This article was published in 2020. Laws, case law and regulatory guidance may have changed since then. Contact us for up to date advice.
MDR postponed by a year
At the end of this month, on 26 May, the new European regulation on medical devices (Medical Device Regulation, MDR) was due to enter into force. However, the coronavirus crisis hampered several steps that were still required for the introduction of this new legislation. The European Commission (EC) has therefore postponed the European regulation on medical devices (Medical Device Regulation) until May 2021. The EC decided this because of the coronavirus crisis. This means that the MDR is expected to apply on 26 May 2021.
Existing legislation remains in force
“It is important that governments, manufacturers, notified bodies, healthcare providers and other market parties are well prepared for the new legislation. Under the current circumstances, this cannot be sufficiently achieved for the last necessary steps”, according to the IGJ (Dutch Health and Youth Care Inspectorate) in a statement. The European Commission (EC) has therefore postponed the European regulation on medical devices (Medical Device Regulation) until May 2021.
The postponement also means that the current legislation for placing these devices on the market remains valid for another year. That legislation is already based on existing European directives for medical devices and active implants and has been incorporated into the Dutch Medical Devices Decree and the Active Implants Decree.
Supervision of medical devices
Supervision remains in the hands of the IGJ. This applies both to products that comply with the new regulation and to products that were still manufactured on the basis of the old directives. The postponement of the introduction of the MDR has no consequences for the date of entry into force of the new regulation on in vitro diagnostics (IVDR). That remains 26 May 2022.
The relationship between the GDPR and the MDR
Both the GDPR and the MDR play an important role in patient safety. The MDR provides additional physical and process safety when working with medical equipment and systems. But safety goes beyond direct safety aspects such as careful procedures, hygiene and adequate nurse call systems. Patient safety also concerns the security of the patient’s personal data. And that is exactly what the GDPR is about: it safeguards the protection of (patient) data.
The GDPR (General Data Protection Regulation) has been in force since 25 May 2018. It is the biggest change in data protection legislation and regulations of the past 20 years, giving individuals more control over their personal data. In short, companies must map all privacy sensitive ‘Personally Identifiable Information’. The vast majority of ICT systems and devices in healthcare use personal data and will therefore have to comply with the rules prescribed by the GDPR.
Implementing this legislation is a considerable challenge, particularly for the ICT departments of hospitals and healthcare institutions. What needs to be done, for example?
- Privacy Impact Assessments will have to be carried out for high-risk processing of personal data. This therefore applies to all systems that use personal data.
- The rights of data subjects will have to be re-examined in the context of the GDPR: can the rights be honoured? Consider, for example, the right to data portability.
- The overarching privacy policy must also be rewritten to comply with this new legislation. It is then important to ensure clear procedures and staff training, so that staff handle personal data correctly. The new legislation therefore not only affects the ICT department, but has consequences for the entire organisation.
Medical Device Regulation for your organisation
The MDR requires that all equipment purchased after 26 May 2021 is inspected and certified in advance. It is therefore important to take this into account now when purchasing new medical equipment. Moreover, it is important that hospitals and healthcare institutions realise that this equipment is often part of a chain. This may mean that a device that is not (yet) certified, and therefore may not be used, can bring the entire chain to a standstill. Where this concerns a medical alarm system, this can have major consequences immediately.
Although it is known that these new laws are coming, it appears that many hospitals and healthcare institutions have not yet fully completed the implementation. That is understandable, but despite all the challenges, these laws must be implemented in good time. After all, the fines are far from trivial. The ICT department will have to take the lead in this dynamic. This requires a great deal of effort and expertise. It is therefore important to get started *now *so that the organisation is prepared in good time for the new legislation and regulations. The aim must be to safeguard the security of patient data without the organisation’s care for patients being hindered by it.