Digital health apps and telemedicine in France

1.1 Is it considered a “medical device” or a “product” to which liability can attach, and if so, under what regulations?

(a) A software within digital health apps could be considered a “medical device”. In line with Regulation (EU) 2017/745, the French legal definition of “medical device” includes software with medical purposes under certain conditions (Article L.5211-1 Public Health Code).

The software must have been “intended by the manufacturer to be used, alone or in combination, in humans for one or more of the following medical purposes and whose primary intended action in or on the human body is not achieved by pharmacological or immunological means or by metabolism, but whose function may be assisted by such means:

1. Diagnosis, prevention, control, prediction, prognosis, treatment, or mitigation of a disease;
2. The diagnosis, control, treatment, mitigation or compensation of an injury or disability
3. Investigation, replacement or modification of an anatomical structure or function or a physiological or pathological process or condition
4. Communication of information through in vitro examination of samples from the human body, including organ, blood, and tissue donations.” 

The French health authority doctrine in respect of the qualification of medical device is in line with EU law, i.e., the Medical Devices (“MEDDEV”) guidelines and ECJ case law (in particular, decision in Case C‑329/16 dated 7 December 2017, SNITEM, Philips France v. Premier Ministre & Ministre de la santé). The French Authority considers that, to be qualified as a Medical Device (or an in vitro diagnostic device (“IVD”)), the software must present the following criteria:

• it must be intended for medical purposes, for example, a diagnosis, an aid to diagnosis, a treatment or an aid to treatment;
• provide a specific result for the benefit of a single patient
• the patient-specific data should be processed in order to provide new medical information.

(b) We are not aware of any specific liability exclusions/exemptions applicable to digital health apps considered as “medical device”. General liability principle would apply. A digital health device can then be regarded as a product from a liability perspective.

Yes. Digital health software should also comply with the following:

(a) Data protection rules, i.e., The French Data Protection Act, Law n° 78-17 dated 6 January 1978 and GDPR.

(b) Pursuant to article L.1111-8 Public Health Code, any person hosting personal health data collected in the course of prevention, diagnosis, care or social and medico-social aftercare on behalf of the patient or the healthcare professionals must be a certified health data hosting service provider (Hébergeur de Données de Santé or “HDS”).

(c) According to the same article, any act of transferring identifying health data for consideration, directly or indirectly, including with the consent of the person concerned, is prohibited under penalty (Article 226-21 of the Criminal Code). 

3.1 The users are residents using it within their jurisdiction and/or using it outside their jurisdiction.

There is no specific restriction as to the localisation of the user when using the app to the extent that the user cannot be qualified as a data controller or data processor under the GDPR. Should it be the case, there might be a risk that the using of the app in a territory outside of the EEA would imply a transfer of data within the meaning of the GDPR, and therefore would require adequate protection in line with the GDPR requirements (art. 44 and seq.).

3.2 It is a “B2B” (business to business) rather than “B2C” (business to end consumer) service.

There are no specific implications from a data protection standpoint regarding health data aspects whether the app is used in a B2B rather than B2C service. However, the use of a health app in a B2B context may raise specific issues where the users are not the data subjects. In such a case, it must be ensured in particular that: (i) there is a data processing agreement and adequate protection for any transfer of data outside the EU as specified above, (ii) the processing of health related data is duly authorised with regards to the requirements of article 9 of the GDPR and that consents of data subjects have been duly collected where required, and that (iii) sufficient information compliant with data protection law is delivered to data subjects.

Besides health-related data specific regulation in France:

1. guidelines from the French HAS (Haute Autorité de Santé) dated Oct. 2016 recommend obtaining the data subject’s explicit consent prior to using location tracking functionalities via his/her device or any other specific functionality or content of his/her device;
2. French data protection law provides for a strict regulation regarding the processing of social security numbers. In the context of telemedicine, processing of social security numbers is allowed for invoicing purposes and to the extent necessary to the coverage of telemedicine acts related expenses, subject to certain conditions;

Moreover, if the processing of health-related data is implemented in the context of a research in the health sector, it might require a prior regulatory approval from the French supervisory authority (CNIL) and the filing of certain formalities before the CNIL.

In a broader manner, the French CNIL underlines the high security levels which must be applied in the context of telemedicine apps. In particular, the following measures must be implemented:

1. a solution of strong authentication combining at least 2 factors (including the use of the health professional chip card for health professionals);
2. each user must be granted a unique login;
3. organisational measures and in particular authorisation management with distinct levels of access authorisation;
4. logging measures with periodic review; and
5. secured emails with encrypted attachments where medical reports are communicated.

According to art. L1142-1 Public Health Code, physicians or healthcare establishments are liable for the “harmful consequences of acts of prevention, diagnosis or care only in the event of fault”, except in the case where they are liable for a defect in a health product such as medical device based on digital health apps.

However, in this case, it is the manufacturer of the defective product who is, by principle, liable under French civil law – i.e., the producer of the software implemented in a digital health app (art.1245 French Civil Code). According to caselaw 1 Civ. 1re, 26 févr. 2020, n° 18-26.256. , it is only when the producer could not be identified that the physician might be found liable.

Besides, if the producer is also responsible for the personal data treatment/hosting, it can also be responsible in this respect.

French authorities are responsible for the compliance to applicable regulations. CNIL is responsible for data protection matters and Agence Nationale de Sécurité du Médicament et des Produits de Santé (“ANSM”) for compliance with medical devices regulation.  Breaches of ethical rules by a physician fall under the Board of physician’s authority.

Competitors can either report a breach to the relevant authorities or bring a claim for unfair competition against the non-compliant company.

Legal consequences for non-compliance will vary depending on the type of breach and on the gravity/repetition of such breaches. Non-compliance to the above-mentioned legal provisions are subject to civil and criminal sanctions.

 No, but telemedicine regulation is a fast-changing sector.

Three conditions are necessary to practice medicine in France (Article L.4111-1 of the French Public Health Code):

1. Diplomas: at a minimum, a French state diploma of doctor of medicine;
2. Nationality, as the case may be;
3. Registration on the register of the Order of Physicians.

The French National Order of Doctors (Conseil national de l’Ordre des médecins, “CNOM”) is the regulator as far as disciplinary breaches are concerned.

From a broader point of view, the French healthcare system is administered at national and regional level by the State, which finances and organises health services:

1. At National level: The Minister in charge of health and solidarity and national agencies such as the French National Authority for Health (Haute Autorité de Santé, “HAS”) or the French national agency for medicines and health products safety (ANSM); and
2. At the regional level: Regional Health Agencies (Agence Regionale de Santé, “ARS”) coordinate prevention and health care.

The French Public Health Code includes all regulations related to patient and professional rights and obligations with respect to medical goods and health services.

The National Union of Health Professionals (Union Nationale des Professionnels de Santé) brings together healthcare professionals in private practice in France and aims to put forward proposals relating to the French health care system organisation.

Telemedicine has been permitted in France for more than 20 years. Telemedicine was introduced in the French Public Health Code (Articles L. 6316‑1 and R. 6316‑1), by the law reforming hospitals of July 21, 2009 and its implementing decree (Decree no 2010‑1229, October 19, 2010). Acts of telemedicine are the following:

• Tele-consultation, whose purpose is to allow remote consultation between a health professional and a patient;
• Tele-expertise, whose purpose is to allow a health professional to consult with other health professionals;
• Tele-surveillance, whose purpose is to enable a medical professional to remotely interpret the data necessary for the medical follow-up of a patient and, if necessary, make decisions regarding the management of the patient; and
• Tele-assistance, which allows a medical professional to remotely assist another health professional carrying out a medical act.

Furthermore, tele-healthcare has also been implemented into the French Public Health code and presents in the form of remote healthcare using information technologies, which connects a patient with one or more pharmacists or medical assistants (art. L.6316-2 of the French Public Health Code).

Yes, French law regulates under what circumstances physicians can use telemedicine. The requirements are the following:

1. Firstly, restrictions applicable to any medical practice must be complied with (conditions of practice, rules of ethics and standards of clinical practice).
2. However, there is no restriction regarding the health professional providing the medical act, as long as they are allowed to practice medicine in France. Any health professional may use tele-consultation, whatever the field of specialty, location and sector of practice (sector 1 or 2), and whether exercising in hospital or private practice. Health institutions may also bill tele-consultations under the same conditions as face-to-face consultations.
3. The French National Health Authority (Haute Autorité de Santé, the “HAS”) has published guidelines to facilitate the implementation of telemedicine by health professionals (in French):

• a memo for professionals (Fiche Mémo Téléconsultation et téléexpertise - Mise en oeuvre);
• a good practices guide (Qualité et sécurité des actes de téléconsultation et de téléexpertise).

The conditions for the implementation of telemedicine are specified in articles R. 6316-2 et seq. of the French Public Health Code:

1. telemedicine must be carried out with the free and informed consent of the patient (in application of the requirements set forth by articles L. 1111-2 and L. 1111-4 of the French Public Health Code);
2. professionals providing care via telemedicine (a “telemedicine act”) may, unless the duly informed patient objects, exchange information relating to that patient, in particular by means of information and communication technologies;
3. when providing care through telemedicine, it must be carried out under conditions that guarantee the following (article R.6316-3 of the French Public Health Code):
   1. the authentication of the health professionals involved in the act;
   2. patient identification;
   3. access by health professionals to the patient's medical data necessary for the performance of the procedure; and
   4. if the situation requires it, training or instruction of the patient in preparation of using the telemedicine device.
4. care provided via telemedicine/the telemedicine act must be recorded in the patient’s record kept by each health professional involved in the care and in the observation sheet (art. R. 6313-4 of the French Public Health Code):
   1. the report on the performance of the act carried out, and, if applicable, the series of activities, tele-healthcare;
   2. the acts carried out and drug prescriptions made during the provision of care via telemedicine or tele-healthcare;
   3. the identity of the health professionals involved in the act;
   4. the date and time of the act, and
   5. where applicable, technical incidents that occurred during the act.
5. Organizations and private health professionals who organize a telemedicine or tele-healthcare activity ensure that the health professionals and psychologists participating have the training and technical skills required to use the corresponding devices (art. R. R6316-5 of the French Public Health Code).

Several measures were introduced during the pandemic crisis:

1. Various measures were introduced to facilitate and encourage the use of telemedicine during the COVID-19 pandemic. The Ministry of Solidarity and Health has published a summary table of professions authorised to practise at a distance as part of covid-19 crisis management (here, in French). Those measures have been explained by the HAS in an FAQ (in French).
2. Flexibilities regarding the tools used to operate were introduced. As an exception to the obligation, to use tools complying with rules regarding hosting of health data, and to the general policy on the security of health information systems (PGS-SIS), healthcare professionals may use “mainstream” digital tools/communication applications when managing patients with symptoms of infection or known covid-19 sufferers until October 30, 2020 (Order of July 10, 2020, art. 17). In any event, compliance with the GDPR is still required for any type of tools.
3. The reimbursement system has been extended. Acts performed/care provided via tele-consultation, care accompanying the tele-consultation, as well as tele-healthcare itself are 100% reimbursed by the health insurance until December 31, 2020 at the latest (Ordinance n°2020-737 of June 17, 2020, art. 5). This measure has been extended until 31 July 2022 (Law of Social Security Financing Act for 2022, December 23, 2021). In addition, tele-consultation is reimbursed even if the act was performed/care provided outside the “care pathway” (“parcours de soins”, which was a condition before the pandemic, see question 13 below). Reimbursement at 100% is also granted for tele-consultation with nurses, speech therapists and midwives.

There is a specific consent process applicable to telemedicine.

11.1 Are there legal requirements for physicians to give disclaimers or other types of notices to patients (as part of the consent process) before using telemedicine? If so, please indicate these.

Telemedicine must be carried out with the free and informed consent of the person (in application of Articles L. 1111-2 and L. 1111-4 of the Public Health Code which are applicable to any medical act).

11.2 Does the use of telemedicine increase the risk of liability (e.g., if a physician is asked to certify someone’s fitness to engage in a particular employment and does so virtually versus an in-person consultation)?

The specific requirement for telemedicine is that the consent is duplicated.

• Consent to the consultation: the patient must first consent to the establishment of a remote medical relationship with a designated health professional.
• If applicable, consent to the medical acts in the context of telemedicine.

There is no specific provision regarding liability with regards to telemedicine. The liability regime for physicians is the same as that for face-to-face consultations or medical acts.

Yes. 

The following types of telemedicine acts can be provided: 

• Tele-consultation, 
• tele expertise,
• tele surveillance, and
• tele-assistance.    

Among the types of medical acts that can be provided via telemedicine (see question 1), restrictions apply depending on the type of act. In addition, depending on the type of telemedicine service, specific restrictions apply.

• Tele-consultation and tele-expertise

Tele-consultation must be carried out by video-transmission and under conditions of equipment, support and organisation adapted to the clinical situations of the patients in order to guarantee a quality consultation (according to the Article 28.6.1.3 (for tele-consultation) and 26.6.2.3 (for tele-expertise) of the National Convention organising the relationship between private practitioners and the Assurance Maladie (the French national health insurance fund) signed on August 25, 2016). Patients who do not have Internet access or who are not comfortable with these technologies can be assisted by another equipped health professional or can go to a tele-consultation booth.

In addition, tele-consultation and tele-expertise must be carried out:

• in places that allow for the confidentiality of exchanges between the patient and the health professional, and between health professionals. For the purpose of exchanges between professionals, secure mail services must be used; and
• in conditions that guarantee the security of the data transmitted (confidentiality, protection of personal data, etc.) and the traceability of billing for procedures carried out, under conditions that comply with security and interoperability standards for data transmission and exchanges.

Video communication tools existing on the market (such as Skype, FaceTime, etc...) “appear to be sufficiently secure for video exchange with the patient when the patient is known,” according to the Assurance Maladie.  However, they do not meet sufficient security conditions for the exchange of medical documents (photos, etc.) that would complement tele-consultation. As a result, they do not offer health professionals a complete solution for the entire process required for telemedicine.

In all cases, telemedicine must comply with the interoperability and security standards drawn up by the French healthcare information systems agency, the ASIP Santé (Article L1470-5 of the French Public Health Code).

• Tele-surveillance

Tele-surveillance falls within an experimental framework and has been introduced in the common law by the Law of Social Security Financing Act for 2022, December 23, 2021 (art. 36). A declaration of telemedicine activity is still required by health professionals and by providers of technical solutions.

Health professionals shall send such declaration to the Regional Health Agency (Agence Régionale de Santé, “ARS”) of their place of practice, and doctors shall send it to the Departmental Council of the Order (Conseil Départemental de l'Ordre, “CDOM”). 

For providers of technical solutions for telemonitoring, a declaration of activity must also be sent to the ARS of their place of practice, as well as a certificate of honour to comply with the provisions of the specifications relating to the pathology concerned and the regulations in force governing telemedicine. In addition, in the case of a medical device, they must send a CE-marking certificate to the General Directorate for Healthcare Services (“DGOS,” Direction Générale de l'Offre de Soins).
Providers of technical solutions are responsible for:

• its installation according to the agreement with the health professional;
• its maintenance in perfect working order; and
• its recovery at the end of the remote monitoring and the elimination of any waste.

The healthcare professional must have been trained in the use of the equipment and the remote monitoring solutions. The patient must be trained in the operation of the technical solution.

Yes. Tele-consultation and tele-expertise are reimbursed by the Assurance Maladie under the same conditions as any face-to-face consultation since 2018. 

Before the pandemic, to be eligible to coverage by the Assurance Maladie, the tele-consultation must be part of the “care pathway” (“parcours de soins”). Therefore, the patient must go through his registered General Practitioner (who may carry out the tele-consultation him/herself or refer the patient to a specialist who will carry out the remote consultation). The patient must be known by the health professional: the patient must have had at least one face-to-face consultation with the professional in the previous 12 months before any tele-consultation. If such conditions are not met, tele-consultation remains possible but will not be reimbursed.

By way of exception, tele-consultation may be reimbursed even if the above conditions are not met: patients under 16 years of age, or in case of direct access to some specialties (gynecology, ophthalmology, stomatology, oral or maxillofacial surgery, psychiatry or neuropsychiatry and paediatrics). For patients who do not have a registered General Practitioner, or whose registered General Practitioner is not available in a time-frame compatible with their state of health, a tele-consultation where the patient is not previously known by the professional is also reimbursed. 

For tele-expertise, coverage is implemented only for long-term illness, rare diseases (as defined by French regulations), patients living in under-dense areas, patients residing in institutions for dependent elderly persons or medical structures and persons detained. 

13.1 If so, are there any special provisions about the reimbursement/coverage of costs regarding the use of mobile apps that can combine digital health and telemedicine? 

Yes. Tele-consultation and tele-expertise are reimbursed by the Assurance Maladie under the same conditions as any face-to-face consultation since 2018.

Before the pandemic, to be eligible to coverage by the Assurance Maladie, the tele-consultation must be part of the “care pathway” (“parcours de soins”). Therefore, the patient must go through his registered General Practitioner (who may carry out the tele-consultation him/herself or refer the patient to a specialist who will carry out the remote consultation). The patient must be known by the health professional: the patient must have had at least one face-to-face consultation with the professional in the previous 12 months before any tele-consultation. If such conditions are not met, tele-consultation remains possible but will not be reimbursed.

By way of exception, tele-consultation may be reimbursed even if the above conditions are not met: patients under 16 years of age, or in case of direct access to some specialties (gynaecology, ophthalmology, stomatology, oral or maxillofacial surgery, psychiatry or neuropsychiatry and paediatrics). For patients who do not have a registered General Practitioner, or whose registered General Practitioner is not available in a time-frame compatible with their state of health, a tele-consultation where the patient is not previously known by the professional is also reimbursed.
With the pandemic, the Health Insurance branch of the Social Security covered 100% of medical teleconsultations and it was no longer compulsory to carry out a tele-consultation with the attending physician and/or without having had a physical appointment with him/her during the last 12 months for suspected cases of Coronavirus (Decree No. 2020-227 of 9 March 2020).

The Decree No. 2021-13 of 8 January 2021 extends its derogation to patients who do not have access to a high-speed or very high-speed Internet connection and within the limit of one teleconsultation per professional per month for the same patient. It also applies, within the same limit, to patients who have such access but who do not have a terminal allowing video transmission in one of the following situations:

• Patient with symptoms of infection or recognized as having covid-19 ;
• Patient over 70 years of age;
• patient recognized as suffering from a serious condition mentioned in 3° of article L. 160-14 of the social security code; and
• a pregnant patient.

Concerning tele-surveillance, the reimbursement by the health insurance scheme has been integrated into common law by the Law of Social Security Financing Act for 2022, December 23, 2021for 2022 (Art. L. 162-48 of the Social Security Code). This concerns interventions combining:

• "1° On the one hand, medical monitoring with the aim of analyzing data and alerts transmitted by means of one of the digital medical devices mentioned in 2°, all the actions necessary for its implementation, the parameterization of the device, the training of the patient in order to use it, the verification and filtering of alerts as well as, if necessary, complementary activities, in particular therapeutic accompaniment activities; and
• 2° On the other hand, the use of digital medical devices whose function is to collect, analyze and transmit physiological, clinical or psychological data and to issue alerts when some of these data exceed predefined thresholds and, where appropriate, associated collection accessories, when they are neither implantable nor invasive and when they are without therapeutic purpose.”

The reimbursement is subject to certain conditions, such as prior registration (Art. L162-52 of the Social Security Code), the quality of medical professional of the tele-surveillance operator (Art. L. 162-50 of the Social Security Code), a prior declaration to the regional health agency (“ARS”) (Art. L. 162-51 of the Social Security Code), or, if applicable, the holding of a certificate of compliance with the interoperability and security reference systems (Art. L162-52 of the Social Security Code).  The Decree No. 2022-1767 of December 30, 2022 specifically concerns the coverage and reimbursement of tele-surveillance activities, while Decree No. 2022-1769 of December 30, 2022, defines the content of the declaration of tele-surveillance activities to the ARS.

Concerning tele-expertise, coverage is implemented only for long-term illness, rare diseases (as defined by French regulations), patients living in under-dense areas, patients residing in institutions for dependent elderly persons or medical structures and persons detained.

(a) For specific provisions regarding reimbursement of costs regarding the use of mobile apps that can combine digital health and telemedicine, please refer to the paragraph above on the reimbursement by the health insurance scheme.

(b) N/A

In any event, physicians and health professionals shall comply with applicable data protection regulations. There is no specific data protection rules applicable to telemedicine.

The French Data protection authority, the CNIL, published guidelines (accessible here in French) about telemedicine and data protection. The CNIL reminds that when the processing resulting from telemedicine is likely to imply a high risk for rights and freedoms of the persons, the data controller shall carry out an impact assessment of the contemplated processing operations.

In general, processing of personal data in the context of telemedicine should not oblige the data controller to perform any formalities. However, depending on the nature of the processing, a prior authorisation might be necessary, if the processing is performed in the context of research.

In particular, security measures are essential (authentication, authorisation management, traceability and incident management, etc.) and the data subjects must be able to effectively exercise their rights, in particular their rights of access, rectification and opposition.

Finally, the health professional must ensure that the service provider complies with the regulations, as the data processor. The data processing agreement must clearly state that the subcontractor:

• processes personal data only on your instructions;
• ensures that confidentiality undertakings are signed by the staff
• takes all required security measures;
• does not hire a data processor without the prior written consent of the data controller;
• cooperates with the data controller to fulfil its obligations, especially when patients have inquiries about their data;
• deletes or returns all personal data to the data controller at the end of the services; and
• Cooperate in audits.

As previously stated in the Digital Health Apps/Software section, or health data, the platform must be hosted by an approved or certified health data host.

No, but telemedicine regulation is a fast-changing sector.