Want to write a piece for 3DHEALS Expert Corner? Email us: info@3dheals.com

In this series of three articles, we explore five critical risk areas related to data integrity, their consequences, and ways to mitigate them.

Additive manufacturing (AM) is fundamentally changing how the medical industry designs, manufactures, distributes, and maintains products. Soon, all medical products will be part of a digital process — from design through simulation to manufacturing. Additive manufacturing has the potential to offer a faster, more flexible supply chain that accelerates the prototyping process, decreases time to market, reduces waste, and better serves the needs of clients and patients. This benefits the industry in the development of prosthetics, implants, bioprinted organs, spare parts for medical equipment and drugs by lowering the cost production and enabling fully customized products to be made available at the time and place of need.

But, like any other industry going through the digitalization of its products, new challenges are emerging that have created vulnerabilities along the supply chain. The digitization of the medical industry is unique in many ways because of manufacturing regulations, healthcare compliance, and the sensitivity of data such as electronic health care records and personal data.  

According to the RegData’s Industry Regulation Index, the medical industry ranks in the top 10 most-regulated industries because of the high volume of data and rapidly shifting requirements. Additionally, medical manufacturing is a $156B market and is one of the top five most-targeted industries for cyber attacks.

As the medical industry digitizes its supply chain and manufacturing processes, there are five key challenges related to management and control of data (such as the design, engineering and manufacturing data required to additively manufacture anything).

1.      IP risk: if competition (through either legitimate or nefarious actions) gets access to these data, this ultimately leads to potential loss of revenue for the owner of the IP (by way of comparison, consider how the entertainment industry was transformed by the arrival of file sharing and unauthorized reproduction).

2.             Production risk: parts can be produced by any owner of a 3D printer, without following any standard or material requirements — and lacking quality control. This can easily lead to products of inferior quality and performance.

3.             Traceability risk: the lack of connection between a physical part that is additively produced and its digital twin can lead to concerns about the authenticity of part (Did it originate from the latest design? Was it manufactured the right way with the appropriate material? And so on).

4.             Liability risk: since manufacturers are liable for defects in their products — defects in design, manufacture, or foreseeable misuse — the loss of control over data or production process can lead to greater exposure or even legal liability regarding product defects and misuse.

5.             Confidentiality risk: protecting the confidentiality and privacy of personal health data is critical in the medical sector. Therefore, some of these data will be associated with design and manufacturing data for the production of individualized medical devices such as as customized prostheses, implants, and bioprinting. There are implications here regarding data risk exposure that the healthcare sector will have to address.

In my next article, I will discuss these risks in more detail and review options and approaches to help mitigate them.

About the Author:

Stephan is currently the Co-founder and Chief Strategy Officer of Identify3d, a software company that develops software solutions for Digital Manufacturing, in charge of Strategy and Business Development. Identify3d enables the Digital Thread through design protection, manufacturing repeatability, and traceability. Stephan has more than 25 years of experience in Operations, Supply Chain, M&A and Restructuring with companies such as EY, Alvarez & Marsal and REL Consultancy. He holds an M.B.A. from Baruch College’s Zicklin School of Business and a Master in management from Dauphine University (France). Stephan also lectures at the Berkeley-Columbia Executive M.B.A. on performance improvement topics. He is a board member of 3D4pro, an Additive Manufacturing Saas company.

Related Articles:

Cybersecurity for 3D Printed Medical Devices: Less Crazy and More Useful Than Bitcoins – by Jenny Chen, M.D.

3D Printing Poses Unique Security Risks for Medical Devices – by Farah Tabibkhoei, J.D.

Five Reasons Cybersecurity Will Play Critical Role in 3D Printing in Healthcare – Part 2

Five Reasons Cybersecurity Will Play a Critical Role in 3D Printing in Healthcare – Part 3

The post Five Reasons Cybersecurity Will Play a Critical Role in 3D Printing in Healthcare – Part 1 appeared first on 3DHeals.

Want to write a piece for 3DHEALS Expert Corner? Email us: info@3dheals.com

3D printed heart -copyright Materialise

Written by Erik Birkeneder and Valerie Breslin Montague
Doctors are increasingly printing 3D models of a patient’s anatomy to plan for surgery or to aid in diagnosis.  For instance, a cardiac surgeon may take an MRI or CT scan of a patient’s heart to create a plastic model of the heart to plan a valve repair. However, many hospitals do not have 3D printing equipment in-house, so the hospital may send the MRI or CT scans to a company that specializes in 3D printing. Sending these scans outside the walls of the hospital could trigger the privacy and security requirements of HIPAA.

When health care providers send data with certain patient “identifiers” to third parties, the arrangement generally triggers HIPAA. In the case of 3D printing, the substance of what is transmitted, oftentimes a scan of an organ or body part, may not be deemed to be “identifiable” under HIPAA. For example, patient identifiers include the obvious information like names and social security numbers, but also include “biometric identifiers, including finger and voice prints,” “full face photographic images and any comparable images,” and “any other unique identifying number, characteristic or code.” Although many organ, tissue, bone and other body part scans likely will not be deemed to identify a particular patient, others might, such as images that contain fingerprints or dental models.

Prior to transmitting any images or data, health care providers must analyze whether the information to be sent to the 3D printing company is subject to HIPAA (or any other state or federal laws protecting patient confidentiality). If the information does contain patient identifiable information, referred to as “protected health information” under HIPAA, either due to the content of the image, the patient’s name or record number on the image or other data identifying the patient in what is transmitted, the provider must enter into a HIPAA business associate agreement with the 3D printing company.

3D printing companies also should take care when preparing models for hospitals, physicians and other health care providers. Generally, if a 3D printing company is the recipient of protected health information, the company becomes a “business associates”, subject to a number of the HIPAA regulations, such as requirements to adopt designated policies and procedures, conduct a security risk assessment and train the company’s workforce on HIPAA compliance. The company can avoid these compliance efforts by working with its health care clients to ensure that no protected health information is transmitted during the arrangement.

Disclaimer: The foregoing is not intended to convey or constitute legal advice, and is not a substitute for obtaining legal advice from a qualified attorney. You should not act upon any such information without first seeking qualified professional counsel on your specific matter.
JOIN US FOR A MORE IN-DEPTH DISCUSSION ON THE LEGAL ISSUES RELEVANT TO HEALTHCARE 3D-PRINTING ON AUGUST 10TH, 2016

Authors:

Erik Birkeneder is an intellectual property attorney at Nixon Peabody that focuses on health care related patents. Erik also serves as outside general counsel for a number of digital health companies and helps them navigate the unique privacy, and other regulatory hurdles that are facing this industry, including in 3D printing. He has a Master’s in Biomedical Engineering from University of Wisconsin Madison where he performed research on the impact of neuropeptides on wound healing in diabetics, and has a law degree from University of Minnesota.

https://angel.co/erik-birkeneder


Valerie Montague represents a variety of health care providers, digital health vendors, senior living facilities, nonprofit trade associations, life sciences companies and vendors of health care providers. Valerie is a Certified Information Privacy Professional/United States (CIPP/US), the preeminent credential in the field of privacy.

The post Legal: Take Care Not to Trigger HIPAA When Outsourcing Medical 3D Printing appeared first on 3DHeals.