17.1 Introduction
The Food and Drug Administration’s (FDA’s) strategic vision for monitoring high-risk medical devices emphasizes the role of postmarket registries, which are databases that actively collect and maintain information about individual patient exposures.Footnote 1 Registries are cost-effective relative to traditional clinical trials and can enroll large numbers of patients to provide generalizable observations and identification of rare safety events.Footnote 2 Although they differ in their structure, study goals, and stewardship – with varying involvement of professional societies, industry, academic centers, and regulators – registries in general may facilitate advancements in device use, manufacture, and design.
Registries are particularly useful for cardiovascular devices, which make up a large proportion of novel device approvals but also are commonly implicated in recalls and adverse event reports.Footnote 3 The FDA and the Centers for Medicare and Medicaid Services (CMS) can mandate postmarket registries as a condition of marketing approval or reimbursement, respectively. To help generate timely information on device safety and effectiveness, the FDA and the CMS sometimes require compulsory enrollment with no opt-out mechanism. Although regulators provide guidance and oversight on registry design and use, there has been little evaluation of the legal and ethical implications of compulsory medical device registries. In particular, questions remain regarding the extent to which compulsory registries accord with health privacy laws and ethical standards for human subjects research.
This chapter proceeds in three parts. First, we begin by discussing the emerging and integral role of registries in the FDA’s medical device postmarket repertoire, with a focus on cardiovascular medical devices. Second, we evaluate the applicability of the Health Insurance Portability and Accountability Act (HIPAA), the Common Rule, and state laws to compulsory registries. Third, we propose additional guidance for registry development, including rules for enrolment, consent, data use, and access to data.
17.2 The Role of Registries in Postmarket Analysis of Medical Devices
17.2.1 Limitations in the FDA’s Evaluation and Monitoring of Devices
The FDA employs a risk-based regulatory framework that classifies medical devices into three categories: Class I (low risk) devices are those that pose a minimal potential for harm, such as tongue depressors and stethoscopes; Class II (medium risk) devices have a higher potential for harm, such as syringes and electrocardiograph machines; and Class III (high risk) devices have the highest potential for harm, such as pacemakers and defibrillators.Footnote 4
All three classes of medical devices are subject to “general controls,” which include, inter alia, registration, prohibitions against misbranding and adulteration, and adherence to good manufacturing practices.Footnote 5 For Class I and Class II devices where general controls are insufficient to provide a reasonable assurance of safety and efficacy, “special controls” are required, which may include, inter alia, postmarket surveillance, patient registries, and 510(k) premarket notification.Footnote 6 For Class III devices where special controls are insufficient to provide a reasonable assurance of safety and efficacy, a premarket approval (PMA) application is required.Footnote 7
The 510(k) pathway principally seeks to establish that a new device is “substantially equivalent” to a device that the FDA has already cleared for marketing. As the FDA explains, the 510(k) pathway “is comparative” whereas the PMA pathway involves “an independent demonstration of safety and effectiveness.”Footnote 8 The 510(k) process “was specifically intended for devices with less need for scientific scrutiny, such as surgical gloves and hearing aids.”Footnote 9 Over the years, however, the breadth of devices eligible for the expedited review mechanism has been expanded significantly, and only 1 percent of medical devices utilize the more rigorous PMA pathway.Footnote 10
Apart from utilization of the 510(k) pathway for some high-risk devices, other high-risk devices come to market as PMA supplements – a subset available where a new device contains changes to an already approved device.Footnote 11 PMA Supplements may be required when changes impact the safety or effectiveness of a device, including but not limited to new device indications, labeling changes, use of new manufacturing processes or facilities, changes in sterilization procedures, packaging changes, or changes in design specifications or components.Footnote 12 For devices that come to market as PMA supplements, the FDA generally does not require clinical trial data.Footnote 13 In recent years, several high-risk cardiac devices approved as PMA supplements – some of which were implanted into hundreds of thousands of patients – have been recalled due to serious safety concerns.Footnote 14
We summarize the distinctions between the 510(k) and PMA pathways here to highlight the fact that it is common for high-risk medical devices to come to market without providing the FDA with clinical trial data that demonstrates the device’s safety and effectiveness. In part these accelerated pathways to market are due to budgetary constraints – specifically, Congress has not allocated sufficient funds so that regulators have the resources to oversee and review clinical trial data. A second relevant factor is that there are significant budgetary and scientific barriers to applying robust scrutiny to a large number of devices from conception through real-world utilization (often referred to as the “total product life cycle”).Footnote 15 In other words, the cost and time to provide meaningful safety and efficacy data would translate to longer periods of time before which a new device could come to market.
These resource constraints are exacerbated by statutory requirements that the FDA utilize “the least burdensome appropriate means of evaluating device effectiveness that would have a reasonable likelihood of resulting in approval.”Footnote 16 This legal requirement – which is not found in regulations governing FDA review of pharmaceuticals or vaccines – was enacted by Congress, largely at the request of lobbyists and medical device manufacturers.Footnote 17 It forces the FDA’s hands by requiring that the agency think creatively on how to solicit the least amount of information that can illustrate device safety and efficacy. As a practical matter it translates to device approvals that, for the most part, do not require clinical trial data. The least burdensome standard applies even for high-risk medical devices such as implantable cardioverter-defibrillators (ICDs), pacemakers, and artificial heart valves.
Several observers have highlighted limitations in the current legal and regulatory framework, particularly in premarket review.Footnote 18 These critiques also extend to the postmarket surveillance scheme which, despite evolving emphasis on new strategies,Footnote 19 continues to rely significantly on passive surveillance of marketed medical devices, a mechanism that fails to adequately capture postmarket safety and efficacy concerns.Footnote 20 While passive surveillance has been able to capture some instances of patient harms due to faulty devices, underreporting is widespread, and reports submitted to the FDA’s passive surveillance database are often submitted late and lack critical information on adverse events.Footnote 21 In instances where the FDA mandates postapproval studies, studies have found that progress is often inadequate and many requirements go uncompleted.Footnote 22 Inadequate postmarket surveillance is not limited to medical devices, but also plagues postmarket evaluation of pharmaceuticals and vaccines.Footnote 23 For truly novel, transformative, and influential therapeutics, then, a robust postmarket surveillance strategy is of great importance to regulators, payors, and the public because it helps produce meaningful evidence to continuously evaluate the safety and efficacy of marketed medical products.
17.2.2 General Structure and Function of Regulatory Registries
When structured and utilized properly, registries can provide valuable information to support postmarket analysis on safety and efficacy. As noted above, the FDA can mandate registries either as a condition of approval for high-risk device (a so-called postapproval study) or as a “522 study,” which can be applied at any point in a product lifecycle.Footnote 24 Timely completion of these studies is the responsibility of device sponsors and, in theory, the FDA can withdraw marketing approval or clearance for failure to do so.
Registries defined by exposure to a specific device or procedure can generate datasets with large sample sizes that include a more diverse set of patients than those in premarket studies. Registries can include or be linked to additional clinical data, which allows for identification of information related to disease severity and comorbidities and may provide information on the device utilization outside the context of pivotal clinical trials or established guidelines. For example, studies have uncovered divergence from guidelines-based indications for ICDs and cardiac resynchronization therapy.Footnote 25 Registries can provide important insights regarding off-label use of devices, such as transcatheter aortic valve replacement (TAVR), that may guide future regulatory decisions about expanded indications.Footnote 26
Registries also play an important role in coverage decisions and subsequent requirements for evidence generation. Once FDA approval is earned, sponsors of new devices typically submit applications to the CMS to determine whether the product meets the statutory requirement of “reasonable and necessary” for reimbursement.Footnote 27 Both terms remain somewhat nebulous but together are generally understood to reflect a totality of evidence supportive of clinically meaningful benefits with an acceptable safety profile.Footnote 28
While many services (including use of new devices) are covered by the CMS automatically, in select cases, manufacturers, clinicians, or the CMS request a national coverage determination, which grants, limits, or excludes Medicare coverage nationwide.Footnote 29 A small proportion of services thought to be particularly novel, influential for Medicare beneficiaries, or otherwise identified as important from the CMS’s perspective are provided conditional reimbursement – “coverage with evidence development.”Footnote 30 In these cases, payment for services occurs only in concert with a prospective study approved by the CMS as meeting specific scientific goals relevant to safety, effectiveness, or utilization among its beneficiaries. Over the past fifteen years, more than two dozen devices or services have been subject to coverage with evidence development decisions. This includes truly novel and (for Medicare patients in particular, most of whom are aged greater than sixty-five) clinically impactful transcatheter treatments for valvular heart disease, devices for stroke prevention, and new “leadless” designs for implantable pacemakers.
17.2.3 Compulsory Registries for Cardiovascular Devices
FDA review and CMS reimbursement have brought together agencies with overlapping public health mandates to help establish several pivotal cardiovascular devices registries.Footnote 31 While the individual details and methods vary, in general these registries have met the needs of regulatory agencies to develop additional evidence specific to its intended patient population, while also providing a platform for postmarket surveillance studies assessing safety, off-label utilization, real-world outcomes, and potential expansion of indications. The exact purpose, structure, and stewardship of “regulatory registries” – that is, those created primarily to meet requirements of the FDA, CMS, or both – varies according to device. Here we describe two influential cardiovascular device regulatory registries that share the feature of compulsory enrollment.
The National Cardiovascular Data Registry (NCDR) ICD Registry was created in 2005 in concert with expansion of CMS coverage guidelines for primary prevention ICDs, which are ICDs implanted in patients without a history of cardiac arrest or sustained ventricular arrhythmias.Footnote 32 A clinical trial published in 2004 demonstrated a survival advantage for ICD implantation in patients with heart failure from left ventricular systolic dysfunction regardless of etiology, widely expanding the pool of patients eligible for an effective but expensive intervention.Footnote 33 The ICD Registry was developed by the American College of Cardiology (ACC), which manages a suite of registries under the NCDR umbrella, and the Heart Rhythm Society (HRS), a professional society for cardiac electrophysiology, with guidance from the CMS and FDA. Notably, the CMS coverage memo requires only that data be collected for Medicare beneficiaries. However, the majority of the approximately 1,500 participating sites submit data on all patients who receive ICD implants, and thus the ICD Registry serves as an excellent storehouse of postmarket information.
Several specific analytic questions were posed by the CMS as the guiding scientific goals for the ICD Registry. The overall principle was summarized in the original 2005 memo from the CMS, which indicated: “We are concerned that the available evidence does not provide a high degree of guidance to providers to target these devices to patients who will clearly derive benefit.”Footnote 34 Specific hypotheses posited to refine that position through the ICD Registry include Table 17.1:Footnote 35
Data collection is performed for over 100 data elements incorporating patient characteristics, procedural details, laboratory tests, and complications that occur within the index hospitalization. These data include multiple individual identifiers, which have facilitated linkages to other datasets such as administrative claims data as well as industry data.Footnote 36 Over one million patients have had data entered into the registry, including hundreds of thousands of patients who are not Medicare beneficiaries. There is no consent obtained and no mechanism for patients to opt-out or to view their own data. Of note, an updated Medicare coverage memo issued in 2018 ended the requirement for entry into the ICD registry as a condition of reimbursement.Footnote 37 Data from the ICD Registry has been relied upon in several publications that have analyzed safety and efficacy of ICDs, though the impact of the ICD Registry on CMS reimbursement has been less clear.
Similar motivation supports the Transvalvular Therapeutics (TVT) Registry, a partnership between the Society of Thoracic Surgeons (STS) and ACC that has been approved by the CMS to meet coverage requirements related to TAVR and transcatheter mitral valve repair. These two device types have been transformative therapies over the past several years, bringing minimally invasive options to patients previously considered prohibitive or high risk for surgical intervention and increasingly extending towards wider populations of potential recipients. The FDA worked with the CMS to structure the registry. The CMS coverage memo for TAVR echoed elements of that issued for ICDs, including the following specifications (among others) and articulated study goals Table 17.2:Footnote 38
Again, patients must be enrolled, or the facility risks nonreimbursement. In practice, this means that device recipients are automatically enrolled without consent or an opt-out mechanism. Notably, the ICD registry case report forms can generally be completed entirely from electronic or similar data sources, without the need to speak with patients. The TVT Registry form includes many of the same demographic, clinical, and procedural details as the ICD registry but also captures quality of life information. These additional data points require a brief interview with patients.
17.3 Legal Framework Governing Compulsory Medical Device Registries
There is no uniform legal framework applicable to all registries. Rather, the reach of the law – including health privacy laws and regulations governing research with human subjects – depends on the structure and function of a registry, as well as the registry steward. This is problematic, since a wide range of stakeholders creates and uses registries, including academic medical centers, not-for-profit entities, professional societies and organizations, private companies, health care payors, provider organizations, and medical device companies.Footnote 39 Divergent protections can result in use of health data in ways that contradict the expectations or interests of patients, which may exacerbate lack of trust in data use and the health care system.
17.3.1 The Scope of HIPAA Protections for Registry Data
HIPAA protections apply solely to covered entities (i.e., health care providers, health plans, and health care clearinghouses) and the business associates of these entities.Footnote 40 Several registry stewards fall outside of HIPAA’s reach entirely, so long as they do not collaborate with a covered entity, including medical device companies, patient advocacy groups, and professional societies. Registry data submitted directly from a patient to a registry steward is also not encompassed by HIPAA’s protections.Footnote 41 And, HIPAA’s limitations apply solely to protected health information, not to the collection and use of deidentified data.Footnote 42
For entities that fall under the HIPAA umbrella, the HIPAA security rule requires implementation of a reasonable security plan and security risk assessments.Footnote 43 In addition to the protections mandated under the HIPAA security rule, the HIPAA privacy rule affords protections to individuals whose health information is handled by an entity bound by HIPAA. The privacy rule requires patient authorization if health information is to be used in research, but authorization is not required if the information is to be used for public health activities.Footnote 44 Via this exception, patient authorization is not necessary for public health surveillance registries that do not include research.Footnote 45 This includes registries created to track the quality, safety, or effectiveness of FDA-regulated products.Footnote 46 Overall, HIPAA allows covered entities and their business associates to disclose identifiable patient information without patient authorization in cases where a registry: 1) furthers public health activities, including public health surveillance and review of an FDA-regulated device; 2) supports health care operations; or 3) is created pursuant to a legal mandate of health oversight officials, such as for CMS reimbursement.
If public health research is conducted using registry data assembled for public health practice, HIPAA permits disclosure of identifiable patient information without consent for a limited dataset, so long as an institutional review board (IRB) or privacy board issues a waiver of consent and the data source and registry steward enter into a data-use agreement.Footnote 47 In considering whether a waiver of consent is appropriate, relevant factors include whether 1) the research involves more than minimal risk, 2) adequate data protections are in place, 3) the research could not practically be conducted if patient authorization is required, and 4) the research could not practically be conducted without identifiable information.Footnote 48 Notably, a limited dataset cannot contain certain data points, such as names, device identifiers, and biometric identifiers; accordingly, limited datasets may be of diminished relevance to device registries, and particularly for cardiac device registries where device and biometric identifiers are essential.
Under HIPAA, patient authorization is also not required for health care treatment, payment processing, or health care operations.Footnote 49 Accordingly, registries used solely to tailor treatments for patients would not need patient authorization, nor would registries that facilitate health care quality improvement, outcomes evaluation, and development of clinical guidelines.Footnote 50 This includes registries created by hospitals or health care providers to track patient outcomes against clinical care standards.Footnote 51
Taken together, HIPAA allows covered entities and their business associates to disclose identifiable patient information without patient authorization in cases where a registry: furthers public health activities, including public health surveillance and review of an FDA-regulated device; supports health care operations; or is created pursuant to a legal mandate of health oversight officials, such as for CMS reimbursement. The public health surveillance exception is particularly relevant in the context of compulsory regulatory registries. Also relevant is the exception whereby identifiable patient data can be disclosed for research purposes if the research could not reasonably be achieved if patient authorization is required. As to the latter, such an argument in the context of a compulsory registry may not withstand scrutiny in cases where direct patient contact in a clinical setting could be expanded to include, for example, verbal or written consent to use of patient data in a registry. The lack of a uniform legal framework to apply across all medical device registries leaves registry stewards to act on an ad hoc basis, which may lead to inconsistent protections across the population.
17.3.2 Applicability of the Common Rule to Registries
In instances involving research based on registry information, federal protections governing research with human participants may apply. As a threshold matter, the Common Rule applies to 1) federally funded research sponsored by one of the seventeen federal agencies that have adopted the Common Rule or 2) studies that will be submitted to the FDA in the context of device approval or monitoring. Some institutions – such as academic medical centers – have adopted the Common Rule to all research conducted at the institution, regardless of funding source. Given the breadth of registry stewards, however, there may be instances where a registry steward or data user is not legally bound by the Common Rule. In such instances the steward or data user has the discretion as to whether, and to what extent, to follow the federal guidelines.
The Common Rule’s protections apply solely to research, which is defined as a systematic investigation that is designed or developed to contribute to generalizable knowledge.Footnote 52 At the outset, it is important to note that the Common Rule does not apply to registries that do not include individually-identifiable information.Footnote 53 Moreover, under the statute, research does not include public health surveillance and the provision of health care.Footnote 54 These exceptions are particularly relevant in the context of regulatory registries, since registries are often created to monitor public health or comply with FDA postmarket requirements.
At the same time, if identifiable information is used for public health research – rather than public health surveillance – the Common Rule would apply and patient consent would be required, unless an IRB or privacy board determines that a waiver of consent is applicable.Footnote 55 Along these lines, the Common Rule’s protections apply to registry research in the context of an FDA-regulated device; as with public health research, the Common Rule would apply and patient consent would be required, unless an IRB or privacy board determines that a waiver of consent is applicable.Footnote 56
For registries that fall within the purview of the Common Rule, regulations require that the registry steward and registry data user obtain informed consent from identifiable individuals who are included in the registry.Footnote 57 A waiver of informed consent may apply if the research poses a minimal risk to the research subjects, cannot be practically conducted without a waiver, does not use registry data in identifiable form, and will not adversely affect the rights and welfare of the research subjects.Footnote 58
In instances where informed consent is required, the research participant must be informed of the risks and benefits of the research. This includes information related to privacy protections and the risks of loss of confidentiality.Footnote 59 However, pursuant to revisions to the Common Rule enacted in 2016, “broad consent” is now permitted in instances where researchers are conducting downstream research using identifiable personal information. Under the broad consent principle, at the point of initial consent, all that is required is a general description of the type of research that may be conducted, the identifiable information that may be used, timeframe for research, any plans to share information, and contact information for the researchers.Footnote 60 Thus, at the time of initial collection, the registry steward can utilize a broad consent document that covers future uses of the patient’s information which, as a practical matter, provides little guidance to the patient on how, precisely, their information will be utilized.Footnote 61
The Office for Human Research Protections explains that primary and secondary purposes of an activity are relevant factors to consider in determining whether a project qualifies as research under the Common Rule.Footnote 62 As such, registries created for research purposes, in whole or in part, would fall under the Common Rule if the entity creating the registry is bound by the Common Rule’s protections.Footnote 63 This is distinct from the HIPAA privacy rule, which indicates that the protections apply only if research is the primary purpose behind use of patient information; otherwise, HIPAA classifies the data use as health care operations.
IRB review of the registry protocol would include the research purpose of the registry, informed consent arrangements (or an explanation of why informed consent is not necessary), and privacy and confidentiality safeguards.Footnote 64 Compulsory registries that are required by law fall under the Common Rule’s umbrella only if the registry is used for research. In such cases, consent would be required unless a waiver has been authorized by a governing IRB.Footnote 65 Taken together, although the Common Rule affords protections for research that utilizes registry data, registry stewards and downstream data users must be mindful of the ethical implications of consent waivers and other exceptions to the research guidelines. Just because use of registry data without patient consent may be legal, it does not mean that such use is ethically appropriate.
17.3.3 Additional Laws
Apart from HIPAA and the Common Rule, we also note briefly that several other laws may apply to the creation and use of registries. The additional laws include federal statutes, state statutes, state common law, and, in the case of registries incorporating data derived from patients outside the United States, laws from other nations. For example, coupled with the Common Rule’s application to research involving registries, there are supplemental federal protections and guidelines for research involving prisoners, pregnant women, children, and patients in federally funded substance abuse programs. In addition, the NIH can issue a certificate of confidentiality for a specific project that requires confidentiality beyond the general legal requirements.Footnote 66
Also relevant is the Federal Trade Commission (FTC) Act, which prohibits unfair or deceptive trade practices.Footnote 67 Registries fall within the FTC Act’s reach, and it would be a deceptive trade practice to provide individuals with false or misleading information regarding data collection or use.Footnote 68 State laws, such as California’s Consumer Privacy Act, may also dictate rights to bearing on registry design, as will the laws of other nations, such as the European Union’s General Data Protection Regulation, if data are collected from or shared within its jurisdiction.
17.4 Proposed Guidelines for Development and Use of Compulsory Registries
The benefits of compulsory registries are tangible and significant. In light of the significant evidence gaps in premarket review, we believe that the potential benefits to be gained from compulsory registries likely outweigh the risks to participating subjects. Yet we are mindful of the implications of compulsory registries on patient autonomy and respect for persons, and thus recommend that a robust informational-disclosure dialogue be implemented as a component of informed consent for clinical care where enrollment in a registry is a requirement for use of the medical device.
Insofar as all patients will have procedural consent obtained prior to device implant, there is an existing mechanism for clinical contact. Moreover, some registries already incorporate detailed patient interviews purely for research purposes, such as the collection of patient-reported outcome measures for key variables such as quality of life. Incorporating a verbal or written consent into the clinical point of care or patient interview would not pose an unreasonable burden on physicians or investigators.
In addition to robust consent and data-linkage protocols, we likewise recommend that registry stewards and data users be held legally accountable for maintaining the security of patient data and providing patients with clear information on data collection and use. This includes providing detailed information on registry sponsorship and specific uses of registry data prior to patient authorization to clinical use of a device. Accountability also includes a privacy-by-design feature whereby registry stewards must affirmatively obtain consent from patients if patient data is to be used beyond the original scope, allowing patients to opt-out of such downstream uses. To further accountability, patients should have easy access to a tracking system that details data use and downstream research.
To promote public trust in compulsory registries, stewards should task a standing advisory committee to track operational and ethical issues. At least one member of the committee should be trained as an ethicist and not have a relationship with the registry steward or downstream data users. The committee should also be a forum whereby patients can raise questions or concerns about the registry. To the extent these criteria are met by an existing institutional review board, there may not be a need to create a separate committee.
17.5 Conclusion
Compulsory registries promote patient outcomes and facilitate robust lifecycle analysis of medical devices. Insofar as laws and regulations have significant gaps in instances where patient authorization is required prior to collection and use of patient data, providers and registry stewards have an ethical obligation to inform patients about data collection and use. Contemporary data protection and research laws afford limited protections for individuals, but these existing laws need not dictate ethical guidance. This is particularly true in the context of health information, which is widely viewed as one of the most sensitive informational areas. Instilling supplemental privacy safeguards and data-use limits may be appropriate when patients are compelled to include their personal information into a registry as a condition of receiving medical care.
Open access