This is an archive page. The links are no longer being updated.

Testimony on Health Care Industry Y2K Preparedness by Kevin Thurm
Deputy Secretary
U.S. Department of Health and Human Services

Thank you for inviting me here today to discuss the Department's number one priority -- the Year 2000 computer challenge. I appreciate the opportunity to appear before the Committee again on this important issue. Y2K is a challenge that we and the health care providers who serve our programs' beneficiaries must meet. The Department continues to make remarkable progress on its own systems such as the Medicare claims processing. To ensure continued smooth operation of the health care system and the health and safety of its patients, it is essential that providers also ready their systems for the new millennium. To facilitate reaching this goal, we are engaged in an unprecedented outreach effort to raise awareness in the provider community of the need to be Year 2000-ready and to have contingency plans in place.

Mr. Chairman, I want to thank you for your role in helping us turn the corner on the Y2K challenge. We would have had a much more difficult time meeting this challenge without the support and attention we received from this Committee and the Congress.

In your letter of invitation, you asked me to address three issues: (1) the Department's assessment of the overall Y2K preparedness of the healthcare industry; (2) any particular concerns that the Department may have with regard to rural and inner-city hospitals and skilled nursing facilities; and (3) the Y2K status of biomedical devices and FDA's role in ensuring the preparedness and safety of these devices.

Update on HCFA's Preparedness

Before I address the readiness of the industry, I would like to comment on the readiness of the Health Care Financing Administration. A year ago, few believed that HCFA could be fully Y2K ready by December 31, 1999. Thanks to the strong leadership of Administrator Nancy-Ann DeParle and the dedication of her staff, HCFA has made remarkable progress. We are fully confident that HCFA will be able to timely and accurately pay Medicare claims at the turn of the millennium. I'm happy to reaffirm that all of HCFA's internal systems were renovated, end-to-end and future-date tested, certified compliant, and implemented by the government-wide Year 2000 deadline of March 31, 1999. Among other things, these internal systems manage the eligibility, enrollment, and premium status of 39 million Medicare beneficiaries, and make payments to about 400 managed care organizations. Second, all of the 75 mission-critical claims processing systems, operated by private insurance contractors that process Medicare fee-for service claims and pay bills, have been fully tested and certified as compliant, and are paying bills today.

HCFA's independent verification and validation (IV&V) expert, with oversight from the Department's Office of the Inspector General (OIG), has verified the readiness of the claims processing systems. HCFA has worked closely with the General Accounting Office which has helped HCFA reach its goals by holding it to a high standard.

HCFA's progress in recent months has not lured the agency into relaxing its efforts. Because of the complexity of the Medicare program and the numerous small changes that need to be made to systems between now and this fall, HCFA will continue to check and retest its systems for the remainder of 1999.

Assessment of Health Care Provider Readiness

As you know, last year HCFA notified all Medicare-participating providers and their billing agents that they must submit 8-digit date Y2K-compliant claims by no later than April 5, 1999, or their claims would be returned as unprocessable. To ease the transition to the new billing format, Medicare's fiscal intermediaries and carriers made compliant billing software available to all providers and submitters for free or at a minimal cost. This has yielded positive results. Virtually every claims submitter in the country is now submitting compliant claims to Medicare's contractors.

While the ability to submit 8-digit date claims is an important step toward Year 2000 readiness, it is only a first step. It does not mean that a provider's entire billing system is Y2K compliant, nor that its office computer or practice management software will function into the millennium. Providers must make sure that any and all software used in their practices has been made compliant and has been future-date tested.

HCFA is giving providers the opportunity to test with the contractors' systems to determine whether provider claims, including future-dated claims, can be successfully accepted and processed by the contractors. This type of testing can assure providers that HCFA's data exchanges do work and that future-dated claims will be accepted by Medicare's systems. It gives HCFA a better indication of how many providers have actually done the necessary renovations to make their entire billing systems compliant, and helps HCFA refine and target its future outreach efforts to providers who may not be making adequate progress in meeting their Y2K responsibility.

Of course, health care providers receive payment from insurance sources other than Medicare. Providers need to work with their other payers to verify that those payers are as ready as HCFA is to pay claims at the turn of the millennium.

Being able to submit claims and get paid is, of course, only one reason why health care providers must meet their Year 2000 responsibility. Computer system problems could impact quality of care and patient safety. Patient management systems, clinical information systems, medical devices, such as defibrillators and infusion pumps, and even elevators and security systems all must be checked, renovated, and tested to make sure they are ready so that providers can give quality care.

We are concerned that some providers will not fully meet the Year 2000 challenge on time. Monitoring of surveys of the health care sector by the Department's Inspector General, HCFA, Rx2000, the Gartner Group, and others indicates that some providers are substantially behind in their remediation efforts and could well fail. Providers have the primary responsibility to ready their own systems for the Year 2000 in a timely manner to meet the millennium challenge successfully. The Department does not have the authority, ability, or resources to step in and fix systems for others. We are providing assistance to the extent that we are able, but in some cases that may not be enough. This matter is of urgent concern, and it grows in importance with each passing day.

While these surveys seem to indicate that many hospitals and clinical laboratories are progressing well in addressing the Year 2000 problem, other types of providers, especially physicians and skilled nursing facilities, do not indicate as great an overall state of readiness. Also, smaller facilities, as measured by number of beds or number of employees, seem less ready than larger facilities. This seems to be the case regardless of whether the smaller facility is rural or urban, and I should note that our OIG specifically over-sampled rural providers because they have been a special concern for us. In addition, a recent study by the OIG on the readiness of managed care organizations yielded troubling results. While most health plans report that all of their computer systems will be ready by the turn of the millennium, only 22 percent of Medicare HMOs responding to the OIG survey reported that they were ready in early 1999. Finally, we note that the various surveys indicate that providers, by and large, have more work to do on developing and validating realistic contingency plans.

According to the latest IG report, "Secondary Analysis of Medicare Provider Readiness for Y2K," dated June 2, 1999, there is little difference between urban and rural providers on most Y2K issues. However, there were a few specific areas where the responses of urban and rural providers differed.

• Rural hospitals were more likely to report having financial and personnel problems, while urban hospitals reported more problems with external vendors. Additionally, urban hospitals were more likely to have renovated their billing systems and to have identified all of their external vendors and contractors than rural hospitals.

• Urban nursing facilities were more aware of changes to HCFA forms and of the availability of free contractor software than rural nursing facilities. Furthermore, urban nursing facilities were more likely to have identified all of their external vendors and contractors.

I don't need to caution you that the data reflected by these various surveys become outdated very quickly. The burden is on us to continue close monitoring of the industry, and we are committed to doing that. And the Office of the Inspector General is continuing its survey work.

Of course, we did not wait for survey results to reach out to the health care community. As you are aware, we have made and are continuing to make a vigorous and unprecedented outreach effort to raise awareness of this critical issue and to encourage providers to take the steps necessary for ensuring their own millennium compliance. Because our mission is to ensure that beneficiaries continue to have access to quality health care into the new millennium, we are going beyond our statutory responsibilities. The surveys help us focus our outreach efforts on areas of greatest concern.

Provider Outreach Activities

The Department is leading the health care sector of the President's Council on Year 2000 Conversion. We chair twice-monthly meetings in coordination with a number of provider trade associations and our public sector health partners, like the Defense Department, the Department of Veterans Affairs, and the Labor Department, among others, to share insights, raise millennium awareness, and encourage all providers to become Year 2000 compliant.

Within the Department, HCFA has engaged in an unprecedented campaign to reach out to the provider community. In January, Administrator DeParle sent letters to over one million health care providers outlining the Year 2000 challenge, including a checklist for what they must do to meet their responsibility. A second letter from the Administrator was mailed a few days ago to these more than one million providers further urging them to complete their Y2K remediation work, test their systems, and complete and test their contingency plans. HCFA and the FDA collaborated on these letters. As such, these letters also prompt providers to consult the FDA's website on the compliance of medical devices.

HCFA installed a toll-free telephone line where callers can receive up-to-date answers to their Y2K questions relating to medical supplies, their facilities and business operations, as well as referrals for more specific billing-related information. HCFA also has a website dedicated to the Year 2000, which contains advice and information on Y2K compliance, such as how to identify mission-critical hardware and software and assess its readiness. It also explains how to test systems and how to develop contingency plans. HCFA is also staffing a Y2K speakers bureau which works with provider groups on Year 2000 readiness. HCFA's speakers have made literally hundreds of presentations on Year 2000 issues to providers and others around the nation.

Finally, HCFA, in collaboration with the FDA, the Health Resources and Services Administration (HRSA), and the Veterans Administration, is continuing to participate in a series of training sessions, seminars and conferences, across the country. HCFA and HRSA are sponsoring smaller, more individualized Year 2000 educational sessions targeted toward rural providers.

HCFA has also been working to address the Year 2000 readiness of managed care plans, an area of special concern. HCFA's first objective -- to ensure its own systems for paying managed care plans were compliant -- has already been accomplished. HCFA is now working hard to raise managed care plans' awareness of the importance of being Year 2000-ready and of having meaningful contingency plans. HCFA has been meeting regularly with managed care industry groups and trade associations to discuss and resolve Year 2000 issues. Importantly, HCFA required all Medicare managed care organizations to submit certifications about their Year 2000 readiness by April 15, 1999. HCFA is reviewing these certifications and the results of these reviews and other information will determine which health plans will receive focused onsite reviews by HCFA and its IV&V expert. HCFA is also requiring managed care organizations to provide contingency plans by July 15, 1999. HCFA will review these plans to determine that they address mission-critical systems encompassing their business functions. Our goal is to make sure that our managed care beneficiaries continue to receive uninterrupted quality health care during the transition to the next millennium.

During the last quarter, the other HHS health care sector components conducted numerous outreach activities. The following depicts only a few highlights of their most recent efforts.

The Centers for Disease Control and Prevention (CDC) has posted all Y2K quarterly reports, white papers, assessments, outreach efforts, and other Year 2000 activities on the web at www.cdc.gov/y2k/y2khome. (This website can be reached through the CDC home page.) Additionally, CDC systems managers have provided their findings regarding Y2K compliant software on the CDC website for easy access and distribution worldwide.

In February, CDC completed the first State health department readiness assessment and received more than a 50 percent response rate, and, after analyzing the data, provided the summary findings to the President's Council on Y2K Conversion. This survey was sent again in June to State health agencies to complete.

The Food and Drug Administration (FDA) has developed a response to the public's concern about the availability of medical products (e.g., pharmaceuticals, medical supplies). They have placed a notice in the Federal Register to inform industry of the intent to request information, develop a survey, and establish an audit program. FDA assisted in the White House Roundtables on Pharmaceuticals and on Consumable Medical Supplies.

The Indian Health Service (IHS) is also engaged in an aggressive outreach effort to raise Y2K awareness and provide information to the Tribal and urban health care facilities where IHS has minimal authority and control. To support outreach activities to Tribal and urban programs, a Y2K resource kit composed of videos, brochures, and reference literatures was produced and distributed to nearly 1100 addressees. A Y2K Internet site was also established (www.ihs.gov/y2k) and is continuously being updated to provide a common source of pertinent information for IHS, Tribal, and urban Indian programs.

The Health Resources and Services Administration (HRSA) has disseminated Y2K information through targeted direct mailings, through the HRSA, Human Services Sector and other program specific web sites, speeches, conferences and the Human Services Y2K Helpdesk.

• Each grantee has already received several mailings. In the next few weeks, each will also receive the Y2K Information Guide and a postcard announcing the Y2K Human Services Helpdesk

• The HRSA prepared Y2K Assessment Tool called, "The Workbook for Addressing the Year 2000 Bug in Community and Migrant Health Centers" has been provided to each of the Migrant and Community Health Centers. The Y2K Assessment Tool is also on the HRSA Web Site (www.hrsa.gov) and at (www.bphc.hrsa.gov). The workbook provides a step-by-step approach for health center grantees to reference and document their progress in the assessment, renovation, validation, and implementation phases of their Y2K project schedule.

Rural Health Outreach actions are being coordinated with HCFA and IHS.

• HRSA is preparing a contract with the National Association of Rural Health Clinics to support four regional meetings for Y2K technical assistance to Medicare certified Rural Health Clinic personnel and other rural providers.

• Meetings will be held between June and September 1999.

• HCFA is transferring $100,000 via interagency agreement for these activities

HRSA also is committed to helping our Community and Migrant Health Centers address their Y2K compliance issues:

• Technical Assistance is being provided through contractor assistance.

• HRSA has published a Y2K Assessment Tool.

• Vendors of major patient information software that Community and Migrant Health Centers use have been surveyed to assess the Y2K compliance level of the software and the Centers.

• HRSA is implementing technical assistance plans to help the Centers become Y2K compliant. The technical assistance will provide sample format and outlines for Day One Planning and BCCP Plans.

To increase the visibility for their services, the Administration for Children and Families (ACF) prepared and sent a post card to approximately 12,500 human services providers informing them of available Y2K resources and how to access them. ACF also prepared business cards containing similar information to be distributed at Y2K conferences and meetings where sector representatives have been asked to speak. ACF continues to receive and answer information requests on their Y2K e-mail inquiry line (Y2Kinquiry"ACF.DHHS.gov) as well as by telephone.

ACF has also placed their revised "Y2K Information Guide For Human Services Providers" on the web and prominently displayed a link to view or download it from the first page of the web site. Demand for the Guide has been so overwhelming that 25,000 more guides, revised to be more generic and applicable to the entire Sector's audience, have been printed .

At the Department, we also welcome Congress's help in making all providers aware of the need to become Year 2000-ready and appreciate your ongoing attention to this critical issue. You can help in identifying additional opportunities to publicize the Year 2000 message and we encourage you to stress the importance of this issue whenever you meet with providers.

Contingency Planning

Regardless of success in renovating and testing systems for Year 2000 readiness, we and providers must have business continuity and contingency plans prepared in case unanticipated problems arise. HCFA has undertaken an extensive effort to develop these plans for all its own critical business processes. HCFA's priorities are to ensure that it can: continue prompt and accurate payments to providers, suppliers, and others; safeguard the Medicare Trust Funds by preventing and recovering inappropriate payments; protect quality of care; and sustain beneficiary entitlement and enrollment.

All of the Department's agencies are following the GAO's advice on contingency planning. HCFA and other agencies are now in the process of refining and validating their contingency and Day One plans. Each contingency plan has a designated Emergency Response Team responsible for executing the various contingency plans, if necessary. During the validation phase, these teams will run practice exercises and rehearse plans in a simulated environment.

Of course, contingency planning is not a static process. We will continue to rehearse and refine our plans throughout the coming year and up until December 31, 1999. We will make changes, if necessary, as we learn more about the readiness status of those with whom we interact, such as providers, pharmaceutical and medical equipment suppliers, and States, among others.

HCFA's contingency plans provide mechanisms to make sure that providers' claims will get processed and paid even if parts of HCFA's systems experience unanticipated failure. In addition, you can be sure we will have in place at the turn of the millennium, as we do today, financial and audit controls to help protect the integrity of the Medicare Trust Funds.

We firmly believe that no contingency plan should cause providers who fail to prepare for the Year 2000 to be rewarded for their lack of attention, effort, or due diligence. Being able to submit a valid claim is the minimal requirement that is necessary to ensure that a provider can operate in the Year 2000 environment and is actually furnishing covered services. That is why Administrator DeParle has made it very clear that HCFA has no contingency plan to make estimated payments to providers that cannot submit a bill. Providers simply must have their own contingency plans in place to ensure that they can get accurate and timely claims to Medicare. Providers might consider getting the Medicare claims submission software that I mentioned earlier as one form of back-up to their commercial billing software packages. We, of course, are ready, willing, and able to do all we can to help them succeed, and HCFA has made a variety of contingency planning resources available to the provider community.

Progress on Medicaid Readiness

Although HCFA provides most of the funding for Medicaid, it is the States that operate these programs. The Department does not have the authority, ability or resources to fix State systems. So, it is critical that the States be Y2K ready and have solid contingency plans.

HCFA and its contractors, with the GAO, have made in-depth site visits to all 50 states and the District of Columbia to review readiness and provide technical assistance, and we are just beginning a second round of visits. HCFA is sharing whatever survey information it gathers directly with the States to give them, at a minimum, an independent appraisal of their Year 2000 issues and progress. What we have learned in these first round of visits is consistent with earlier work by the GAO that suggests some States may need to devote more time and attention to Y2K compliance. Those States that are at greatest risk seem to lack senior management support and resources, or have not conducted adequate end-to-end future date testing, or are not developing contingency plans in sufficient detail. HCFA and its IV&V team are revisiting approximately 35 States between now and the end of August to monitor progress and focus on the States' contingency planning efforts. ACF is coordinating site visits with HCFA. Finally, the Secretary has written to the governors three times to bring to their attention the progress that has been made in their States and to indicate what work remains to be done. We have found that the direct communication by the Secretary to the governors results in more attention and resources for States' compliance efforts.

Pharmaceutical Industry and Y2K Compliance

We also have been examining the intersection of Y2K risk mitigation and the availability and quality of certain prescription drugs. In fact, the White House recently held a roundtable discussion on the Y2K readiness of the nation's pharmaceutical supply chain. The discussion focused on those services and supply chains that are critical to the health and well-being of all Americans, and in particular the ready availability of pharmaceuticals ­ from their manufacture to the filling of prescriptions at the drug store. The consensus of those present ­ the brand name and generic drug manufacturers, wholesalers, and health care providers, payers, along with consumer advocates and government regulators ­ is that allowing patients to obtain a substantial advance buying or stockpiling is not necessary and may actually cause the shortage that this kind of action is trying to prevent. We are continuing to examine this issue and will have more factual information later this summer when the results of a Food and Drug Administration (FDA) Y2K survey from pharmaceutical manufacturers are received.

The FDA Commissioner sent a letter, dated April 21, 1999, to the Presidents and CEOs of approximately 4230 pharmaceutical manufacturers, distributors and repackagers requesting their assistance in assuring FDA and the American public that their firms have addressed the Y2K problem as it affects the adequate supply of safe and effective drugs. Included with the letter was a "Y2K Assessment Survey" concerning the status of actions pharmaceutical firms have taken to address this issue. FDA is committed to maximizing the response rate particularly with manufacturers of sole source, orphan and the most prescribed drugs. The results of this survey will provide the basis for a clear message to reassure the American public that drugs will continue to be available as we make the transition to the new century. FDA and the pharmaceutical industry will continue to monitor the Y2K status and availability of pharmaceutical supplies.

FDA has processes in place to address product availability and has used these procedures to help get necessary products to patients. FDA will continue to work with the health professional community, industry and the patient groups regarding Y2K readiness and product availability.

Y2K Status of Biomedical Devices

In evaluating how computer-based equipment will handle the change in the millennium date, this Committee has expressed some concern about the adaption of the wide variety of medical devices upon which contemporary health care depends. The Food and Drug Administration (FDA) regulates the manufacture of these devices and based on the Agency's extensive communication with the industry, FDA believes that the Year 2000 problems with medical devices will not be significant or widespread if facilities take appropriate, identifiable actions to address this issue.

The FDA has taken a number of steps to enhance the confidence of the American public that medical devices will function as intended as Year 2000 approaches. FDA is concerned about the status of Y2K medical devices and has been actively pursuing information from device manufacturers. FDA wants to provide sufficient information to health facilities, professionals and consumers so that an assessment can be made as to the Y2K compliance status of devices being used. For the past two years, FDA has continued to add to its knowledge of medical devices to provide additional assurances. In attempting to achieve this high level of confidence FDA has taken a number of constructive actions to work with manufacturers and provide information to users about the Year 2000 compliance of medical devices.

FDA's Year 2000 Database

An important tool for obtaining information about biomedical equipment is FDA's Federal Year 2000 Biomedical Equipment Clearinghouse database. In order to give the general public, government agencies, and the healthcare and research communities one comprehensive source of publicly available information on the Year 2000 compliance status of biomedical equipment, FDA, VHA and DoD established the database in March 1998 and it is available via the World Wide Web. The Biomedical Equipment Clearinghouse provides Year 2000 product status information in five categories including: products that are Year 2000 compliant; products that do not use a date; products that have a date related problem; products whose status is provided on the manufacturers' websites; and identification of manufacturers for whom no information is available (nonrespondents to FDA requests).

The database can be found on the Internet at fda.gov/cdrh/yr2000. Manufacturers also may submit a World Wide Web link to their own website, if they so choose, where the requested information is provided to the public.

While the database has proven to be useful to health facilities, professionals and consumers -- receiving over 185,000 "hits" from 155,208 users over a period of approximately 13 months -- FDA has continued to collect information from medical device manufacturers. FDA wants to provide as much assurance as possible concerning the Y2K status of medical devices. To that end, FDA has issued a series of letters requesting more specific information about medical devices, not traditionally required by FDA. In addition, FDA has taken a series of actions to ensure that information is available. These include:

• June 25, 1997, notice to all medical device manufacturers (8,322 domestic and 5,085 foreign) registered to FDA's Center for Devices and Radiological Health (CDRH) indicating that they needed to address this issue and review both embedded and non-embedded software products.
• January 21, 1998, letter which I sent to approximately 16,000 medical device and biomedical equipment manufacturers to ask them to voluntarily provide information on the Year 2000 compliance status of their products.
• June 29, 1998, targeted, follow-up letter to specific manufacturers of potentially vulnerable computerized devices.
• September 2, 1998, follow-up to the June 29, 1998, letter directed to the manufacturers of potentially computerized devices who had not responded to the previous requests.
• August 14, 1998 and September 2, 1998, letters from Dr. Bruce Burlington, then Director, CDRH, and Dr. Friedman, then Acting Commissioner of the Food and Drug Administration, to the Health Industry Manufacturers Association (HIMA) requesting that the Association take aggressive and immediate actions to encourage and assist medical device equipment manufacturers in providing information to FDA.
• Late September 1998 FDA posted on the website those manufacturers of selected product categories which are likely to include vulnerable products that had not provided a response to FDA's inquiries.
• March 3, 1999, letter requesting that the 2000 targeted biomedical equipment manufacturers carefully review the Year 2000 status information that they have provided or intended to submit, and, where necessary, provide more specific information on non-compliant products.
• March 29, 1999, memorandum issued by the Director, Division of Emergency and Investigational Operations, Office of Regulatory Affairs (ORA), to the FDA field instructing investigators to expand the Year 2000 activities to include asking questions regarding what the firm has done to assure that the computer controlled and date-sensitive products, manufacturing processes and distribution systems are Year 2000 compliant
• March 29, 1999, letter requesting that targeted medical device manufacturers submit a complete list of individual product models that are Year 2000 compliant. Responses from 572 manufacturers have been received as of June 1, 1999.

Additional Outreach and Guidance

FDA has had a good response rate from those manufacturers believed to have potentially vulnerable equipment (about 2,000). In fact, there are only about 200 manufacturers in this group which have not responded and every effort is being made to determine the status of these companies. In an effort to reach the widest group of individuals, both to get information and to spread information, CDRH also has been conducting extensive outreach to the device industry and to other consumers on this issue. These efforts are as follows:

• CDRH's Division of Small Manufacturers Assistance provided an article in May 1998 entitled, ABiomedical Equipment Manufacturers Urged to Share Year 2000 Information to 12 medical device trade press contacts and to 65 U.S. and 35 foreign medical device trade associations in order to facilitate the dissemination of information to their members regarding the website database and to encourage the posting of data by manufacturers.
• The website and database were mentioned in the FDA Column of the June 3, 1998, Journal of the American Medical Association and in an article in FDA's Medical Bulletin that was sent to approximately 700,000 healthcare practitioners this past summer.
• In the spring of 1998, CDRH developed a Guidance Document on FDA's expectations of medical device manufacturers concerning the Year 2000 date problem. The guidance is available on the FDA website.
• FDA also developed an article addressed to the users of radiation treatment planning systems regarding the need to assess these systems. The article was published in the newsletters of relevant professional associations.
• Staff of CDRH have participated in numerous conferences and video teleconferences devoted to the Year 2000 problem in healthcare in order to communicate with healthcare facilities regarding the Biomedical Equipment Clearinghouse and the need to address the Year 2000 issue with devices.
• In a letter to providers, HCFA noted the FDA website for providers to obtain information on medical devices and Y2K compliance.

Although most devices are regulated by CDRH, FDA's Center for Biologics Evaluation and Research (CBER) regulates blood bank software, which is of particular concern for potential Year 2000 problems. In January 1998, CBER posted guidance for industry entitled, AYear 2000 Date Change for Computer Systems and Software Applications Used in the Manufacture of Blood Products on the FDA website. The guidance provided specific recommendations to assist industry in its evaluation of computer and software systems used in the manufacture of blood products and to assist in evaluating the impact of potential Year 2000 problems. CBER is aware of the status of these individual products and believes that the blood bank software will be Y2K compliant or will have a "patch" or "work-around" for the systems to ensure that the systems will work through Year 2000.

What Is the Data Telling Us Thus Far?

As of June 6, 1999, FDA has entered a total of 4,142 responses from the 16,000 manufacturers originally contacted. As indicated above, FDA believes that approximately 2,000 of the 16,000 manufacturers may produce equipment that may be affected by the Year 2000 problem. The data from all of these manufacturers who have responded have been entered into the database on the FDA website. In addition, 427 manufacturers have provided World Wide Web links (URLs) to data provided on their own manufacturer-operated websites. These numbers change daily as data are entered, corrected or even removed at the request of manufacturers. Of the 4,142 manufacturers who have responded, 3,404 have reported that their products do not use date-related data or all of their products are compliant. Six hundred and fifty-nine manufacturers [311 manufacturers listed on the FDA website and 348 manufacturers listed on the manufacturer websites] have reported one or more products with date-related problems. There are a few submissions in which the data were incomplete or unclear in some manner. FDA is communicating with these manufacturers to obtain clarification before entering the information into the database. FDA will continue to post additional responses as they are received.

In reviewing the data received from the manufacturers so far, FDA sees no indication of widespread problems which will place patients at risk, provided the solutions being developed and offered by manufacturers are implemented. Of course, FDA can not make assurances about manufacturers who have not reported product status. FDA believes that the information received to date confirms our original expectation that the Year 2000 problems with medical devices will not be significant or widespread if facilities take appropriate actions to address this issue. There will be specific problems which need correction; however, the current assessment is that, to the extent problems do arise, they are more likely to disrupt patient care rather than be of direct danger to patients. Nonetheless, such disruption could be serious and the potential for it to happen merits the continued involvement of FDA in its activities of gathering, evaluating, and sharing information.

Potentially High Risk Devices

Although FDA firmly believes that its normal regulatory processes provide the necessary assurances, FDA has come up with the following plan to provide additional assurances to the public and healthcare facilities about the Y2K status of medical devices.

FDA is preparing a list of manufacturers with potentially high risk devices (PHRDs) that are likely to be computer-controlled and that could present a significant risk of immediate harm to the patient should the devices fail to operate as expected due to a Year 2000 problem. FDA will have a contractor conduct an on-site review of records to assess the existence and adequacy of the controlled processes implemented under a quality system to assure that potentially vulnerable devices have been adequately assessed and that any upgrade is correctly implemented and appropriately tested and evaluated by the manufacturer.

The first phase will be a review of a random sample of the manufacturers to determine if there is a significant potential that manufacturers have not taken appropriate steps to address any Year 2000 problem which could present a risk to patients. After evaluating the results of the first phase, a determination, after appropriate consultation, will be made as to whether the second phase should proceed. The second phase would consist of contractor review of a portion of the remaining manufacturers of identified devices not yet audited. FDA is confident that this proposal will provide any additional assurances needed by the public.

FDA will place additional emphasis on reviewing the Y2K status of potentially high risk devices (PHRDs) during the remainder of 1999. Although there are a significant number of device types in this category and a large number of different models for each type, FDA expects that the number of devices that will actually present a significant risk due to Y2K non-compliance to be only a small number.

Now that manufacturers should have completed their assessments of Y2K compliance status and identified non-compliant devices, FDA will review this information to identify any manufacturers of PHRDs for which information is not available or whose non-compliant products pose an actual significant risk to patient health. FDA will review the steps taken in these situations by the manufacturers to notify users regarding any problems that might exist and to assure that appropriate corrections are implemented or the device removed from service. In any situation identified where the action by the manufacturer has been inadequate to assure patient safety, FDA will use its all of its statutory authorities to require corrections and publicize the situations. These actions could include public advisories to device users, suggestions to manufacturers regarding voluntary recalls, mandatory recalls or seizure of the non-compliant devices in extreme risk situations.

FDA's current plan is to complete the assessment of the PHRDs by October 1. The agency believes, in most cases, this date strikes the appropriate balance between permitting implementation of corrective actions and ensuring adequate time remains to recall the device or take other remedial action. FDA will continue to evaluate the appropriateness of enforcing Y2K compliance for particular devices before or after that date. FDA expects, however, that the situations where such actions will be required to be rare as there are many incentives in addition to possible FDA regulatory action which lead manufacturers to address any such potentially high risk situations.

Legal Authority

FDA's legal authorities place responsibility on device manufacturers for establishing a controlled system of device manufacture and design. FDA monitors, regulates, and when necessary, enforces compliance with this required system of controls. Moreover, FDA has enforcement authorities specific to devices that enable the Agency to take remedial action before harm has occurred when the device presents a serious or significant risk of harm. As noted above, this could result in seizure of products and mandatory recalls if FDA is not convinced that a medical device manufacturer has provided adequate assurance of Y2K compliance of particular medical devices.

FDA's Quality System Regulation (QSR) (21 CFR Part 820) requires manufacturers to take corrective and preventive actions, which include recall, for problems with current production. Devices automated with computer software are subject to all requirements of Part 820 unless expressly exempted by regulation. Any computer-automated device that has a Year 2000 problem for which the manufacturer has not made adequate corrections is currently subject to legal action under the Food, Drug and Cosmetic Act, even if the device will function properly until January 1, 2000. The Food, Drug and Cosmetic Act expressly prohibits marketing such devices.

Should FDA learn of Year 2000 problems in devices that could pose serious health risks, FDA will take immediate remedial steps, including enforcement action. FDA's enforcement authorities include requiring notification of all purchasers and users of the device and ordering a recall. Using these remedies, FDA will order, if necessary, the individuals best able to locate current users and the device itself to notify those users of Year 2000 problems, fixes or work-arounds that are available, and to recall the device if necessary.

FDA continues to emphasize to manufacturers the importance of reporting on the Year 2000 compliance status of their products and take additional steps to boost the response rate.

Conclusion