Clinical software systems are becoming ubiquitous. A growing literature documents how these systems can improve health care delivery, but concerns about patient safety must now be formally addressed. In 1996, the U.S. Food and Drug Administration (FDA) called for discussions on regulation of software programs as medical devices. In response, a consortium of organizations dedicated to improving health care through information technology developed recommendations for the responsible regulation and monitoring of clinical software systems by users, vendors, and regulatory agencies. These recommendations were revised and approved by the American Medical Informatics Association Public Policy Committee and Board. Other organizations reviewed, modified, and approved the recommendations, and the Boards of Directors of most of the organizations in the consortium endorsed the guidelines. The consortium proposes four categories of clinical system risk and four classes of monitoring and regulatory action that can be applied on the basis of the risk level. The consortium recommends that most clinical software systems be supervised locally and that developers of health care information systems adopt a code of good business practices. Budgetary and other constraints limit the type and number of systems that the FDA can regulate effectively; therefore, the FDA should exempt most clinical software systems and focus on systems that pose high clinical risk and provide limited opportunity for competent human intervention.
