Test

Test

Test

CFR - Code of Federal Regulations Title 21 - Statute

http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/cfrsearch.cfm?cfrpart=820&showfr=1

CFR - Code of Federal Regulations Title 21 - Definitions

Sec. 820.3 Definitions.

(a)Act means the Federal Food, Drug, and Cosmetic Act, as amended (secs. 201-903, 52 Stat. 1040 et seq., as amended (21 U.S.C. 321-394)). All definitions in section 201 of the act shall apply to the regulations in this part. (b)Complaint means any written, electronic, or oral communication that alleges deficiencies related to the identity, quality, durability, reliability, safety, effectiveness, or performance of a device after it is released for distribution. (c)Component means any raw material, substance, piece, part, software, firmware, labeling, or assembly which is intended to be included as part of the finished, packaged, and labeled device. (d)Control number means any distinctive symbols, such as a distinctive combination of letters or numbers, or both, from which the history of the manufacturing, packaging, labeling, and distribution of a unit, lot, or batch of finished devices can be determined. (e)Design history file (DHF ) means a compilation of records which describes the design history of a finished device. (f)Design input means the physical and performance requirements of a device that are used as a basis for device design. (g)Design output means the results of a design effort at each design phase and at the end of the total design effort. The finished design output is the basis for the device master record. The total finished design output consists of the device, its packaging and labeling, and the device master record. (h)Design review means a documented, comprehensive, systematic examination of a design to evaluate the adequacy of the design requirements, to evaluate the capability of the design to meet these requirements, and to identify problems. (i)Device history record (DHR ) means a compilation of records containing the production history of a finished device. (j)Device master record (DMR ) means a compilation of records containing the procedures and specifications for a finished device. (k)Establish means define, document (in writing or electronically), and implement. (l)Finished device means any device or accessory to any device that is suitable for use or capable of functioning, whether or not it is packaged, labeled, or sterilized. (m)Lot or batch means one or more components or finished devices that consist of a single type, model, class, size, composition, or software version that are manufactured under essentially the same conditions and that are intended to have uniform characteristics and quality within specified limits. (n)Management with executive responsibility means those senior employees of a manufacturer who have the authority to establish or make changes to the manufacturer's quality policy and quality system. (o)Manufacturer means any person who designs, manufactures, fabricates, assembles, or processes a finished device. Manufacturer includes but is not limited to those who perform the functions of contract sterilization, installation, relabeling, remanufacturing, repacking, or specification development, and initial distributors of foreign entities performing these functions. (p)Manufacturing material means any material or substance used in or used to facilitate the manufacturing process, a concomitant constituent, or a byproduct constituent produced during the manufacturing process, which is present in or on the finished device as a residue or impurity not by design or intent of the manufacturer. (q)Nonconformity means the nonfulfillment of a specified requirement. (r)Product means components, manufacturing materials, in- process devices, finished devices, and returned devices. (s)Quality means the totality of features and characteristics that bear on the ability of a device to satisfy fitness-for-use, including safety and performance. (t)Quality audit means a systematic, independent examination of a manufacturer's quality system that is performed at defined intervals and at sufficient frequency to determine whether both quality system activities and the results of such activities comply with quality system procedures, that these procedures are implemented effectively, and that these procedures are suitable to achieve quality system objectives. (u)Quality policy means the overall intentions and direction of an organization with respect to quality, as established by management with executive responsibility. (v)Quality system means the organizational structure, responsibilities, procedures, processes, and resources for implementing quality management. (w)Remanufacturer means any person who processes, conditions, renovates, repackages, restores, or does any other act to a finished device that significantly changes the finished device's performance or safety specifications, or intended use. (x)Rework means action taken on a nonconforming product so that it will fulfill the specified DMR requirements before it is released for distribution. (y)Specification means any requirement with which a product, process, service, or other activity must conform. (z)Validation means confirmation by examination and provision of objective evidence that the particular requirements for a specific intended use can be consistently fulfilled. (1)Process validation means establishing by objective evidence that a process consistently produces a result or product meeting its predetermined specifications. (2)Design validation means establishing by objective evidence that device specifications conform with user needs and intended use(s). (aa)Verification means confirmation by examination and provision of objective evidence that specified requirements have been fulfilled.

How We Got Here: The Road to Meaningful Use

On January 24, 2009, newly sworn in President Obama uttered a bold promise: "To lower health care cost, cut medical errors, and improve care, we'll computerize the nation's health records in five years, saving billions of dollars in health care costs and countless lives." It's those words that marked the beginning of healthcare reform.

In the time since that first weekly address, a number of significant events have unfolded:

• February 2012: CMS issues a Notice of Proposed Rulemaking (NPRM) for Stage 2 and ONC releases the Standards and Certification NPRM
• Janaury 2012: Additional Meeting with ONC and CMS on Meaningful Use and Hospital-Located Eligible Professionals takes place
• December 2011: ONC's HIT Standards Committee and HIT Policy Committee-MU Workgroup Discuss Early Plans for Exploring Imaging Standards and the RBMA, ACR and Other Stakeholders Meet With ONC to Discuss Hospital-Located EPs Without Physical Practice Infrastructures
• November 2011: ONC HIT Policy Committee/Meaningful Use (MU) Workgroup/Specialist Subgroup holds conference call to discuss MU and specialized medicine
• October 2011: ONC HIT Policy Committee/Meaningful Use Workgroup/Specialist Subgroup held its first meeting to discuss gaps and opportunities regarding MU and specialists
• June 2011: HIT Policy Committee makes recommendations to the National Coordinator on Meaningful Use Stage 2
• May 2011: ACR Participates in HHS Hearing on 'Meaningful Use and Specialists'
• April 2011: Dr. Farzad Mostashari named new National Coordinator for HIT at the ONC
• March 2011: ACR verbally comments to full HITPC and MU workgroup
• February 2011: ACR comments on draft Stage 2 meaningful use measure recommendations
• January 2011: RSNA and ACR comment on ONC RFI regarding PCAST report
• December 2010: ONC announces the addition of two ATCB groups - ICSA Labs in Mechanicsburg, PA and SLI Global Solutions in Denver, CO
• September 2010: HHS selects third group - InfoGard Laboratories - to test and certify electronic health records systems for supporting meaningful use
• August 2010: HHS selects first two EHR certification groups - Certification Commission for Health IT (CCHIT) and the Drummond Group (DGI)
• July 2010: CMS and ONC released final rules implementing Stage 1 of meaningful use
• April 2010: Congress passes H.R.4851, the Continuing Extension Act of 2010
• March 2010: The ACR, joined by the American Board of Radiology (ABR), Radiological Society of North America (RSNA), and Society for Imaging Informatics in Medicine (SIIM), issued a collective set of comments to all twenty-five reporting measures of the proposed EHR incentive program as it applies to radiology
• January 2010: Following the release of the IFR and NPRM, a public comment period was initiated with a deadline of March 15, 2010
• December 2009: CMS issued a Notice of Proposed Rulemaking (NPRM) which outlined three incentive programs and the provisions governing each program
• December 2009: ONC issued its Interim Final Rule (IFR), a summary of recommendations on MU which proposed the initial set of standards and certification criteria as well as implementation specifications
• October 2009: American College of Radiology (ACR) proposed topics to the HIT Policy Committee that it viewed as relevant to the discussion of radiology meaningful use (RMU)
• March 2009: Under the auspices of the Federal Advisory Committee Act (FACA), two committees were formed; the Health IT Policy Committee and Health IT Standards Committee
• March 2009: Obama administration appointed David Blumenthal, MD, MPP, as national coordinator of health information technology for the ONC
• February 2009: Health Information Technology for Economic and Clinical Health (HITECH) Act was born as a subset of the ARRA
• February 2009: Congress passed the American Recovery and Reinvestment Act (ARRA) of 2009

http://www.healthmu.org/radiology/index.php

New privacy and security requirements increase potential legal liability—and jeopardize brand reputation.

Protect personal health information in motion, in use and at rest with HP access,
authentication, authorization and audit solutions.
Executive summary
According to a 2008 study by the independent privacy, data-protection and
data-security technologies research firm Ponemon Institute, the healthcare industry
is among the top three industries most frequently victimized by data breaches.1
Healthcare entities have largely ignored the Health Insurance Portability and Account-
ability Act (HIPAA) and the associated security framework necessary to safeguard
protected health information (PHI). But the newly implemented HITECH Act gives
HIPAA new life. The Act is emphasizing accountability, raising breach response costs
and increasing penalties for data breach to as high as $1.5 million. Not only can
a data breach carry huge medical and financial risks to the people whose data is
lost—it can also severely damage a healthcare entity’s brand.
Many organizations think that traditional IT security and compliance are sufficient safety
measures for PHI. However, a recent study by PricewaterhouseCoopers2 found that
only 5 percent of data breaches are caused by malicious cyber attacks, almost 55 per-
cent are linked to human error and 44 percent are due to third-party handling of data.
The study also revealed that 70 percent of all organizations do not have an accurate
inventory of where personally identifiable information (PII) in their custody is stored. With
the complex web of organizations involved in providing healthcare services, this is
a critical issue for the healthcare industry.
HIPAA and the HITECH Act
In 2009, the new Health Information Technology for Economic and Clinical Health (HITECH) Act
took effect. HITECH requires healthcare organizations to take more responsibility for protecting
patient records and health information. The Act widens the scope of privacy and security protections
available under HIPAA, increases potential legal liability for non-compliance and provides more
enforcement of HIPAA rules. The HITECH Act seeks to streamline healthcare and reduce costs
through the use of health information technology, including the adoption of electronic health records.

HIPAA - 10 Things To Know About HIPAA

1. The Health Insurance Portability and Accountability Act of 1996 is a law. The law was passed in 1996, and mandated that DHHS draft specific regulations to facilitate compliance with the law's provision (Administrative Simplification; Privacy; Security; Unique Identifiers; etc.)
2. All HIPAA compliance efforts should be documented and memorialized in some fashion.
3. Covered Entities include those healthcare providers, health plans, and healthcare clearing houses that transmit information electronically, in accordance with the Electronic Transactions Standard. Once deemed "covered," these entities are subject to the Privacy and Security regulations, regardless of the form of the "protected health information."
4. HIPAA is TECHNOLOGY-NEUTRAL: No specific technology is required for compliance, and the regulations were drafted to be scalable to each covered entity's individual needs.
5. Third parties (vendors, industry partners, business associates, etc.) are not directly regulated under HIPAA (unless they are also "covered entities"). The burden befalls the "covered entity" to obtain assurances that third parties with access to protected information will maintain the appropriate levels of privacy and security.
6. No private right of action exist under the HIPAA Regulations. However, state law claims (breach of privacy, breach of duty, negligence, etc.) may be bolstered by evidence of non-compliance with the Federal Regulations.
7. Organization-wide education is crucial to compliance efforts. Don't underestimate the power of adequate and appropriate training.
8. Keep track of compliance dates and implementation deadlines. Because of the dynamic nature of the regulations, this specific task should be assigned to someone in each organization. Keeping up to date with the changes and proposed modifications will also be a good measure of the industry response to the regulations, and may provide guidance with respect to implementation efforts.
9. Seek inter-industry assistance with compliance efforts. Compliance efforts should include internal assessments, regardless of outside assistance. Achieving compliance will require more than outside "certification," and is an organization-wide effort. Seeking compliance and implementation assistance may be helpful, but such measures will serve limited purposes. An "internal" understanding and practical application and use of policy and process modifications will require internal change. Compliance efforts should, however, include industry partners, with respect to acquiring knowledge, training, technology, where appropriate, and additional assistance.
10. HIPAA does not necessarily preempt state laws. The regulations were drafted to work in conjunction with State Privacy and Security Laws/Regulations. More stringent state privacy and security laws will remain in effect. Seek assistance from internal or outside counsel to avoid redundant and unnecessary compliance efforts, and to ensure proper measures are taken to achieve compliance with the Federal Regulations.

ACR PRACTICE GUIDELINES AND TECHNICAL STANDARDS

http://www.acr.org/SecondaryMainMenuCategories/quality_safety/guidelines/toc.aspx

Planning for PACS: A Comprehensive Guide to Nontechnical Considerations

http://www.acr.org/SecondaryMainMenuCategories/BusinessPracticeIssues/Teleradiology/PlanningforPACSDoc2.aspx

Medical-Legal Issues in Radiology

http://www.acr.org/SecondaryMainMenuCategories/BusinessPracticeIssues/Medical-Legal-Handbook.aspx