AI, EHR, SaMD and Hospitals — US, German and Australian regulation make AI immediately available with non-SaMD pathway for Hospitals and Doctors

DOI: 10.70317/2024.24rw09

Introduction

As hospitals increasingly incorporate artificial intelligence (AI) into their EHR systems, they face a critical regulatory challenge: How can they deploy these advanced tools without falling under Software as a Medical Device (SaMD) regulations? SaMD classification brings rigorous oversight, including regulatory approvals, post-market surveillance, and compliance with international standards. However, many hospitals, particularly in the U.S., Germany, and Australia, are developing their own in-house tools that provide insights into patient data, without crossing into regulatory oversight as a medical device.

This paper examines the regulatory frameworks in these three countries, evaluates the role of EHR providers such as Epic Systems, and offers strategies for framing AI as informational rather than clinical decision-making software. By doing so, hospitals can remain compliant while harnessing the benefits of AI-driven innovations.

Regulatory Frameworks by Country

United States

The FDA defines a medical device under the Federal Food, Drug, and Cosmetic Act (FD&C Act, 21CFR) (1) as “any software or device used for diagnosing, treating, curing, or preventing diseases”. Software as a Medical Device (SaMD), which includes AI-driven tools that provide clinical decision support (CDS), falls under this regulation.

However, hospitals can develop in-house AI tools that avoid this classification if the software is intended to support clinicians without automating or replacing their judgment. Epic Systems, for instance, positions its Deterioration Index (4) as an AI tool that provides predictive insights about a patient’s likelihood of deterioration. By framing this output as contextual data rather

than direct diagnostic recommendations, Epic avoids triggering FDA SaMD regulations.

Key U.S. regulatory bodies:

• FDA (Food and Drug Administration): Oversees medical devices, including SaMD.

• CMS (Centers for Medicare & Medicaid Services) (5): Sets standards for hospital compliance.

• The Joint Commission (7): Accredits hospitals in line with federal standards.

Germany

In Germany, the EU Medical Device Regulation (MDR) governs medical devices, including AI-based SaMD. Article 5(5) of the MDR 2017/745 allows hospitals to develop in-house medical devices for exclusive internal use without requiring a CE mark, as long as they do not market these tools. This exemption allows hospitals to innovate without undergoing full regulatory scrutiny, provided the tools adhere to basic safety and performance requirements.

AI-based tools that process EHR data for insights must be carefully framed as non-diagnostic. For instance, AI tools that highlight patterns in patient data can help healthcare providers contextualize trends, but direct diagnoses or automated decisions would fall under the MDR’s scope.

Key German regulatory bodies:

• BfArM (Federal Institute for Drugs and Medical Devices) (2): Regulates medical devices and drugs.

• Paul-Ehrlich-Institut (PEI) (3): Oversees biologics and vaccines.

Australia

In Australia, the TGA (Therapeutic Goods Administration) regulates medical devices under the Therapeutic Goods Act 1989. AI tools designed for clinical decision-making, such as diagnosing or treating a disease, would be classified as SaMD and subject to TGA regulation. However, hospitals can develop in-house tools if they ensure the AI provides informational insights without making

treatment decisions.

Like in other jurisdictions, EHR providers in Australia frame their AI systems as tools that aggregate data or provide general risk scores. Epic’s predictive models, for example, are designed to augment clinicians’ workflows by providing contextual information, rather than automating care.

Key Australian regulatory bodies:

• TGA (Therapeutic Goods Administration): Regulates SaMD and therapeutic goods.

• ACSQHC (Australian Commission on Safety and Quality in Health Care): Sets national safety and quality standards .

• State and Territory Health Departments: Oversee hospital standards and public healthcare.

Avoiding SaMD Classification: Key Strategies

To avoid SaMD regulation, hospitals must carefully craft the language and functionality of their AI

tools. Here are some effective strategies (1,2,4,5,8):

1. Frame AI as Informational and Supportive

   By emphasizing that AI tools offer supportive insights rather than diagnostic decisions, hospitals can position their tools as informational aids. Terms such as “trends,” “risk scores,” and “data visualization” should replace diagnostic or prescriptive terminology.

   For example, Epic Systems highlights that its AI offers risk assessments without making clinical recommendations. This ensures that the final decision-making remains in the hands of the clinician, avoiding regulatory scrutiny. Their predictive models, like the Sepsis Early Warning System and Deterioration Index, use EHR data to calculate risk scores for conditions like sepsis or patient deterioration. These scores provide early warnings but stop short of offering direct diagnostic decisions, allowing clinicians to use these outputs as supplementary information rather than replacing their judgment. This approach helps avoid SaMD regulation.

   
   

2. Focus on Data Aggregation, Not Automation

   AI tools should focus on aggregating and presenting data, allowing clinicians to interpret the information within their clinical judgment. AI should avoid automating decisions like diagnosing a condition or recommending a treatment plan.

   
   

3. Use Non-Specific Outputs

   By generating generalized insights, such as population-level trends or probability scores, AI tools can provide valuable context without falling into the regulatory scope of SaMD. This strategy keeps the AI’s role limited to supporting, rather than driving, clinical decisions.

   
   

4. Diagnostic Codes and Administrative AI

   Epic also uses AI for automating medical coding by suggesting potential ICD codes based on clinical documentation. By framing this feature as a tool to streamline administrative processes rather than influencing treatment, it avoids classification as a medical device.

Conclusion

Hospitals in the U.S., Germany, and Australia are increasingly integrating AI-driven tools into their EHR systems. By positioning AI as supportive and informational or via circumvention of ICDCoding, hospitals can avoid the regulatory challenges posed by SaMD classification. The use of language, functionality, and context is key in ensuring that AI remains outside the scope of medical

device regulations. By carefully navigating this landscape, hospitals can drive innovation while maintaining compliance with FDA, EU MDR, and TGA frameworks.

References

1. FDA (Food and Drug Administration). (2022). Guidance on Software as a Medical Device (SaMD). Retrieved from: FDA SaMD Guidance, https://www.fda.gov/medicaldevices/digital-health-center-excellence/software-medical-device-samd and https://www.fda.gov/media/120066/download

2. BfArM (Federal Institute for Drugs and Medical Devices). (2020). EU Medical Device Regulation (MDR). Retrieved from: BfArM MDR Overview, https://www.bfarm.de/EN/Medical-devices/_FAQ/Clinical-investigations-performancestudies/MDR-MPDG/faq-liste.html and https://www.bfarm.de/EN/Medical-Devices/Overview/_node.html

3. Paul-Ehrlich-Institut (PEI). (2021). Biologics Regulation in Germany. Retrieved from PEI Website, https://www.pei.de/EN/home/home-node.html

4. TGA (Therapeutic Goods Administration). (2021). Regulation of software-based medical devices. Retrieved from: TGA Software Regulation, https://www.tga.gov.au/how-weregulate/supply-therapeutic-good/supply-medical-device/medical-devices-reforms/medicaldevices-reforms-software-regulation and https://www.tga.gov.au/regulation-software-basedmedical-devices

5. Epic Systems. (2022). Using AI for Clinical Insights. Retrieved from: Epic AI Deterioration Index, https://www.epic.com/epic/post/saving-lives-with-ai-using-the-deterioration-indexpredictive-model-to-help-patients-sooner/

6. Centers for Medicare & Medicaid Services. (CMS). (2021). Medicare Conditions of Participation for Hospitals. Retrieved from https://www.cms.gov/

7. 7. The Joint Commission. (2021). Accreditation Standards for Hospitals. Retrieved from The Joint Commission. https://www.jointcommission.org/

8. How Epic is using AI to change the way EHRs work. (2023). Healthcare IT News.

   https://www.healthcareitnews.com/news/how-epic-using-ai-change-way-ehrs-work

Disclaimer

I am releasing this paper without exact details of the steps to take either to register and AI as SaMD or integrate as non-SaMD into existing hospital systems as those details are subject to active NDAs. Please anticipate errors and limitations as the regulatory landscape is evolving quickly. I welcome feedback and evaluations of the content.

Author Contributions

The work of conceptualization, methodology, evaluation, analysis was done by the author. A local, specifically trained (regulations of US, EU Germany and Australia for SaMD, AI and Hospitals) Large Language Model was used to generate Abstract and original draft. The author read, reviewed and approved the final manuscript.

Declaration of Interests

The author has consulted companies and hospitals in regard to Software and AI integration either into EHR Software or as SaMD.

2024_24rw09 Rudolf Wagner Article Hospital SaMD.pdf

PDF herunterladen • 155KB