Key legal aspects of implementing digital therapeutics (DTx) in Belgium

For software solutions in the healthcare sector it is important to consider that the software may constitute a medical device in the sense of the EU Medical Devices Regulation (EU) 2017/745 ("MDR"). In this case, the requirements of the MDR must be observed, including obligations for quality management processes, appropriate conformity assessment procedures and CE marking. If a product is considered as medical device, the legal manufacturer has to comply with all these obligations before the product is placed on the market in Belgium.

The question whether or not the software qualifies as a medical device depends on a number of criteria, e.g. according to the MDR. The definition and the local case law may vary between the countries.

In Belgium, authorities and courts apply the MDR taking into account the available guidance on the EU level (in particular MDCG guidance) and guidance provided by the Belgian regulator, the Federal Agency for Medicines and Health Products (“FAMHP”).

Software will qualify as a medical device in accordance with article 2 of the MDR, if the intended purpose relates to one of the following:

• diagnosis, prevention, monitoring, treatment or alleviation of disease,
• diagnosis, monitoring, treatment, alleviation or compensation of injuries or handicaps,
• investigation, replacement or modification of the anatomy or of a physiological process, control of conception.

The differentiation between a medical device and a consumer product – which does not fall within the scope of the MDR – can largely be influenced by the manufacturer who defines the intended purpose of the respective product. Mere lifestyle/everyday apps (e.g., for fitness tracking, nutritional recommendations, resilience exercises, meditation training without a medical purpose) are generally not intended for therapeutic purposes.

Not only is the explicitly described intended purpose relevant but so are the instructions for use and the promotional materials (e.g., website, information in App Store) regarding the specific product. Possible indicative terms in connection with the intended purpose and corresponding functions can be, for example: alarming, analysing, calculating, detecting, diagnosing, interpreting, converting, measuring, controlling, monitoring, amplifying. Indicative functions for classification as a medical device can be, amongst others, the following: Decision support or decision-making software, e.g., regarding therapeutic measures; calculation, e.g., of dosing of medicines (as opposed to mere reproduction of a table from which users can deduce the dosage themselves); monitoring patients and collecting data, e.g., by measurements if the results thereof have an influence on diagnosis or therapy. Pure data storage, archiving, lossless compression (i.e., using a compression procedure that allows the exact reconstruction of the original data), communication, or simple search functions do not in themselves result in classification as a medical device.

Medical devices are — generally speaking — assigned to risk classes. The classification is decisive for the conformity assessment procedure that the respective product must undergo. The classification is mainly based on the vulnerability of the human body (invasiveness) and takes into account the potential risks associated with the release or exchange of energy (activity) and the duration of use of the medical device. They are assigned to Classes I, IIa, IIb or III, whereby Class I comprises those products with the lowest risk potential.

The classification rules for software devices are listed under annex VIII chapter III, rule 11 MDR. Software can fall into risk class I. However, due to the new interpretation rules this will likely be an exception only. Most software as medical device will be classified as class IIa or higher. This is important from a practical point of view because such software then needs to undergo a conformity assessment procedure applied by a notified body.

Apart from the qualification of the product as such, often companies active in this space also wish to offer services or service components, such as coaching or elements of telemedicine. Here the question arises whether this is legally possible or whether such healthcare services may not be provided unless the manufacturer uses physicians. This requirement can have a big impact on the design of the software and the level of service offered in a country.

The Belgian law of 10 May 2015 on the practice of healthcare professions, defines what falls under the definition of healthcare. Healthcare are any services provided by a healthcare practitioner with a view to promoting, determining, preserving, restoring or improving a patient's state of health, modifying his or her bodily appearance for primarily aesthetic purposes or accompanying him or her at the end of life. The provision of healthcare requires a license either as a physician or as another licensed healthcare practitioner.

The distinction between the healthcare services and other activities that do not require a license is not absolute and not clear-cut, which is why expert opinions are regularly obtained on this question in practice.

As a main consequence, the applicability of the Law on the practice of healthcare professions results in the services provider being required to have the necessary license to provide healthcare services according to Belgian law.

As digital services are not able to obtain such license, it is crucial that a DTx without involvement of natural persons does not engage in providing healthcare services to customers.

In practice, it is thus important to take into account before entering the Belgian market that a medical software may on the one hand qualify as a medical device – entailing the need to a quality management system and the conformity assessment of the device – and on the other hand be aimed at facilitating the provision of healthcare. In the latter case the persons delivering such services must be sufficiently qualified under Belgian law, i.e. normally be doctors able to practice in Belgium.

It is also important to note that doctors cannot be involved in commercial activities.

Since DTx will always create and use health data, data protection and data security are areas of key concern in this context.

If Software processes personal data of the users/patients, it must comply with the applicable data protection regulations, in particular with the EU General Data Protection Regulation (“GDPR”). When processing personal data, the principles contained in art. 5 GDPR, such as the lawfulness and purpose limitation of data processing, data minimization, and the integrity and confidentiality of processing, must be taken into account.

These rules only apply to the processing of data of individuals (regardless of citizenship) residing in the European Union (art. 3 GDPR). If they use the app outside of their jurisdiction, GDPR will still apply if the provider is a company established in the EU.

If data is stored on the device or if data is collected from the users' device and if this is not necessary for providing the service, users must provide additional consent according to the EU “Cookie Directive” (Art. 5 (3) of Directive 2002/58/EU). The Cookie Directive is not just covering cookies but any scenario where the provider stores data on or collects data from a device.

In addition, location tracking is also subject to consent provided it is not an essential part of the service provided.

The GDPR always applies in B2C scenarios. The GDPR also applies in B2B scenarios if the business user is a natural person or if the user is processing personal data of other individuals via the app. If the business user is processing personal data of other individuals (e.g., patients), he or she must ensure that this complies with the GDPR (the legal ground for which will usually be a contract with the individual or consent).

If data is stored on the device or if data is collected from the users' device and if this is not necessary for providing the service, users must provide additional consent according to the EU “Cookie Directive” (Art. 5 (3) of Directive 2002/58/EU). The Cookie Directive is not just covering cookies but any scenario where the provider stores data on or collects data from a device.

A consent is required in accordance with Art. 9 para. 2 letter a) in conjunction with Art. 7 GDPR. It should be noted, however, that according to Art. 7 para. 1 GDPR, the person responsible for data processing must be able to prove the consent of the data subject – regardless of any formal requirements.

Any medical software to be offered on a given market will also need to comply with local requirements in this regard. For instance, in Belgium, controllers processing health data must adopt the following measures:

• keep a list of categories of persons having access to the personal data with a description of their function in relation to the processing of these personal data;
• make this list available to the Belgian Data Protection Authority (“APD”) upon request; and
• ensure those persons are bound by a statutory or contractual confidentiality duty towards the data.

In addition, the APD decided that a data protection impact assessment must be conducted when special categories of personal data within the meaning of Article 9 of the GDPR are exchanged systematically between several controllers.

The Law of 21 August 2008 on the establishment and organization of the eHealth platform should also be considered as compliance with the eHealth operability standards is one of the requirements to be met for medical mobile applications to be reimbursed by the National Institute for Health and Disability Insurance (“NIHDI”) (see below, point 3.a).

Other than the abovementioned legal requirements to be considered when developing DTx and placing it on the market, at the moment, there are no specific key legal requirements under Belgian law. However, some additional conditions apply when considering applying for the reimbursement scheme under compulsory health insurance (see below under point 3).

Advertising measures within the medical devices sector  fall under general advertising rules. In addition, sector specific laws and industry codes of conduct must be taken into account. For products qualifying as medical devices the stipulations of the MDR also apply directly.

The following principles need to be considered and complied with by a DTx provider:

DTx and other medical devices may be promoted to healthcare professionals and also to the general public in Belgium, except for software included in implantable medical devices which cannot be promoted to the public.

The key stipulation for the promotion of medical device is article 7 MDR, which stipulates:

“In the labelling, instructions for use, making available, putting into service and advertising of devices, it shall be prohibited to use text, names, trademarks, pictures and figurative or other signs that may mislead the user or the patient with regard to the device's intended purpose, safety and performance by:

1. ascribing functions and properties to the device which the device does not have;
2. creating a false impression regarding treatment or diagnosis, functions or properties which the device does not have;
3. failing to inform the user or the patient of a likely risk associated with the use of the device in line with its intended purpose;
4. suggesting uses for the device other than those stated to form part of the intended purpose for which the conformity assessment was carried out.”

In the area of medical devices, the use of HCPs’ testimonials and reports of experiences is strictly regulated from both a legal and deontological standpoint. Scientific testimonies based on objective, verifiable data in line with the current state of science are permitted. Patient’s testimonies can also be used provided that these are not made in an abusive or misleading manner. Also, advertising with thank you letters, experience sharing or other forms of gratitude are allowed as long as such advertising is not done in a misleading way. Any advertising measure must also not disguise the advertising character.

Under Belgian healthcare advertising law, the provision of benefits in the context of promoting medical devices is in principle prohibited. According to the law of 25 March 1964 on medicines (the "Law on Medicines"), it is not permitted to granting advantages and benefits to wholesalers, brokers, persons authorized to prescribe or dispense medical devices and to institutions in which the prescription or dispensing of medical devices takes place within the scope of the supply, prescription, or dispense of medical devices. Exceptions exist, in particular, for benefits or promotional gifts that are of negligeable value and that are relevant for the professional activity of the healthcare professional. Such negligeable value is defined by the Belgian “Mdeon Code of ethics” and is limited to a maximum of EUR 50 per gift (VAT included) and EUR 125 (VAT included) per year, per HCP and per company. Another exception are inviting and covering the costs of participation of healthcare professionals for a scientific event, provided that some conditions are met, such as that the event must be of an exclusively scientific nature and that, when the scientific event takes place over several consecutive calendar days or requires an overnight stay, an authorization has been granted by the Minister of public health (represented by Mdeon) prior to the event.

Applying these rather strict rules to the marketing of DTx in Belgium leads to the conclusion that the offering of benefits to healthcare professionals or to patients is only possible to a very limited extent. It would therefore not be allowed to combine the purchase of a DTx with a present, such as a shopping voucher or a combination with a free product.

Test access is permissible in light of the Law on Medicines: the test access is allowed if the main purpose of giving the test access is to allow healthcare professionals to get acquainted with the product or to provide an opinion on the product quality (and not to promote it). A loan of equipment must however be limited in time (the period must not exceed the time needed for the healthcare professionals to get acquainted with the product) and the quantity of provided instruments must be compatible with the purpose of the loan.

Apart from the healthcare advertising rules, the provision of benefits to healthcare professionals must also take into account the doctor’s deontological rules as doctors must remain independent and retain his/her freedom of judgement.

In Belgium, there are several possible routes of distributing a DTx, both to healthcare professionals and to patients.

Medical devices can be distributed through any intermediaries as long as they comply with the legislation on medical devices and are registered with the FAMHP. Guidelines on good distribution practice for distributors of medical devices have also been drawn up by the FAMHP in consultation with professional associations. One exception to the liberalization of the distribution of medical devices concern DTx embedded in implants which must be delivered to final users through (hospital) pharmacies.

Since the distribution is liberalized in Belgium, there are several possible route for distributing, including for example:

• Through hospitals: professional decision support tools are often provided to hospitals and purchased by them, be it directly in tenders.
• To patients or healthcare professionals directly: a DTx product which complies with Belgian law requirements may be provided via an app store and can be downloaded by patients who pay for such product. Software aimed at healthcare professionals may also be distributed like this or also via healthcare organizations.
• Distribution via cooperation partners, such as pharma companies, who would know the Belgian market and have access to potential customers – be it healthcare professionals be it companies – is a further route.
• Through insurers (public or private) who can provide the DTx to their insured.

This Section shall further explore the different options of partnering and cooperating in the distribution and promotion of medical software/DTx and the legal considerations to take.

One example is using a cooperation partner for the promotion of the DTx vis-à-vis physicians, hospitals or insurers. It is important to have the right contracts in place for such cooperation models.

For example, a legal manufacturer of a medical device may want to cooperate with a pharmaceutical company. The latter has experience in addressing healthcare professionals and the necessary staff. This can be an important service provided to the legal manufacturer of the software that does not have the resources to reach healthcare professionals.

Also, when it comes to development of new features or indications partnering with a strategic or financial investor may help. This then goes into the direction of onboarding investors.

Another aspect are white label solutions with insurers who may wish to offer the product as part of their portfolio or even under their own name.

There are two possible payors (routes) for monetizing DTx: the private route (point b) and the public route (point c). The reimbursement process is also explained (under point d).

One big advantage of the private route is that there is a high degree of flexibility in pricing. There are no specific rules defining the prices for medical devices paid by private parties. This is up to the negotiations of the parties and the principle of supply and demand. There is free price setting in the area of medical devices which are not reimbursed by the social security.

The most common private route is the reimbursement of DTx through the sick funds (“mutualités”). Some sick funds reimburse part of the cost of medical applications to their affiliates under the complimentary (non-compulsory) health insurance. These reimbursements are subjects to the conditions set by the relevant sick funds. For example, both Partenamut and the Mutualité Libérale reimburse up to EUR 20 per year for medical applications recognized by mHealthBelgium  or prescribed by a doctor.

One rather obvious route is the payment by the patient. In Belgium, this route is rather difficult because patients in Belgium are traditionally rather reluctant to pay for such products. This is mainly due to the high number of patients being insured with the mandatory public health insurance system. However, in certain fields, where there is a shortage of care, patients may be prepared to pay themselves for digital applications.

Another payment model is offering DTx as part of a private insurance company offering or of an employment benefit. An employer can include a medical app as a benefit to its employees. It is then the employer who pays a certain amount – be it a lumpsum per patient or a certain amount per use – to the provider of the app. For the provider of the DTx this can result in a stable flow of income and enable access to a rather large patient base.

Also, platforms may provide access to DTx products and include them in their offerings.

Patients in Belgium must be insured with a sick fund (“mutualité”). Therefore, it is attractive for a manufacturer of a DTx to gain access to this system.

The sick funds play two roles: (i) they give access to the mandatory health insurance (public) and pay the relevant reimbursement and (ii) they offer complimentary (non-mandatory) health insurance to their affiliates (private – see above, point b).

To fall under the reimbursement scheme of the compulsory health insurance (the NIHDI), DTx must fulfill four conditions:

1. be CE-marked as a medical device and notified to the FAMHP;
2. enable patients to share health-related information from their own environment (with or without sensors) with a healthcare provider;
3. enable a healthcare provider to diagnose, apply therapy or monitor a patient remotely via a medical device designed to be used by the patient in his or her own environment;
4. meet the technical eligibility criteria set by the eHealth platform (a federal public institution), including ensuring eHealth platform interoperability (a federal platform used to share patient data between patients/healthcare providers).

Health services using applications meeting the above criteria may obtain a reimbursement that covers the cost of the applications.  In addition, to be considered for reimbursement, the application must testify of a social and economic added value (clinical evidence and cost-effectiveness ratio: fewer follow-up consultations, fewer complications and fewer hospital readmissions), which will be assessed by the NIHDI. The intention is not to reimburse applications per se, but their use within the context of a specific care process. This financing can be temporary or permanent.

A new procedure applies as of 1 October 2023. Application to the NIHDI for integrating a medical mobile application in the reimbursement system can be submitted by manufacturers/distributors of medical mobile applications, scientific associations, professional organisations and hospitals. After the file has been declared admissible, a working group (made up of representatives of organizations representing the medical profession, paramedical professionals, hospitals, insurances, patients and representatives of universities, beMedTech, Agoria, FAMHP, eHealth, the Federal Public Services of Public Health) evaluates the file within around 6 to 9 months.

Upon positive decision, the proposal will be submitted to the Insurance Committee and possibly to one or more other relevant consultative bodies. The proposal should be validated within 3 months and it should take a further 2 to 6 months for the decision to be formally implemented.

A decision of temporary reimbursement (usually 3 years) can be adopted for innovative applications for which evidence is already available but uncertainties remain. In such case, an interim assessment is scheduled every 18 month and no later than 6 months before the end of the temporary reimbursement period, the applicant must submit a request for definitive reimbursement and an assessment report.

This reimbursement scheme generally takes places through hospitals or general practitioners associations. Usually, the hospital pays the license fees to the provider of the application and usually takes care of the installation of the connected device (if any) at the patient's home. The reimbursement takes place by the payment of a lump-sum from the NIHDI to the hospitals for the overall care provided (including access to the DTx).