Laws are created by legislative bodies and spell out specific actions that are permitted or prohibited.

The line between a code, a standard, and the law is often not clear to many working in health care. This has led to problems over the years, and it will continue in the future until we get everyone on the same page. In the September issue of 24×7, there were two excellent articles that should be read and understood. The first, “An Introduction to IEC 62353” by John Backes, reviews the standard that the manufacturers use to test their equipment. In the Service Solutions section, Liz Finch’s article, “Rewriting NFPA 99,” contain the rules that many health care organizations follow. When you read the two documents, you will find numerous conflicts that can, and will, cause confusion in the future.

To understand the differences, the terms must be defined, and that is what we will try to do in this article.

Defining the Law

Basically, a law is created by a legislative body and spells out specific actions that are permitted or prohibited. It can also create a body or agency to create rules and regulations that are designed to meet the provisions in the act. One that impacts all of us is the Safe Medical Device Act, passed by the US Congress, that gives power to the FDA to write the rules and regulations for medical products. Generally, laws passed by Congress give the power to other agencies to create the rules and regulations, which then become the working law. Others that impact our daily work lives are the HIPAA requirements and OSHA, to name a few. Sometimes, those agencies will create very specific requirements for a specific product or service.

Falling into the category of rules created by laws that we have to deal with are the radiation requirements for x-ray—CFR title 21, part 900, dealing with mammography centers, and problem reporting to the FDA. Also in this group are the EPA requirements on mercury, and NRC requirements on isotopes used in diagnostic procedures. One that many of you are probably not exposed to is the requirement of OMB-133A, which requires reporting on the service work done on any device that is purchased with federal grants—generally, research equipment. Many of you have gone through the requirements from the FCC to register telemetry channels with the American Society for Healthcare Engineering.

Many states will also pass laws that can impact our work, but remember that the federal law always supersedes the state law. In both the federal and state cases, some laws stay on the books long after the problem identified has passed. According to a Massachusetts law, it is legal to shoot someone from Rhode Island if they are in Massachusetts on a Sunday. That law was passed around the year 1630 and is still on the books, but if I shoot someone I bet that there are other laws that will come into play.

Further complicating the laws are the legal rulings from various judges over the years that alter the wording of regulations or allow for something different. An example of this is that in the first Safe Medical Device Act (PL-94-295), manufacturers were required to supply the users with all technical documentation to repair devices. Several companies took that provision to court saying that they would have to provide privileged information that competitors would gain access to. The courts agreed with the companies, and so today, we cannot always get the service information or documentation that we need to do our job.

Remember, laws and the regulations that the designated governmental agencies create are enforceable in court. Civil and criminal fines can be levied, as can jail time.

Know the Codes

A code is defined as a set of rules, principles, or ethics, and is developed by a group of individuals with interest in a specific area or profession. A code is not enforceable by law in its original form, but a code can become a law if adopted by a legislative body. The most common of these is the NFPA Life Safety Code, which has become the electrical code of about 39 states in the United States. A problem with legislative bodies making codes into laws is that most codes change every 3 to 5 years and the law is sometimes very different from the current code. Unless a code becomes a law, a company making medical devices is not required to meet the requirements.

For example, in section 8.5.3.1.1.1 of NFPA, which is part of the Life Safety Code, it states that maintenance manuals must be available to the users, but often when a company is pushed for manuals they do not comply, stating that they are complying with federal requirements and they do not have to accept any provisions of NFPA.

Remember that requirements in various codes do not always agree, such as the electrical leakage limits in NFPA 99, AAMI/ANSI, and IEC. If your state has adopted NFPA as the electrical code, those are the numbers that you have to use. If your state has not adopted NFPA, you are free to use any of the other codes. Please note that currently on the exam, only NPFA leakage numbers are used.

Review Question

1) Which is the wrong statement?

  1. NPFA 99 requires the manufacturer to supply full repair documentation on devices.
  2. The FDA requires that the manufacturer supply full repair documentation on devices.

See the answer

A code cannot be enforced by a court; they can use it as a guide but cannot enforce it.

Living Up to a Standard

A standard is defined as something that serves as a basis for comparison; a technical specification or written report by an expert. The Joint Commission is not a law or code but a standard. But, if The Joint Commission or another deemed body does not accredit your hospital, your facility will not be able to receive payments for Medicare or Medicaid patients. Since those patient populations make up the majority of most hospitals’ income, The Joint Commission standard carries a lot of weight.

Other standards that are part of our daily work include the UL standards on various devices, the AHA standard/guideline on AEDs, CE designations, and in many hospitals CAP standards in the laboratory areas. Also, there are standards from the blood banks, pharmacy, laser, endo, and just about any group that has anything to do with health care. Most hospitals will also have internal policies and procedures that have to be followed. Again, many of these may be in conflict with various laws, codes, or standards, just to make your life interesting.

You should take the time to go to the FDA Web site, and read the section, “How to Report Problems with Products Regulated By the FDA.” While reporting problems is the law, many hospitals restrict who can report problems to the FDA. Usually, the risk manager does the reporting, but be sure to know what the system is in your hospital as it might come up at some time during an investigation of an incident or an inspection. It is important to be prepared.


David Harrington, PhD, is director of staff development and training at Technology in Medicine (TiM), Holliston, Mass, and is a member of 24×7’s editorial advisory board. For more information, contact .