By Robert J. Kerwin
A little-known rulemaking proceeding is underway at the U.S. Copyright Office which, depending upon the outcome, may have profoundly favorable implications for the use by servicers of electronic medical device equipment manuals.
Every three years under the Digital Millennium Copyright Act (“DMCA”), the Librarian of Congress, upon receipt of the recommendation of the Register of Copyrights, is permitted to exempt, on a temporary basis, certain classes of copyrighted works from the DMCA’s prohibition against the circumvention of "technology protection measures" (TPMs). Known as the "Triennial Rulemaking Proceeding" (yes that’s quite a mouthful), the Register of Copyrights considers whether “persons who are users of a copyrighted work are or are likely to be, in the succeeding 3-year period, adversely affected by the prohibition [on circumvention].”
During this proceeding, the Register considers petitions for new exemptions along with renewal requests for past exemptions. At this writing, the Register is considering a petition for exemption of "computer programs and data files that are contained in and controlling the functioning of medical devices for repair."
DMCA can be tool to limit competition without new exemption
There is little doubt that the DMCA has been an enormously impactful law over the last 20 years to prevent copyright infringement. Designed, in large part, to protect companies and artists having their work stolen, many feel that certain parts of the law actually have resulted in copyright protection gone horribly wrong. Some have argued that the law has actually hampered competition.
U.S. Senator Thom Tillis has suggested that the DMCA is ill-suited for the needs of most copyright owners and has called for DMCA’s modernization to encourage “the creation of copyrightable works and to protect users and consumers who are making lawful uses of copyrighted goods and software-enabled products, respectively.” While Congress is considering the draft legislation submitted by Tillis, (which includes measures to improve exemptions available to users), the U.S. Copyright Office is continuing with its eighth rulemaking proceeding to consider exemption renewals and new possible exemptions.
New exemption proposed on medical equipment servicing materials
An exemption pertaining to medical devices is now being considered by the Register of Copyrights for possible recommendation to the Librarian of Congress. The exemption, requested by Transtate Equipment Company, would allow access to computer programs and data files that are contained in and control the functioning of medical devices for the purpose of diagnosis, maintenance, or repair of devices. Note: service manuals are frequently on the device. This exemption is accordingly appropriate for servicing activities (diagnosis, repair and maintenance) to comply with manufacturer and government specifications.
Electronic servicing materials could be more accessible if exemption is allowed
Knowledgeable observers suggest that the practical effect of allowance of this exemption would be to allow owners of medical devices and their authorized agents (i.e., third party servicers), to access and use the electronic servicing materials and perform servicing activities without the threat of legal action under DMCA.
Service materials for radiation emitting devices — A.I.A.T. (assembly, installation, adjustment and testing) — are already mandated to be supplied “at a cost not to exceed the cost of publication and distribution” under 21 U.S.C. §1020.30(g). Notwithstanding, some electronic service materials for basic servicing are not infrequently unavailable (behind the TPMs) unless a servicer obtains a key from a manufacturer. In any event, there may well be expense and other challenges to get the key. Hence, allowance of this exemption by the U.S. Copyright Office may greatly assist owners of medical devices and third-party servicers working on the devices.
U.S. Copyright Office hearings held to consider new possible exemptions and renewals
Earlier this year, on behalf of IAMERS, I testified in support of the proposed new exemption at the Register’s hearing together with Steve Inacker, president of Avante Health Solutions, and others. Comments had been received in opposition and some testimony mischaracterized in my view some of the supportive underpinnings of the favorable 2018 FDA Servicing Report. I noted that the FDA MAUDE reports (manufacturer and user facility device experience reports) confirm that under one percent of adverse events have been reported with respect to device servicing activities as described more fully in the FDA report.
During his testimony, Inacker acknowledged the proverbial "elephant in the room" with regard to the adverse effects to the patient if a manufacturer imposes the current prohibition against circumvention: “[w]e need to have the right to repair the equipment for our customers and have access to do so on a readily available basis. This is a patient safety issue. When we can’t get access to the equipment that we need to service, patients wait.”
U.S. Copyright asks FDA to weigh in
Faced with comments in opposition to the proposed exemption and claims that the FDA’s regulatory authority may be applicable, the Register of Copyrights made the FDA aware of the U.S. Copyright Rulemaking proceeding.
On August 13, 2021, the FDA Office of Strategic Partnerships and Technology Innovation issued a letter to the U.S. Copyright Office
acknowledging that opponents of the exemption have expressed concerns that the exemption may facilitate device servicing by unregulated entities with the potential to increase cybersecurity risks and result in harm to both patients and providers. The FDA noted in this regard that “device servicing entities may be well positioned to help identify and address security vulnerabilities, and observes that ISOs may play an important role in maintaining the overall quality, safety, and efficacy of medical devices.“
While acknowledging that the FDA is continuing to seek stakeholder input on this topic and will evaluate this input, the FDA plainly stated its thinking with regard to opponents of the exemption:
“FDA therefore does not share
the view that an exemption from liability under 17 U.S.C. §1201 for circumvention conducted solely for purpose of diagnosis, maintenance, or repair of medical devices would necessarily and materially jeopardize the safety and effectiveness of medical devices in the United States with respect to cybersecurity…”(emphasis supplied).
Though it is not known what the final impact of the FDA’s supportive letter to the Copyright Office will be, Stephen Grimes of Strategic Healthcare Technology Associations, a knowledgeable industry observer and co-author of the AAMI Medical Device Cybersecurity Guide, saw the FDA letter and its implications as quite impactful.
“Once again, the FDA has demonstrated a willingness to look past unfounded claims of quality and cybersecurity risks being strongly voiced by parties who may possess other motives," Grimes said.
It will be very interesting in the coming months to learn of the final determination of the petition. What is also quite interesting is the FDA seems to be readily acknowledging that device servicing entities may be well positioned to help identify and address security vulnerabilities. Stay tuned.
About the author: Robert J. Kerwin is general counsel for IAMERS, the International Association of Medical Equipment Remarketers and Servicers.