1. Digital Health
1.1 What is the general definition of "digital health" in your jurisdiction?
"Digital health" is not defined under French law. The French Public Healthcare Code (FPHC) refers to "telehealth", which includes two forms of remote medical practice by means of information and communication technologies: (i) "telemedicine", "which brings one or more healthcare professionals (HCPs) together or with a patient, and, where appropriate, other professionals involved in the patient's care", consisting of tele-consultation, tele-expertise, tele-surveillance, tele-assistance, and medical regulation; and (ii) "telecare", "which brings a patient together with one or more pharmacists or paramedic[s]".
1.2 What are the key emerging digital health technologies in your jurisdiction?
Internet of Things (IoT), wearables, virtual reality, augmented reality and metaverse are among key emerging technologies. IoT is one of the fastest-growing digital health trends, with applications in healthcare that benefit patients, families, physicians, hospitals, and insurance companies. The proliferation of healthcare-specific IoT products opens up immense opportunities and the huge amount of data generated by these connected devices holds the potential to transform healthcare. The French government is proactive in this area, notably with the development of the use of digital health tools among patients through the Digital Health Space (espace numérique de santé), which is going to be used as national medical records and a secure messaging system between health professionals and patients, and will reference health application for patients.
1.3 What are the core legal issues in digital health for your jurisdiction?
- Applicable Regime: the product's regulatory status will determine the relevant pre- and post-commercialisation considerations. Notably, the period for medical device (MD) regulatory review has increased in Europe due to the entry into force of the new MD regulations (see question 2.6).
- Regulatory Evolution and Reimbursement Pathways: regulations evolve rapidly and reimbursement pathways can be obscure. For instance, telemedicine has been effectively regulated since 2018 in France and the regulatory framework continues to evolve. In 2022, new legislation opened the reimbursement of telesurveillance by the health insurance scheme (HIS), subject to certain conditions which will be specified by future decree. A new transitional coverage system was also set up to grant reimbursement for one year for presumed innovative therapeutic or disability compensation MDs. On the other hand, teleconsultation is no longer fully reimbursed by the HIS and the Social Security Financing Bill for 2023 may require authorisation of teleconsultation companies (for coverage) and restrict the at-home practice.
- Data protection: digital health is likely to involve the collection, storage, transfer, and processing of (highly sensitive) personal health data, subject to the General Data Protection Regulation (GDPR) and the French Data Protection Act (DPA) No. 78-17 of 6 January 1978 as modified. Soon, digital health will also be impacted by the European Health Data Space Regulation (EHDS) introduced by the European Commission in May 2022, which aims at empowering patients to control and use their health data across any Member State and to foster a genuine single market for digital health services and products. French law also adds security and interoperability requirements specifically applicable to healthcare information systems (see question 2.2).
1.4 What is the digital health market size for your jurisdiction?
According to a study by the Institut Montaigne, in association with McKinsey & Company, the digital health market could generate up to 22 billion euros per year in France. Both public and private actors are betting on this sector. French digital health start-ups raised more than one billion euros between the first and third quarters of 2022.
1.5 What are the five largest (by revenue) digital health companies in your jurisdiction?
To our knowledge, the five largest digital health companies in France (by revenue) are Doctolib, Alan, Withings, Owkin, and Kry (Livi).
2. Regulatory
2.1 What are the core healthcare regulatory schemes related to digital health in your jurisdiction?
European and French legislators have addressed many aspects of digital health; however, there is no comprehensive regulatory scheme yet. At the French level, such regulations are mostly codified in the FPHC - e.g. anti-kickback and transparency provisions, advertisement of MDs, medical ethics, and manufacturing and distribution of medicinal products. Provisions from other codes may also apply to specific aspects of healthcare. Regulatory agencies also play an important role in the construction and implementation of guidelines to facilitate implementation.
2.2 What other core regulatory schemes (e.g., data privacy, anti-kickback, national security, etc.) apply to digital health in your jurisdiction?
- Regulations on MDs: (see question 2.6).
- Regulations on anti-kickback and transparency requirements: (see question 2.1).
- Regulation and reimbursement: (see question 1.3 and good practice guidelines set by regulatory agencies).
- Regulations on electronic medical records: health data security and interoperability requirements; implementation of a Digital Health Space (see question 1.2) and upcoming EHDS Regulation which fosters the development of electronic medical records at the EU level (see question 1.3).
- Regulations on data protection: (see section 4).
2.3 What regulatory schemes apply to consumer healthcare devices or software in particular?
There is no specific regulatory scheme for "consumer devices" as a stand-alone category. General regulations cover various aspects of consumer devices' life cycle. However, the line between wellness consumer devices and MDs with a medical purpose may be difficult to draw, and the latter (including software) are subject to a specific regime (see question 2.6).
2.4 What are the principal regulatory authorities charged with enforcing the regulatory schemes? What is the scope of their respective jurisdictions?
Some of the principal regulatory authorities in France are the following:
- Directorate General for Care Provision (DGOS): reports to the French Ministry of Health and plays the role of interface with healthcare institutions. It must notably ensure the quality, continuity, and proximity of care.
- National Agency for the Safety of Health Products (ANSM): responsible for authorising clinical trials, monitoring adverse reactions related to health products, inspecting establishments engaged in certain activities, and authorising health product imports. The ANSM regularly publishes influential guidelines and situational analyses and may impose administrative sanctions.
- Data Protection Authority (CNIL): responsible for ensuring the protection of personal data. Its role is to alert, advise, and inform the public, and it controls and sanctions data controllers and processors through the issuance of injunctions and fines.
- National Health Authority (HAS): notably responsible for the pricing and reimbursement of health products and the optional certification of prescription assistance software. The HAS regularly publishes guidelines, including guidelines relating to digital health issues.
- Regional Health Agencies (ARS): responsible for the regulation of healthcare provisions at a regional level, including implementation of a digital health policy.
- National Digital Health Agency (ANS): responsible for assisting the State in implementing digital health regulation, specifically by issuing recommendations and standards regarding security and interoperability, as well as by developing national health software and projects.
2.5 What are the key areas of enforcement when it comes to digital health?
Some of the key areas of enforcement regarding digital health in France are:
- Defective MDs: manufacturers of connected implants and high-risk medical assistance software are exposed to product liability claims.
- Data Protection: digital health likely involves the processing of personal health data, considered as highly sensitive. Failure to meet data protection (including security) requirements may therefore result in severe sanctions, such as an injunction to stop the processing or fines of up to 20 million euros or 4% of total worldwide annual turnover, which can be publicly issued.
- Regulatory Requirements: existing and future digital health solutions cover an extensive and highly diversified field, and market access may depend on stringent regulatory requirements.
2.6 What regulations apply to software as a medical device and its approval for clinical use?
Like other MDs, the software is subject to pre- and post-commercialisation requirements (CE-marking, materiovigilance, etc.) set forth by: (i) the EU, Regulation (EU) 2017/745 on MD (MDR) or Regulation (EU) 2017/746 on in vitro diagnostic MDs (IVDR) (directly enforceable in France and fully operative respectively since May 2021 and May 2022); and (ii) in France specifically, by the FPHC. These regulations broaden the range of technologies covered (e.g. devices aimed at medical prediction and prognosis are now expressly included), set forth a stricter classification regime (a new rule has notably been introduced for stand-alone software MDs, such as most health apps), and added rules on clinical performance evaluation of MDs. It is worth taking note, however, that France has requested postponement of the implementation of these new regulations due to insufficient regulatory capacity and transitional guidance. Regulatory authorities have also issued guidelines tailored to software MDs.
2.7 What regulations apply to artificial intelligence/machine learning powered digital health devices or software solutions and their approval for clinical use?
Artificial Intelligence (AI) and Machine Learning (ML)-powered MDs are subject to MD regulation, data protection regulations (the GDPR and French regime on automated decision-making), and bioethics rules. Other rules may apply as there is no comprehensive regulatory framework. The EU Commission has proposed harmonised rules regarding AI applications (the AI Act) which would pre-empt national regulatory frameworks, although monitoring and enforcement would remain the responsibility of Member States. Recently, the EU Commission has also announced the AI Liability Directive aiming at complementing and modernising the EU civil liability framework by introducing specific rules to damages caused by AI systems.
3. Digital Health Technologies
3.1 What are the core issues that apply to the following digital health technologies?
- Telemedicine/Virtual Care: Depending on the digital health product or service, different legal regimes may apply. Health data protection, security requirements, liability issues, and reimbursement of such products or services are also key.
- Robotics: Several potential legal regimes may apply to robotics. Liability allocation is one issue, as well as the consideration of the regime of product responsibility.
- Wearables: The monitoring involved by wearables, specifically when collecting precise and daily information that can reveal health status, requires strict compliance with data protection laws. Depending on the features, MD regulations may also apply.
- Virtual Assistants (e.g. Alexa): The monitoring involved by virtual assistants, depending on the way they can be activated and how they record information, and the use of AI to train them, requires strict compliance with data protection laws and security requirements and triggers some questions regarding algorithm transparency. Upcoming AI-based regulation should also be closely monitored.
- Mobile Apps: Data protection and security requirements, specifically for health and/or monitoring apps, and the issue of liability, are key. Depending on the features, MD regulations may also apply.
- Software as a Medical Device: MD and health data protection, including additional public health requirements regarding interoperability and security, will apply. Upcoming AI-based regulation should also be closely monitored. Proper liability allocation is key.
- Clinical Decision Support Software: MD regulation will apply. Health data protection, including additional public health requirements regarding interoperability and security, will also apply. Proper liability allocation is key.
- Artificial Intelligence/Machine Learning Powered Digital Health Solutions: Training an AI- or ML-based health solution requires processing large amounts of personal data and health data, triggering compliance requirements with data protection and security, specifically for sensitive data. Algorithm transparency and IT security must be ensured. MD regulations will also apply (see question 2.7).
- IoT (Internet of Things) and Connected Devices: Data protection and security requirements, specifically for health and/or monitoring devices, as well as the issue of liability, are key. Depending on the features, MD regulations may also apply.
- 3D Printing/Bioprinting: 3D bioprinting means the creation of living tissues via the additive manufacturing technology of 3D printing. MD regulation will likely apply, depending on the intended use.
- Digital Therapeutics: Digital therapeutics are held to the same standards of evidence and regulatory oversight as traditional medical treatments. In addition, data protection and security requirements, as well as the issue of liability, are key.
- Natural Language Processing: Natural language processing is at the crossroads of AI and personal data processing. Algorithm transparency, data protection compliance, and in some cases, medical device regulations, are key. Depending on the support service, the issue of the illegal practice of medicine can be relevant.
3.2 What are the key issues for digital platform providers?
Providers may face specific regulatory constraints depending on the nature of the services offered, but the landscape is evolving rapidly. The landscape is constantly evolving, with, for example, the publication of the Health Insurance Good Practice Charter for Teleconsultation of 6 April 2022, which provides obligations for solution providers and physicians. Discussions for a better supervision of teleconsultation will continue, notably by requiring a healthcare professional to be present during the consultation (other than a doctor) and should be closely monitored. Security and interoperability requirements are higher for digital health platform providers (e.g. if medical data is processed, the platforms may only use the services of a certified health-data-hosting service provider and must comply with security and interoperability standards, especially regarding data access). A certification scheme for interoperability has been considered but not yet implemented.
4. Data Use
4.1 What are the key issues to consider for use of personal data?
Personal data is subject to the GDPR and its key principles, mainly lawfulness, fairness, transparency, proportionality, purpose limitation, and data minimisation, and to the French DPA requirements, specifically regarding health data.
4.2 How do such considerations change depending on the nature of the entities involved?
Data protection laws apply regardless of the nature of the entities, whether public or private. However, some entities may be subject to derogations depending on the importance of the data processing operations (e.g. SMEs).
4.3 Which key regulatory requirements apply?
In order to carry out personal data processing, the data controller must implement the following compliance steps:
- maintain a record of processing activities under its responsibility;
- inform the individuals of the processing's existence; and
- ensure that the agreements entered into contain adequate provisions to properly determine the parties' capacities, roles, and responsibilities.
Health data is also subject to the following specific requirements under the GDPR and additional national obligations:
- its processing is, by principle, prohibited, except when based on a specific legal ground;
- its processing must also be justified by a public interest and authorised by the French Data Protection Authority unless it falls under exceptions; and
- organisational and technical security measures must be adapted to the level of data sensitivity.
4.4 Do the regulations define the scope of data use?
The scope of data use is determined, to the extent that the data processing must be lawful, in view of its purpose and conditions of implementation of its operations.
Some specific restrictions do exist such as the prohibition to sell health data that is directly or indirectly identifiable.
4.5 What are the key contractual considerations?
Regarding business-to-business relationships, the requirement to enter into an agreement depends upon the capacities of the stakeholders:
- in a data controller and data processor relationship, an agreement must be entered into, the provisions of which are expressly defined by the GDPR. Security requirements are essential;
- in a joint data controller relationship, an agreement must be entered into, the provisions of which are not specifically defined. However, it is highly recommended to precisely allocate the parties' roles and responsibilities, depending on the actual level of involvement; or
- in an independent controller relationship, an agreement is not required but may be recommended if material personal data exchanges are taking place.
Regarding business-to-consumer relationships, the data controller has an obligation to provide relevant information to the individuals, and, in some cases, to obtain their express consent; failing to do so will make lawful use of the data impossible.
4.6 What are the key legal issues in your jurisdiction with securing comprehensive rights to data that is used or collected?
Data is an incredibly important business asset. It is thus highly important to negotiate adequate contractual provisions, in order for the capacities to be in line with the business needs to use data, to properly allocate responsibilities, and to avoid sanctions (see question 4.3).
4.7 How are issues with data inaccuracy, bias and/or discrimination addressed by the regulatory authorities in your jurisdiction?
There is no specific regulatory framework under French law; however, regulatory authorities generally address the question through the principle of transparency. While the French Code of relations between the public and the administration (Code des relations entre le public et l'administration) specifies the information to be provided by the administration to a person who is the subject of an individual decision taken on the basis of an algorithmic processing, the GDPR provides for the obligation for data controllers to inform data subjects of the existence of automated decision-making and, in particular, to communicate meaningful information about the logic involved as well as the significance and the envisaged consequences of such processing for them.
The prevention of bias and structural discrimination is also at the core of the AI Act, which intends to provide for mandatory requirements applicable to high-risk AI systems in order to serve this purpose.
In September 2022, the French Supreme Administrative Court suggested to designate the CNIL as the authority in charge of the application of the AI Act. It is therefore very likely that the CNIL will pursue and expand its work relating to data inaccuracy, bias, and discrimination in the coming years.
5. Data Sharing
5.1 What are the key issues to consider when sharing personal data?
Data protection laws, as well as specific requirements regarding the sharing of medical data, specifically where covered by medical secrecy, are applicable.
5.2 How do such considerations change depending on the nature of the entities involved?
Data protection laws apply regardless of the nature of the entities, whether public or private, except where requirements are specifically applicable to health professionals.
5.3 Which key regulatory requirements apply when it comes to sharing data?
Sharing personal data must always be subject to entering into an agreement (see question 4.5) and to adequate security measures during transmission.
Personal data transfers to recipients located outside the EU, in a country that does not ensure an adequate level of protection, must be covered by appropriate safeguards, notably data transfer agreements (standard contractual clauses (SCCs) adopted by the EU Commission).
However, further to the Schrems II decision (CJEU, 16 July 2020, C-311/18, Facebook Ireland and Schrems), data controllers must conduct a risk assessment before using SCCs and must also implement strong safeguards to ensure the protection of personal data from access by foreign authorities. In France, the French centralised public health database (the Health Data Hub) has been subject to various proceedings regarding potential transfers of health data to the US through the hosting service provider. This issue may be impacted by the recent adoption by the US of a Data Privacy Framework (EO 14086, 7 October 2022), which may lead to the adoption of a new adequacy decision for the US facilitating personal data transfer.
If data is covered by medical secrecy, a specific regime for "shared medical secrecy" generally requires patient consent to share its medical data with any party outside the healthcare team.
6. Intellectual Property
6.1 What is the scope of patent protection?
In order to be covered by a patent issued by the French Industrial Property Office (INPI), an invention must be new, involve an inventive step, and have an industrial application. In principle, computer programs and mathematical methods are not patentable per se. However, a computer program that produces a non-obvious "technical effect" and certain AI-related inventions directed to a technical subject-matter may be patentable. Patents offer strong protection but are limited in scope (to the patent claims) and in duration (20 years). This protection also requires public disclosure of the invention as patent applications are published 18 months after being filed.
6.2 What is the scope of copyright protection?
Copyright protects an original work in a fixed form and excludes ideas, concepts, or mathematical formulas that may not be subject to copyright. A software's architecture, source code, object code, and preparatory design material are eligible for copyright protection, but not the algorithm. The copyright holder benefits from moral rights, which are perpetual, inalienable, and not subject to statutes of limitation, and economic rights which last 70 years after the author's death or after the works' disclosure where it belongs to a legal person. Original works are protected without formalities from their day of creation.
6.3 What is the scope of trade secret protection?
In 2016, the European Commission enacted Directive (EU) No. 2016/943 of 30 July 2018, which protects secret information with commercial value. In France, information protected under trade secrets is defined as any information that is: (i) not generally known or easily reachable by specialists; (ii) of commercial value, actual or potential, because of its secret nature; and (iii) subject to reasonable protective measures by its legitimate holder to keep it secret. Trade secret protection may apply to corporate algorithms.
6.4 What are the rules or laws that apply to academic technology transfers in your jurisdiction?
There is no specific academic technology transfer rules scheme in France. Since 2019, France Biotech, an industry association, has been developing tools (negotiation process, templates, access to existing agreements) to facilitate and accelerate technology transfer and, in collaboration with BPI France, has begun to suggest improvements to the technology transfer process. A working group on technology transfer, of which France Biotech's Health Technology Transfer Observatory is a member, is currently being set up.
6.5 What is the scope of intellectual property protection for software as a medical device?
Intellectual property protection for Software as a Medical Device (SaMD) will depend on the features and functionality of the product, and the nature of the specific market. A particular SaMD may be protected simultaneously by more than one type of intellectual property protection (patent, copyrights, trade secret, trademarks, design).
6.6 Can an artificial intelligence device be named as an inventor of a patent in your jurisdiction?
No. The European Patent Office has already refused patent applications designating an AI as the inventor (January 2020).
6.7 What are the core rules or laws related to government funded inventions in your jurisdiction?
Industrial property rights allocation mostly depends on the specific contract executed between the government sponsor and the inventor(s). When the public authority plans to order products that are likely to be protected, particular attention must be paid to the proper management of intellectual property rights in order to ensure that it will be able to use the products ordered in accordance with its needs. In order to help public and private entities in the negotiation and performance of their IP-related agreements, standard intellectual property provisions, adapted to the different public contracts, are made available by the government.
7. Commercial Agreements
7.1 What considerations apply to collaborative improvements?
The main consideration is to identify the applicable regulations and define a clear intellectual property scheme regarding the results generated during a partnership, depending on the allocation of responsibility between the parties during development. Academics often request joint ownership of results (independent of inventorship).
7.2 What considerations apply in agreements between healthcare and non-healthcare companies?
There are many considerations to assess, including: ensuring business continuity with respect to the product and/or process; warranties on the compliance/regulatory capabilities; cross-border concerns; and data breach indemnity.
8. Artificial Intelligence and Machine Learning
8.1 What is the role of machine learning in digital health?
ML is proliferating in the digital health sector to assist HCPs' practice and research. AI can provide assistance in decision-making and make the decision itself, although only under very strict circumstances (notably to protect the subjects' data).
8.2 How is training data licensed?
Training data is protected by intellectual property rights as an entire database if it is original, or, if not, the owner can demonstrate a substantial investment in obtaining, verifying, and presenting data. In this regard, training data can be licensed, subject to compliance with regulatory requirements. Open databases may also be used without the need for a licence.
8.3 Who owns the intellectual property rights to algorithms that are improved by machine learning without active human involvement in the software development?
The author of a creation is a natural person and protection automatically arises (see question 6.2). Regarding computer programs, rights may be vested in his or her employer (a company) if the employee acted within his or her duties or pursuant to the employer's instructions. The European Patent Office has already refused patent applications designating AIs as inventors (January 2020).
8.4 What commercial considerations apply to licensing data for use in machine learning?
In addition to securing the necessary rights to use training data, data integrity and reliability are key considerations, as well as obtaining transparency guarantees regarding ML algorithms.
9. Liability
9.1 What theories of liability apply to adverse outcomes in digital health solutions?
- Civil liability: the producer of the device may be strictly liable for the provision of a defective product in case of harm to the user. Claims may also be brought against economic actors involved in manufacturing or distribution under fault-based regimes.
- Criminal liability: manufacturers, distributors, users, and other actors involved in digital health may be liable for specific offences described in the FPHC, or ordinary offences.
- Regulatory liability: regulatory authorities may impose administrative sanctions on manufacturers that fail to meet regulatory requirements related to or resulting in adverse outcomes in digital health.
9.2 What cross-border considerations are there?
There are many cross-border considerations likely to impact the business model of industrials engaging in the field of digital health, including:
- Cross-border healthcare: Directive 2011/24/EU on patients' rights in cross-border healthcare (as modified) sets out the conditions under which a patient may receive medical care from an HCP located in another EU country - it covers healthcare costs, the prescription, and the delivery of medications and MDs.
- MDs and local representation: to place an MD on the EU market, a non-EU manufacturer must designate an "authorised representative" in the EU (Art. 11, MDR).
- Data transfer: see question 5.3.
10. General
10.1 What are the key issues in Cloud-based services for digital health?
The key challenges with Cloud-based services for digital health lie in the setting up of sufficient security and governance mechanisms to enable users to demonstrate compliance with the strictest legal regime applicable to their operations. It is also crucial to ensure data interoperability so that data sharing can be efficient between different healthcare institutions. The impact of the legal restrictions on personal data transfers must also be taken into account for Cloud-based services that are not exclusively hosted within and accessible from the EU (please see question 5.3).
10.2 What are the key issues that non-healthcare companies should consider before entering today's digital healthcare market?
The digital healthcare market is a highly regulated, complex sector to navigate through - solid knowledge of the industry and the norms is key.
10.3 What are the key issues that venture capital and private equity firms should consider before investing in digital healthcare ventures?
A threshold consideration is whether the digital solution will provide the necessary features, functions, and tools to meet the market needs, as well as comply with the above-mentioned regulatory requirements.
10.4 What are the key barrier(s) holding back widespread clinical adoption of digital health solutions in your jurisdiction?
Despite the growing number of digital health technologies, the evolution of methodologies to perform timely, cost-effective, and robust assessments has not kept pace. Key barriers in France include the lack of comprehensive regulation and a sometimes-obscure methodology for reimbursement of digital health solutions.
10.5 What are the key clinician certification bodies (e.g., American College of Radiology, etc.) in your jurisdiction that influence the clinical adoption of digital health solutions?
The SNITEM (Syndicat National de l'Industrie des Technologies Médicales) is the main representative (non-certifying) of the medical technology industry and is proactive in the field of MD regulation.
10.6 Are patients who utilise digital health solutions reimbursed by the government or private insurers in your jurisdiction? If so, does a digital health solution provider need to comply with any formal certification, registration or other requirements in order to be reimbursed?
They can be reimbursed (by both), although a strict procedure applies. MDs must be CE-marked and any digital health solution must undergo an HAS assessment, be registered on a governmental list, and be prescribed by an HCP to be reimbursed in France.
10.7 Describe any other issues not considered above that may be worthy of note, together with any trends or likely future developments that may be of interest.
Several so-far innovative and marginal practices were rapidly developed under derogatory schemes during the pandemic, and legislators are now slowly selecting the measures they wish to entrench in common law and the ones they either keep derogatory or strike down. In addition, public opinion is having an increased impact on the services offered in the digital health marketplace.
Originally published by ICLG.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.