When regulations have to play catch-up: Telehealth, online consultations and practicing medicine in an increasingly digital world

With the digital health market developing fast, and into increasingly diverse areas, regulations are often not keeping pace with how the industry works. Throughout the sector this is causing confusion as market players struggle to understand how to stay compliant.  Here, Fieldfisher partners Sarah Ellson and Paul Graham look at the state of affairs and look at what's going on.

In the last 2 years, there has been an explosion in the use of digital and electronic means of delivering healthcare in the UK and around the world. Whether it's referred to as 'telehealth', 'telecare' or 'telemedicine', in the medical world there's no getting away from the increasing importance of digital solutions in our healthcare delivery and provision.

And it's not just 'behind the scenes' developments that have gained traction – adoption of digital platforms is being surging among patients and health service users. Notably, in December last year, NHS digital reported[1] a surge in the use of various NHS online services noting a 912% increase in individuals using the NHS app and a 495% increase in repeat prescriptions via the NHS app.  

Within this, service and platform providers such as Babylon, Teladoc and Push Doctor have become familiar names and many internet and physical retail pharmacies now partner with online doctors.

While the Covid-19 pandemic proved a catalyst for greater adoption and acceptance of telehealth, many of these ways of delivering healthcare are not new.  But whilst telehealth has been around for a while, regulation has frequently not kept up with these changes, leaving providers uncertain about the requirements on them when they offer healthcare services in this way. 

Even within the UK the landscape is different in each of the 4 nations and the issue of cross-jurisdiction provision is particularly unclear.

There is no universal definition of telehealth, but for the purposes of this article we adopt the definition of the European Commission which states that "Telemedicine is the provision of healthcare services, through use of ICT, in situations where the health professional and the patient (or two health professionals) are not in the same location."[2]

Telehealth services are generally provided by way of three methods:

1. Video or telephone calls – appointments with GPs, other therapists or specialists, where data is collected from and provided to the patient in real time;
2. Store and forward technology – gathering electronic data to be reviewed at a later date by healthcare professionals which can include home monitoring via wearable devices, imaging, test results and electronic medical records;
3. Remote surgery – robotics used to perform operations remotely[3], and the developing field of augmented or mixed reality[4] (distinct from virtual reality which is also increasingly being utilised in the space).

This article focuses on the first of these methods and the issue of what services might need to register where.

The regulatory landscape

Regulated healthcare activities in England, Scotland, Wales and Northern Ireland are each governed by separate independent regulatory regimes (Care Quality Commission, Healthcare Improvement Scotland, Care Inspectorate Wales and the Regulation and Quality Improvement Authority respectively) who regulate the services provided. These regulators are set up by and underpinned by overarching primary legislation concerning healthcare, which in England is the Health and Social Care Act 2008 ("the HSCA").

Provision of a "regulated activity" by service providers[5] established in England requires CQC registration (or is otherwise a criminal offence). For a company providing services via the internet, the place of establishment is not the place at which the technology supporting its website is located (i.e. the data centre location) or the place at which its website is accessible, but, according to the EU's e-Commerce Directive, the place where it pursues its "economic activities".  Where a services provider has several places of establishment, the relevant place of establishment for the service concerned is the place where the provider has the "centre of its activities" relating to this particular service.   The CQC Regulations[6] set out a list of what constitutes a regulated healthcare activity, remote service provision is referenced in Regulation 9 "Transport services, triage and medical advice provided remotely" which refers to:

           (2) Medical advice in cases where immediate action or attention is needed, or triage provided, over the telephone or by electronic mail by a body established for that purpose.

When tech overtakes regulations

The 2014 Regulations have arguably become dated[7] and Regulation 9 does not squarely address all the activities currently being carried out within the telehealth space. For example, a primary care consultation over video call  -which may not fall within Section 9.  Not because a video call is not within the plain language interpretation of over the telephone but actually because where telehealth is provided as an adjunct to more traditional in person services, providers in England (such as a GP surgery or clinic) will usually be registered for Regulation 4 "the treatment of disease, disorder or injury". 

Regulation 9 is targeted at those providers specifically established for remote provision of services in cases that need immediate attention or action or triage (and was not originally intended to capture general healthcare advice).

Exactly which kinds of "providers" have to register is complex too.  With increasing prescribing rights being given to other healthcare professionals, some providers offer services via Pharmacist Independent Prescribers ("PIPs") who require registration with the General Pharmaceutical Council but not CQC.

If CQC registration is required, when inspecting online primary care providers the CQC's key lines of enquiry largely mirror those for General Practitioners, though there is an additional list of prompts for telehealth providers which set out some of the additional considerations involved.[8]

Jurisdictional issues for telehealth providers

One of the most interesting issues for telehealth providers is the question of jurisdiction and determining which regulatory regimes might apply.  Working out where a telehealth company is established and therefore might need to be registered and required to comply with legal frameworks requires analysis of the place where it pursues its economic activities. 

The e-Commerce Directive was implemented into UK law by the Electronic Commerce (EC Directive) Regulations 2002/2013 (the "Regulations").  In the EU businesses can enjoy the protection of the "country of origin" principle (otherwise known as the Article 3 protection)

The country of origin principle allows information society service providers generally to operate across the EU while only being required to comply with the laws of the Member State in which they are legally established (Art. 3).   It should be noted however that Member States may take measures to derogate from Article 3 if it is considered necessary for the protection of public health or the protection of consumers (Art. 3, 4(a)(i)).  So that can be requirements placed on service providers in the EEA to ensure that their services are compliant with local law requirements.

Following Brexit, the UK's Regulations were amended by the Electronic Commerce (Amendment etc.) (EU Exit) Regulations 2019.  Ultimately the UK government intends to remove the Directive’s country of origin principle from UK legislation to bring EEA online service providers in scope of UK laws, so anyone providing services in the UK will have to comply with UK laws. However, the principle is expressed in a number of pieces of UK legislation and will be removed in stages when parliamentary time allows.

The CQC has issued guidance[9] as part of its registration process asking providers to state the "location" where each regulated activity is being carried on, at or from. Relevant to telehealth providers, it states within its "nine rules" for determining location, that where it is not possible to identify where a regulated activity is being carried on under rules 1-8, the regulated activity may be considered to be delivered or managed from the headquarters or business address. One example provided of this is:

For the CQC's purposes, the location of telehealth service providers is likely to be the headquarters or business address within England.

The CQC has always stated that it does not normally regulate providers based outside England that offer care and treatment to patients in England. This appears to be based what it means to be "established" in a country and the practical realities of out of jurisdiction enforcement.

That said in February 2022, the CQC successfully prosecuted Pharmacorp Ltd (also known as Medicine Direct) for running an online service which involved GMC registered doctors based in Romania prescribing medication to patients following completion of an online questionnaire. The medication was sent to patients by post from the company’s premises in Stockport.

The website operated by the company misled patients by suggesting they were using doctors based in the UK.  The CQC was clear that required digital providers using doctor consultation services to be registered as a provider. Pharmacorp were not registered and were found to be in breach of s 10 of the HSCA and incurred a total penalty of over £13,000.[10]  In their case however they did have a UK base and whether action would or could have been taken if they had been located off-shore remains uncertain.

Operating telehealth is not without multiple practical considerations about its suitability and patient safety.  We will return to these in a later article.

Summary

Telehealth solutions are clearly becoming more integrated into the provision of regulated healthcare activities across the world and while regulation is catching up, it is clearly behind the curve.

When trying to assess whether your service falls within the regulatory framework in England, ask yourself:

1. Does my business provide a regulated healthcare activity or service?
2. What is or are the location/s of those services?
3. Are we certain as to the regulatory requirements that attach in each jurisdiction? 

If you are looking to provide services from afar we can help you assess the associated legal and compliance risks.