e-health Europe

You don’t have to be an avid reader of the British Medical Journal to know that healthcare providers in the UK and throughout Europe are under increasing financial strain. A potent combination of changing demographics, rising chronic disease and hard-hitting budget cuts is forcing the medical profession to seek out alternative and more cost-efficient models of healthcare provision. And proponents of e-Health believe they have found the answer.

E-Health is a relatively new “umbrella” term used to describe all medical services and products which are delivered via telecommunications technologies. By harnessing the power of technology, healthcare providers (“HCPs”) hope to maximise efficiency, reduce costs and improve access to healthcare, particularly in remote areas.

The range of e-Health services and products being developed is vast. Medical consultations carried out by video link make medical treatment more accessible, saving time and money for patients in rural communities. Mobile technology can be used to remotely monitor patients with chronic diseases, reducing the need for hospital check-ups (and having a knock-on effect on waiting lists). In years to come, mobile phones and the internet could be used to track infectious diseases on a global scale and to impose “behavioural interventions” on individuals most at risk, with the aim of preventing infection.

The potential benefits of e-Health both for HCPs and patients are unquestionable. For businesses, the potential gains to be made by investing in e-Health are equally significant. With the global digital health market set to grow between $40 and $70bn by 2018, and the European market alone being estimated to be worth more than £40bn per annum, it’s no wonder many existing lifesciences companies and new entrants are turning their focus towards the e-Health marketplace.

So where’s the hitch?

A number of perceived legal issues have been blamed for slowing down the roll out of e-Health in Europe. A stringent Data Protection regime and unclear regulation of e-Health products and services are often cited as key barriers, leading some commentators to question whether the current law is flexible enough to encourage continued investment in e-Health. However, in many cases these so-called “barriers” may be more accurately described as hurdles which can be over-come through proper planning and preparation.

Data Protection – consent, security and international data transfer

Almost all forms of e-Health involve the use and transmission of patient health data. Under the European Data Protection regime, an individual’s health data is classed as “sensitive personal data” and, generally speaking, use of that data requires the patient’s explicit consent. The current exemptions in the Data Protection Act protect use and transfer of personal data by a health professional practitioner for the purposes of providing medical treatment. However e-Health products and services often involve transmission of data to or between service providers who are not health professionals and who may not be providing medical treatment. Consequently this exemption may not be sufficiently wide to permit such data transfers. It is therefore necessary to ensure that the explicit consent of the patient to all transfers and storage of personal data for e-Health purposes is appropriately documented in advance.

This requirement to give detailed consideration to consenting is bolstered by the new draft European Data Protection Regulation (“Regulation”) which will come into effect within the next year or two. The Regulation intends to bring about a culture change in the way that we approach patient privacy and champions the idea of “privacy by design”. The current practice of “opting-out” will no longer be sufficient. E-Health companies and healthcare providers alike will need to build privacy and data protection compliance into their e-Health projects from the outset. The processes for obtaining consents will need to be thought through and the consents themselves to be wide enough to accommodate all potential transfers and uses of the health data, including international data transfers and cloud storage, where applicable. Considering these issues early as a key project priority will reduce the risk of falling foul of the data privacy regime further down the line, and help ensure project success.

In the midst of the media concern over the proposed changes to the data protection regime, many commentators have overlooked the Regulation’s potential to boost Europe’s global competitiveness in the e-Health arena. It shouldn’t be forgotten that one of the primary aims of the Regulation is to reduce the administrative and legal burden for businesses by introducing one European regulator for data protection, in place of the current 28 national regulators. This, coupled with the fact that health data in Europe is typically held within public sector healthcare providers, gives Europe a significant advantage over other jurisdictions where health data is less accessible for use in medical research and in developing commercial e-Health based solutions. In America, for example, businesses often have difficulty accessing patient data because it is held by private hospitals, which are in turn owned by insurance companies with their own vested interests in the data. Europe has the potential to become host to invaluable data banks which are subject to a single Data Protection regime and the data from which might be utilised by businesses across European borders (e.g. via implementation of binding corporate rules).

Finally, data security has been another concern for those involved in the e-transmission of personal data. Recent high-profile hacking and snooping scandals have cast doubt on the security of sensitive information held online. The law requires data controllers to ensure that data processors have adequate security measures in place to protect the data and restricts transfers of personal data outside the European Economic Area other than in certain fairly narrow circumstances. Owing to technological advances, such as the storage of personal data in remote servers and the Cloud, the question of whom and where the data processor is has become less clear cut. In the case of data processing “giants”, such as DropBox, the waters becomes murkier still.

However, so long as businesses and HCPs have the foresight to ensure their legal position is protected through robust data processing agreements before embarking on e-Health initiatives which require the transfer of personal data, security obligations should not be an insurmountable obstacle. Particular care should be taken if a cloud provider offers a “take it or leave it” set of terms and conditions with no opportunity to negotiate. Cloud customers should push back to retain sufficient control over the data and to ensure compliance with their Data Protection obligations.

Unclear regulation

The rise of mobile medical devices is blurring the boundaries between several historically distinct sectors: healthcare, telecommunications and consumer products. Each of these sectors is heavily regulated; each has its own independent regulatory regime and its own distinct regulator. Ensuring compliance with all relevant regulatory obligations requires foresight, diligence and detailed planning.

A further development over recent years has been the rise in the number of big retailers and traditional technology providers taking an interest in the e-Health market (Tesco and Vodafone being but two such examples). For these “non-lifesciences” companies, and even for those well versed in the medical device sector, working out the proper regulations which need to be followed for a particular digital product or service can pose a serious compliance challenge. When does your Nike heart rate monitor, sold for use at the gym, but capable of performing similar functions to an ECG, become “medical device” for regulatory purposes? Additional regulation and guidance would surely help to alleviate some of these challenges and this is an issue which will hopefully be addressed in due course.

Summary

In summary, there are undoubtedly legal obstacles to the development of e-Health in Europe. The law may well require some modernisation to align it with technological advances. However, the law need not sound the death knell for companies focusing on the e-Health sector. Successful e-Health initiatives, such as the Telemedicine Clinic based in Barcelona which provides teleradiology services to hospitals throughout Europe, show that e-Health can be the next frontier in the provision of healthcare. Businesses in Europe wishing to invest now to get ahead of the game should do so, but should embark on their endeavours with an “eyes open” approach to the legal hurdles that they may need to manoeuvre.

Have Your Say Rate this feature and give us your feedback in the comments section below

e-health Europe

E-Health in Europe

FIND CONTENT BY TYPE

Pharma IQ COMMUNITY

ADVERTISE WITH US

JOIN THE Pharma IQ COMMUNITY