Telemedicine in Italy: Healthcare authorization profiles in the modern medico-legal reading

1. Introduction

The ruling n. 38485, 20 June 2019, of the Italian Supreme Court, III criminal section, addressed by the perspective of the law the very sensitive and new issue of telemedicine and, in detail, analyzes the question of its authorization by the local health authority and consequently deals with the legitimate exercise of a health activity, where the concept of physical space can be overcome by the possibility of its performance at a distance, in an apparent non-place and between absentees, towards the information and communication technology (ICT) [1,2].

In fact, the Italian dated dictate of the Royal Decree No. 1265 of July 27, 1934, Consolidated Text of Health Laws (Testo Unico delle Leggi Sanitarie, hereinafter TULS), with its purposes and although partially updated by the Legislative Decree 30 December 1992, n. 502 and the Legislative Decree 19 June 1999, n. 229 and by regional health authorization regulations, has been the subject of articulated discussion in its translation to a situation of the very present. The question was whether a health authorization was required for the operation of a health point, located inside a shopping center, in which a self-detection instrument - such as those for pressure or blood glucose measurement - collects personal data, with subsequent transmission to a health facility, with diagnostic analysis by licensed health care professionals, and final diagnostic return to the user. In a very brief summary, if and how a telemedicine activity needed to be authorized was decided by the reference local health authority [3].

An argumentative cue seems to be what was previously expressed by the same section of the Supreme Court in the ruling n. 20474, 25 May 2007, which stated that “for there to be ‘health activity’ it is necessary that acts having a medical relevance be performed within the facility” [4].

Authorization by the competent health authority thus looks at the requirements of both the physical space in which it takes place, and the activity that takes place there. At present, however, it is possible to think of supervisory profiles toward a health activity, almost regardless of where it takes place, since precisely it may not need a physical space. In the case law cited, the facility was any shopping center, but indeed telemedicine services could take place nowhere, since virtual space, and anywhere, even at the user’s home. After all, the Italian National Recovery and Resilience Plan [5], mission 6, component 1, includes a specific Investment (1.2 Home as the first place of care and telemedicine) that looks at the citizen’s home and not the health care facility, as the pivot of welfare policies’ development. Leaving aside for a moment what is a health/medical act, we note in fact how the incidental reference to space -inside the facility- acts as a conditioning factor, bonding the act and the physical place of performance. The key aspect also lay in the location within a shopping center. In fact, had it been the case of an already licensed health care facility, no further authorization steps would have been necessary as only the mode of delivery was different. On this track, for instance, a regional resolution emphasized only for new authorizations the fulfillment of additional requirements listed in the paragraph Service Standards/Requirements for the provision of services in telemedicine as well as the general authorization requirements -structural, technological and organizational [6]. A proper investigation should be needed with respect to the changed requirements for the exercise of a health activity, in a context in which it is no longer of interest, to guarantee a minimum of security and control over professional practice spaces, to avoid activity in the barber’s cabinet. It interests, instead, to supervise activities of significant effect on the good/interest of health and of possible ubiquitous and widespread performance, outside of that sanitary context that allowed an indirect control through the authorization of the physical space [7]. Interrogating State law, in a system such as Europe characterized by autonomous national matrices of law, is of extreme importance with respect to cross-border healthcare policies and mobility [8–10]. In fact, adherence to legal requirements for health practice, at its continuous verification, is the first system of risk management, ensuring patient safety at the most fundamental level, namely that of the right to health and the health services to guarantee it.

The purpose of this commentary is to study in detail where and how a health activity begins, and especially how it now relates to the physical place where it takes place, and consequently whether -and at what point- aspects of authorization and control arise in activities that are still embryonic, with the related responsibilities.

2. Physical spaces and authorization for health exercise

A first major difference, for the purposes of authorization regarding physical spaces for health activities, is made in Italian legislation between the professional practice where the mere intellectual practice of the health professional takes place, and the outpatient clinic. The latter resulted from the organized activity, the direct intervention on the psycho-physical integrity of the patient with related risks, as well as the complex functional and administrative organization with definite opening days and hours, legal individuality of the facility, and the legal nature of an enterprise. Thus, it accounts for the local health authority assessment for the start of activities. This is to guarantee the safety of the patient [11]. However, digitization and the changing organizational and delivery models in healthcare, while always linked with those requirements, do not necessarily require a physical location. Telerehabilitation, as an extreme example of telemedicine activities, could be carried out wherever the patient is located, so it is even more interesting to understand the functional adequacy of the service, the suitability of the operators, but obviously not the structural requirements of the places where the patient is located, to which the health authorization refers. In such a way, the spatial aspect would assume a minor value and could even escape the principles and purpose of exercise authorization, although still functional, technological, and no less legal issues may remain, primarily in case of localization in areas of different purpose -see commercial one-, because it might be performed health activity. Those are fundamental for the safe provision of the service.

On this point, both the Decree of Health Ministry 27 October 2020 National Directions for the Delivery of Telemedicine Services, and the Decree of Health Ministry 21 September 2022, with the more directive title Approval of guidelines for telemedicine services - Functional requirements and service levels focus on the functional requirement, further implemented by Regions and other National Agencies [12]. This approach is of immense value, as it emphasizes the process overcoming the purely physical aspect of the activities in order to guarantee the minimum requirements, primarily of the ICT infrastructure, to ensure the effectiveness, safety, interoperability, and appropriateness of the service. This from the two fronts, one of the services centers with purely technical tasks and the other of the provider center with purely health-related tasks [13].

A review by Kruse et al. discusses some of the barriers to the full activation of telemedicine services, distinguishing them with respect to the observer/stakeholder, be it the citizen user, the health professional, or the organization [14]. In particular from the organization one, several critical issues were identified such as data security, equipment obsolescence, reporting flows, that meanwhile could benefit from a somewhat verification system. Then, healthcare facilities that want to start telemedicine services, even in atypical settings, must set up by design compliance programs for the risks’ prevention as a whole and as any other health activity must be submitted for conformity control by the local health authority.

In Italy, the health care facilities, such as outpatients, are authorized after the assessment of the functional and structural minimum requirements for the exercise of any health activities, and through the recent Decree of the Ministry of Health 19 December 2022 Assessment in terms of quality, safety, and appropriateness of activities provided for accreditation and contractual agreements with health care facilities, any public and private health facility will be evaluated also with respect to telemedicine activities. This decree will be contextualized and applied in each Italian regions [15].

3. Health act definition

If possible, at least in the abstract, to dispense without or disregard the physical space, it is necessary to examine what qualifies activities as health one, and therefore to consider whether there are aspects of control by a health authority, in addition to those for the practitioners.

The first reference, constitutionally oriented, is the act on the subject’s psycho-physical integrity, now broadly understood as the subject’s discretionary decision-making with respect to personal physical, mental, and social well-being [16,17]. Moreover, the reference for heath acts to complex diagnostic and therapeutic activities, with an explicit reference to the diagnosis, restricted to physicians and dentists among all the health professionals, is worthy of further attention since it seems to limit or circumscribe that definition to the medical category only. In Italy thus hypothetically excluding psychologists, physical therapists, radiology technicians, nurses, acknowledged as health professionals. In fact, the previous mentioned ruling n. 20474/2007 still defines health care services as services ... of medical significance. As far as the diagnostic aspect is concerned, we can deduce a possible argument in support of the Supreme Court decision, regarding the lack of authorization of the point of transmission of data for telemedicine activities: according to what has been discussed, the health activity began later and in a different place than that of shopping mall, with the diagnostic effort, that took place in the heath facility.

It is true, however, that Presidential Decree 14 January 1997, Policy and Coordination Act on Requirements for the Practice of Health Care Activities by Facilities, in declining in Article 4 the facilities required to meet and comply with the general and specific minimum requirements for health performing, refers to much more varied functions than diagnostic and medical ones: care services, including rehabilitation, instrumental and laboratory diagnostics. If, therefore, the health act is the intervention in the constitutionally protected good/interest of health, understood as the right to self-determination in health choices, the relationship with the lawful exercise of all health professionals, expanded by the Italian Law 11 January 2018, n. 3, and addressed to the entire area of health, from prevention, care, rehabilitation, to education, in central in health act definition. It is appropriate to make this clarification because telemedicine involves all health professionals, and precisely in that territory and chronicity recently reformed where non-medical professional figures are the most called upon [18,19].

Health action must be understood, with an apparent tautology, as the performance of acts with health relevance - not only medical - and by typical health relevance was meant any activity involving the discretionary judgement of a health practitioner. The invasiveness of the acts, not only physical then, but in the sense of penetrating the sphere of the right to self-determination in health choices, is therefore the characterizing requirement of health activity. A further reference to define the moment when health activity begin is the information evaluation and processing by the health professionals, but this could be reasonably included in the discretionary power exercised by the health professional, as decision-making is made after logical, scientifical and integrated analysis of all patient related data. Summarizing, a health act is any activity tangential to the good/interest of health, characterized by invasiveness, even in the abstract, by complexity and by the presence of health hazards to be properly managed by health professionals, and which engages the discretion of judgment of any health professional. Defining the health act is therefore neither a trivial nor unnecessary matter, even more where with remote delivery, state boundaries, and thus of law, can be crossed, confronting with wide disparities even in the European context [20,21].

4. Responsibilities

The responsibilities related to telemedicine are quite different, with respect to hypothetical injury to the subject in health setting. They fall to date more classically on the referring health facility, which must be fully aware of this, and cannot avoid it by shifting the need for a service to another agency, non-health care, as the services center. The health care facility is the responsible for its professionals and it could not be called that the services center uses the health facility’s professionals as sub-contractors, thus being liable for them under Article 1228 of the Italian Civil Code ¹ . The services center performs, and is responsible for, only logistics, and thus is liable if the damage depends on negligence or failure in logistical support, but certainly not for any negligence or error of the health care personnel working at the health care facility, even and especially if the error depends on the professional’ unskillfulness with a software.

Also with respect to issues of integrity, keeping and authenticity of the digital health records, the health facilities must ensure and verify the suitability of the service center, as newly it falls under the responsibility of the medical director of the health facility. This to say that health care facilities that are developing polymorphic activities in telemedicine, directly converting previous and routinely performed physical activities, today must set up suitable mechanisms to cover the resulting risks and liabilities, explicitly mentioned in the article 10 of Italian law on patient safety and liability in health [22]. In fact, it is only in the case of residual conditions that the services center could be the only responsible.

Last, but perhaps of first and absolute interest with respect to the value assumed today in health law, and health damage as its negative fallout, is consciously given consent [23]. Obviously assuming that it must be documented and documentable (written, videotaped, or similar) as stated by Italian law [24]. Considering the prevalence and ease of access to this delivery modality, as well as the partially unknown or unexplored related risks, the question of the consent form signed by the user, or the videotaped consent, arises as a moment of negotiating an agreement with the user. Who was informing and who was receiving consent for health treatment in the case under discussion is not obvious to the reader. Indeed, the user is in the mall, given the judge discussion without health care personnel and in the absence of health activity. It follows that therefore the user will have to be -remotely- approached by the health care provider once receiving the data, to be informed and to sign consenting form remotely -or for a videotaped interview and consent-, prior to the health report. Otherwise, the meaning and convenience of remote activity would vanish in a signature at the health facility. Considering that the first clinical assessment in Italian regulation must be in presence, even for the clinical examination, information and expression of will could reasonably be referred to this moment, with disclosure of ICT use for following visits [25].

We recall from the cited judgment and the foregoing that health care activity begins with the discretionary action of the health care provider, performed within the health care facility. Thus, reviewed from the perspective centered on the protection of health and the demand for health care to the user, the referent is the health care facility, which relies on the logistical support of the services center, on a par with another service provider, such as supply contracts. The measure is also offered to us from the perspective of data processing, incidentally mentioned: the data owner is the health care facility, because is the one that gives the purpose to the data processing.

5. Critical issues

Several critical points then arise, not yet fully in line with the Supreme Court’s reading, which can also be found often in some European Commission documents starting from Directive 2011/24/EU on the application of patients’ rights in cross-border healthcare [26–29].

First, the purpose or target of the activities conducted in the health point within the shopping center, which in the case under consideration was not at all clear due to distortion. The reconstruction of the case, with a nurse at the reception, although accidentally; with the collection of medical history, although not elaborated; the signing of consent form, although not to the health performance, nor for the data processing for health purposes; a payment for the health service, although only having a functional support character; a physician’s relation with a diagnosis, although produced in a mediated way, put the user in an uncertain and foggy situation. This could definitively undermine the informed and conscious choice and reliance to the treatment path. Equally defining it as a health point, albeit not necessarily surreptitiously, but only for the purpose of distinguishing it from the commercial context where it placed, confuses the user.

Even though, according to the reconstruction of the elements characterizing the health activity and its lawful exercise, no typical health activity took place there, and therefore no health license was required for its operation, in the user’s understanding the purpose for that service was certainly health one. In other words, it is impossible not to notice how the distortion represented to the user an outpatient-type space providing health services. It is therefore necessary to valorize how the communication to the user in the field of health and aspects of marketing and business [30], are always very risky, also thinking to Professional Codes of Ethics, precisely because they misrepresent to the citizens the facts, with evident consequences to the accountability of the services providing health services, mainly when also the physical relation is absent. Technological advances have expanded the effectiveness and sophistication of health interventions, resulting in overall increased social expectations for both personal health and health care system, but with poor computer health literacy [8], worthy of population education and training [31]. Misleading information is dangerous for the health system, which is already paying the price for media distortions, social media unprocessed spread [32], and smear campaigns [33], especially in the relations between public and private health facilities, and telemedicine is now an area of major investment and financing in health care companies. It should also be made clear to the user that the fee paid in this case to the health point, even if covered through national health service, meets a logistical/technical need, but that the typically health service is carried out elsewhere, and by other professionals.

6. Comparative cues

In some of the European Commission working group documents on e-health and telemedicine aforementioned, after Strengths-Weaknesses-Opportunities-Threats (SWOT) analysis, regulatory issues are discussed but mainly focused on the field of free and secure flow of data, also with regard to electronic health records [27,34]. However, the discussion on health regulations underlying telemedicine activities and their compliance verification could be relevant.

In some countries the management of telemedicine services has been limited to health centers, and users have not been able to receive assistance directly from a health provider, as in Peru, to ensure the minimum safety requirements of the tele-care provided [35]. In contrast, the U.S. [36] and Europe [29,37] face the problem of licensing health professionals for the tele-health services. However, an U.S. survey revealed delayed response from the medical board, lost documents, and lack of online access to the current status of applicant [35], while the Europe faces the added complexity of national and regional regulatory constraints. Looking globally to this issue, a strong regulatory approach was also reported in Zambia, notably detailed on licensed health professionals, together with service accreditation and minimum technical equipment, with the further important consideration – comparing to South Africa and India- of tailoring each regulatory system over health care and legal frameworks [38]. Quality labeling and/or framework assessment for digital health products and services, together with certification for health purposes, are other important indirect verification mechanisms [39].

Taken together, there are certainly health care professionals who are licensed and constantly supervised by their professional bodies, to be further educated and trained on e-health, and meanwhile health care facilities developing more and more telemedicine activities to be checked [40]. In Italian regulation we thus find an adequate control over the health care activities delivered through telemedicine systems, by the scrutiny of local health authorities. This considers precisely the peculiar functional, technological, and health professionals’ training requirements, thus allowing safe exercise, even in the hypothetical location in the shopping center, as the real distributor being the health facility. There still remain lots of opportunities for improvement to be integrated with regional specification of the mentioned 19 December 2022 Health Ministry Decree, to answer to what has been discussed for exercise of telemedicine services in the European territory [41] and in Italy, also with the focus to different disciplines [42–48].

7. Conclusion

The ruling discussed provided an initial interpretation that is appropriate and responsive to the current needs and context of health care delivery, compared to earlier regulatory requirements on healthcare practice. After present analysis, the overall Italian regulatory system seems to address the issue of control of telemedicine activities with the general health exercise authorization of health facilities, typically at the company level, together with other indirect mechanisms such as device and software certifications and service quality certifications. This goes beyond the mere spatial concept and enhance, through appropriate functional compliance systems, the indications of the national guidelines that consider telemedicine as a health process with different stages and levels of relationships, from which obligations arise. By thus valuing the manner and not the place where these activities take place, to better represent the process to the citizen-user and likewise to control it as it unravels, thus differentiating the various parties involved based on the legal nature of their activities. Health facility risk management programs, universities curricula, and global health policies on health care must nevertheless address wide range training in the use of digital tools in health care and telemedicine services. Albeit with the limitations of representativeness of single State legal analysis, the topic of health care legislation and compliance monitoring with respect to telemedicine services is central, and worthy of further comparison. In fact, it could be argued that the health act could also partially change shape, along with the modality of delivery, but it must respond to the unchanged needs for patient safety, health rights, and health professional practice protection, looking at the accountability principle of the health system as a whole.