EU national authorities are struggling to grasp how to regulate apps and other digital health products. But before they have had the chance to gain full confidence about their responsibilities and how to carry out them out, new requirements are on the way in the form of the EU Medical Devices Regulation.
Added to this is the challenge of the reimbursement systems that exist within the different countries. These systems appear to be at an even more preliminary stage that the regulatory frameworks. Medtech Insight spoke with attorney Alexandre Regniault, an associate partner at the law firm Simmons & Simmons in Paris, about some of the details of EU regulatory and reimbursement challenges for digital health.
"National authorities are generally not yet convinced of the usefulness of the connected app or mHealth device," Regniault says.
Medtech Insight: What are the biggest regulatory challenges for apps and other digital health products at present under the EU Medical Devices Directive?
Alexandre Regniault: The main issue today for the sector is to determine whether an app or digital product falls within the scope of the Medical Devices Directive. This generally requires conducting a medical and a technical assessment of the functionalities of the app or digital product. It is also worth noting that in France, the national authorities are not quite ready to allow the reimbursement of mHealth products. Indeed, national authorities are generally not yet convinced of the usefulness of the connected app or mHealth device – and it is up the medical device companies to demonstrate the added value to the patient when applying for reimbursement of their products. Also, the procedures for applying for reimbursement are quite long and could be an obstacle to market access for some products, whose life-time span is shorter than for non-digital medical devices. This is particularly challenging for the many companies in this area that are SMEs: The challenges related to funding and finding the right contact to submit their funding application in the public and the private sector are particularly acute since they do not necessarily have the resources to navigate the system.
How should companies go about managing these challenges?
Regniault: For the moment, companies will need to wait for progress to be made by national authorities and in terms of the implementation of assessment criteria specific for digital products – especially for reimbursement. One step was made last year in France with the first authorization for reimbursement awarded to a digital medical device; this was an app used as part of a telemedicine service for diabetic patients to help them monitor their insulin dosage. However, the French national authority in charge of deciding the reimbursement of medical devices (“CNEDiMTS”) limited reimbursement to the use for type 1 diabetic patients – to whom specific training on the use of the medical device should be delivered. For the [more numerous] type 2 diabetic patients, CNEDiMTS considered there was insufficient data available to assess whether the digital product could contribute to the improvement of the patients' medical condition. Some companies believe that existing funding and reimbursement guidelines are not appropriate for the assessment for digital health products and that constitutes an obstacle for their reimbursement via the social security system But there are developments on the way with CNEDiMTS recently announcing that it will draft dedicated guidelines for the assessment of health connected devices with the view of their reimbursement.
What are likely the biggest regulatory challenges specific to apps and other digital health products under the new Medical Devices Regulation?
Regniault: The MDR will increase the requirements in terms of clinical evaluation. With the entry into application of this text on May 26, 2020, a reassessment of the digital products will be necessary to determine whether they fall within the scope of the category of medical devices – and, if so, what class they fall into. In addition, the MDR will reinforce the obligations of the various operators in the manufacturing and distribution chain. One of the challenges will be to determine who should be considered as the manufacturer and as the distributor of the device. Another challenge will be the post-market monitoring of the medical device, and the requirement to notify any incident regarding its safety. Today, cyberattacks are mainly targeted against IT systems of major companies or administrations. However, the risk of cyberattacks on medical devices is possible, and it is up to medical device companies to implement sufficient safeguards to prevent possible attacks. Many companies will need support to meet the new clinical evaluation requirements and to maximize the use of pre-existing data in this respect.
What proportion of these products needs to be reviewed by a notified body?
Regniault: Before the MDR, companies were able to perform self-certification for class I medical devices – into which many apps, for example, fall – for which a review by a notified body was not required. With the MDR, those class I products will need reassessing to see whether the qualification as a medical device – and the class – is still valid under the new regulation or whether the product should be reviewed by a notified body.
Is there sufficient knowledge and capacity among notified bodies to deal with the demand for reviewing these products?
Regniault: When reviewing digital products or apps, notified bodies have to assess whether the technical specifications of the product are adequate and reliable in terms of security. So, notified bodies will need to cultivate new technical skills and competence to assess the products at a technical level and understand the IT complexity.
"A reassessment of the digital products will be necessary to determine whether they fall within the scope of the category of medical devices – and, if so, what class they fall into."
Where a notified body is not involved, what are the potential pitfalls for companies?
Regniault: Where a notified body is not involved, companies operating in France are able to refer to the guidelines published by the French National Authority for Health (HAS) on health apps and smart devices (mobile health or mHealth). But manufacturers will have to make their own risk assessment at the technical and medical level, and determine for themselves whether their product should qualify as a medical device. Another aspect to consider would be to determine the respective obligations of the various operators – manufacturer vs. distributor.
How much regulatory work are lawyers having in this field now? Is this likely to grow and, if so, why?
Regniault: As lawyers, we assist our clients during the process of preliminary assessment of the digital product to assess its qualification as a medical device and its risk class. The digital health products sector is a fast-growing sector; companies in the health sector are aware of the necessity to rapidly adapt to the new technologies used by patients in their everyday life. They are also aware that young doctors tend to use new technologies when creating patient-care programs. In addition, more and more studies show the positive effective of digital medical devices in patients' lives, so it is to be expected that an increasing number of new digital products will be designed in the health sector. The question remains, however, whether the social security and national administrations will be also convinced of the usefulness of these products for the national health systems.
What market access challenges are there and in which markets are these the least and the most demanding?
Regniault: Market access challenges that manufacturers might face include showing clinical evidence that the device would improve the patient’s life; conducting a medical and clinical analysis to help convince national authorities in charge of reimbursement decisions of the cost-effectiveness of the digital product; determining the requirements under which the digital product/app could be linked to a telemedicine system, for example to allow for videoconferencing; and dealing with national health authorities, such as CNEDiMTS, which are not yet used to performing technical assessments of digital products. Telemedicine has been acknowledged in French law since 2009-2010 but these activities have not quite picked up yet due to difficulties in funding/reimbursement. The current draft social security budget law (PLFSS 2018) is trying to address this.