Digital Health

We assist companies that develop and operate digital platforms for the relationship between healthcare practitioners and patients, with the support of an integrated legal and technical/IT team, in analysing and managing the legal and contractual issues connected with developing and making available solutions for booking healthcare services.
We shape the service around the Client’s business model and our work can cover the design of the contractual framework, liability profiles and data protection compliance. In particular, we draft and negotiate contracts with healthcare facilities and practitioners, define the platform’s terms and conditions of use, allocate liability between the parties and set up the information flows and the legal bases for the processing.
We provide advice that combines legal and technical expertise, for solutions that are not only compliant but also workable in practice.

We work alongside the Client in assessing the feasibility of telemedicine services and in designing them, ensuring compliance with the applicable legislation and with sector guidelines.
We take account of the organisational model and the clinical purposes of the project and support the Client from the preliminary analysis through to the operational development of the service. Our legal support includes the qualification of the services (telehealth visit, teleconsultation, telemonitoring), the verification of authorisation and organisational requirements, the preparation of the privacy notice and consent and the definition of professional liability profiles and of the management of healthcare records.
We are committed to providing oversight that integrates the legal, technology and data protection aspects, in compliance with all applicable rules.

We issue specialist opinions on the applicability of the rules specific to the digital health sector — including the Italian electronic health record (“Fascicolo Sanitario Elettronico”) , telemedicine, compliant digital preservation and online reporting — with a precise indication of the related compliance obligations.
The service is personalised to the Client’s role and the features of the project and draws on an integrated legal and technical/IT team. Among other things, our opinions address the interoperability and feeding of the Fascicolo Sanitario Elettronico, the requirements for compliant preservation and digital reporting, the obligations on signatures and time stamping and the implications for the protection of health data.
We aim to offer an operational reading of the regulatory framework, translating legal requirements into concrete, immediately usable guidance.

We work alongside companies developing digital health solutions, with the support of an integrated legal and technical/IT team, in analysing and managing the legal, contractual and data security issues connected with their development and roll-out.
The service can cover individual products or the entire digital ecosystem. We assist the Client in defining the contractual framework with technology suppliers and partners, qualifying the solutions (including as software medical devices), protecting intellectual property and embedding privacy and security by design principles throughout the development cycle.
Our approach is to oversee the legal, contractual and IT security aspects side by side.

We provide legal assistance in building solutions for booking medical services and for online reporting.
The service covers the design of the contractual framework, compliance with sector rules and the protection and security of health data. Our support addresses identity and access management, integration with booking systems and payment circuits, the secure delivery of medical reports, compliance with retention periods and the definition of responsibilities and service levels with suppliers.

We provide legal and technical advice on the data protection aspects of handling health data processed through mobile and wearable devices.
The service covers data protection obligations, IT security aspects and the contractual framework with the suppliers involved. We analyse the data flows generated by apps and wearables, the legal bases and user notices, any transfers to third countries and the technical security measures (encryption, minimisation, pseudonymisation) needed to protect particularly sensitive data.

We support the Client in carrying out data protection impact assessments (DPIAs) on e-health and m-health solutions.
We differentiate the deliverable as far as possible according to the nature of the processing and the complexity of the solution. We handle the risk analysis, the identification of mitigation measures and the preparation of the documentation required by the GDPR. We adopt a structured risk analysis methodology, involving the DPO where appointed, assessing the need for prior consultation of the Italian Data Protection Authority and defining a plan for the periodic review of the assessment as the solution and the regulatory context evolve.

We work alongside the Client in correctly implementing Patient Relationship Management (PRM) solutions. We study the patient relationship processes and take account of the complexity of the systems adopted. Our assistance covers the contractual, data protection and IT security aspects of managing communications and health data. In particular, we oversee the management of contact channels and promotional communications, the proper collection of consent, user profiling and segmentation, data retention periods and the relationships with the technology suppliers involved.
Our support accompanies the Client from the design of the solution through to its operation.

We work alongside the Client in outsourced IT and cloud computing projects in the healthcare sector.
We devote a first phase of the work to analysing the technology architecture and the sourcing model adopted. The service covers contracts with suppliers, the protection of health data and IT security measures. We negotiate outsourcing and cloud contracts, define data processing agreements and sub-processor arrangements, address data localisation and portability requirements, exit and reversibility strategies and coordination with security and business continuity obligations.

Every company operating in the healthcare sector runs into a range of ordinary legal issues that often call for multidisciplinary input — with higher management costs and a greater dispersion of energies, which inevitably affect how quickly action can be taken. This is the scenario the Legal Desk service offered by netforLegaL is designed for. It is a multidisciplinary legal assistance and advisory service whose availability and, above all, speed the Client can always count on. The service meets the need to outsource the handling of legal issues in less complex business contexts and can also be a valuable support to the in-house legal department in more structured organisations.
The involvement of a pool of senior professionals — organised by area of specialisation — allows the Client to capitalise on the advisory experience gained, ensuring constant regulatory updates in its sector. The multidisciplinary approach also delivers attractive economies of scale.

Our areas of work include:

• Legal and contractual assistance to companies developing digital health solutions;
• Opinions on the application of sector rules (FSE, telemedicine, e-health);
• Impact assessments on e-health and m-health solutions and on the processing of health data;
• Assistance with Patient Relationship Management, online booking and reporting solutions;
• Management of health data on mobile and wearable devices;
• Outsourced IT and cloud projects in the healthcare sector;
• Training for healthcare and administrative staff.

For each Client the service involves a “contact lawyer”, who coordinates the work and has an ongoing relationship with the company. The presence of this figure brings:

• A stronger relationship of trust with the Client;
• The progressive personalisation of the service, as knowledge of the company context steadily grows;
• The guarantee of a constant legal presence, which also plays a proactive role towards the Client.

As for how the service is offered, the methodology is that of a typical help desk: maximum freedom and flexibility for the Client to set upfront an annual budget for the initiative, to make the most of its economies of scale.
The expected result is to turn what has perhaps been perceived until now as the cost of regulatory compliance into an insurance policy — or an investment — in the peace of mind of doing things properly.

Our services also include training sessions on digital health and the processing of health data. Our training is designed to offer both a general grounding in the principles of the legislation and more specific, technical and operational content, tailored to the Client’s sector and to any special regulations that apply. As part of our ongoing advisory work, we also deliver dedicated training sessions on the correct use and implementation of the documentation and procedures adopted.
All our learning services are modulated and adapted to the specific needs of the Client and can be delivered both in class and at distance; timing, duration and recipients of such sessions are always defined in advance and agreed upon with the Client, with the possibility to arrange single sessions for personnel with specific duties and competences within the company.
We furthermore offer drafting of learning materials (e.g. awareness raising materials, simulations of possible scenarios with fictional characters, legal text easily accessible via hypertext) which can also be uploaded into e-learning platforms including animations, sounds, multiple answers questions and randomized answers.
We also offer a range of “ready-to-go” solutions, thanks to a consolidated collaboration with our technological partner Mediamed Interactive, which allows us to offer to our Clients a product based on the more evolved and widespread training platforms, so that our Clients can enjoy both standard sessions or more tailored sessions.
We also deliver tailor-made training on shifts in ward-level responsibility, on human-in-the-loop safeguards and on preventing “automation bias” (uncritical reliance on the algorithm), with an analysis of medical negligence and civil liability profiles.