CMS Expert Guide to digital health apps and telemedicine

  1. Digital Health Apps/Software
    1. 1. How is the software within digital health apps classified in your jurisdiction, and what regulation(s) apply?
    2. 2. Are there any other legal regimes that may govern digital health software? (e.g. data protection/ privacy) If yes, please indicate these.
    3. 3. If your response to Q2 is yes, please state whether it matters if, the users are residents using it within their jurisdiction and/or using it outside their jurisdiction; and/or it is a “B2B” (business to business) rather than “B2C” (business to end consumer) service. In each case, please summarise any implications (if applicable). 
    4. 4. Do any particular features, such as location tracking, or monitoring real-time information, trigger any additional consent requirement, regulatory approval, and/or other restrictions beyond the general ones applicable to Q1/Q2?
    5. 5. In the context of physicians relying on digital health apps (containing software), whether for in-person or via telemedicine consultations, are there circumstances where the physicians’ liability can be limited or transferred to the producer of the software contained in the app, or of the final product/app itself, when a fault or inaccuracy with the software (rather than the physicians’ error) occurs, leading to damage (or injury)? 
    6. 6. Please describe the enforcement mechanism for compliance with regard to the regulations discussed in Q1, Q2, and/or Q4 in your jurisdiction with regard to the software contained in digital health apps. What are the legal consequences for non-compliance?
    7. 7. Are you aware of any future legal developments in your jurisdiction with regard to digital health apps/software?
  2. Telemedicine
    1. 8. How are physicians regulated in your jurisdiction (i.e., who is their Regulator; e.g., the General Medical Council in the UK)?
    2. 9. What laws and/or regulations apply to physicians regarding telemedicine?
    3. 10. Does the law in your jurisdiction regulate under what circumstances physicians can use telemedicine in order to treat patients?
    4. 11. Do the standards of care applicable to physicians change in the context of using telemedicine?
    5. 12. Are there any restrictions on the type of medicine that can be prescribed through telemedicine?
    6. 13. Are telemedicine services reimbursable under the state’s medical insurance / subsidy / coverage? 
    7. 14. Are there specific data protection regulations covering telemedicine (outside the context of using a digital health app) in your jurisdiction? If so, please summarise what they are.
    8. 15. Are you aware of any future legal developments in your jurisdiction with regard to telemedicine?

Digital Health Apps/Software

1. How is the software within digital health apps classified in your jurisdiction, and what regulation(s) apply?

1.1 Is it considered a “medical device” or a “product” to which liability can attach, and if so, under what regulations?

Software in the form of a digital health app may be considered a “medical device” largely depending on its functionality. 

Medical devices are currently regulated by the Medical Devices Regulations 2002 which give effect to the EU directives 93/42/EEC and 98/79/EC on medical devices and IVDs respectively. Following the expiry of the Brexit implementation period on 31 December 2020, CE marked medical device apps will continue to be accepted in Great Britain (“GB”), which comprises England, Scotland, and Wales, until 30 June 2023. From 1 July 2023 all medical devices placed on the market in GB (and therefore in England) will be subject to new UKCA mark requirements, which are awaited. CE marked medical software apps will continue to be accepted in Northern Ireland (“NI”) after 1 July 2023 while the NI Protocol agreed with the EU remains in force.

The definition of a medical device includes both standalone software and software that is used in combination with a device that is “intended by its manufacturer to be used specifically for diagnostic and/or therapeutic purposes.” 1 https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/521458/Borderlines_with_medical_devices.pdf  

Under current law, a software digital health app will qualify as a “medical device” if it is intended to be used for one or more of the medical purposes specified in the definition of a medical device or IVD, which include, inter alia, diagnosis, treatment, and monitoring of a disease, injury or disability. 

Following CJEU jurisprudence from 2017 (in Case C 329/16 concerning Philips’ prescribing software), which will be retained law in GB after 31 December 2020, software where at least one of the functions makes it possible to use patient-specific data for a medical purpose is, in respect of that function, a medical device. This aligns with the position taken in both the European Commission’s MEDDEV 2.1/6 of July 2016 and guidance from the Medical Devices Coordination Group (established under the MDR). Although neither of these have binding effect in GB, they indicate that, where standalone software used in healthcare has applications that consist of both medical device and non-medical device “modules,” only the modules that have medical device functionality need to comply with medical device requirements.

Therefore, where certain parts of an app qualify as a medical device, this does not necessarily qualify the whole app as a medical device if the modules can be considered distinct.

If software in the form of a digital health app is considered a medical device, the software must be validated through pre-market conformity assessment to demonstrate it conforms to the safety and performance requirements set out in the Medical Devices Regulations 2002 and the applicable Medical Devices Directive. In practice, this entails the legal manufacturer successfully performing the required pre-market conformity assessment and establishing appropriate systems and procedures to fulfil the manufacturer’s post-market surveillance and vigilance reporting obligations. 

The current GB medical devices legislation only regulates products that are placed on the market or made available in the “Union” 2 Due to various international agreements, for the purposes of medical device legislation, “Union” is the EEA, Switzerland, Turkey and the UK, until 31 December 2020. . Therefore, a service provided from outside the Union is arguably not regulated by current GB medical devices legislation even where it has a medical purpose, though this is a controversial regulatory issue. It is notable that this issue has been resolved in the EU in favour of future regulation of such services (from May 2021) by requiring the underlying software devices to be CE marked. However, as GB will not implement the EU MDR or IVDR (EU Regulations 2017/745 and 746), this will require further legislation in GB.

1.2 If your response to Q1.1 is yes, please state whether there are any exclusions/exemptions applicable with regard to liability, and/or whether those are applicable only under certain circumstances (e.g., for in-hospital use)?

Whether or not software in the form of a digital health app satisfies the definition of a medical device, general civil law liability principles apply. In particular, civil liability could potentially arise under the common law tort of negligence and/or in contract.

There exists some legal uncertainty as to whether standalone, non-embedded software (i.e., software that has to be downloaded) constitutes a “product” within the scope of the Consumer Protection Act 1987 (“CPA”), which has given effect to the EU product liability directive 85/374/EEC in GB. The CPA is expressed to apply to “goods or electricity” 3 Section 1(2) of the CPA . We are not aware of any GB case law that specifically addresses whether non-embedded software can be “goods” for the purposes of the CPA. However, English first instance and appellate case law relating to other legislation that is expressed to apply to “goods” has concluded that downloaded software is not “goods” for the purposes of that legislation. 4 See Computer Associates UK Ltd v The Software Incubator Ltd [2018] EWCA Civ 518; at issue in this case was whether supply of downloadable software could be a ‘sale of goods’ for the purposes of the Commercial Agents (Council Directive) Regulations 1993. Please note that this case has been appealed to the UK Supreme Court and a reference has been made to the Court of Justice of the European Union  These decisions suggest that GB courts could have similar doubts to those expressed by the European Commission and others regarding whether the EU product liability directive (or CPA in GB) is applicable to digital technologies. 5 Report from the Commission to the European Parliament, the Council and the European Economic and Social Committee: Report on the safety and liability implications of Artificial Intelligence, the Internet of Things and robotics (19 February 2020) and Report from the Expert Group on Liability and New Technologies – New Technologies Formation: Liability for AI and other Emerging Digital Technologies (27 November 2019).

1.1 Is it considered a “medical device” or a “product” to which liability can attach, and if so, under what

The software used within digital health apps can be classified either as medical devices within the meaning of the Legislative Decree no. 46/1997, which has implemented Directive 93/42/EEC, or as simple consumer product to which the regulations on general product safety apply.

In light of Legislative Decree no. 46/1997 medical device means any instrument, device, implant, substance or other product, used alone or in combination, including information software used for correct operation and intended by the manufacturer to be used in humans for the purpose of diagnosis, prevention, control, therapy or mitigation of a disease, diagnosis, control, therapy, mitigation or compensation of an injury or handicap; study, replacement or modification of the anatomy or physiological process.

Basically, the software is classified as a medical device if it has at least one feature involving the use of patient-specific data to support the physician in prescribing or calculating treatment dosage.

Therefore, the decisive factor is whether the software was intended by the manufacturer to be used for one or more medical purposes.

In order to qualify the software as a medical device or not, it is also possible to rely on the indications of the “Manual on borderline and classification in the Community regulatory framework for medical devices.”

1.2 If your response to Q1.1 is yes, please state whether there are any exclusions/exemptions applicable with regard to liability, and/or whether those are applicable only under certain circumstances (e.g., for in-hospital use)?

The exclusions from liability for damages caused to patients by the product (i.e., the software) are listed in the Italian Consumer Code. In particular, with reference to liability for product damage, the same is excluded:

  • if the manufacturer has not put the product into the market;
  • if the defect that caused the damage did not exist when the manufacturer put the product into the market;
  • if the producer did not manufacture the product for sale or for any other form of distribution for consideration, nor did they manufacture or distribute it in the exercise of their professional activity;
  • if the defect is due to the conformity of the product with an imperative legal provision or a binding measure;
  • if the status of scientific and technical knowledge, at the time the manufacturer put the product into service, did not yet allow the product to be considered as defective;
  • in the case of the manufacturer or supplier of a component part or raw material, if the defect is entirely due to the design of the product into which the part or raw material has been incorporated or to its conformity with the instructions given by the manufacturer who used it.

It should be noted, however, that although the definition of defective medical device provided in the new Medical Device Regulation (“MDR”) is based on the notion of defective product set forth in Directive 85/374/EEC and the Italian Consumer Code, it is partially different: “defect” in such case is any deficiency in the identity, quality, durability, reliability, safety or performance of a device, including malfunction, errors in use or inadequacy of the information provided by the manufacturer. The reference to the lack of performance of the device is undoubtedly noteworthy since, according to the MDR, “clinical performance” means the ability of a device to achieve the intended use declared by the manufacturer, thus providing a clinical benefit to patients.

The new concept of defective medical device therefore goes beyond the boundaries drawn by the Consumer Code, for which the concept of defect is closely related to the concept of safety (a product is defective when it does not offer the safety that can legitimately be expected, taking into account all the circumstances) and does not correspond to the definition of “defect,” which is identified in an imperfection of the good and may also not lead to a lack of product safety.

As mentioned above, the MDR is not yet applicable, therefore it is arguable that even the definition of “defective device” provided for therein cannot be used in any possible litigation arising from damage caused by devices; it is not excluded, however, that the case law might (de facto) adopt the stricter concept of “defect” of device provided for in the MDR, thus widening the notion of “safety” of the product in order to benefit possible injured parties.

Data Protection

If the personal data of users/patients is processed using digital health software, such processing must comply with the data protection laws in force in the UK, in particular with: 

  • The General Data Protection Regulation (“GDPR”); 
  • The Data Protection Act 2018 (the “DPA”) and 
  • The Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), to the extent relevant.

The GDPR generally governs the processing of personal data and requires that any processing undertaken is done lawfully, fairly and in a transparent manner. (See in particular Articles 5(1)(a), 6, 13 & 14 GDPR.) The GDPR also imposes further conditions on the processing of “special category data” including health data. (See Article 9 GDPR.) The DPA is a national law which supplements the GDPR, and sets out additional requirements for the processing of special category data in the UK.

Following the end of the Brexit transition period in the UK (31 December 2020), the GDPR will be retained in UK law and become known as the “UK GDPR”. It will continue to apply subject to certain adaptations. (See The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.)

PECR sits alongside the DPA and GDPR and imposes specific requirements in the context of marketing, cookies, keeping communications secure, and customer privacy. 

Consumer Rights

The Consumer Rights Directive (2011/83/EC) applies when a person purchases an app relating to lifestyle or wellbeing. Any data that is transferred via the app is likely to be considered personal data.

The Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 (SI 2013/3134) (“CCRs”) implement most of the Consumer Rights Directive. The Consumer Protection (Amendment etc.) (EU Exit) Regulations 2018 amend the CCRs by making various amendments to EU-derived UK consumer protection legislation, including the removal of references to EU legislation. They also include an omission of CCR 3(2) relating to having regard, in the Secretary of State’s periodic reviews, to what is done in other EU Member States to implement The Consumer Rights Directive.

The Italian Data Protection Authority, by means of measure no. 55 of 7 March 2019, has provided for some clarification on the application of the data protection regulation on digital health software. 

By means of said guidelines, in fact, it has been specified that the exceptions to the general prohibition of processing the so-called “special categories of data,” including those on health, on the basis of which the processing of such data is allowed, are now to be identified in Article 9 of the GDPR which lists a series of exceptions that legitimize the processing and which, in the health sector, are generally attributable to the processing necessary for:

  1. reasons of public interest relevant on the basis of Union or Member State law;
  2. reasons of public interest in the field of public health;
  3. purposes of preventive medicine, diagnosis, health or social care or treatment or management of health or social systems and services on the basis of Union law/Member States or in accordance with a contract with a health professional, carried out by (or under the responsibility of) a health professional subject to professional confidentiality or by another person also subject to the confidentiality obligation.   

In addition, with reference to processing in the health sector that does not fall within the hypotheses described above and, therefore, which require the explicit consent of the data subject, the Data Protection Authority has identified, by way of example, processing relating to the use of medical apps, through which independent data controllers collect data, including health data of the data subject, for purposes other than telemedicine or when, regardless of the purpose of the app, subjects other than health professionals or other subjects bound to professional confidentiality may have access to the data of the data subject.

In this case, the obtaining of consent, as a condition of lawfulness of the processing, is mandatory as required by art. 75 of the Italian Privacy Code. 

Therefore, the minimum requirements provided by the general principles underlying GDPR must be adopted by device manufacturers and developers of e-health apps. It is always necessary that the interested parties provide their free, specific, informed, unequivocal and explicit consent.

3. If your response to Q2 is yes, please state whether it matters if, the users are residents using it within their jurisdiction and/or using it outside their jurisdiction; and/or it is a “B2B” (business to business) rather than “B2C” (business to end consumer) service. In each case, please summarise any implications (if applicable). 

3.1 The users are residents using it within their jurisdiction and/or using it outside their jurisdiction.

The GDPR applies to the processing of personal data in the context of an establishment of a controller/processor in the EEA or UK, regardless of whether the processing takes place there. (See Article 3(1) GDPR.)

In addition, the GDPR applies if a controller/processor is not established in the EEA or UK but processes the personal data of data subjects in the EEA or UK when the processing activities relate to the offering of goods/services or monitoring the behaviour of the data subjects so far as that takes place within the EEA or UK. (See Article 3(2) GDPR.)

3.2 It is a “B2B” (business to business) rather than “B2C” (business to end consumer) service.

The GDPR and DPA do not distinguish between the processing of personal data in a B2B or B2C context and may apply to processing in either context.

In general, the marketing requirements of PECR will apply in a B2C but not B2B context. There are however exceptions in the case of marketing relating to sole traders and some partnerships to which the PECR marketing requirements will also apply. (See in particular regulation 22 PECR.)

No specific provisions have been provided for the case in which the use takes place outside of Italy, or the product is used in a B2B or B2C business.

Data protection 

To the extent that personal data is processed for location tracking or monitoring real-time information, the GDPR applies. 

Location tracking

PECR governs the processing of location tracking information. In general, such processing is only permitted in cases in which it is undertaken by a services provider on an anonymous basis or if it is necessary for a value added service (i.e., beyond what would be needed for transmission or billing of a communication) and the user has consented. (Traffic data is subject to separate requirements.) (See in particular regulation 14 PECR.)

Monitoring real-time information

If the monitoring of real-time information includes the processing of health data then, as explained above, this is classified as special category data under the GDPR and subject to additional requirements under the GDPR and DPA. (See Article 9 GDPR.)

Please note that the GDPR also imposes specific requirements in respect of automated individual decision-making, including profiling. Such decision-making must not be based on special category data such as health data unless the controller takes suitable measures to safeguard the data subject's rights and freedoms and legitimate interests and either: 

  • the data subject has given their explicit consent to the processing, or
  • the processing is necessary for reasons of substantial public interest (and has met additional DPA requirements).

(See in particular Article 21 GDPR, section 10 and Part 2 of Schedule 1 DPA.)

Cookies

If a digital app were to include analytical, behavioural or marketing cookies, then the use of such cookies requires prior consent by the data subject. Unless an exemption applies, PECR requires the following for the use of cookies:

  • the provision of "clear and comprehensive" information; and
  • the consent of website users or subscribers.

(See in particular regulation 6 PECR.)

Particular features, such as location, tracking, or monitoring real-time information do require the user’s consent in all cases where such information is not provided in the context of telemedicine or when, regardless of the purpose of the application, subjects other than health professionals or other subjects bound to professional confidentiality may have access to the data of the data subject.

5. In the context of physicians relying on digital health apps (containing software), whether for in-person or via telemedicine consultations, are there circumstances where the physicians’ liability can be limited or transferred to the producer of the software contained in the app, or of the final product/app itself, when a fault or inaccuracy with the software (rather than the physicians’ error) occurs, leading to damage (or injury)? 

We refer you to our response to Question 9 for information regarding the standards to which a doctor is held. 

Generally speaking, whether liability would fall on a Healthcare Professional (“HCP”) or the producer depends on where the fault lies.

If the HCP’s clinical decision was based on defective or faulty software, then the producer may be deemed negligent, or the product may be considered defective such that general product liability principles may apply. In those situations, liability would likely be borne by the producer of the software. If a claim is brought against the HCP and the HCP is found liable, then the HCP may bring a claim for contribution against the producer. However, if the HCP’s erroneous clinical decision is not due to any defect or fault concerning the software, then the HCP could face a claim in negligence brought against him/her directly.

In the context of physicians relying on digital health apps a distinction should be made between:

  1. damages caused by incorrect use of the software by the physician, or otherwise resulting from incorrect medical advice in circumstances where the software does not present anomalies;
  2. damages caused by incorrect installation, operation or maintenance of the software;
  3. damages caused by software malfunction.  

In the cases referred to in point a), it is reasonable to state that the responsibility will be borne by the physician only. 

In the cases referred to in point b), the responsibility could be either of the manufacturer, if it has not provided sufficient information for the implementation of the new system, or of the health care facility where the doctor operates if it has not properly maintained or installed the software. 

In the cases referred to in point c), the responsibility will presumably be borne by the software manufacturer only. 
In each scenario, however, a case-by-case assessment will be required.

Medical Devices

If the digital health app satisfies the definition of a medical device (such that its intended use is for diagnostic, treatment, prevention, or prognosis purposes), then in order to lawfully place this on the market in GB, the manufacturer must conduct an appropriate pre-market conformity assessment procedure. Depending on the risk classification of the app under the EU Medical Devices Directive, this may also entail an assessment of the technical documentation and the manufacturer’s quality system by a Notified Body (designated by the competent authority). 

In the post-market period the manufacturer of a medical device app must fulfil post-market surveillance and vigilance reporting obligations overseen by the Medicines and Healthcare products Regulatory Agency (MHRA) which is the competent authority for medical devices in the UK. Where adverse incidents are caused by a device, then corrective action may be required. This may include the recall or withdrawal of a product in order to eliminate the risk of injury or death.

All obligations under the Medical Devices Regulations 2002 are enforced via the criminal law in the UK. The MHRA, as the enforcement authority, also has a range of statutory powers in the 2002 Regulations and in the CPA to enable it to require compliance, investigate product safety as well as to act directly against products, e.g., by issuing compliance, prohibition or information notices concerning individual products. Offences for breach of the 2002 Regulations are set out in the CPA. Penalties for offences include imprisonment for up to 6 months, an unlimited fine, or both. 

For direct-to-consumer apps, manufacturers (or importers into GB from 1 January 2021) may also be ordered to recall the apps under the powers in the General Product Safety Regulations 2005, which have given effect to the EU General Product Safety Directive 2001/95/EC in GB. Under this legislation distributors (if relevant for software devices) also have obligations to act with due care, not to promote or supply unsafe devices, to cooperate with regulatory authorities, and to assist with monitoring through traceability measures. 

In addition to potential regulatory liability, a manufacturer or supplier of a defective health app which causes injury may face civil liability claims from injured users. Depending on the exact circumstances, users may be able to claim damages in respect of their injury under: (i) the tort of negligence; and/or (ii) where the user has a contract directly with the producer of the health app, contract law (under either express or implied product quality warranties in the contract). As explained above, there is currently uncertainty as to whether injured users will be able to recover compensation for injury or loss under the CPA where this is caused by defects in standalone software apps.

Data Protection

Under the GDPR, supervisory authorities such as the Information Commissioner’s Office (ICO) have a number of enforcement powers, including:

  • to issue an information notice requiring information in order to exercise their functions and conduct investigations;
  • to issue an enforcement notice requiring a person to take certain steps, or refrain from taking certain steps, which may include an absolute or partial ban on processing;
  • to issue an assessment notice allowing them to conduct assessments of compliance with applicable legislation. 

In addition, for breaches of the GDPR the ICO may impose a fine of up to 20 million Euros or 4% of worldwide annual turnover of the preceding financial year, whichever is higher. For a breach of PECR, the ICO can also impose a fine of up to £500,000.

(See in particular Article 83 GDPR and regulation 31 PECR.)

Should the software included in the digital health app be considered a medical device as it is used to monitor physiological processes or otherwise collect and provide information and assume diagnostic or therapeutic decisions, it is likely that it falls within class IIA or IIB of medical devices that require CE marking through the involvement of the so called “Notified Body.” Should it not fall, for any reason, within classes IIA or IIB, it would probably fall within the definition of class I of medical devices which would still require CE marking but without involvement of the CE marking process by the “Notified Body.”
In addition, all medical devices, irrespective of their class, shall be notified to the Ministry of Heath for registration before they are launched on the market.

Failure to comply with the above-mentioned rules could result in both criminal and pecuniary sanctions up to €128,400.

As far as the Data Protection regulation is concerned, it is necessary to point out that, beyond the cases in which the app is used for telemedicine purposes, the consent of the person concerned to the processing of his/her health data is necessary. 

The consent must be given even before the actual installation of the medical app on one's own device and, with the same easiness, all the other rights granted to the user by GDPR (right of revocation, oblivion, etc.) must be properly granted.

Consent must be given for every purpose specified in the information notice with simple and clear language, in a transparent form and easily accessible by users and patients.

The Italian Data Protection Authority has stated that it is also appropriate for the data controller to establish (“Privacy by design and privacy by default”), all the appropriate technical and organizational measures to ensure that only personal data necessary for each specific purpose of processing are processed by default. This obligation applies to the amount of personal data collected, the scope of processing, the retention period and accessibility. In particular, such measures ensure that, by default, personal data is not made accessible to an undefined number of persons.

In addition, with regard to storage methods, duration and security measures adopted, the developer and/or producer of e-Health apps must provide, always within the information notice all the necessary information also in accordance with the Privacy Code of Conduct on Mobile Health APPs and articles 32 and 35 of the GDPR.

In the event of violations of data protection obligations, significant fines may be imposed on operators. The sanctions, depending on the violation, can be up to 10 or 20 million Euros or up to 2% or 4% of the annual worldwide turnover of the previous year, whichever is higher. 

GB will no longer be subject to EU Regulation after 31 December 2020. As existing EU medical devices regulation will become “retained law” in GB (it will continue in NI for at least 4 years), there is unlikely to be significant changes in the immediate short term beyond the new product and UK Responsible Person registration requirements, which will start in 2021. 6 https://www.gov.uk/guidance/using-the-ukca-mark-from-1-january-2021  As GB will now require the new UKCA marking for all medical devices including medical software apps from 1 July 2023, we can expect to see further detail on these requirements during 2021-2022 to allow industry to prepare for this, and there is a general expectation that the MHRA will issue a formal consultation on the new UKCA mark requirements. 

As the UK has already indicated its intention to appoint UK Approved Bodies for higher risk classes of devices, which may affect some medical software apps, it will be important that the capacity of UK Approved Bodies is appropriately taken into account if the UK is not to repeat the Notified Body capacity shortage that has been such a challenge for industry and regulatory authorities alike during the period leading up to the MDR and IVDR. On this basis, our expectation is that the new UKCA mark requirements are likely to share at least some commonality with the current and future EU CE mark requirements for medical devices and IVDs. 

In the more immediate short term, the Medicines & Medical Devices Bill is currently before Parliament and will constitute the sector’s primary legislation to allow existing regulatory frameworks to be updated post-Transition Period. It is also intended to consolidate the enforcement regime for medical devices. 

If the Bill becomes law, then it will contain powers for the MHRA to impose civil penalties (as an alternative to criminal prosecution) for breaches of the medical device regime. It will also usher in new rights of action for breach of statutory duty (for persons affected by infringements of the Medical Devices Regulations 2002), an additional enforcement authority in the shape of local authority trading standards authorities for consumer use medical devices, which will include direct-to-consumer medical apps, and powers for the MHRA to disclose information for purpose of civil proceedings, as well as for criminal proceedings or investigations. 7 https://commonslibrary.parliament.uk/research-briefings/cbp-8699/  

The legal framework applicable to digital apps/software will be partially affected by the application of the new EU Regulation 2017/745 (“MDR”). 

The MDR expressly states that “software… intended by the manufacturer to be used, alone or in combination, for human beings for one or more of the following specific medical purposes: diagnosis, prevention, monitoring, prediction, prognosis…” is a medical device.

In addition, pursuant to Whereas no. 19 of the same EU Regulation, “software…, when specifically intended by the manufacturer to be used for one or more of the medical purposes set out in the definition of a medical device, qualifies as a medical device, while software for general purposes, even when used in a healthcare setting, or software intended for life-style and well-being purposes is not a medical device”. 

The MDR therefore provides a precise definition of when the software should be considered a medical device. 

Finally, it is worth remembering that the Italian Government has not yet issued the law reforming the penalty system with reference to medical devices, adapting it to the provisions of the new MDR.

Telemedicine

8. How are physicians regulated in your jurisdiction (i.e., who is their Regulator; e.g., the General Medical Council in the UK)?

The General Medical Council (the “GMC”) regulates individual medical practitioners in the UK—not medical services. Every doctor who wishes to practise medicine in the UK must be registered with the GMC and hold practising rights. Doctors utilising telemedicine need to be appropriately qualified and regulated and should demonstrate, through the GMC or other means, that they are up to date and fit to practise medicine.

The practice of health care professions is subject to the reaching the age of eighteen and the obtaining of a university degree issued following the final qualification exam for the profession. This university degree is valid throughout the national territory in compliance with European legislation on the free movement of professions and is issued following a training course to be carried out in whole or in part at the companies and facilities of the National Health System, including institutions of hospitalisation and care of a scientific nature, identified by the regions, on the basis of special protocols of understanding between them and universities.

In compliance with article 32 of the Italian Constitution, to practise as a medical professional, it is necessary to be enrolled in the corresponding Professional Association. 

The Professional Associations are independent in terms of assets, financial, regulation and discipline. They are subject to the supervision of the Ministry of Health. In addition, the Associations are financed exclusively with the contributions of the members, without charges for public finance.

The Professional Associations supervise the practice of the medical profession. In particular, they verify the qualifications required for professional practice and maintain and publish the registers of professionals, held by the Associations themselves.

In addition, the Professional Associations supervise their members, in whatever legal form they carry out their professional activity, imposing disciplinary sanctions in case of violation of their obligations imposed by law or deontological rules. 

9. What laws and/or regulations apply to physicians regarding telemedicine?

Medical professionals have a duty of care to the patients they treat. The case of Bolam v Friern Hospital Management Committee (1957) 1 WLR 583 established a test to determine if a medical professional has breached their duty of care. It led to the proposition that a doctor’s duty is to exercise skill and care in accordance with the reasonable standards by those practising in the relevant medical field. Therefore, if a responsible body of professional opinion considered the doctor’s care was reasonable, then the doctor would not be in breach of the standard of care. If a doctor did breach the applicable standard of care, and if that breach of duty caused an injury, then the doctor can be liable for damages under the common law tort of negligence.

Fitness to Practise

A doctor must be qualified and fit to practise medicine to maintain registration with the GMC and be allowed to practise medicine. 

All doctors must comply with the “Good Medical Practice” standards set out by the GMC.

The standards of doctors by the GMC apply equally to digital and conventional consultations. Doctors should consider which medium is most appropriate for them and their patient. 

In the context of Digital Health/Telemedicine, doctors must consider the clinical risk of not conducting the consultation against any potential risk of using consumer-focused services and apps, such as Skype, WhatsApp, or FaceTime.

Primary care networks (PCNs) can procure approved videoconferencing software. However, when using telehealth, doctors still need to safeguard confidential patient information in the same way they would with any other consultation. They need to take extra care to ensure that all information is recorded in the appropriate care record (as usual); ensure any personal information stored on the doctor’s own device, or obtained through a video or telephone conversation, is safely transferred to the appropriate health and care record as soon as possible; delete any personal information, including back-up data, from the doctor’s own device; and apply his/her own relevant professional standards, as would normally be done. BMA Advice, “Covid-19: video consultations and home working,” 3 June 2020: https://www.bma.org.uk/advice-and-support/covid-19/adapting-to-covid/covid-19-video-consultations-and-homeworking

Although not a regulator of the individual doctors, the CQC registers telehealth/telemedicine service providers in England for the regulated activity of providing triage and medical advice “remotely” when certain criteria are met. Under Schedule 1(9) of The Health and Social Care Act 2008 (Regulated Activities Regulations) 2014, this is defined as, “Medical advice in cases where immediate action or attention is needed, or triage provided, over the telephone or by electronic mail by a body established for that purpose.” The CQC’s guidance published in March 2015 confirmed that remote advice will qualify as a regulated activity when the following are criteria met:

  1. The advice is medical; and
  2. The advice is responsive (i.e., for immediate attention or action); or it constitutes triage (defined in the guidance as “assigning degrees of urgency to diseases, disorders or injuries in order to decide the order and place of treatment for people using the service”); and
  3. The advice is provided over the telephone or by electronic mail; and
  4. The advice is provided by a body established for that purpose (as opposed to, for example, the occasional provision of advice by a hospital or university on an informal basis). 

E-Commerce

Until the end of the Brexit transition period (that ends 31 December 2020), the E-Commerce directive (2000/31/EC) will apply to telemedicine in the UK, as the directive applies to “information society services” defined as any service that is normally provided,

  • For payment,
  • “at a distance” (such that customers can use the service outside the presence of the provider),
  • By electronic means, and
  • At the individual request of a recipient of the service.

This directive was implemented into UK law by the Electronic Commerce (EC Directive) Regulations 2002.

Post-transition period, the retained law will be the E-Commerce Regulations, which will be amended by the Electronic Commerce (Amendment etc.) (EU Exit) Regulations 2019. The most significant impact of the amendments is to the “country of origin” rule such that a UK-established e-commerce operator will no longer be able to benefit from the previous principle allowing an information society service provider to comply with the laws of the country in which it is based. Instead, it will have to comply with the specific requirements of each jurisdiction in which it is active. A UK-based provider will therefore need to do the following:

  1. account for different contracting arrangements/ requirements/information provision rules in each EU jurisdiction post-Brexit transition period (as well as complying with UK requirements when selling in the UK); and 
  2. be mindful of any limitation on offering a telemedicine service which may apply in each jurisdiction where it is active.  

Although there is not yet a specific law concerning telemedicine, the most important reference is the document "National Guidelines for the provision of telemedicine services" approved following an agreement between the Government and the Regions on 17 December 2020. The Guidelines should represent the national unitary reference for the implementation of telemedicine services and the use of such systems within the National Health Service.

According to the Guidelines, Telemedicine services can be divided into four categories:

  • Services that can be assimilated to any other traditional diagnostic and/or therapeutic healthcare service, representing an alternative to it;
  • Services which, since they cannot replace the traditional healthcare service, support it by making it more accessible and/or increasing its efficiency.
  • Services which complement traditional services by making them more effective in meeting patients' needs;
  • Services which can completely replace traditional healthcare services.

In the context of telemedicine, the Guidelines identify the following services, which should be traced back to the same regime under which they are provided also in the presence of the patient.

  • Televisiting: this is a medical act in which the professional interacts at a distance in real time with the patient, also with the support of a care-giver. Televisiting is, however, limited to the monitoring of patients whose diagnosis has already been made during an in-person visit. This means that services that do not require palpation, percussion or auscultation can be provided in this way.
  • Teleconsultation: this is a medical act in which the professional interacts at a distance with one or more doctors to discuss, also by means of a video call, the clinical situation of a patient, based primarily on the sharing of all the clinical data, reports, images, audio-video regarding the specific case.
  • Teleconsulting: this is a health activity, not necessarily medical but in any case, specific to the health professions, which takes place at a distance and is performed by two or more persons who have different responsibilities with respect to the specific case. It consists in the performance of clinical activities, followed by a video call in which the requested health professional provides the other with indications for the correct performance of care services for the patient.
  • Telecare by health professions (nurse/physiotherapist/logopedist/etc): this is a professional act  based on remote interaction between the healthcare professional and the patient by means of a video call, to which data, reports or images may be shared if necessary. The telecare professional can also use suitable apps to administer questionnaires, share images or video tutorials on specific activities.
  • Telereferral: is a report issued by the doctor who has examined the patient, whose report is transmitted by means of digital and telecommunication systems.

For all healthcare services provided at a distance, the national/regional regulatory framework regulating access to the same services in traditional form applies.

10. Does the law in your jurisdiction regulate under what circumstances physicians can use telemedicine in order to treat patients?

10.1 What are the requirements?

The GMC has published guidance on remote consultations. 9 https://www.gmc-uk.org/ethical-guidance/ethical-hub/remote-consultations and also https://www.gmc-uk.org/about/what-we-do-and-why/data-and-research/research-and-insight-archive/regulatory-approaches-to-telemedicine  Briefly, the doctor needs to consider whether a face-to-face consultation is necessary, or whether remote treatment may be appropriate. If appropriate, then the doctor should obtain the patient’s consent for this method of provision of medical services. If the doctor is not the patient’s usual doctor, then s/he must ask the patient for consent to obtain information and a history from the patient’s GP and to send details of any treatment the doctor has arranged.

Remote consultations via use of telehealth can take place where the patient’s clinical need or treatment request is straightforward; the doctor has access to the patient’s medical records; all the information requested/needed by the patient can be given by telephone, internet, or videolink; the treatment does not require follow-up or monitoring; and the doctor has a safe system in place to prescribe medications if needed. If these are not met, and/or if the doctor needs to physically examine the patient; the doctor is unsure about the patient’s capacity; the doctor is unable to determine that the patient has all the information the patient wants or needs about treatment options; or the doctor is prescribing injectable cosmetic medications, then the consultation must be in person. 

10.2 Were there any new (time-limited) regulation regarding the Sars-CoV-2 pandemic?

Telemedicine/telehealth services and technology were already being used in the UK before the Covid-19 pandemic. However, the pandemic highlighted the need to urgently reduce the risk of staff exposure, increase the supply of PPE, and minimise high patient volume impacts on healthcare facilities. No new regulations or laws have been introduced which specifically regulate the use of telemedicine by doctors. As above, the CQC regulate healthcare institutions in England. As before the Covid-19 pandemic, telemedicine providers in England are required to register with the CQC to perform the regulated activity of “transport services, triage and medical advice provided remotely.” 10 The Healthcare Improvement Scotland (HIS), Healthcare Inspectorate Wales (HIW), and the Regulation and Quality Improvement Authority in Northern Ireland (RQIA), the other 3 national regulators, do not have specific telemedicine policies for healthcare providers.  

At the start of the Covid-19 global pandemic/during the first lockdown period in the UK, primary care and hospital outpatient departments were instructed by England’s Health Secretary to use “digital first” and that all consultations should be done via telemedicine unless there were clinical or practical reasons not to do so. GP practices were advised to move to a “total triage first” model to protect patients and staff from avoidable risks of infection. 11 “How to establish a remote total triage model in general practice using online consultations.” https://www.covid19-gpg.innovationlab.org.uk/topics/remote-working/total-triage-consult 12 A similar approach was taken by Scotland, Wales, and Northern Ireland. However, GP practices must conduct face-to-face consultations where clinically indicated, as discussed in Q10(a)

10.1 What are the requirements?

Telemedicine is not a separate medical discipline, but a different way of providing health services. Therefore, provided that the service complies with the general requirements identified by the Guidelines on Telemedicine in terms of access to the service, technology, professionalism, adequate organisation and compliance with good clinical practice for the pathology treated, it is suitable to be used each area identified by the Italian Regions through specific programmes.

In order to perform Telemedicine activities, the facilities/physicians involved, must:

  • be licensed by the Region for the specific discipline (cardiology, diagnostic imaging, ophthalmology, clinical diagnostics, etc.) for which they intend to use individual services of Telemedicine and/or clinical care programs integrated with the activities of Telemedicine;
  • comply with the service standards for Telemedicine  defined by the Region, if any;
  • stipulate, if necessary, specific contractual agreement(s) with the Regions/Local Health Facilities for Telemedicine services;
  • appoint a director/manager to ensure that the appropriate performance standards are met for activities provided through Telemedicine;
  • adopt cybersecurity management systems;
  • adopt a risk assessment plan, appropriate to the kind of services provided.
10.2 Were there any new (time-limited) regulation regarding the Sars-CoV-2 pandemic?

The Italian High Institute of Health (“ISS”) has published a document containing “Indications for telemedicine care services during the COVID-19 emergency,” which provides support for the provision of services in Telemedicine during the COVID-19 emergency, thus providing indications, identifying operational problems and proposing solutions supported by evidence, which are easily feasible in practice.

The document does not provide specific measures aimed at simplifying Telemedicine’s use but mainly aims at encouraging healthcare professionals to use distance-health tools.

According to the above mentioned document, where telemedicine is not yet structured in a system of a national relevance, in consideration of the health emergency situation, it is necessary first of all to implement and make available those solutions that can be activated quickly, within a few days, which are usable by people at home with the technological equipment immediately available to them and that can be activated for periods of time appropriate to the needs of the emergency situation.

The document also identifies the reference principles which it is advisable that healthcare professionals focus on:

  • preconditions for making telemedicine services possible (e.g., connectivity, entirely digital prescriptions, cybersecurity);
  • health responsibility during the performance of telemedicine activities;
  • elements necessary to carry out the services at home;
  • functioning of health-related video calls;
  • activation steps of the telemedicine service.

11. Do the standards of care applicable to physicians change in the context of using telemedicine?

The standards of doctors by the GMC apply equally to digital and conventional consultations.

11.1 Are there legal requirements for physicians to give disclaimers or other types of notices to patients (as part of the consent process) before using telemedicine? If so, please indicate these.

After the doctor verifies the patient’s identity, the doctor will need to confirm consent for a remote consultation and confirm that the patient is in a private area to speak, explaining limitations of the medium used.

If a video consultation is used, then the doctor’s practice should use a system that incorporates a robust identity authentication process, allowing the doctor to control communications with the patient. 13 See https://www.england.nhs.uk/wp-content/uploads/2020/01/online-consultations-implementation-toolkit-v1.1-updated.pdf

Doctors should inform patients that any data/information/photos/etc. sent to the doctor via an app will be added to the patient’s medical record, in order to obtain the patient’s consent to use other media forums for sharing of information.

The same principles of good clinical practice should apply in online consultations as compared to either when speaking to a patient by way of phone or by way of other non-face to face contact. The doctor should see the patient in person if clinically appropriate, confirming the patient’s agreement with management plans, and should ensure to follow GMC requirements for good care.

Data Protection

Under the GDPR, a controller is required to meet transparency requirements, including providing data subjects with information on the processing of any personal data they provide (e.g., using a privacy notice). As explained above, the processing of health data is also subject to additional requirements under the GDPR where a specific condition (such as explicit consent) must be satisfied to permit the processing of such data. (See in particular Articles 9, 13 and 14 GDPR.)

11.2 Does the use of telemedicine increase the risk of liability (e.g., if a physician is asked to certify someone’s fitness to engage in a particular employment and does so virtually versus an in-person consultation)?

The use of telemedicine does not particularly increase the risk of liability, per se. Doctors are held to the same standards as when not using telemedicine and will need to determine if a face-to-face consultation is necessary. See our response to Question No. 9.

11.1 Are there legal requirements for physicians to give disclaimers or other types of notices to patients (as part of the consent process) before using telemedicine? If so, please indicate these.

The performance of health services through telemedicine, requires the adoption of a number of additional safeguards by healthcare professionals. 

In particular, physicians must adequately inform the patient the service in Telemedicine will be provided through Telemedicine. To this purpose, the patient must receive appropriate information on the opportunity and scope of the service, as well as on the means used and the methods of storage and processing of his/her data.

11.2 Does the use of telemedicine increase the risk of liability (e.g., if a physician is asked to certify someone’s fitness to engage in a particular employment and does so virtually versus an in-person consultation)?

The use of telemedicine systems requires a different approach to the physician's liability in the case of incorrect medical assessment.

In such a scenario, some factors that influence liability may be detected, such as defects in the construction of the devices used, incorrect installation of the device, ineffective maintenance, incorrect use of the devices, including incorrect transmission/evaluation of the data. 

Such circumstances may lead to a diagnostic error caused by the alteration of the transmitted data or by device’s failure/malfunction. 

In the context of a diagnostic error, it must therefore be assessed whether it is due to a technical deficiency that would exclude the physician's responsibility. 

From a general point of view, the physician will instead be responsible for his/her culpable error due to the wrong interpretation of the data.

12. Are there any restrictions on the type of medicine that can be prescribed through telemedicine?

The GMC has published guidance for doctors on remote consultations and prescribing. 14 https://www.gmc-uk.org/ethical-guidance/ethical-guidance-for-doctors/prescribing-and-managing-medicines-and-devices/remote-prescribing-via-telephone-video-link-or-online Doctors must satisfy themselves that they can make an adequate assessment; obtain the necessary information/knowledge about the patient’s health they consider is needed to make a prescription; that the medicine(s) to be prescribed serve the patient’s needs; have access to the patient’s medical records; that a physical examination or other assessment is not first required; and they must obtain a patient’s consent before a prescription can be made via telephone, video-link, or online. Physical examinations are required before prescribing any non-surgical cosmetic medicinal products. Prescriptions for patients in a care or nursing home should be made following communication with the patient and/or the patient’s carer to assess the need for the prescription, and should be followed up with written confirmation.

The Guidelines on Telemedicine do not impose particular limits with regard to the medicines that can be prescribed. However, it should be noted that e-prescription is a tool already regulated regardless of the use of telemedicine systems. 

The e-prescription, regulated by the Interministerial Decree of 2 November 2011, is now a widely used tool for access to pharmaceutical services of the National Health Service.

The spread of dematerialized prescription has reached a very high level of coverage. The Ministry of Health has declared that almost 90% of pharmaceutical prescriptions are electronic prescriptions. 

However, not all prescriptions allowing access to the services of the National Health System have been, shifted to electronic prescriptions. Therefore, a working group is active between the Ministry and the Regions to extend the prescriptions that are still in paper format. Such prescriptions concern:

  • therapeutic plans,
  • drugs in direct distribution,
  • thermal performance,
  • prescriptions for supplementary care and prosthetic assistance; and
  • prescription of drugs containing narcotics, with indications other than pain therapy. 

In addition, a working group at the Ministry of Health is actively dealing with the dematerialization of vouchers for the provision of gluten-free products for coeliac disease patients, vouchers that will be spendable anywhere in Italy, even outside the Region where the patient resides.

With regard to the e prescription system, it is stipulated that following the prescription, the physician must release to the patient:

  • the Electronic Prescription Number
  • the paper memo of the recipe.   

The paper memo is issued to guarantee the provision of the service even in case of unavailability of computer systems. However, the Interministerial Decree of 25 March 2020 initiated a process to digitise the memo and thus making the prescription completely digital.

13. Are telemedicine services reimbursable under the state’s medical insurance / subsidy / coverage? 

Healthcare in the UK is primarily provided through the National Health Service (“NHS”) which is a publicly funded healthcare system. Responsibility for the NHS is a devolved power, meaning that the devolved governments of England, Scotland, Wales, and Northern Ireland are responsible for the operation of the NHS in those respective UK nations. Our comments here relate to the health service in England, which is the largest healthcare market in the UK. 

As far as NHS patients are concerned, NHS treatment is generally free at the point of demand. However, the NHS does not fund all treatments and products on an unlimited basis. For example, some healthcare products can be subject to health technology assessment (“HTA”) approvals by the National Institute for Health and Care Excellence (“NICE”) in England, which can mandate funding for use in England. The availability on the NHS of other therapies can depend on the therapy being included in area formularies as the result of more localised reviews. As far as digital health apps are concerned, the NHS Apps Library contains apps which have been clinically assessed by the NHS to ensure they meet NHS quality standards for safety, usability, and accessibility. However, there is not yet publicly-funded provision of apps direct to patients. Patients must therefore either self-fund or use free of charge apps. 

Telemedicine services can, in principle, be funded by the NHS through a range of different structures depending on the nature of the service and the context in which it is provided (e.g., primary versus secondary care). For example, primary care services provided by way of telemedicine may be commissioned and paid for by a commissioning body under a standard contract for general medical services. 

13.1 If so, are there any special provisions about the reimbursement/coverage of costs regarding the use of mobile apps that can combine digital health and telemedicine? 

here are no statutory provisions specific to reimbursement/coverage of telemedicine/healthcare mobile apps. However, there are various ways that such a service may be funded by the NHS. For example, as per above, in primary care this could be funded under a contract for general medical services. Alternatively, a telemedicine service may be indirectly funded by the NHS where an NHS provider, such as an NHS hospital Trust sub-contracts part of its service provision to a provider of this type of service. 

13.2 And further, if yes, who is covering the costs for apps that are mostly used by healthcare professionals and by patients?

As per above, this will depend on the type of app. For apps used by HCPs, this will likely be the healthcare provider at which they are employed, which will in turn be funded by way of contracts with NHS commissioning bodies.

The services provided by the Italian National Health System (“NHS”), whether through public or accredited private facilities, are only those identified in the LEAs (Essential Levels of Care), defined by the Prime Minister Decree of 12 January 2017; therefore, if a citizen wishes to benefit from a healthcare service which is not included in the LEAs, the cost would be entirely at his or her own expenses whether the healthcare service was provided in a public or accredited private facility. Therefore, a telemedicine service can be reimbursed by the NHS provided that the concerned healthcare service is included in the LEAs.

The Guidelines on Telemedicine state that the use of ICT technologies can allow the provision of services that fall into the following two categories:

  1. services already provided by national and regional tariffs, but which are provided, thanks to the use of technology, in Telemedicine and which, in any case, maintain the substantial content unchanged;
  2. services already provided by national and regional tariffs, but which, thanks to the use of technology, are performed in ways (in particular in relation to the place, time and duration of observation) that can improve the diagnostic and therapeutic content and strengthen the continuous monitoring.

With reference to Telemedicine activities referred to in a) above, such services should refer to the corresponding description and tariff, assessing in each case - with specific and analytical reference to the use of technology (hardware, software and connectivity) – whether the use of Telemedicine represents an added value for the purpose of changing the tariffs.

With reference to Telemedicine activities referred to in b) above, reference shall always be to the tariff already in force, but the description and value will necessarily be modified in relation to the different content of the service.

The Guidelines on Telemedicine do not provide special provisions about the reimbursement/coverage of costs regarding the use of mobile apps that can combine digital health and telemedicine.

14. Are there specific data protection regulations covering telemedicine (outside the context of using a digital health app) in your jurisdiction? If so, please summarise what they are.

Data protection

Besides the legislation referred to above, there are no other specific data protection laws or regulations relating to telemedicine in the UK. 

For what concerns the protection of the users’ personal data, the relevant provision of the EU Regulation 2016/679 (GDPR), together with the Italian data protection law on the processing of health data, would apply. In this regard, the Italian Data Protection Authority has issued a decision in which it has clarified that the processing of personal data for telemedicine purposes (i.e., where the data is strictly related and necessary for the provision of the healthcare service by the professional) does not require the user’s consent.

Current regulations that impact on telehealth may be subject to amendments post-Brexit to take into consideration the UK no longer being in the EU. For example, the current EU Cross-Border Healthcare Directive (2011/24/EU) (“the Directive”) allows British citizens to access healthcare in other EU countries and provides for mutual recognition of prescriptions between the UK and other EU countries. The UK government implemented provisions of the Directive by the National Health Service (Cross-Border Healthcare) Regulations 2013 and the National Health Service Act 2006 in England. 

To protect against a no-deal, Parliament approved the National Health Service (Cross-Border Healthcare and Miscellaneous Amendments etc.) (EU Exit) Regulations 2019, which revokes the 2013 Regulations and ends rights under the Directive for reimbursement of costs of services provided in another EEA state. The 2019 Regulations will likely come into force on 31 December 2020 if no agreement with the EU to facilitate cross-border arrangements beyond the transition period exists by that time. The 2019 Regulations will retire current cross-border healthcare arrangements giving effect to the Directive in domestic legislation but will also enable residents of England and Wales to access cross-border healthcare in countries with whom reciprocity has been established prior to 31 December 2020. 15 See Paras 2.11 – 2.13 and 7.1 – 7.4 of the Explanatory Memorandum to The National Health Service (Cross-Border Healthcare and Miscellaneous Amendments Etc.) (EU Exit) Regulations 2019.  

Unless an EU-UK healthcare treaty is agreed, then British citizens/UK residents will likely lose the cross-border healthcare rights previously enjoyed under the Directive. A case-by-case determination will therefore need to be considered, depending on what has been agreed between the UK and other countries as at 31 December 2020.

With regard to data protection, after the end of the Brexit transition period on 31 December 2020, the UK will have its own data protection regime, separate to EU law. The UK plans to retain the GDPR in its domestic law with some changes (e.g., replacing references to EU entities such as the European Commission with UK entities such as the Secretary of State). In general, the substance will remain very similar. While the UK has made provision for transfers of personal data from the UK to the EEA to continue, it is not yet clear if the European Commission will make an adequacy decision in respect of the UK. Therefore, businesses wishing to transfer personal data from the EEA to the UK will need to consider how to meet the GDPR requirements in respect of international transfers after the end of the Brexit transition period.

Generally, we anticipate that the scope of regulation of digital healthcare and telemedicine will ultimately widen and incorporate services that are not currently captured by existing regulation.

The Ministry of Health has launched a monitoring system for the various telemedicine programs that have been activated at the regional level. Based on the data collected, an evaluation of the experiences in terms of both effectiveness and cost-effectiveness will be carried out and then the Guidelines and, if necessary, the legislation on Telemedicine will be amended.

The Ministry of Health has also created a working group that will define the ways in which to achieve the complete digitalisation of prescriptions.

Picture of Shuna Mason
Shuna Mason
Partner
London
Elizabeth-Anne Larsen
Elizabeth-Anne Larsen
Senior Associate
London
Picture of Laura Opilio
Laura Opilio
Partner
Rome
Roberto Plutino
Roberto Plutino
Associate
Milan