Germany: Digital Health Laws & Regulations 2023

1. Digital Health

1.1 What is the general definition of "digital health" in your jurisdiction?

German law does not define "digital health" specifically. Generally, the term is interpreted broadly and includes, inter alia: (i) digital healthcare services, including telemedicine; (ii) medical software applications for smartphones; (iii) medical devices that include artificial intelligence ("AI"); and (iv) other medical products that involve digital features, such as digital pills. Moreover, digital health is an umbrella term for the new markets in which the providers of the aforementioned products and services are active. Similar to "e-health", the term is symbolic of the rapidly advancing digitisation of the German healthcare sector.

1.2 What are the key emerging digital health technologies in your jurisdiction?

Prescription and reimbursement of medical apps: A new system for the reimbursement of medical smartphone apps (Digitale Gesundheitsanwendungen – "DiGA") has been introduced under the statutory health insurance ("SHI") regime in 2021. The DiGA concept applies to apps that are CE-certified medical devices under the Medical Device Regulation ("MDR") risk class I or IIa. DiGA can be prescribed by physicians and psychotherapists and are then reimbursed by SHI funds. In order to obtain reimbursement for a medical app, the manufacturer has to file an application with the German Federal Institute for Drugs and Medical Devices (Bundesinstitut für Arzneimittel und Medizinprodukte – "BfArM"). Once approved, the applicable reimbursement thresholds are determined by and negotiated with the Federal Association of the SHI Funds (Spitzenverband Bund der Krankenkassen – "SpiBu").

To obtain approval for reimbursement, the manufacturer must prove that the medical app meets the requirements for safety, functional capability and quality and that it complies with data protection requirements. Additionally, the manufacturer must show that the app has positive effects in patient care. These positive effects in patient care have to be established with a comparative study which demonstrates the advantages of using the app, as opposed to not using it. Such study must generally be retrospective. It does not have to be a genuine clinical trial. Valid concepts are epidemiological studies, or studies using methods from other scientific fields such as healthcare research.

At present, BfArM has approved 34 medical apps. The number of reimbursed medical apps will likely increase quickly as the system becomes more established.

Similar to the DiGA concept, a new system for the reimbursement of digital care applications (Digitale Pflegeanwendungen – "DiPA") has been introduced in December 2022 under the statutory and private long-term care insurance regime (Pflegeversicherung). DiPA are intended to provide support to care recipients at home and designed to help alleviate the care recipient's loss of independence or capabilities or prevent their need for care from progressing further. Reimbursement is obtained under the same procedure that applies to DiGA.

Liberalisation of telemedicine: For many decades, telemedicine was largely restricted under German physicians' professional law. This had already started to change before the COVID-19 pandemic. In 2019, Germany had set the legal basis for telemedicine, including video consultation by physicians, and their coverage by private and public payers. The practical implementation of these laws has been accelerated significantly due to the pandemic and related restrictions on public life. The number of video consultations, online prescriptions and other types of remote patient treatment have meanwhile reached an all-time high. Physicians are now also allowed to issue a certificate for sick leave in a video consultation. Simultaneously, restrictions on the advertisement of telemedicine have, to some extent, been lifted.

Regardless of the above, telemedicine is still subject to numerous regulatory restrictions. According to German professional laws, remote treatment can only take place if, among other things, the use of the telecommunication medium is medically justifiable, i.e. no further medical examinations are necessary to obtain a direct and comprehensive picture of the patient and his or her disease. Moreover, telemedicine business models are subject to high data protection and IT security standards, as they involve the processing of a significant amount of health data.

Electronic patient record: Since January 2021, Germany has been in the process of implementing the so-called electronic patient record (elektronische Patientenakte – "ePA"). The implementation shall be completed in 2023. The ePA is a central element of digital and networked healthcare. Since 2021, patients insured with SHI are entitled to be provided with the benefits of ePA upon request, and all physicians and psychotherapists must have the necessary equipment to transfer data to the ePA. The aim of the ePA is to centrally store patient data in one virtual place if the patient consents and to the extent covered by the patient's consent. Patient data include, inter alia, treatment data and vaccination records. As of 2023, the ePA shall also facilitate research and development, i.e. patients shall now be able to make data from their ePA available for research projects on a voluntary basis. The ePA will now also include medication records and data collected through DiGA.

1.3 What are the core legal issues in digital health for your jurisdiction?

Digital health trends are a major challenge for the German health sector, which is still characterised by many traditional rules and practices. The objective of the German government is to provide a functioning and secure healthcare telematics infrastructure that sets a digital framework and facilitates cooperation between various players in the domestic health markets. The telematics infrastructure seeks to achieve a balance between protecting the patients' fundamental rights of autonomy and confidentiality of their health data on the one hand, and creating digital health services and a high level of work efficiency across the health sector on the other hand. One of the key issues of digital health is the handling of sensitive patient data, the extensive use of which has considerable value for research and development, but is at the same time limited by a number of local, national and EU regulations, including the EU Regulation 2016/679 (General Data Protection Regulation – "GDPR").

1.4 What is the digital health market size for your jurisdiction?

The market for digital products and services in the healthcare sector is growing rapidly. There are various estimates on the market size, depending on the notion of digital health (as outlined under question 1.1 above) and the relevant key figures. The size of the market is already estimated today to be in the tens of billions, with a strong upward trend.

1.5 What are the five largest (by revenue) digital health companies in your jurisdiction?

It is not possible to make a blanket statement in this regard. Many of the companies specialising in digital health are also active in other health or technology markets. As in other countries, the global tech companies such as Apple, Google or IBM play a significant role in the digital health market. At the same time, university spin offs and other early stage companies are making their mark in this emerging sector as well. In the telemedicine sector, there are a number of promising platform operators that use their e-commerce and IT expertise to connect patients and physicians online.

2. Regulatory

2.1 What are the core healthcare regulatory schemes related to digital health in your jurisdiction?

Digital health products, including medical apps, often qualify as medical devices or in vitro diagnostics and, therefore, fall within the scope of Regulation 2017/745 on medical devices ("MDR") and Regulation 2017/746 on in vitro diagnostics ("IVDR"). As EU regulations, the MDR and IVDR are directly applicable in Germany and do not have to be transposed into national law. The regulations are complemented by the German Act on the Implementation of EU Medical Devices Law (Medizinprodukte-Durchführungsgesetz – "MPDG").

Digital health services are subject to German healthcare regulations on the inpatient sector (e.g., hospitals and care homes) and outpatient sector (e.g., medical offices and home care providers). In these sectors, services are typically reserved for physicians or other healthcare professionals who may be entitled to provide healthcare services. Physicians are subject to the requirement of a German approbation or other permit to provide physician-only services, and bound by strict regulations under their professional codes.

Reimbursement of digital health products and services under the SHI regime is predominantly governed by the Fifth Book of the Social Insurance Code (Fünftes Buch Sozialgesetzbuch – "SGB V").

2.2 What other core regulatory schemes (e.g., data privacy, anti-kickback, national security, etc.) apply to digital health in your jurisdiction?

The laws on data privacy, in particular the GDPR and the German Federal Data Protection Act (Bundesdatenschutzgesetz – "BDSG"), are particularly relevant to digital health products and services. It is key for any digital health products company to ensure that patient data are treated in line with these legal frameworks and protected against undue third-party access. Furthermore, depending on the respective health product or service, additional data protection regulations may apply, e.g., for the approval of medical apps or telemedicine services.

In Germany, the cooperation between the health industry and healthcare professionals ("HCP") is subject to various healthcare compliance regulations. Their purpose is to protect independent medical decisions of HCP, patient health and fair competition among healthcare providers. To this end, the regime in particular seeks to prevent any undue influence on HCP. The applicable healthcare compliance provisions are manifold and complex. They equally apply to any cooperation and business activities in the digital health sector.

2.3 What regulatory schemes apply to consumer healthcare devices or software in particular?

While there is no specific national scheme for "consumer healthcare devices", such products are subject to the laws and regulations described above. Under EU law, consumer products are generally subject to the General Product Safety Directive ("GPSD"). In the digital health sector, however, the GPSD is of minor relevance because the more specific medical device regulations, including the MDR, would typically apply instead of GPSD.

With the implementation of the EU directive on digital content in the German Civil Code (Bürgerliches Gesetzbuch – "BGB"), the German legislator has reinforced consumer protection in this area. Where digital apps are marketed to consumers, manufacturer obligations under these provisions may even go beyond the general regulatory obligations under the MDR.

2.4 What are the principal regulatory authorities charged with enforcing the regulatory schemes? What is the scope of their respective jurisdictions?

The BfArM regulates the market clearance and reimbursement for most digital health products. Market surveillance for medical devices, including medical apps, is carried out by supervisory authorities at a regional level.

The SpiBu and the Federal Assembly of the SHI and the Federal Panel Doctors' Association (Gemeinsamer Bundesausschuss – "G-BA") are the highest bodies of the SHI and are involved in the majority of reimbursement decisions for digital health products and services.

Federal and Regional Data Protection Commissioners (Datenschutzbeauftragte des Bundes und der Länder) are responsible for the supervision of data protection efforts.

The Telematics Society (Gesellschaft für Telematik – "Gematik") was created specifically with regard to the task of developing a suitable and functioning healthcare telematics infrastructure, including an electronic patient health card, electronic patient files and e-prescriptions.

2.5 What are the key areas of enforcement when it comes to digital health?

Compliance of medical device software ("MDSW") with the sector-specific laws and regulations is mainly supervised by regional market surveillance authorities and notified bodies. This includes regular and ad hoc audits. Legal violations by the manufacturer of MDSW may lead to reputational damage and qualify as an administrative or criminal offence. Depending on the circumstances of the individual case, they may result in fines, orders of corrective and preventive measures, or a market ban.

Where digital health products or services require the transfer and processing of personal health data, data protection authorities supervise the market as well. Failure to meet data protection requirements may result in severe sanctions, such as an injunction to stop the processing, and/or fines of up to EUR 20 million or 4 per cent of the total worldwide annual turnover, which can be publicly issued.

2.6 What regulations apply to Software as a Medical Device and its approval for clinical use?

MDSW must bear a CE-mark in accordance with the MDR or IVDR. For that purpose, these products must undergo a conformity assessment procedure that, depending on the risk class, can be passed through by the manufacturer (self-certification) or requires the involvement of a notified body. Upon successful completion of the conformity assessment procedure, the CE-mark can be affixed to the MDSW product.

Before the MDR came into force, MDSW was generally classified under risk class I and subject to self-certification. Under the MDR, many MDSW are now subject to higher risk classes. Therefore, manufacturers must regularly obtain their CE certificates from notified bodies.

The transition scheme under the MDR allows for manufacturers of class I MDSW to benefit from a grace period. More specifically, they may continue to market their products under the previous MDD regime until 2024 if they have issued a declaration of conformity before the MDR has become applicable.

The Medical Devices Coordination Group ("MDCG") of the European Commission issued several guidelines on qualification and classification of MDSW.

2.7 What regulations apply to Artificial Intelligence/Machine Learning powered digital health devices or software solutions and their approval for clinical use?

Germany has not enacted a specific law on AI so far. Products that include AI are subject to the same regulations as other products, including medical devices law and data protection, as well as cybersecurity regulations. As part of a medical device, AI software has to comply with the requirements of the MDR or IVDR.

The EU Commission published a draft regulation on AI on 21 April 2021. The regulation is expected to come into force no earlier than 2024. As things currently stand, the draft regulation shall not supersede to the EU medical devices regime but apply in parallel. AI systems shall be subject to regulatory requirements that increase with the level of risk associated with them. High-risk AI, including certain AI systems for medical technology, shall be subject to comprehensive legal obligations imposed on the respective operator.

3. Digital Health Technologies

3.1 What are the core issues that apply to the following digital health technologies?

• Telemedicine/Virtual Care: Despite being liberalised to a substantial extent (see question 1.2 above), telemedicine and virtual care services are still considerably restricted. Remote treatment of patients must be medically justifiable, i.e. the treatment case may not require further medical examination in the doctor's practice. Moreover, telemedicine and virtual care services typically involve the collection and storage of sensitive patient data and, thus, require comprehensive data protection compliance management.
• Robotics: Robotics are machines that have the capacity to (partly) substitute healthcare professionals. Such machines will mostly qualify as medical devices (see question 2.6). Where publicly owned hospitals purchase robotics, the transaction is subject to public procurement laws and a formal tender procedure must be regularly conducted.
• Wearables: Wearables, such as smartwatches or smartglasses, often serve multiple purposes, and their primary purpose may not even be of a medical nature. However, if wearables come with health-related features, they might qualify as medical devices and require CE-certification.
• Virtual Assistants (e.g. Alexa): Virtual assistants (such as Amazon's Alexa, Microsoft's Cortana, or Apple's Siri) usually have not been designed with health-specific features and are thus not considered medical devices. Moreover, it would be challenging for third-party software that runs on these devices and has a medical purpose to meet the reliability standards required for MDSW.
• Mobile Apps: Mobile apps that implement health-related features may be considered MDSW and, thus, may require CE-certification. Medical apps of MDR risk class I or IIa may be approved for reimbursement under the German Digital Care Act (Digitale-Versorgungs-Gesetz, "DVG") and the German Digital Health Applications Regulation (Digital-Gesundheitsanwendungen-Verordnung). They can then be prescribed by physicians and reimbursed by SHI funds, similar to medical aids.
• Software as a Medical Device: As with mobile apps, other software that implement health-related features may equally qualify as MDSW (see above).
• AI/ML powered digital health solutions: Digital health solutions powered by AI and machine learning can be a powerful tool for medical diagnostics and monitoring. The training of neural networks and similar AI/machine learning algorithms necessarily requires a large amount of personal health data that must be obtained in compliance with data protection laws. At the same time, the results are often not sufficiently protected by intellectual property rights (see question 8.3).
• IoT and Connected Devices: Connected medical devices such as long-term EKG or blood pressure metres are subject to the MDR and thus require CE-certification. The processing of personal health data needs to comply with the GDPR. This usually means that the processing will be a service provided on behalf of a healthcare provider.
• 3D Printing/Bioprinting: 3D printing and bioprinting can be used to manufacture prosthetics and tissues. In the future, this technology might even be used to create whole organs. The use of 3D templates for prosthetics and tissues also raises new intellectual property and licensing questions.
• Digital Therapeutics: Digital therapeutics are treatment procedures based on digital technologies. Such technologies may, depending on their specific features, qualify as MDSW (see above).
• Natural Language Processing: Natural Language Processing ("NLP") describes techniques and methods for automatic analysis and representation of human speech. The purpose of NLP is direct communication between humans and computers based on natural language (see question 8.1). NLP may be one phase of text and data mining ("TMT"), the purpose of which is to detect new correlations in databases by means of algorithms. NLP is, inter alia, used in pharmaceutical research.

3.2 What are the key issues for digital platform providers?

Platforms that facilitate transactions between healthcare providers and patients are subject to the requirements of Regulation (EU) 2019/1150 (Platform-to-Business Regulation), which sets out minimum standards for terms and conditions, transparency and fairness. As such platforms do not qualify as licensed healthcare providers, they are not authorised to process health data under Article 9(2)(h) of the GDPR. Consequently, they will often need to obtain valid consent from end-users in order to perform their services.

As platforms handle health data, they are also subject to increased data security requirements. They may not rely on email, which is often unencrypted, but need to establish a more secure channel for communicating with patients instead.

4. Data Use

4.1 What are the key issues to consider for use of personal data?

The use of personal data is governed by the GDPR. Such data must be processed lawfully (i.e. on a legal basis), transparently and fairly. They must be collected for a specific purpose (purpose limitation), limited to what is necessary (data minimisation), be accurate, be kept only as long as necessary (storage limitation) and finally be kept securely (integrity and confidentiality) (Article 5(1) of the GDPR). Health data is a special category of personal data. Its collection and further processing is generally prohibited unless a special exemption applies (Article 9 of the GDPR).

In addition to the requirements of the GDPR, the unauthorised disclosure of personal secrets of patients by healthcare professionals and their auxiliaries is subject to criminal liability under Sections 203 and 204 of the German Criminal Code (Strafgesetzbuch – "StGB").

For connected medical devices and other equipment, the Telecommunication-Telemedia Data Protection Act (Telekommunikation-Telemedien-Datenschutzgesetz – "TTDSG"), which transposes certain parts of Directive 2002/58/EC, imposes additional restrictions on remote access to data, even if it is not personal data.

The upcoming EU Data Act (Proposal for a Regulation on harmonised rules on fair access to and use of data, procedure file 2022/0047(COD)) would also cover digital health products and services, and require the vendors to make available both personal data and non-personal data to the user and third parties requested by the user.

4.2 How do such considerations change depending on the nature of the entities involved?

The GDPR sets out different requirements for health data, depending on the nature of the entities involved and the purposes for which personal data is processed.

Licensed healthcare professionals are permitted to process special categories of personal data for the purpose of occupational and preventive medicine, diagnosis and treatment (Article 9(2)(h) of the GDPR). This covers laboratories and other healthcare professionals that cooperate with physicians, as well as medical and non-medical service providers acting on behalf of these professionals, and organisations that manage insurances and social security systems.

Research organisations, conversely, may rely on a permission to process personal data for scientific and historical research purposes under Article 9(2)(j) of the GDPR and Section 27 of the BDSG.

For private organisations that are neither involved in the provision of healthcare nor in scientific research, the use of health data is more challenging. In many cases, such organisations need to obtain explicit consent as set out in Article 9(2)(a) of the GDPR, as no other exception from the ban on the processing of special categories of personal data applies. This includes suppliers of medical equipment or diagnostic services that wish to re-use personal data for their own purposes, such as product improvements, as well as entities that provide health-related products and services, such as vendors of wearables that record health data, or digital platforms that facilitate finding the best doctor who is an expert for specific ailments.

4.3 Which key regulatory requirements apply?

Under the GDPR, every entity responsible for the processing of personal data (data controller) is subject to transparency and documentation obligations. In particular, the data controller needs to:

• inform the individuals (data subjects) how their data is processed;
• maintain a record of processing activities; and
• conduct data protection impact assessments ("DPIA") and possibly consult with the competent authority prior to certain risky types of data processing – this will often apply to digital health applications which involve sensitive health data and new technologies.

Under the BDSG, an entity is required to appoint a data protection officer ("DPO") if it employs 20 or more persons with the processing of personal data, or if it needs to conduct a DPIA. Hence, digital health providers in Germany will usually require a DPO.

Healthcare professionals are also required to take additional measures to ensure that their staff and service providers are warned of their potential criminal liability and thus maintain confidentiality.

4.4 Do the regulations define the scope of data use?

Under the GDPR, the scope of data use is limited by the purpose for which the data was originally collected, and the legal basis used.

For health data in particular, the exceptions from the ban on the processing of special categories of data only apply to certain purposes. By way of example, healthcare professionals can use health data for the provision of medical services and related administrative purposes. However, if they exceed this scope – e.g., if they want to anonymise data to share it with the vendor of their equipment – they will need to look at a different exception. This often means that they need to obtain consent from their patients.

4.5 What are the key contractual considerations?

Regarding compliance with the GDPR, one of the key considerations is identifying the roles of the parties in relation to the processing of personal data:

• if an entity (processor) processes personal data on behalf of another (controller), a data processing agreement is required under Article 28 of the GDPR;
• if two entities are jointly responsible for the processing of personal data, they need to enter into a joint controller agreement under Article 26 of the GDPR; and
• between independent controllers, the GDPR does not directly require specific contractual provisions. However, the parties may want to restrict the re-use of data in order to minimise the risk on non-compliance with the GDPR.

Liability and indemnification obligations are two of the key considerations for every contract. For the use of health data, this is amplified due to the potential for high fines under the GDPR.

Under the proposed EU Data Act, providers would also be required to inform the users about the non-personal data generated by a product or service before entering into a contract.

4.6 What are the key legal issues in your jurisdiction with securing comprehensive rights to data that is used or collected?

German law does not generally provide for ownership in data as intellectual property or otherwise. Data can only be protected as part of a database under the sui generis database protection rights set out in Sections 87a et seq. of the German Copyright Act (Urheberrechtsgesetz – "UrhG"), which transposes Directive 96/9/EC. This protection, however, only comes into play if there was a substantial investment specifically in the acquisition, verification or presentation of the contents of such database. Efforts undertaken to collect data for other commercial purposes, such as providing healthcare services or developing medical software, are not specific to the creation of the database and will thus not be considered. In addition, the proposed EU Data Act would clarify that databases containing data obtained from or generated by the users would not be eligible for protection. Such measures could also apply when data is shared in accordance with the proposed EU Data Act.

Failing a protection as a database, data can only be partially protected as a trade secret under the German Trade Secret Act (Geschäftsgeheimnisgesetz – "GeschGehG"), which transposes Directive (EU) 2016/943. For this protection to apply, adequate measures against unauthorised access must be taken, e.g., including non-disclosure agreements with any person with whom the data is shared. Such measures could also apply when data is shared in accordance with the proposed EU Data Act.

Often, the ownership of the data is overshadowed by the rights of the patient or other data subjects under the GDPR. If the collection or processing of personal data is based on consent (as opposed to, e.g., the research exemption), this consent can be revoked at any time, and the data subsequently needs to be deleted. This usually means that data ownership is not the primary concern, provided that data is not aggregated or otherwise anonymised.

4.7 How are issues with data inaccuracy, bias and/or discrimination addressed by the regulatory authorities in your jurisdiction?

Data inaccuracy is currently not in the focus of data protection authorities. There have been a small number of investigations or warnings reported where data was inaccurate. Due to the fact that automated decision-making is limited by the GDPR, there is a relatively low risk of bias and discrimination based on profiling and data use.

5. Data Sharing

5.1 What are the key issues to consider when sharing personal data?

Under the GDPR, there must be a legal basis for sharing personal data. In digital health markets, this often means that the healthcare professional collecting health and other personal data for purposes of diagnosis and treatment needs to obtain explicit consent from his or her patients in order to share data for other reasons, such as research or product improvement. This applies even when the professional aggregates or anonymises the data before sharing, as this preparation of data is already a processing activity outside the scope of the provision of healthcare. When data must be made available under the EU Data Act, e.g., when a user requests this, such data must be shared under fair, reasonable and non-discriminatory terms and in a transparent manner.

When sharing data outside the EU, the GDPR imposes additional restrictions to ensure that the personal data remains adequately protected. If the target jurisdiction is not subject to an adequacy decision of the European Commission, adequacy must be ensured through effective contractual undertakings. For transfers to the United States, in particular, a recent decision of the Court of Justice of the EU (16 July 2020, C-311/18 – Schrems II) indicates that such contractual undertakings would not be effective and need to be supplemented with additional measures. The EU and the United States have agreed on a new Data Privacy Framework that would make these considerations obsolete when the recipient participates in the framework. However, it remains to be seen whether this new framework will – unlike its predecessors – hold up to the scrutiny of the Court of Justice of the EU.

5.2 How do such considerations change depending on the nature of the entities involved?

The GDPR sets out different requirements for health data depending on the nature of the entities sending and receiving the data.

Sharing data between healthcare professionals for the purposes of diagnosis or treatment is usually covered by an exception stipulated in Article 9(2)(h) of the GDPR. Similarly, professionals can share information with the health insurance for the purposes of billing under this exception. However, professional secrecy must be taken into account, and it must be ensured patients' secrets will only be shared with other persons subject to professional secrecy or written confidentiality undertakings.

In order to be able to share data with research organisations, one may rely on the permission to process special categories of personal data for scientific and historical research purposes under Article 9(2)(j) of the GDPR and Section 27 of the BDSG.

Public healthcare providers (e.g., a municipal hospital) and research organisations (e.g., a state university) may be subject to additional restrictions from state data protection laws and governmental policies when sharing health data.

5.3 Which key regulatory requirements apply when it comes to sharing data?

When sharing personal data, one of the key requirements is ensuring that there is a legal basis for the disclosure of personal data. For health data in particular, one of the exceptions set out in Article 9(2) of the GDPR needs to apply. In many cases, this requires obtaining the patient's or data subject's consent. For this consent to be valid, the data subject needs to be informed how their personal data will be used, and with whom it will be shared. The EU Data Act would also require data to be shared with government bodies under certain circumstances.

6. Intellectual Property

6.1 What is the scope of patent protection?

Patent protection is granted – upon application – for any invention having a technical character, if it is new, involves an "inventive step" and is suitable for industrial application. In digital health markets, the core technology (e.g., sensors and hardware) is generally patentable, even if patents remain mostly used in this rapidly developing environment. The number of worldwide Internet of Things ("IoT") patent applications increased substantially to over 130,000 per year; the health sector is contributing significantly to this development.

6.2 What is the scope of copyright protection?

Copyright law has the purpose of granting exclusive, non-registered rights to the author or creator of the original, non-technical work. The work can also take the form of a computer program, e.g., a statement, program language or mathematical algorithm, provided that it is an individual work and therefore the result of the author's own intellectual creation. However, efficient protection of an invention can only be achieved with the help of a patent; at most, copyright law can offer accompanying protection. Data created by digital health programs, however, can never be subject to copyright, because they are not an individual work and therefore, not the result of an author's own intellectual creation.

6.3 What is the scope of trade secret protection?

Trade secrets can be a useful tool to generate value for digital health companies if patent protection is not available, e.g., regarding software source codes or algorithms. The prerequisite of trade secret protection is that it relates to something that can be kept secret and actually is kept secret through reasonable efforts. For example, obvious elements of technology (design, etc.) or business strategies will not remain secret once placed on the market. In order to actually maintain secrecy, companies must – in accordance with the new GeschGehG – implement a confidentiality program that includes organisational (e.g., trade secret policies), technical (e.g., IT security) and legal steps (e.g., extensive confidentiality clauses). Only the trade secret as such is protected, not the results achieved with it. This is relevant in the context of data protection, since, for example, a trade secret covering data processing means it does not cover generated data.

6.4 What are the rules or laws that apply to academic technology transfers in your jurisdiction?

Academic technology transfer from university employees to their university employer is subject to certain employee privileges under the German law on employee inventions because of the freedom of teaching and research. As opposed to other employees, a university employee does not have an obligation to report or to disclose a service invention. If a university employee wishes to disclose his or her invention, he or she must notify the university employer of the invention. If a university claims a service invention which was disclosed by its employee, the inventor retains a non-exclusive right to use the service invention within the scope of his or her teaching and research activities. If the university exploits the invention, the amount of the remuneration is 30 per cent of the income generated by the exploitation. This percentage is much higher than the employee invention remuneration of a normal employee.

6.5 What is the scope of intellectual property protection for Software as a Medical Device?

In the healthcare sector, the main question is whether intellectual property protection is available for software inventions, e.g., MDSW. If MDSW represents an abstract idea and, therefore, protection is sought for computer programs as such, there is no protection according to patent law. Under German and European patent law, protection is only possible for algorithms and methods underlying the programs that have an inventive step over the prior art – one that is found based only on features that contribute to the technical character. According to German case law, however, programs that immediately trigger a technical effect or directly optimise data-processing hardware are considered patentable. The same rules apply to copyright, since the underlying concept is never fully protected. Trade secret protection for MDSW is only possible under the restrictions described in question 6.3.

6.6 Can an artificial intelligence device be named as an inventor of a patent in your jurisdiction?

So far, an AI device has not been named as the inventor of a patent in Germany. Several applications for the registration of patents "invented" by an AI device have already been rejected in Germany.

6.7 What are the core rules or laws related to government funded inventions in your jurisdiction?

The contractor may be obliged to grant a back licence under the EU, federal or state level funding regulations on publicly funded research and development projects. In general, public grants contain ancillary provisions that must be fulfilled to avoid a possible revocation of the funding decision and the reimbursement of the grant. In addition to exercise and exploitation obligations, the funding conditions include obligations to grant access and utilisation rights in favour of the funding agency as well as the subcontractors. The Subsidiary Conditions for Grants from the German Federal Ministry of Research and Education (Bundesministerium für Bildung und Forschung – "BMBF") for Research and Development Projects ("NKBF 98"), e.g., require that the results be made available to research and teaching in Germany free of charge.

In addition, inventions that are the result of publicly financed research and development or innovation activities are subject to the EU regulatory framework for state aids according to Articles 107 and 108 of the Treaty on the Functioning of the European Union (TFEU) and the corresponding EU Commission Communication on Research, Development and Innovation (2014/C 198/10). Under these rules, any transfer of funded inventions to commercial undertakings must be remunerated at the market price.

7. Commercial Agreements

7.1 What considerations apply to collaborative improvements?

Collaborations in the digital health sector are mostly subject to extensive contractual agreements, that aim at a fair balance of IP rights allocation and commercialisation rights on the one hand, and regulatory responsibilities and product liability on the other hand.

7.2 What considerations apply in agreements between healthcare and non-healthcare companies?

When cooperating with healthcare companies or healthcare professionals, non-healthcare companies should avoid granting any benefits, both unilaterally (e.g., gifts) and as part of (bilateral or multilateral) cooperation agreements. In such agreements, therefore, services and consideration must be equivalent, i.e. any remuneration must be at arm's length (principle of equivalence).

When granting benefits, companies should avoid the impression that there are any commercial expectations associated with such benefits. In particular, benefits must not create an incentive for the healthcare company or healthcare professional to make a certain procurement or therapy decision. In other words, if companies grant any benefits, this should be for legitimate objective reasons and kept separate from other businesses or commercial interests (principle of separation).

In the event of a cooperation with healthcare companies or healthcare professionals, any details of such cooperation should be agreed upon in written form and as transparently as possible. In particular, companies should avoid any (additional) verbal agreements or other non-transparent arrangements as these give the impression of secrecy (principles of transparency and documentation).

8. AI and Machine Learning

8.1 What is the role of machine learning in digital health?

Machine learning usually refers to the use of an algorithm ("neural network") that is trained with representative input data (e.g., images or sensor information) and the desired output. The algorithm is thus trained to recognise patterns in input data and to produce a certain output.

Machine learning can be a powerful tool for diagnostic purposes to assist healthcare professionals and to monitor the success of patient treatment. It can also be used for the early detection of potential health issues, even in consumer devices such as smartwatches or smartphones.

8.2 How is training data licensed?

Training data is often protected under the sui generis database protection rights set out in Sections 87a et seq. of the UrhG, which transposes Directive 96/9/EC on the legal protection of databases. In this case, it can be licensed in the same manner as other intellectual property.

Licensing training data will often be challenging, as it includes personal health data, which is under strict protection under the GDPR regime. Consequently, training data can often be licensed in anonymised form only. One of the main considerations is how to ensure that it will not be possible to re-identify individuals.

8.3 Who owns the intellectual property rights to algorithms that are improved by machine learning without active human involvement in the software development?

As a general rule, intellectual property can only be produced and owned by human beings, not by machines. For this reason, improvements made without active human involvement do not fall under the protection of most intellectual property rights.

In some cases, the results may be protected by sui generis database protection rights (see question 8.2 above). Unlike other types of intellectual property, this protection only requires a substantial investment, but not necessarily an intellectual achievement.

Furthermore, the improvements might be protected as trade secrets of the entity that made them.

8.4 What commercial considerations apply to licensing data for use in machine learning?

The main consideration is the ownership and/or access to the results of the training, i.e. the trained algorithm. As the algorithm may often not be protected by intellectual property rights (see question 8.3), it is crucial to clearly define the rights and obligations of each party with respect to its further use in the commercial agreement.

As training data will often include personal health information, it is also important to agree on liability and indemnification provisions in case the use of the licensed data turns out to be a violation of the GDPR. This could, e.g., be the case if the consent given by the patients is invalid or if the data has not been properly anonymised.

9. Liability

9.1 What theories of liability apply to adverse outcomes in digital health solutions?

Besides regulatory responsibility and potential criminal charges, civil law liability plays a significant role in digital health markets. Under German law, there is contractual liability on the one hand, and tort liability under the BGB, as well as product liability under the Product Liability Act (Produkthaftungsgesetz – "ProdHG") that each cannot be restricted by a contract on the other hand. MDSW is subject to liability under the ProdHG, even if not offered in a material object as data carrier.

9.2 What cross-border considerations are there?

Liability rules are predominantly subject to Member State law. With regard to cross-border matters, the EU Regulation 593/2008 ("Rome I Regulation") and the EU Regulation 864/2007 ("Rome II Regulation") regulate the applicable national legislation. Under Art. 4 of the Rome II Regulation, applicable law is determined on the basis of where the damage has occurred, irrespective of the country in which the act that has caused the damage took place. There are two general exemptions from this rule: (i) if the parties reside in the same country, the law of that country shall apply; or (ii) if a tort is apparently more closely connected to a country other than where the damage occurred or where both parties live – in that case, the law of that other country is applicable. Furthermore, exemptions apply with regard to certain types of liability. For product liability, specific rules apply according to Art. 5 of the Rome II Regulation. Here, the place where the product was acquired can become decisive. Under the Rome I Regulation, parties are, under certain conditions, allowed to determine the applicable law by contract. In the absence of a contractual choice of law, with regard to services, the law of the service provider's residence is applicable. However, there are exemptions to this rule with regard to consumer contracts, where generally the law of the consumer's country of residence is applicable.

Given that cross-border liability cases can result in severe legal consequences and significant loss of reputation in all countries concerned, cross-border digital health companies should adopt a global compliance regime and establish an organisation that takes into account the specific legal requirements and pitfalls of each national legal system concerned.

10. General

10.1 What are the key issues in Cloud-based services for digital health?

Healthcare organisations that transfer IT operations to Cloud-based services are facing, inter alia, technical and legal challenges. Security and confidentiality are key aspects for a wide-scale offering and use of Cloud-based services. To reduce the risk of cyber-attacks and the loss of personal data, healthcare organisations must ensure a safe system to transfer, maintain and receive health information. Confidentiality can be achieved by access control and by using encryption techniques. Healthcare data may be exchanged only in pseudonymised or even anonymised form. In certain legal regimes, it may be obligatory that Cloud-based services are carried out in Germany or the EU at the very least.

In Germany, the legislator enacted the Health IT Interoperability Governance Ordinance (Gesundheits- IT -Interoperabilitäts-Governance-Verordnung – "GIGV") to ensure the secure and fast Cloud-based transfer of patient data.

10.2 What are the key issues that non-healthcare companies should consider before entering today's digital healthcare market?

As shown above, digital health products and services are strictly regulated and under a high level of surveillance. To offer such products and services on the market, companies must establish a comprehensive compliance organisation, including to meet the various regulatory, data protection and healthcare compliance requirements.

10.3 What are the key issues that venture capital and private equity firms should consider before investing in digital healthcare ventures?

There are restrictions to corporate ownership of certain healthcare service providers. While there are no ownership restrictions for hospitals, such restrictions exist with regard to physician practices and medical care centres (Medizinische Versorgungszentren – "MVZ"). As hospitals are entitled to hold MVZ, this is an option for corporate entities to indirectly operate MVZ and thereby employ physicians.

10.4 What are the key barrier(s) holding back widespread clinical adoption of digital health solutions in your jurisdiction?

The key barriers include high-market entry, reimbursement and compliance requirements. The market entry of MDSW is largely restricted by certification procedures under the new MDR and IVDR regimes that often require the involvement of notified bodies. However, as the new regulations maintain the general certification system and do not introduce a genuine approval requirement for MDSW (unlike for drugs), they are still regarded as an efficient market-clearance system. On the reimbursement side, while it may be difficult and time-consuming to convince SHI funds of new and innovative digital health products or services, recent legal developments have facilitated reimbursement, e.g., in the area of medical app prescriptions. Still, companies entering the German digital health markets must observe a number of regulations, including with respect to the processing and use of health data and cooperation with healthcare companies or healthcare professionals. In clinics, many healthcare services are still reserved to the physician by statutory laws and, hence, not or only partly replaceable by digital health solutions.

10.5 What are the key clinician certification bodies (e.g., American College of Radiology, etc.) in your jurisdiction that influence the clinical adoption of digital health solutions?

The German Physicians' Chamber (Bundesärztekammer – "BÄK") supervises all physicians practising in Germany. The Panel Doctors' Associations (Kassenärztliche Vereinigungen – "KV") supervise doctors that are entitled to provide healthcare services reimbursed under the SHI regime. Medical societies (Fachgesellschaften) issue guidelines that determine whether a treatment is considered state of the art.

10.6 Are patients who utilise digital health solutions reimbursed by the government or private insurers in your jurisdiction? If so, does a digital health solution provider need to comply with any formal certification, registration or other requirements in order to be reimbursed?

In Germany, medical apps have recently become subject to a general reimbursement scheme (see question 1.2 above). Besides that, reimbursement depends on the legal status of the respective digital health product or service. Medical devices may be reimbursable as medical aids (Hilfsmittel), or – in certain cases after testing periods – as new treatment methods. Digital healthcare services provided by physicians are reimbursed in the same manner as traditional physician services: their reimbursement in the outpatient sector in the SHI is subject to the Uniform Assessment Measure, (Einheitlicher Bewertungsmaßstab – "EBM"). New digital health products or services must be listed in the EBM in order to obtain reimbursement. Where such listing takes too long, companies still have the option to enter into reimbursement negotiations with individual SHI funds.

10.7 Describe any other issues not considered above that may be worthy of note, together with any trends or likely future developments that may be of interest.

With some delay, the electronic prescription ("e-prescription") is now being introduced in Germany. Since September 2022, pharmacies must be able to process e-prescriptions. From January 2023, the use of e-prescription shall be mandatory for physicians. Patients can decide to manage their e-prescription via smartphone using a secure e-prescription app and send it digitally to the pharmacy of their choice, or request a hardcopy of the access data required to redeem their e-prescription at the doctor's office.

In future, the concept of e-prescription shall be extended to other healthcare products and services, such as physical therapy, medical aids or home care.

To strengthen cross-border patient safety, the national e-health contact point is to be established by mid-2023, in order to facilitate availability of social insurance data to physicians in other EU countries.

Originally Published by ICLG

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.