A Legal Insight into Aarogya Setu Mitr characteristics – Tele-medicine, e-Pharmacy e-Diagnostics and Data Protection!

Safeena Mendiratta, Corporate Lawyer, Senior Associate, Kapil Sapra & Associates discusses the legalities associated with services offered by the platform ‘aarogyasetumitr.in’ namely tele-medicine, e-pharmacy, e-diagnostics and data protection issues related to the same

The office of the Principal Scientific Adviser to the Prime Minister and NITI Aayog along with voluntary participation from start-ups, industry coalitions and other organisations have launched a public and private collaborative initiative i.e. Aarogya Setu Mitr platform (‘Mitr Platform’).

Mitr Platform with URL ‘aarogyasetumitr.in’ (‘Website’) is a pioneering building block for India’s health stack amidst the COVID-19 pandemic and intends to provide users door-step access to certain services by three categories of service providers namely Tele-medicine Counsels, e-Diagnostic Partners and e-Pharmacy Partners.

Tele-medicine Counsels registered and listed on Mitr Platform will provide free Tele-medicine consultation to the users in all official Indian languages. The Website presently supports Hindi and English Tele-medicine consultation services. The pre-requisites for registering as a Tele-medicine counsel are – availability of minimum 100 number of doctors on a daily basis, full responsibility for KYC for every doctor, free COVID-19 consultations, non-solicitation of patients and minimum guaranteed service level of 95 per cent.

e-Diagnostic Partners: In addition to free Tele-medicine Consultations, the paid ancillary services such as laboratory testing and home sample collection are intended to be provided through sample collection partners. Such partners will include vendors providing booking and home collection services in certain States and that are duly approved by Indian Council of Medical Research (‘ICMR’). The pre-requisites for registering an e-Diagnostic Partner are – running of home sample collection service in minimum 25 cities, ability to undertake COVID-19 sample home collection, accreditation by NABL, presence of tracking system for phlebotomists and minimum guaranteed service level of 95 per cent.

e-Pharmacy Partners: In addition to on-boarding Tele-medicine Counsels and e-Diagnostic Partners, Mitr Platform also provides for registration and listing of e-pharmacy(ies). The pre-requisites for registering as an e-Pharmacy Partner are – minimum service delivery in 10,000 pin-codes, possessing more than three years of experience and minimum guaranteed service level of 95 per cent.

It will be worthwhile to provide a legal insight into four specific characteristics of Mitr Platform i.e. Tele-medicine consultation, e-Diagnostics, e-Pharmacy and Data Protection.

As a pre-cursor to the launch of Mitr Platform, the Ministry of Health and Family Welfare (‘MoHFW’) issued Telemedicine Practice Guidelines (‘Tele-medicine Guidelines’) [1] dated March 25, 2020 enabling Registered Medical Practitioners (‘RMP’) to provide ‘Healthcare’ using ‘Telemedicine’. Further, the Board of Governors, in supersession of Medical Council of India (‘MCI’) adopted these Tele-medicine Guidelines [2] and included the same as an amendment to the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulation, 2000 by inserting Regulation 3.8 captioned “Consultation by Telemedicine”. Presently, these Telemedicine Guidelines provide a regulatory framework for healthcare providers who are practising allopathic medicines.

Until the issuance of Tele-medicine Guidelines, there was no specific law or guidelines in India on the practice of tele-medicine and the existing provisions under Indian Medical Council Act, 1956 (‘IMC Act’), the Indian Medical Council (Professional Conduct, Etiquette and Ethics Regulation 2002) (‘Ethics Regulations’), The Drugs & Cosmetics Act, 1940 and Rules 1945 (‘D&C Law’), The Clinical Establishment (Registration and Regulation) Act, 2010 (‘CERRA’), Information Technology Act, 2000 (‘IT Act’) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (‘SPDI Rules’), Other Service Providers Regulations under the New Telecom Policy, 1999 primarily governed the practice of tele-medicine and information technology.

In addition to specifying role and responsibilities of the RMP’s, the Tele-medicine Guidelines provide specific guidelines for ‘platforms enabling Tele-medicine’ (‘Guidelines for Platforms’). Such Guidelines require – platforms to (a) ensure that the users are consulting with RMP’s which are duly registered with national medical councils or respective State Medical Council (‘SMC’) and who comply with relevant provisions; (b) conduct due diligence before listing any RMP on its online portal; and (c) listing of the name, qualification, registration number, and contact details of every RMP listed on the platform etc. Further, if the platform is found in violation of these guidelines, the Board of Governors may black list the technology platform and as a result, no RMP may then be able to use that platform to provide Tele-medicine.

Presently, the Tele-medicine consultation legal framework is at a nascent stage and requires clear provisions on various aspects. Some issues which need consideration include legality of the practice of other medicines, the ability of the medical practitioners registered in one state to practice in other state, multiplicity of laws in documenting a valid prescription, misuse of prescriptions, professional indemnity insurance, indirect advertisement or promotion of e-Pharmacy and e-Diagnostic partners resulting in freebies to the Tele-medicine Counsels, determining patients identity, capturing consent of patient (both minor and adult), implementing nation-wide framework for adopting electronic health records etc.

In the context of e-diagnostics, CERRA regulates all public and private sector clinical establishments including medical diagnostic / pathological laboratories (‘CE’) which must register with the relevant authority and conform to the minimum standards as prescribed under CERRA [3].

CERRA is applicable in certain States namely Arunachal Pradesh, Himachal Pradesh, Mizoram, Sikkim, Bihar, Rajasthan, Uttar Pradesh, Uttarakhand, Jharkhand, Assam, Haryana and all Union Territories except the NCT of Delhi. Each SMC issues registrations under CERRA based on the location of the CE and category (clinics / diagnostic centres, medical diagnostic laboratory etc.) which results in complexity in compliance, implementation and enforcement. Certain States such as Maharashtra, Karnataka and Kerala have their own State clinical establishment legislations and hence fall outside the scope of CERRA. Recently, the Cabinet also approved Punjab Clinical Establishment (Registration and Regulation) Ordinance, 2020.

Some legal challenges related to CERRA include the requirement of obtaining different registrations for each of its ‘centres’, applicability of two different regimes in the event a service provider has one centre in a State under CERRA and another centre in a State where CERRA is not applicable, absence of specific standards for certain field workers resulting in challenges in determining negligence thereof, inclusion of institutions offering tele-medicine services as part of CERRA etc.

Several States have been reluctant to adopt CERRA on account of certain industry concerns including but not limited to display of offered services along with fees, required minimum infrastructure etc. [4]

The current COVID-19 pandemic has resulted in synergies of several academic research institutions and start-ups which have developed new tests, both for the RT-PCR approach and for the antibody detection in connection with diagnosis and testing. Further, the capacity for both these tests has significantly scaled up as laboratories all over the country have been linked. In addition, the consortia have also addressed the challenge in respect of import of reagents to meet the current pandemic requirements [5]. The current thrust holds promise for the development of a robust long-term industry in this area.

In the context of e-Pharmacy, at present, there is no law to regulate e-pharmacies or online / electronic pharmacies. The Indian Medical Association as well as the brick and mortar pharmacies have opposed the operation of e-pharmacies and conducted ‘pharma bandh’ from time to time. The MoHFW had issued comprehensive draft regulations dated August 28, 2018 [6] to amend the D&C Law by incorporating separate provisions for regulating online pharmacies. However, the same have not yet been finalised since the issue remains entangled in the bureaucratic circles of the MoHFW. Subsequently, the Madras and the Delhi High Court passed orders banning online sale of medicines. The Madras High Court eventually lifted the ban and directed the Government to notify the draft rules expeditiously. On November 28, 2019, the Drug Controller General of India directed all States and Union Territories to prohibit sale of medicines through unlicensed online platforms until the draft rules on e-Pharmacies were finalised [7] .

The Pharmacy Practice Regulations, 2015 which regulate the practice of pharmacy by registered pharmacists in India specify that prescription drugs must be handed over to the patient or to patient’s agent directly by a registered pharmacist. Therefore, it becomes practically daunting in an online set-up to have pharmacists deliver medication directly to the patients. Other issues in relation to e-pharmacy include validity of scanned copy of prescription which is not authenticated by means of electronic signatures as specified under the IT Act.

Nevertheless, MoHFW on account of the exigency created on account of COVID-19 pandemic, recently spearheaded in issuing another notification dated March 26, 2020 permitting home-delivery of drugs [8] by way of retail sale directly to the consumers. Such notification however does not specify if such home delivery can be facilitated by e- pharmacies. Further, the said notification provides that the drugs may be dispensed ‘based on receipt of prescription physically or through email’ thereby making it easier for e-pharmacies to dispense drugs even if the prescription is not digitally signed. It is necessary to consider the significance of e-pharmacies which may effectively fulfil the unmet needs of a large section of people both amidst and post the COVID-19 pandemic. Accordingly, any further clarity on continuance of the door step delivery of medicines post the COVID-19 pandemic by offline as well as online / e-pharmacies will be appreciated.

Further, despite the resistance and the technological challenges, access to virtual courts has become the new normal norm and accordingly any considerations in respect of in respect of jurisdictional issues for any civil, criminal or consumer cases stands significantly reduced. Presently, the online / e-pharmacies continue to operate under the gaps of law and look forward for a clear positive regulatory framework.

In the context of Data Protection, the Terms of Service (‘Terms’) and the Privacy Policy presently uploaded and available on the Website are quite brief and sketchy. The use of the Website is intended to constitute deemed acceptance of the original or revised Terms of Service. Further, any implied or express acceptance of the Terms will constitute consent to the Privacy Policy. Any failure to comply with these Terms will result in suspension of the user’s ability to use the Website. Further, the Terms also provide that the use of each service linked from the Website shall be separately governed by Service Provider’s respective Privacy Policy and terms of service.

The Privacy Policy is even briefer than the Terms and provides for the following:

Information Collection, Use and manner of collection: Information such as IP address, postal PIN Code from which the Website is accessed, details of the device accessing the Website is collected and stored securely on a server operated and managed by the Website. Further, when an application to join is submitted, all information provided by the sender is only used to contact the sender and securely managed by the Website. The information retained by the Website can be utilised to run analytics regarding the usage of / access to the Website.

Data Security and Data Encryption: The Website is equipped with standard security features to protect the confidentiality and security of information and the data (both in transit and at rest) is encrypted.

Grievance handling procedure by sending an email to a specified email address.

Mitr Platform is a public private collaboration and intends to establish a marketplace or an aggregator solution for Tele-medicine Consultation, e-Pharmacy and e-Diagnostics.

As an intermediary, it needs to ensure compliance with the Information Technology (Intermediaries Guidelines) Rules, 2011 issued under IT Act, 2000 and therefore observe due diligence as specified in Rule 3 besides ensuring compliance with other laws.

Further, other obligations of Mitr Platform under the SPDI Rules will be determined based on the role it plays as a body corporate either controlling or processing the data, the nature of the data collected i.e. whether it is personal information and / or sensitive personal data or information and lastly the points of accessing the data i.e. at the time of registering the various service providers on Mitr Platform and / or or post the registration. The Privacy Policy of Mitr Platform presently specifies that only limited information such as IP address, contact address etc. is collected for contacting the persons who submit an application for joining Mitr Platform. Accordingly, any collection, handling, dealing or disclosure of such personal information including sensitive personal data or information will have to ensure compliance with SPDI Rules.

It is pertinent to note that the current SPDI Rules fail to stipulate any specific provisions relating to applicability of the provisions to Government or any public private initiative and further lack clarity on IP address, Internet of Things (IoT), cookies, data localisation, cloud services, data analytics, anonymisation, encryption, distinction between consent, informed consent and explicit consent, distinction between data controller and data processors etc. Further, certain provisions such as compensation to the affected person for failure to protect data under Section 43A and penalty for breach of confidentiality and privacy under Section 72 of the IT Act remain untested in the Indian courts.

In view of the aforesaid, it is imperative that the aforesaid issues are addressed expeditiously and the Government must pave way for the new Personal Data Protection Bill, 2019 (‘PDP Bill’) which is still pending in the Parliament. The PDP Bill requires explicit consent of the data principal for processing of sensitive personal data (which covers health data) (‘SPD’) or for responding to a medical emergency involving threat to life or severe threat to health of data principal or any other individual. It also make provision for data localisation and provides that while SPD must continue to be stored in India even though it may be transferred outside India, critical personal data must only be processed in India.

In addition to the PDP Bill, the proposed ‘Digital Information Security in Healthcare Act’ seeks to formally establish ‘National Electronic Health Authority’ and facilitate online exchange of patient information to prevent work duplication and streamline resources.

Way forward

Mitr Platform has ignited hope amidst the COVID-19 pandemic for a healthcare revolution. As a public private initiative, it brings together digital health commitment from various stakeholders for prevention as well cure of various ailments of the public.

An analysis of the pre-requisites of registration of the Tele-medicine Counsels reveals that only large Tele-medicine Counsels (and not individual doctors) are presently eligible for registration since the eligibility requirements specify availability of minimum 100 no of doctors on a daily basis. Similarly, only large e-Diagnostic and e-Pharmacy Partners are presently eligible to register on the Mitr Platform since the requirements stipulate service deliveries in minimum cities and pin-codes. It seems that Mitr Platform is cautious in reaching the targeted customers and is looking forward to listing only established players in the market. Surprisingly, it does not provide any option to the brick and mortar pharmacy /diagnostic centres to list online. Such pharmacy brick and mortar centres have been our frontline warriors in the COVID-19 pandemic and have been undertaking home delivery of medicines. Further, any clarity as to whether Mitr Platform is intended to survive the COVID-19 pandemic or is merely a temporary / stop-gap arrangement will be welcome.

The public interest seems to be the consensus-ad-idem of the Mitr Platform promoters as well as inventors. It remains to be seen whether the India’s developing legal regulatory framework will further ignite or impede its purpose. In order to be truly effective and meaningful, this initiative must analyse the legal as well as practical gaps from the perspective of legislation, compliance, overlap, implementation and enforcement. A holistic effort may be necessary to analyse the nuances of each of Mitr Platform’s characteristics namely – Tele-medicine, e- Pharmacy and e-Diagnostic. Accordingly, it will be best that existing or archaic laws be simultaneously assessed as well as upgraded to meet the exigencies of the times. In fact, the Government can with the support of other stakeholders initiate to rectify or upgrade the current legal inconsistencies and / or imperfections not just for this COVID-19 pandemic but for an eternal public private partnership. Simultaneously, it must expeditiously address the data protection issues and pave way for the new Data Protection Bill, 2019 to bring about a technologically healthy revolution.

Besides upgrading the current laws, this is an opportune time to welcome the dawn for a consolidated central legislation which can bring together all the characteristics of Mitr Platform and yet meaningfully transform the core of the healthcare sector. Accordingly, the Government must engage in stakeholder discussions and seek feedback on various characteristics of healthcare including Tele-medicine, e-Pharmacy and e-Diagnostic to pave way for a medical revolution in 2020.

References:

1 https://www.mohfw.gov.in/pdf/Telemedicine.pdf

2 https://mciindia.org/MCIRest/open/getDocument?path=/Documents/Public/Portal/LatestNews/01-

%20Public%20Notice%20for%20TMG%20-Website%20Notice-merged.pdf

3 http://www.clinicalestablishments.gov.in/cms/Home.aspx

4 https://www.tribuneindia.com/news/archive/punjab/7-years-on-clinical-act-hangs-in-balance-861811

5 Press release dated 5 th May, 2020 captioned ‘PM chairs a meeting of the Task Force on Corona Vaccine Development, Drug Discovery, Diagnosis and Testing’.

6 https://cdsco.gov.in/opencms/opencms/system/modules/CDSCO.WEB/elements/download_file_division.jsp?num_id=MTkzOQ==

7 https://www.livemint.com/news/india/government-directs-states-to-take-action-against-unlicensed-online- pharmacies-11575376011403.html

8 https://www.mohfw.gov.in/pdf/Doorstepdelivery26B.pdf