Digital Health Laws and Regulations Report 2024 Denmark
1. Digital Health
1.1 What is the general definition of “digital health” in your jurisdiction?
Although Denmark is one of the most digitalised economies and societies in the EU with a healthcare system characterised by extensive digitisation, electronic communication between healthcare providers and systematic use of data and digitised working procedures, there is no formal definition of “digital health” under Danish law.
The term “digital health” is used as a broad umbrella term referring to a wide range of hardware and software technologies used within the healthcare sector, including electronic medical records, telemedicine, robotic surgery, mobile apps, medical devices and much more.
1.2 What are the key emerging digital health technologies in your jurisdiction?
In Denmark, healthcare services are among the most digitised in the world due to a long tradition of focusing on implementing and integrating digital solutions. The fundamentals for the advanced digital infrastructure in the healthcare sector in Denmark were created in the 1960s with the implementation of the Danish Civil Registration System (the CPR-register). The Danish CPR-register allows for a unique digital identification of all citizens with a unique person ID issued at birth to all Danes. The CPR-register allowed records of treatment, medicine, diagnosis and social care efforts to be traced across the entire Danish population forming the basis for digital health in Denmark.
A prime example of digital health in Denmark is sundhed.dk (“health”.dk), which is the official Danish eHealth Portal providing both access to and information about all the Danish Healthcare Services. The platform facilitates communication and information exchange between citizens and healthcare professionals and enables all Danish citizens to access updated healthcare information from national health registers, medical records, laboratory tests, medications, and more.
Another example of digital health in Denmark is the Shared Medication Record (“Fælles Medicinkort”), which is an electronic register that provides citizens and healthcare professionals a digital overview of a patient’s current medication. Citizens are able to look up information about their current and previous prescriptions as well as order renewals of their prescriptions. Patients are also able to access the shared medication record through sundhed.dk.
The e-record (“e-Journal”) system is also an example of a system that gives both patients and healthcare professionals digital access to information from all public hospitals, including information on treatment, diagnoses, etc.
Some of the next key emerging digital health technologies in Denmark are in the areas of AI, telehealth and robot technology. Several platforms have already been launched in Denmark in order to develop and implement new solutions within these areas. One such platform consists of three centres: the Centre for Clinical Robotics (CCR); the Centre for Clinical Artificial Intelligence (CAI-X); and the Centre for Innovative Medical Technology (CIMT):
- CCR aims to improve hospital treatment and workflows by bridging robot technology and clinician needs.
- CAI-X focuses on bringing engineers, doctors and companies together to create AI solutions that address clinical workflows.
- CIMT focuses on apps, telemedicine, home monitoring, video consultations, VR and wearables.
With regard to telehealth, telemedicine, including telepsychiatry solutions, is becoming more widespread in the Danish regions and municipalities and is currently one of the main focus areas within digital health in Denmark. Telemedicine enables patients to receive their treatment or part of their treatment in their home.
1.3 What are the core legal issues in digital health for your jurisdiction?
Given the nature of digital health solutions, which involve the processing of significant quantities of health information, including sensitive personal data, data privacy and cybersecurity emerge as paramount concerns. Safeguarding the integrity and confidentiality of this data is of the utmost importance in the realm of digital health. Processing of personal data, including health data, is regulated by national and EU regulations, including the EU Regulation 2016/679 (General Data Protection Regulation – “GDPR”). Digital health solutions must adhere to strict privacy and data security standards, obtain informed consent, and handle data lawfully and transparently.
Another key issue in digital health is medical device regulation. Digital health solutions that qualify as medical devices must meet regulatory requirements. This includes obtaining necessary certifications, demonstrating safety and efficiency, and complying with quality standards.
In addition, liability and responsibility is also a core issue. Determining liability in digital health incidents is vital.
1.4 What is the digital health market size for your jurisdiction?
In recent years, Denmark has been at the forefront of digital health adoption and has invested significantly in digital healthcare infrastructure and initiatives.
However, there is no publicly available information.
More generally, it has been estimated that the revenue in the Danish digital health market will reach US$ 499.10m in 2024.
1.5 What are the five largest (by revenue) digital health companies in your jurisdiction?
No public data is available.
2. Regulatory
2.1 What are the core healthcare regulatory schemes related to digital health in your jurisdiction?
There is no comprehensive regulatory scheme related specifically to digital health under Danish law and Danish legislation regarding healthcare is generally characterised by a healthcare system that is government-funded with universal access.
Generally, Danish healthcare legislation is relatively broad and able to apply to digital health. The Danish Health Act (“Sundhedsloven”) encompasses all legislation on benefits pertaining to public healthcare, including mental healthcare and patient’s rights. However, in order to future-proof the Danish healthcare legislation, numerous acts, including the Danish Health Act, have been generally and continuously adapted to the ongoing digitalisation.
As an EU member, Denmark has an obligation to follow the EU rules. Therefore, Danish healthcare legislation changes on an ongoing basis and regulatory agencies also play an important role in administering healthcare-specific legislation in Denmark. As an example, the Danish Medicines Agency (“Lægemiddelstyrelsen”) administers the medical devices legislation in Denmark, the Danish Act on Medical Devices (“Lov om medicinsk udstyr”) and the related executive order on medical devices and in vitro diagnostic medical devices. The act is a framework act empowering the Danish Minister for Health to lay down the rules necessary for the implementation and application of the medical device legislation of the EU. Likewise, the Danish Medicines Agency has prepared a number of guidance documents in the area of medical devices for users, healthcare professionals and medical device companies to assist them with the interpretation of the requirements of the legislation.
The relevant EU regulation 2017/745 on medical devices (MDR) and the EU regulation 2017/746 on in vitro diagnostic medical devices (amended by regulation (EU) 2023/607 as regards the transitional provisions) are also directly applicable in the EU countries, including Denmark, supplemented by national executive orders.
2.2 What other core regulatory schemes (e.g., data privacy, anti-kickback, national security, etc.) apply to digital health in your jurisdiction?
- The GDPR.
- Directive (EU) 2016/1148/EU of 6 July 2016 on Network and Information Security systems implemented into Danish law via sector-specific regulation.
- Act no. 3 of 3 January 2019, The Danish Product Safety Act.
2.3 What regulatory schemes apply to consumer healthcare devices or software in particular?
There is no regulatory scheme that applies to consumer healthcare devices or software in particular under Danish law. With regard to software in particular, please see question 2.6.
2.4 What are the principal regulatory authorities charged with enforcing the regulatory schemes? What is the scope of their respective jurisdictions?
The Ministry of Health is responsible for the financing of medical devices and establishes the framework for the provision of health services. The Minister of Health also has the right to formulate specific requirements about the use of information and communication technology in the Danish healthcare system, including requirements concerning standardisation, use of common infrastructure, etc. The Ministry of Health is responsible for effectuating the intentions of the law. This implies ensuring enhanced overall national coordination of the development of digital health throughout the Danish healthcare sector.
The Danish Medicines Agency (“Lægemiddelstyrelsen”) monitors the Danish market and ensures that incidents and accidents with medical devices are followed up so that causes are investigated and measures can be taken. Moreover, the agency interacts with the European Commission and other authorities and exchanges information on medical devices and safety matters.
The Safety Technology Authority (“Sikkerhedsstyrelsen”) administers the Danish Products Safety Act. The authority supervises, monitors and issues orders and imposes fines for violations of the Danish Product Safety Act. The Safety Technology Authority may act both following a notification or on the basis of its own investigation, and its decision may be appealed to the Danish courts.
2.5 What are the key areas of enforcement when it comes to digital health?
The primary areas that regulatory authorities are targeting in relation to digital health are confidentiality, data security, data protection obligations, legal qualification as a medical device, medical secrecy regime, liability in case of damage and safety.
2.6 What regulations apply to software as a medical device and its approval for clinical use?
In Denmark, the regulations for software as a medical device and its approval for clinical use are primarily governed by the Danish Medicines Agency (“Lægemiddelstyrelsen”) and the Danish Health Authority (“Sundhedsstyrelsen”). These regulatory bodies have specific guidelines in place to ensure the safety, efficacy and quality of medical devices, including software used in a healthcare context.
The key regulations that apply to software as a medical device in Denmark and its approval for clinical use include:
- The MDR, which provides a comprehensive framework for the regulation of medical devices across the EU.
- The Danish Act on Medical Devices (“Lov om medicinsk udstyr”), which aligns with the MDR and specifies additional requirements for medical devices, including software marketed in Denmark.
According to Danish legislation, medical devices are not defined by the media or material that makes up the device, but by the intended purpose. Hence, while the software itself could be a medical device, it could also be a component of a medical device.
The full medical device definition is found in art. 2(1) of the MDR. Since the medical device definition is very broad, the European Commission has issued guidance for classifying software as medical devices.
2.7 What regulations apply to artificial intelligence/machine learning powered digital health devices or software solutions and their approval for clinical use?
Please see the response to question 2.6. Like other software, AI-based software is classified as a medical device if it provides an effect in connection with, for example, diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of diseases for an individual.
3. Digital Health Technologies
3.1 What are the core legal or regulatory issues that apply to the following digital health technologies?
- Telemedicine/Virtual Care: Telemedicine involves the collection and processing of sensitive patient information and depends on reliable and secure telecommunications infrastructure. Health data protection, data privacy, network security, confidentiality, etc. are all core issues. Additionally, liability and professional standards and making sure that telemedicine services comply with Danish regulations are also key.
- Robotics: Manufacturers and distributors of robotic technologies used within the healthcare system must conform to the Danish Product Liability Act, making product safety a core issue. Also, robotic systems used within the healthcare sector interact with health data, making data protection and privacy key. Ethical considerations including AI biases and safety standards are also worth mentioning.
- Wearables: As mentioned under question 2.6, whether a device or software falls under the regulatory framework of medical devices depends on the intended purpose. Hence, depending on the wearable’s features, strict compliance requirements for medical devices may apply. Additionally, as with telemedicine and robotics, data privacy and the protection of sensitive health data collected by the wearable are core issues. Depending on the wearable, product safety regulations might also apply. Legal issues might also arise with regards to advertising and marketing of wearables in Denmark, as this would be subject to the rules of the Marketing Practices Act and Good Marketing Practices.
- Virtual Assistants (e.g. Alexa): Depending on the purpose of the specific technology, a virtual assistant may be classified as a medical device and consequently greater compliance requirements will apply – for example, if the virtual assistant begins providing medical/diagnostic/therapeutic advice. Requirements regarding data privacy and health data protection will also apply. AI biases should also be considered.
- Mobile Apps: As with wearables, virtual assistants, software, etc., the main legal and regulatory issues regarding mobile apps within healthcare concerns the legal classification of the app and whether the app falls within the definition of a medical device. In addition, requirements regarding data privacy and health data protection are key.
- Software as a Medical Device: The use of software as a medical device gives rise to several legal issues in Denmark. Firstly, software used as a medical device is subject to Danish and EU medical device regulations including the MDR, as mentioned under question 2.1. As the use of software as a medical device often involves the processing of personal health data, compliance with requirements regarding data privacy and health data protection will also apply. Questions of product liability and medical malpractice may also arise in the event where the use of medical devices causes harm or errors. This might lead to issues regarding allocation of liability, insurance coverage and recourse, etc.
- Clinical Decision Support Software: Based on the intended use and functionality of clinical decision support software, Danish and EU medical device regulations would most likely apply (see questions 2.6). The question of regulatory compliance is therefore key. Clinical decision support software stores and processes health data, which is why issues of data privacy and security arise. In addition, the question of liability is also introduced when it comes to the accuracy and reliability of the software’s recommendations.
- Artificial Intelligence/Machine Learning Powered Digital Health Solutions: Digital health solutions powered by AI/ML require processing large amounts of personal data and health data, making data privacy and security key. As with the above solutions, software that is powered by AI/ML may fall under the legal framework of Danish and EU medical device regulations, making regulatory compliance key. Using software based on AI/ML requires training of the AI models in order to learn patterns, etc. This might lead to bias in data training and lack of diversity, which might influence diagnostics, treatment recommendation, etc. In addition, the use of AI/ML-based software also raises liability questions and ethical considerations.
- IoT (Internet of Things) and Connected Devices: The use of IoT and connected devices within the Danish healthcare sector has grown rapidly and is, for example, used for tracking patients with dementia. However, the use of IoT and connected devices requires reliable and secure telecommunications infrastructure, making health data protection, data privacy, network security, confidentiality, etc. all core issues.
- 3D Printing/Bioprinting: As with robotics, the use of 3D printing/bioprinting requires compliance with not only Danish and EU medical device regulations but also the Danish Product Liability Act, making product safety a core issue. This also raises issued with regard to liability and compensation. In addition, legal issues with regard to licences and intellectual property might also arise.
- Digital Therapeutics: Digital therapeutics such as smart inhalers, cognitive behavioural apps, etc. may be subject to Danish and EU medical device regulations and the Danish Product Liability Act. Compliance with applicable law and regulations is key. The use of digital therapeutics may also give rise to questions about the qualifications, licensing and liability of healthcare professionals responsible for the recommended treatments, etc. As with the above solutions, data privacy and security are also key.
- Digital Diagnostics: See above under Digital Therapeutics.
- Electronic Medical Record Management Solutions: Electronic medical record management solutions involve the collection and processing of sensitive patient information and are dependable on reliable and secure telecommunications infrastructure. Health data protection, data privacy, network security, confidentiality, etc. are all core issues.
- Big Data Analytics: A key component of big data analytics includes the collection, storage, management and processing of large volumes of diverse data from multiple sources. Ensuring compliance with data protection regulations is key.
- Blockchain-based Healthcare Data Sharing Solutions: As with most data sharing solutions, blockchain-based healthcare data sharing solutions present challenges in terms of data privacy. Achieving compliance while maintaining the decentralised and transparent nature of blockchain technology can be complex.
- Natural Language Processing: Natural language processing (NLP) is utilised in various sectors in Denmark and can be used to extract clinical information from Danish electronic health records. However, since only approximately six million people speak Danish, NLP solutions entirely based on the Danish language do not work optimally. As with digital health solutions powered by AI/ML, NLP requires processing large amounts of personal data and health data, making data privacy and security key. Additionally, dataset curation and training of NLP-models play an important role, making mitigation of biases key.
3.2 What are the key issues for digital platform providers?
Digital platform providers may be subject to the Digital Services Act (EU Regulation 2022/2065, “DSA”), which is an EU regulation that came into force in EU law on 16 November 2022 and will be directly applicable across the EU from 17 February 2024. The DSA applies to a wide range of online intermediaries, which include services such as internet service providers, cloud services, messaging, marketplaces or social networks and regulates the obligations of digital services that act as intermediaries in their role of connecting consumers with goods, services and content.
The scope of the DSA overlaps with the Platform to Business Regulation (EU Regulation 2019/1150, “P2B”) already in force. The P2B regulates the commercial relationship between online intermediaries and the business users that offer goods and services via the intermediary platforms.
In addition to the above, digital platform providers are also subject to the requirements of the GDPR when handling health data.
4. Data Use
4.1 What are the key legal or regulatory issues to consider for use of personal data?
The use of personal data is a fundamental part of the digitised Danish healthcare sector. The rise of digital health technologies has increased the need for collecting, processing and sharing personal data across the Danish healthcare sector.
Personal data is subject to the GDPR and the Danish Data Protection Act (“Databeskyttelsesloven”). The GDPR requires for personal data to be processed lawfully, fairly and in a transparent manner. Other principles such as: purpose limitation; data minimisation; accuracy; storage limitation; integrity; and confidentiality are also key.
According to the GDPR art. 9, health data is considered a special category of personal data and its collection and further processing is generally prohibited. However, art. 9(2)(h) of the GDPR allows health data to be processed where it is required for the purposes of preventative medicine, medical diagnosis, the provision of care or treatment, or the management of healthcare services. Art. 9(2)(i) of the GDPR further considers the necessity of processing health data for reasons of public interest in the area of public health. Hence, the use of personal data requires thorough investigation into the legal frame of data privacy and security and depending on the category of personal information used, comprehensive regulatory requirements may apply.
In addition to the requirements of the GDPR and the Danish Data Protection Act, the processing of health information is also regulated by the Danish Health Act (“Sundhedsloven”), which – under specific circumstances – allows healthcare professionals to collect and share relevant health information regarding patients currently undergoing treatment, without explicit consent.
4.2 How do such considerations change depending on the nature of the entities involved?
The GDPR applies both to European organisations that process the personal data of individuals in the EU, and to organisations outside the EU that target individuals living in the EU. Additionally, the GDPR applies regardless of the nature of the entities, whether public or private.
In order to lawfully process special category data, including health data, both a lawful basis and a separate condition for processing must be identified under GDPR art. 9 – e.g. explicit consent. However, according to art. 9 (2) (h) of the GDPR, processing health data is also permitted if processing is “necessary for the purposes of preventive or occupational medicine, […] medical diagnosis, [or] treatment”. This exemption is typically relevant for the public healthcare sector and licensed healthcare professionals. However, this exemption does not necessarily apply to other authorities, e.g. private healthcare providers that would have to identify another legal basis to process health data.
4.3 Which key regulatory requirements apply?
The GDPR includes a comprehensive set of key regulatory requirements for processing personal data. Some of the key requirements are:
- Full basis for processing: Personal data must be processed based on a valid lawful basis, such as consent, contract performance, legal obligation, protection of vital interests, a public task or legitimate interests.
- Data subject rights: Individuals have various rights, including the right to access their data, rectify inaccuracies, erase data, restrict processing, data portability, object to processing and not be subject to automated decision-making.
- Data protection by design and default: Data controllers are required to implement data privacy features and data privacy enhancing technologies directly into the design of projects from the outset.
- Data breach notification: In the event of a personal data breach, data controllers must notify the relevant supervisory authority within 72 hours, unless the breach is unlikely to result in a risk to individual’s rights and freedoms. In certain cases, individuals must also be informed.
- International data transfers: Transferring personal data outside the European Economic Area (EEA) is allowed only if the transfer is in compliance with the conditions laid down in Chapter V of the GDPR. Transfers may take place on the basis of an adequacy decision, or, if the controller or processor has provided “adequate safeguards”. The European Commission publishes the list of its adequacy decisions on its website. In the absence of an adequacy decision, personal data may also be transferred when “adequate safeguards” are in place. A list of tools containing “adequate safeguards” can be found under art. 46 in the GDPR.
Other relevant regulatory requirements under the GDPR include:
- Keep a record: Entities must keep a register of the personal data that is processed by the entity and the purpose of the processing.
- Document compliance with the principles of good data processing: Entities must document that the entity adheres to the fundamental principles of data protection as outlined in the GDPR.
- Document implementation of appropriate technical and organisational measures: Entities must document that suitable technical and organisational measures in order to protect personal data have been implemented.
- Inform customers and employees about data processing: Entities are required to inform customers and employees about how their data is processed, including the purpose of the processing, rights, etc.
- Provide evidence of compliance with the regulations: The entity must be able to demonstrate that it complies with the GDPR.
4.4 Do the regulations define the scope of data use?
The strict requirements for processing data under the GDPR define the scope of data use. Hence, processing data is permitted under the GDPR when there is a legal basis for processing, such as the necessity for fulfilling a contract, compliance with a legal obligation, protection of vital interests, consent from the data subject, performance of a task carried out in the public interest or official authority, or legitimate interests pursued by the data controller or a third party. These legal bases provide the framework within which data processing activities can lawfully occur under the GDPR and automatically define the scope of data use.
4.5 What are the key contractual considerations?
GDPR regulations might require that an entity (controller) may only use data processors (processor) who can assure that they process personal data securely. This means that the processor must implement technical and organisational measures that are appropriate to the level of risk in the risk assessment of the processing. Under art. 28 of the GDPR, a written agreement (data processing agreement) is required. If two entities are jointly responsible for the processing of personal data, a joint controller agreement is required under art. 26 of the GDPR.
On 4 June 2021, the European Commission issued modernised standard contractual clauses under the GDPR for data transfers from controllers or processors in the EU/EEA (or otherwise subject to the GDPR) to controllers or processors established outside the EU/EEA (and not subject to the GDPR).
4.6 What are the key legal issues in your jurisdiction with securing comprehensive rights to data that is used or collected?
It is not possible under Danish law to secure comprehensive rights to personal or sensitive data that is used or collected. The GDPR’s aim is to protect individuals’ privacy and rights regarding their personal data, enhance individuals’ control over their data, harmonise data protection laws in the EU, hold businesses accountable, etc.
Provided that an entity complies with the comprehensive regulatory requirements under the GDPR, processing of personal data is allowed. Please see questions 4.1 and 4.3 for more regarding the requirements. However, under the GDPR, individuals have certain rights regarding their personal data: the right to be informed; the right of access; the right to rectification; the right to erasure; the right to restriction of processing; the right to data portability; the right to object; etc.
Regardless of compliance with the GDPR requirements, the “ownership” or more accurately, the right to process personal data, is overshadowed by the data subject’s rights under the GDPR.
4.7 How are issues with data inaccuracy, bias and/or discrimination addressed by the regulatory authorities in your jurisdiction?
As mentioned above, under the GDPR individuals have certain rights regarding their personal data, including the right to rectification and the right to erasure. There are currently no specific initiatives taken by the Danish regulatory authorities regarding data inaccuracy, bias and/or discrimination. However, the Danish Data Protection Agency (“Datatilsynet”), which is an independent supervisory authority, is responsible for ensuring compliance with data protection rules, including the GDPR. In addition, the Danish Data Protection Agency provides advice and guidance, processes complaints from individuals in relation to breaches of data protection rules and conducts inspections of authorities and companies related to breaches of data protection rules to ensure compliance with the rules.
4.8 What are data-usage legal or regulatory issues that are unique to generative AI companies and how are those issues being addressed in your jurisdiction?
The use of generative AI is evolving rapidly and there are currently no concrete measures being taken under Danish law specifically with regard to generative AI companies and their use of data. However, as part of its digital strategy, the EU aims to establish regulations for AI in order to enhance the development and utilisation of AI technology. In April 2021, the European Commission took a significant step by proposing the initial regulatory framework for AI within the EU. This framework involves the analysis and classification of AI systems used across various applications based on the level of risk they pose to users. Once these regulations are approved, generative AI would have to comply with transparency requirements.
However, the legal issues that the use of generative AI brings with it are highly debated and include:
- Data privacy and security: How are uploaded information being stored and used? What are the risks of data breaches or sharing confidential information?
- Copyright infringements or violations: Content created by generative AI is not copyrighted and most AI platforms do not take into account copyrighted inputs.
- Responsible and ethical use of AI: The use of AI might violate company policies.
5. Data Sharing
5.1 What are the key issues to consider when sharing personal data?
Data protection regulations are becoming increasingly relevant as society becomes more digitalised. The scale of personal data collection and sharing has increased significantly.
As health data is sensitive personal data, the collection and processing of health data is regulated under national GDPR legislation and EU law. This means that public authorities are subject to certain rules that limit their right of disposal over the sensitive health data they collect from citizens. This is to protect citizens against misuse of the data, for example, when sharing it with third parties.
If the data is to be shared with third parties, e.g. in connection with a study, certain legal requirements under national and EU law apply. For example, there are certain requirements that the sensitive personal data must be anonymised, etc.
Please also see questions 4.1 and 4.3.
5.2 How do such considerations change depending on the nature of the entities involved?
All entities are subject to regulation under data protection laws, regardless of whether they are private parties or public authorities; however, the data protection regulation varies according to the specific circumstances, e.g. depending on the purpose of the sharing, who the recipient is, etc.
5.3 Which key regulatory requirements apply when it comes to sharing data?
The sharing of personal health data is regulated under EU and national GDPR law. See the answers under questions 4.1 and 4.3.
5.4 Are there any governmental initiatives to establish standards for creating, maintaining and sharing healthcare data in your jurisdiction?
Denmark has various national health registries. What they have in common is that they all collect health information about citizens. The health registries collect information on, for example, surgeries, medical records, prescriptions, birth information, etc.
Health authorities have the ability to obtain and forward the health information in the registry to each other. However, this must be for a legitimate purpose and in accordance with the law. Citizens also have the ability to access their health information through the registries’ websites or apps.
In addition, it must be stated that Denmark supports the European Health Data Space (EHDS), which the European Commission presented a draft regulation in 2022. At present, the EHDS is still under discussion, so the final design is still unknown.
5.5 What are the key issues to consider with respect to federated models of healthcare data sharing?
The same issues apply as stated under question 5.1.
6. Intellectual Property
6.1 What is the scope of patent protection for digital health technologies?
Digital healthcare technologies enjoy the same level of patent protection as other industrial products. Patent protection in Denmark generally covers novel and non-obvious inventions related to hardware, software or a combination. This may include innovations in medical devices, data processing algorithms or communication protocols. The scope of the patent protection depends on the specific claims made in the patent application and how the innovation fulfils the fundamental criteria of novelty, inventive steps and industrial applicability.
6.2 What is the scope of copyright protection for digital health technologies?
Like in many other jurisdictions, copyright protection in Denmark primarily covers expression of a creative idea rather than the idea itself. In the context of health technologies this may include protection of the source code of software, graphic user interfaces and, for example, design elements. However, copyright does not typically protect ideas, algorithms or functional aspects. Copyright protection applies automatically upon creation; however, registration of the work can provide additional benefits.
6.3 What is the scope of trade secret protection for digital health technologies?
In Denmark, trade secrets are primarily protected under the Danish Marketing Practices Act, which implements the EU Trade Secrets Directive. The directive aims to harmonise the legal framework for trade secret protection across EU Member States, including Denmark.
Key aspects of the legal framework for trade secret protection in Denmark include:
- Definition of Trade Secrets: The law provides a definition of trade secrets, emphasising information that is secret, has commercial value because it is secret, and has been subject to reasonable steps to keep it confidential.
- Unlawful Acquisition, Use and Disclosure: The legal framework prohibits the unauthorised acquisition, use or disclosure of trade secrets. This includes actions such as industrial espionage, unauthorised access or breach of confidentiality agreements.
- Remedies and Enforcement: The law provides for civil remedies, such as injunctions and damages, for the unlawful use or disclosure of trade secrets. Enforcement typically involves legal proceedings where the trade secret holder seeks protection and compensation.
For digital health technologies, trade secrets may include proprietary algorithms, manufacturing processes or confidential data analytics methods.
6.4 What are the rules or laws that apply to or regulate academic technology transfers in your jurisdiction?
In 2000, the Danish Parliament adopted a piece of regulation making technology transfers a part of the assignment of Danish Universities. This regulation, called the Research Patent Act, defines technology transfer as the identification, assessment, protection and marketing of intellectual property with the purpose of commercial utilisation. The law applies to universities, as well as Danish hospitals. The fundamental elements of the law are:
- Employees at institutions are as an outset owners of innovations invented by themselves. For innovations invented as part of the employment, however, the institution can take over ownership rights in order to commercialise the innovation.
- The institution can make agreements with private undertakings about commercial exploitation of the innovations.
- A legal basis for the institutions to incur costs of taking out patents and create technology transfer units.
- How income from the innovations is split between the institutions and the employees.
With regard to software, this is regulated in the Danish copyright regulation. As a general rule, the employer automatically receives ownership to the rights.
Apart from the Research Patent Act, knowledge institutions engaging in public–private innovation partnerships must comply with a number of other regulations including the University Act, which stipulates freedom of research for researchers at Danish universities. On this basis, a private partner cannot require a researcher to perform specific research. Universities and other public knowledge institutions are also required to comply with the general rules of open government, access to information, etc. Such rules could potentially limit a private partner’s desire to keep information confidential.
Universities and other public research institutions have a legal basis in the Danish Technology Transfer Act to establish limited liability companies under certain conditions and to obtain shares in limited liability companies established by other research institutions.
6.5 What is the scope of intellectual property protection for software as a medical device?
In Denmark, software is protected under copyright law. Copyright provides automatic protection as soon as the software is created, without the need for registration. Additionally, Denmark is a member of the EU, and software can also be protected through the EU Software Directive. Patents may apply to software in certain cases, but the criteria are strict.
Copyright law in Denmark, as in many other countries, provides protection to the creators of original works. For software, copyright protection relates to, for example, the source code, object code, and the overall structure and expression of the program. This means that the specific way in which the code is written and arranged is protected against unauthorised copying.
Copyright protection grants the software creator exclusive rights to reproduce, distribute, display and modify their work.
6.6 Can an artificial intelligence device be named as an inventor of a patent in your jurisdiction? Why or why not?
There is no specific case law in Denmark dealing with the question. However, a legal or a natural person is required in order to execute any rights under a patent. Under section 8 (4) of the Danish Patent Act, a patent application must include the name of the inventor. If a patent is applied for by someone other than the inventor, the application must include that the applicant has the rights to the invention. This wording ensures that the applicant has sufficient legal authority to claim rights to the invention. As an AI has no legal authority, it is unlikely that such an entity can be named as inventor.
6.7 What are the core rules or laws related to government-funded inventions in your jurisdiction?
The core regulations of publicly funded innovations are laid down in the Danish Research Patent Act, which is described under question 6.4, which sets out the basis for how publicly funded research institutions can operate with regard to ownership to and income generation from innovations. Apart from the law, publicly funded innovations must consider how they comply with EU state aid rules and the principles of equal treatment. This applies to knowledge institutions as well as Danish government-funded innovation funds.
7. Commercial Agreements
7.1 What considerations should parties consider when dealing with collaborative improvements?
Under section 22 of the Danish Procurement Act, Danish public institutions can enter into development collaboration contracts with private companies without a prior tender. This is solely designed to allow for collaborative research and development projects. The public institution can only buy the product after a public procurement process.
Sections 73–79 of the Procurement Act outline the requirements that apply to innovation partnerships. Such partnerships consist of three phases: 1) procurement; 2) innovation; and 3) purchase. Before the three phases can be initiated, the institution must conduct a market analysis in order to examine if applicable solutions already exist in the market place.
7.2 What considerations should parties consider when dealing with agreements between healthcare and non-healthcare companies?
Apart from the regulatory elements described above, the parties should pay special attention to:
- The character and the extent of the collaboration.
- Changes in the collaboration.
- New contracting parties.
- Confidentiality.
- Termination.
7.3 What considerations should parties consider when dealing with federated learning healthcare data sharing agreements between companies?
In federated learning data sharing agreements, the parties should pay particular attention to the protection of sensitive client data and privacy issues. In healthcare, data used for federated learning will, with great certainty, be regarded as sensitive personal data under the GDPR. On this basis, the parties must consider how data can be protected. Such protection could consist of requirements for participating companies to anonymise data. Parties should calculate the sensitivity of the function that is used in the machine learning model in advance of entering into an agreement. The parties can further consider introducing a differential privacy mechanism, such as randomised response, or introducing noise in the system.
The agreeing parties should further consider how the ownership to the machine learning models developed through federated learning is shared among the participating companies and the rights and obligations of each participant, including each party’s access to the use of developed models.
7.4 What considerations should parties consider when dealing with the use of generative AI in the provisioning of digital health solutions?
When dealing with generative AI in digital healthcare solutions, it is important to consider:
- Governability: It is important to ensure that while the AI system fulfils its intended purpose, humans must retain the ability to identify and prevent unintended consequences.
- Reliability: The generative AI models should have explicit and well-defined clinical use cases. A generative AI model designed for disease prediction must have a clear definition of the use situation and patient criteria. In addition, such generative AI models should be safe, secure and effective throughout their life cycles.
- Equality: The generative AI models, that potentially could have elevated data bias risks due to their pre-training on massive datasets, should not exacerbate this for certain marginalised, under-represented or low-education groups.
- Privacy: Privacy is necessary in most medical applications due to the confidential and sensitive nature of personal data. Generative AI systems in healthcare must be secure to prevent breaches and unauthorised use.
- Lawfulness: Developers must ensure AI software applications in healthcare respect various legal requirements, including health regulation, intellectual property rights, data privacy (GDPR) and cybersecurity.
- Liability: In case of non-compliance or wrongful diagnostics/medication, issues regarding potential liability can arise.
8. Artificial Intelligence and Machine Learning
8.1 What is the role of machine learning in digital health?
AI and ML can be used to help doctors diagnose various diseases, such as different types of cancer, etc.
AI and ML need a lot of data to learn. It is difficult to collect all this data while complying with national legislation and EU GDPR law. Therefore, politicians must decide on strategies for developing and implementing AI solutions in healthcare while complying with current legislation.
8.2 How is training data licensed?
In connection with the revision of the guidelines for patenting, the European Patent Office might have opened up the possibility of obtaining a patent for ways to train an AI and ways to generate training datasets. However, this requires that the training method and the way of generating the datasets can be shown to provide a reliable and repeatable technical effect.
8.3 Who owns the intellectual property rights to algorithms that are improved by machine learning without active human involvement in the software development?
Under Danish law, it is only possible for individuals to obtain patent rights on their own inventions. This means that it is not possible for AI and ML algorithms to obtain patent rights. Presumably, it is possible for the creator of the AI or ML algorithm to obtain patent rights for the inventions of the AI or ML algorithm.
8.4 What commercial considerations apply to licensing data for use in machine learning?
As the data used in the training of ML often includes sensitive health information, the use of the data must be in accordance with national and EU GDPR law. This can limit the use of ML and AI, and the possibilities to get the outcome of the ML and AI licensed.
9. Liability
9.1 What theories of liability apply to adverse outcomes in digital health solutions?
Civil liability:
- Product liability: With the rising popularity of digital health solutions in Denmark, product liability laws play a crucial role in safeguarding individuals from potential harm or damages caused by defective digital health products. Manufacturers, importers and distributors of digital health technologies are responsible for ensuring that these products are safe, reliable and meet applicable regulatory standards. In case of harm or damage caused by the use of a product, a consumer has the right to seek compensation under the Danish product liability regulations. However, digital heath solutions pose unique challenges in terms of liability due to related issues with regard to data privacy, cybersecurity and the accuracy of health information, etc.
- Contractual liability: Contractual liability becomes increasingly important between the various parties involved in the development, deployment and use of digital health solutions. Contractual relationships typically exist between technology vendors, software developers, data processors and healthcare providers. The contracts typically establish the terms and conditions between the parties and outline rights, obligations, potential liabilities, etc. Contractual liability becomes key in the event of harm or damage caused by a product arising from a breach of contract.
Criminal liability:
- Digital health solutions must comply with relevant EU and Danish regulations and laws. Breaches of regulations relating to medical devices, data privacy, cybersecurity, the Danish Health Act, etc. may result in administrative sanctions or prosecution.
9.2 What cross-border considerations are there?
Cross-border considerations regarding liability in the context of digital health solutions involve the legal implications and challenges that arise when digital health technologies and services are deployed or used across different jurisdictions. The key factors to consider are jurisdictional variations; different countries have different legal frameworks and regulations concerning: liability and digital health solutions; data protection and privacy; healthcare regulations and licensing; and dispute resolution mechanisms.
9.3 What are best practices to minimise liability risks posed by the use of generative AI in the provisioning of digital health solutions?
In Denmark, it is common for commercial contracts to include provisions regarding liability limitations. These provisions primarily aim to limit the risk of the contractual parties being held liable, including for damages. The principle of freedom of contract in Denmark allows parties extensive powers to shape liability limitations according to their preferences. This means that it is possible to include provisions that absolve the seller of a digital health technology from responsibility for the products or services provided. Parties can also agree that the seller is only liable for certain types of damages or that liability is limited to a maximum amount. However, please note that under Danish law, it is not possible to agree to limitations on liability for personal injury.
10. General
10.1 What are the key issues in Cloud-based services for digital health?
Cloud services offer several benefits, including accelerated IT development, enhanced scalability and a robust framework. The essence of cloud computing lies in the flexible sharing of resources, enabling users to pay only for the specific resources they utilise. Moreover, cloud services are typically operated at large scale, allowing for the implementation of comprehensive security solutions within the provider’s data centres.
The key issues in cloud-based services for digital health are data security and compliance with the GDPR. The Danish Data Protection Agency (“Datatilsynet”) has published a guide on cloud service usage and launched a working group to explore data protection best practices for cloud environments. The guidelines encompass suggestions for evaluations and prerequisites concerning data processors, alongside sections addressing the transfer of data to third countries via cloud services.
10.2 What are the key issues that non-healthcare companies should consider before entering today’s digital healthcare market?
Before non-healthcare companies venture into the digital healthcare market, it is crucial for them to carefully consider a range of key issues. These include ensuring compliance with comprehensive relevant healthcare regulations and standards, establishing robust security measures and privacy protocols, addressing health data interoperability challenges and validating the efficiency and safety of their solutions through rigorous testing. By thoughtfully addressing these factors, non-healthcare companies can navigate the complexities of the digital healthcare market.
10.3 What are the key issues that venture capital and private equity firms should consider before investing in digital healthcare ventures?
Some of the key issues that venture capital and private equity firms should consider before investing in digital healthcare ventures include: market size and potential; competitive landscape; regulatory compliance; scalability and sustainability; technology and infrastructure; and clinical validity and evidence.
10.4 What are the key barrier(s) holding back widespread clinical adoption of digital health solutions in your jurisdiction?
Although Denmark’s healthcare sector is recognised as one of the most digitised in the world, an even more widespread clinical adoption of digital health solutions is hindered due to challenges in digital infrastructure across sectors. These challenges include interoperability between different systems, lack of protocol standardisation, technical infrastructure, etc. Addressing these challenges requires ongoing investments and focus to improve the exchange of health data across sectors and deliver more coordinated care.
10.5 What are the key clinician certification bodies (e.g., American College of Radiology, etc.) in your jurisdiction that influence the clinical adoption of digital health solutions?
There are no Danish clinician certification bodies that influence the clinical adoption of digital health solutions. The Danish Medicines Agency (“Lægemiddelstyrelsen”) contributes to developing policies and regulations in the pharmaceutical area, both in Denmark and in dialogue with the EU’s other regulatory authorities, including assisting the department of the Ministry of Health in pre-legislative work and ministerial services. However, the Danish Medicines Agency does not issue certifications.
10.6 Are patients who utilise digital health solutions reimbursed by the government or private insurers in your jurisdiction? If so, does a digital health solution provider need to comply with any formal certification, registration or other requirements in order to be reimbursed?
The general costs (reimbursement) of medical devices are provided by the Danish local municipalities. However, there is no specific reimbursement process for digital health solutions. If specific requirements are met, patients that are in need of medical devices, e.g. walking aids, special beds, wheelchairs, protheses, hearing aids, etc. can apply to local authorities for reimbursement.
10.7 Describe any other issues not considered above that may be worthy of note, together with any trends or likely future developments that may be of interest.
The digitalised healthcare services comprise a solid digital foundation on which to build, and although many digital solutions have been developed and implemented both nationally and locally in Danish regions and municipalities, ambitious digitalisation strategies have been set out in order to help address the health system’s challenges in the years ahead. The ambition in the coming years is to integrate and streamline the way patient data are accessed and shared across the healthcare system, in order to make all relevant data accessible when needed and to accelerate the implementation of thoroughly tested solutions across the entire health service.
The focus is on expanding our digital healthcare system, so that citizens have better self-service tools available in order to provide a general picture of home-monitoring data, etc.
link