In the 1980s, ERPs and EHRs ushered in the modern age of healthcare IT. Today, clinical care, patient safety, and quality improvement are almost entirely handed off to computers.

Still, despite the array of communication technologies available, there is no universal way of managing and transferring healthcare data.

The top obstacle hindering smooth data exchange has been the disorderly adoption of healthcare data standards for storing, encoding, and sharing clinical information.

While the federal government has been moving forward with integrating healthcare systems, the need to navigate the many healthcare IT standards stands firm.

This blog post lists vital healthcare IT standards and regulations for healthcare software companies and medical organizations to keep in mind when developing and rolling out healthcare technology. Let's dive in!

Healthcare IT Standards Governing Data Security

HIPAA

What once started as an act protecting health insurance for workers who lost their jobs, HIPAA, or Health Insurance Portability and Profitability Act, is now probably the best-known piece of legislation protecting healthcare information. It sets standards for storing, sharing, managing, and recording personally identifiable health information (PHI). So, any entity involved in operating healthcare data or provisioning software dealing with such data must ensure the necessary health information technology regulations are met.

HIPAA consists of several components:

The ones bound to healthcare software are Security, Privacy, and Breach Notification Rules.

HIPAA Security Rule

The security rule outlines safeguards for protecting PHI and spans three parts: technical, physical, and administrative safeguards.

Technical safeguards:

The technical safeguards require healthcare organizations to encrypt electronic PHI once it travels beyond internal servers. Organizations are free to choose appropriate means for implementing the following requirements:

Physical Safeguards:

The physical safeguards focus on securing physical access to PHI and lay out measures for securing mobile devices and workstations. Healthcare organizations are required to implement:

Administrative Safeguards:

The administrative safeguards lay down high-level measures for PHI protection. They require:

HIPAA Privacy Rule:

The Privacy Rule of the HIPAA healthcare data standard outlines measures on how PHI can be used and disclosed. Under the Privacy Rule, healthcare organizations are supposed to:

HIPAA Breach Notification Rule

The Breach Notification Rule requires healthcare organizations to notify patients if their PHI is compromised. It also requires entities to promptly notify the Department of Health and Human Services of PHI breaches and issue a notice to the media if the breach affects more than five hundred patients.

HITECH

The Health Information Technology for Economic and Clinical Health Act was signed in 2009. The new healthcare IT regulation aimed at promoting the "adoption and meaningful use of health information technology" and set stricter enforcement of HIPAA. The act requires healthcare providers to run security audits to investigate if they comply with HIPAA's Privacy and Security rules. So, HITECH may be considered an enforcement wing of HIPAA.

The healthcare IT regulation also provides financial incentives for healthcare organizations to negate the cost of switching to EHR and stricter data security requirements and penalties for both healthcare providers and software vendors.

Under HITECH, patients must be notified of unauthorized access to their data, and personal health information can only be shared via secure methods.

GDPR

The General Data Protection Regulation is one of the critical healthcare IT regulations that controls all issues data in the EU, and health information falls within its scope. It's worth remembering that GDPR applies not only to organizations based in the EU but also to those outside it in case they target EU-based individuals. The critical steps for an organization to take for ensuring GDPR-compliance span:

Healthcare IT Regulations Controlling Medical Devices and Software as a Medical Device (SaMD)

FDA

The US Food and Drug Administration regulates everything from food to drugs to cosmetics. What is of interest to healthcare IT vendors is that the entity vets and sets health IT standards for medical devices and software applications that function as medical devices.

Thus, if your software is involved in carrying out a medical task and unintended use of this software is bound to high risks, you will need to get an FDA clearance. An example of software that falls under FDA regulations could include an application that helps control inflation and deflation of a blood pressure cuff or a mobile app that directs insulin delivery on an insulin pump. You may check all features that make your product subject to FDA approval here.

On the other hand, if your software does not meet the definition of a medical device or poses a low risk to the public, chances are you won't need to apply for FDA approval. Applications excluded from FDA certification may include mobile apps that help patients self-manage their conditions without providing specific treatment suggestions or those assisting healthcare providers in automating their daily tasks.

To get FDA approval,

Classify your software or device at the start of your healthcare app development journey. Depending on your product's features, it may fall under class I, II, or III, which determines the medical software regulations to execute.

The class a device falls into depends on its intended use and, more importantly, its risks. Class I spans devices with the lowest risk and class III — those with the highest.

To determine the product class, you may go directly to the classification database and search for the device by name. Alternatively, you can go to the panel listing and search by a panel or medical specialty your device belongs to.

Additionally, since up to 74% of class I devices are exempt from the premarket notification process, check whether it's the case with your product by searching it up on the Medical Device Exemptions page.

And if you are developing a medical device or SaMD with a completely novel intended use, we recommend contacting FDA directly to discuss what healthcare information technology regulations may apply.

Medical devices of class I require implementing general controls, namely:

  1. Establishment registration and medical device listing (21 CFR Part 807)
  2. Quality system regulation (21 CFR Part 820)
  3. Labeling requirements (21 CFR Part 801)
  4. Medical device reporting (21 CFR Part 803)
  5. Premarket notification (21 CFR Part 807)
  6. Reporting corrections and removals (21 CFR Part 806)
  7. Investigational device exemption requirements for clinical studies of investigational devices (21 CFR Part 812)

Class II devices require implementing the general controls above, special controls, and premarket notification.

Class III devices require implementing general controls and premarket approval. Once you get the required documentation ready, submit it for consideration.

Note: As of the beginning of 2022, the entity is drafting guidance regulating digital health technologies for remote data acquisition and clinical investigation. The guidance is not yet finalized, but we will keep an eye on it.

Healthcare Content Structure Standards

HL7

Developed by Health Level Seven International, a non-profit entity that provides a framework and related health information regulations, HL7 handles the exchange of medical data between disparate healthcare systems.

The standard is the backbone of EHR. Since EHR is a distributed system that depends on a smooth interaction between multiple subsystems to make up a specific healthcare process, HL7 serves as a link between those subsystems.

There are two versions of the HL7 healthcare IT standard.

HL7 version 3 has been adopted primarily for applications without legacy communication requirements, with no historical usage of HL7 version2, or in regions with strict governmental requirements for HL7 v3 usage.

Both versions of the healthcare data standard coexist, and it is pretty common to have several versions of the standard deployed simultaneously at the same institution.

Message Transportation Standards

FHIR

Built upon HL7, Fast Healthcare Interoperability Resources describe data formats and APIs for electronic health records.

The standard provides a set of HTTP-based RESTful APIs to let healthcare providers share data in XML and JSON formats. The standard is applicable in various settings, from mobile apps to cloud applications to EHR-based data sharing.

An essential element of FHIR is a resource. Depending on its type, a resource can contain data about patient demographics, medications, care plans, allergies, and more. When combined, resources make up varied clinical and administrative workflows.

Despite healthcare providers' mixed reactions towards FHIR maturity, FHIR is projected to take over other healthcare data exchange standards by 2024. The reason is that FHIR offers a possibility to build standardized applications for accessing healthcare data — no matter which EHR underpins the infrastructure.

DICOM

DICOM, or Digital Images and Communications in Medicine, facilitates the exchange of medical images and related data across software and hardware. Compared to standard image files, like JPEG or TIFF, that do not feature data about a picture's context, DICOM files have a more complex structure. They contain metadata that gives insight about a patient and image acquisition parameters.

The systems DICOM applies to are manifold: from CT and MRI scanners to picture archiving and communication systems (PACSs) to radiology information systems (RISs).

Key Things to Keep in Mind When Dealing With Healthcare Technology Solutions

The pandemic has driven many healthcare organizations and health startups to think digital-first. As a result, the number of technology solutions entering the healthcare market has increased considerably. As a provider and a user of healthcare technology, what can you do to ensure the solutions in question meet all of the needed healthcare IT regulations? We've compiled a list of the essential tips to keep in mind.

Tips for Healthcare Tech Vendors:

Tips for Healthcare Organizations:

To ensure that the technology you use complies with all the necessary medical software regulations, it is crucial to establish a comprehensive organization-wide compliance program.

Instead of a Conclusion

As healthcare technology approaches its momentum and innovative techs like medical AI, IoMT, and RPA gain more attention, regulating agencies work on elaborating the set healthcare IT standards. As the standards get more precise and complex, it can become quite tricky for medical startups and healthcare organizations to find what's relevant for their product and maintain compliance.

So, if you want to develop a healthcare solution that checks all of the needed compliance boxes, contact ITRex experts. We will help you achieve top safety and uncompromised security.

Co-published here.