free mHealth Checklist

mHealth Pathways provides detailed information for each step.
Register for an Advanced account at www.clearroadmap.com to subscribe.
© Copyright 2014 | Carver Global Health Group LLC. | All rights Reserved.
FREE
mHealth Checklist
Familiarize yourself at a high-level with the US legislative
rules and regulatory requirements for mHealth solutions.
mHealth Introduction
mHealth has recently been categorized by the Federal Government into these three categories.
These categories include Administrative, which covers billing and claims payments, Health
Management which are the clinical mobile applications, and mobile medical device which are
medical devices approved by FDA.
While the FDA does not regulate fitness and health information tracking applications, other
Federal Regulations and State Legislation may apply. It is important to correctly deal with
these regulations.
The mHealth Checklist will provide the insights to categorize your device within the three
primary health information technology categories:
 Health Administration
 Health Management
 mobile Medical Devices
Some applications may require certification, while others may require regulatory approval. To
protect your company and patient information, all mHealth applications require some level of
adherence to Federal and State regulations.
Does your mHealth app require custom made hardware?
At this step you need to decide if your application is integrated into a custom made hardware,
generic mobile platform, or if your application operates on industry platforms/hardware
designed to support mobile health.
If your application is integrated into a custom made hardware
-> then proceed to the "Communications" step.
If your application is based on industry platforms/hardware designed to support mobile
health
-> then proceed to "Privacy & Security" step.
Communications

Electronic communications in the United States, such as frequency and broadband is regulated by the
Federal Communications Commission (FCC)
(FCC - CFR, Title 47 – Telecommunications, Chapter I -, Subchapter A – General)
At this step you will need to:
 Research: Regulations to identify those which apply - See Guidance’s and URLs below.
(e.g. if you are a mammography device, transmitting device for implants such as
pacemakers, or wireless health monitoring watch).
 Develop: Build quality into the development of your product by establishing processes,
procedures and corporate culture towards product validation and verification. This in the
long-term reduces costs and burdens associated with changing processes to meet
regulatory requirements and audits.
 Test: Your application and device based on the parameters you need to meet.
 Compile: The test data and other supporting information, based on the applicable
Guidance.
 Prepare for submission: Information needs to be submitted either directly to FCC or in
the case of mobile medical devices, to FDA with the relevant FCC requirements. See the
next decision diamond in this mHealth Pathway.
 If necessary, prepare for Audit: In the case of mobile medical devices, audits are
incorporated into the FDA audit process. In the case of Wireless Medical Telemetry
Devices, there could be on-site visits.
Privacy & Security
For decades the United States Federal and State governments have been legislating what
health information can be shared, to whom and in what format. The Health Insurance
Portability and Accountability Act (HIPPA), first passed in 1996, called for the establishment
of standards and requirements for transmitting certain health information to improve the
efficiency and effectiveness of the health care system while protecting patient privacy, there
have been numerous updates to the Privacy rules at a Federal Level.
Originally focused on requirements for Electronic Health Records systems (EHRs) and
electronic Prescribing (medications) systems, more recent regulatory focus include
Frameworks about implementing and managing patient Privacy and data Security.
This step is about patient data security and privacy.
At this step you need to:
 Research: The appropriate Federal Privacy & Security Requirements, to include breach
notification, cybersecurity framework and Digital/Electronic Signature.
 Understand: Your users (patient) privacy rights, to include their consent to collect, store
and share information, which means you MUST know in detail how your device executes.
 Research: The appropriate State Privacy & Security Requirements

 Research: Your potential client's (health care setting) additional Privacy & Security
processes and procedures
 Design, Develop and Implement using standards: which protect patient information,
prevent breaches and enable users to quickly assess the severity of a breach and take
appropriate actions to stop and notify affected individuals/organizations.
User Presentation & Experience
User experience is incredibly important, as it often "makes or breaks" solution adoption.
Studies show that 30% of downloaded applications are only used once. One study found that
60% of why users stop using an application is because of bad User eXperience.
At this step, you will need to evaluate your design and development for:
 Functionality: It does what it claims to do.
 Reliability: It works consistently.
 Usability: It works in a way that is consistent with the user's expectations.
 Barriers: It is available and functioning based on the user's needs.
 Meaningful: It does something important or valuable.
 Pleasurable: It is enjoyable to use.
 User mobile device literacy: Users understand how to interact with the device.

Decide if your device is a mobile medical device
At this step you need to decide if your mHealth app could be considered a mobile medical
device, which is regulated by the Food and Drug Administration (FDA).
This is a critical step in the whole process because the decisions you make here dramatically
affect the level of regulatory scrutiny and compliance your solution will need to follow.
(Section 618 of the Food and Drug Administration Safety and Innovation Act (FDASIA), Public Law 112-144)
FDA has been regulating software in medical devices for over 20 years. Software residing on
mobile platforms, such as smartphones, is just another platform on which medical devices can
function.
If your mobile app meets the FDA definition of a device
–> then proceed to "FDA Requirements”
If your mobile app does not meet FDA definition of a device
-> then proceed to "Assess Admin or Health Management"
Section 201(h) of the Federal Food, Drug, and Cosmetic Act (FD&C Act) defines a medical
device.
Medical Device is:
1) An instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or
other similar or related article, including a component part, or accessory which is:
 recognized in the official National Formulary, or
 the United States Pharmacopoeia, or
 any supplement to them,
Intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation,
treatment, or prevention of disease, in man or other animals, or
2) Intended to affect the structure or any function of the body of man or other animals, and
which does not achieve its primary intended purposes through chemical action within or on
the body of man or other animals and which is not dependent upon being metabolized for
the achievement of any of its primary intended purposes.
a “mobile medical app” is :
a mobile app that meets the definition of device; and either is intended:
 to be used as an accessory to a regulated medical device; or
 to transform a mobile platform into a regulated medical device.
mobile medical devices – FDA Requirements
This is the beginning of a much more intensive review and formal regulatory approval process.
This step reviews the FDA requirements for a mobile medical device.
For a more in-depth guide, please subscribe to the Pathway’s tool
https://clearroadmap.com/Home/Pricing
If you do not desire to pursue a regulatory approach, consider going back and reviewing your
application functionality.

At this step:
 Review - requirements for FDA submission
 Assemble a Team - Employees, Advisors, Investors and/or consultants, who understand
building quality products: concept, design, production, regulatory, reimbursement and
commercialization.
 Create a quality culture - quality products are a result of a corporate culture that
recognizes the importance of incorporating quality from the beginning and through the
process; not just later when it costs money to fix both product issues and corporate
culture.
FDA medical device – including mobile medical device
This step transitions from mHealth specific activities, to the FDA specific activities for
medical devices
At this step you need to:
 Research your design: How your medical device is designed has several impacts to
benefit/risk assessment and design control requirements for regulatory approval. The type
of energy utilized can impact the reimbursement codes and thus your revenue.
 Research Federal regulations: Which apply and submission process (e.g. 510k, 510k
Exempt, De Novo, PMA)
 Research your state level: Based on the state in which you develop and manufacture
your device, you may have additional state level requirements.
 Assemble an interdisciplinary Team: Consider employees, advisors, investors, and/or
consultants who have the following:
 Behavioral and health care knowledge
 Health data technology and standards
 User experience translation at task level, screen level, widget level
 Semiotic integrity of data capture, analytics and interpretation (in other words, the
icons used to depict the data capture are not accurate. Icons for Stop or Wi-Fi are
universal, yet an icon for diabetes or A1c is not)
 Federal, state and medical organization's regulations, legislation and rules
 Reimbursement strategy
 Fundraising
 Corporate development from start-up to IPO or acquisition
 Define the patient population: The target patient type will impact reimbursement. (e.g.
Adult population is either direct sales to consumers or private insurance, elderly and
disabled are primarily Medicare)
For additional details proceed to: 510k, PMA, Combination or De Novo
Pathways

Assess if your device is a Health Management or Administrative Health
This step is not in the realm of FDA regulations.
(Food and Drug Administration Safety and Innovation Act (FDASIA), Public Law 112-144)
(FDASIA Health IT Report - DRAFT - Proposed Strategy and Recommendations for a Risk-Based Framework)
Yet there are still Federal and State regulations and legislation that apply to applications built
to enable the administration of health data and the management of health information (e.g.
wellness and patient health portals).
At this step:
 Review - the definition of: Administrative Health IT and Health Management Health IT.
 Determine - the most appropriate category for your product.
 Plan - the most appropriate route(s) based on the product category.
Decide if your device is a Health Management or Administrative Health
At this step you need to choose between Administrative HIT or Health Management, based on
the assessment in the previous step.
If your application meets the definition of a Administrative HIT application
->proceed to Administrative activities below.
If your application meets the definition of a Health Management application
->proceed to Health Management activities below.
Administrative Health IT includes:
 Software intended to facilitate admissions,
 Billing and claims processing,
 Practice and inventory management,
 Scheduling,
 General purpose communications,
 Analysis of historical claims data to predict future utilization or cost effectiveness,
 Determination of health benefit eligibility,
 Population health management,
 Reporting of communicable diseases to public health agencies and reporting on quality
measures pose limited or no risk to patient safety.
Health Management Health IT (sometimes referred to as “clinical software”) includes:
 Health information and data management;
 Data capture and encounter documentation;
 Electronic access to clinical results;
 Most clinical decision support;
 Medication management (electronic medication administration records);
 Electronic communication and coordination (e.g. provider to patient, patient to
provider, provider to provider, etc.);
 Provider order entry;

 Knowledge (clinical evidence) management;
 Patient identification and matching.
Health Management - HIT - Standards
This step reviews the HIT Standards, which apply to clinical data and transmission standards.
Some applications will require these for certification, such as Electronic Health Records
(EHRs)
Having your process and end product adhere to the relevant HIT Standards, future proofs it for
the evolving world of integrated health care.
For example the Affordable Care Act is moving American medical practices towards more
integrated health care, which also applied to medical devices.
At this step:
 Comprehend and Implement - Medical data code sets
 Review and apply to product - Procedure and Utilization Codes
 Integrate Using - Interoperability and Data Standards (e.g. International Classification of
Diseases ICD-9/ICD-10, Code on Dental Procedures and Nomenclature)
Health Management - HIT – State Regulations
In addition to the Federal requirements, each state independently legislates the collection,
storage, use, and transmission of health care data.
At this step:
 Review - States regulate the practice of medicine.
 Review - States regulate and enforce of health information and HIT.
 Assess - potential impact to clients, providers and patients (e.g provider interstate
licenses).
 Analyze - impact to your current business plan, design and information sharing rules (e.g.
across state lines).
States regulate and enforce:
The use, collection and disclosure of health information.
 The maintenance of patient medical records through provider-specific licensure laws.
This may include how to maintain, and what information is required to be in the
record.
 State level privacy and confidentiality of health information, which may be stricter
than federal standards.
 When a provider may disclose personal health information (PHI). This includes
defining the purpose of the disclosure and to whom.

 States also set standards for private health insurers conducting business within the
state.
 The state portion of the Medicaid covered benefits, provider reporting requirements,
and eligibility criteria. This includes the additional state fraud and abuse laws.
 The Public Health reporting requirements for diseases and conditions which is shared
with Federal CDC. Some of the reporting uses disease-specific registries.
 Providers and health plans on performance and utilization measures. This includes the
reporting of patient safety to federal agencies.
 Health Insurance Exchanges and Health Information Exchanges laws, in alignment
with federal laws
Health Management - HIT Other Considerations
Some HIT applications require certification, while others are part of reimbursement or
incentive programs to help off-set cost and are potential sources of revenue.
At this step:
 Consider - various HIT technologies.
 Telemedicine
 Telemetry
 Patient Health Record (PHI)
 Wellness monitors
 Diet tracking
 Clinical Decision Support (CDS)
 Electronic Health Record (EHR)
 Health Information Exchanges (HIE)
 Evaluate - market and reimbursement opportunities. Identifying patient population will
define potential reimbursement opportunities
 Assess – business agreements with other entities, to include partnership
Administrative Health - Standards
Health Administration Standards are associated with Claims data, and other
administrative activities, such as scheduling appointments.
(45 CFR Part Subpart K and L Parts 162.1101 to 162.1203 Health care claims or equivalent encounter info)
The CMS (Centers for Medicare and Medicaid Services) developed the National Correct
Coding Initiative (NCCI) to promote national correct coding methodologies and to control
improper coding leading to inappropriate payment in Part B claims – which in turn can
result in legal and financial liability.
If you are building an application which will seek to help coordinate patients or health
care setting insurance transactions or other non-clinical information you need to consider
the following standards.

Some applications will combine both the clinical and administrative and then will require
both the HIT Standards and Health Administrative Standards, such as the ePrescribing,
which sends patients medication order from providers to the Pharmacy.
At this step:
Review and Implement: - the standards and codes established by law
 Health care claims or equivalent encounter information
 Referral Certification and Authorization
 Health Care Claim Status
 Enrollment and Disenrollment in a Health Plan
 Health Care Electronic Funds Transfers (EFT) and Remittance Advice
 Health Plan Premium Payments
 Coordination of Benefits
 Medicaid Pharmacy Subrogation
Review and Implement - National Correct Coding Initiative (NCCI) to promote national
correct coding methodologies.
Understand -Classification of Death and Injury Resulting from Terrorism.
Review and Implement - Interoperability and Data Standards, (e.g. Standards for health
care and claims or equivalent encounter information transaction).
Administrative Health – State Regulations
The Affordable Care Act of 2010 increased the states role and responsibility with
Medicaid and State Exchanges. These are opportunities to help states become efficient
with patient health care.
At this step:
 Review - Medicaid programs at the state level.
 Assess - Potential clients and patients. (e.g. some diseases are clustered in specific
geographic regions.
 Analyze - Impact to your current business plan, design and information sharing rules.
Administrative Health – Other Considerations
As health care reimbursement moves from services to outcomes and value based medicine.
Initiatives will continue to focus on the quality and patient outcomes.
At this step:
 Consider - current national efforts to develop value based health care system and align
application design. (across different facets of health care and disease management to align
incentives and tools)
 Analyze - Big Health data efforts for product integration.

Breach Notification
Financial and personal information breaches are frequently in the news.
In the area of health care the regulatory and legal consequences are even more significant
than in the financial area.
Therefore, it is important to understand what processes you need to be ready to follow,
when you are confronted with data breach.
At this step:
 Review - Breach Notification rules and fines from the Privacy & Security in previous
steps.
 Validate - Your product and processes are in compliance
 Implement - Processes, procedures, and training.
 Insurance - Verify your corporate liability insurance is sufficient for the risk and level of
patient data storage and exchange.
In the United States two Federal agencies and each state which regulate and enforce data
breaches. The US Health and Human Services (HHS) regulates and enforces health care
related entities as defined in HIPPA. All other entities (non-HIPPA) which support health data
are regulated by the US Federal Trade Commission (FTC). FTC mission is prevent business
practices that are anticompetitive or deceptive or unfair to consumers; to enhance informed
consumer choice and public understanding of the competitive process; and to accomplish this
without unduly burdening legitimate business activity.
Additionally, each state regulates and enforces breaches. Some state enforce similar
requirements to the Federal Agencies, while others have added additional actions. Developers
need to design and develop their applications to support clients breach notification processes.
By understanding what their clients may need, applications can be proactive in both preventing
breaches, notifying breaches and responding expeditiously.
Decide – Insurance Reimbursement or Direct Sales
At this step you need to choose between insurance based reimbursement or direct sales to
patients or practitioners.
If your application has the ability to be reimbursed with existing product codes
-> proceed to Insurance Reimbursement.
If your application does not have reimbursement codes, but can be a value to patients,
providers, hospitals or private insurance,
-> proceed to the direct sales to consumers and /or coverage determination
For additional details on coverage determination proceed to: Reimbursement
Pathways.

Insurance Reimbursement
First, determine if there are existing reimbursement codes and for which patient population
(e.g. adult employer based insurance, elderly or disabled for Medicare, or low income for
Medicaid) that can apply. Using existing codes significantly accelerates the process of
receiving approval for reimbursement.
If there are no applicable existing codes, the proceed to the process to obtain a new code can
take up to 24 months and sometimes longer.
Second, evaluate if existing codes reimburse at a level that is viable, otherwise if the product
development and infrastructure operations is more expensive than the code, alternative codes
or reimbursement / payments are needed. Or perhaps you need to change something in your
product to accommodate the lower reimbursement rates.
Lastly, Government and some private Integrated Delivery Networks (IDN) and Accountable
Care Organizations (ACOs) have the ability to reimburse based on Value Based Purchasing.
IMPORTANT!
Because this step has direct impacts on your profitability – it is important to do a preliminary
evaluation of reimbursement codes and opportunities even before you begin to develop your
mHealth solution to insure a predictable Return On Investment
At this step:
 Consider: reimbursement from Private (Employer based) Insurance.
 Consider: reimbursement from government (Federal Medicare/Medicaid, State
sponsored).
Direct Sales
Direct sales: Business –to-customers (B-C): users, patients, providers, care takers.
At this step:
 Ideal Client - Though the internet allows for broad reach, building products that target
your ideal clients will make identifying the sales easier to channel.
 Value - Identify the features which will bring the most value to your clients, rather than
all the features.
 Viral - Using social media to obtain critical mass; higher volume lower cost.
 Understand - the buying patterns and how to get them to ‘yes’ at the right time.
 Engage - patient advocacy groups or trade organizations to talk about it.
 Partner - With an organization to develop a Case study.

free mHealth Checklist

More Related Content

What's hot (18)

Similar to free mHealth Checklist (20)

free mHealth Checklist