1. Digital Health and Health Care IT

1.1 What is the general definition of "digital health" in your jurisdiction?

In general, digital health in India refers to the tools and services used for health services with the help of information and communication technologies, including the prevention, diagnosis, treatment, monitoring and management of diseases. The Ministry of Health and Family Welfare (MoHFW) regulates this sector.

1.2 What are the key emerging technologies in this area?

The digital health sector is continuously growing in India and some of the key emerging technologies include: telemedicine; the Internet of Medical Things (IoMT); robot-assisted surgery; self-monitoring healthcare devices; Electronic Health Records (EHR); Health Service Aggregation; mobile health; targeted advertising; e-pharmacies; cloud computing; and Artificial Intelligence (AI).

1.3 What are the core legal issues in health care IT?

As there is a regular exchange of information regarding health issues between the patient and the service provider, personal data protection is of prime concern. Although the Information Technology Act, 2000; Data Protection Rules, 2011; and Intermediaries Guidelines, 2011 are available, no standards have yet been set to mandate the implementation of data protection and security. Recently, the Personal Data Protection Bill, 2019 was introduced in Lok Sabha, on 11 December 2019. The said Bill seeks to provide for the protection of individuals' personal data and establishes a Data Protection Authority for the same.

2. Regulatory

2.1 What are the core health care regulatory schemes?

Healthcare schemes in India can be broadly classified under Central Sector Schemes, Centrally Sponsored Schemes and State Schemes. At national level, the Ministry of Health and Family Welfare (MoHFW) is the supreme body. Further, at state level, the organisation is under the department of health and family welfare of each state which is headed by a minister and has a secretariat under the charge of the Secretary or Commissioner (Health and Family Welfare) belonging to the cadre of the Indian Administrative Service (IAS). In addition, at regional level, each regional and zonal set-up covers three to five districts and acts under authority delegated by the State Directorate of Health Services; at district-level, the structure of health services is a middle-level management organisation that provides a link between the state and the regional structures on one side, and the primary health centres and sub-centres on the other. Furthermore, at community level, one community health centre has been established which provides basic specialty services in general medicine, paediatrics, surgery, obstetrics and gynaecology. Various schemes such as: Pradhan Mantri Swasthya Suraksha Yojana; the National AIDS and STD Control Programme; Family Welfare Schemes; the National Pharmacovigilance Programme; National Organ Transplant Programme; Impacting Research Innovation and Technology (IMPRINT) Scheme; and Swachhta Action Plan (SAP) are covered under Central Sector Schemes. Further, programmes such as the National Health Mission (NHM), National Rural Health Mission (NRHM) and National Urban Health Mission (NUHM) are centrally sponsored schemes which cover various other sub-schemes.

2.2 What other regulatory schemes apply to digital health and health care IT?

Some of the key ongoing initiatives in digital health being implemented by MoHFW include: Reproductive Child Healthcare (RCH); Integrated Disease Surveillance Program (IDSP); Integrated Health Information System (IHIP); e-Hospital, e-Shushrut, Electronic Vaccine Intelligence Network (eVIN); Central Government Health Scheme (CGHS); Integrated Health Information Platform (IHIP); National Health Portal (NHP); National Identification Number (NIN); Online Registration System (ORS); Mera Aspatal (Patient Feedback System); Health Management Information System (HMIS); and National Medical College Network (NMCN). These initiatives are operational at a substantially mature level and are already generating an enormous amount of data in the health sector. Since health is a state subject, states are supported under the National Health Mission (NHM) for services like Telemedicine, Tele-Radiology, Tele-Oncology, Tele-Ophthalmology and Hospital Information System (HIS).

2.3 What regulatory schemes apply to consumer devices in particular?

Consumer devices are usually protected under the Designs Act, 2000. A 'design' has been defined to mean only features of shapes, configurations, patterns, ornaments or the composition of lines or colours that are applied to an 'article'. In terms of digital health, the two major components that would require design protection would be the Graphical User Interface (GUI) of applications and the design of the devices. GUI may be protected under the Designs Act, more specifically under Article 14-04 of the Design Rules, 2001, which covers 'Screen Displays and Icons'.

2.4 What are the principal regulatory authorities? What is the scope of their respective jurisdictions?

The Central Drug Standards Control Organisation (CDSCO) is the prime regulatory authority which looks into provisions of The Drugs and Cosmetics Act, 1940 and Rules thereof. Further, the practice of medicine is regulated by the Medical Council of India. In addition, the protection in terms of intellectual property is regulated under the Office of the Controller General of Patents, Designs and Trade Marks (CGPTDM) and copyright is governed by the Copyright Office, both under the Department for Promotion of Industry and Internal Trade (DPIIT).

The legal and regulatory framework is usually governed by following relevant Acts:

  1. The Information Technology Act, 2000, The Information Technology (reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 and the Information Technology Rules, 2011.
  2. Other Service Providers Regulations under the New Telecom Policy 1999.
  3. The Drugs and Cosmetics Act, 1940 and Drugs and Cosmetics Rules, 1945.
  4. The Indian Medical Council Act, 1956 and The Indian Medical Council (Professional conduct, Etiquette and Ethics) Regulations, 2002.
  5. The Drugs and Magic Remedies Act, 1954 and Drugs and Magic Remedies Rules, 1955.
  6. Unsolicited Commercial Communications Regulations, 2007 and Telecom Commercial Communication Customer Preference Regulations, 2010.
  7. The Clinical Establishments Act, 2010.

2.5 What are the key areas of enforcement when it comes to digital health and health care IT?

Key areas for enforcement include standards and ensuring security, confidentiality and privacy of patient's health and records.

2.6 What regulations apply to Software as a Medical Device and its approval for clinical use?

The Central Drug Standards Control Organization (CDSCO) under Directorate General of Health Services (Ministry of Health & Family Welfare) is the primarily responsible authority for regulating medical devices and diagnostics in India. The Drug Controller General of India (DCGI) is the key official within the CDSCO. The DCGI is responsible for the approval of the manufacturing of certain drugs (vaccines, large volume parenterals, blood products, r-DNA derived products), specific medical devices, and new drugs. In India, the manufacturing, import, sale, and distribution of medical devices are regulated under India's Drugs & Cosmetic Act and Rules (DCA).

In India, at present only notified medical devices are regulated as 'drugs' under the Drugs and Cosmetics Act 1940 and Rules made thereunder in 1945:

(i) substances used for in vitro diagnosis and surgical dressings, surgical bandages, surgical staples, surgical sutures, ligatures, blood and blood component collection bag with or without anticoagulant covered under sub-clause (i);

(ii) substances including mechanical contraceptives (condoms, intrauterine devices, tubal rings), disinfectants and insecticides notified under sub-clause (ii); and

devices notified from time to time under sub-clause (iv), of clause (b) of Section 3 of the Drugs and Cosmetics Act, 1940.

3. Digital Health Technologies

3.1 What are the core issues that apply to the following digital health technologies?

  • Telehealth

A. System development, maintenance and implementation cost.

B. Digital awareness and technology acceptance.

C. Diagnostic accuracy.

  • Robotics

A. Energy storage.

B. Ethics and security.

  • Wearables

A. Cost of device.

B. Battery life.

C. Safety, security and privacy.

  • Virtual Assistants (e.g. Alexa)

A. Lack of accuracy.

B. Lack of analytical interpretation.

  • Mobile Apps

A. Competitive market.

B. Promotion and marketing.

  • Software as a Medical Device

A. Software development lifecycle.

B. Product safety and security.

C. Data collection and privacy.

  • AI-as-a-Service

A. Reliance.

B. Transparency and governance.

C. Long-term cost.

  • IoT and Connected Devices

A. Compatibility of operating systems.

B. Identification and authentication of devices and technologies.

C. Integration of IoT products and platforms.

D. Connectivity.

E. Data analytics, security and privacy.

F. Consumer awareness.

  • Natural Language Processing

A. Understanding of natural language.

B. Reasoning about multiple documents.

C. Identification of data and evaluation of problem.

3.2 What are the key issues for digital platform providers?

The primary issues for platform providers stem from the transitional phase of adopting new technologies. Accordingly, the following issues are of primary concern for digital platform providers: the state of the existing IT system and its upgradation; training for employees, along with understanding the importance of customer demand from the market; and leadership.

4. Data Use

4.1 What are the key issues to consider for use of personal data?

Data Privacy is a main concern in the use of personal data. In September 2013, the MoHFW notified the Electronic Health Record Standards (EHR Standards) for India. They were chosen from the best available, previously used standards applicable to international electronic health records, keeping in view their suitability to and applicability in India. Accordingly, the EHR Standards 2016 document is notified and is placed herewith for adoption in IT systems by healthcare institutions and providers across the country. The MoHFW facilitated its adoption by making available standards such as the Systematised Nomenclature of Medicine Clinical Terminology (SNOMED CT) free-for-use in India, as well as appointing the interim National Release Centre to handle the clinical terminology standard that is gaining widespread acceptance among healthcare IT stakeholder communities worldwide.

In addition, the MoHFW has proposed a new bill, the Digital Information Security in Healthcare Act (DISHA) to govern data security in the healthcare sector. The purpose of this Act will be to provide for electronic health data privacy, confidentiality, security and standardisation. The MoHFW, through the proposed DISHA, plans to set up a statutory body in the form of a national digital health authority for promoting and adopting: e-health standards; enforcing privacy and security measures for electronic health data; and regulating the storage and exchange of electronic health records. In addition, the Personal Data Protection Bill, 2019 was introduced in Lok Sabha, on 11 December 2019 which intends to seek to provide for the protection of the personal data of individuals, and establishes a Data Protection Authority for the same.

4.2 How do such considerations change depending on the nature of the entities involved?

Such considerations are important and usually change with the experience and issues observed during the transition and lag phase between the consumer and service provider.

4.3 Which key regulatory requirements apply?

The MoHFW, through the proposed DISHA, plans to set up a statutory body in the form of a national digital health authority for promoting and adopting: e-health standards; enforcing privacy and security measures for electronic health data; and regulating the storage and exchange of electronic health records. In addition, the National Digital Health Authority (NeHA) under MoHFW is a proposed authority that is intended to be responsible for the development of an integrated health information system in India. It is proposed to be a promotional, regulatory and standard-setting organisation to guide and support India's journey with Digital Health and consequent realisation of benefits of ICT intervention in the health sector. It also spells out the proposed functions and governance mechanism of NeHA. DISHA is the legislation that seeks to formally establish NeHA and facilitate the online exchange of patient information with a view to prevent duplication of work and streamline resources.

4.4 Do the regulations define the scope of data use?

Yes, the regulations define the scope of data use with consent, and also define what is 'sensitive health-related information' and 'sensitive personal information'.

4.5 What are the key contractual considerations?

The primary contractual consideration for data protection would be to enter into non- disclosure and confidentiality agreements with employees which provide remedies in case of disclosure of confidential information.

5. Data Sharing

5.1 What are the key issues to consider when sharing personal data?

The key issues in sharing personal data are primarily, but not limited to: the transparency and control of data exchange; security and privacy; and information, trust, responsibility and accountability.

5.2 How do such considerations change depending on the nature of the entities involved?

Such considerations can change during data sharing, particularly data protection and privacy, as this is an important concern.

5.3 Which key regulatory requirements apply when it comes to sharing data?

The MoHFW created the draft for the Digital Information Security in Healthcare Act (DISHA) with the aim of securing the healthcare sector data in India, giving people complete ownership of their health data. For example, if you are visiting a doctor for a check-up and the doctor places your results into an electronic health record (EHR) that information is completely protected by DISHA as it is placed within the healthcare system. DISHA proposes three main objectives such as: setting up a digital health authority at national and state levels; enforcing privacy and security measures for electronic health data; and regulating the storage and exchange of electronic health records. Additionally, the draft also provides details on the establishment of National and State Electronic Health Authorities (NeHA and SeHA). In effect, it would provide extensive data protection to Indian subjects, as well as govern the data portability.

6. Intellectual Property

6.1 What is the scope of patent protection?

The Patents Act, 1970 provides patent protection in India which is compliant with Trade-Related Aspects of Intellectual Property Rights (TRIPS) and has been adopting and implementing the provisions. To obtain a patent protection in India, apart from the patentability criteria-novelty, inventive step and industrial applicability, the invention must not fall within the ambit of Section 3 and 4 of the Act. As any digital health application works on software and a computer program, Section 3(k) of the Indian Patents Act is relevant which precludes patentability of a computer program per se. Recently, the Delhi High Court has iterated that all computer programs are not barred under Section 3(k) and when such program demonstrates a 'technical effect' or a 'technical contribution', the invention would be patentable.

Additionally, a patent may not be granted if the program or device is intended to be 'a process for the medicinal, surgical, curative, prophylactic or other treatment of human beings or any process for a similar treatment of animals to render them free of disease or to increase their economic value or that of their products' under Section 3(i) of the Indian Patents Act. However, the device and process of using an in vitro mechanism is considered patentable.

6.2 What is the scope of copyright protection?

The Copyright Act, 1957 provides copyright protection in India. A copyright can be applied for original literary, dramatic, musical or artistic work, cinematograph films, and sound recordings. Although the registration of copyright is not essential, it serves as prima facie evidence for establishing the right. Digital health application(s) essentially use software and will fall under the definition of 'computer program' and would be protectable under copyright law in India.

6.3 What is the scope of trade secret protection?

There is no exclusive law on dealing with confidential information and trade secrets in India. However, for the developing digital health industry such confidential information is usually protected by signing a mutual agreement such as a non-disclosure and confidentiality agreement.

6.4 What are the typical results on academic technology transfer rules?

Academic technology transfer in digital health and protecting intellectual property is in a nascent stage in India, and now institutions are becoming aware of the importance of protecting and disseminating their knowledge through technology transfer, and the trend seems to be continuing. Typical results on academic technology transfer rules and activities include the following which is not limited to: evaluation/assessment of the invention; protection of intellectual property relating to the technology; and searching and identifying the most suitable partner for licensing and demonstration of the working of the technology.

6.5 What is the scope of intellectual property protection for Software as a Medical Device?

Section 3(k) of Indian Patents Act precludes patentability of computer program per se. Recently, the Delhi High Court has iterated that not all computer programs are included under Section 3(k) when such program demonstrates a 'technical effect' or a 'technical contribution'.

Additionally, a patent may not be granted if the program or device is intended to be 'a process for the medicinal, surgical, curative, prophylactic or other treatment of human beings or any process for a similar treatment of animals to render them free of disease or to increase their economic value or that of their products' under Section 3(i) of the Indian Patents Act. However, the device and process of using an in vitro mechanism is considered patentable.

Digital health application(s) essentially use software, thus, they should fall under the definition of 'computer program' and be protected under copyright law in India.

In addition, one of the classes under which a trademark can be registered is class 9, which includes 'computer software and computer programs'.

7. Commercial Agreements

7.1 What considerations apply to collaborative improvements?

For collaborative improvements, various considerations not limited to the following can be practically adopted; such as: primary objectives for such collaboration; details of all eligible members; consideration of management of governance along with dissemination of contract management; confidentiality and evaluation of existing intellectual property and technology transfer; and information regarding the allocation of payments, rights, obligations, liabilities, variations and termination are certain facts for consideration while applying for collaborative improvements.

7.2 What considerations apply in agreements between health care and non-health care companies?

The working concept of healthcare and non-healthcare companies is different in mechanism and approach; however, the prime concern for both sectors is consumer satisfaction. While considering the agreements, the confidentiality protocol for exchange of data and data protection and privacy must also be considered.

8. AI and Machine Learning

8.1 What is the role of machine learning in digital health?

Machine learning in digital health has the following primary roles:

  1. Ease of process to reduce cost, time and efforts.
  2. Identifying disease and diagnosis.
  3. Drug discovery and manufacturing.
  4. To analyse machine learning-based behaviour modifications.
  5. To maintain health records.
  6. Clinical trial and data collection.
  7. Outbreak prediction.

8.2 How is training data licensed?

Currently, India does not have any specific laws for regulation of AI and machine learning and accordingly the activities for these must be in compliance with the existing IT Acts and regulations. In addition, a confidentiality agreement between licensee and licensor can be in place for record.

8.3 Who owns the intellectual property rights to algorithms that are improved by machine learning without active human involvement in the software development?

Currently, this is not applicable in India.

8.4 What commercial considerations apply to licensing data for use in machine learning?

Authenticity of the licensed data, permission for users, consideration for purpose such as 'know-your customer', restriction on various locations, data privacy and security, quality, rights for using the term and termination are of prime considerations.

9. Liability

9.1 What theories of liability apply to adverse outcomes in digital health?

The liabilities that apply to adverse outcome can be civil or criminal in nature and would be different for practitioners running the services and for service providers such as institutes and online suppliers. For civil cases, the remedies are available under the Consumer Protection Act and action as to file a suit before a civil court. In case of negligence by a doctor, a customer can raise a complaint before the ethics committee of the Medical Council of India. Further, criminal liability is dealt with under the provisions of the Indian Penal Code.

9.2 What cross-border considerations are there?

Data localisation is of prime concern.

10. General

10.1 What are the key issues in Cloud-based services for digital health?

Primarily the high cost of implementing and maintaining health information technology for digital health is a challenge. Further, security and privacy of data management is another important issue which needs attention.

10.2 What are the key issues that non-health care companies should consider before entering today's digital health care market?

Besides proper business planning and approach for data privacy and security, non-healthcare companies must understand that the health sector follows highly regulated standards for manufacturing and marketing. Additionally, for the healthcare market consumer laws are also applicable.

10.3 What are the key issues that venture capital and private equity firms should consider before investing in digital health care ventures?

Some of the key issues that venture capital and private equity firms should consider before investing in digital health care ventures are: proper business plan; market opportunity; strategic partnership; understanding of financial and key matrices for business; potential risk for business; expected valuation; and IP protection.

Originally Published by ICLG.com

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.