Careful examination of the product classification
Incorrect classification can lead to legal problems and distribution bans. Manufacturers should therefore carefully consider what functions the software has and how they draft the intended purpose.
After we had already discussed the (decision) proceedings of the Higher Regional Court of Hamburg in an editorial on our website, the Higher Regional Court of Hamburg now issued a judgment on 20.06.2024 under file number 3 U 3/24. This ruling could represent a significant decision on the risk classification of software as a medical device.
The focus was on an app that enables patients to send images of skin conditions to selected dermatologists, fill out a medical history questionnaire and provide personal data. The app was declared as a CE-marked medical device in risk class I in accordance with Rule 11 of the Medical Devices Regulation (EU) 2017/745. A competitor took legal action against this risk classification, initially seeking interim legal protection.
At the heart of the dispute was the question of whether the software was correctly classified and could therefore be placed on the market. The opposing party argued that the app should not be classified as a medical device in risk class I, but as risk class IIa or higher. According to Rule 11 of the Medical Devices Regulation (EU) 2017/745, software used to support diagnostic or therapeutic decisions is classified as Class IIa. The defendant, on the other hand, took the view that its app was merely a data transmission and communication solution and therefore belonged in the lower risk class I.
The court followed the opposing party’s argument and found that the app not only transmits data, but also intervenes in the diagnostic process by automatically adapting the medical history questionnaire. This happens independently of individual medical decisions and thus influences the basis for the medical diagnosis and therapy decision.
Therefore, the app is to be classified as a Class IIa or higher medical device, which requires more extensive certification, the involvement of the Notified Body and the affixing of the CE mark by the latter. Consequently, the defendant was ordered not to place the corresponding medical device on the market or make it available on the market as long as it is not certified as a medical device in risk class IIa or higher.
As was already the case in the previous proceedings, the court’s decision will be subject to much criticism from legal experts and expert associations. Based on the court’s reasoning, there is already a risk that all medical software could potentially be classified as risk classification IIa or higher.
This ruling highlights the complex legal situation regarding the classification of medical software applications and could also have an impact on already approved digital health applications (DiGA) that are financed by statutory health insurance (SHI). Companies that develop or distribute such products should consider the following points:
A new study shows that patients are less likely to upload stigmatized diseases, such as depression or sexually transmitted diseases, to their electronic patient record (EPR), depriving treating physicians of important information. In contrast, non-stigmatized diseases such as a broken wrist or type 1 diabetes mellitus do not influence upload behavior.
The research by Niklas von Kalckreuth and Prof. Dr. Markus Feufel from the TU Berlin, published in the journal JMIR Human Factors, investigates the influence of disease characteristics on upload behavior to the EPR. The study shows that the social stigmatization of certain diseases leads to a reluctance of patients to share these diagnoses digitally – regardless of whether the disease is acute or chronic.
Niklas von Kalckreuth explains that previous surveys indicated a high willingness to use the EPR, but that other studies have shown that actual use often falls short of the stated intentions. This indicates a gap between stated intention and actual behavior, which has important implications for the implementation and use of the EPR.
The German public health insurances (GKV) has published a report on the current provision of digital health applications (DiGA). The results shed a critical light on the successes and challenges of this innovative area of healthcare to date.
By October 2022, only 33 applications had found their way into the DiGA directory. In total, DiGA had been used around 164,000 times by September 30, 2022, resulting in service expenditure of 55.5 million euros. According to the umbrella organization, however, it is questionable whether this can be considered a success.
The report shows that the majority of applications were unable to demonstrate any positive effects on care when they were included in the DiGA directory. Two thirds of DiGAs were only provisionally included in the directory. Of the permanently approved applications, three were not included in the full scope of indications, and three trial DiGAs were even completely removed from the directory.
Another major problem is the high prices charged by manufacturers for their DiGAs. On average, these are around 500 euros per quarter. Trial DiGAs, which have no proven positive supply effect, are particularly expensive, with prices ranging from 600 to 952 euros. Even the maximum amounts introduced on October 1, 2022 could not significantly reduce the high price level.
The report by the German public health insurances clearly shows that the introduction and use of DiGA has so far been associated with considerable challenges. The high costs and the lack of evidence of positive healthcare effects in many applications call into question the sustainable integration of these digital healthcare solutions. There is an urgent need for measures to improve the cost efficiency and effectiveness of DiGA in order to fully exploit the potential of this technology.
The view of the umbrella organization is viewed very critically by service providers.
In a recent ruling, the European Court of Justice (ECJ) classified the TC string, an alphanumeric character string that encodes the user’s consent preferences for online advertising, as personal data. This decision is based on Art. 4 No. 1 GDPR, according to which personal data means any information relating to an identified or identifiable natural person. Identification can also take place indirectly through assignment to an online identifier.
The ECJ has confirmed that it is sufficient for identifiability if a person can be indirectly identified by additional information. It is not necessary for all information to be available for a single person. Personal data also includes all information resulting from the processing of such data.
The TC-String contains the user’s preferences, which, according to the ECJ, can contribute to direct identification. In addition, the TC-String information can be used to create a user profile and identify the person concerned via an identifier, such as the IP address. The fact that the defendant itself cannot link the TC string to the IP address does not change this, as the relevant information does not have to be in the hands of a single person.
The defendant can use legal means to obtain information from its members that enables user identification. Therefore, the TC-String is to be considered as personal data.
The ECJ confirms its previous case law that the concept of personal data must be interpreted broadly. The decision makes it clear that information such as the TC-String, which can indirectly contribute to the identification of a person, must also be classified as personal data. This may have far-reaching consequences for the practice of online advertising and data protection.