White Paper Trends in Medical Device Design

New Regulations and Technologies Will Shape Future Devices

ABSTRACT
With the number of older persons projected to double from the year to 2000 to 2030 to 71.5 million, technology is advancing to meet the need for new medical devices to provide better, more cost effective, healthcare. Often, these medical device developments require application of technology originally developed for PDAs and cell phones. This electronics technology is fundamentally different from the electronics used in the last generation of medical devices. To meet these challenges, new design and engineering techniques with partnerships spanning the supply chain are emerging.

By Lawrence Ricci

Doctors Reaching Out

Soon, medical monitoring and treatment equipment will shrink for use in the home, even to wearable or implanted form factors. Communications media unknown, even undreamt of, a decade ago will link them to medical practitioners around the globe and vast databases chronicling best care strategies. Battery - and even bio power will become the norm. Yet these technologies must be employed within the properly conservative requirements for medical devices. This paper will outline some of the forces and concerns that will govern the development of such equipment.

Applied Data Systems 10260 Old Columbia Road Columbia, Maryland 21046 Phone 301-490-4007 Fax 301-490-4582

New Regulations And Technologies Will Shape Future Devices

Introduction
The new challenges of medical device design include proscriptive compliance to regulations, extended product lifecycles, reduced product development time, and of course, product safety. The challenge is to meet these goals and still achieve modern communication, device reliability, and sometimes battery power/power management. These new designs, once achieved, will not only improve the devices within clinics and medical centers, but will facilitate the transition of monitoring and therapeutic devices into the patients home.

Mobile Radio and TV stationsi. Since 1997, with the FCC assigning more bandwidth for HDTV, some devices in hospitals have been reset to use channels still left unoccupiedii. However, this is only a small change in the landscape, affecting mostly legacy devices and their one-to-one replacements. The most popular new communications technology is 802.11 and its variants. Here is where the interface between FDA regulations, FCC regulations, and FIPS regulations (Federal Information Protection and Security) collide with the reality of fast-moving, high-tech consumer hardware, and software. Keeping abreast with these issues, the Food and Drug Administration has recently published a Draft Guidance for comment, where the evolution of the various 21 CFR device design guidelines is being discussediii.

Communications: Now Fundamental to Function

Ten years ago, medical monitoring was typically done on individual devices, without interconnection. If data was linked, it was through written notes on a clipboard. Now, to reduce costs and to improve access to data, most devices in the hospital or home - whether diagnostic or therapeutic - must be networked to reduce errors and facilitate faster data exchange. This need to network medical devices occurs at the same time as rapid advances in digital radio technology expands the playing field of what is possible, and the rapidly maturing FCC guidelines put regulations in place to control the safety of the technology. Previously, in addition to wired Ethernet, in-hospital devices have used electromagnetic spectrum shared with, but not protected from, local Land
Applied Data Systems 10260 Old Columbia Road Columbia, Maryland 21046 Phone 301-490-4007 Fax 301-490-4582

WiFi Will Be King

The 802.11 (a,b,g) specifications, published by the IEEE, define only the most basic level of compatibility. Workable interoperability typically demands additional conformance to the WiFi Alliance specifications and to a suite of Extensible Authentication Protocols (EAP) and other features, sometimes identified as the Cisco Compatible Extensionsiv (CCX), now at Revision 4. Then, additionally, there is a host of application extensions needed to make it practical and simple to do things like logon securely and transfer from one access point to another. Figure 1 is included to indicate the mechanics of how just a portion of the
Page 2

New Regulations And Technologies Will Shape Future Devices

Client device Protocol: 802.1X authenticator
Blocks port for data traffic Blocks port for data traffic

AP Protocol: RADIUS

RADIUS server authentication server

EAP: Request identity EAP: Identity response* RADIUS: Request/Identity

Mutual authentication*: Server authenticates client; client authenticates server

Derivation of pairwise master key (PMK)

Derivation of pairwise master key (PMK)

RADIUS: Accept with PMK EAP: Success

* Specific to EAP type

Figure 1- Secure WiFi Access, Courtesy of Summit Data Communication

EAP (Extended Access Protocol) of a WiFi net might be managed. This figure is a extreme simplification; in practice, multiple 802.11 devices adhering to different access protocols will contend for the in the same airspace and spectrum. All of these, including invited and uninvited guests with PDAs in their pocket, need to be administered. Diligent third party testing and application focused implementation tends to mask all this complexity from the consumer/user. The designer of a laptop knows that it is typically operated from a desk, so its connection to an access point should be sticky. The designer of a PDA knows that it will be used by a moving user, and needs to frequently reconnect from one AP to another (slippery). For a medical
Applied Data Systems 10260 Old Columbia Road Columbia, Maryland 21046 Phone 301-490-4007 Fax 301-490-4582

device, the engineer needs to design these properties in, and for some devices, properties like stickiness are mandated by regulation. Getting this design right is not as simple as selecting the right CF card. The problem is the standards change so fast, that the com chip selected in January may be EOL by the fall, and approval cycles may take up much of the time in-between. Careful coordination between design, and supply chain management are needed to effectively apply technologies like 802.11 in medical devices.

MedRadio is Coming, MICS is still here

Many other forms of communication are also being used or being planned for medical devices. All of them are
Page 3

New Regulations And Technologies Will Shape Future Devices regulated and protected by the FCC, Not Too Far Away-Metro Area and all of them require certain design Health
and testing standards. Most critical, of course, are the recently proposed FCC standards for Medical Device Radiocommunication Service or MedRadiov. This term refers to expanded bandwidth for implanted and body-worn medical radio communication devices. The older rules for Medical Implant Communications Standards (MICS) are still largely in place, including the rules for low frequency, inductively coupled sensors. The promise of MedRadio is great. Patients can wear various vital sign monitors, and even therapeutic devices like insulin pumps, yet still have reasonable mobility within the facility or even at home. It is hoped that as more wearable and implantable devices are developed, more of the chronic care process can be moved out of the hospital and costly nursing home to lower cost assisted-living and at-home care. These networks require additional testing for susceptibility, for emission, and for certain protocol behaviors, such as checking for a frequency before using it. We have found this testing well advised as the clock frequency of modern PDA/cellphone components is in the range of MedRadio, and the frequency of the low-frequency inductively coupled MICS devices is in the range of the switched mode power supplies that power this class of device. The specs for susceptibility and emissivity can be tight, and design features may have to be adjusted to meet them. Health care professionals can be hard to find in the rural areas of the United States. As an experiment, the Federal Communications Commission (FCC) established in September 2006vi a pilot program that will assist in the development and deployment of regionwide broadband networks dedicated to the provision of healthcare services.

Figure 2: Some day soon, devices like this, located in homes, will perform much monitoring now done by vesting nurse services

This is an exciting development. So called 3G and 4G network technologies like Intel WiMax exist now and provide broad band speed and easy connection across wide areas. Some of these preWiMax networks have already been deployed over multi-county areas for specific functions like homeland security. The use of such a metro area LAN will solve the last mile problem for connection to the house, and in fact, could solve the last yard problem for connection to the device. Many of the target households for such health care devices are not broad band equipped
Page 4

Applied Data Systems 10260 Old Columbia Road Columbia, Maryland 21046 Phone 301-490-4007 Fax 301-490-4582

New Regulations And Technologies Will Shape Future Devices

now and would probably benefit from a device as easy to connect to the network as a cell phone. The challenge will be engineering these devices. Notably, forward thinking device manufacturers are looking at broadband capability as a way to reach out and teleconference with patients. This broadband capability would provide the health care professional with an overview of how the patient is doing, his posture and general demeanor, and perhaps a suitable view of wounds, bandage applications and so forth. At the same time, the patient will have, to some degree, psychological reinforcement that comes from the bedside manner of the health care provider. These functional requirements put a serious burden on the design of the health care device. Not only must it establish a network connection like a leading edge cell phone, but it must do it within the power budget and design constraints of various medical device regulations. Finally, its design must be consistent with the documentation and test standards for medical devices. logical step would be to move to the NIST-maintained FIPS-140 Rev 2 which defines a series of strong encryption, identification and authentication techniques. Sometimes, this basket of technologies is referred to as Suite Bviii. These techniques are, in general, network-independent and could essentially span WiFi and other nets as well. At such time as the Suite B becomes the expectation, medical device design will be taken to the edge of the envelope of available silicon technology. The various crypto protocols and key exchange protocols are much more computation intensive than those used today; special purpose chips may be needed and these need to be integrated with the operating systems Crypto API. If the teleconference data is also mandated to have enhanced cryptographic security, the compute load might be heavy indeed. These technologies are all available, have been proven in DoD systems, are declassified for civilian use, royalty-free or reasonably priced (depending on enduse), and are now ready for application as part of any serious OEM device development. Development and product costs are inside the envelope typically established for medical devices, so perhaps the move to more secure data handling will be made by an OEM looking for first mover/regulatory advantage.

HIPPA will be a Factor

Currently HIPAA regulationsvii (Health Insurance Portability and Accountability Act of 1996) mandate confidential transfer of patient information. To date, proper applications of commercial WiFi protocols have satisfied this need, but it is possible that prevailing rules may soon mandate moving past the IEEE 802.11i and 802.11x security package (an overlay to 802.11a,b or g) . The
Applied Data Systems 10260 Old Columbia Road Columbia, Maryland 21046 Phone 301-490-4007 Fax 301-490-4582

Page 5

New Regulations And Technologies Will Shape Future Devices

Figure 3- This is part of an actual FMEA study done for a mobile, embedded computer to monitor implanted devices

Reliability
From the designers point of view, it seems that the Hippocratic pledge to do no harm is ninety percent of medical device design. The other 10% is documenting compliance to the 90%. Safety of the device typically focuses on power supply design, software design and overall FMEA considerations (Failure Mode and Effects Analysis) Power supply safety is, for the most part, regulated by IEC 60601-1. Design to this spec is, among other things, a good assurance that high or unsafe voltage will never reach the patient. IEC 60601 also stipulates proper device performance in the face of power interruptions and surge wave
Applied Data Systems 10260 Old Columbia Road Columbia, Maryland 21046 Phone 301-490-4007 Fax 301-490-4582

interference. The standards for RFI emission and immunity are likewise inside this and related IEC regulations. The net effect of these regulations is to significantly increase the size and cost of the power supply elements in the device. Cost and size of the device is reduced if less power is consumed, so application of power-thrifty RISC processors is a good way to keep device size and cost in line.

Page 6

New Regulations And Technologies Will Shape Future Devices

Software reliability is also an area of concern. The regulations specify rules for the software in Class I, II and III devices, with Class III the most critical, life sustaining service, and subject to extensive PMA (Pre Market Approval) process. Regulations for topic are evolving quickly, the FDA publishes activity reportsix. Device design may encompass split functions, with certain more critical tasks done by 100% hardware subsystems, others done by low level assembly coded microcontrollers and finally some higher level functions like operator interface and network communications managed by a fully-functioning Off the Shelf operating system like Microsoft Windows CE or Linux. Use of such OTS software is possible for most medical devices provided hazards are mitigated by an FDA regulated process as shown, in part, in Figure 3. While design details might change, the important fact here is that once approved, changes to software are generally not allowed, and if allowed must be carefully documented. Since the RISC CPUs under consideration for many of these programs change very often, this mandates a special controlled Bill of Materials and excellent supplier relationships. Finally, reliability is not just a MTBF calculation. The specific performance of the device must be analyzed for each conceivable failure, and ranked by probability and consequence of that failure. This FMEA (Failure Mode and Effects Analysis) analysis is, in itself, a regulated processx detailing the failure mode, its causes, its effects, the frequency of occurrence, the severity of occurrence and the actions to mitigate the effects. This analysis can be performed on individual components or on the medical devices embedded computer as a unitized subsystem. Then, this analysis becomes an element of the FMEA for the full device. Finally, an FMEA process is adopted for the entire health-management process in the facility. Figure 3 is a section of the summary report for an actual Single Board, PDA style computer used in a Medical application. The design must be documented and any change to the Bill of Material may be a regulatory event. This can make use of COTS devices difficult as they often change as component suppliers
Page 7

Figure 4- Process for Hazard Mitigation, Off-The-Shelf Software Use in Medical Devices, September 9, 1999 See
http://www.fda.gov/cdrh/ode/guidance/585.html

Applied Data Systems 10260 Old Columbia Road Columbia, Maryland 21046 Phone 301-490-4007 Fax 301-490-4582

New Regulations And Technologies Will Shape Future Devices

shift prices and otherwise EOL items. The medical device OEM sill must maintain a Device Master Record DMR in accordance with regulation.xi

Getting to Core Value

As exciting as the new size, power and communication options are for medical devices, they are all, essentially, commodity specifications. The real core value of a medical device is its sensors and their proper application within established guidelines.

Sensor Integration and Signal Analysis

Medical device design often is centered on the integration of some novel sensor and application of its data. Ultimately, this will require measurement of a voltage and often it will require this be done at high frequency, to enable spectrum analysis. While these requirements are common with almost any measurement device, the design of this sensor electronics within the general electrical requirements for medical devices can demand specialized techniques. To get this done in a small device suggests a considered design where the sensor electronics and computer electronics are balanced carefully. Modern cell phone and PDA devices have excellent signal analysis capability in the form of in-built DSPs and DSPlike general CPU instructions. These features, developed by silicon suppliers at great cost to support telecommunications functions, can be applied to solve signal analysis and signal processing for medical sensors. But, of course, this must be done within the regulations for medical devices. For example, very high resolution A/D converters may be needed to resolve the tiny signals at EKG electrodes from the potentially high common mode voltage exclusion mandated by patient isolation.

Figure 5: A computer board like this might cost 10,000 development man-hours. Yet, it provides only 'commodity' specs and is far from the value proposition of medical device

This is not to diminish the difficulty in meeting various communication and power supply design specs. It can be very difficult and require experienced engineers, test facilities and so forth. Any one of these can take man-months to engineer and to test to compliance. But in the end - all of these specs, like 802.11, IEC 60601-1, 21 CFR 820 compliance, etc - are simple commodities, in the most part tested for their commodity nature by third party labs. This dichotomy between the core value of a medical device and the effort required to commoditize elements of its design is causing companies to
Page 8

Applied Data Systems 10260 Old Columbia Road Columbia, Maryland 21046 Phone 301-490-4007 Fax 301-490-4582

New Regulations And Technologies Will Shape Future Devices

reconsider their engineering and development models. In the past, the controls required for medical devices meant that most companies kept engineering, design, and production in house. Now, with the demand for more of this low power and communication oriented commodity features, the same firms are looking at design/build models with shared responsibility. While not completely outsourcing or private labeling the devices, the companies are seeking business models where the commodity portion of the device can be released turn key to a supplier who can engineer to the specifications and manage the supply chain.
Federal Communications Commission, 47 CFR Part 15, part 90 ii Federal Communications Commission, ET Docket No. 95-177, Released: October 20. 1997 iii DRAFT GUIDANCE, FDA, Health and Human Services, issued on: January 3, 2007, contact Donald M. Witters Jr. at 301-827-4955, ( Donald.Witters@fda.hhs.gov.) iv Cisco Website (Jan 10,2007), http://www.cisco.com/web/partners/pr46/pr147/part ners_pgm_concept_home.html v FCC Amendment of Parts 2 and 95 of the Commission's Rules to Establish a Medical Implant Communications Service in the 402-405 MHz Band WT Docket No. 99-66 vi NEWS Federal Communications Commission. See http://hraunfoss.fcc.gov/edocs_public/attachmatch/ DOC-267605A1.pdf vii Federal Register, 45 CFR Parts 160 and 164, December 28, 2000 as amended: May 31, 2002, August 14, 2002, February 20, 2003, and April 17, 2003 viii See NSA Fact Sheet, http://www.nsa.gov/ia/industry/crypto_suite_b.cfm, , Jan 10, 2007 ix Telemedicine Related Activities, Center for Devices and Radiological Health, Food and Drug Administration 11 July 1996 x International Standards Organization, ISO 13485:2003, published in July 2003. Standard based on the ISO 9001:2000 xi Code of Federal Regulations, 21CFR820.181, Volume 8, Revised April 1, 2006
i

Summary
Medical device design is advancing on two fronts. Proprietary technology like better sensors, measurements, and analytical techniques are moving to market. Emerging commodity specifications for connectability and portability allow these devices to better integrate with a broader healthcare network. Getting the best devices to market will require new partnerships and development of new supply chains.
Copyright , Applied Data Systems, Inc, 2006. All Rights Reserved. This document may not be used for commercial gain without permission of Applied Data Systems, Inc. Any trademarks used within are the property of their respective owners. This document contains technical descriptions that may not be representative of Applied Data Systems product or services

Applied Data Systems 10260 Old Columbia Road Columbia, Maryland 21046 Phone 301-490-4007 Fax 301-490-4582

Page 9