Skip to content
In the intricate world of healthcare, where innovation meets human life, a complex web of regulations governs every step. From the conception of a new drug to its delivery to patients, businesses navigate a maze of rules designed to protect public health and safety. These regulations are not mere hurdles but essential safeguards to privacy and patient safety.
The regulatory landscape can be daunting, with misunderstandings or oversights leading to severe consequences, from financial penalties to reputational damage. A misstep can be catastrophic, not just for the business but for the patients they serve. However, taking a proactive approach to understanding the regulations and embedding a culture of quality throughout the business, can accelerate adoption and assure potential customers from the outset of any engagement.
In this blog written between our Commercial Director, Ryan Palmer and Head of Quality and Regulatory Affairs, Daniel Mannion, we’ll explore the advantages of developing a clear regulatory strategy, offering insights to help healthcare-focused businesses navigate business critical requirements.
What are Regulatory Requirements?
The exact definitions vary from country to country, but generally, laws are passed by a legislative body (e.g. Parliament, Congress) that give a framework for what a government expects/requires a company to do to protect its citizens from risks related to their products.
Regulations are the specific requirements created within the framework of the law. In some countries, these requirements are included within the law and in others Regulations are created, published and maintained separately from the legislation by a governmental/executive body. We’ve previously written about how interpretation of legal precedents can often lead to issues for businesses, especially when considering Information Governance, and you can read more about this here.
For businesses operating in a healthcare setting in the UK, the most common regulatory bodies businesses could encounter, or more appropriately should aim not to encounter, are the Information Commissioner’s Office (ICO) responsible for upholding information rights in the public interest and the data privacy of individuals and the Medicines and Healthcare products Regulatory Agency (MHRA) responsible for regulating medical devices or medical equipment.
Why should you invest in a Regulatory Strategy?
Investing in a Regulatory Strategy can offer a host of benefits to your business, whether you are just starting out or developing a new product/service line that may be subject to regulations and compliance requirements in a specific market. We believe there are 3 core reasons for doing so:
Fundraising
Investors are all about assessing the balance of risks and rewards and just like a go-to-market strategy, a detailed Regulatory Strategy can often tip the balance between securing investment and failing to do so for digital health technologies.
Through a Regulatory Strategy, businesses and investors can fully understand the timelines and costs associated with compliance, ensuring a realistic budget is applied to ‘must-have’ activities and the right resources are allocated quickly to prevent your runway from running out. One of the quickest ways to apply the learnings from a regulatory strategy is by selecting a trusted partner that can help you hit the ground running which will ultimately support validation of the go-to-market strategy.
By investing limited funds in a comprehensive Regulatory Strategy it becomes a simple task to explain the strategy to your investors in your initial pitch deck. This will help them feel assured that you are serious about your business and will take sensible measures to maximise and protect their investment. Furthermore, if they are disinterested in regulated products, such as Software as a Medical Device or Medical Devices generally, it will help you qualify them out of your investment round.
Most investors in healthcare have deep experience and knowledge in the industry or may have industry-specific advisors to review your business strategy, but even investors with minimal exposure will have heard of high-profile disasters like Theranos. Whilst investing is a risky process, most investors focused on healthcare will want to de-risk their investment from the outset to give them the best chances of seeing a return on investment or ROI.
Go-to-Market Strategy
Defining your Regulatory Strategy from the outset will give the business a clearer view of how a go-to-market strategy should be developed and deployed.
For Medical Devices, there may be considerations made during the initial strategy to ensure the product can go to market quickly, without incurring additional costs from Notified Bodies or Certification Bodies. This is extremely common with Software as a Medical Device (SaMD) in both the UK and US where the decision may be to limit features, to prevent the need for significant additional spend. Alternatively, a product which requires multiple rounds of review and certification may need to delay its go-to-market plans until regulatory approval has been granted. While the latter is a riskier more long-term strategy, it may be the only option for some products.
Alternatively, where your regulatory requirements may not extend to medical device regulations, the business may benefit from an impartial perspective on what it must conform against in order to operate in a specific market. We often find ourselves helping international companies determine how their existing compliance portfolio may align with the expectations of the NHS Digital Technology Assessment Criteria (DTAC). By doing so, we help them to make and explain a clear and manageable plan to support their UK market entry aspirations.
A go-to-market strategy for healthcare businesses often requires a much broader evaluation than just the regulatory requirements, however, considering the regulations and indeed the crossover between your existing compliance portfolio can often support internal business cases and lay the path for commercial success.
Hiring
By understanding the regulatory profile of your business, Founders and management teams can also make more effective hiring decisions.
If you’re building a medical device for example, having a CTO or Technical Leadership that is familiar with managing and following Design Controls and updating the Quality Management System (QMS) may prevent unnecessary bottlenecks in development and release cycles (particularly for self-certified Class 1 Medical Devices in the UK). In addition, it will help embed a culture of quality and compliance throughout the technical team ensuring the product remains safe and effective.
Overall, by looking holistically at your go-to-market strategy and your target market, businesses can think strategically about the resources they need to be effective in their country or market of choice. In some cases, it may be more effective for international businesses to outsource their requirements for a particular market to prevent unnecessary overheads but also gain valuable market knowledge that may be difficult to track down in a single hire.
What are the consequences of Regulatory non-compliance?
Lost Opportunities
Many healthcare customers – especially larger, institutional clients like the NHS – will perform due diligence on your company as part of procurement and contracting. What will be involved during due diligence will often be fairly opaque until you get to the final stages of closing a contract, but the NHS Digital Technology Assessment Criteria (DTAC) serves as a good framework for businesses to follow to help address the regulatory and compliance requirements of the NHS.
Customers expect you to have met the applicable regulatory requirements because they are mandatory so offer little reconciliation if you cannot evidence compliance. Purchasing staff often don’t know why you need to meet these regulatory requirements, just that you have to as part of the due diligence process.
Sadly, many companies with great products have misunderstood or neglected regulatory requirements and so had huge contracts pulled at the last minute. It was this experience that led 8foldGovernance to come to be what it is today. Our Founders saw that many digital health businesses were failing to appreciate compliance as part of the go-to-market (GTM) strategy and this proved their undoing. We were founded to help ethical innovation get to market and prevent lost opportunities for businesses and the chance to impact patient care.
Enforcement
By far the most common outcome of Regulatory non-conformity is a requirement by the Regulator that the non-compliance is investigated, resolved and prevented from recurring. This occurs for the least serious scenarios where there is no or little risk of harm to patients and the non-compliance is (or at least appears to be) accidental.
In circumstances where non-conformities have been ineffective or slow or where a risk to patient safety or confidentiality has been identified, Regulators will issue Enforcement Notices to prevent further product or sales, force repair or recall and/or seize products.
The ICO for example can issue fines up to £17.5m or 4% of annual turnover, whichever is higher for data protection infringements in the UK or EU. This has led to fines as high as €1.2bn (yes, billion) for Meta in Ireland and £20m for British Airways in the UK. At the start of August, NHS software provider Advanced Computer Software Group was fined £6m for a breach of around 83,000 patient’s personal data.
Criminal Penalties
The most serious consequence related to Regulatory non-compliance is where an individual is considered to have committed an offence and so is personally liable – for example, in the UK, this is governed by the Consumer Protection Act 1987 and individuals face up to six months in prison and/or (since 2015) an unlimited fine for failing to follow prohibition notices, failing to meet essential safety requirements, failing to appropriately label a medical device, failing to provide information to regulators or falsifying information (whether internal quality records, regulatory submissions or marketing claims).
This only happens in the most serious of cases but is an option available to regulators and prosecutors – ultimately, being in a regulated industry means negligent or malicious non-compliance can be punished as a criminal offence. Recent examples include Laura Perryman – Founder and CEO of Stimwave – who was sentenced to 6 years in prison for creating and selling a fake medical device product.
What are the impacts of Regulatory Strategy on Business Strategy?
As we have explained above, a clear regulatory strategy can have a wide-reaching impact and should be seen as a key investment for any new business or a business looking to expand its reach into a new territory. In summary:
Regulatory compliance is complex and costly: Companies new to regulated industries or markets where regulations may be different can often underestimate the time, effort, and financial resources required to meet regulatory and compliance standards. Understanding the financial impact can help founders or management teams make strategic investments in resources to ensure a smooth adoption of regulatory standards.
Regulatory strategy impacts business strategy: Compliance with regulations can significantly impact product development timelines and costs due to testing, approval processes, and fees meaning investment needs to be carefully made with a clear go-to-market strategy for commercial success. .
Strategic product design can reduce regulatory burden: By carefully defining a product’s intended use and target markets, companies can potentially lower regulatory hurdles and accelerate time-to-market.
- Misclassifying products or misunderstanding regulations can have serious consequences: Incorrectly identifying a product as a medical device or failing to register and address legal requirements set out by an information standards regulator like the ICO, can create bottlenecks in both procurement and adoption. It’s essential to understand in each new market what your product or service must be compliant with in order to negotiate customer due diligence.
Understanding and effectively managing regulatory requirements is crucial for business success in regulated industries like healthcare. Whether you’re providing a service or technology, it’s worth being aware of the mandated requirements to do business and appreciate the impact on commercial success. A well-crafted regulatory strategy can significantly impact a company’s bottom line and time-to-market if done strategically with a clear goal in mind
How we can help
Often a Regulatory Strategy can be a daunting task. Fortunately, we are the trusted partner for health software, medical services and medical device companies, helping founders and management teams create a clear and comprehensive Regulatory Strategy and provide support to implement the recommendations.
Working with 8FoldGovernance has been a pleasure. The team are incredibly knowledgeable and easy to work with. They have been pivotal in crafting our route forward to bring clinical impact safely. We would certainly recommend them as partners to your business.
Edmund, CEO of Health Narrator
