Digital health apps and telemedicine in Italy

1.1 Is it considered a “medical device” or a “product” to which liability can attach, and if so, under what

The software used within digital health apps can be classified either as medical devices within the meaning of the Legislative Decree no. 46/1997, which has implemented Directive 93/42/EEC, or as simple consumer product to which the regulations on general product safety apply.

In light of Legislative Decree no. 46/1997 medical device means any instrument, device, implant, substance or other product, used alone or in combination, including information software used for correct operation and intended by the manufacturer to be used in humans for the purpose of diagnosis, prevention, control, therapy or mitigation of a disease, diagnosis, control, therapy, mitigation or compensation of an injury or handicap; study, replacement or modification of the anatomy or physiological process.

Basically, the software is classified as a medical device if it has at least one feature involving the use of patient-specific data to support the physician in prescribing or calculating treatment dosage.

Therefore, the decisive factor is whether the software was intended by the manufacturer to be used for one or more medical purposes.

In order to qualify the software as a medical device or not, it is also possible to rely on the indications of the “Manual on borderline and classification in the Community regulatory framework for medical devices.”

1.2 If your response to Q1.1 is yes, please state whether there are any exclusions/exemptions applicable with regard to liability, and/or whether those are applicable only under certain circumstances (e.g., for in-hospital use)?

The exclusions from liability for damages caused to patients by the product (i.e., the software) are listed in the Italian Consumer Code. In particular, with reference to liability for product damage, the same is excluded:

• if the manufacturer has not put the product into the market;
• if the defect that caused the damage did not exist when the manufacturer put the product into the market;
• if the producer did not manufacture the product for sale or for any other form of distribution for consideration, nor did they manufacture or distribute it in the exercise of their professional activity;
• if the defect is due to the conformity of the product with an imperative legal provision or a binding measure;
• if the status of scientific and technical knowledge, at the time the manufacturer put the product into service, did not yet allow the product to be considered as defective;
• in the case of the manufacturer or supplier of a component part or raw material, if the defect is entirely due to the design of the product into which the part or raw material has been incorporated or to its conformity with the instructions given by the manufacturer who used it.

It should be noted, however, that although the definition of defective medical device provided in the new Medical Device Regulation (“MDR”) is based on the notion of defective product set forth in Directive 85/374/EEC and the Italian Consumer Code, it is partially different: “defect” in such case is any deficiency in the identity, quality, durability, reliability, safety or performance of a device, including malfunction, errors in use or inadequacy of the information provided by the manufacturer. The reference to the lack of performance of the device is undoubtedly noteworthy since, according to the MDR, “clinical performance” means the ability of a device to achieve the intended use declared by the manufacturer, thus providing a clinical benefit to patients.

The new concept of defective medical device therefore goes beyond the boundaries drawn by the Consumer Code, for which the concept of defect is closely related to the concept of safety (a product is defective when it does not offer the safety that can legitimately be expected, taking into account all the circumstances) and does not correspond to the definition of “defect,” which is identified in an imperfection of the good and may also not lead to a lack of product safety.

As mentioned above, the MDR is not yet applicable, therefore it is arguable that even the definition of “defective device” provided for therein cannot be used in any possible litigation arising from damage caused by devices; it is not excluded, however, that the case law might (de facto) adopt the stricter concept of “defect” of device provided for in the MDR, thus widening the notion of “safety” of the product in order to benefit possible injured parties.

The Italian Data Protection Authority, by means of measure no. 55 of 7 March 2019, has provided for some clarification on the application of the data protection regulation on digital health software. 

By means of said guidelines, in fact, it has been specified that the exceptions to the general prohibition of processing the so-called “special categories of data,” including those on health, on the basis of which the processing of such data is allowed, are now to be identified in Article 9 of the GDPR which lists a series of exceptions that legitimize the processing and which, in the health sector, are generally attributable to the processing necessary for:

1. reasons of public interest relevant on the basis of Union or Member State law;
2. reasons of public interest in the field of public health;
3. purposes of preventive medicine, diagnosis, health or social care or treatment or management of health or social systems and services on the basis of Union law/Member States or in accordance with a contract with a health professional, carried out by (or under the responsibility of) a health professional subject to professional confidentiality or by another person also subject to the confidentiality obligation.   

In addition, with reference to processing in the health sector that does not fall within the hypotheses described above and, therefore, which require the explicit consent of the data subject, the Data Protection Authority has identified, by way of example, processing relating to the use of medical apps, through which independent data controllers collect data, including health data of the data subject, for purposes other than telemedicine or when, regardless of the purpose of the app, subjects other than health professionals or other subjects bound to professional confidentiality may have access to the data of the data subject.

In this case, the obtaining of consent, as a condition of lawfulness of the processing, is mandatory as required by art. 75 of the Italian Privacy Code. 

Therefore, the minimum requirements provided by the general principles underlying GDPR must be adopted by device manufacturers and developers of e-health apps. It is always necessary that the interested parties provide their free, specific, informed, unequivocal and explicit consent.

No specific provisions have been provided for the case in which the use takes place outside of Italy, or the product is used in a B2B or B2C business.

Particular features, such as location, tracking, or monitoring real-time information do require the user’s consent in all cases where such information is not provided in the context of telemedicine or when, regardless of the purpose of the application, subjects other than health professionals or other subjects bound to professional confidentiality may have access to the data of the data subject.

In the context of physicians relying on digital health apps a distinction should be made between:

1. damages caused by incorrect use of the software by the physician, or otherwise resulting from incorrect medical advice in circumstances where the software does not present anomalies;
2. damages caused by incorrect installation, operation or maintenance of the software;
3. damages caused by software malfunction.  

In the cases referred to in point a), it is reasonable to state that the responsibility will be borne by the physician only. 

In the cases referred to in point b), the responsibility could be either of the manufacturer, if it has not provided sufficient information for the implementation of the new system, or of the health care facility where the doctor operates if it has not properly maintained or installed the software. 

In the cases referred to in point c), the responsibility will presumably be borne by the software manufacturer only. 
In each scenario, however, a case-by-case assessment will be required.

Should the software included in the digital health app be considered a medical device as it is used to monitor physiological processes or otherwise collect and provide information and assume diagnostic or therapeutic decisions, it is likely that it falls within class IIA or IIB of medical devices that require CE marking through the involvement of the so called “Notified Body.” Should it not fall, for any reason, within classes IIA or IIB, it would probably fall within the definition of class I of medical devices which would still require CE marking but without involvement of the CE marking process by the “Notified Body.”
In addition, all medical devices, irrespective of their class, shall be notified to the Ministry of Heath for registration before they are launched on the market.

Failure to comply with the above-mentioned rules could result in both criminal and pecuniary sanctions up to €128,400.

As far as the Data Protection regulation is concerned, it is necessary to point out that, beyond the cases in which the app is used for telemedicine purposes, the consent of the person concerned to the processing of his/her health data is necessary. 

The consent must be given even before the actual installation of the medical app on one's own device and, with the same easiness, all the other rights granted to the user by GDPR (right of revocation, oblivion, etc.) must be properly granted.

Consent must be given for every purpose specified in the information notice with simple and clear language, in a transparent form and easily accessible by users and patients.

The Italian Data Protection Authority has stated that it is also appropriate for the data controller to establish (“Privacy by design and privacy by default”), all the appropriate technical and organizational measures to ensure that only personal data necessary for each specific purpose of processing are processed by default. This obligation applies to the amount of personal data collected, the scope of processing, the retention period and accessibility. In particular, such measures ensure that, by default, personal data is not made accessible to an undefined number of persons.

In addition, with regard to storage methods, duration and security measures adopted, the developer and/or producer of e-Health apps must provide, always within the information notice all the necessary information also in accordance with the Privacy Code of Conduct on Mobile Health APPs and articles 32 and 35 of the GDPR.

In the event of violations of data protection obligations, significant fines may be imposed on operators. The sanctions, depending on the violation, can be up to 10 or 20 million Euros or up to 2% or 4% of the annual worldwide turnover of the previous year, whichever is higher. 

The legal framework applicable to digital apps/software will be partially affected by the application of the new EU Regulation 2017/745 (“MDR”). 

The MDR expressly states that “software… intended by the manufacturer to be used, alone or in combination, for human beings for one or more of the following specific medical purposes: diagnosis, prevention, monitoring, prediction, prognosis…” is a medical device.

In addition, pursuant to Whereas no. 19 of the same EU Regulation, “software…, when specifically intended by the manufacturer to be used for one or more of the medical purposes set out in the definition of a medical device, qualifies as a medical device, while software for general purposes, even when used in a healthcare setting, or software intended for life-style and well-being purposes is not a medical device”. 

The MDR therefore provides a precise definition of when the software should be considered a medical device. 

Finally, it is worth remembering that the Italian Government has not yet issued the law reforming the penalty system with reference to medical devices, adapting it to the provisions of the new MDR.

The practice of health care professions is subject to the reaching the age of eighteen and the obtaining of a university degree issued following the final qualification exam for the profession. This university degree is valid throughout the national territory in compliance with European legislation on the free movement of professions and is issued following a training course to be carried out in whole or in part at the companies and facilities of the National Health System, including institutions of hospitalisation and care of a scientific nature, identified by the regions, on the basis of special protocols of understanding between them and universities.

In compliance with article 32 of the Italian Constitution, to practise as a medical professional, it is necessary to be enrolled in the corresponding Professional Association. 

The Professional Associations are independent in terms of assets, financial, regulation and discipline. They are subject to the supervision of the Ministry of Health. In addition, the Associations are financed exclusively with the contributions of the members, without charges for public finance.

The Professional Associations supervise the practice of the medical profession. In particular, they verify the qualifications required for professional practice and maintain and publish the registers of professionals, held by the Associations themselves.

In addition, the Professional Associations supervise their members, in whatever legal form they carry out their professional activity, imposing disciplinary sanctions in case of violation of their obligations imposed by law or deontological rules. 

Although there is not yet a specific law concerning telemedicine, the most important reference is the document "National Guidelines for the provision of telemedicine services" approved following an agreement between the Government and the Regions on 17 December 2020. The Guidelines should represent the national unitary reference for the implementation of telemedicine services and the use of such systems within the National Health Service.

According to the Guidelines, Telemedicine services can be divided into four categories:

• Services that can be assimilated to any other traditional diagnostic and/or therapeutic healthcare service, representing an alternative to it;
• Services which, since they cannot replace the traditional healthcare service, support it by making it more accessible and/or increasing its efficiency.
• Services which complement traditional services by making them more effective in meeting patients' needs;
• Services which can completely replace traditional healthcare services.

In the context of telemedicine, the Guidelines identify the following services, which should be traced back to the same regime under which they are provided also in the presence of the patient.

• Televisiting: this is a medical act in which the professional interacts at a distance in real time with the patient, also with the support of a care-giver. Televisiting is, however, limited to the monitoring of patients whose diagnosis has already been made during an in-person visit. This means that services that do not require palpation, percussion or auscultation can be provided in this way.
• Teleconsultation: this is a medical act in which the professional interacts at a distance with one or more doctors to discuss, also by means of a video call, the clinical situation of a patient, based primarily on the sharing of all the clinical data, reports, images, audio-video regarding the specific case.
• Teleconsulting: this is a health activity, not necessarily medical but in any case, specific to the health professions, which takes place at a distance and is performed by two or more persons who have different responsibilities with respect to the specific case. It consists in the performance of clinical activities, followed by a video call in which the requested health professional provides the other with indications for the correct performance of care services for the patient.
• Telecare by health professions (nurse/physiotherapist/logopedist/etc): this is a professional act  based on remote interaction between the healthcare professional and the patient by means of a video call, to which data, reports or images may be shared if necessary. The telecare professional can also use suitable apps to administer questionnaires, share images or video tutorials on specific activities.
• Telereferral: is a report issued by the doctor who has examined the patient, whose report is transmitted by means of digital and telecommunication systems.

For all healthcare services provided at a distance, the national/regional regulatory framework regulating access to the same services in traditional form applies.

10.1 What are the requirements?

Telemedicine is not a separate medical discipline, but a different way of providing health services. Therefore, provided that the service complies with the general requirements identified by the Guidelines on Telemedicine in terms of access to the service, technology, professionalism, adequate organisation and compliance with good clinical practice for the pathology treated, it is suitable to be used each area identified by the Italian Regions through specific programmes.

In order to perform Telemedicine activities, the facilities/physicians involved, must:

• be licensed by the Region for the specific discipline (cardiology, diagnostic imaging, ophthalmology, clinical diagnostics, etc.) for which they intend to use individual services of Telemedicine and/or clinical care programs integrated with the activities of Telemedicine;
• comply with the service standards for Telemedicine  defined by the Region, if any;
• stipulate, if necessary, specific contractual agreement(s) with the Regions/Local Health Facilities for Telemedicine services;
• appoint a director/manager to ensure that the appropriate performance standards are met for activities provided through Telemedicine;
• adopt cybersecurity management systems;
• adopt a risk assessment plan, appropriate to the kind of services provided.

10.2 Were there any new (time-limited) regulation regarding the Sars-CoV-2 pandemic?

The Italian High Institute of Health (“ISS”) has published a document containing “Indications for telemedicine care services during the COVID-19 emergency,” which provides support for the provision of services in Telemedicine during the COVID-19 emergency, thus providing indications, identifying operational problems and proposing solutions supported by evidence, which are easily feasible in practice.

The document does not provide specific measures aimed at simplifying Telemedicine’s use but mainly aims at encouraging healthcare professionals to use distance-health tools.

According to the above mentioned document, where telemedicine is not yet structured in a system of a national relevance, in consideration of the health emergency situation, it is necessary first of all to implement and make available those solutions that can be activated quickly, within a few days, which are usable by people at home with the technological equipment immediately available to them and that can be activated for periods of time appropriate to the needs of the emergency situation.

The document also identifies the reference principles which it is advisable that healthcare professionals focus on:

• preconditions for making telemedicine services possible (e.g., connectivity, entirely digital prescriptions, cybersecurity);
• health responsibility during the performance of telemedicine activities;
• elements necessary to carry out the services at home;
• functioning of health-related video calls;
• activation steps of the telemedicine service.

11.1 Are there legal requirements for physicians to give disclaimers or other types of notices to patients (as part of the consent process) before using telemedicine? If so, please indicate these.

The performance of health services through telemedicine, requires the adoption of a number of additional safeguards by healthcare professionals. 

In particular, physicians must adequately inform the patient the service in Telemedicine will be provided through Telemedicine. To this purpose, the patient must receive appropriate information on the opportunity and scope of the service, as well as on the means used and the methods of storage and processing of his/her data.

11.2 Does the use of telemedicine increase the risk of liability (e.g., if a physician is asked to certify someone’s fitness to engage in a particular employment and does so virtually versus an in-person consultation)?

The use of telemedicine systems requires a different approach to the physician's liability in the case of incorrect medical assessment.

In such a scenario, some factors that influence liability may be detected, such as defects in the construction of the devices used, incorrect installation of the device, ineffective maintenance, incorrect use of the devices, including incorrect transmission/evaluation of the data. 

Such circumstances may lead to a diagnostic error caused by the alteration of the transmitted data or by device’s failure/malfunction. 

In the context of a diagnostic error, it must therefore be assessed whether it is due to a technical deficiency that would exclude the physician's responsibility. 

From a general point of view, the physician will instead be responsible for his/her culpable error due to the wrong interpretation of the data.

The Guidelines on Telemedicine do not impose particular limits with regard to the medicines that can be prescribed. However, it should be noted that e-prescription is a tool already regulated regardless of the use of telemedicine systems. 

The e-prescription, regulated by the Interministerial Decree of 2 November 2011, is now a widely used tool for access to pharmaceutical services of the National Health Service.

The spread of dematerialized prescription has reached a very high level of coverage. The Ministry of Health has declared that almost 90% of pharmaceutical prescriptions are electronic prescriptions. 

However, not all prescriptions allowing access to the services of the National Health System have been, shifted to electronic prescriptions. Therefore, a working group is active between the Ministry and the Regions to extend the prescriptions that are still in paper format. Such prescriptions concern:

• therapeutic plans,
• drugs in direct distribution,
• thermal performance,
• prescriptions for supplementary care and prosthetic assistance; and
• prescription of drugs containing narcotics, with indications other than pain therapy. 

In addition, a working group at the Ministry of Health is actively dealing with the dematerialization of vouchers for the provision of gluten-free products for coeliac disease patients, vouchers that will be spendable anywhere in Italy, even outside the Region where the patient resides.

With regard to the e prescription system, it is stipulated that following the prescription, the physician must release to the patient:

• the Electronic Prescription Number
• the paper memo of the recipe.   

The paper memo is issued to guarantee the provision of the service even in case of unavailability of computer systems. However, the Interministerial Decree of 25 March 2020 initiated a process to digitise the memo and thus making the prescription completely digital.

The services provided by the Italian National Health System (“NHS”), whether through public or accredited private facilities, are only those identified in the LEAs (Essential Levels of Care), defined by the Prime Minister Decree of 12 January 2017; therefore, if a citizen wishes to benefit from a healthcare service which is not included in the LEAs, the cost would be entirely at his or her own expenses whether the healthcare service was provided in a public or accredited private facility. Therefore, a telemedicine service can be reimbursed by the NHS provided that the concerned healthcare service is included in the LEAs.

The Guidelines on Telemedicine state that the use of ICT technologies can allow the provision of services that fall into the following two categories:

1. services already provided by national and regional tariffs, but which are provided, thanks to the use of technology, in Telemedicine and which, in any case, maintain the substantial content unchanged;
2. services already provided by national and regional tariffs, but which, thanks to the use of technology, are performed in ways (in particular in relation to the place, time and duration of observation) that can improve the diagnostic and therapeutic content and strengthen the continuous monitoring.

With reference to Telemedicine activities referred to in a) above, such services should refer to the corresponding description and tariff, assessing in each case - with specific and analytical reference to the use of technology (hardware, software and connectivity) – whether the use of Telemedicine represents an added value for the purpose of changing the tariffs.

With reference to Telemedicine activities referred to in b) above, reference shall always be to the tariff already in force, but the description and value will necessarily be modified in relation to the different content of the service.

The Guidelines on Telemedicine do not provide special provisions about the reimbursement/coverage of costs regarding the use of mobile apps that can combine digital health and telemedicine.

For what concerns the protection of the users’ personal data, the relevant provision of the EU Regulation 2016/679 (GDPR), together with the Italian data protection law on the processing of health data, would apply. In this regard, the Italian Data Protection Authority has issued a decision in which it has clarified that the processing of personal data for telemedicine purposes (i.e., where the data is strictly related and necessary for the provision of the healthcare service by the professional) does not require the user’s consent.

The Ministry of Health has launched a monitoring system for the various telemedicine programs that have been activated at the regional level. Based on the data collected, an evaluation of the experiences in terms of both effectiveness and cost-effectiveness will be carried out and then the Guidelines and, if necessary, the legislation on Telemedicine will be amended.

The Ministry of Health has also created a working group that will define the ways in which to achieve the complete digitalisation of prescriptions.