Key legal aspects of implementing digital therapeutics (DTx) in Hungary

Product qualification for software solutions in the healthcare sectoris crucial as if a software qualifies as a medical device (“MDSW”), the software itself may be subject to the medical device regulations. Software can be considered a medical device provided that it falls under the definition of Act CLIV of 1997 on Healthcare (“Healthcare Act”). The definition of medical device in the Healthcare Act has been amended in line with Regulation (EU) 2017/745 on medical devices (“MDR”) and the EU In Vitro Diagnostic Medical Devices Regulation (“IVDR”) for harmonisation purposes. 

The primary decisive factor is the product’s intended purpose as described by the manufacturer of the software. Other decisive factors are regulated in the MDR and the IVDR. E.g., if the software is intended to process, analyse, create or modify medical information, it may be qualified as MDSW, provided that it is governed by a medical intended purpose. Therefore, it is important that manufacturers carefully classify the software and pay close attention to any local guidelines published that clarify the classification criteria contained in the MDR and the IVDR. Furthermore, the requirements of the MDR must be observed, including obligations for quality management processes, appropriate conformity assessment procedures and CE marking. If a product is considered as medical device, the legal manufacturer has to comply with all these obligations before the product is placed on the market in Hungary.  

In Hungary, authorities and courts apply the MDR taking into account the available guidance on the EU level (in particular MDCG guidance) and guidance provided by the Hungarian authority (legal predecessor: the National Institute of Pharmacy and Nutrition (OGYÉI), as of 1 August 2023, the National Centre for Public Health and Pharmacy (NNGYK)). 

Section 3 point h) of the Healthcare Act defines medical device by reference to Article 2 point (1) of the MDR. Pursuant to Article 2 point (1) of the MDR, medical device means any instrument, apparatus, appliance, software, implant, reagent, material or other article intended by the manufacturer to be used, alone or in combination, for human beings for one or more of the following specific medical purposes: 

• diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease; 
• diagnosis, monitoring, treatment, alleviation of, or compensation for, an injury or disability; 
• investigation, replacement or modification of the anatomy or of a physiological or pathological process or state; or 
• providing information by means of in vitro examination of specimens derived from the human body, including organ, blood and tissue donations, 

and which does not achieve its principal intended action by pharmacological, immunological or metabolic means, in or on the human body, but which may be assisted in its function by such means. 

The differentiation between a medical device and a consumer product – which does not fall within the scope of the MDR – can largely be influenced by the manufacturer who defines the intended purpose of the respective product. Mere lifestyle/everyday apps (e.g., for fitness tracking, nutritional recommendations, resilience exercises, meditation training without a medical purpose) are generally not intended for therapeutic purposes.  

Not only is the explicitly described intended purpose relevant but so are the instructions for use and the promotional materials (e.g., website, information in App Store) regarding the specific product. Possible indicative terms in connection with the intended purpose and corresponding functions can be, for example: alarming, analysing, calculating, detecting, diagnosing, interpreting, converting, measuring, controlling, monitoring, amplifying. Indicative functions for classification as a medical device can be, amongst others, the following: Decision support or decision-making software, e.g., regarding therapeutic measures; calculation, e.g., of dosing of medicines (as opposed to mere reproduction of a table from which users can deduce the dosage themselves); monitoring patients and collecting data, e.g., by measurements if the results thereof have an influence on diagnosis or therapy. Pure data storage, archiving, lossless compression (i.e., using a compression procedure that allows the exact reconstruction of the original data), communication, or simple search functions do not in themselves result in classification as a medical device. 

Medical devices are – generally speaking – assigned to risk classes. The classification is decisive for the conformity assessment procedure that the respective product must undergo. The classification is mainly based on the vulnerability of the human body (invasiveness) and takes into account the potential risks associated with the release or exchange of energy (activity) and the duration of use of the medical device. They are assigned to Classes I, IIa, IIb or III, whereby Class I comprises those products with the lowest risk potential. 

The classification rules for software devices are listed under annex VIII chapter III, rule 11 MDR. Software can fall into risk class I. However, due to the new interpretation rules this will likely be an exception only. Most software as medical device will be classified as class IIa or higher. This is important from a practical point of view because such software then needs to undergo a conformity assessment procedure applied by a notified body.  

The detailed rules for medical devices in Hungary are included in Decree 4/2009. (III. 17.) of the Minister of Health on medical devices and ESzCsM Decree 8/2003. (III. 13.) on in vitro diagnostic medical devices, which have also been updated and amended in line with the MDR and IVDR. 

Furthermore, as per product classification, it should be noted that medical devices that can be given to the lay end users for personal use qualify as medical aids in Hungary and are subject to a special legal regime.  

Apart from the qualification of the product as such, often companies active in this space also wish to offer services or service components, such as coaching or elements of telemedicine. Here the question arises whether this is legally possible or whether – as is the case for instance in Hungary, such healthcare services may not be provided unless the manufacturer uses physicians. This requirement can have a big impact on the design of the software and the level of service offered in a country.  

Under Hungarian law, Act CLIV of 1997 on Health Care (the “Healthcare Act”) defines in a lengthy definition what is to be considered healthcare service. According to the provision, healthcare service shall be “all healthcare activities that may be carried out in possession of an operating license issued by the government healthcare administration body or - in cases provided for by legislation - upon registration by the government healthcare administration body, intended to preserve the health of the individual and the prevention and early diagnosis of diseases for the purpose of treatment, averting a threat to life, improving the condition resulting from the disease or preventing further deterioration, aimed at the examination and treatment, care, nursing, medical rehabilitation, reduction of pain and suffering, and for processing the patient’s test materials in the interest of the above, including the activities governed by specific other legislation related to medicinal product, medical aids and medical care, as well as rescue and patient transport, obstetric care, special human reproduction procedures, sterilization, medical research in human subjects, as well as post-mortem examination, medical procedures related to dead bodies, including the related activities provided for in other legislation related to the transportation of dead bodies”. The provision of healthcare requires a license either as a physician or as another licensed healthcare practitioner. 

The applicability of the Healthcare Act results in the acting persons or service provider being required to have the necessary license to provide healthcare service according to Hungarian law.  

As digital services are not able to obtain such license, it is crucial that a DTx without involvement of natural persons does not engage in providing healthcare services to customers. 

In practice, it is further important to take into account before entering the Hungarian market that a medical software may on the one hand qualify as a medical device and on the other hand qualify as a medical aid, as these qualifications must adhere to different set of rules.  

Since DTx will always create and use health data, data protection and data security are areas of key concern in this context. Any medical software to be offered on a given market will need to comply with the General Data Protection Regulation (GDPR) and special Hungarian legal requirements. 

General data protection and data security rules 

If Software processes personal data of the users/patients, it must comply with the applicable data protection regulations, in particular with the EU General Data Protection Regulation (“GDPR”). When processing personal data, the principles contained in art. 5 GDPR, such as the lawfulness and purpose limitation of data processing, data minimization, and the integrity and confidentiality of processing, must be taken into account. 

These rules only apply to the processing of data of individuals (regardless of citizenship) residing in the European Union (art. 3 GDPR). If they use the app outside of their jurisdiction, GDPR will still apply if the provider is a company established in the EU.  

If data is stored on the device or if data is collected from the users' device and if this is not necessary for providing the service, users must provide additional consent according to the EU “Cookie Directive” (Art. 5 (3) of Directive 2002/58/EU). The Cookie Directive is not just covering cookies but any scenario where the provider stores data on or collects data from a device. 

In addition, location tracking is also subject to consent provided it is not an essential part of the service provided. 

The GDPR always applies in B2C scenarios. The GDPR also applies in B2B scenarios if the business user is a natural person or if the user is processing personal data of other individuals via the app. If the business user is processing personal data of other individuals (e.g., patients), he or she must ensure that this complies with the GDPR (the legal ground for which will usually be a contract with the individual or consent). 

A consent is required in accordance with Art. 9 para. 2 letter a) in conjunction with Art. 7 GDPR. It should be noted, however, that according to Art. 7 para. 1 GDPR, the person responsible for data processing must be able to prove the consent of the data subject – regardless of any formal requirements. Since recordings of the video consultation hour are not permitted, at least electronic documentation of the declaration of consent will be required if the written form is not used. 

The DTx also must comply with the data security requirements of the GDPR (article 32).  

Special rules for medical devices and medical software products 

The Hungarian Act on processing health data (Act XLVII of 1997, section 4) stipulates that health data and identifying data can be processed only for the purposes listed in the Act, among other for protecting, maintaining health, tracking the data subject’s health conditions. For purposes other than listed therein health data can be processed only with the consent of the data subject, which the data controller shall be able to prove.  

The MDR contains the safety criteria of the medical devices. The manufacturer must determine minimum requirements for hardware, information technology networks, information technology security measures for ensuring the appropriate operation of medical software including protection against illegal access. 

If the medical device (including software as a medical device) will be funded from the social security fund, the device must be registered as device supported from the social security fund. When deciding on the request submitted, ISO 9001 or similar certificate will be taken into consideration. 

On the one hand, advertising measures are regulated under the general advertising act i.e. Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities (the “Advertising Act”). For products qualifying as medical devices the stipulations of the MDR also apply directly and the sector-specific codes such as the MedTech Code shall be taken into account as well.  

The following principles need to be considered and complied with by a DTx provider: 

DTx and other medical devices may be promoted to healthcare professionals and also to the general public in Hungary. There is no prohibition to promote medical devices towards laypersons.  

The key stipulation for the promotion of medical device is article 7 MDR, which stipulates: 

“In the labelling, instructions for use, making available, putting into service and advertising of devices, it shall be prohibited to use text, names, trademarks, pictures and figurative or other signs that may mislead the user or the patient with regard to the device's intended purpose, safety and performance by: 

1. ascribing functions and properties to the device which the device does not have; 
2. creating a false impression regarding treatment or diagnosis, functions or properties which the device does not have; 
3. failing to inform the user or the patient of a likely risk associated with the use of the device in line with its intended purpose; 
4. suggesting uses for the device other than those stated to form part of the intended purpose for which the conformity assessment was carried out.” 

When it comes to the advertising of remote treatment, Hungarian legislation does not contain special provisions for the advertising of telemedicine.  

On the other hand, in the case of medical aids, Act XCVIII of 2006 on the General Provisions Relating to the Reliable and Economically Feasible Supply of Medicinal Products and Medical Aids and on the Distribution of Medicinal Products (the “Medicines Thrift Act”) contains specific provisions concerning lawful communication. The advertising of medical aids subsidized under the social security system is prohibited by the Medicines Thrift Act. Promotion towards healthcare professionals is also strictly regulated regarding medical aids.

Under Hungarian healthcare advertising law, if the medical software is a medical device or IVD medical device, but is not considered a medical aid, the rules of the Advertising Act apply. In this context, the general prohibitions on advertising must be taken into account, e.g., it is prohibited to advertise a free gift, discount, rebate, benefit, advantage or prize draw in connection with the sale of a product in conjunction with a product demonstration.  

The provision of benefits in the context of promoting medical aids is in principle prohibited. According to Section 14(1) of the Medicines Thrift Act, it is not permitted to provide, offer, or promise gifts, pecuniary advantages or other material benefits to healthcare professionals either directly or indirectly, unless any of the exceptions provided in the same article apply. Such exceptions exist, in particular, for benefits or gifts that are of low value if other conditions are also met. 

Applying these rather strict rules to the marketing of DTx that qualifies as medical aids in Hungary leads to the conclusion that the offering of benefits to healthcare professionals or to patients is only possible to a very limited extent.  

Apart from the healthcare advertising rules, the provision of benefits to healthcare professionals can also create issues under the professional code of doctors and even the criminal code. According to these rules, providing material and immaterial benefits to healthcare professionals is considered critical, in particular if such benefit is provided in order to make the healthcare professional prefer the respective product in an undue manner.  

One example is using a cooperation partner for the promotion of the DTx vis-à-vis physicians, hospitals or insurers. In Hungary such cooperation models are on the rise, and it is important to have the right contracts in place for that.  

For example, a legal manufacturer of a medical device may want to cooperate with a pharmaceutical company. The latter has experience in addressing healthcare professionals and the necessary staff. This can be an important service provided to the legal manufacturer of the software that does not have the resources to reach healthcare professionals. The typical basis for such cooperation is a contract which has certain elements of a co-promotion agreement known from the pharmaceutical industry.  

Also, when it comes to development of new features or indications partnering with a strategic or financial investor may help. This then goes into the direction of onboarding investors.  

Another aspect are white label solutions with insurers who may wish to offer the product as part of their portfolio or even under their own name. 

In Hungary, there are several possible routes of distributing a DTx, both to healthcare professionals and to patients. 

One possibility is to provide downloads for patients. A DTx product which complies with Hungarian law requirements may be provided via an app store and can be downloaded by patients who pay for such product. Software aimed at healthcare professionals may also be distributed like this or also via healthcare organizations.  

Another possible route is the provision of a DTx to employees by way of employee benefit programmes. The manufacturer would then offer the DTx to an organization, e.g. a large company, which would enable access for its employees.  

Distribution via cooperation partners, such as pharma companies or specialized promotion companies, who would know the Hungarian market and have access to potential customers – be it healthcare professionals be it companies – is a further route. 

Finally, developing the app and requesting the medical aid to be subsidized by the social security system is a further way of distributing and getting reimbursed a medical app in the Hungarian healthcare system.  

Professional decision support tools are often provided to hospitals and purchased by them, be it directly in tenders. 

The special public procurement rules regarding medical devices are contained in Government Decree No. 6/2012 (II. 16.) on the specific rules of public procurement of medicinal products and medical devices. 

In certain fields, where there is a shortage of care, patients may be prepared to pay themselves for digital applications.  

Also, it is possible to find ways to get reimbursement from insurance companies, be it public or private ones.  

We have also seen projects in which insurance companies integrate certain DTx into their portfolio and offer such solutions in certain packages to their insured.  

Also, platforms may provide access to DTx products and include them in their offerings. 

Another payment model that has gained momentum in Hungary recently is offering DTx in employment benefit programmes. An employer can include a medical app as a benefit to its employees. It is then the employer who pays a certain amount – be it a lumpsum per patient or a certain amount per use – to the provider of the app. For the provider of the DTx this can result in a stable flow of income and enable access to a rather large patient base.  

Lastly, in Hungary there is the possibility to have the DTx recognized as a subsidized medical aid from the social security system. Once the medical app is recognized and authorized as a subsidized medical aid, it can be prescribed by a doctor and is then reimbursed by the public healthcare system. 

In Hungary there is a big difference between the private route of reimbursement and the public route.  

One big advantage is that there is a high degree of flexibility in pricing unless the device is subsidized by the social security system. There are no specific rules defining the prices for medical devices paid by private parties. This is up to the negotiations of the parties and the principle of supply and demand. Unlike for healthcare services, which are regulated, there is free price setting in the area of medical devices.

Once the product that qualifies as a medical aid is recognized by the Hungarian social security system, it can be expected that there will be a certain flow of patients and related payments.  

In order to be able to take this route, a special contractual arrangement must be concluded with the public sick fund i.e. National Health Insurance Fund (Hungarian abbreviation: NEAK). The regulations in this regard are quite detailed.  

Procurement of medical devices by the public healthcare providers in Hungary is performed through tendering procedures. The Hungarian public procurement threshold is net HUF 15 million (approx. EUR 40,000). Special public procurement rules apply to medical devices that are contained in Government Decree No. 6/2012 (II. 16.) on the specific rules of public procurement of medicinal products and medical devices. 

In Hungary, a DTx which qualifies as a subsidized product after a complex approval process – can be prescribed by a doctor and is then reimbursed by the public sick fund.