McKesson Corporation Ann Richardson Berkey

One Post Street Vice President

San Francisco, CA 94104 Public Affairs

May 8, 2008

The Honorable Andrew C. von Eschenbach, M.D.

Commissioner
Food and Drug Administration
5630 Fishers Lane, Room 1061
Rockville, MD 20852

Re: Docket Number 2007N-0484 21 CFR Part 880 Devices: General Hospital and Personal
Use Devices; Reclassification of Medical Device Data System

Dear Dr. von Eschenbach:

On behalf of McKesson Corporation (hereinafter “McKesson”), I am pleased to submit comments

on the proposed rule issued by the Food and Drug Administration (FDA) on February 8, 2008 in
Docket Number 2007N-0484, Devices: General Hospital and Personal Use Devices;
Reclassification of Medical Device Data System.

For 175 years, McKesson has led the industry in the delivery of medicines and healthcare
products to drug stores. Today, a Fortune 18 corporation, we deliver vital medicines, medical
supplies, care management services, automation and health information technology solutions that
touch the lives of over 100 million patients in healthcare settings that include more than 25,000
retail pharmacies, 5,000 hospitals, 200,000 physician practices, 10,000 extended care facilities,
700 home care agencies, the Department of Veterans Affairs, the Department of Defense and
other government facilities.

As the largest health information technology company in the world, McKesson is actively
engaged in the transformation of healthcare from a system burdened by paper to one empowered
by interoperable electronic solutions that improve patient safety, reduce the cost and variability of
care and improve healthcare efficiency. McKesson has medical device systems registered with
the FDA, and we provide comprehensive information technology solutions to healthcare
providers and payors.

Our perspective on the proposed rule is based on our extensive experience with health
information technology and medical devices used by hospitals, health systems and pharmacies.

Section III. Device Description

We commend the FDA for proposing medical device reclassification to improve device and
patient safety and for providing guidance for device manufacturers.

McKesson Comments on FDA Docket Number 2007N-0484

21 CFR Part 880 Devices: General Hospital and Personal Use Devices;
Reclassification of Medical Device Data System
In order to minimize industry confusion as to the devices that might be classified under this rule,
we urge the FDA to provide greater specificity and clarification on the definition of a Medical
Device Data System (MDDS). In these comments, we have detailed specific items in the
proposed regulation where we believe more guidance would be helpful. We also recommend the
exclusion of two categories of data systems from MDDS classification: clinical data repository
systems and electronic health records (EHR) certified by the Certification Commission for
Healthcare Information Technology (CCHIT).

Existing laws define a medical device as “an instrument, apparatus, implement, machine,
contrivance, implant, in vitro reagent, or other similar or related article, including a component
part, or accessory which is:
• recognized in the official National Formulary, or the United States Pharmacopoeia, or
any supplement to them,
• intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation,
treatment, or prevention of disease, in man or other animals, or
• intended to affect the structure or any function of the body of man or other animals, and
which does not achieve any of its primary intended purposes through chemical action
within or on the body of man or other animals and which is not dependent upon being
metabolized for the achievement of any of its primary intended purposes.”

1) In the proposed MDDS regulation, the first bullet states that a MDDS is intended to provide
“the electronic transfer or exchange of medical device data from a medical device, without
altering the function or parameters of any connected device.” This description is very broad
and could apply to any system which incorporates information related to healthcare, but
which is not subsequently “used in the diagnosis of disease or other conditions, or in the
cure, mitigation, treatment, or prevention of disease, in man or other animals.” Such
information systems would include, but are not limited, to:
• health information systems (HIS), such as clinical data repositories or other passive
receptacles of healthcare data, including administrative, financial and archived
information; and
• claims eligibility, billing and adjudication systems that interface with clinical
information systems.

In the case of a large HIS, clinical and medical device data are electronically attached to a
healthcare claim. We do not believe it is FDA’s intention to regulate these systems under the
proposed MDDS regulation when the application itself does not meet the definition of a medical
device. We are seeking confirmation that this interpretation is accurate.

2) The second bullet in the proposed regulation defines a MDDS as “the electronic storage and
retrieval of medical device data without altering the function or parameters of connected
devices. For example, this would include software that stores historical blood pressure
information for later review by a health care provider.” In a broad interpretation of this
definition, a MDDS could include any clinical information system where results from devices
can be stored or retrieved. Examples of such systems which are not currently defined by the
FDA as medical devices would include:
• pharmacy information systems linked to a clinical system to allow the review of
blood pressure data as a part of medication therapy management;

McKesson Comments on FDA Docket Number 2007N-0484 2

21 CFR Part 880 Devices: General Hospital and Personal Use Devices;
Reclassification of Medical Device Data System
 • billing and eligibility checking systems that interface with clinical information
systems; and
• clinical documentation systems used by nurses and physicians to store, document and
review data for clinical decision making.

We do not believe these types of systems should be considered a MDDS.

Based on the cited examples, McKesson seeks clarification as to the criteria and the basis for
MDDS classification, including intended use as well as connectivity and/or the level of analytic
function, particularly with respect to electronic transfer, exchange and retrieval of medical device
data. Clinical data repositories, web portals, and administrative systems that serve as passive
receptacles of healthcare data, including administrative, financial and archived information
systems, do not meet the definition of a medical device and should be explicitly excluded from
the MDDS classification.

Such exclusion should also apply to EHRs which do not meet the FDA definition of a medical
device. Many EHRs can be certified by the CCHIT through a rigorous process, which tests
products against the clinical needs of providers and the quality and safety needs of healthcare
consumers. According to CCHIT Chairman, Mark Leavitt, M.D., Ph.D., “Physicians who
purchase certified products have the assurance that the products have been reviewed by a panel of
judges, including practicing physicians, and that the products are being evaluated against
standards set by professionals in the field and successfully piloted with products from large and
small companies... the quality and safety of EHR products can now be measured using
certification criteria that were developed specifically for that purpose.” This process aligns with
the FDA’s goal to provide reasonable assurance of safety and effectiveness and should support an
exemption from MDDS classification for any CCHIT-certified EHRs.

3) The third bullet in the proposed regulation defines a MDDS as a device intended to provide
“the electronic display of medical device data without altering the function or parameters of
connected devices. For example, this would include software that displays the previously
stored electrocardiogram for a particular patient.” As written, any monitor or computer
screen that displays device data, including a computer terminal in a nursing station or a
screen on an infusion pump that displays the infusion rate or amount infused, could be
considered a MDDS. We do not believe these are defined as medical devices. We request
that the FDA confirm that software and devices with electronic displays of medical device
data are excluded from the classification of a MDDS.

We also have questions concerning the interpretation of the term “direct connection” and request
FDA guidance as to whether a clinical HIS system that transmits data stored within a device is to
be classified as a MDDS, even if the device is not directly connected to the HIS. If an EKG is
stored in a remote database such as a data repository, is that considered a direct connection?
Would the data repository be considered a MDDS? If the FDA interprets “direct connection” to
include remote systems, we believe that an HIS system or billing system that stores and transmits
healthcare claims and clinical data could be considered a MDDS.

Finally, we seek guidance on diagnostic and clinical decision-making functions and the FDA’s
interpretation of “altering” such functions. A MDDS is defined in the proposed regulation as
“the electronic display of medical device data without altering the function of the connected
device.” Further, in the same paragraph, the regulation states “MDDS is not intended to provide
real-time, active or online patient monitoring functions” and “By themselves, MDDS do not

McKesson Comments on FDA Docket Number 2007N-0484 3

21 CFR Part 880 Devices: General Hospital and Personal Use Devices;
Reclassification of Medical Device Data System
provide any diagnostic or clinical decision making functions.” We interpret the proposed rule to
mean that the display of historical data is considered a MDDS; the real time display of the same
data is not. We recommend that FDA clearly define the phrase “altering the function of
connected devices.” We also recommend that FDA define the time interval associated with the
term “real-time,” and confirm that “diagnostic and clinical decision-making functions,” which
are included in the definition of MDDS, do not include administrative data systems.

Section IV. Proposed Reclassification

The proposed rule would exempt a MDDS from premarket notification requirements when it is
indicated for use only by a healthcare professional and does not perform irreversible data
compression.

We recommend that FDA remove irreversible data compression as a criterion for submission of a
premarket notification for MDDS. The majority of irreversible data compression is used in
medical image storage devices and medical image communications devices, which are currently
regulated under 21 CFR 892.2010 and 21 CFR 892.2020. Under these regulations, medical
image storage devices and medical image communications devices do not require premarket
notification submission. We urge the FDA not to inadvertently alter the regulations that currently
apply to these devices.

Section VI. Summary of Reasons for Reclassification

As proposed, the design controls of the Quality System Regulation (QSR) (21 CFR 820.30) apply
to class I devices with software. The FDA does not intend to apply design controls retroactively
to legally marketed MDDS devices.

We applaud the FDA for this decision; the retroactive requirement for design controls for MDDS
devices could create an unnecessary burden for software developers. However, the statement “…
changes to existing designs or to currently marketed devices must be made in accordance with
design control requirements, even if the original design was not subject to these requirements,§
820.30,” is of concern because the designs of software based medical devices are frequently
changed. Consequently, an application for design controls and other relevant sections of the QSR
would be required as of the effective date of the final rule or 60 days after the publication of the
final rule, as stated in Section VII.

Most software development generally follows a systematic process with design and technical
specifications, reviews, verification and validation. Firms that design and manufacture products
to meet the proposed definition of MDDS will not have established business processes to be
compliant with the QSR or another medical device quality system standard. Companies require
sufficient time to establish business processes and verification procedures to ensure compliance
with the QSR. Therefore, we recommend that FDA set the effective date for implementation of
the rule a minimum of two years from the date of publication of the final rule. We also
recommend that FDA provide education sessions and written materials on the application for the
QSR, and in particular, design controls for MDDS during this two-year period.

The FDA’s reference to a “legally marketed MDDS” is confusing in that many products currently
on the market were not originally marketed as a MDDS. As written, the proposed rule could be
interpreted as requiring products currently on the market and subject to the proposed definition of
a MDDS to be registered with the FDA and in compliance with the QSR. Given FDA’s proposed
MDDS reclassification and the fact that devices have been on the market for several decades, we
suggest that FDA replace the phrase “legally marketed MDDS” with “device meeting the
requirements for a MDDS.”
McKesson Comments on FDA Docket Number 2007N-0484 4
21 CFR Part 880 Devices: General Hospital and Personal Use Devices;
Reclassification of Medical Device Data System
Section VIII. Effective Date
For the reasons identified above, we recommend that this section be modified to indicate the
following effective dates:
• 60 days after final rule publication: Establishment registration and device listing sections
of 21 CFR 807
• Two years after final rule publication: Compliance with Quality System Regulation 21
CFR 820

Additionally, we recommend that premarket notification submissions and their effective dates be
removed from this section.

Conclusion
McKesson supports the FDA’s MDDS reclassification to provide a reasonable assurance of the
safety and effectiveness of a MDDS device. However, we urge FDA to strengthen the proposed
rule to:
• ensure that the definition of MDDS covers only medical devices in accordance with the
FDA definition of medical devices;
• provide detailed criteria for classification, particularly with respect to electronic transfer,
exchange, storage and retrieval of medical device data;
• exempt CCHIT-certified EHRs from MDDS classification;
• exclude clinical data repositories, web portals, and administrative systems or other
passive receptacles of healthcare data from MDDS classification;
• provide clarification of the term “real-time” and the phrases “altering the function of
connected devices” and “diagnostic and clinical decision-making functions”;
• remove irreversible data compression as a criteria for submission of a premarket
notification for MDDS;
• ensure that a minimum of two years be allowed for manufacturers to meet the QSR; and
• replace the phrase “legally marketed MDDS” with “device meeting the requirements for
a MDDS.”

We appreciate the opportunity to provide our comments on the proposed rule and look forward to
working with you as you finalize and implement this MDDS reclassification. Should you have
questions or need further information, please contact me at (415) 983-8494 or
ann.berkey@mckesson.com.

Sincerely,

Ann Richardson Berkey

McKesson Comments on FDA Docket Number 2007N-0484 5

21 CFR Part 880 Devices: General Hospital and Personal Use Devices;
Reclassification of Medical Device Data System