“We have embraced circularity as a way to take back products and to recoup the value, and to recoup the scarce material to avoid [their going] to the landfill, but actually, closing the loop is good business because I don't want our medical equipment to fall in the hands of third parties, who then cannibalize the systems and destroy my spare parts business,” he said, according to transcripts.

The Service Pack 5 update essentially locked servicers without CSIP Level 1 credentials or higher, such as Image Technology Consulting, out of the software menus they had previously been accessing without the manufacturer's knowledge or express consent. It's logical to assume that over time the effect would be end users abandoning the exiled ISOs and bringing their service business to Philips.


FDA requires OEMs to provide instructions to third parties
Independent servicers and biomedical engineers have long complained that certain manufacturers withhold necessary installation and service documents or materials. Many of the comments submitted to a 2016 FDA docket on the topic of medical device service pointed to uncooperative OEMs as a top safety concern for ISOs trying to do their jobs.

The Code of Federal Regulations Title 21, Section 820 is the Quality System Regulation (QSR) concerning medical device quality and safety requirements. Section 820.170 states, in part:

Each manufacturer of a device requiring installation shall establish and maintain adequate installation and inspection instructions, and where appropriate, test procedures. Instructions and procedures shall include directions for ensuring proper installation so that the device will perform as intended after installation. The manufacturer shall distribute the instructions and procedures with the device or otherwise make them available to the person(s) installing the device.

The Division of Industry and Consumer Education (DICE) at FDA's Center for Devices and Radiological Health (CDRH) has clarified, in correspondences reviewed by HCB News, that the regulation, “includes third party installers and the customer if the customer (such as a hospital) has qualified persons who can install the device."

Is it possible that documents Philips classified as CSIP Level 1 (“available only to customers with a valid contract and subject to nondisclosure agreements”) were required by FDA regulations to be accessible to anyone qualified to work on the machines? As the question pertains to the lawsuit filed by Philips, court filings suggest it may be beside the point.

The legal representatives for Image Technology Consulting cited Section 820.170 as part of a motion to dismiss the lawsuit in July of 2022, but were denied in part because the case is concerned with the “acquisition, sale, and use of fake and/or unauthorized IST certificates,” which the court determined does not require interpretation of FDA regulations.

A medical device copyright exemption
In 2021, three years after the release of Service Pack 5 and in the shadow of the COVID-19 pandemic, the Librarian of Congress approved an exemption to the Digital Millennium Copyright Act (DMCA) permitting medical device owners and third parties to access system software necessary for the purposes of diagnosing, maintaining, and repairing the equipment.

The ruling specifically limited DMCA liability for working around OEM access controls to copyrighted software and related data files on lawfully acquired systems, when access is a necessary step in maintaining or restoring a device to work in accordance with its original specifications.

In its lawsuit, Philips asserts the exemption does not shield Image Technology Consulting from liability for two reasons. One, because it does not apply to "unfettered access to Philips’ protected CSIP materials and expressly excludes conduct that modifies software" and two, because the exemption is not retroactive. Whether or not those arguments are persuasive remains to be seen, but other industry stakeholders have sought to make the case that the exemption is unlawful to begin with.

The Medical Imaging Technology Alliance (MITA) and AdvaMed, groups representing the interests of medical equipment manufacturers, sued the Library of Congress over the exemption in February 2022. They claimed that the software protections employed by medical device manufacturers are essential to safeguard patients and their privacy — and that the Library’s rule would allow independent service providers to “piggyback” off the work done by the device’s original developers. The complaints were denied in federal court, but MITA and AdvaMed have appealed the ruling and the case remains pending.

Right-to-repair: The big picture
While medical equipment manufacturers have long sought to frame independent servicers as a patient safety hazard, a 2018 report by the FDA cast doubt on those fears, finding "objective evidence is not sufficient" to justify the implementation of new regulatory requirements on third parties.

More Magazine Features

MRI Homepage