Medical Devices

 

Medical devices are regulated by the Therapeutic Goods Administration and are products intended for:

• diagnosis, prevention, monitoring, prediction, prognosis, or treatment of a disease, injury, or disability
• alleviation of, or compensation for, an injury or disability
• investigation of the anatomy or of a physiological process
• control or support of conception.

Note: For non-portable medical devices, please see the guidelines for Medical Technology systems.

Standards and specifications

General requirements

Medical Device regulation

Medical devices (including those that are software or incorporate software) must comply with applicable regulatory requirements under the Therapeutic Goods Act 1989.

Most medical devices must be included in the Australian Register of Therapeutic Goods (ARTG) before they can be supplied in Australia. Suppliers of medical devices can advise if they are included in the ARTG.

Guidance can be found at Regulation of software based medical devices | Therapeutic Goods Administration (TGA).

Cyber security

If the medical device includes a back-end system that stores patient and clinical data, the software must demonstrate adherence to the ‘Essential 8’ cyber security principles.  

Core requirements

Standards for identification

If the medical device includes a back-end system that stores patient and clinical data, and will integrate into other clinical systems, the software must:  

• be able to discover and validate Individual Healthcare Identifiers (IHI) via the Healthcare Identifier (HI) Service Business-2-Business web services
• integrate Individual Healthcare Identifiers (IHIs) into the local patient record
• where the EMR stores local directory for Healthcare Providers allow for:
  • the storing of Healthcare Provider Identifier-Organisation (HPI-O) in the local system associated with the locally stored healthcare provider organisation details
  • the storing of healthcare provider identifier-individual (HPI-I) in the local system associated with the locally stored healthcare provider individuals’ details.
• support data capture and storage of unique device identification of medical devices as defined within AS ISO/IEC 15459.4:2023 Information technology — Automatic identification and data capture techniques — Unique identification, Part 4: Individual products and product packages
• support adherence to Patient Identification best practices as outlined by the Australia Commission on Safety and Quality in Health Care.

Where the system stores a local directory for Healthcare Providers it must allow for the storing of:

• Healthcare Provider Identifier-Organisation (HPI-O) numbers
• Healthcare Provider Identifier-Individual (HPI-I) numbers.

Australian Core Data for Interoperability (AUCDI)

The software should support the use of AUCDI Release 1.

Note: The focus of the AUCDI Release 1 is the representation of the clinical content necessary for each of the data groups identified within the Release 1 scope.

Development is continuing to enhance AUCDI.

Standards for data sharing

The software should:  

• support the consumption of clinical documents in Fast Healthcare Interoperability Resources (FHIR®) formats.
• capable of using HL7 FHIR-compliant API when sending clinical information.
• should be capable of using HL7 FHIR-compliant API when receiving clinical information.

If the system stores, transmits, retrieves, prints, processes or displays medical imaging, it must:

• support the DICOM standard.

Standards for terminology, code sets and classifications

The system must:

• support Systematised Nomenclature of Medicine-Clinical Terms AU (SNOMED CT-AU)
• support the use of Australian Medicines Terminology (AMT) for the storage of patients’ current medicines.
• support Logical Observation Identifiers Names and Codes (LOINC®)
• support Data Set Specifications including but not limited to National Minimum Data Sets (NMDS), as defined within Australian Institute of Health and Welfare Metadata Online Registry (Meteor)
• support the Australian Refined Diagnosis Related Groups (AR-DRG) classification
• be capable of using METEOR for recording clinical information with data specifications
• be capable of using Nutrition Care Process Terminology (NCPT)
• be capable of using Rapid Response System (RRS) terminology
• support the inclusion of medicines listed on the Australian Register of Therapeutic Goods (ARTG)
• support Pharmaceutical Benefits Scheme (PBS) updates to determine eligibility
• support Standardised Pathology Informatics in Australia (SPIA)
• support the use of the Private Health Insurance (prostheses) rules and the current versions of the prosthesis list including the drafted Prescribed List Guide.
• support demographic AU core data set.

The system should:

• support person and provider identification in healthcare National Best Practice Data Set
• support the National Clinical Terminology Service (NCTS)
• support the capture of information to support Australian PBS regulatory requirements
• support the use of content from the National Health Services Directory.

National Safety and Quality Health Service (NSQHS) Standards

Implementation of NSQHS is mandated in all hospitals, day procedure services and public dental services across Australia.

The system must:  

• support adherence to best practices related to Informed Consent
• support adherence to all relevant National Safety and Quality Health Service Standards in accordance with the intended scope of the system being procured. These may include, but not limited to the following standards:
  • Partnering with Consumers Standard
  • Communicating for Safety Standard
  • Comprehensive Care Standard
  • Blood Management Standard
  • Medication Safety Standard
  • Clinical Governance Standard.
• support adherence to all relevant Clinical Care Standards.

Other Standards

International

Where appropriate, the system should:

• support ISO 13485:2016 Quality Management for Medical devices

National

The system must:

• Content will be updated following consultation feedback.

Connections to National Systems

HI Service

If the software is expected to deal with healthcare identifiers (e.g. in a hospital environment) then it must either:

• be able to discover and validate Individual Healthcare Identifiers (IHI) via the Healthcare Identifier (HI) Service, or

Where the enterprise utilises an enterprise-wide system for discovery and validation of Individual Healthcare Identifiers (IHI) the software must:

• be able to manage and interface with this middleware in order to enable discovery and validation of Individual Healthcare Identifiers (IHI).

My Health Record

The software must:  

• be able to respect patient instruction not to upload at a patient and document level when contributing clinical information to the My Health Record system
• be able to access record information from the My Health Record as required
• be able to upload an Event Summary to the My Health Record system, if required
• support patient instruction not to upload.
• be able to upload a pathology report to the My Health Record system  

Note: If the system is not connecting to My Health Record then My Health Record requirements above can be removed.  

Where it is a source system for capture, it must also:  

• be able to upload a Discharge summary to the My Health Record system  
• be able to upload Diagnostic Imaging reports to the My Health Record  
• be able to upload Discharge Dispense Medication to the My Health Record.

API Gateway or Government Provider Management System (GPMS)

For aged care services, the software should:

• be capable of sharing relevant data and reports to the GPMS  

Conformance

HI service

The software should:

• have production access to the Health Identifiers Service.

Healthcare Information Provider Services (HIPS)

If the system connects to the Healthcare Information Provider Service (HIPS) middleware product, the system must:

• conform with the HIPS conformance profile V1.

State and territory requirements

The following state and territory requirements must be upheld based on location.