Striking Balance with New Digital Health Technologies

Technology is driving an evolution in U.S. health care. The availability and use of digital health technologies have increased exponentially since the COVID-19 pandemic, and artificial intelligence (AI) is transforming the patient experience. In developing the federal response to new and emerging technologies, policymakers will need to re-evaluate regulatory structures to ascertain whether they account for the complexities of these innovations.

The Bipartisan Policy Center’s Health Program is actively engaged in this dialogue and recently submitted a series of public comments and responses to requests for information. We discuss the need for comprehensive health data privacy reforms, strategies to ensure access to safe medical technologies, and guardrails to maximize benefits and minimize risks associated with AI in health care.

Below is a summary of these comments.

Increasing Patient Access to At-Home Use Medical Technologies (August 2023)

BPC responded to the Food and Drug Administration’s (FDA’s) request for public comments on increasing patient access to at-home use medical technologies. We draw upon our work to develop evidence-based federal policy recommendations for the effective use of remote monitoring technologies. Our comments focus on the need for transparency and ensuring communities with access barriers can utilize these devices.

BPC recommends that Congress direct the FDA to promulgate a rule clarifying that remote monitoring device labels should include performance characteristics. Providers and patients need information on these devices—including how they work across races, ethnicities, and sexes—to gauge their clinical value and appropriate use. We propose creating a list of legally marketed remote monitoring devices or a searchable database to simplify access, eliminate counterfeit device risks, and ensure proper utilization.

Many Americans grapple with limited broadband, including 46 million individuals living in rural and frontier communities. To facilitate widespread access, the FDA should ensure remote monitoring devices are capable of store-and-forward technology—the electronic transmission of medical information to a practitioner at a distant site for use outside of a live patient interaction. Additionally, Centers for Medicare and Medicaid Services (CMS) should allow store-and-forward technologies for billing codes related to remote monitoring and provide guidance on how often patients should transmit data to providers.

Health Breach Notification Rule (August 2023)

BPC submitted comments in response to the Federal Trade Commission’s (FTC’s) proposed rule regarding health data. In the absence of an overarching federal privacy law, BPC supports the FTC’s Health Breach Notification Rule and the proposed changes to safeguard personal health information by encompassing a wider range of data and entities. The proposed changes would add wellness products—such as sexual health, sleep, and diet apps—to the definition of health care services or supplies. This broader definition is more consistent with the type of intimate personal information users disclose in health applications.

BPC requests additional clarification by the FTC, including to:

• clearly articulate that there is now little to no gap through which actors can legally share personal health data;
• ensure the definition of personal health record identifiable information clearly includes data from wellness products; and
• provide safe-harbor rules around cybersecurity.

Improving Americans’ Health Data Privacy (September 2023)

BPC expanded on the need for federal privacy legislation in our response to a request for information from Sen. Bill Cassidy (R-LA).

The United States needs a comprehensive consumer data privacy law that includes protecting data collected from a growing number of digital health tools. The main health-related privacy statute is the Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA protects patient information when held by certain covered entities, including health providers, health insurers, and the business associates of those individuals or organizations. Since HIPAA’s enactment—the same year that the Motorola flip phone and Palm Pilot entered the market—computing power, adoption of electronic health records, and delivery of health care services have changed dramatically.

BPC’s comments emphasize the need for comprehensive privacy legislation and for regulatory agencies to update frameworks to address unique privacy challenges posed by modern health care technologies. Our recommendations aim to strike a balance between safeguarding patient privacy and fostering innovation and efficiency in health care delivery.

2024 Physician Fee Schedule (September 2023)

BPC’s comments on the Centers for Medicare and Medicaid Services’ (CMS) 2024 physician fee schedule draw upon our work on remote monitoring tools and include recommendations to ensure evidence-based health technologies are accessible to all patients.

BPC recommends that CMS tailor its policies to facilitate access to remote patient monitoring, allowing safety net providers—such as federally qualified health centers and rural health clinics—to bill separately for these services and developing disease-specific clinical practice guidelines.

In the 2024 physician fee schedule, CMS proposes including remote monitoring services in the general care management code (GCM), G0511. This inclusion may hinder access to necessary care, since CMS limits patients in safety net clinics to one type of GCM service per month (i.e., only remote monitoring or only comprehensive care management). The physician fee schedule also requires a minimum of 16 days of remote monitoring data per month for reimbursement, even though fewer days of data are sufficient for many health conditions.

BPC recommends that CMS allow safety net providers to bill separately for remote monitoring and consider creating a separate code for these services. We also call for more research to determine the most appropriate use of remote monitoring services by disease state and for which patients. We emphasize the need for disease-specific clinical practice guidelines and tailored Medicare payment policies.

Exploring Congress’ Framework for the Future of AI (September 2023)

BPC also commented on Sen. Cassidy’s request for information regarding Congress’ Framework for the Future of AI. Most of our comments focus on opportunities and risks associated with AI in health care.

When implemented correctly, AI could bridge gaps in health care inequities, alleviate provider burnout, improve patient care, streamline administrative processes, and reduce health care expenses. It also comes with risks. For instance, AI systems could inadvertently amplify existing human biases and exacerbate privacy concerns. The U.S. needs tailored policies that tap into AI’s transformative potential and mitigate inherent risks.

We discuss the role of regulatory bodies like the FDA in steering the integration of AI in health care and the need to adapt regulatory frameworks to address the unique risks and rewards presented by AI technologies. Drawing upon our work on remote monitoring, we highlight gaps in FDA’s framework for medical devices that incorporate AI software, including the need to provide comprehensive performance data and ensure transparency about device limitations.

The federal government needs access to expertise in engineering, data science, law, policy, and ethics to review AI products and assess sociotechnical risks and benefits. Collaboration between diverse public- and private-sector stakeholders is critical as Congress and the executive branch assess which AI use cases are safe and appropriate. As part of these collaborative efforts, BPC recommends that regulatory bodies like the FDA work with the National Institute of Standards and Technology to adopt the AI Risk Management Framework, which provides guidance on how to map, measure, manage, and govern sociotechnical risks throughout the AI lifecycle.

Conclusion

In an era of rapid technological advancement, regulatory frameworks must account for the complexity of emerging health technologies and promote equitable access to evidence-based tools. BPC is at the forefront of this dialogue, informing health policies that embrace innovation while upholding patient safety and data privacy.