1
,2
,Medical Devices
Some mobile apps may meet the definition of a medical device but because they pose a lower
risk to the public, the FDA intends to exercise enforcement discretion over these devices
(meaning it will not enforce requirements under the FD&C Act). One example is a mobile app
that makes a light emitting diode (LED) operate. If the manufacturer intends the system to
illuminate objects generally (i.e., without a specific medical device intended use), the mobile app
would not be considered a medical device. If, however, through marketing, labeling, and the
circumstances surrounding the distribution, the mobile app is promoted by the manufacturer for
use as a light source for providers to examine patients, then the intended use of the light source
would be similar to a conventional device such as an ophthalmoscope.
FDA Oversight for Medical Devices
The Food and Drug Administration (FDA) (2013) recognizes the extensive variety of actual and
potential functions of mobile apps, the rapid pace of innovation in mobile apps, and the potential
benefits and risks to public health represented by these apps. The FDA intends to apply its
regulatory authorities to select software applications intended for use on mobile platforms. Given
the rapid expansion and broad applicability of mobile apps, the FDA is issuing this guidance
document to clarify the subset of mobile apps to which the FDA intends to apply its authority.
Many mobile apps are not medical devices, meaning such mobile apps do not meet the definition
of a device by the Federal Food, Drug, and Cosmetic Act (FD&C Act); therefore, the FDA does
not regulate them.
, Privacy
According to Healthit.gov (2014) Protecting Your Health Information, the privacy and security
of patient health information is a top priority for patients and their families, health care providers
and professionals, and the government. This was also previously discussed under HIPAA. It also
requires that "key persons and organizations that handle health information to have policies and
security safeguards in place to protect your health information whether it is stored on paper or
electronically."
Confidentiality
Hard to maintain due to social media and use of mobile devices such as smartphones, they are
being utilized in treatment rooms around the globe, Providers need to be aware of institutional
policies regarding audio/video recordings by patient and families, requires two-party consent,
sometimes enthusiasm for patient care and learning can lead to ethics violations.
Cybersecurity
Another federal regulatory agency with a role in the privacy and security of health care data is
the Food and Drug Administration (FDA). The FDA oversees the safety of medical devices,
which includes addressing the management of cybersecurity risks and hospital network security.
Recent guidelines issued (FDA, 2013) recommend that medical device manufacturers and health
care facilities take steps to ensure that appropriate safeguards are in place to reduce the risk of
failure caused by cyberattack. This could be initiated by the introduction of malware into the
medical equipment or unauthorized access to configuration settings in medical devices and
hospital networks. The consequences of not adequately addressing these risks could be dire. As
,2
,Medical Devices
Some mobile apps may meet the definition of a medical device but because they pose a lower
risk to the public, the FDA intends to exercise enforcement discretion over these devices
(meaning it will not enforce requirements under the FD&C Act). One example is a mobile app
that makes a light emitting diode (LED) operate. If the manufacturer intends the system to
illuminate objects generally (i.e., without a specific medical device intended use), the mobile app
would not be considered a medical device. If, however, through marketing, labeling, and the
circumstances surrounding the distribution, the mobile app is promoted by the manufacturer for
use as a light source for providers to examine patients, then the intended use of the light source
would be similar to a conventional device such as an ophthalmoscope.
FDA Oversight for Medical Devices
The Food and Drug Administration (FDA) (2013) recognizes the extensive variety of actual and
potential functions of mobile apps, the rapid pace of innovation in mobile apps, and the potential
benefits and risks to public health represented by these apps. The FDA intends to apply its
regulatory authorities to select software applications intended for use on mobile platforms. Given
the rapid expansion and broad applicability of mobile apps, the FDA is issuing this guidance
document to clarify the subset of mobile apps to which the FDA intends to apply its authority.
Many mobile apps are not medical devices, meaning such mobile apps do not meet the definition
of a device by the Federal Food, Drug, and Cosmetic Act (FD&C Act); therefore, the FDA does
not regulate them.
, Privacy
According to Healthit.gov (2014) Protecting Your Health Information, the privacy and security
of patient health information is a top priority for patients and their families, health care providers
and professionals, and the government. This was also previously discussed under HIPAA. It also
requires that "key persons and organizations that handle health information to have policies and
security safeguards in place to protect your health information whether it is stored on paper or
electronically."
Confidentiality
Hard to maintain due to social media and use of mobile devices such as smartphones, they are
being utilized in treatment rooms around the globe, Providers need to be aware of institutional
policies regarding audio/video recordings by patient and families, requires two-party consent,
sometimes enthusiasm for patient care and learning can lead to ethics violations.
Cybersecurity
Another federal regulatory agency with a role in the privacy and security of health care data is
the Food and Drug Administration (FDA). The FDA oversees the safety of medical devices,
which includes addressing the management of cybersecurity risks and hospital network security.
Recent guidelines issued (FDA, 2013) recommend that medical device manufacturers and health
care facilities take steps to ensure that appropriate safeguards are in place to reduce the risk of
failure caused by cyberattack. This could be initiated by the introduction of malware into the
medical equipment or unauthorized access to configuration settings in medical devices and
hospital networks. The consequences of not adequately addressing these risks could be dire. As
