe in Section 10.3.

10.3 A DESI for Devices?

Though the FDA has experimented with medical device regulation in recent years, mounting evidence that the move toward lifecycle regulation and RWE carries serious tradeoffs suggests more radical changes may be required. We draw inspiration from a historical program, designed and implemented by the FDA in the wake of 1962 legislative reforms, to envision even more modern advances to medical device regulation. We first describe the DESI program, then argue that existing legal authorities can and should be repurposed to support a DESI 2.0 for devices.

10.3.1 The “Drug Efficacy Study Implementation” Experiment

Although the 1962 Kefauver-Harris Amendments are widely considered to be foundational, the requirement that drug manufacturers show “substantial evidence” of effectiveness were preconfigured by agency practice. Safety, the sole criterion for market entry from 1938 to 1962, was understood by the FDA to encompass clinical utility or effectiveness beginning in the early 1950s.⁴⁴ Administrative innovation pre-staged congressional legislation.

The 1962 amendments likely emboldened the FDA, not only in terms of justifying heightened expectations for evidence of efficacy, but also in terms of using its administrative discretion to fashion solutions to problems perceived in the marketplace. Central among them was the question of what to do about the thousands of “old drugs” that had entered the market between 1938 and 1962, which were not formally evaluated for effectiveness prior to Kefauver-Harris. Congress did not explicitly require the FDA to review these old drugs,⁴⁵ but the agency read multiple sections of the legislation as all the mandate they needed.⁴⁶ Within a few years “DESI” was born.

DESI would come to evaluate some 3,400 old drugs for over 16,000 therapeutic indications over twenty-plus years.⁴⁷ To accomplish that feat, the agency understood that it needed a remarkable new structure. In 1966, under the leadership of Commissioner James Goddard, the FDA contracted the work to the National Academy of Sciences (NAS) and National Research Council (NRC).⁴⁸ The FDA not only lacked sufficient personnel for the task, but its personnel lacked the clout that NAS/NRC experts could command if and when difficult decisions had to be made to pull products from the market. The FDA created a centralized Policy Advisory Committee to define DESI’s procedures, which in turn spawned thirty review panels assigned to the therapeutic categories of the day. Each panel was comprised of a chair and approximately six NAS/NRC experts. They worked in confidence, delivering recommendations to the FDA about whether a given drug was “effective,” “probably effective,” “possibly effective,” or “ineffective.” Even though the panels did not conduct new research, each panel reviewed the medical literature for roughly 150 drugs, requiring 10,000 hours of expert scientific labor.⁴⁹

DESI drew lawsuits from industry as the FDA followed through on panel recommendations, announcing hundreds of drug withdrawals via the Federal Register.⁵⁰ The litigation was less about the involvement of outside NAS/NRC experts, and more to do with the summary-type procedures that the FDA had adopted in the name of efficiency. Notwithstanding firms’ legal challenges, the litigation ultimately failed. The Supreme Court largely validated the agency’s approach in the 1973 “Hynson quartet” of cases involving challenges to NDA withdrawals for preamendment drugs.⁵¹ Even without explicit statutory authorization, in Hynson the Supreme Court refers to DESI as a “statutory mandate,”⁵² and a Senate Report from 1972 refers to DESI as being “required by the Drug Amendments of 1962.”⁵³ Further, the Supreme Court upheld the FDA’s power to use summary procedures, ruling that firms’ expectations of a full administrative hearing to decide the fate of a drug was conditional upon having first produced “substantial evidence” of effectiveness. Where such evidence is lacking, the Court held, a full hearing need not follow.

The implications of DESI are manifold. But the move to engage outside actors in the decision-making process is underexamined. If the FDA’s inability to encourage high-quality evidence production are ultimately reflective of a kind of incumbency – both in terms of who is involved in producing and how it is appraised⁵⁴ – then regulation may take as its inspiration DESI’s disruptive move to bring outside actors into the regulatory fold. In the realm of medical devices, recent FDA initiatives such as NEST show some willingness to do this.

But the success of a DESI 2.0 for devices may depend on coupling 1) third-party evidence generation with 2) third-party reviews of that evidence – two functions which neither the original DESI nor more recent initiatives like NEST have sought to combine. Third-party evidence generation and reviews might significantly strengthen the use of “real-world” signals beyond what the FDA and/or industry is either capable or willing to do, making more meaningful recent odes to total lifecycle regulation and postmarket surveillance.

10.3.2 Repurposing Existing Legal Authorities to Support a “DESI 2.0”

Allowing third parties to both generate evidence and conduct rigorous product reviews is a less radical idea than we might think. Data are now available through many different sources, including massive device registries.⁵⁵ And the sheer volume of devices introduced into the market, particularly in digital health, augers in favor of outsourcing some portion of review of safety and efficacy. It is the joining of these two functions and empowering third parties to fulfill them that is crucial.

A threshold question is whether a DESI 2.0 would be legally permissible. Just as the Kefauver-Harris Amendments were interpreted by the FDA as authorizing the original DESI, the current statute is flexible enough to support both device reviews and evidence generation by third parties. First, the statute very broadly requires the FDA to “consider, in consultation with the applicant, the least burdensome appropriate means of evaluating device effectiveness that would have a reasonable likelihood of resulting in approval,” unless “contrary to public health.”⁵⁶ Moreover, as with DESI, the statute entrusted initial review and classification of pre-1976 devices to expert panels, and envisioned that the FDA could turn to expert panels to review classification petitions.⁵⁷ In both cases, panel decisions are recommendations published and reviewed by the FDA.⁵⁸ Likewise, the statute authorizes the FDA to withdraw or suspend PMA approvals, particularly when “new information” is presented.⁵⁹ FDA rules make clear that the agency “may seek advice on scientific matters from any appropriate FDA advisory committee” and “may use information other than that submitted by the applicant” in deciding whether to withdraw approval of a PMA.⁶⁰

Section 523 of the FDCA provides more specific authority for the kind of dual-function third-party mechanism we imagine. In 1997 Congress amended the statute to codify a five-year pilot program to allow the FDA to accredit third parties to review 510(k)s and make nonbinding recommendations to the agency.⁶¹ The FDA initiated the pilot in 1996, before it received statutory authorization.⁶² The idea was to provide manufacturers of certain devices “an alternative 510(k) review process that could yield more rapid marketing clearance decisions” and preserve FDA review for higher-risk devices.⁶³ The FDA published accreditation criteria in 1998,⁶⁴ and the pilot has been renewed by Congress every five years since 2002.⁶⁵ Currently, only eight entities are accredited for the renamed “3P Review Program.”⁶⁶ Although 510(k) user fees are waived and FDA clearance is 29 percent faster when recommended by an accredited third party, the program remains underutilized.⁶⁷

Despite possessing sufficient legal authority to create a DESI 2.0, the FDA might seek more clear statutory authorization from Congress in order to act upon third-party evidence and recommendations. Although the FDA’s authority to adopt summary-type procedures for devices would be supported by the Hynson quartet of Supreme Court decisions, more aggressive reliance on third-party reviews might need clearer statutory support. To wit, after the FDA announced its Digital Health Action Plan and software precertification program, several Senators sent a letter to the FDA questioning the agency’s statutory authority to do so.⁶⁸ Indeed, the FDA’s announcement of the Action Plan itself acknowledged that it may lack statutory authority for third-party precertification.⁶⁹ However, there is a long history of the FDA relying on panels and advisory committees to make nonbinding recommendations regarding product approvals, classifications, and withdrawals. A similar system, whereby NEST (or some other third party) would be empowered not only to analyze newly collected data but also make recommendations to the agency about appropriate regulatory actions in light of that evidence – ranging from label changes to product withdrawal – would seem to be within FDA authority. Advisories and recommendations are, by their very nature, nonbinding, though their publication would force the FDA to offer compelling justifications for making decisions contrary to the recommendations.

Thus, the stars seem well aligned for a DESI 2.0 for devices. Agency practice presages it. Intense cooperation with third parties to develop new sources of RWE and deploy them for regulatory decisions presages it. The statutory authority remains broad and arcs in that direction. And, perhaps most importantly, the need is clear. The FDA itself remains unable to give adequate attention to the sheer volume and variety of new devices. If vogue ideas like RWE, RWD, and total product lifecycles are to gain real traction, formalizing and inviting third-party participation seems crucial.

10.4 Potential Obstacles and Future Research

While the law may not be an immediate obstacle to creating a DESI 2.0, industry, institutional, and scientific obstacles remain. For starters, medical device manufacturers are likely to challenge any such initiative in Court. In Hynson, industry contested the agency’s authority to adopt summary procedures, which the Supreme Court upheld. In recent years, lower courts have, at times, endorsed exceedingly low standards for what constitutes “substantial evidence.”⁷⁰ If a mere scintilla of evidence was sufficient to trigger a formal evidentiary hearing before any decision to withdraw a device from the market, any efficiencies to be gained from third-party reviews would be seriously undermined.

A second set of obstacles is more institutional in nature. On one hand, the external academic researchers affiliated with NEST have incredible credentials, but it is not obvious that they command the level of deference from the FDA that the NAS/NRC once did. Elite universities have established relationships with the FDA;⁷¹ how critically these academic units would approach the task of generating robust new evidence and, when warranted, reversing prior agency decisions, is not known. In this regard, potential conflicts of interest (especially financial conflicts) are a potential concern. The work of FDA advisory committees has been plagued by conflicts, so ensuring that a DESI 2.0 retains a strong independence⁷² with respect to each device evaluated may prove critical to the initiative’s success. More generally, nongovernment certification has a spotty track record, from longstanding critiques of Joint Commission accreditation of hospitals for Medicare,⁷³ to familiar critiques of third-party certification of “meaningful use” for electronic health records (EHRs),⁷⁴ to more recent critiques of the Federal Aviation Administration (FAA) allowing Boeing to self-certify its 737 Max aircraft (later recalled after multiple crashes).⁷⁵ These examples demonstrate the need for traditional regulatory compliance monitoring and enforcement as a backstop to any third-party recommendations.⁷⁶

Thirdly, there are also scientific obstacles to implementing a DESI 2.0. As noted above, standards for generating RWE from a variety of real-world data are a work in progress. There is serious scientific debate about the strength of different kinds of RWE for different types of health interventions, not to mention when such evidence should motivate regulatory action. Anticipating these debates, the major trade associations like AdvaMed and BIO have commented on the FDA’s use of RWE.⁷⁷ Committing DESI 2.0 to transparency – in terms of the data it generates, its analyses, and recommendations – can serve not only to enhance trust, but also to refine scientific standards.⁷⁸

DESI was a watershed moment in the history of medical product regulation, using outside review panels to evaluate evidence of clinical efficacy for thousands of products. Although DESI was encouraged by watershed legislation, the Kefauver-Harris Amendments did not clearly authorize it. Today, the FDA is being pushed toward lifecycle regulation and reliance on so-called “real world evidence” to evaluate products. Whether this shift is successful or not depends, we think, on whether the FDA can learn important lessons from the DESI experiment with pharmaceuticals in the 1960s–80s. In particular, third parties may be useful not only in generating RWE on specific products but also evaluating such evidence to support the FDA’s regulatory decision making.

11 Digital Home Health During the COVID-19 Pandemic Challenges to Safety, Liability, and Informed Consent, and the Way to Move Forward

Sara Gerke

11.1 Introduction

Artificial intelligence (AI) and other digital health products, such as smart pills, are rapidly entering clinical practice.¹ We live in the age of big data, where massive amounts of data are collected and used to develop or update digital health products and are shared with third parties for research or commercial purposes. Moreover, we can already see a shift in health care from hospitals to people’s homes, for example through the use of medical apps, Fitbits, and other wearables. This line between clinic and home will likely become more and more blurry in the near future. According to one estimate, the smart home health care market size is projected to grow from $6.1 billion in 2018 to over $30 billion in 2025.²

In particular, the COVID-19 pandemic has propelled the adoption of health AI and digital health across multiple applications.³ For example, the development and use of digital home health products have been expedited to reduce exposure to the coronavirus SARS-CoV-2, such as through remote patient monitoring, and to better control its spread, such as through exposure-notification apps.⁴ At the same time, the regulation of medical devices is more flexible during the public health emergency. However, the acceleration of launching new digital home health devices on the US market combined with less regulatory oversight also raises some challenges, including post-pandemic questions.

In this chapter, I will first give an overview of the promise of digital home health. I will then discuss the regulation of digital home health before and during COVID-19 in the context of the US Federal Food, Drug, and Cosmetic Act (FDCA). This will be followed by a discussion of three digital home health challenges during the pandemic: 1) safety, 2) liability, and 3) informed consent. In this context, I will also make suggestions on how to move forward.

11.2 The Promise of Digital Home Health

The term “digital health” is broadly defined by the US Food and Drug Administration (FDA) and encompasses categories such as telehealth, health information technology, mobile health, AI/machine learning, wearable devices, and precision medicine.⁵ Digital health technologies harness software, connectivity, sensor, and computing platforms for health care and associated uses.⁶ They are used for several applications, ranging from general wellness to medical devices.⁷ The hope is that digital health will revolutionize health care by enabling precision medicine, increasing quality, improving access, and reducing costs and inefficiencies.⁸

I define “digital home health” as digital health that is related to the patient’s or consumer’s home. The term “home” has a broad scope here. It encompasses patients’ or consumers’ homes in the narrow sense of the term, such as their apartment, house, and so forth. In addition, it also refers to any other location in which there is no personal contact with and direct supervision by a health care provider. For example, digital home health includes telehealth visits as the conversation between the physician and the patient is virtual. It also refers to general wellness apps, such as an app for weight management,⁹ and mobile medical apps, such as an app that detects heart function irregularities,¹⁰ used by consumers or patients. Another example is COVID-19 exposure-notification apps that consumers use – without physicians’ supervision – to receive notifications in cases where they may have been exposed to SARS-CoV-2. The term also covers remote patient monitoring – regardless of whether the monitoring takes place in the patient’s apartment or house or even in a hospital – since the data are collected remotely and transferred digitally, and thus there is no personal contact with and direct supervision by a health care provider.¹¹

Digital home health holds great promise in enabling patients to self-manage their health issues, keeping them out of the hospital as long as possible, and easing the already overburdened health care system. More than sixty million Americans (who are over sixty-five or younger people with disabilities or certain conditions) are already receiving insurance coverage by Medicare, and it is expected that this number will further increase to more than eighty million beneficiaries in 2030.¹² As the American population is aging, digital home health can serve as a useful tool to help patients to stay independent as long as possible.¹³ For example, Best Buy Health offers assisted living technology, including remote patient monitoring devices placed in people’s home.¹⁴ A recent study predicts that the global remote patient monitoring market will increase from $23.2 billion in 2020 to $117.1 billion by 2025.¹⁵ Remote monitoring devices can collect a variety of health data, including body temperature, pulse rate, blood pressure, respiration rate, and weight. Digital home health can be used for various applications, such as fall prevention and detection, memory aids, and nutrition, diet, or health status monitoring.¹⁶ For example, researchers at the Massachusetts Institute of Technology developed a radio-frequency-based system, BodyCompass, that provides sleep posture monitoring overnight in a person’s home.¹⁷ This system may be applied to track Parkinson’s disease progression, reduce apnea events, or avoid bedsores after surgery. In the era of big data, people are also increasingly using apps, fitness trackers, and other wearables to manage their health.

In particular, the COVID-19 pandemic has only highlighted the potential of digital home health. Over the last one and a half years, the development and launching of digital home health products on the US market have been accelerated to ease overcrowding in the hospitals and reduce personal contacts between patients and physicians and the risk for infection with SARS-CoV-2.¹⁸ For example, physicians can use Alivecor’s KardiaMobile 6L, an electrocardiogram device, to measure QTc in patients both at home and in the hospital for the duration of COVID-19.¹⁹ Moreover, telehealth rates have skyrocketed. For example, from March through June 2020, more than 34.5 million telehealth services were delivered to Medicaid and Children’s Health Insurance Program’s beneficiaries, suggesting a 2,632 percent growth compared to the same time in 2019.²⁰

11.3 Regulation of Digital Home Health

11.3.1 Pre-COVID-19

The FDA regulates digital home health products if they are classified as medical devices under FDCA Section 201(h). This is usually the case when such a product is

intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man … and which does not achieve its primary intended purposes through chemical action within or on the body of man … and which is not dependent upon being metabolized for the achievement of its primary intended purposes.²¹

Software plays an essential role in digital home health. There are three different software types associated with medical devices:

1. 1. Software as a Medical Device (SaMD) – that is, standalone software that is a medical device on its own;

2. 2. Software in a Medical Device (SiMD) – that is, software, which is integral to a medical device; and

3. 3. software used in the maintenance or manufacture of a medical device.²²

In particular, a variety of digital home health medical devices are SaMD. For example, AliveCor’s Kardia Band System is SaMD that is intended to store, record, and transmit single-channel electrocardiogram rhythms and detect the presence of normal sinus rhythm and atrial fibrillation.²³ The Kardia Band System consists of a watchband with a sensor, the Kardia phone app software installed on the Apple iPhone, and the Kardia watch app software installed on the Apple Watch.²⁴ Other examples are Apple’s Electrocardiogram App²⁵ and Apple’s Irregular Rhythm Notification Feature,²⁶ both of which are SaMD and intended for use with the Apple Watch.

There are three different classes of medical devices – that is, Class I, Class II, and Class III. While Class I medical devices have the lowest risk, Class III medical devices have the highest risk. Depending on the class, medical devices are subject to general controls (all classes), special controls (Class II), and premarket approval (PMA, Class III) to ensure reasonable assurance of their safety and effectiveness.²⁷ In particular, there are three main premarket pathways for medical devices:

1. 1. 510(k)/clearance – for Class I or II devices, unless exempt;

2. 2. De Novo Classification Request – for novel medical devices of low/moderate risk; and

3. 3. PMA – for Class III medical devices.²⁸

Digital home health medical devices can be found in all premarket pathways. For example, AliveCor’s Kardia Band System is a Class II medical device that received FDA clearance via the 510(k) pathway in November 2017 as the first device add-on for the Apple Watch.²⁹ Apple’s Electrocardiogram App and Irregular Rhythm Notification Feature are also Class II medical devices, and both received FDA marketing authorization via the De Novo pathway in September 2018.³⁰

Some digital home health products are not classified as medical devices under the FDCA and hence are not subject to FDA regulation. The 21st Century Cures Act, signed into law in December 2016, introduced FDCA Section 520(o), which excludes certain medical and clinical decision support software from the medical device definition.³¹ In the context of digital home health products, Section 520(o)(1)(B) is relevant:

The term device, as defined in section 201(h), shall not include a software function that is intended … for maintaining or encouraging a healthy lifestyle and is unrelated to the diagnosis, cure, mitigation, prevention, or treatment of a disease or condition.

This exception covers digital home health products with a general wellness intended use that maintains or encourages a “general state of health or a healthy activity.”³² For example, apps used by consumers for weight management, relaxation or stress management, physical fitness, self-esteem, sexual function, mental acuity, or sleep management are not considered medical devices, as long as they are not related to “the diagnosis, cure, mitigation, prevention, or treatment of a disease or condition.”³³ The FDA also does not regard most software apps and systems for public health surveillance and communication as medical devices, such as COVID-19 exposure-notification apps.³⁴ Moreover, software for videoconferencing intended for use in telehealth is also not a medical device under the FDCA and thus is not subject to FDA regulation.³⁵

For low-risk software functions that are medical devices or may meet the medical device definition, the FDA also intends to practice enforcement discretion and thus does not intend to enforce compliance with the requirements under the FDCA.³⁶ An example is software functions that guide users through questionnaires of symptoms and signs to recommend the most appropriate health care facility for their needs.³⁷

11.3.2 During COVID-19

During the COVID-19 pandemic, there are two other pathways for digital home health medical devices available: 1) Emergency Use Authorizations (EUAs) and 2) COVID-19 guidance documents.

11.3.2.1 EUAs

The FDA can issue EUAs for medical devices during COVID-19. In February 2020, the then Secretary of Health and Human Services Alex Azar determined a public health emergency³⁸ and, based on this determination, has issued the following three EUA Declarations related to medical devices:

1. 1. “in vitro diagnostics for detection and/or diagnosis of the novel coronavirus”;³⁹

2. 2. “personal respiratory protective devices”;⁴⁰ and

3. 3. “medical devices, including alternative products used as medical devices.”⁴¹

Due to the broad scope of the latter EUA Declaration, the FDA can issue EUAs under FDCA Section 564 for unapproved or uncleared digital home health medical devices for commercial distribution or for unapproved or uncleared uses of approved or cleared digital home health medical devices.⁴² This is the case if the following four criteria are fulfilled:

1. 1. serious or life-threatening condition or disease;

2. 2. evidence of effectiveness;

3. 3. benefit/risk analysis; and

4. 4. no alternatives.⁴³

The first criterion is met during the COVID-19 pandemic – SARS-CoV-2 can cause COVID-19, a serious or life-threatening disease. The second criterion requires a “may be effective” standard as evidence, and thus a lower level than an “effectiveness” standard.⁴⁴ More precisely, it must be “reasonable to believe” that the digital home health medical device “may be effective” to treat, diagnose, or prevent COVID-19.⁴⁵ The third criterion is given if it is “reasonable to believe” that the potential and known benefits of the digital home health medical device outweigh its known and potential risks, taking into account the material threat posed by SARS-CoV-2.⁴⁶ For both the second and third criteria, the assessment must be “based on the totality of scientific evidence available,” including – if available – data from well-controlled and adequate clinical trials.⁴⁷ Lastly, the fourth criterion is fulfilled when there is “no adequate, approved, and available alternative” to the digital home health medical device for treating, diagnosing, or preventing COVID-19.⁴⁸ An approved alternative may be considered “unavailable” if there are insufficient supplies to fully encounter the emergency need and may be considered “inadequate” if SARS-CoV-2 is or may be resistant to it.⁴⁹

With the issuance of an EUA, the FDA may also, for example, waive the requirements concerning current good manufacturing practice.⁵⁰ An EUA can be revised or revoked under specific conditions, such as when the issuance criteria are no longer met.⁵¹ In general, an EUA also becomes ineffective with the termination of the Secretary of Health and Human Services’ corresponding EUA Declaration.⁵²

The FDA has already issued EUAs for digital home health medical devices, namely for certain wearable or remote patient monitoring devices to help reduce personal contacts between patients and health care providers and thus exposure to COVID-19.⁵³ For example, in April 2020, the FDA issued an EUA for VitalConnect’s VitalPatch Biosensor.⁵⁴ This wireless remote monitoring system is intended to be used by health care professionals to detect QT interval changes of an electrocardiogram in adult COVID-19 patients who are not in the ICU but are undergoing treatment with drugs that may cause arrhythmias.⁵⁵ The device is used in the hospital setting to remotely monitor such patients to decrease health care professionals’ exposure to SARS-CoV-2.⁵⁶ VitalPatch Biosensor is a 510(k)-cleared device for continuous collection of physiological data in health care settings and in the patients’ homes.⁵⁷ However, its clearance does not include the use for automated arrhythmia detection of an electrocardiogram’s QT interval.⁵⁸ Thus, the FDA authorized here an emergency use of a cleared device for an uncleared use.

11.3.2.2 COVID-19 Guidance Documents

The FDA has released numerous enforcement discretion guidance documents related to digital home health medical devices that apply during the COVID-19 pandemic.⁵⁹ These guidance documents represent the agency’s current thinking and should be seen as nonbinding recommendations, unless particular statutory or regulatory requirements are cited.⁶⁰

For example, the FDA issued a guidance document for certain legally marketed noninvasive remote monitoring devices to help expand the capability and availability of such devices to facilitate patient monitoring, while decreasing health care provider and patient contact and exposure to SARS-CoV-2.⁶¹ This guidance document contains a list of applicable device types, such as breathing frequency monitors, noninvasive blood pressure measurement systems, cardiac monitors, and oximeters.⁶² All of these devices can be connected to a wireless network through, for example, Wi-Fi or Bluetooth to transfer a patient’s collected health data directly to the health care provider or another monitoring party.⁶³ Some of these devices also apply algorithms.⁶⁴ The guidance document states that, during the public health emergency, the FDA does not intend to disapprove of limited modifications to claims, functionality, indications, software, or hardware of the listed devices, without prior 510(k) submission, where this premarket notification submission would usually be necessary.⁶⁵ Suppose a noninvasive remote monitoring device was previously marketed exclusively for use in hospitals. During the COVID-19 pandemic, the manufacturer can modify the device for use in the home setting without submitting a 510(k).⁶⁶ In addition, the FDA also clarifies that the agency does not anticipate to enforce compliance with the special controls for two device types listed in the guidance document, namely non-electroencephalogram physiological signal-based seizure monitoring systems and computerized cognitive assessment aids.⁶⁷ The guidance document also contains recommendations, such as on labeling, and emphasizes that the modification of a legally marketed noninvasive monitoring device must not create an undue risk.⁶⁸

Another example of a COVID-19 guidance document related to digital home health medical devices is for certain noninvasive maternal and fetal monitoring devices.⁶⁹ This enforcement policy aims to foster monitoring of pregnant women at home during COVID‑19, while decreasing potential exposure for health care providers and their patients to SARS-CoV-2.⁷⁰ Some of these devices can be connected to Wifi or Bluetooth to directly transmit the measurements, such as the fetal or maternal heart rate, to the patient’s health care provider or another monitoring party.⁷¹ The FDA clarifies that 510(k)-cleared noninvasive maternal and fetal monitoring devices listed in the guidance document can be modified to a limited extent in their functionality, indications, software, and/or hardware without submitting a new 510(k).⁷² This only applies, however, when the modification of the device does not create an undue risk.⁷³ This guidance document also contains recommendations, such as on labeling.⁷⁴ Other examples of COVID-19 enforcement discretion guidance documents related to digital home health medical devices include guidance for digital health devices for treating psychiatric disorders⁷⁵ and guidance for remote ophthalmic assessment and monitoring devices.⁷⁶

11.4 Discussion

While the acceleration of launching new digital home health products on the US market or modifying legally marketed devices is needed to address the COVID-19 pandemic, it also raises several challenges. In the following, I will discuss three of them, namely safety, liability, and informed consent,⁷⁷ and make suggestions on how to move forward.

11.4.1 Safety

The two additional regulatory pathways available during the COVID-19 public health emergency, namely EUAs and COVID-19 enforcement discretion guidance documents, are vital to act swiftly and combat COVID-19, but at the same time also pose safety risks. In particular, digital home health medical devices that are FDA authorized for emergency use concerning COVID-19 under an EUA have not undergone a “full” review that intends to provide reasonable assurance of their safety and effectiveness, as is the case of FDA-cleared or approved medical devices. Instead, as seen above,⁷⁸ the FDA can already issue an EUA when the digital home health medical device “may be effective” to treat, diagnose, or prevent COVID-19. Thus, an EUA does not suggest that the device is safe and effective.⁷⁹

It is imperative that – even in times of a pandemic – the FDA does not make too many tradeoffs when carrying out the benefit/risk analysis and determining whether the digital home health medical device’s potential and known benefits outweigh its known and potential risks.⁸⁰ For example, the agency has recently been criticized for its decision in March 2020 to issue an EUA for chloroquine phosphate and hydroxychloroquine sulfate for the treatment of COVID-19, when used under certain conditions, due to a lack of adequate scientific evidence at the time of issuance.⁸¹ The FDA revoked the EUA in June 2020 after case reports in April 2020 have shown death and serious heart-related adverse events in COVID-19 patients receiving these medicines.⁸² This case example also holds valuable lessons for EUAs for digital home health medical devices as it highlights the importance of a robust benefit/risk analysis based on the totality of scientific evidence even in times of crisis. In particular, more transparency in the decision-making process of EUAs is needed. For example, the FDA has issued EUAs for wearable or remote patient monitoring devices “based on bench testing and reported clinical experience,” but without giving any further information on such reports in the letters of authorization.⁸³ Thus, it would be helpful if the FDA disclosed the scientific evidence used to reach an EUA decision in more detail in its letter of authorization.⁸⁴ Transparency is crucial to promote public trust in the agency, which has been tremendously shaken during the COVID-19 pandemic, such as most recently in vaccines.⁸⁵

There are likely additional safety risks when the development of digital home health products – devices and non-devices – is rushed to quickly put them on the market in response to the COVID-19 pandemic. In particular, digital home health products are prone to false-positive results that may be caused, for example, by inaccurate measurements.⁸⁶ Suppose an authorized remote monitoring device for emergency use under an EUA is used in the hospital to monitor a COVID-19 patient remotely, thereby reducing clinicians’ exposure to SARS-CoV-2, and has too many false positives due to its rapid development. Suppose the device alerts the patient’s physician each time it detects an irregular heart rhythm. Thus, due to the high false-positive ratio, the device sends several false alerts, which can easily lead to alert fatigue of the physician.⁸⁷ Moreover, digital home health products also bear the risk of false-negative results. If the device in the hypothetical example fails to detect an irregular heart rhythm, the patient’s treatment may be delayed, and this can have adverse effects on the patient’s health.⁸⁸

The COVID-19 guidance documents related to digital home health medical devices mainly apply to certain limited modifications of particular legally marketed devices.⁸⁹ Thus, in general, the risks associated with such modifications may likely be lower than the risks associated with EUAs, which may also authorize emergency use of uncleared or unapproved medical devices.⁹⁰ In addition, the COVID-19 guidance documents contain an additional safeguard as the limited modifications must not create an undue risk.⁹¹ Nevertheless, one also needs to acknowledge that accelerated modifications of devices in compliance with the COVID-19 guidance documents bring additional risks, especially when such devices are now used in people’s homes. For example, even if patients receive instructions for home use with appropriate lay terminology,⁹² patients may over-rely on the device’s output, mishandle the device, and also not know when to seek medical help.⁹³

Many digital home health products are not considered medical devices, and thus the FDA did not review them – even before the COVID-19 pandemic.⁹⁴ Thus, it is essential that – irrespective of whether a product undergoes no review, a “light” review, or a “full” review – digital home health companies should mitigate safety risks to patients and consumers as much as reasonable. They should – during the pandemic and post-pandemic – practice “ethics by design.”⁹⁵ This approach requires, among other things, that the companies develop products that mitigate biases, adequately protect individuals’ privacy, and have proper security safeguards in place. Moreover, digital home health companies should also practice “ethics maintenance” of their products during and after the COVID-19 pandemic. This is particularly important for so-called adaptive algorithms that can learn and adapt to new conditions and therefore hold great promise to realize the full potential of AI in the future.⁹⁶ However, since these algorithms constantly learn and change, it will be crucial to make sure that the products will remain safe and effective. An “ethics maintenance” approach ensures, for instance, that companies monitor their digital home health products continuously and that the monitoring is carried out by a department other than the one that developed it.⁹⁷

On January 8, 2021, the then Secretary of Health and Human Services Alex Azar signed a proposal making some regulatory flexibilities provided during the COVID-19 pandemic permanent.⁹⁸ This proposal was published in the Federal Register on January 15, 2021, only five days before President Joe Biden’s inauguration. It intended, among other things, to exempt eighty-three Class II medical devices from the 510(k) premarket notification requirement, including several devices related to digital home health such as fetal cardiac monitors and computerized behavioral therapy devices for psychiatric disorders.⁹⁹ The proposal suggested that the 510(k) premarket notification requirement was no longer necessary for such devices to assure their safety and effectiveness because they were apparently associated with few adverse event reports.¹⁰⁰ But few adverse event reports should not be a primary reason to justify 510(k) exemptions. Digital home health medical devices interact with their user, and it can be challenging to detect issues with them straightaway.¹⁰¹ As we have seen above, digital home health medical devices are, for example, prone to false-positive and false-negative results. Patients and consumers may also over-rely on their outputs and may unknowingly not seek medical care although necessary. In a Notice from April 16, 2021, the Department of Health and Human Services and the FDA luckily withdrew, among other things, the proposed exemptions for the eighty-three Class II medical devices.¹⁰² The main reason for the withdrawal was “that the proposed exemptions and bases for them are flawed.”¹⁰³

11.4.2 Liability

The use of digital home health products during the COVID-19 pandemic also raises questions of liability. Suppose a remote monitoring device that is authorized for emergency use concerning COVID-19 under an EUA fails to detect an irregular heart rhythm in a COVID-19 patient, and the patient dies as a result. Can the manufacturer be held liable under current law? The then Secretary of Health and Human Services Alex Azar issued a Declaration under the Public Readiness and Emergency Preparedness Act (PREP Act), effective as of February 4, 2020, “to provide liability immunity for activities related to medical countermeasures against COVID-19.”¹⁰⁴

Under the PREP Act,

a covered person shall be immune from suit and liability under Federal and State law with respect to all claims for loss caused by, arising out of, relating to, or resulting from the administration to or the use by an individual of a covered countermeasure if a declaration … has been issued with respect to such countermeasure (emphasis added).¹⁰⁵

However, there is no immunity in cases of willful misconduct that proximately caused serious injury or death.¹⁰⁶ A covered person is, for example, a manufacturer of a covered countermeasure or a “qualified person” (for example, a licensed health professional or other person who is authorized to administer, prescribe, or dispense covered countermeasures under the State law in which the countermeasure was administered, prescribed, or dispensed).¹⁰⁷ The term “loss” includes, for instance, death and personal injury.¹⁰⁸ Covered countermeasures are, for example, FDA cleared or approved medical devices used to prevent, mitigate, treat, cure, diagnose, or limit the harm of COVID-19, medical devices authorized for emergency use concerning COVID-19 under an EUA, and investigational medical devices that are permitted to be used under an investigational device exemption to treat COVID-19.¹⁰⁹ Consequently, PREP Act immunity may apply in cases of digital home health medical devices authorized for emergency use concerning COVID-19 under an EUA. However, devices that are modified under the COVID-19 enforcement discretion guidance documents are not covered countermeasures, and thus there is a priori no PREP Act immunity.¹¹⁰ Further, digital home health products that are not classified as medical devices are likewise not covered countermeasures, and PREP Act immunity does not apply from the outset.¹¹¹ Such products will likely be governed under product liability law if they are defective.¹¹²

The Department of Health and Human Services Office of the General Counsel (Counsel) has emphasized in its first Advisory Opinion from May 2020 the broad scope of the PREP Act immunity.¹¹³ Even in cases where not all of the requirements are fulfilled, a “reasonably-could-have-believed” standard may confer immunity.¹¹⁴ For instance, suppose the medical product is not a covered countermeasure (for example, is counterfeit), but an individual or entity “reasonably could have believed” that it was a covered countermeasure (for example, the individual or entity has taken reasonable steps to substantiate the product’s authenticity).¹¹⁵ Such an individual or entity will not lose PREP Act immunity so long as the individual or entity complies with all other conditions of the Secretary of Health and Human Services’ Declaration and the PREP Act.¹¹⁶

If all conditions of the Secretary of Health and Human Services’ Declaration and the PREP Act are fulfilled, immunity will cover claims for loss sounding in contract and tort and claims for loss relating to compliance with federal, state, or local laws, regulations, or other legal conditions.¹¹⁷ The Counsel clarifies in its first Advisory Opinion that

immunity applies when a covered person engages in activities related to an agreement or arrangement with the federal government, or when a covered person acts according to an Authority Having Jurisdiction to respond to a declared emergency (emphasis added).¹¹⁸

The Counsel interprets such two conditions broadly.¹¹⁹ The first condition includes “any arrangement with the federal government.”¹²⁰ The second condition means “any activity that is part of an authorized emergency response at the federal, regional, state, or local level.”¹²¹ These activities can be authorized, for example, through agreements, requests for assistance, guidance, or other arrangements.¹²²

The Fourth Amendment to the Declaration under the PREP Act, published in the Federal Register on December 9, 2020, added a third distribution channel that extends liability coverage to additional private-distribution channels.¹²³ To qualify for this channel, the “Covered Person must manufacture, test, develop, distribute, administer, or use the Covered Countermeasure pursuant to the FDA licensure, approval, clearance, or authorization (or pursuant to an Investigational New Drug Application or Investigational Device Exemption), or the NIOSH approval.”¹²⁴

If liability immunity is provided to covered persons, individuals who die or suffer a serious physical injury as a direct outcome of the use or administration of a covered countermeasure may receive compensation under the Countermeasures Injury Compensation Program.¹²⁵ In order to assess whether PREP Act immunity applies, each case will need to be evaluated individually, taking into account the particular circumstances and facts. The Fourth Amendment to the Declaration under the PREP Act also clarified that the Declaration must be construed pursuant to the Counsel’s advisory opinions.¹²⁶ However, the advisory opinions only set forth the Counsel’s current views.¹²⁷ It is thus highly recommended that digital home health companies, for example, continue to apply best record-keeping practices and recording justifications for decision-making concerning devices that could be used as countermeasures to fight COVID-19.¹²⁸

Digital home health products will also continue to raise liability questions post-pandemic. In particular, health AI presents new challenges for the liability ecosystem,¹²⁹ and it will be decisive to figure out how to ensure a balanced liability system in the future.

11.4.3 Informed Consent

Informed consent is important to respect the patient’s autonomy and includes that health care providers disclose relevant information to competent patients who can voluntarily decide whether they want to accept or refuse a treatment, research study, and so forth.¹³⁰ For example, during the COVID-19 pandemic, a meaningful discussion between the physician and the patient is crucial in cases in which a wearable or remote patient monitoring device that is authorized for emergency use under an EUA shall be used in the treatment of a COVID-19 patient (for example, in a hospital setting) to help reduce personal contacts.¹³¹ Most prominently, the physician should inform the patient that the device has not undergone a “full” FDA review and that the EUA does not suggest that it is safe and effective.¹³² The physician should also explain to the patient, among other things, the significant known and potential risks and benefits of the use of the device, the patient’s option to refuse or accept its use, and available alternatives, including their benefits and risk.¹³³

The FDA requires sponsors to develop two fact sheets – one for health care providers and one for patients – that contain relevant information, such as on COVID-19, the device and its use, the device’s potential and known risks and benefits, alternatives, length of the monitoring, the device’s limitations, and an EUA.¹³⁴ An informed consent conversation between the physician and patient may also be carried out via telehealth, such as by phone or video call, to discuss, inter alia, the patient’s questions concerning the fact sheet or any other questions.¹³⁵ In particular, the current fact sheets are only available in English, and their translation in other languages would be helpful for patients who may not be fluent in English.¹³⁶ The physician also needs to communicate with the patient through a qualified interpreter to ensure that a patient with limited English proficiency can give voluntary and informed consent.¹³⁷

Transparency about the EUA and its criteria for issuance is essential to promote trust in the physician-patient relationship. The same applies to post-pandemic scenarios. Regardless of the legal requirements, the clinical translation of new technologies like AI and wearable or remote patient monitoring devices can only succeed if health care providers are frank with their patients from the outset about the technology’s use, its benefits, and shortcomings.¹³⁸ The era of big data also requires that physicians are adequately educated about AI and digital health, including scientific, ethical, and legal considerations. Education in this field is crucial so that physicians can, for instance, explain to their patients what AI is, with what type of data the algorithm was trained, what data is collected and shared with third parties, and why it is shared. Moreover, this knowledge will not only help physicians to identify the best available treatment option for their patients but also to recognize potential biases in an AI/machine learning system.

Another challenge of most digital home health products is user agreements. For example, in response to COVID-19, Apple developed together with the White House, the Centers for Disease Control and Prevention, and the Federal Emergency Management Agency, a COVID-19 screening tool app. This app aims to help users understand what steps to take next about COVID-19, such as self-isolating. However, with the app’s installation or use, users also agree to be bound by the terms of Apple’s software license agreement. The issue with user agreements is that they are lengthy and difficult to understand, especially for nonlawyers. In contrast to an informed consent conversation between a physician and patient, a user agreement is nonnegotiable, and the user either accepts it or has to refrain from using the app.¹³⁹ In addition, user agreements often change. Moreover, in most cases of digital home health apps, such as in the case of Apple’s screening tool app, sensitive data are collected. Such data may then be shared with third parties for different purposes, including commercial ones.¹⁴⁰

Thus, during the COVID-19 pandemic and after the pandemic, more transparency is needed concerning software license agreements and the respective privacy policies when users install and use digital home health apps, such as COVID-19 exposure-notification apps, wellness apps, and mobile medical apps. App developers can do a better job in making the terms more accessible to the average user. For example, icons and a few sentences with lay terminology could be additionally used to present relevant information – such as the app’s goal, information to data collection, use and sharing, and cybersecurity safeguards – to users once they have installed and opened the app. If this key information changes (for example, the app is now sharing data with third parties for commercial purposes), users should be notified in a similar manner so that they can make an informed decision about whether to continue using the app. User-friendly design options not only increase transparency, but also promote user trust in companies, which is necessary to ensure the success of digital home health in the future.

11.5 Conclusion

Digital home health holds great promise in enabling individuals to manage their own health. However, the adoption of digital home health products has been hastened during the COVID-19 pandemic to reduce exposure to SARS-CoV-2. This acceleration has also raised several challenges, including safety, liability, and informed consent. It is important that the identified issues are dealt with as best as possible during the COVID-19 public health emergency and will be overcome post-pandemic to release digital home health’s full potential in the future.