oversight

Year 2000 Computing Challenge: Compliance Status Information on Biomedical Equipment

Published by the Government Accountability Office on 1999-10-21.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                          United States General Accounting Office

GAO                       Testimony
                          Before the Subcommittee on Oversight and Investigations
                          and the Subcommittee on Health and Environment,
                          Committee on Commerce, House of Representatives


For Release on Delivery
Expected at
10 a.m.
                          YEAR 2000 COMPUTING
Thursday,
October 21, 1999          CHALLENGE

                          Compliance Status
                          Information on Biomedical
                          Equipment
                          Statement of Joel C. Willemssen
                          Director, Civil Agencies Information Systems
                          Accounting and Information Management Division




GAO/T-AIMD-00-26
             Messrs. Chairmen and Members of the Subcommittees:

             Thank you for inviting us to participate in today’s hearing on the Year 2000
             (Y2K) compliance status of biomedical equipment.1 The question of
             whether medical devices, such as magnetic resonance imaging (MRI)
             systems, x-ray machines, pacemakers, and cardiac monitoring equipment,
             can be counted on to work reliably on and after January 1, 2000, continues
             to be one of critical importance to our nation’s health care. To the extent
             that biomedical equipment uses computer chips, it is vulnerable to the Y2K
             problem.2 In the medical arena, such vulnerability carries with it possible
             safety risks.

             Responsibility for oversight and regulation of medical devices, including
             the impact of the Y2K problem, lies with the Food and Drug Administration
             (FDA)—an agency within the Department of Health and Human Services
             (HHS). Since the fall of 1998, FDA has been providing information collected
             from medical device and scientific and research instrument manufacturers
             through its Federal Y2K Biomedical Equipment Clearinghouse.3

             My testimony today will discuss (1) the status of FDA’s Federal Y2K
             Biomedical Equipment Clearinghouse, (2) compliance status information
             on manufacturers’ web sites referred to in FDA’s clearinghouse, (3) FDA’s
             efforts to review the Y2K activities of manufacturers of
             computer-controlled, potentially high-risk devices, (4) information on the
             compliance status of health care providers’ biomedical equipment, and
             (5) information on compliance testing of equipment.



Background   Biomedical equipment is indispensable; it plays a central role in virtually all
             health care. It is defined as any tool that can record, process, analyze,


             1
              Biomedical equipment refers both to medical devices regulated by FDA, and scientific and
             research instruments, which are not subject to FDA regulation.
             2
              As is widely known by now, for the past several decades computer systems have often used
             two digits to represent the year, such as “98” for 1998, in order to conserve electronic data
             storage and reduce operating costs. In this format, however, 2000 is indistinguishable from
             1900 because both are represented as “00.” As a result, if not modified, systems or
             applications that use dates or perform date- or time-sensitive calculations may generate
             incorrect results beyond 1999.
             3
              This site can be accessed on the Internet World Wide Web at
             http://www.fda.gov/cdrh/yr2000/year2000.html.




             Page 1                                                                    GAO/T-AIMD-00-26
display, and/or transmit medical data—some of which may include medical
devices, such as pacemakers, that are implanted in patients—and
laboratory research instruments, such as gas chromatographs4 and
microscopes. Such equipment may use a computer for calibration or for
day-to-day operation. If any type of date or time calculation is performed,
susceptibility to a Y2K problem exists, whether the computer is a personal
computer that connects to the equipment remotely, or a microprocessor
chip embedded within the equipment itself. This could range from the more
benign—such as incorrect formatting of a printout or incorrect display of
the date—to the most serious—incorrect operation of equipment with the
potential to decrease patient safety. The degree of risk depends on the role
of the equipment in the patient’s care.

As part of its oversight and regulatory responsibility for domestic and
imported medical devices, FDA has been collecting Y2K compliance status
information on these devices, as well as on some scientific and research
instruments. Its goal has been to provide a comprehensive, centralized
source of compliance information on biomedical equipment used in the
United States, and make this information publicly available through an
Internet World Wide Web site. In addition, the Veterans Health
Administration (VHA)—a key federal health care provider5—took a
leadership role in determining the Y2K compliance status of biomedical
equipment. Specifically, it obtained information from manufacturers on the
compliance status of biomedical equipment in its inventory, and shared this
information with FDA.

FDA has also acted to identify products within the array of medical devices
used in health care for which Y2K problems could pose a risk to patient
health and safety. It identified 90 types of products that it refers to as
computer-controlled, potentially high-risk devices (PHRD).6 These medical
devices are characterized by their potential for immediate and serious
adverse health consequences for a patient if they fail to function as
designed or expected, including a failure to initiate or continue operation.
These devices are



4
 Such instruments are used to separate the components of a solution with heat and measure
their relative quantities.
5
A component of the Department of Veterans Affairs (VA).
6
Appendix I lists the 90 PHRD product types.




Page 2                                                                 GAO/T-AIMD-00-26
                        • used in the direct treatment or therapy of a patient, the failure of which
                          could result in patient injury or failure of an intended treatment;
                        • used in the monitoring of vital patient parameters, information that is
                          needed immediately for effective treatment; or
                        • necessary to support or sustain life during treatment or patient care.

                        PHRD products identified by FDA include breathing frequency monitors,
                        electroanesthesia apparatus, hemodialysis systems and accessories, and
                        fetal ultrasonic monitors and accessories.7 Also included on the list of
                        PHRD products is equipment used to collect human blood and manufacture
                        blood products.8



Biomedical Equipment    HHS, on FDA’s behalf, initiated action to collect biomedical equipment
                        information in January 1998 by issuing a letter to domestic and foreign
Status Information      manufacturers requesting information on the Y2K compliance of their
Available Through FDA   product lines. All information received from these manufacturers was then
                        to be made available to the public through an FDA web site.
Clearinghouse
                        As we reported in September 1998, FDA’s database did not include product
                        compliance information from many manufacturers who had already
                        provided such information to VHA;9 further, VHA was not making this
                        information available to the public. We therefore recommended that HHS
                        and VHA jointly develop a single data clearinghouse containing information
                        on the Y2K compliance status of biomedical equipment, and make this
                        information publicly available. 10 In response to our recommendation,
                        FDA—in conjunction with VHA— established the Federal Y2K Biomedical
                        Equipment Clearinghouse.


                        7
                         An electroanesthesia apparatus uses electricity to induce and maintain anesthesia during
                        surgical procedures. Hemodialysis systems cycle blood from a patient’s body to filter out
                        body waste before returning the blood to the patient. Fetal ultrasonic monitors use sound to
                        measure the heart rate of the fetus and uterine contractions of the mother during pregnancy
                        and childbirth.
                        8
                         Examples of such equipment include automated blood cell and plasma separators for
                        therapeutic purposes and instruments used to screen the blood supply for blood-borne
                        pathogens.
                        9
                        Year 2000 Computing Crisis: Compliance Status of Many Biomedical Equipment Items Still
                        Unknown (GAO/AIMD-98-240, September 18, 1998).
                        10
                             GAO/AIMD-98-240, September 18, 1998.




                        Page 3                                                                   GAO/T-AIMD-00-26
VHA, the Department of Defense, and the Health Industry Manufacturers
Association all assisted FDA in obtaining compliance status information
from manufacturers. According to FDA, 4,288 biomedical equipment
manufacturers had submitted data to the clearinghouse as of October 4,
1999.

Based on the data submitted, FDA places a manufacturer into one of four
categories.

• Products that do not employ a date—manufacturer reported status as
  “All Products Do Not Use a Date.”
• Products that are all compliant—manufacturer reported all products
  “Y2K compliant.”
• Products with date-related problems—manufacturer reported status as
  “Products With Date-Related Problem.”
• Product status on manufacturer’s web page—manufacturer reported
  status to be “Product Status Specified on a (Web) Page.”

As shown in figure 1, as of October 4, 1999, 61 percent of the manufacturers
reported having products that do not employ a date, while 8 percent
(342 manufacturers) reported having date-related problems such as
incorrect display of date/time. According to FDA, the 342 manufacturers
reported 1,035 specific products with date-related problems. Compliance
data for 429 manufacturers were reported on their web sites and linked
through the FDA clearinghouse.




Page 4                                                      GAO/T-AIMD-00-26
Figure 1: Biomedical Equipment Compliance-Status Information Reported to FDA by
Manufacturers as of October 4, 1999




Note: Total number of manufacturers = 4,288.
Source: FDA.


This total (4,288) excludes 132 manufacturers who, according to FDA, had
not responded to the agency’s request for product compliance information
as of October 4, 1999. According to a top official in FDA’s Center for
Devices and Radiological Health, most of these manufacturers have gone
out of business, do not make computerized products, or just cannot be
located. This official added that FDA nevertheless continues to follow up
with these manufacturers through letters and telephone contact. The
clearinghouse lists the names of these manufacturers who have not
responded to FDA’s requests for product compliance information.




Page 5                                                         GAO/T-AIMD-00-26
                        Our September 1998 report also noted that information on the FDA web
                        site was not detailed enough to be useful.11 Specifically, the list of
                        compliant equipment contained no information on equipment make or
                        model. We therefore recommended that VA and HHS include in the
                        clearinghouse information on the compliance status of all biomedical
                        equipment by make and model. FDA agreed, subsequently requesting this
                        information from manufacturers; users can now find specific information
                        on the make and model of compliant medical devices on-line.



Quality of Compliance   As an alternative to obtaining biomedical equipment product compliance
                        information from manufacturers and posting it to the Federal Y2K
Information on          Biomedical Equipment Clearinghouse, FDA accepts equipment
Manufacturers’ Web      manufacturers’ references to their own web sites for compliance
                        information. The clearinghouse provides users with a direct link to these
Sites Varies            web sites. As of October 1, 429 manufacturers had chosen this option,
Significantly           linking their web sites through the clearinghouse.

                        While FDA is aware of the number of products and their reported
                        compliance status for those manufacturers providing this information to
                        the clearinghouse, in testimony before these Subcommittees this past May,
                        officials stated that they did not know the total number of biomedical
                        equipment products reported by manufacturers on their web sites, or how
                        many of them were noncompliant. We subsequently reviewed information
                        available through these web sites and reported in June that the quality of
                        information available through them varied significantly.12 Specifically, while
                        most sites contained compliance information on at least one product, some
                        contained insufficient information or did not clearly distinguish biomedical
                        equipment from nonbiomedical products.

                        Because of the Subcommittees’ interest in the compliance information on
                        the manufacturers’ web sites, we reviewed this information to identify the
                        total number of biomedical equipment products reported, and categorized




                        11
                             GAO/AIMD-98-240, September 18, 1998.
                        12
                         Year 2000 Computing Challenge: Concerns About Compliance Information on Biomedical
                        Equipment (GAO/T-AIMD-99-209, June 10, 1999).




                        Page 6                                                            GAO/T-AIMD-00-26
their compliance status.13 We also reviewed these sites to assess the clarity
and completeness of the information reported.

As of October 1, 1999, FDA’s clearinghouse listed 429 manufacturers
referring users to their web sites. Of this total,

• 354 manufacturers reported compliance status information for at least
  32,598 individual biomedical equipment products;14
• 71 manufacturers’ web sites either contained insufficient information on
  the number of products and their compliance status, or did not clearly
  distinguish biomedical equipment from nonbiomedical products;
• 3 web sites were those of vendors or distributors, not manufacturers;
  and
• 1 manufacturer’s web-site link in FDA’s clearinghouse did not work.15

Because of the limitations cited above for many of the manufacturers’ web
sites, our ability to determine the total number of biomedical equipment
products reported and their compliance status was impaired. Accordingly,
the actual number of products reported by these manufacturers could be
higher than the 32,598 that we counted.

As shown in figure 2, of the 32,598 products that we were able to identify
on manufacturers’ web sites, about 54 percent reportedly do not employ a
date, about 29 percent of the products are considered compliant, and about
12 percent are reportedly noncompliant. The compliance status of the
remaining 5 percent of products was unknown, for reasons such as the
manufacturer’s ongoing assessment of the product.




13
 We summarized the results of our review in four compliance categories—products that do
not employ a date, products that are compliant, products that are noncompliant, and
products whose compliance status is currently unknown. This last category includes those
manufacturers who reported that they have not completed an assessment of their products,
have discontinued a product, or have a product that is now obsolete.
14
 This includes medical devices, scientific and research instruments, and other supporting
products, such as printers and software.
15
  According to FDA, the contractor assisting it with the clearinghouse verified that this web
site link was operable.




Page 7                                                                    GAO/T-AIMD-00-26
Figure 2: Biomedical Equipment Compliance-Status Information Reported on
Manufacturers’ Web Sites as of October 1, 1999




Note: Total number of products = 32,598.
Source: GAO analysis of manufacturers’ web sites.


The 4,053 noncompliant products that we identified were from the web
sites of 214 manufacturers. This number of noncompliant products is about
four times the number reported directly by FDA in its clearinghouse
(1,035). Examples of these noncompliant products included a bedside
monitor, film digitizer, ultrasound systems, radiology information systems,
and laboratory information systems. Included among noncompliant PHRDs
were ventricular assist devices and hemodialysis equipment.16

In addition to supplying information on noncompliant products, most of
the manufacturers with noncompliant products also provided solutions for
correcting the problem. At least one solution to correcting a problem was

16
 A ventricular assist device is a small electromechanical pump that helps maintain blood
circulation in patients suffering from end-stage heart disease. Hemodialysis equipment
cycles blood from a patient’s body to filter out body waste before returning the blood to the
patient.




Page 8                                                                    GAO/T-AIMD-00-26
offered by 190 of the 214 manufacturers we identified with noncompliant
products. The solutions generally involved upgrades to hardware or
software, manual action (such as turning the equipment on and off on
January 1, 2000), or workarounds.17 We also noted that for these
190 manufacturers, at least 29 offered Y2K solutions to all their products at
no charge, 9 offered no-charge solutions for more that 50 percent of their
product line, 13 offered no-charge solutions to less than 50 percent of their
product line, and 12 offered no solutions free of charge. For the remaining
127 of the 190 manufacturers, we were unable to determine if Y2K solutions
were available to users free of charge.

Our review disclosed that the quality of the information on manufacturers’
web sites continued to vary significantly. It ranged from general assurances
of compliance to detailed information on specific product make and model.
For example:

• A manufacturer reported that its products had no Y2K issues, but it did
  not identify the products.
• A manufacturer reported that it was still assessing its products, and did
  not provide any detailed information on its web site.
• A manufacturer did not list theY2K readiness of products but did report
  that the only Y2K problem it was having was with the software it used to
  run its business.
• A manufacturer listed about 65,000 products, but did not sort them by
  type so that the biomedical products could be easily identified.
• A manufacturer reported that for its 282 products, 79 were compliant,
  50 were noncompliant, the status of 43 was currently unknown, and
  110 were not affected by the Y2K problem. It also provided solutions for
  its reported noncompliant products.
• A manufacturer reported compliance information for 97 products, by
  make and model. Of these, 72 were compliant, 17 were noncompliant,
  1 product was currently under assessment, and Y2K did not apply to
  7 products. It also provided solutions for various noncompliant
  products, including information on the availability of solutions and
  whether to replace the noncompliant product.

Because both the quality of and access to compliance information are
critical to biomedical equipment users, any problems with information on


17
  An example of a workaround is noting on the printout of an EKG machine the year “2000”
instead of “1900.”




Page 9                                                                GAO/T-AIMD-00-26
                       manufacturers’ web sites could have a direct bearing on the ability of
                       health care providers to identify and correct any noncompliant equipment
                       in their inventories. Accordingly, we believe that FDA should request that
                       manufacturers that are providing information through their web sites
                       clearly identify product make and model, compliance status, and
                       availability of solutions for noncompliant equipment.



FDA Is Now Reviewing   While compliance information is available through FDA’s Federal Y2K
                       Biomedical Equipment Clearinghouse, we have raised concerns in the past
Manufacturers’ Y2K     year about the lack of independent verification and validation of
Activities             biomedical equipment that manufacturers have certified as compliant. In
                       addition to making sure that manufacturers provide detailed information
                       on their products, we believe that it is essential that FDA provide some
                       level of confidence that critical care and life support medical devices will
                       work as intended.

                       In response to our previously reported concerns, FDA is now reviewing a
                       sample of biomedical equipment manufacturers’ Y2K activities, such as risk
                       management, test planning and procedures, and implementation and
                       contingency planning. In September 1998, we first reported that FDA did
                       not require manufacturers to submit test results certifying product
                       compliance.18 Rather, we noted, FDA relies on the manufacturer to validate,
                       test, and certify that it has adequately addressed any Y2K problem. As a
                       result, we stated that FDA lacked assurance that biomedical equipment
                       manufacturers had adequately addressed the Y2K problem for
                       noncompliant equipment.

                       Accordingly, we recommended that HHS take prudent steps to review
                       manufacturers’ compliance test results for critical care/life support
                       biomedical equipment, especially equipment once determined to be
                       noncompliant but now deemed compliant, and that for which concerns
                       about the determination of compliance remain. At the time, HHS and FDA
                       did not concur with our recommendation. They reasoned that submissions
                       of appropriate certifications were sufficient, further stating that they did
                       not have the resources to undertake such reviews.




                       18
                            GAO/AIMD-98-240, September 18, 1998.




                       Page 10                                                     GAO/T-AIMD-00-26
As mentioned, HHS and FDA have now changed this position. In a May 25,
1999, hearing before these Subcommittees, FDA’s Acting Deputy
Commissioner for Policy testified that FDA proposed reviewing
manufacturers’ test results supporting compliance certifications for a
sample of critical devices. FDA’s proposal consisted of two phases. In the
first phase FDA would

• develop a list of the manufacturers of these devices;
• from this list of manufacturers, select a sample of 80 for review; and
• hire a contractor to develop a program to assess manufacturers’
  activities to identify and correct Y2K problems with PHRDs.

The goal of the first phase of the survey is to extrapolate from the
80 assessments a level of overall confidence in the biomedical equipment
industry’s Y2K compliance activities. According to FDA, the second phase
of the evaluation would be undertaken only if the results of the first phase
indicated a need for further review of manufacturer Y2K activities because
of concerns about how manufacturers are addressing the issue of product
compliance.

In carrying out its plan to assess manufacturers’ Y2K activities, FDA issued
a task order on July 1, 1999, for a contractor, assisted by two
subcontractors, to perform assessments of the Y2K compliance activities
for a sample of PHRD manufacturers. FDA identified 803 PHRD
manufacturing sites that produce equipment sold in the United States.19
These were composed of 726 biomedical equipment manufacturing sites
and 77 manufacturing sites of blood and blood products equipment that
manufacture product types listed in appendix I.

FDA’s contractor then randomly selected 325 of the 803 sites for possible
assessment. These manufacturing sites were then contacted and asked if
they would volunteer to participate in the assessment process. As of
October 4, 1999, of the 325 randomly selected sites,

• 197 were identified as producing no computer-controlled equipment,
• 80 agreed to participate,




19
 The 803 consisted of those manufacturers among the 90 types of PHRDs identified that had
registered PHRD products with FDA.




Page 11                                                                GAO/T-AIMD-00-26
• 26 declined to participate,20
• 18 were duplicates,21 and
• 4 did not respond.

To carry out the on-site assessments of manufacturing sites, the contractor
developed a guide for its examiners. This guide focused on the firm’s Y2K
activities in six areas: (1) executive leadership and control, (2) risk
management, (3) corrective and preventive actions, (4) test planning and
procedures, (5) communication with the consignee (user of the products),
and (6) implementation and contingency planning.

After completing these assessments at the manufacturers’ sites, examiners
were required to prepare a report of concerns in each of the six areas
reviewed. Concerns were identified as high, medium, or low, as defined
below:

• high—actions that are not timely, inadequate planning, inadequate or
  incomplete resources, incomplete or inaccurate deliverables, inability to
  validate results, and/or inadequate due diligence;
• medium—actions that are somewhat late, incomplete planning,
  insufficient or incomplete resources, deficiencies in deliverables, and/or
  incomplete validation of results; and
• low—actions that are on schedule and have adequate resources.

According to FDA’s PHRD survey project manager, as of October 15, 1999,
examiners had completed all 80 manufacturer site assessment visits, and
had prepared 62 assessment reports.

We reviewed the 25 manufacturer site visit reports that were completed by
the examiners and available to us as of September 10, 1999. For 20 of these
assessments, the examiners’ assessed concern was low. At the five
remaining manufacturing sites, the examiner found at least one item of
moderate concern in the six areas, such as test planning and procedures.
According to the PHRD survey project manager, the areas identified in the


20
 According to FDA, reasons given by manufacturers for declining to participate included
scheduling or resource limitations and recent regular FDA site inspections. Five
manufacturing sites declined without giving a reason.
21
 These sites involved large, multisite manufacturers where the FDA contractor had already
selected two or more of the same manufacturer’s sites. According to FDA, the contractor did
not assess duplicates if they came up in later samples.




Page 12                                                                GAO/T-AIMD-00-26
site visit reports as medium risk do not constitute a risk to patient health or
safety.

Until recently, none of the site visit reports submitted to FDA contained a
concern assessed as high. However, earlier this week, the PHRD survey
project manager informed us that FDA had just received a site visit report
with concerns assessed as high in two areas—leadership and control, and
test planning and procedures. The report stated that the manufacturer’s
policies and procedures were found to be inconsistent, ambiguous, and
were not followed in a manner that would meet due diligence
requirements. It also noted that the qualifications of the manufacturer’s
personnel for specified tasks were not well defined, and that some
personnel assigned to tasks identified in the policies and procedures were
not qualified to perform those tasks. The report concluded that the
manufacturer’s procedures for Y2K assessment and corrective and
preventive action were less than adequate, and that assessment procedures
had not been applied consistently. The manufacturer subsequently told the
examiner that action would be taken on the issues raised. FDA officials
told us that they plan to follow up with the manufacturer.

The project manager also told us that FDA’s contractor is in the process of
preparing a final report summarizing the overall findings from the 80 site
visit assessment reports, detailing any problems encountered during the
project. This individual indicated that FDA expects to receive the final
report from the contractor later this month. Although FDA initially
expected to submit a final report to HHS by October 1, it has not yet
established a date for when this will occur.

To assess how the contractor was executing FDA’s task order, we observed
selected site assessments. At the five manufacturing site assessments we
observed, examiners generally followed the contractor-developed audit
guide and were knowledgeable about information technology management,
Y2K testing, and risk assessment. During our two initial visits, we noted
that examiners sometimes could not answer questions from the
manufacturers relating to the FDA clearinghouse and the processing of the
final report on the site assessments. We subsequently shared these
observations with FDA officials. FDA agreed to consider our suggestions,
such as better communicating to the firms the final reporting process and
how the FDA Federal Y2K Biomedical Equipment Clearinghouse works.
During the later three visits, we did not observe any similar areas of
concern.




Page 13                                                        GAO/T-AIMD-00-26
                       Many of the 803 PHRD manufacturing sites identified by FDA are in foreign
                       locations. Specifically, our review of the 803 sites on FDA’s list showed that
                       203 were located in 27 foreign countries (appendix II lists these countries).
                       Of the 325 randomly selected for assessment, 233 were in the United States
                       and 92 were in 22 foreign countries. Finally, of the 80 locations where
                       manufacturers agreed to be assessed by FDA, 65 are located in the United
                       States and 15 are located in 8 other countries—Canada (1 site), Finland (2),
                       Germany (4), the Netherlands (1), Norway (1), Sweden (2), Switzerland (1),
                       and the United Kingdom (3).



Information on         While information is available on the Y2K compliance status of biomedical
                       equipment through the FDA clearinghouse and other sources, it is not clear
Biomedical Equipment   at this time how extensively health care providers are using this
Compliance of Health   information to determine their Y2K readiness. According to FDA, it has
                       taken steps to make users aware of the clearinghouse. For example, FDA
Care Providers         has published articles in professional trade journals and participated in
Incomplete             conferences aimed at health care facilities.

                       FDA also informed us that the Federal Y2K Biomedical Equipment
                       Clearinghouse had received about 317,000 inquiries between April 1998 and
                       September 1999. However, according to FDA, it is not possible to
                       determine the sources of the inquiries.

                       To determine whether health care providers were using the FDA
                       clearinghouse to assess the Y2K compliance status of their biomedical
                       equipment, we reviewed readiness surveys sent to providers by several
                       federal agencies and professional health care associations.22 For example,
                       the American Medical Association (AMA) surveyed a random sample of
                       7,000 of its members in July/August 1999 on whether they were aware of
                       the FDA clearinghouse; only 17 percent of respondents indicated that they
                       were.

                       In addition, a July 1999 HHS Office of Inspector General (OIG) survey sent
                       to hospitals, nursing facilities, home health agencies, and physicians
                       contained three questions on FDA’s clearinghouse. These questions related
                       to awareness, usage, and whether the clearinghouse was helpful.


                       22
                        These include HHS’ Office of the Inspector General, American Hospital Association (AHA),
                       and AMA.




                       Page 14                                                                GAO/T-AIMD-00-26
Responses to the HHS OIG survey varied significantly. For example, about
80 percent of the hospitals responding stated that they were aware of the
clearinghouse, but less than half of the nursing facilities, home health
agencies, and physicians responding stated this same awareness. Further,
while about 60 percent of the responding hospitals reported that they used
the clearinghouse, 25 percent or fewer of the responding nursing facilities,
home health agencies, and physicians reported using the clearinghouse to
obtain readiness information about their biomedical equipment.

The HHS OIG survey noted that there was general agreement among the
respondents that the clearinghouse information was helpful. Specifically,
100 percent of the physicians, 95 percent of the nursing facilities,
91 percent of the hospitals, and 87 percent of the home health agencies that
said they had used clearinghouse data said they found the information to be
helpful.

Although compliance information on biomedical equipment is available
through FDA’s clearinghouse, theY2K readiness status of equipment at
health care providers’ offices is not known because a significant number of
providers did not respond to the surveys. As shown in table 1, the response
rates to the July survey from the HHS OIG to nursing facilities, home health
agencies, and physicians were all less than 50 percent. The response rates
to surveys from AHA and AMA on this subject were even less, at 29 and
8 percent, respectively. Lastly, the response rate to a survey from the
American Health Care Association (AHCA)23 was even more disappointing,
at less than 3 percent.




23
 This is a federation of 50 state health organizations that represent nearly 12,000 nonprofit
and for-profit assisted living, nursing facility, long-term care, and subacute-care providers.




Page 15                                                                    GAO/T-AIMD-00-26
Table 1: Reported Survey Results of Y2K Readiness of Biomedical Equipment
                                                                          Percentage
                                                                          responding         Percentage
Entity performing                           Number        Number of          currently       responding
survey/group surveyed                      surveyed       responses         compliant        don’t know
HHS Office of the Inspector
General (July 1999)
Hospitals                                       1,000             537a               27              5
Nursing facilities                              1,000             230a               50             25
Home health agencies                            1,000             159a               48             27
Physicians                                      1,000              79a               56             22
American Hospital
Association (AHA)
(February 1999)                                 2,000              583                6              2
American Medical
Association (AMA)
                                                                                       c              d
(July/August 1999)                              7,000              544
American Health Care
Association (AHCA)
(March 1999)                                  12,000              342e               24               d


American Medical Group
Association (AMGA)b
                                                                                                      d
(March 1999)                                      230               99               42


Source: Organizations listed. We did not independently verify this information.
a
 The number of respondents who selected “not applicable” for the question were excluded from the
number of responses.
b
 This organization represents approximately 45,000 physicians in more than 230 medical groups
across 40 states.
c
 According to the survey results, 67 percent of responding physicians rent or lease biomedical
equipment that will be affected by Y2K; 62 percent of them were confident that their vendors have
prepared the equipment for Y2K. Data were not provided on the remaining 33 percent of responding
physicians.
d
    The survey did not have “Don’t Know” as a response choice.
e
    Twenty-eight percent of the respondents said this question was not applicable to them.


The survey results also indicated that much work remains in making
biomedical equipment Y2K-ready. Table 1 shows that less than one-third of
the hospitals responding to HHS’ OIG survey stated that all of their
biomedical equipment was currently compliant, and only 6 percent of the
hospitals responding to the AHA survey stated that their biomedical
equipment was currently compliant.




Page 16                                                                             GAO/T-AIMD-00-26
Manufacturers Vary on   The question of whether to test their biomedical equipment for Y2K
                        compliance is a difficult one that confronts many users, such as hospitals
User Testing of         and physicians’ offices. FDA has taken the position that manufacturers’
Biomedical Equipment    submissions of Y2K compliance certifications provide sufficient assurance
                        of product compliance, and that such testing on the part of users is not
                        necessary. VA and the Emergency Care Research Institute (ECRI)24 have
                        also stated that manufacturers are best qualified to analyze embedded
                        systems or software to determine Y2K compliance. Accordingly, they do
                        not encourage user testing of biomedical equipment for Y2K compliance.
                        ECRI guidelines, however, suggest that health care facilities should
                        consider testing interfaces between medical devices in cases where the
                        facility cannot determine theY2K compliance of the interface from the
                        device manufacturers.

                        In contrast to VHA’s and FDA’s positions, some hospitals in the private
                        sector believe that testing biomedical equipment is necessary to prove that
                        they have exercised due diligence in the protection of patient health and
                        safety. We have testified that officials at three hospitals told us that their
                        biomedical engineers established their own test programs for biomedical
                        equipment and, in many cases, contacted the manufacturers for their test
                        protocols.25 Several of these engineers informed us that their testing
                        identified some noncompliant equipment that the manufacturers had
                        earlier certified as compliant. According to these engineers, the equipment
                        found to be noncompliant all had display problems and was not critical
                        care/life support equipment. We were told that equipment found to be
                        incorrectly certified as compliant included a cardiac catheterization unit, a
                        pulse oxymeter, medical imaging equipment, and ultrasound equipment.

                        Our review of manufacturers’ web sites disclosed that manufacturers’
                        opinions vary on whether users should test their biomedical equipment. We
                        noted that at least 37 manufacturers provided information on their web
                        sites about Y2K testing. Of these, 30 encouraged testing; 15 provided end
                        users with information such as test protocols and instructions. Fifteen
                        manufacturers also encouraged users to test their devices in configuration


                        24
                         ECRI is an international, nonprofit health services research agency. It believes that
                        superficial testing of biomedical equipment by users may provide false assurances, as well
                        as create legal liability exposure for health care institutions.
                        25
                         Year 2000 Computing Crisis: Action Needed to Ensure Continued Delivery of Veterans
                        Benefits and Health Care Services (GAO/T-AIMD-99-136, April 15, 1999).




                        Page 17                                                                 GAO/T-AIMD-00-26
with related equipment to ensure that the devices operate as intended.
Seven manufacturers did not encourage testing; two of these stated that
such testing could disrupt operation of software.

As we testified in May, the question of whether to independently verify and
validate biomedical equipment that manufacturers have certified as
compliant is one that must be addressed jointly by medical facilities’
clinical staff, biomedical engineers, and corporate management.26 The
overriding criterion should be ensuring patient health and safety.

In summary, compliance status information on biomedical equipment can
be found in FDA’s clearinghouse or on manufacturers’ web sites. The
quality of the compliance information on the web sites, however, varies
significantly, ranging from general assurances of compliance to detailed
information on specific product make and model. Given the criticality of
having medical devices function as intended on and after January 1, it is
important that FDA encourage manufacturers to provide detailed
information on the product make and model, compliance status, and
availability of solutions for noncompliant equipment.

To its credit, FDA has assessed the Y2K compliance activities of 80 PHRD
manufacturing sites. Although most appeared to have been assessed as
having low degrees of concern, one site had a concern in two areas
assessed at high. FDA is currently reviewing this site to make sure that
there are no unresolved issues affecting patient safety.

Because a significant number of health care providers are not responding
to Y2K surveys sent by federal agencies and professional associations, the
public lacks information on the readiness of providers. Such information
would help alleviate public concerns about the Y2K readiness of health
care providers and the biomedical equipment they use in patient care.
Lastly, although there are varying views on whether end users should test
their biomedical equipment for Y2K compliance, the overriding criterion
should be ensuring patient health and safety.


We performed this assignment in accordance with generally accepted
government auditing standards, from July 1999 through October 1999. We


26
 Year 2000 Computing Challenge: Much Biomedical Equipment Status Information
Available, Yet Concerns Remain (GAO/T-AIMD-99-197, May 25, 1999).




Page 18                                                            GAO/T-AIMD-00-26
                  reviewed and analyzed information listed in the Federal Y2K Biomedical
                  Equipment Clearinghouse. We also reviewed and analyzed information
                  listed on the web sites of biomedical equipment manufacturers referred to
                  in FDA’s Federal Y2K Biomedical Equipment Clearinghouse. In addition, we
                  reviewed and analyzed FDA documentation on the agency assessments of
                  PHRD manufacturing sites, including selected contractor’s final reports to
                  FDA on the manufacturers. We also visited five PHRD manufacturing sites
                  and observed FDA’s contractor examiners carrying out the assessment of
                  the firms’ Y2K compliance activities. We interviewed FDA officials
                  responsible for the Federal Y2K Biomedical Equipment Clearinghouse and
                  oversight and management of the agency’s survey of PHRD manufacturer
                  Y2K compliance activities.

                  Messrs. Chairmen, this concludes my statement. I would be pleased to
                  respond to any questions that you or other members of the Subcommittees
                  may have at this time.



Contact and       For information about this testimony, please contact Joel Willemssen at
                  (202) 512-6253 or by e-mail at willemssenj.aimd@gao.gov. Individuals
Acknowledgments   making key contributions to this testimony included Gwen Adelekun,
                  Dr. Nabajyoti Barkakati, Michael Fruitman, James Houtz, Robert Kershaw,
                  Helen Lew, Barbara Oliver, Michael Resser, Glenn Spiegel, and Glenda
                  Wright.




                  Page 19                                                    GAO/T-AIMD-00-26
Appendix I

FDA’s List of Computer-Controlled Potentially
High-Risk Medical Device Types                                                                          Appendx
                                                                                                              Ii




               Classification Name
               Anesthetic vaporizer
               Arrhythmia detector and alarm
               Autotransfusion apparatus
               Automated blood cell and plasma separator for therapeutic purposes
               Automated blood grouping and antibody test system
               Blood and plasma warming device
               Blood storage refrigerator and blood storage freezer
               Breathing frequency monitor
               Breathing gas mixer
               Cardioconverter, implantable
               Cardiopulmonary bypass heart-lung machine console
               Cardiopulmonary bypass on-line blood gas monitor
               Cardiopulmonary bypass pulsatile flow generator
               Cardiopulmonary bypass pump speed control
               Centrifugal chemistry analyzer for clinical use
               Continuous flow sequential multiple chemistry analyzer for clinical use
               Continuous ventilator
               DC-defibrillator low energy (including paddles)
               Defibrillator, automatic implantable cardioconverter
               Defibrillator, implantable, dual-chamber
               Device, thermal ablation, endometrial
               Discrete photometric chemistry analyzer for clinical use
               Electroanesthesia apparatus
               Environmental chamber for storage of platelet concentrate
               External counter-pulsating device
               External negative pressure ventilator
               External pacemaker pulse generator
               External programmable pacemaker pulse generator
               Fetal ultrasonic monitor and accessories
               Gas machine for anesthesia or analgesia
               Glucose test system
               Hemodialysis systems and accessories
               High permeability hemodialysis systems
               Hyperbaric chamber
               Hysteroscopitc insufflator
                                                                                                Continued




               Page 20                                                                   GAO/T-AIMD-00-26
Appendix I
FDA’s List of Computer-Controlled
Potentially High-Risk Medical Device Types




Classification Name
Implantable pacemaker pulse-generator
Implanted cerebellar stimulator
Implanted diaphragmatic/phrenic nerve stimulator
Implanted electrical urinary continence device
Implanted intracerbral/subcortical stimulator for pain relief
Implanted nueromuscular stimulator
Implanted peripheral nerve stimulator for pain relief
Implanted spinal cord stimulator for bladder evacuation
Implanted spinal cord stimulator for pain relief
Indwelling blood carbon dioxide partial pressure (PCO2) analyzer
Indwelling blood oxygen partial pressure (PO2) analyzer
Infant radiant warmer
Infusion pump
Instruments used to screen the blood supply for bloodborne pathogens
Intermittent mandatory ventilation attachment
Intra-aortic balloon and control system
Isolated kidney perfusion and transport system and accessories
Kit, test, alpha-fetoprotein for neural tube defects
Laproscopic insufflator
Lipoprotein, low density, removal
Lung water monitor
Medical charged-particle radiation therapy systema
Medical Neutron radiation therapy systema
Membrane lung (for long term pulmonary support)
Micro chemistry analyzer for clinical use
Neonatal incubator
Neonatal transport incubator
Nonroller-type cardiopulmonary bypass blood pump
Oxygen-uptake computer
Pacemaker programmers
Peritoneal dialysis system and accessories
Portable oxygen generator
Powered emergency ventilator
Processing system for frozen blood
Pulse-generator, dual chamber, implantable
Pulse-generator, program module
Pulse-generator, single chamber
                                                                Continued from Previous Page




Page 21                                                                   GAO/T-AIMD-00-26
Appendix I
FDA’s List of Computer-Controlled
Potentially High-Risk Medical Device Types




Classification Name
Pulse-generator, single chamber, sensor driven, implantable
Pump, drug administration, closed loop
Pump, infusion, implanted, programmable
Radionuclide radiation therapy systema
Remote controlled radionuclide-applicator systema
Roller type cardiopulmonary bypass blood pump
Software, blood bank, stand alone products
Separator for therapeutic purposes, membrane automated blood cell/plasma
Sorbent hemoperfusion system
Stimulator, cortical, implanted (for pain)
Stimulator, electrical, implanted, for Parkinsonian tremor
Stimulator, sacral, nerve, implanted
Stimulator, spinal-cord, totally implanted for pain relief
Stimulator, subcortical, implanted for epilepsy
System, pacing, temporary, acute internal atrial defibrillation
Ventilator, high frequency
Ventricular bypass (assist) device
X-ray radiation therapy system a
                                                                   Continued from Previous Page
a
 These device classifications include radiation treatment planning systems that are accessories to
these device types.
Source: FDA.




Page 22                                                                          GAO/T-AIMD-00-26
Appendix II

Listing of Foreign Countries With PHRD
Manufacturing Sites                                               Appendx
                                                                        iI




                      Argentina
                      Australia
                      Belgium
                      Brazil
                      Canada
                      Costa Rica
                      Denmark
                      Finland
                      France
                      Germany
                      Ireland
                      Israel
                      Italy
                      Japan
                      Malaysia
                      Mexico
                      Netherlands
                      New Zealand
                      Norway
                      Pakistan
                      People’s Republic of China
                      Republic of Korea
                      Singapore
                      Sweden
                      Switzerland
                      Thailand
                      United Kingdom




(511772)      Leter   Page 23                      GAO/T-AIMD-00-26
United States                       Bulk Mail
General Accounting Office      Postage & Fees Paid
Washington, D.C. 20548-0001           GAO
                                 Permit No. GI00
Official Business
Penalty for Private Use $300

Address Correction Requested