Source: https://iclg.com/practice-areas/digital-health-laws-and-regulations/france
Timestamp: 2020-07-07 15:52:28
Document Index: 337719704

Matched Legal Cases: ['§2', '§2', '§2', '§2', '§2', '§4', 'Art. 1245', '§2', 'Art. 28', 'Art. 26', '§4', 'Art. 11']

Digital Health 2020 | Laws and Regulations | France | ICLG
France: Digital Health 2020
ICLG - Digital Health Laws and Regulations - France covers digital health and healthcare IT, regulatory, digital health technologies, data use, data sharing, intellectual property, commercial agreements, AI and machine learning and liability in 24 jurisdictions.
ICLG.com > Practice Areas > Digital Health > France
“Digital health” is not defined under French law. The French Public Healthcare Code (FPHC) exclusively refers to “telemedicine”, defined as a “form of remote medical practice by means of information and communication technologies, which brings one or more healthcare professionals (HCPs) together or with a patient, and, where appropriate, other professionals involved in the patient’s care” (Art. L. 6316-1 FPHC), consisting in teleconsultation, tele-expertise, tele-monitoring, tele-assistance and medical regulation) (Art. R. 6316-1 et seq. FPHC). Various other terms are used by French authorities to refer to concepts related to “digital health”; although they are not strictly defined, they all refer to the digital revolution in healthcare to enable patients and HCPs to (i) better monitor, manage and improve healthcare, (ii) reduce inefficiencies in the delivery of healthcare, and (iii) improve access to treatment and HCPs by reducing costs, increasing quality and personalising healthcare.
Due to the universal access to mobile networks and the increasing use of smartphones, mobile health applications, and notably connected medical devices (MD), are among the key emerging, widely spreading technologies in this area. Healthcare IT solutions intended for HCPs (e.g. clinical decision support, machine learning or predictive analyses) and/or patients (e.g. teleconsultation platforms, webchat for symptom checking, online pharmacies) are examples of booming IT health products. The French government demonstrated its commitment to foster the development of artificial intelligence (AI) in the field of healthcare by launching a national health database (Health Data Hub) on 1 December 2019.
Applicable Regime: the regulatory status of a given healthcare IT product will determine the specific regime, and thus the relevant pre- and post-commercialisation considerations. At this time, the legal framework for approving AI-powered diagnostic devices is not yet settled and generally, the period for MD regulatory review has increased in Europe due to the coming into force of the new MD regulations (cf. §2.6).
Data protection: healthcare IT is likely to involve the collection, storage, transfer and processing of (highly sensitive) personal health data, subject to the General Data Protection Regulation (GDPR) and the French Data Protection Act No. 78-17 of 6 January 1978. French law also provides for additional requirements specifically applicable to healthcare IT (Art. L. 1111-8 and L. 1110-4-1 FPHC, cf. §2.2).
Regulation and reimbursement of telemedicine: in September 2018, the French national security scheme introduced provisions allowing for the reimbursement of certain telemedicine acts (Art. L. 6316-1 et seq. FPHC).
European and French legislators have addressed many aspects of healthcare, ranging from relationships between industrials and HCPs, public health policy and patients’ rights in cross border healthcare to the health products. At the French level, such regulations are mostly codified in the FPHC – e.g. anti-gifts and transparency provisions (Art. L. 1453-1 et seq. FPHC), advertisement of MD (Art. L. 5122 and L.5213-1 et seq. FPHC), medical ethics (Art. R.4127-1 et seq. FPHC), and manufacturing and distribution of medicinal products (Art. L. 5124-1 et seq. FPHC). Provisions from other French codes may, however, apply to specific aspects of healthcare (e.g. respect due to the human body in the Civil Code (FCC), reimbursement schemes in the Social Security Code (FSSC), etc.). Finally, regulatory agencies play an active role in the construction and implementation of guidelines, which aim to improve the comprehension of regularity schemes by the market actors (cf. §2.4).
Regulations on MD: cf. §2.6.
Regulation and reimbursement of telemedicine: cf. §2.6 and through the setting of good practice guidelines (HAS’ guidelines published in May 2019).
Regulations on electronic medical records (dossier médical partagé – DMP): creation of a digital health record that stores and secures patients’ health data, starting in the summer of 2021 (Art. L. 1111-14 and seq. FPHC and R.1111-26 and seq. FPHC).
Regulations on data protection: see §4.
There is no specific regulatory scheme for “consumer devices” as a standalone category. General regulations cover various aspects of the life cycle of consumer devices – e.g. the French Consumer Code addresses the relationship between professional providers and consumers; defective product liability regulations are applicable to defective consumer devices (Art. 1245 et seq. FCC).
The line between wellness consumer devices (e.g. diet app, sport assistant watch) and MDs with a medical purpose, which are subject to a specific regime (§2.6), may be difficult to draw.
Directorate General for Care Provision (DGOS): reports to the French Ministry of Health and plays the role of interface with healthcare institutions. It must notably ensure quality, continuity and proximity of the care.
National Agency for the Safety of Health Products (ANSM): key agency notably responsible for authorising clinical trials, monitoring adverse reactions related to health products, inspecting establishments engaged in certain activities and authorising health product imports. The ANSM regularly publishes influential guidelines and situational analyses and may impose administrative sanctions.
Data Protection Authority (CNIL): responsible for ensuring the protection of personal data. Its role is to alert, advise and inform the public, and it also has power to control and sanction through the issuance of injunction and fines to data controllers.
National Health Authority (HAS): notably responsible for the pricing and reimbursement of health products and the optional certification of prescription assistance software. The HAS regularly publishes guidelines, some of which are specific to digital health.
Regional Health Agencies (ARS): responsible for regulation of healthcare provision at the region level, including implementation of a digital health policy.
National Digital Health Agency (ANS): responsible for assisting the State in implementing digital health regulation, specifically by issuing recommendations and guidelines regarding security and interoperability, as well as by developing health software and projects.
Defective MDs: the sector of MD is under close scrutiny. Manufacturers of connected implants and high-risk medical assistance software are exposed to product liability claims.
Data Protection: digital health likely involves the processing of personal health data, considered as highly sensitive. Failure to meet data protection requirements may therefore result in severe sanctions, such as an injunction to stop the data processing or fines up to EUR 20,000,000 or 4% of total worldwide annual revenue, which can be publically issued.
Regulatory Requirements: access to the market may depend on stringent regulatory requirements. For example, the ANSM has already suspended the placing on the market, and prohibited the distribution, of a software wrongly marketed as a consumer device when it should have been certified as a MD (ANSM Decision of 12 January 2015).
Like other MDs, software is subject to pre- and post-commercialisation requirements (CE-marking, materiovigilance, etc.) set forth by (i), at the European level, Regulation (EU) 2017/745 on MD (MDR) or Regulation (EU) 2017/746 on in vitro diagnostic MD (IVDR) (that will enter into full force respectively in May 2020 and May 2022 and are directly enforceable in France) and (ii), at the French level, by the FPHC (e.g. provisions on advertisements Article L.5213-1 et seq. FPHC). The new regulations notably reinforce the rules on clinical performance evaluation of MDs.
To clarify this regulatory scheme, regulatory authorities have issued guidelines tailored to software as an MD (e.g. the MD Coordination Group of the European Commission issued guidelines on qualification and classification of concerned software in October 2019 MDCG 2019-11 – formerly MEDDEV guides; the HAS issued guidance on the assessment of connected MD for reimbursement purposes in February 2019).
Depending on the telehealth product or service, different legal regimes may apply, mainly the telemedicine or online pharmacies regulatory requirements, as well as the medical devices regulations.
Health data protection and security requirements, as well as the issue of liability and reimbursement of such products or services, are key.
Robotics are at the crossroads of several potential legal regimes. The liability issue is of great importance and must be clearly allocated between the involved parties, and must take into account the legal regime of product responsibility. Depending on the features, medical devices regulations may also apply.
The monitoring involved by wearables, specifically when collecting precise and daily information that can reveal health status, requires strict compliance with data protection laws. Depending on the features, medical devices regulations may also apply.
The monitoring involved by virtual assistants, depending on the way they can be activated and how they record information, and use of AI technologies in order to train virtual assistants, requires strict compliance with data protection laws and security requirements and triggers some questions regarding algorithms transparency.
Data protection and security requirements, specifically for health and/or monitoring apps, as well as the issue of liability, are key. Depending on the features, medical devices regulations may also apply.
Medical devices, as well as health data protection, including additional public health requirements regarding interoperability and security, will apply. Proper allocation of liability is key.
Training an AI requires processing of large amounts of personal data and, depending on the features, of health data, triggering compliance requirements with data protection and security, specifically for sensitive data. Algorithms transparency and IT security must be ensured. Depending on the features, medical devices regulations may also apply.
Data protection and security requirements, specifically for health and/or monitoring devices, as well as the issue of liability, are key. Depending on the features, medical devices regulations may also apply.
Natural language processing is at the crossroads of AI and personal data processing. Algorithms transparency, data protection compliance, and in some cases, medical devices regulations are key. Depending on the service using such processing, the issue of illegal practice of medicine can be relevant.
Providers may face specific regulatory constraints depending on the nature of the services they offer. Online sale of medicines is, for example, subject to stringent requirements under French law (only pharmacies may sell medicines; online sale is limited to over-the-counter drugs), which are strictly interpreted by French courts (see Cour de cassation 19 June 2019 n° 18-12.292). “Telemedicine” platforms may not publish advertising that conflicts with medical ethics (notably, French law prohibits medical practice as a business). By contrast, medical information platforms are not related to a medical activity per se and thus are subject to general regulation.
Security requirements are higher for digital health platform providers (e.g., if medical data are processed, such providers may only use the services of a certified health data hosting service provider (Art. L. 1111-8, FHPC), and must comply with IT guidelines, especially regarding health data access (Art. L. 1110-4-1, FHPC).
Personal data are subject to the GDPR, and its key principles, mainly of lawfulness, are fairness, transparency, proportionality, purpose limitation and data minimisation, and are subject to the French Data Protection Act requirements, specifically regarding health data.
Data protection laws apply regardless of the nature of the entities, whether public or private. However, some entities may be subject to derogations depending on the importance of the data processing operations (e.g. SMEs).
In order to carry out personal data processing, the data controller must implement compliance steps:
to maintain a record of processing activities under its responsibility;
to inform the individuals of the existence of the processing; and
to ensure that the agreements entered into contain adequate provisions in order to properly determine capacities of the parties and allocate roles and responsibilities.
As special categories of data, health data are also subject to specific requirements under the GDPR and additional national obligations:
processing of health data is, by principle, prohibited, except where based on a specific legal ground (such as prior and express consent, or where necessary, for purposes of preventive medicine, medical diagnosis, provision of health or social care, etc.);
health data processing must, in addition, be justified by a public interest and be authorised by the French Data Protection Authority, unless it falls under some exceptions; and
organisational and technical security measures must be adapted to the level of data sensitivity (encryption, access monitoring, pseudonymisation or even anonymisation).
Scope of data use is determined, to the extent that the data processing must be lawful, in view of its purpose and of the conditions of implementation of the data processing operations.
Some specific restrictions must be highlighted, for instance the prohibition to sell health data that are directly or indirectly identifiable (Art. L. 1111-8, VII, FPHC), or the prohibition to use health professionals’ information extracted from medical prescriptions (Art. L. 4113-7, FHPC).
Regarding business-to-business relationships, the requirement to enter into an agreement depends upon the capacities of the stakeholders:
in a data controller and data processor relationship, an agreement must be entered into, the provisions of which are expressly defined by the GDPR (Art. 28). Security requirements are of the essence;
in a joint data controller relationship, an agreement must be entered into (Art. 26), the provisions of which are not specifically defined. However, it is highly recommended to precisely allocate the roles and responsibilities of the parties, depending on the actual level of involvement; or
in an independent controller relationship, an agreement is not required, but may be recommended if material personal data exchanges are taking place.
Regarding business-to-consumer relationships, the obligation for the data controller to provide relevant information to the individuals, and, in some cases, to obtain their express consent, has an impact on the contractual documents with individuals. Lack of such information may lead to the impossibility to use personal data in a lawful manner.
Data protection laws, as well as specific requirements regarding sharing of medical data, specifically where covered by medical secrecy, are applicable.
Data protection laws apply regardless of the nature of the entities, whether public or private, except where requirements are specifically applicable to health professionals.
Sharing personal data must always be subject to entering into an agreement (cf. §4.5) and to adequate security measures during transmission.
Personal data transfers to recipients located outside the EU, in a third country that does not ensure an adequate level of protection, must be covered by appropriate safeguards, the most common of which are data transfers agreements (standard contractual clauses adopted by the EU Commission).
If data is covered by medical secrecy (Art. L. 1110-4 FHPC), a specific regime for “shared medical secrecy”, it generally requires patient consent to share its medical data with any third party outside of the healthcare team (Art. L. 1110-12 FHPC).
As in other jurisdictions, in order to be covered by a patent issued by the French Industrial Property Office (INPI), an invention must be new, involve an inventive step and have an industrial application. In principle, computer programs and mathematical methods are not patentable per se (Art. L. 611-10 French Intellectual Property Code – FIPC). Abstract ideas and mathematical formulas may not be subject to patent protection. However, a computer program that produces a “technical effect” and certain AI-related inventions directed to a technical subject-matter, providing a non-obvious technical solution of a technical problem (e.g. a neural network in a heart-monitoring apparatus for detecting irregular heartbeats) may be patentable. Patents offer strong protection, but are limited in scope to the patent claims, and the protection is of limited duration (20 years). Additionally, patent protection requires public disclosure of the invention as patent application is published 18 months after filing of the patent.
Copyright protects an original work in a fixed form (Art L.112-1 of the FIPC). Ideas, concepts or mathematical formulas may not be subject to copyright. A software’s architecture, source code, object code and preparatory design material is eligible for copyright protection, but not the algorithm. In addition to economic rights, the copyrights’ holder benefits from certain moral rights which are perpetual, inalienable and not subject to statutes of limitation, whereas economic rights last 70 years after the author’s death or after the works’ disclosure where it belongs to a legal person. The original work is protected without formalities from the day it is created, whatever its form, nature, merits or destination.
In 2016, European Commission enacted Directive (EU) No. 2016/943 of 30 July 2018. In France, information protected under trade secrets is defined as any information that is: (i) not generally known or easily reachable by specialists of the matter; (ii) of commercial value, actual or potential, because of its secret nature; and (iii) subject to reasonable protective measures by its legitimate holder to keep it secret (Article L 151-1 to L 154-1 of the French Commercial Code). Trade secret protection may apply to a company’s algorithms.
There is no specific academic technology transfer rules scheme applying to healthcare IT. In 2019, France Biotech, an industry association, began to develop tools (negotiation process, templates, access to existing agreements) to facilitate and accelerate technology transfer and, in collaboration with BPI France, have begun to study and suggest improvements to the technology transfer process.
Intellectual property protection for Software as a Medical Device (SaMD) will depend on the features and functionality of the product, as well as the nature of the specific market. A particular SaMD may be protected simultaneously by more than one type of intellectual property protection (patent, copyrights, trade secret, trademarks, design).
The main consideration is to define a clear intellectual property scheme regarding the results generated during a partnership, depending on the allocation of the responsibility between the parties as defined in the development plan. In the case of academics being involved, they frequently request joint ownership of results, independent of inventorship.
There are many considerations to assess in negotiating agreements in the field of digital health: ensuring business continuity with respect to the product, warranties on the compliance/regulatory capabilities, cross borders concerns and data breach indemnity.
Machine learning holds a rising position in the digital health sector, in order to assist health professionals in their daily practice as well as in research. AI can provide assistance in decision-making as well as make the decision itself, but only under very strict circumstances (e.g. express consent of data subjects).
Training data can only be protected by intellectual property right as an entire database if it is original, or, if not, if the owner can demonstrate a substantial investment in obtaining, verifying and presenting data. In this regard, training data can be licensed, subject to compliance with regulatory requirements.
The author of a creation is a natural person and protection automatically arises (see question 6.2). Regarding computer programs, rights may be vested in a company employing the author if the employee has acted in execution of his duties or following the employer’s instructions. The European Patent Office has already refused patent applications designating an AI as inventor (January 2020).
In addition to securing the necessary rights to use training data, data integrity and reliability are key considerations, as well as obtaining transparency guarantees regarding machine-learning algorithms.
Civil liability: the producer of the device can be found liable on the basis of defective product liability, where a person suffers harm from the use of a defective digital health product or service (e.g. if the software malfunctions or delivers incorrect results). Claims may also be brought against economic actors involved in the manufacturing and/or distribution of digital health products under fault-based regimes.
Criminal liability: manufacturers, distributors, users and other actors involved in digital health may be liable on the ground of specific offences described in the FPHC or ordinary offences (e.g. involuntary manslaughter).
Regulatory liability: manufacturers may be exposed to administrative sanctions imposed by regulatory authorities if they fail to meet regulatory requirements related to or resulting in adverse outcomes in digital health.
There are many cross-border considerations likely to impact the business model of industrials engaging in the field of digital health, including:
Cross-border healthcare: Directive 2011/24/EU on patients’ rights in cross-border healthcare sets out the conditions under which a patient may receive medical care from a HCP located in another EU country – it covers healthcare costs, as well as the prescription and delivery of medications and MD.
MDs and local representation: in order to place a MD in the EU market, a non-EU manufacturer must designate an “authorised representative” (Art. 11, MDR).
Transfer of data: see question 5.2.
Storage of data (see question 3.2), access and protection (data anonymisation, cybersecurity, etc.) and complying with consent withdrawal are key.
The healthcare market is a complex sector, marked by a multiplicity of actors (industrials, HCPs, regulators, patients, social security scheme, hospitals, etc.) and a high level of normativity (regulatory barriers to entry to the market, liability exposure, etc.).
A threshold consideration is whether the healthcare IT will provide the necessary features, functions and tools to meet the market needs, as well as compliance and regulatory requirements with the abovementioned.