Rethinking Health App Regulation: The Case for Centralized FDA Voluntary Certification of Unregulated Non-Device Mobile Health Apps RETHINKING HEALTH APP REGULATION: THE CASE FOR CENTRALIZED FDA VOLUNTARY CERTIFICATION OF UNREGULATED NON-DEVICE MOBILE HEALTH APPS Samuel J. Dayton* I. INTRODUCTION ........................... 714 A. Introduction to the Health App Market ... ..... 717 B. Current State of the Health App Market..............720 C. Doctors' Concerns Regarding the Current Health App Market .................................. 721 D. Role of the FDA in Regulating Health Apps.........722 II. LEGAL BACKGROUND ............................. 722 A. Scope of the Draft Guidance......... ........ 722 B. Health Apps Not Covered by the Draft Guidance.... 723 C Federal Preemption .................... 725 III. CERTIFICATION OF HEALTH APPS EXPLORED ......... 726 A. The Need for a Certification Process ............. 726 B. The Happtique Model. .............. ........... 727 C. A Centralized Certification Scheme for Direct FDA Certification ......................... ..... 731 1. Voluntary Nature of the Program ..... ..... 735 2. Cooperation with Other Agencies..... ..... 736 3. Implementation of the Certificates .... ..... 739 D. An Alternative, Decentralized Certification Scheme for the FDA..........................739 1. Current Uses of Decentralized Certification Programs...............................741 2. Implementation of the Decentralized Certification Program .............. ..... 742 3. Potential Dra whacks of the Decentralized Certification Program ................... 745 IV. CONCLUSION .................................... 748 * J.D., 2014, Indiana University Robert H. McKinney School of Law, Indianapolis, Indiana; B.A., 2011, Indiana University, Bloomington, Indiana. INDIANA HEALTH LAW REVIEW I. INTRODUCTION Young adults suffering from a persistent case of acne may try special creams, cleansing soaps, or changes in diet, but in 2011 some chose to try blue and red light emitted by their cellular phones. Developers of software applications that purportedly relied on credible science led these consumers astray. With only the tap of a screen, these consumers would be on their way to brighter and clearer skin. Unfortunately, these claims were too good to be true. In today's mobile industry, a library's worth of medical information is one tap of a screen away, and consumers without any particularized medical knowledge are left to fend for themselves. The federal government should allow developers of mobile software containing health information to petition for certification of their products. This would not only promote consumer confidence in the certified software but would help consumers avoid spending time and money on deceptive scientific claims. On October 13, 2011, the Federal Trade Commission ("FTC") filed a complaint against Koby Brown and Gregory W. Pearson both individually and doing business as Dermapps. 1 Dermapps developed and marketed an app called "AcneApp" that would use blue light to fight bacteria and red light to heal skin on acne-prone skin.2 In the app's description, Dermapps referenced a study by the British Journal of Dermatology to show blue and red light treatments eliminated p-acne bacteria, allegedly a major cause of acne, and would reduce skin blemishes by as much as 76%.3 However, Dermapps misrepresented the British Journal of Dermatology study because the study did not prove that blue and red light as provided by AcneApp would be an effective treatment for acne, so Dermapps acted deceptively or unfairly by making a false advertisement in violation of the Federal Trade Commission Act. 4 By the 1 Complaint at *4, In re Koby Brown, (No. C-4337), 2011 WL 5228729 (F.T.C. Oct. 13, 2011); 15 U.S.C. §§ 45(a), 52 (2013). 2 Id. 3 Id. 4 Id. 714 Vol. 11:2 RETHINKING HEALTH APP REGULATION time that the FTC filed its complaint a year and a half later, the app had been purchased for $1.99 approximately 11,600 times.5 The Commission voted unanimously to accept a settlement agreement with Dermapps that contained, among other things, a fine of $14,294.6 AcneApp was a special type of software application that was intended, or at least appeared to intend, to cure a medical condition, but there are many other types of health- related apps available for purchase. Today, health apps purport to provide easy solutions for everything from "flabby abs to alcoholism," and they promise to provide relief from symptoms such as pain, stress, stuttering and ringing in the ears. 7 Many of these apps fail to follow established medical guidelines, and few are tested through the sort of clinical research used for treatments sold by other means.8 Around 247,000,000 smartphone users are expected to have downloaded health apps in 2012.9 Some health apps, such as "Lose it" as used for weight loss, "Azumio" as used for measuring heart rates, and "iTriage" as used to check symptoms and search the local area for hospitals with the shortest wait times, appear to be quite good.10 However, consumers tend to have to rely upon descriptions written by an app's developers or the anonymous, mixed reviews." Apps are generally sold through third parties. Apple and Google are two of the largest. The amount of protection they offer to consumers is unclear because both have been hesitant 5 Id. at 1-2; 'Acne Cure" Mobile App Marketers Will Drop Baseless Claims Under FTC Settlements, FED. TRADE COMM'N (Sept. 8, 2011), www.ftc.gov/opa/2011/09/acnecure.shtm, archived at http://perma.cc/5GYL-J5SJ. 6 Id.; Agreement Containing Consent Order, FED. TRADE COMM'N, http://www.ftc.gov/os/caselist/1023205/110908dermappsorder.pdf, archived at http://perma.cclDAF7-74VD. 7 Rochelle Sharpe, Lacking Regulation, Many Medical Apps Questionable at Best, CTR. FOR NEW ENGLAND INVESTIGATIVE REPORTING (Nov. 18, 2012), http://necir-bu.org/investigations/medical- apps, archived at http://perma.cclDB8H-K6WA. 8 Id. 9 Id. 10 Id. 11 Id. 2014 715 INDIANA HEALTH LAW REVIEW to make statements about their apps, processes, and rules for developers. 12 Apple indicated to the Federal Communications Commission ("FCC") that apps will be rejected if they fail to operate correctly on a technical level, contain malicious "bugs" that may damage users' devices, or fail to perform as advertised. 13 Apple also stated that it aims to protect consumers' privacy and children from "inappropriate content."14 Google's content guidelines seem to indicate that it only bans apps that are sexually explicit, gratuitously violent, or contain anything that may damage a user's device.' 5 Sixty-six percent of global consumers use the advice of experts to influence their purchasing habits.' 6 On a global survey, the advice of experts was less influential to people than the advice of family and friends, but it was more influential to consumers than advertisements on the television and more than fifteen other methods for raising consumer awareness of a product. 17 This implies that the Food and Drug Administration would most likely be able to influence consumers through a certification program, which would 12 Id. 13 Id.; Apple Answers FCC Questions, APPLE, http://www.apple.com/hotnews/apple-answers-fcc-questions (last visited May 21, 2014), archived at http://perma.cclDEJ5-75VB. 14 Apple Answers FCC Questions, supra note 13. Note that Apple, as early as 2009, received 8500 app submission each week and usually rejected 5% of them. Id. By extension, Apple likely rejected as many as 22,100 apps in 2009. Apple does not appear to have provided more recent data on submission statistics, but it did approve its one-millionth app in 2012, and in January 2014, Apple announced that customers spent over $10 billion in its app store. See Seth Fiegerman, Apple Has Approved 1 Million Apps for the App Store, MASHABLE (Nov. 19, 2012), http://mashable.com/2012/11/19/apple-app-store- 1-million-submissions, archived at http://perma.cc/ZM2N-F76B; Press Release, App Store Sales Top $10 Billion in 2013 (Jan. 7, 2014), available at http://www.apple.com/pr/library/2014/01/07App-Store-Sales-Top-10- Billion-in-2013.html, archived at http://perma.cc/4EM-9CFR. 15 Sharpe, supra note 7. 16 Every Breakthrough Product Needs an Audience: Find Yours in All Corners of the World, NIELSEN 14 (Jan. 2013), http://www.nielsen.com/ content/dam/corporate/us/en/reports-downloads/2013%20Reports/Nielsen- Global-New-Products-Report-Jan-2013.pdf, archived at http://perma.cc/ YC5S-2MX9. 17 Id. 716 Vol. 11:2 RETHINKING HEALTH APP REGULATION signal to consumers which health apps had met an established set of protective criteria. Developers of health-related mobile applications should also take notice that endorsements from the FDA, with its vast experience with health and safety, would likely have a positive impact on economic growth when compared to health apps lacking the FDA's certificate. A. Introduction to the Health App Market Technological achievements have made rapid changes in individual healthcare mobile applications. Today, a consumer may download applications onto his or her mobile device (e.g., cell phone or tablet computer) that address almost any facet of healthcare. The realm of mobile technology is complex, and its relevant vocabulary is intricately defined. The software programs consumers use on their mobile devices are called "apps." 18 Apps are "software application[s] that can be executed (run) on a mobile platform . . . or a web-based software application that is tailored to a mobile platform but is executed on a server."19 In fact, apps are responsible for as much as 56% of all activity on at least Android smartphones. 20 They are a major, if not the primary, source of interaction consumers have with their mobile devices. Mobile platforms are "commercial off-the-shelf (COTS) computing platforms, with or without wireless connectivity, that are handheld in nature."21 These include include iPhones, BlackBerry phones, Android phones, tablet computers, or other smart phone or digital personal assistant devices. 18 FOOD AND DRUG ADMIN., MOBILE MEDICAL APPLICATIONS: DRAFT GUIDANCE FOR INDUSTRY AND FOOD AND DRUG ADMINISTRATION STAFF 1, 7 (July 21, 2011) [hereinafter DRAFT GUIDANCE], available at http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGui dance/GuidanceDocuments/UCM263366.pdf, archived at http://perma. cc/RWN6-JQ4A. 19 Id. 20 You Have an App for That ... Now What, NIELSEN (June 22, 2011), http://www.nielsen.com/us/en/newswire/20 11/you-have-an-app- for-that-now-what.html, archived at http://perma.cc/Z26S-9HHW. 21 DRAFT GUIDANCE, supra note 18, at 7. 2014 717 INDIANA HEALTH LAW REVIEW There are many brands of mobile devices, and each operates slightly differently. "iOS" devices are products designed, developed, and manufactured by Apple, Inc., and include iPhones, iPads, and iPods. 22 The mobile platform for these devices is called "iOS."23 App developers for iOS devices publish and sell their apps on Apple's "App Store."24 Another major player in the mobile technology industry is Android. Android is an open-source software, or mobile platform, for mobile devices, in a project led by Google. The project was created to ensure that no party could restrict or control the innovations of any other.25 Other corporations, such as Research In Motion or Microsoft, lie somewhere on the spectrum in-between Apple and Android. App developers have crafted mobile apps to address countless issues related to healthcare. Some apps, such as those that measure glucose levels in the blood, render the app and mobile device a "medical 'device."' A medical device is an "instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article, including any component, part, or accessory, which is . . .. intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man or other animals."26 Any app that meets this definition and is either "used as an accessory to a regulated medical device" or "transforms a mobile platform into a regulated device" is a mobile medical app. 27 The Food and Drug Administration looks to the "intended use" of a mobile app to determine whether it 22 Apple iOS Software License Agreement, APPLE, http://apple. com/legallsla/docsliOS6.pdf, archived at http://perma.cc/SYK6-JPNK. 23 Id. 24 There is some confusion about whether this is a generic title under U.S. trademark law. See generally Apple, Inc. v. Amazon.com, Inc., 2011 U.S. Dist. LEXIS 72271 (N.D. Cal. 2011). 25 OPEN SOURCE PROJECT, http://source.android.com (last visited Nov. 4, 2012), archived at http://perma.cc/8GCY-ST4H. 26 Federal Food, Drug, and Cosmetic Act, 21 U.S.C. § 321(h)(2) (2014). 27 DRAFT GUIDANCE, supra note 18, at 7. 718 Vol. 11:2 RETHINKING HEALTH APP REGULATION counts as a "device."28 If the intended use of a mobile app is to diagnose, cure, treat, mitigate, or prevent a disease or other condition or is "intended to affect the structure or any function of the body of a man," the mobile app is a device. 29 The FDA only regulates devices that meet the definition of a "device" under §321(h)(2). Devices are organized into three categories. Class I devices are those which represent the smallest risk to consumers, while Class III devices represent the greatest risk. Some Class I and most Class II devices require creators of those devices to inform the FDA that the devices are safe, effective, and substantially equivalent to devices already marketed legally. 30 This is called premarket notification.31 In 2010, only 3% of smartphone owners used them solely for telephonic conversation.32 Furthermore, as of 2010, even though only 21% of people who had wireless device subscriptions owned smartphones, 45% of the population without smartphones expressed that their next cellular device would be a smartphone.33 However, the growth in smartphone ownership has actually increased much faster. In 2012, two- thirds of people buying new cell phones opted for smartphones. This means that the number of people exposed to and misled 28 DRAFT GUIDANCE, supra note 18, at 7-8 (citing 21 C.F.R. § 801.4 (2014) (stating that intended use may be shown through labeling claims, advertising materials, or oral or written statements made by manufacturers)). 29 DRAFT GUIDANCE, supra note 18, at 7-8. 30 Premarket Notification (510k), FOOD AND DRUG ADMIN. (Sept. 3, 2010), http://www.fda.gov/MedicalDevices/ DeviceRegulationandGuidance/HowtoMarketYourDevice/PremarketSub missions/PremarketNotification5lOk/default.htm (citing 21 C.F.R. § 807.92(a)(3)), archived at http://perma.cc/9BMW-VR9R. 31 Bradley Merrill Thompson, FDA Regulation of Mobile Health, MOBIHEALTHNEWS 6 (June 2010), http://mobihealthnews.com/wp- content/pdflFDARegulation of MobileHealth.pdf, archived at http://perma.cc/ZUJ8-63Z5. 32 Roger Entner, Smartphones to Overtake Feature Phones in US by 2011, NIELSEN (Mar. 26, 2010), http://www.nielsen.com/us/en/ newswire/2010/smartphones-to-overtake-feature-phones-in-u-s-by-2011. html, archivedathttp://perma.cc/XC7Z-W6GP. 3 3 Id. 2014 719 INDIANA HEALTH LAW REVIEW into purchasing deceptive, faulty, useless, or inaccurate health apps will only increase as time goes on. B. Current State of the Health App Market Some health apps were designed to serve as medical devices, but there are many other sorts of health apps. There even seems to be a greater use of apps that are not medical devices. 34 Consumers can download apps that track their fitness, wellness, exercise, and diet.35 Fitness and wellness apps can easily be sold to people who are fairly healthy already and just want to stay fit, and hospital administrators realize that these apps can be used for chronic disease management and may keep people out of the hospital.36 The health app market is moving in a direction where a person with asthma would open an app and determine whether his or her asthma symptoms will be worse on a given day based on the pollen count.37 Or a person with a heart condition might open an app and receive feedback on inconsistencies of that person's heartbeat. Most health apps are "technically reliable in that they work, but their accuracy is largely dependent on where they source their background data from." 38 Interestingly, two- thirds of people who use health and fitness apps stop using them after six months or less. 39 Perhaps this is due to consumer apathy, but it may also be an indicator of the underlying quality of the apps. Consumers do anticipate and 34 Ken Terry, More Consumers Get Health Info on Mobile Devices, INFO.WEEK (Oct. 8, 2012), http://www.informationweek.com/healthcare/ patient/more-consumers-get-health-info-on-mobile/240008624#, archived at http://perma.cc/T5JF-W2NM. 35 Id. 36 Id. 37~ Id. 38 Merry Christmas and App-y' New Year, NAT'L HEALTH SERV. (Dec. 23, 2010), www.nhs.uk/news/2010/12December/Pages/health-app- guide-iphone.aspx, archived at http://perma.cc/4ZS6-8YPE. 39 Ryan Faas, Why Your Doctor Doesn't Want You Using iPhone and iPad Health Apps, CULT OF MAC (June 20, 2012, 7:43 AM), http://www. cultofmac.com/174776/why-your-doctor-doesnt-want-you-using-iphone- and-ipad-health-apps/, archivedathttp://perma.ccl9YMU-MGUU. 720 Vol. 11:2 RETHINKING HEALTH APP REGULATION expect big changes in their futures from mobile health apps. In one study, 48% of respondents said they expected mobile health apps would change the way they manage chronic conditions, 48% said mobile health apps would change the way they manage their medications, and 49% said mobile health apps would change the way they manage their overall health.40 C. Doctors' Concerns Regarding the Current Health App Market The reaction of doctors to the explosive growth of the health app field seems to be mixed. Doctors do not appear to be fully aware of all of the available health apps in the market. Furthermore, medical professionals are unlikely to risk their medical licenses and trust health apps for their patients unless a respectable party like the FDA has confirmed value and accuracy of the apps. 41 Less than two-thirds of healthcare providers acknowledge that mobile technology offers potential benefits for patients, but they feel that mobile health is unexplored and untested territory. 42 Approximately 73% of doctors do not suggest mobile health apps to their patients and 13% actually discourage patients from using them.43 Doctors' concerns about how patients would use their mobile health apps were a major factor in discouraging their use.4 4 These concerns included fears about how the patients would comply with their health apps, the lack of ability for the physicians to ensure the app's proper use, and that patients might become "too independent and avoid regular office visits." 45 The concern about consumer independence "appears to be a very valid point since 59% of mobile health users said iOS apps and other mobile technologies have replaced some visits to doctors 40 Id. 41 Travis Good, Why Doctors Aren't Prescribing Health Apps to Patients, KEVINMD.CoM (Mar. 19, 2012), http://www.kevinmd.com/ blog/2012/03/doctors-prescribing-health-apps-patients.html, archived at http://perma.cc/S2ER-6V55. 42 Faas, supra note 39. 43 Id. 44 Id. 45 Id. 2014 721 INDIANA HEALTH LAW REVIEW or nurses." 4 6 This suggests consumers may be or become vulnerable to deceptive health apps without correction from medical experts. Physicians are currently also uncomfortable recommending health apps at the moment because of uncertainty about future regulation of the field.4 7 Furthermore, medical apps potentially can pose risks to public health. These risks may even be unique to mobile platforms. 48 For example, "the interpretation of radiological images on a mobile device could be adversely affected by the smaller screen size, lower contrast ratio, and uncontrolled ambient light of the mobile platform."49 D. Role of the FDA in Regulating Health Apps The current role the FDA plays in regulating health apps is not completely clear. The FDA is charged with promoting the science and innovation necessary to ensure that the United States is fully equipped to address the public health challenges of the modern world.50 It is the FDA's job to ensure safety and efficacy in FDA-regulated products as well as to work to foster scientific innovation leading to tomorrow's "new breakthrough products." 51 However, the FDA has so far only issued draft guidance rather than a final decision regarding the regulation of mobile medical apps. II. LEGAL BACKGROUND A. Scope of the Draft Guidance The FDA's Draft Guidance for Industry and Food and Drug Administration Staff Mobile Medical Applications 46 Id. 47 Id. 48 DRAFT GUIDANCE, supra note 18, at 6-7. 49 Id. 50 Margaret A. Hamburg, FDA and Innovation: Addressing the Public Health Challenges of the 21st Century, U.S. FOOD AND DRUG ADMIN. (July 15, 2011), http://www.fda.gov/NewsEvents/Speeches/ ucm275219.htm, archived at http://perma.cc/EL7B-PKEL. 51 Id. Vol. 11:2722 RETHINKING HEALTH APP REGULATION illustrates the FDA's current thought on the future of health app regulation. The guidance is meant to explain that the FDA intends to apply its regulatory requirements to a certain subset of mobile apps. 52 This subset only includes mobile apps that meet the statutory definition of a device and either are used as an accessory to regulated medical devices or transform mobile platforms into regulated medical devices.5 3 The draft guidance does not address many different topics including wireless safety; classification and submission requirements related to clinical decision support software; or the application of quality systems to software. 54 The FDA appears to intend to address these topics at a later time.55 B. Health Apps Not Covered by the Draft Guidance The FDA has classified health apps into two categories: (1) regulated medical device health apps and (2) unregulated non-medical device health apps. The FDA identifies the following as examples of health apps that would not be covered by its intended regulation: copies of medical textbooks, teaching aids, or reference materials; text solely for providing clinicians with training or reinforcing previous training; apps that log, record, track, evaluate, or make decisions or suggestion "related to developing or maintaining general health and wellness" that are not intended for "curing, treating, seeking treatment for mitigating, or diagnosing a specific disease, disorder, patient state, or any specific, identifiable health condition;" apps that simply automate general office operations with functions including billing, inventory, appointments, or insurance transactions; apps that are "generic aids that assist users but are not commercially marketed for a specific medical indication;" and apps that 52 Draft Guidance, supra note 18, at 4. 53 Id. at 12. 54 DRAFT GUIDANCE, supra note 18, at 10-11. (These would also be beyond the scope of this Note.) 55 Id. 2014 723 INDIANA HEALTH LAW REVIEW "perform the functionality of an electronic health record system or personal health record system."56 Textbooks, teaching aids, and reference materials could include flashcards, quizzes, slide shows with medical pictures or diagrams, and lists of medical terminology that are to be used primarily by medical students.57 These types of apps contain no patient-specific information, but they may contain specific examples for illustration.5 8 Mobile apps that do take in patient-specific information and output patient-specific information using any of these sources of medical information, however, would be covered by the draft guidance.59 Some apps log, record, track, evaluate, or make decisions or suggestions regarding general health and wellness maintenance but are not meant to cure, treat, mitigate, or diagnose a specific disease, disorder, patient state, or any specific, identifiable health condition. Examples of these apps might include dietary tracking logs, appointment reminders, dietary suggestions based on a calorie counter, posture suggestions, exercise suggestions, or similar decision tools that "generally relate to a healthy lifestyle and wellness." 60 These are examples given by the FDA, but there does appear to be some tension with the patient- specific input and output element as previously described. Apps with patient-specific input and output will likely have to be assessed on a case-by-case basis in the future. Apps that simply automate general office operations might include the following: "apps that determine billing codes like ICD-9 (international statistical classification of diseases); medical business accounting functions and aids that track and trend billable hours, procedures, and reminders for scheduled medical appointments . .. ; apps that automate functions such as collecting patient histories that replace paper-based entry; apps that enable insurance claims data collection and processing; and other apps that are similarly administrative in 56 Id. at 16-18. 57 Id. at 20. 58 Id. at 21. 59 Id. at 24. 60 Id. 24-25. Vol. 11:2724 RETHINKING HEALTH APP REGULATION nature."61 These health apps perhaps have the least to do with the health of patients and are least likely to be used by individual consumers. Apps that are generic aids might include apps that use the camera and screen of a mobile device to create a magnifying glass effect (but not specifically for medical purposes), recording audio, note taking, replaying audio with amplifications, and other similar functions. 62 The FDA intends to monitor mobile apps that are outside this guidance and may determine whether additional or different actions are needed to protect the public health.63 Manufacturers may choose to register and list their apps and to seek approval or clearance for them with the FDA. 64 However, this process is a subtle verification of an app's permissibility in the marketplace, and seems more directed at cautious app developers than at uninformed consumers. The FDA could and should do more to certify accuracy and trustworthiness of mobile health apps. This would promote consumer confidence in objectively trustworthy and accurate health apps and protect consumers from spending money on health apps that are neither trustworthy nor accurate. C Federal Preemption Although states generally have jurisdiction over consumer protection issues, a certification program for health apps properly falls under federal jurisdiction, especially if it is extended to medical device apps. Federal law explicitly preempts state law on medical device laws. 65 This likely means that mobile medical device apps fall 61 Id. at 21. 62 Id. at 21-22. 63 Id. at 12. 64 Id. at 32. 65 21 U.S.C. § 360(k) (2013) (prohibiting states from establishing or continuing in effect medical device regulations "different from, or in addition to, any requirement applicable under this chapter" and relates to the safety or effectiveness of the device except in very limited circumstances). 2014 725 INDIANA HEALTH LAW REVIEW under federal jurisdiction as well. 6 6 Preemption is less clear for non-device apps. Presumably, the creation of a certification process would raise preemption issues. III. CERTIFICATION OF HEALTH Apps EXPLORED A. The Need for a Certification Process Certification is a process used with great success in other realms of modern technology. The establishment of "certification authorities" plays a vital role for commerce, meeting the demands of ever-changing technology, a transition to a paperless society, and the integrity of cyberspace.6 7 These certification authorities are critically important at the level of cybernotarization and authentication within international e-commerce. 68 In that contest, trusted third parties act as notaries, 69 but that is only one approach to certification. Given the explosive growth in health apps, it would be impossible for the FDA to evaluate the claims of every single health app available to consumers. Indeed, imagining the FDA attempting to carry out such a task evokes a comparison to Lucy Ricardo having to stuff pieces of chocolate in her mouth and clothing as she fails to keep up with the speedy assembly line.7 0 Currently, the federal government appears to take a caveat emptor approach to ex ante consumer protection. 7 Buyer beware! This approach is insufficient. 6 DRAFT GUIDANCE, supra note 18, at 8 (stating that apps that are intended to work like medical devices are regulated as medical devices). 67 Dina Athanasopoulos-Arvanitakis & Marilynn J. Doe, A Proposed Code of Professional Responsibility for Certilcation Authorities, 17 J. MARSHAIL J. CoMPuTER & INFO. L. 1003, 1004-05 (1999). 68 Id. at 1003, 1003 n.1. 69 Id. at 1004. 70 I Love Lucy.' Lucy Goes to Work (CBS television broadcast Sept. 15, 1952), available at http://www.tvland.com/video-cips/t9jwdz/i-love- lucy-lucy-goes-to-work. 71 See generally Miracle Health Claims, FED. TRADE COMM'N (Nov. 2011), http://www.consumer.ftc.gov/articles/0167-miracle-health-claims (stating that fraud in health-related claims is a problem so that is why it is "important to learn how to evaluate claims for products related to your health"), archived at http://perma.cc/3FEF-C2D7. 726 Vol. 11:2 RETHINKING HEALTH APP REGULATION Reliance on health apps that have not been based on established medical practices and tested by professional peer review, like traditional medical treatment, leaves consumers who are, "at best, delaying appropriate treatment, and, at worst, threatening their health."72 Consumers would be better served by a voluntary system that requires app developers to seek out the FDA for heightened credibility. B. The Happtique ModeP3 Happtique, a recent startup and subsidiary of the Greater New York Hospital Association, is set to become the 72 Patrick A. Malone, Want Bad Health Advice? There's an App for That, PATRICK MALONE & AssOCIATES, P.C., DC MEDICAL MALPRACTICE & PATIENT SAFETY BLOG (Nov. 26, 2012), http://www.protectpatientsblog.com/2012/11/want bad health advice t heres_1.html, archived at http://perma.cc/GTU8-UX3J. 73 Around the time this Note was submitted to INDIANA HEALTH LAW REVIEW, Happtique experienced a major setback. Harold Smith, III, randomly tested two apps that Happtique certified as secure and found significant security risks. Brian Dolan, Happtique Suspends Mobile Health App Certification, MOBIHEALTHNEWS (Dec. 13, 2013), http://mobihealthnews.com/28165/happtique-suspends- mobile-health-app-certification-program/, archived at http://perma.cc/R6QC-3UA6. Since then, Happtique redesigned its website and removed many of the sources cited below. By the time Happtique suspended its certification operations, it had not experienced much success. Satish Misra, M.D., took Happtique's security oversight as evidence of flaws in app certification as a whole. Satish Misra, Happtique's Recent Setback Shows that Health App Certification is a Flawed Proposition, iMedicalApps (Jan. 8, 2014), http://www.imedicalapps.com/2014/01/ happtiques- setback-future-app-certification/, archived at http://perma.cc/D924- VC8E. Misra is correct that certification is a one-size-fits-all proposition and that certification cannot tell an individual customer about whether an app will be what he or she needs. Id. However, the certification models proposed in this Note are not intended to act as surrogate physicians; for diagnoses or specific treatment methods, see a physician. However, certification can protect consumers in determining whether an app is and does what the developer says it is and does. Although many of the sources below are no longer available, this section was included to serve as an introduction to the concept of certification and not as a recommended model. Since there do not appear to be any other similar organizations that could substitute for Happtique in this section, the Happtique section remains a part of this Note. 2014 727 INDIANA HEALTH LAW REVIEW country's first organization to certify specifically health- related apps for safety and effectiveness. 7 4 It intends to provide consumers with a way to "identify [health] apps that meet high operability, privacy, and security standards and [that] are based on reliable content."75 Happtique's certification standards, like the FDA guidance on mobile medical device apps, remains in a draft state only as of the publication of this Note.76 The draft stage of Happtique's standards still provides useful guidance for steps the FDA might take. Before certifying apps, Happtique has indicated it intends to review apps for operability, privacy, security, and content. 77 This Note mainly focuses on content of apps, but operability, privacy, and security are important as well, and any certification program adopted by the FDA should contemplate them in some way. Under Happtique's certification standards, an app must be "based on one or more credible information sources such as an accepted protocol, published guidelines, evidence- based practice, peer-reviewed journal, etc."78 Developers must submit documentation about the information source if the source is a public or private entity.79 If the source of the information within the app comes from any other source, the developer must submit information about how the content in the app was derived, its relevancy, and its 74 Sharpe, supra note 7; HAPPTIQUE (2011), http://www.happtique.com (last visited Jan. 11, 2013), archived at http://perma.cc/6XZ9-WXB5. (Disclaimer: Please note that this Note is not endorsing Happtique's services or certification of apps, and the author of this Note is not affiliated with Happtique in any way). 75 App Certification, HAPPTIQUE, http://www.happtique.com (last visited Jan. 11, 2013) (last change in original). 7 6 Id. 77 See generally Happtique App Certification Program: Draft App Certification Standards, HAPPTIQUE, http://www.happtique.com/wp- content/uploads/App- Certification-Standards-final.pdf (citing generally MedEdPORTAL Submission Standards, The Association of American Medical Colleges (Nov. 3, 2011), http:/www.mededportal.org/download/ 262700/data/mepsubmissionstandards.pdf). 78 Happtique App Certification Program: Draft App Certification Standards, HAPPTIQUE 11, http://www.happtique.com/wp- content/uploads/App-Certification-Standards-final.pdf. 7 Id. 728 Vol. 11:2 RETHINKING HEALTH APP REGULATION reliability.80 Happtique also requires that any deviations from the content of third parties the app contains be indicated and explained, and the app must provide a citation to the third party content in its entirety for the consumer.8 ' Furthermore, all apps must draw on content from at least one authoritative work that is recognized within the field or discipline of the app and, as appropriate, is derived from published and/or peer reviewed work. 82 Any instructional, educational assessment, and other apps of a similar kind, specifically, must derive its content from "accepted pedagogy and/or learning strategies or techniques that are appropriate for the intended audience(s)." 83 Therefore the app must rely upon authoritative sources that have been recognized within the field or discipline that is the subject of the app and, as appropriate, come from published or peer reviewed works, or both. 84 These apps must have clearly stated learning objectives, and the methods for teaching and/or learning must be suitable to meet those objectives. There must also be a process or method for assessing and documenting improvements in knowledge or skill.85 Developers must also ensure that all of the app's content contains information that is current as of the date the app is submitted for certification. 86 App developers must demonstrate and explain why the information contained within the app is current and that the developer has a method or protocol for keeping the app's content current for the entire time the app is certified by Happtique. 87 Apps need to be updated to keep their information content up-to- date and for other software-related reasons. Happtique has not yet released its standards and requirements for re- certification of apps except that all updates must include 80 Id. 81 Id. at 12. 82 Id. at 13. 83 Id. 84 Id. 85 Id. 86 Id. at 11. 87 Id. 7292014 INDIANA HEALTH LAW REVIEW descriptions and documentations of each change to the app.88 All apps must comport with all applicable laws, rules, and consumer protection regulations dealing with advertising claims, marketing, promotional activities, and sales practices. 89 Generally, this means that the app's description and content must be truthful, fair, and not misleading, backup documentation to substantiate claims made in the description or content is available, and clear and conspicuous disclosures are provided to prevent deception.9o Electronic health record systems for mobile devices have to be designated for certified electronic health records that have already been certified by an appropriate Authorized Testing and Certification Body. 91 If an app contains any of the following including, but not limited to, mathematical formulae, calculations, data tracking, reminders, timers, measurements, or other related operations, the app does so with "sufficient accuracy and reliability" to achieve the operation's intended purpose. 9 2 That means not only must the app perform satisfactorily on a technical level, the operations that incorporate content must also perform satisfactorily. Apps with multiple purposes or functions must ensure each element comports with Happtique's requirements under any relevant standards.93 The guidelines require that advertisements within apps are clearly designated as such. 94 Any such advertisement may not violate FDA, FTC, or FCC laws or regulations governing advertisements and claims made therein. 95 Developers must take care to ensure that the app specifically designates any claim that could be construed as medical advice for treatment recommendations is meant 88 Id. at 11 n.13. 89 Id. at 12-13. 90 Id. at 12. 91 Id. at 14. 92 Id. at 12. 93 Id. at 15. 94 Id. 95 Id. 730 Vol. 11:2 RETHINKING HEALTH APP REGULATION solely for advertising and not for other purposes; it must also state that the advertising claim should not be considered a substitute for medical or clinical advice.96 In no case may an app contain advertising supported through products containing malicious code or software such as spyware, viruses, or any other malicious software. 97 Lastly, any app the developer intends to be used primarily by laypersons must be written and presented in such a way that is "appropriate for the intended audience." 98 This means that anybody using an app primarily intended for laypersons must be able to readily understand the content of the app, and technical terminology must be used only as appropriate to meet these ends. 99 Happtique, and any other future private certification body, would not become moot by the presence of a voluntary certification model where the FDA certifies health apps directly. App developers could choose Happtique over the FDA certification process. Happtique may make a strategic decision to require less of apps than the FDA to attract the developers who do not wish to meet the FDA's exacting standards, but consumers would likely notice the FDA's absence. Happtique, then, could become a more prestigious brand. If Happtique raises its standards above those of the FDA, then consumers may come to trust that a Happtique- certified app is a safe choice. C A Centralized Certification Scheme for Direct FDA Certification The FTC settlement with AcneApp makes a convenient example for how the FDA might formulate its certification program. This is because although AcneApp was a mobile medical device app and would therefore be regulated under the forthcoming FDA regulations as indicated by the Draft Guidance, it did not contain the same level of threat of harm 9 6 Id. 9 Id. 9 8 Id. 9 Id. 7312014 INDIANA HEALTH LAW REVIEW to consumers as most regulated medical devices. AcneApp purportedly cured acne when the mobile device was held against the affected area. There is a possibility that holding a wireless device up to a person's face could increase his or her chance of developing cancer, 100 but even so this exposure would be for two minutes on each of the blue and red lights, each of which was only slightly longer than the average call on a cell phone in 2011.101 This suggests any physical damage to consumers was minimal, so the harm faced by consumers was likely the pecuniary cost of purchasing the app. As a result, the FTC's treatment of Dermapps provides useful guidance for an FDA centralized certification model for non-device apps, where the damage would be most likely to be pecuniary with a more remote possibility of physical harm. The Happtique model is rather exhaustive and may help consumers somewhat, but the FDA could go further in its protection of consumers. The FTC already demands more when it reaches settlements with app developers for false advertisement claims, unfair or deceptive acts or practices charges, or violations of the Federal Trade Commission Act. 102 When Dermapps settled with the FTC over the claims it made in and about AcneApp, the FTC demanded that if Dermapps engage in marketing AcneApp in the future it first meet certain standards. If the app made any claims about AcneApp's ability to treat acne, it would need to ensure its claims would be "non-misleading" by possessing the following: 100 IARC Classifies Radiofrequency Electromagnetic Fields as Possibly Carcinogenic to Humans, INT'L AGENCY FOR RES. ON CANCER, WORLD HEALTH ORG. 1-2 (May 31, 2011), http://www.iare.fr/en/media- centre/pr/2011/pdfs/pr2O8_E.pdf, archived at http://perma.cc/ED7W- 6DBG. 101 Will Dean, Will Dean ' Ideas Factory; Tracking Phone CaLl Lengths, THE INDEPENDENT (June 7, 2012), http://www.independent.co.uk/life- style/gadgets-and-techlfeatures/will-deans-ideas-factory-tracking-phone-call- lengths-7821172.html (reporting that the average length of calls on mobile devices was down to 1.78 minutes), archivedathttp://perma.cc/33EQ-M75X. 102 Complaint at *4, In re Brown, 2011 WL 5228729 (F.T.C. Oct. 13, 2011); 15 U.S.C. §§ 45(a), 52 (2013). 732 Vol. 11:2 RETHINKING HEALTH APP REGULATION two adequate and well-controlled human clinical studies of the device, conducted by different researchers, independently of each other, that conform to acceptable designs and protocols and whose results, when considered in light of the entire body of relevant and reliable scientific evidence, are sufficient to substantiate that the representation is true. 0 3 Happtique's requirements contain a similar standard, but it only requires one study instead of two. The second independent study requirement helps ensure that the future science on which Dermapps relies is valid and not fraudulently obtained. In addition to requiring more than one study to make claims, the FTC required that any representations made by Dermapps be made with sufficient quality and quantity. 04 At first, this mandate may seem superfluous, but it actually means that two studies will not be enough to substantiate representations if they depend on fringe science. In order to make future representations, Dermapps would have to actually rely on standards "generally accepted in . . . relevant scientific fields."105 This requirement may be more punitive than the FDA might need to require for its voluntary certification program. However, the FDA should at least require that an app relying on non-mainstream science conspicuously note it has done so. It should come as no surprise that the FTC also required Dermapps not make representations based on evidence not in existence.106 This would be an obvious addition to any certification standards promulgated by the FDA. Any developer who submits fraudulent evidence it knows to be false or evidence on which it did not actually rely should be penalized criminally or civilly, or both. 103 Agreement Containing Consent Order at *4, In re Brown, 2011 WL 4092215, (F.T.C. Sept. 8, 2011). 104 Id. at 5. 105 Id. 106 Id. at 4. 2014 733 INDIANA HEALTH LAW REVIEW Dermapps also had to pay fines of $14,294.107 This requirement does not completely translate to an ex ante certification program because the FTC assessed the fines for an ex post violation. The FDA could achieve a similar effect by giving a private cause of action for customers against developers who fraudulently obtain a certificate. The FDA might also have to ensure that these cases may be brought as a class since the purchase price of individual apps is typically low, although the injuries from reliance on the apps could potentially be high. For example, if a free health app says consumers with lumps on their body need not see a doctor, consumers who rely on that advice would have a cause of action against the developer for medical costs or loss associated with that reliance. This could be a significant disincentive for developers to enter into the certification program. As such, developers who participate in the FDA's centralized certification program in good faith would receive at least qualified tort immunity. The extent of this immunity is beyond the scope of this Note, but it is likely necessary for significant participation in such a scheme. App developers would also have to keep the FDA informed about any developments in the field of medicine or health that undermine the foundation upon which the developer originally secured certification. Without this condition, consumers may over-rely on the FDA's certificate. Furthermore, it is much more efficient for the app developers to monitor the science behind their own apps than for the FDA to monitor the science underlying all certified apps and verifying the certifications' continued legitimacy. Perhaps certificates could expire annually and be renewed only if the developers affirm that the apps rely on no new evidence and the underlying science has not changed in such a way as to undermine the integrity of the apps' claims. Also, any updates to the substantive components of the apps would need to either undergo a new review or an abbreviated application process. The specifics of this 107 Id. at 5. Vol. 11:2734 RETHINKING HEALTH APP REGULATION update process are beyond the scope of this Note, but at the very least, developers should be allowed to continue using the certificate during the review of the update. 1. Voluntary Nature of the Program An FDA certification would be completely voluntary to app developers. The only occasion where a developer could not participate and be punished for having not done so would be if the developer used the seal of certification without having obtained proper authorization and certification. A filing fee would help offset the costs of the certification program while discouraging frivolous applications. The voluntary nature of this program mixed with a filing fee means that the only influx of demands on the FDA would be from developers who believe they and their consumers would benefit from an FDA certificate on their app. The FDA's filing fees, however, may have to be on a sliding scale to be based on the size of the app. An app full of reference material would likely require more FDA resources to be certified than an app that calculates body mass index. Voluntary certification programs are not unprecedented in the FDA, but existing programs appear to be used for indirect consumer protection rather than for direct signals to consumers. For example, 15% of the food supply for the United States is imported and Congress has passed new legislation to promote food safety.108 Part of this effort was the creation of a voluntary certification program to provide expedited review to qualifying suppliers and their products. 109 The model proposed by Congress has one more accreditation step than the decentralized certification method described below.110 This model may not be the most 108 Susan A. Schneider, Notes on Food Law An Overview of the Food Safety Modernization Act, 2011 ARK. L. NOTEs 39, 44 (2011). 109 Id. at 45; see also 21 U.S.C. §§ 384b, 384d (2014). no 21 U.S.C. § 384d(b)(1)(A) (2014) (instructing the Secretary of the Department of Health and Human Services to establish and accreditation body to accredit third party certifying entities or defaulting); see also discussion infra Part III.D. 2014 735 INDIANA HEALTH LAW REVIEW efficient way to implement a voluntary certification program for health apps, but it does signify that Congress and the Department of Health and Human Services have previously demonstrated a willingness to explore certification alternatives, or at least supplements, to regulation. In fact, if the Secretary of the Department of Health and Human Services failed to establish an accreditation body for the accreditation of third party certifying entities, the Department could accredit the third parties itself; this would be strikingly close to the decentralized model discussed below."' 2. Cooperation with Other Agencies A certification program of non-medical device medical apps, whether it is centralized or decentralized, may require the cooperation of the FTC and maybe the FCC. These agencies have a history of working together and share an interest in ensuring consumers can trust their health apps. An ex ante certification program may even reduce the number of necessary ex post investigations of health- related, non-medical device apps. The FTC is the agency usually tasked with protecting consumers from deceptive trade practices, but the specialized nature of health apps leave substantial room for the FDA, which has the most and best resources to analyze health-related assertions. The FTC has a general mandate to keep an eye out for unfair or deceptive acts or practices as well as false or misleading claims." 112 This mandate includes looking for acts or claims that cause or are likely to cause substantial harm to consumers that cannot be avoided or be offset by benefits to consumers or 111 21 U.S.C. § 384d(b)(1)(A)(ii) (2014); see also discussion infra Part III.D. 112 Brian Dolan, How FDA and FTC Co-Regulate Health Apps, MOBIHEALTHNEWS (Mar. 22, 2012), http://mobihealthnews.com/16729/ how-fda-and-ftc-co-regulate-health-apps, archived at http://perma.cc/ZVE6-4BM3. Incidentally, this app would also likely be considered a medical device and be directly subject to the jurisdiction of the FDA. See 21 U.S.C. § 321(h)(2) (2013); DRAFT GUIDANCE, supra note 18, at 7. Vol. 11:2736 RETHINKING HEALTH APP REGULATION competition. 113 The FTC has previously investigated mobile health apps. For example, as seen in the introduction of this Note, the FTC pursued a case against the marketers of an app that purported to cure acne if a person held the device close to his or her face; the light from the device, allegedly, would cure the acne. 114 The FTC believed these claims were unfounded and pursued judicial action.115 The FDA has a role in a certification program of health apps because, even though the FTC clearly has competency to investigate health-related claims, an ex ante certification program would involve investigating all potential problems with a health app rather than investigating specific deceptive claims. The FTC takes action when no "direct harm" is posed to consumers by the medical apps, and in those cases, the FDA may choose to have the FTC take action or choose to take action itself.116 The FDA and FTC do try to work together to minimize confusion that may arise from overlapping jurisdictions.117 Furthermore, even though the FTC has jurisdiction "for health breaches when the entities involved are not Health Insurance Portability and Accountability Act 11s covered entities," the FTC "carefully [determines] how best to work with [Health and Human Services] on health information breaches." 19 Additionally, the FCC and the FDA have announced a Joint Statement of Principles and have signed a Memorandum of Understanding signifying a heightened level of previous and future cooperation. It states the agencies' intentions to enhance efforts to "share information, improve the efficiency of our regulatory processes, promote efficient use of tools for product analysis and risk identification, and build infrastructure and processes that meet common needs for evaluating the safety and efficacy of broadband and wireless enabled medical 113 Dolan, supra note 112. 114 Id. 115 Id. 116 Id. 117 Id. 118 Pub. L. No. 104-191, 110 Stat. 1936 (1996). 119 Dolan, supra note 112. 2014 737 INDIANA HEALTH LAW REVIEW devices." 120 The ultimate goal of this partnership is "a balanced approach . . . [and] an approach that meets the unique challenges of the 21st century while prioritizing health and well-being above all else."121 The FDA has an ongoing working relationship with both the FTC and FCC, so it is likely that the agencies could successfully cooperate in carrying out a successful certification program for health apps. The ex ante use of the FDA's medical expertise, the FTC's expertise in consumer fraud, and the FCC's communications expertise not only would promote consumer confidence in health apps that have been certified and prevent apps that could not be certified from being produced. A centralized certification process would possibly have to include the cooperation of the FTC, FCC, or both. Each agency would have personnel who would review the voluntarily submitted app within the respective agency's field of expertise and authority. Given the FDA's vast experience in the field of medicine, it should be the agency responsible for reviewing the accuracy and trustworthiness of the medical information within the health app. Any reviewing member of these agencies would have the ability to reject the certification of health apps for non- arbitrary determinations that the app developer failed to meet that agency's standards of accuracy and trustworthiness. For example, Dermapps would not have received approval from the FDA for making false medical claims, and it would not have received FTC approval because it sought to induce purchases with false claims. Given that AcneApp had no communicative components, it probably would not have fallen under FCC jurisdiction. 120 Margaret A. Hamburg, Comm'r of Food and Drugs, Remarks at the FDA/FCC Public Workshop: Enabling the Convergence of Communications and Medical Systems, available at http://www.fda.gov/NewsEvents/Speeches/ucm220447.htm, archived at http://perma.cc/6368-B8DN. 121 Id. 738 Vol. 11:2 RETHINKING HEALTH APP REGULATION 3. Implementation of the Certificates Apple, at least, has the ability to incorporate certificates into its App Store. The iOS software "contains functionality that allows it to accept digital certificates either issued from Apple or from third parties."122 The definition of digital certificates is rather technical and requires acquaintance with upper-level mathematics, but it suffices to say that Apple could cooperate with the FDA to implement digitally verifiable certificates. 12 3 Anyone who uses the FDA's health app certificate without authorization would be subject to civil or criminal penalties, or both. For extra consumer protection, these penalties could extend to any entity that derives a benefit from the use of the certificate and plays a role in its unauthorized use. For example, if Apple approved an app using an unauthorized certificate in its advertising, marketed it, and took a commission on the sale, it would face penalties. However, to protect Apple in a situation like this, there should be a public registry maintained by the FDA of apps that have been certified, so Apple would only be liable in cases of its own negligence. D. An Alternative, Decentralized Certification Scheme for the FDA Cost constraints faced by the FDA and other agencies or the desire to protect fledgling organizations like Happtique may mean that a centralized certification program is not possible. If so, a decentralized certification program would still be possible. Under such an approach, the FDA would certify independent organizations like Happtique rather than certify individual apps. These certified third parties would then turn around and certify the apps themselves. A decentralized certification process, as a concept, would not 122 Apple iOS 6 Software License Agreement, supra note 22, at § 9. 123 See Description of Digital Certificates, MICROSOFT CORP. (Jan. 23, 2007), http://support.microsoft.com/kb/195724, archived at http://perma.cc/6NJH-3FXW. 2014 739 INDIANA HEALTH LAW REVIEW be revolutionary. It would be an evolutionary concept applied to the exploding mobile health market. Independent organizations would need to demonstrate particular qualities to the FDA in order to be certified. First, they would need to show that experts within the field of health and medicine would review the substantive content of the apps for accuracy, trustworthiness, reliability, and quality. The apps should also be reviewed by technological experts with respect to how the technological components of the apps bear on the reliability of the health-related components of the apps. For example, technical experts would ensure that an app that reminds consumers to take pills at particular times would be sufficiently reliable. Whereas, if the app had a library of images to correspond with the pills the app is reminding the patient to take, pharmaceutical experts would need to verify the accuracy of these matches. The analysis factors used by the FDA will vary greatly based on which approach the entity takes. A centralized approach means the FDA uses standards to evaluate the content of the apps themselves, but a decentralized approach means the analysis must cast a wider net. Any decentralized program requires an analysis to be both flexible enough to cover the limitless array of apps the third party certifying entities may be asked to review but also strict enough to provide effective protection to consumers post-review. It is a much more difficult standard to articulate and, if this approach is taken, the FDA should take special care to receive input from developers, certifying third parties, and consumers to help it strike an appropriate balance. Furthermore, as a result of these difficulties, there are really no previous examples directly on point, and any comparison will have limited application to health apps. This Note endorses the centralized method over the decentralized one, but described below are past experiences the United States government has had with decentralized certifying and accrediting bodies that help shed light on concerns that a decentralized program for health apps would need to address. Vol. 11:2740 RETHINKING HEALTH APP REGULATION 1. Current Uses of Decentralized Certification Programs A decentralized certification program would not be a revolutionary concept because it already exists in numerous forms within the United States government. Third parties have been used in areas as diverse as education, nuclear regulation, and clinical trials with human testing.124 Third party certification is widely used in the field of education. Disbursement of federal funds has been tied to third party certifications from as far back as the early G.I. Bills.125 As far back as a century ago, colleges sought to cooperate by adjusting admissions standards to achieve "uniformity in preparation" of their students. 126 There also were concerns about what a college education actually entailed. 127 These concerns, at least in part, ultimately resulted in accreditation of colleges by 1913.128 Now, six regional accreditation bodies accredit thousands of higher education institutions.12 9 The modern approach to accreditation of educational institutions operates slightly differently from how certification of health apps would. These days, accreditation of higher education institutions is less about achieving uniformity and more about institutions achieving recognition from peers that they have lived up to their 124 See generally Charles J. Walsh & Alissa Pyrich, Rationalizing the Regulation of Prescription Drugs and Medical Devices: Perspectives on Private Certification and Tort Reform, 48 RUTGERS L. REV. 883, 973- 87 (1996). 125 Veterans' Readjustment Assistance Act of 1952, Pub. L. No. 82- 550, § 253(a)(1), 66 Stat. 663, 675 (repealed 1958) (tying financial aid for veterans to courses offered by colleges or other institutions that had been "accredited and approved by a nationally recognized accrediting agency or association"), cited in Walsh & Pyrich, supra note 124, at 981. 126 Douglas C. Michael, Federal Agency Use of Audited Self- Regulation as a Regulatory Technique, 47 ADMIN. L. REV. 171, 228 (1995) (citing WILLIAM K. SELDEN, ACCREDITATION: A STRUGGLE OVER STANDARDS IN HIGHER EDUCATION 30-31 (1960)). 127 Id. 128 Id. 129 KENNETH E. YOUNG ET AL., UNDERSTANDING ACCREDITATION 26- 28 (1983) (discussing the nature and membership of the six regional accreditation bodies), cited in Michael, supra note 126, at 228. 2014 741 INDIANA HEALTH LAW REVIEW established goals. 130 This was actually a return to educational values that predated the history of accreditation; higher education institutions in the United States have a long history of diversity and local control over academic programs. 131 Health apps are generally the same in one region of the country as they are in others, and therefore the historical tradition of regional diversity and control is not exactly relevant to health apps. But the use of accrediting bodies to ensure standardization is acutely relevant to certification of health apps since ensuring that health apps comply with demonstrated medical knowledge and proven scientific discoveries is the goal of such certification. The adaptability of third party certification programs suggests it may also have a place in protecting consumers from spending money on or placing trust in poor quality health apps. It is also a form of governance to which Americans have become accustomed over the past century. 2. Implementation of the Decentralized Certiflcation Program National experiments with third party certification programs have had mixed success, and a decentralized certification program for health apps should learn from those successes and failures. In 1952, Congress adopted, and the Commissioner of Education implemented, an accreditation scheme for higher education that lacked any real teeth. 132 Among other things, it required the accrediting body (1) be national or regional (i.e. included more than one state) in scope, (2) 130 Michael, supra note 126, at 228-29 (citing KENNETH E. YOUNG ET AL., UNDERSTANDING ACCREDITATION 66 (1983); Courts Oulahan, The Legal Implication of Evaluation and Accreditation, 7 J.L. & EDUC. 193, 223 (1978)). 131 Michael, supra note 126, at 229 (citing WILLIAM K. SELDEN, ACCREDITATION: A STRUGGLE OVER STANDARDS IN HIGHER EDUCATION 17-20 (1960)). 132 Michael, supra note 126, at 230 (citing Matthew W. Finklin, Federal Reliance on Voluntary Accreditation: The Power to Recognize as the Power to Regulate, 2 J.L. & EDUC. 339, 343-48 (1973)). 742 Vol. 11:2 RETHINKING HEALTH APP REGULATION serve a "definite need," (3) do nothing that might impact its independent judgment, (4) give access to the public about its accreditation standards, operations, and membership, (5) only accredit institutions that it determines meet its pre- established standards after an examination, (6) have some experience in accreditation, and (7) has gained "general acceptance" for its criteria and decisions.133 It is possible that Congress and the Commissioner adopted such vague and innocuous measures because they sought to avoid engaging in a review to determine which school would not receive funding through the use of accreditation schemes that were well understood by the educational institutions but not the general public.134 Regardless, these standards, if applied to health apps, would set such a low bar for quality assurance that they can only be a starting point in the analysis. After the Three Mile Island accident, members of the nuclear power industry proposed a set of regulations through the collaborative effort of the Institute for Nuclear Power Operations ("INPO").135 The official regulatory body, the Nuclear Regulatory Commission, adopted the INPO proposals for personnel training as a condition for the grant or renewal of licenses.136 However, the INPO proposals, as adopted, only encouraged and did not require implementation of personnel training programs, and the United States Court of Appeals for the District of Columbia Circuit determined this was insufficient because Congress had mandated that licensing be contingent upon such 133 Michael, supra note 126, at 230 n.402 (citing Finklin, supra note 129, at 347). 134 Michael, supra note 126, at 229 (citing KENNETH E. YOUNG ET AL., UNDERSTANDING ACCREDITATION 251 (1983)). 135 Michael, supra note 126, at 233. 136 Michael, supra note 126, at 233-34 (citing Commission Policy Statement on Training and Qualification of Nuclear Power Plant Personnel, 50 Fed. Reg. 11,147 (Mar. 20 1985); Commission Policy Statement on Training and Qualification of Nuclear Plant Personnel, 53 Fed. Reg. 46,603 (Nov. 18 1988) (making the previous changes permanent)). 2014 743 INDIANA HEALTH LAW REVIEW personnel training. 137 This example is emblematic of the mixed history of decentralized certification programs. While the Court of Appeals struck down the INPO proposals, as adopted, on legal grounds (e.g., the regulation was not as strict as Congress required), there still was an element of public policy at work. Congress, speaking on behalf of the American people, demanded more personnel preparedness than the industry wanted to give. Third parties certifying health app developers may fall victim to the same problem. A truly independent certifying body may be immune to pressures out-of-step with public demands, but it is more likely that these certifying bodies will end up favoring the entities they do business with (e.g., the certified health app developers) over the people vis-A-vis the government. If so, then the FDA's requirements for certifying third parties must be strict enough to combat pressures from the industry. The optimal model for decentralized review of health apps may actually be found in a recommendation made by the Progress & Freedom Foundation ("PFF') to the FDA in June 1995. 138 This proposal contained five main recommendations: (1) maintain or improve existing standards for efficiency and safety, (2) provide for third party review of new products, (3) retain the FDA seal of approval, (4) facilitate application of cutting-edge scientific talent and knowledge to the review process, and (5) foster competition and management efficiency in the processes of research, development, and oversight. 139 All of these objectives track the goals of health app review put forth in this Note. This is especially true for the last four objectives. The general purposes of health app review are to protect consumers' health and finances with FDA oversight, ensure 137 Public Citizen v. Nuclear Regulatory Com'n, 901 F.2d 147 (D.C. Cir. 1990), cited in Michael, supra note 126, at 234. 138 Walsh & Pyrich, supra note 124, at 992-93, (citing Thomas M. Lenard et al., The Future of Medical Innovation: A New Approach for Bringing Medical Products to Market, PROGRESS & FREEDOM FOUND. (1995)). 139 Walsh & Pyrich, supra note 124, at 993 (citing Lenard, supra note 138, at 18). 744 Vol. 11:2 RETHINKING HEALTH APP REGULATION health apps contain accurate and up-to-date scientific knowledge, and promote commerce by signaling to consumers which health apps are trustworthy. Unlike previous recommendations to the FDA, which had encouraged a great degree of privatization within the drug approval process, the PFF proposal would have left a relatively significant amount of control in the hands of the FDA.140 The proposal recommended that Drug Certifying Bodies ("DCBs") would perform most of the review functions that were currently being performed by the FDA, and the DCBs would receive special licenses from the FDA and be subject to its ongoing supervision.141 The level of deference given to third party certifiers would be at the discretion of the FDA. 142 Perhaps as an incentive to induce drug developers to agree to this process, PFF proposed creating a tort liability defense for drug manufacturers who had received DCB approval.143 The PFF proposals appear not to have been adopted by the FDA and Congress due to political pressures,144 but as applied to health apps, they may strike a welcome balance. 3. Potential Drawbacks of the Decentralized Certification Program Using third parties to certify health apps does alleviate problems like potentially high costs that could be caused by the centralized program. However, the decentralized 140 See generally Walsh & Pyrich, supra note 124, 987-98 (describing the historical development of drug regulation beginning with a recommendation by the Council on Competitiveness Proposal in 1991, continuing through the 1996 PFF proposal, and beyond). 141 Walsh & Pyrich, supra note 124, at 994 (citing Lenard, supra note 138, at 18). 142 Walsh & Pyrich, supra note 124, at 994 (citing Lenard, supra note 138, at 21); FDA Would Become "Certifier of Certifiers" Under Progress & Freedom Found. Privatization Plan for Product Approvals, Sponsors Pay for Reviews, 57 F-D-C REP. (THE PINK SHEET) (June 26, 1995) [hereinafter Sponsors PayforReviews). 143 Walsh & Pyrich, supra note 124, 993-94 (citing Lenard, supra note 135, at 28). 144 Walsh & Pyrich, supra note 124, at 996. 2014 745 INDIANA HEALTH LAW REVIEW program has problems of its own, some of which may undermine the entire objective of a certification program. Third parties generally must be well known in order for the public to feel secure in purchasing a health app bearing their certificates. These days, anyone can design a fancy certificate on a computer and affix it to the description of an app. Therefore, someone who has not gone through the official certification process could nonetheless legally establish an unsanctioned certification body, design a certificate, and lure the consumer into purchasing an app that would not meet the official certification criteria but still look official. This problem is not unlike the problems faced by certified personal trainers. There are hundreds of certification programs for personal trainers, but only a few of them are reputable. 145 Consumers are left to sift through the merits of individual certificates and hopefully arrive at a sound conclusion.146 This problem ends up putting the cart before the horse for consumers new to the field. Before they can identify high quality trainers, they have to learn about the precise field for which they have sought out a personal. As applied to health apps, this same problem could arise if sellers use unsanctioned certificates to market their products. Consumers would be left to research the merits of individual certifying third parties in a field for which they have sought the health apps to educate them in the first place. The dilution of the effectiveness of third party apps could be mostly offset if the FDA reserved some centralized authority. For example, the FDA could license third parties to use certificates bearing text to the effect of "An FDA Approved Organization." Any entity attempting to induce purchases with unsanctioned certificates would be prohibited to use any text suggesting the entity has FDA approval. Enforcement of this rule would be the 145 Jeremy Hoefs, Top 10 Best Personal Trainer Certifications, LIVESTRONG, http://www.1ivestrong.comlarticle/436098-top-10-best- personal-trainer-certifications/ (last updated Mar. 3, 2014), archived at http://perma.cclX5LU-D6YQ; Jill Schachner Chanen, Fitting in Ftness, ABA J., July 2001, at 64, 65. 146 Chanen, supra note 145. 746 Vol. 11:2 RETHINKING HEALTH APP REGULATION responsibility of the FDA, and it should be equipped with the ability to seek civil or criminal penalties for violating it. Another problem is that third parties may not have the same degree of transparency as the FDA. The motives behind FDA certification decisions would presumably be benign, but for-profit entities have other responsibilities. Public corporations generally have a duty to protect shareholders above all else, 147 and their interests may diverge from the interests of the public. For example, a private entity may offer to expedite the certification process for a premium. However, if the certifying entity does not expend extra resources on the review process, it may deliver a result that is both profitable to its shareholders and substandard to the public. Third parties may have any number of other conflicts of interest that government agencies and agents would be forbidden from having. An example of this problem might come from the close relationship between the DCBs and drug manufacturers that may have formed had the PFF proposal been adopted. Under the PFF proposal, drug developers would actually hire DCBs to oversee and advise the developer through the development process of the drug. 148 Then, when the developer believed the drug would be ready, the same DCB would be responsible for deciding whether to officially approve the drug for the market, and it would submit its report to the FDA.149 PFF appeared to believe that because the DCBs would only be applying existing FDA standards, the FDA would typically defer to DCB findings. 150 This plan would leave a substantial amount of approval authority in the hands of the bodies responsible for helping the 147 E. Norman Veasey & Christine T. Di Guglielmo, How Many Masters Can a Director Serve? A Look at the Tensions Facing Constituency Directors, 63 Bus. LAW. 761, 765 (2008) (quoting N. Am. Catholic Educ. Programming Found., Inc. v. Gheewalla, 930 A.2d 92, 99 (Del. 2007)). 148 Walsh & Pyrich, supra note 124, at 994 (citing Lenard, supra note 138, at 21). 149 Walsh & Pyrich, supra note 124, at 994 (citing Lenard, supra note 138, at 21). 150 Walsh & Pyrich, supra note 124, at 994 (citing Lenard, supra note 138, at 21); Sponsors Payfor-Reviews, supra note 142. 2014 747 INDIANA HEALTH LAW REVIEW developers obtain approval. DCBs that already accepted money from drug developers would feel significant pressure to ultimately accept drugs after completion of the development phase in order to secure future business. At least under the PFF proposals the FDA would retain post- market surveillance and could recommend pulling the offending drug from the market, 151 but this would be insufficient to protect a first wave of individuals negatively affected by a bad drug. Any approach adopted for health apps following this model should hold third party certifiers liable for injuries caused by any health apps negligently approved. The only way to eradicate these problems entirely would most likely be for the FDA to direct the operations of the certifying third parties to such a degree that there would be little practical difference between a centralized and decentralized certification system. This result, however, would be highly undesirable. Therefore, one of the concessions of using third parties to certify health apps would be that a certain level of conflicts of interest with the public would necessarily have to occur. Exactly what conflicts these would be or the limit to which society would tolerate is beyond the scope of this Note but is certainly worthy of consideration. IV. CONCLUSION The mobile device industry is still rather new, but the adoption rate of mobile devices has been astronomical. The number of consumers likely to be negatively impacted by apps like Dermapps only increases. Creators of deceptive or inaccurate health apps will only have increased incentives to design and market more, while the existing ex post review of offending health apps becomes increasingly unrealistic and ineffective. Consumers are left to fend for themselves in the current health app market. They can sometimes rely on anonymous or pseudonymous testimonials from consumers, but 151 Walsh & Pyrich, supra note 124, at 995. 748 Vol. 11:2 RETHINKING HEALTH APP REGULATION someone has to be the proverbial guinea pig. The FDA draft guidelines make proposals that would protect some consumers from some unreliable apps, but there are many categories of apps left uncovered by the guidelines, and consumers' well-being and checkbooks are left vulnerable. Adopting a certification standard that would signal to consumers which health apps have been verified as medically reliable would go a long way in promoting consumer, and even physician, confidence in the health app marketplace. Such a standard could be implemented through the FDA, which would allow the greatest flexibility for FDA review on a case-by-case basis, or through third parties certified by the FDA, which would address many political issues and especially those having to do with the budget and national debt. If the FDA were to determine a certification model applicable to the mobile medical devices, particularly those not requiring premarket approval, it currently intends to regulate, the decentralized approach may be the best fit. A certificate that a mobile medical device has met the FDAs regulations may be nearly meaningless because all covered apps would be required to meet those criteria. The decentralized approach would allow private entities to set a higher standard, and the FDA would not have to maintain two sets of standards for the same apps. This Note only explored issues with substantive contents of health apps, but there are many more issues at play. Furthermore, this Note explored only a few models for centralized and decentralized certification, but the possibilities are endless. This is the beginning of a conversation on how to promote confidence and consumer protection in the health app marketplace by establishing an alternative to regulation. Certification of health apps provides the customization and adaptability necessary to promote consumer confidence and protection in the modern technological age. The government cannot save consumers from making poor decisions in all cases, but as has been demonstrated, it can at least provide consumers with the tools to make well- 2014 749 750 INDIANA HEALTH LAW REVIEW Vol. 11:2 informed, smart decisions about their healthcare by promulgating certificates for mobile health apps.