Worldwide: Virtual And Digital Health Digest

Welcome to the latest installment of Arnold & Porter's Virtual and Digital Health Digest. This edition primarily covers February 2023 highlights across the virtual and digital health space. This digest focuses on key virtual and digital health and telehealth related developments in the United States, United Kingdom, and European Union in the healthcare, regulatory, corporate transactions, and privacy spaces.

FDA REGULATORY UPDATES

FDA Releases Discussion Paper on Artificial Intelligence in Drug Manufacturing. On March 1, 2023, FDA's Center for Drug Evaluation and Research issued a discussion paper titled "Artificial Intelligence in Drug Manufacturing" (Discussion Paper). The Discussion Paper presents areas for consideration and policy development associated with application of AI to pharmaceutical manufacturing. As further detailed in the Discussion Paper, AI offers many possibilities in the pharmaceutical industry, including optimizing process design and process control, smart monitoring and maintenance, and trend monitoring to drive continuous improvement. Areas of consideration with AI in manufacturing discussed in the paper include: (1) cloud applications may affect oversight of pharmaceutical manufacturing data and records; (2) the Internet of Things (IOT) may increase the amount of data generated during pharmaceutical manufacturing, affecting existing data management practices; (3) applicants may need clarity about whether and how the application of AI in pharmaceutical manufacturing is subject to regulatory oversight; (4) applicants may need standards for developing and validating AI models used for process control and to support release testing; and (5) continuously learning AI systems that adapt to real-time data may challenge regulatory assessment and oversight. Notably, FDA explains that there are additional areas of consideration not covered in the paper, for example, difficulties that could result from ambiguity on how to apply existing regulations to AI or lack of FDA guidance or experience

The Discussion Paper includes specific questions for stakeholder feedback, such as areas of AI in manufacturing where guidance may be beneficial, common practices for validating and maintaining self-learning AI models, and necessary elements for manufacturers to implement AI-based models in a cGMP environment. Comments are due by May 1, 2023.

FDA Hosts Conference on Artificial Intelligence (AI) and Machine Learning (ML) in Precision Medicine. On February 17, 2023, FDA hosted a conference titled "Application of Artificial Intelligence and Machine Learning for Precision Medicine" in collaboration with the University of Maryland Center of Excellence in Regulatory Science and Innovation (M-CERSI). The conference included remarks and presentations from numerous FDA officials, including from the Center for Drug Evaluation and Research (CDER) and the Center for Devices and Radiological Health (CDRH), with materials available here. FDA officials recognized that the use of AI/ML to support drug development has increased substantially in recent years. CDER officials discussed the steps the center has taken in this area, including (1) collaborating with CDRH, the Center for Biologics Evaluation and Research (CBER), and other centers on issues involving AI/ML in medical product development to improve consistency and (2) creating an AI steering committee in 2020 to promote effective use and sustainment of AI in CDER's decisionmaking and operations. CDER also outlined its planned next steps relating to AI/ML, including workshops, white papers, a discussion paper, harmonizing and tailoring "Good Machine Learning Practice for Medical Device Development" to drug development, and supporting development of regulatory science methods. CDER emphasized that its overarching goal in this space is "to develop and adopt a flexible risk-based regulatory framework that promotes innovation and protects patient safety."

FDA Establishes a Digital Health Steering Committee and Launches DHT Resources Webpage. FDA recently announced that it has established a digital health steering committee. The steering committee is made up of senior staff from CDER, CBER, and CDRH, including from the Digital Health Center of Excellence (DHCoE). Creation of this steering committee fulfills a commitment FDA made under PDUFA VII to establish a committee from the drug and biologic centers to work with DHCoE to coordinate FDA's DHT-related work under the PDUFA program. The steering committee's responsibilities include:

• Assisting with the implementation of the framework to promote the use of digital health technologies (DHTs) in drug and biological product development, as well as other related commitments made by FDA in the PDUFA VII commitment letter
• Overseeing activities to ensure consistent approaches to the review of drug submissions that contain DHT derived data
• Engaging with external stakeholders on DHT-related issues in drug development

The DHT Steering Committee is discussed on a new FDA webpage focused on the agency's digital health technologies-related activities. The page also contains information on how to meet with FDA; DHT-related public meetings, workshops, and other webinars; DHT-related guidance; and other DHT-related resources.

FDA Launches List of DHT Demonstration Projects. FDA also recently launched a webpage that lists FDAfunded DHT demonstration projects. The page currently contains information on two funded projects. One project is entitled "Using mHealth to Measure Impact in Functionality Behavior, Activity and Sleep Patterns in Children and Adolescents Treated with Psychotropics" and the other project is entitled "Evaluati[ng] Mobile Health Tool Use for Capturing Patient-Centered Outcome Measures in Heart Failure Patients."

HEALTHCARE FRAUD AND ABUSE UPDATES

DOJ Signals Concern About Data-Sharing Among Healthcare Organizations. On February 3, 2023, the Department of Justice's (DOJ) Antitrust Division announced the withdrawal of three policies jointly authored by DOJ and the FTC — the 1993 Department of Justice and FTC Antitrust Enforcement Policy Statements in the Health Care Area; the 1996 Statements of Antitrust Enforcement Policy in Health Care; and a 2011 statement on Antitrust Enforcement Policy Regarding Accountable Care Organizations Participating in the Medicare Shared Savings Program. These policies provided guidelines on a variety of business collaborations in the healthcare industry, including joint ventures, joint purchasing agreements, and other collaborations. The policies also provided a "safe harbor" where industry surveys, including price and cost information, would not be challenged by antitrust authorities if they met the following conditions:

• The survey must be managed by a third party.
• The information provided is relatively old or stale
• The information is aggregated to protect the identity of the sources.
• A sufficient number of sources are aggregated to prevent competitors from linking particular data to an individual source.

According to the department, these old policy statements were "overly permissive on certain subjects, such as information sharing." Similarly, at an antitrust conference on February 2, 2023, DOJ's Principal Deputy Assistant Attorney General Doha Mekki stated that the guidance provided in these documents "no longer reflects the market realities of the modern health care system or the Division's current enforcement priorities."

Competition in healthcare is a focus for antitrust enforcement authorities. Companies should review their collaborations with competitors and any ongoing information exchanges or benchmarking exercises for antitrust risk. For further information, please see Arnold & Porter's blog post on this topic here.

False Claims Act Settlements and Judgments Exceed $2 Billion in Fiscal Year 2022. On February 7, 2023, DOJ announced that the 2022 False Claims Act settlements and judgments reached the second-highest number of settlements in history, exceeding $2.2 billion in the fiscal year (ending on September 30, 2022). DOJ specifically highlighted some cases involving telehealth, reminding the industry of the need to be vigilant regarding the medical necessity requirement regardless of whether services are furnished in person or virtually. One case DOJ emphasized was the settlement with Physician Partners of America LLC (PPOA). In this case, the United States alleged that PPOA caused the submission of claims for medically unnecessary urine drug testing, requiring physician employees to order multiple tests at the same time without ascertaining whether this testing was necessary or reasonable. PPOA incentivized physicians to order these tests by paying them 40% of the profits from this testing in violation of the Stark Law. In relevant part, with respect to telehealth, DOJ alleged that PPOA instructed physicians to schedule bi-weekly telehealth appointments with patients "for the sole purpose of increasing revenue during the pandemic."

Troy Doctor Indicted on Healthcare Fraud, Accused of Bilking Medicare of More Than $448,000. In February 2023, a Michigan physician was indicted by a federal grand jury on a charge of healthcare fraud, alleging that she ran a scheme to submit fraudulent claims to Medicare. Dr. Sangita Patel operated Advance Home Physicians Center in Troy, Michigan where she allegedly submitted more than $1 million in false claims to Medicare for telehealth services she did not provide throughout the public health emergency. In turn, Medicare paid more than $448,000 on these fraudulent claims. The criminal complaint states that Dr. Patel would have an unlicensed medical assistant 5 | Arnold & Porter contact patients by telephone on her behalf, yet she submitted claims attesting that these interactions were telehealth services she furnished. Moreover, the criminal complaint alleged that "[o]ver 90% of the patients involved in Patel's telehealth insurance claims received Schedule II controlled prescriptions," and Patel would "send electronic prescriptions to pharmacies without any interaction with the patients." If convicted, Patel faces a maximum of 10 years in prison.

PROVIDER REIMBURSEMENT UPDATES

DEA Issues Proposed Rules Addressing Permanent Regulatory Telemedicine Flexibilities. On February 24, 2023, the Drug Enforcement Agency (DEA) released two long-awaited proposed rules that seek to permanently expand the rules for prescribing Schedule III-V controlled substances via telemedicine beyond the end of the public health emergency (PHE). Comments are due March 31, 2023.

Under the Ryan Haight Act, practitioners are required to conduct an in-person evaluation of a patient before they can prescribe controlled substances over the internet. The in-person requirement under the act was waived during the COVID-19 pandemic, but will resume when the PHE ends without further action by government officials. The DEA proposed rules propose to permanently waive this requirement in limited instances of telemedicine. There are other categories of telemedicine recognized under the Ryan Haight Act that are not covered by this rule.

In the first proposed rule, DEA, in concert with the Department of Health and Human Services (HHS), proposes to permanently authorize telemedicine pursuant to the Ryan Haight Act where (1) the prescribing practitioner has not conducted an in-person medical evaluation with the patient; (2) the prescription was issued pursuant to a telemedicine encounter; and (3) the telemedicine encounter resulted in a prescription for a non-narcotic schedule III-V controlled substance. See 88 FR 12876. In addition, the proposed rule would require prescribing practitioners to include a notation on each prescription issued to show that the prescription has been issued via a telemedicine encounter. See 88 FR 12876.

The second proposed rule was issued pursuant to DEA's Fall 2022 Unified Agenda, where the agency expressed its commitment to expand access to buprenorphine, the only Food and Drug Administration schedule III-V approved narcotic used in the maintenance or detoxification treatment of opioid use disorder. The rule proposes to allow practitioners, in limited instances, to prescribe schedule III-V narcotic drugs or the combinations of such drugs that have been approved for use in such treatment via telemedicine, including audio-only encounters. DEA believes this proposed rule will expand access to buprenorphine and future drugs approved to treat opioid use disorder because many patients seeking the drug may lack the financial means to obtain in-person treatment or through the traditional audio-video telemedicine format. See 88 FR 12890, 12894. DEA is also proposing to promulgate further regulations to mitigate the risks of diversion. DEA notes that buprenorphine is a "critical tool" used to fight opioid use disorder, but one that poses a high risk of misuse and death if not controlled effectively. See 88 FR 12894.

Both proposed rules would permit telemedicine prescriptions only in limited circumstances. The proposed rules do not cover telemedicine appointments that do not involve or result in the prescribing of controlled medications, telehealth appointments by practitioners who have previously conducted an in-person medical examination of the patient, nor telehealth appointments if the referring medical practitioner previously conducted an in-person medical examination of the patient. In addition, both proposed rules propose to limit each prescription furnished via telemedicine to a 30-day supply until there has been a form of in-person visit. See 88 FR 12881; 88 FR 12895.

Public reception to these proposed rules has been overwhelmingly negative from industry stakeholders and politicians on both sides of the aisle. Many critics believe the proposed rules do not go far enough to permanently preserve the expanded telemedicine access the PHE set in motion. The American Telemedicine Association (ATA) issued a statement, calling the proposed rules "significantly more restrictive than is warranted." ATA takes issue with the limited duration of the telemedicine prescription period, maintaining that "mandatory in-person visits are clinically unnecessary barriers to appropriate care."

Some lawmakers have criticized the proposed rules for creating a barrier to effective opioid use disorder treatment, pointing to the potential to exacerbate the opioid crisis if patients experience delays in access to in-person appointments. Lawmakers have also criticized the in-person requirement at the end of the 30-day period and are advocating for an extension or a complete waiver of the in-person requirement.

CAC Meeting Convened. On February 28, 2023, the Medicare Administrative Contractors (MACs) held a multi-jurisdictional Contractor Advisory Committee (CAC) meeting to discuss two types of Remote Patient Monitoring: Remote Physiologic Monitoring (RPM) and Remote Therapeutic Monitoring (RTM).

Remote Patient Monitoring allows physicians to monitor certain aspects of a patient's health status from their home or additional remote locations. It is covered by Medicare and has dramatically risen in use since the start of the PHE. This rise in use has been fueled, in part, by expanded insurance coverage, a growing awareness of telehealth options, and advancements in medical technology. Remote Patient Monitoring can also reduce the opportunities to transmit contagious diseases and infections.

The purpose of the meeting was to obtain advice from CAC members and subject matter experts regarding their use of RPM and RTM and the strength of published evidence for RPM and RTM.

Subject matter experts on the CAC panel were chosen to provide a broad representation of medical specialty, background, geography, and practice setting. Medical directors from all of the MACs, except National Government Services, participated in the discussion.

The meeting's format consisted of opening remarks, followed by a discussion of several questions relating to clinical experience and adequacy and expert assessment of literature on RPMs and RTMs. The overwhelming sentiment of the group was that the panelists greatly support the use of RPM and RTM technology in their practices and believe that the literature — in addition to their clinical experience — supports its efficacy and helpfulness to the healthcare system across a broad array of metrics.

The review of the evidence presented at the meeting and through written comments will be considered in determining whether a collaborative Local Coverage Determination (LCD) should be developed.

PRIVACY UPDATES

FTC Fines Online Mental Healthcare Company $7.8 Million, Alleging Unfair and Deceptive Sharing and Use of Personal Health Information. On March 2, 2023, the Federal Trade Commission (FTC) announced a proposed settlement with online mental health counseling service BetterHelp, Inc. for alleged violations of Section 5 of the FTC Act's prohibition on unfair and deceptive practices. In its complaint against BetterHelp, the FTC asserted that the company, contrary to its representations to consumers, shared the personal health data of visitors to the BetterHelp website with third parties such as Facebook and Snapchat for advertising purposes. According to the FTC, while BetterHelp's privacy policies stated the company would use and disclose the email address, IP address, and Intake Questionnaire responses of an individual website visitor for intake and certain other purposes, the policies did not mention advertising purposes or the disclosure of consumers' information to third parties for those parties' own purposes. In fact, the FTC claimed, BetterHelp uploaded the email addresses of visitors to the company's website to third parties such as Facebook, and those email addresses constituted personally identifiable health information, as the addresses implicitly identified the visitors as persons seeking mental health treatment.

The FTC acknowledged that BetterHelp "hashed" consumers email addresses (i.e., converted them into a sequence of letters and numbers) before disclosing them to third parties, but claimed that BetterHelp knew that the recipient third parties would be able to undo the hashing. Facebook allegedly matched the email addresses provided by BetterHelp with those of Facebook's customers and sent those individuals targeted advertisements encouraging them to refer their Facebook friends to BetterHelp for mental health services. In addition, BetterHelp allegedly similarly shared consumers' IP addresses, and "[e]ach such disclosure similarly constituted a disclosure of [personal] health information because it both identified the individual (via the IP address) and conveyed to the recipient third party that the [consumer] was seeking and/or receiving mental health treatment.

The BetterHelp settlement emphatically underscores the risks inherent in collecting, using, and sharing information that could be construed as indicative of a particular individual's health. A privacy policy or other representation to consumers that fails to consider the implications of collecting any information from or about those consumers in the health services context could be a target for FTC scrutiny and discipline. And the stakes are high: under the proposed consent order, BetterHelp must, among other things, pay a fine of $7.8 million, cease sharing individually identifiable information relating to the mental health of a consumer with any third party for advertising or re-targeting purposes, and obtain affirmative, express consent before sharing any consumer's personal information with a third party for other purposes. 

CORPORATE TRANSACTION UPDATES

Amazon Closes $3.9 Billion Deal Acquiring One Medical. On February 22, 2023, Amazon announced it closed its $3.9 billion deal to acquire virtual and primary care provider One Medical. One Medical, dubbed the "Netflix-for-primary-care," has merged with Amazon with the goal of making on-demand healthcare more accessible. Through the acquisition, Amazon gains access to almost 190 brick-and-mortar clinics, a subscription telehealth service, an electronic health record, and direct contracts with thousands of employer clients. Under One Medical's membership structure, for an annual fee of $144, new members can access services, including in-office and telehealth visits, on-site labs, and programs for various health concerns, including preventive care, chronic care management, common illnesses, and mental health concerns.

One Medical will allow Amazon to resume expanding its telehealth offerings after shutting down its own telehealth service, Amazon Care, last year. In its news release announcing the closing, Amazon specifically touted One Medical's digital health services including "around-the-clock access through the One Medical app" and "on-demand virtual care services, like 24/7 video chats and easy in-app messaging, which are included in membership at no extra cost." This acquisition showcases Amazon's continued focus on and strategy of bending the cost curve in healthcare through integration of technology, efficient access, and data.

This multi-billion dollar deal, one of Amazon's largest to date, came after speculation that the merger would be delayed by FTC's ongoing investigation of the deal. While FTC ultimately allowed the deadline to bring a suit blocking the merger to pass, it reserved the right to continue investigating and specifically noted a focus on Amazon's control and use of sensitive consumer data as an ongoing concern.

GE HealthCare Announces Plans To Acquire AI Imaging Firm, Caption Health. GE HealthCare, newly spun-off from GE Electric, is already making big moves in acquiring Caption Health, an artificial intelligence imaging firm. After announcing the acquisition on February 9, 2023, GE HealthCare advertised the merger as expanding access to ultrasound imaging by providing technology that even novice users can use.

By integrating Caption Health's AI technologies within GE HealthCare's ultrasound devices, such ultrasound machines could provide earlier detection of life-threatening diseases and more accurate initial diagnoses, while at the same time making it more accessible. For example, heart failure has been nicknamed "the silent killer" because the symptoms often go unnoticed until it is too late for intervention. Caption Health's AI technology should make heart ultrasounds more accessible by putting such devices in the hands of more users. This, in turn, could result in earlier detection of heart disease and thereby act as a great equalizer to health quality and outcomes related to this disease. GE Electric's ultrasound segment brought in over $3.4 billion in revenues in 2022, and if the acquisition proves to be complementary, GE HealthCare could begin to see immediate economic benefit. While the terms of the deal are not public information, GE HealthCare announced it will fund the acquisition from its cash reserves.

The UK's First Medtech Strategy Is Published. On February 3, 2023, the UK's Department of Health and Social Care (DHSC) published its first medical technology (medtech) strategy. The strategy focuses on general medical devices, IVDs, and digital tools, as well as areas of overlap between physical devices and digital tools. The strategy aims to reduce diagnostic bottlenecks, reduce waiting lists, support long-term financial sustainability of the National Health Service (NHS) and provide patients with faster access to safe, effective, and innovative medical devices. The strategy identifies four priority areas:

1. Improve the resilience and continuity of supply chains.
2. Coordinate and speed up the implementation of new medtech.
3. Collect clear data and metrics on medtech availability and collaborate with the medtech industry.
4. Have a focused approach for specific technologies, clinical specialties, populations, and places of use. It was noted that there is significant ongoing work around the use of digital and artificial intelligence, both in medtech products and as standalone products.

An implementation plan describing the priority areas will be published in early 2023.

Evaluation of the UK Government Commitments Made on the Digitization of the NHS. On February 17, 2023, the Health and Social Care Committee published a report from a panel of experts evaluating the progress the UK government has made against its commitments relating to the digitization of the NHS in England. The panel reviewed nine commitments across four policy areas: (1) care of patients and people in receipt of social care, (2) health of the population, (3) cost and efficiency of care, and (4) workforce literacy and the digital workforce. Although it recognized that significant progress had been made in these areas, the report concluded that some key commitments have not been met or are not on track to be met. For example, the rollout of the NHS App, the use of digital home monitoring, and commitments relating to the purchasing of digital technologies were rated "requires improvement," and ensuring that there are sufficient staff with the requisite knowledge and skills to implement digitization was rated "inadequate." The committee expects the DHSC to respond within two months.

PRIVACY UPDATES

Update From the EMA on the Commission's Call for Proposal on the Framework for the Secondary Use of Health Data. On February 8, 2023, the European Medicines Agency (EMA) published a note on the European Commission's (Commission) Call for Proposal, which launched in January 2023, related to "Developing a Data Quality and Utility Label for the European Health Data Space." The Commission is seeking proposals from applicants for a common EU framework on the secondary use of health data. The Commission states that to support data users in the discovery and selection of datasets, there is a growing need to develop a data quality and utility framework to articulate the characteristics and the potential usefulness of datasets. This framework will also support data holders in identifying and addressing areas of improvement which can, in turn, allow for wider and better use of these datasets. Any proposed framework should take into account both the needs of data users and burdens put on data holders with respect to utility and quality. The EMA's note contains information to be considered by applicants when proposing that the EMA be involved in their proposals. The EMA states that it will not lead, manage, or coordinate a work package or part of the work program, but may provide expertise where appropriate. The deadline for proposals is April 13, 2023. 

EDPB Work Program 2023/2024. On February 22, 2023, the European Data Protection Board (EDPB) published its work program for 2023/2024. The program is divided into four pillars:

1. Advancing harmonization and facilitating compliance with data protection laws
2. Supporting effective enforcement and cooperation between national supervisory authorities
3. Promoting a fundamental rights approach to new technologies
4. Promoting high global standards for international data transfers

Under pillar 3, the EDPB proposed to publish guidelines on telemetry and diagnostic data and guidelines on the interplay between the AI Act and the GDPR.

EDPB Adopts Opinion on Draft EU-U.S. Data Privacy Framework Adequacy Decision. On February 28, 2023, the EDPB adopted Opinion 5/2023 on the European Commission's Draft Implementing Decision on the adequate protection of personal data under the EU-U.S. Data Privacy Framework (DPF). While noting substantial improvements in the DPF, the EDPB recommends that the European Commission make a number of changes to its draft adequacy decision to better protect the personal data of individuals that are transferred to the U.S. Some of these changes include clarifications on the scope of exemptions, obligations on organizations bound by the DPR to assess the data protection laws of third country's prior to an onward transfer, and specific rules about individuals' rights with respect to automated decision-making. The EDPB also recommends that the European Commission monitor the effectiveness of redress avenues for EU data subjects, and that the adequacy decision should be conditional on the adoption of the updated policies and procedures to implement EO 14086 by all U.S. intelligence agencies. See our Enforcement Edge blog for more details.

UK Government Opens Online Survey on Software Resilience. On February 6, 2023, two departments within the UK government launched an online survey to collect stakeholders' views on how the government can build upon existing interventions to address software risks in the development, distribution, use, and maintenance of software packages and overall create a more resilient digital environment. Two such interventions are the new Code of Practice for App Store Operators and App Developers, discussed in our January digest, and a policy paper published in July 2022 on a pro-innovation approach to regulating AI. The survey is split into three sections (software risks, existing industry measures, and future government action) and is aimed at software in all sectors, not solely digital health. The last date to respond is May 1, 2023. The formal government response is expected to be published in summer 2023.

REIMBURSEMENT UPDATES

France Launches a Fast-Track Reimbursement Pathway for Digital Health Technologies. In February 2023, a new fast-track reimbursement pathway was launched in France called "Prise en charge anticipée (PECAN)." PECAN provides a transitional one-year reimbursement access pathway for innovative digital therapeutic medical devices and remote-patient-monitoring activities before applicants obtain reimbursable status under the standard system. It therefore enables patients to rapidly access such technologies. To be eligible under PECAN, digital devices must have a CE marking, various technical certifications (e.g., for cyber security and GDPR), a clinical evaluation, and data on healthcare benefits. After a favorable opinion from the Commission of the French National Authority for Health (CNEDiMTS), based on the first available data and from the French eHealth Agency on compliance with interoperability and security guidelines, the solution will be reimbursed for one year. Within a fixed time period, the company must then file for standard reimbursement.

The new French pathway takes inspiration from the DiGA pathway in Germany. However, whereas DiGA only applies to class I to IIa devices, PECAN is open to all classes of medical devices.

Digital Mental Health Tech for Children and Young People Recommended by NICE. Four digital technologies that can help children and young people with mild to moderate symptoms of anxiety or low mood have been recommended in new NICE guidance in England. These technologies are the first to be recommended under NICE's early value assessment guidance, which allows promising health technologies to be used in the NHS while further evidence is still being generated. The additional evidence will then be reviewed enabling NICE to make a recommendation on routine use across the NHS. The products offer a mix of games, videos, and quizzes, based on cognitive behavioural therapy (CBT) principles, and help children and young people learn techniques to better understand and manage their symptoms of anxiety or low mood. These technologies can be used in the NHS once they have been given Digital Technology Assessment Criteria (DTAC) approval by NHS England.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.