Digital Health Laws and Regulations Report 2024 Introduction


1. What is Digital Health?

The rapid convergence of digital technologies with healthcare over the past five years (even prior to the COVID-19 pandemic) has transformed how healthcare is delivered to the masses.  The promise of digital technologies continues to transform the healthcare delivery model from a traditional model based on a “one size fits all” practice of medicine that was characterised by a provider-centric approach with information silos, to a new model that is focused on patient-centric treatment personalisation with high data accessibility and utilisation.  The result is a highly personalised healthcare system that is focused on data-driven healthcare solutions and individualised delivery of therapeutics and treatments to patients using information technologies (IT) that enable seamless integration and communication between patients, providers, payors, researchers and health information depositories.  A November 2020 report by Precedence Research published on GlobeNewsWire indicates that the global digital health market is poised to grow at a compound annual growth rate of around 27.9% over the next seven years to reach approximately US$833.44 billion by 2027.[i]

Digital Health Ecosystem

There are five primary constituents that make up the Digital Health Ecosystem.  

Life Sciences Companies – are the companies that develop and make products such as therapeutics, diagnostics, medical devices and the like that are used to help treat a patient’s health or wellness condition.

Pharmacies – are the supply chain, people and companies that sell the products that life sciences companies develop to end-users such as patients and providers.

Providers – are the doctors, clinics, hospitals and healthcare systems that provide healthcare services to patients by leveraging off the products produced by the life sciences companies.

Payors – are the group of entities (e.g., private insurance companies, government-sponsored insurance programmes, national healthcare systems, etc.) that pay for the products and healthcare services provided to patients.  

Patients – are the people who all the collective entities (Life Sciences Companies, Pharmacies, Payors and Providers) try to serve as part of the Digital Health Ecosystem.

The Digital Health Ecosystem constituents sometimes struggle to transact in a seamless manner with each other; and Digital Health Solutions provide the key to building effective channels and improving efficiencies between them. 

2. Traditional Healthcare Paradigm

“One size fits all” approach

Disease diagnosis and treatment have traditionally been based on efficacy validation models that neatly packaged patient populations into distinct buckets (often focused just on the disease state in question) that rarely allowed for differentiation between the individual constituents.  This “one size fits all” approach did not enable true personalisation of patient diagnosis and treatment based on their innate individual characteristics (e.g., genome, epigenome, proteome, microbiome, metabolome, morphology, etc.) and exposome (e.g., lifestyle, environmental exposure, socioeconomic status, etc.).

One main reason why the healthcare industry adhered to the “one size fits all” paradigm for so long was the lack of capable and affordable tools and methodologies that could accurately monitor and determine all aspects of an individual’s innate characteristics and then utilise that data to precisely tailor treatments or infer clinical outcomes for an individual.  Because of recent digital health advances and availability of large volumes of relevant data, many of those technical hurdles have been overcome.  The cost of generating and processing data that is indicative of an individuals’ uniqueness (e.g., whole genome sequencing, proteomic analysis, high resolution imaging, etc.) has recently come down to such an extent that it is readily accessible to the masses and recent advances in artificial intelligence (AI) (more specifically machine learning (ML)) techniques have powered the analysis of large and complex datasets generated by these tools to make clinically relevant insights that can help guide the diagnosis and treatment of patients based on their individual uniqueness.

Provider-centric model

Until recently, healthcare services were delivered to patients primarily through a provider-centric model whereby patients seeking medical attention were required to go to a medical practitioner, clinic or hospital to be diagnosed and/or treated for their condition.  This approach was largely driven by the healthcare industry’s slow adoption of new IT (e.g., Internet of Things (IoT), wireless video communication, text messaging, electronic medical record systems, etc.) and the lack of digital health tools (e.g., wireless diagnostic medical devices, wearables, mobile apps, etc.) that allow for remote patient diagnosis and monitoring.

In the last few years, the healthcare industry’s adoption of new IT technologies and other digital health tools has accelerated significantly, ushering in a new patient-centric paradigm (e.g., telemedicine, virtual healthcare, etc.) whereby healthcare services are delivered remotely, almost on-demand, to patients regardless of where they are.  When the COVID-19 pandemic took hold of the world, a measure of urgency was also added as the provider-centric approach to healthcare now included a component of danger that patients would be exposed to COVID-19 if they visited their providers in person.

Siloing of health information and data

Data access and analytics are the fuel that drives digital health.  Patient health information has traditionally been either stored as physical files at a provider site (e.g., doctor’s office, clinic, hospital, etc.) or in electronic health record (EHR) management systems that are incompatible with one another.  This resulted in health data being siloed where they were stored, which hindered the seamless communication and sharing of health data.  This also prevented the use and aggregation of such data to power analytics tools (many of which are driven by AI/ML) that are used in a variety of different applications, including drug discovery, diagnostics, digital therapeutics, pre-surgical planning and clinical decision support.

Fragmentation of constituents

There is substantial fragmentation between the major constituents of the Digital Health Ecosystem, which makes it difficult for them to access, navigate or transact with each other.  The inefficiencies caused by this fragmentation add unnecessary cost and delay to the delivery of care to patients.  Further, it makes it difficult for patients to access the full range of products and services that are available to treat their health or wellness condition.

3. New Digital Technologies

A host of different digital technologies are helping to provide the infrastructure and know-how to drive the digital health revolution in healthcare.

Wireless connectivity and Internet of Medical Things (IoMT)

Wireless/mobile devices (e.g., mobile phones, wearables, medical devices, mobile applications, etc.) allow patients to access their healthcare providers and resources from anywhere around the world with wireless or Wi-Fi data connectivity.  In turn, this also allows their healthcare providers to monitor their current health status and condition.  This amalgamation of devices can all be connected to enterprise healthcare information systems using networking technologies to form an IoMT that allows for uniform transfer of medical data over a secure network.    

Big Data analytics/storage

The voluminous quantity of medical data captured and transmitted through an IoMT is then stored and analysed using Big Data storage and analytics systems that manage, curate and process the data to generate predictive insights and/or visualise the data to aid analysts in quickly interpreting the data.  A 2017 white paper from Stanford University School of Medicine estimates that 153 exabytes of healthcare data was generated in 2013, and that was projected to grow to 2,314 exabytes by the year 2020.[ii]  Analytics can be performed on the data using traditional statistical data analysis tools or more advanced AI/ML methodologies.

4. Enabling New Digital Health Solutions

The adoption of digital technologies in healthcare has given rise to a number of different categories of transformative digital health solutions.   

Remote patient monitoring and delivery of care

Perhaps the most visible and impactful of the categories of digital health solutions are telemedicine/telehealth and virtual care.  2020 was a banner year for telehealth as the COVID-19 pandemic led to an exponential leap in the number of patient consults using telehealth platforms due to social-distancing measures and to minimise exposure.

A 2020 report by Amwell found that before COVID-19, fewer than 1% of all physician visits in the US were conducted via telehealth; in just over a month after the start of the pandemic, analysis of health claims data found that this number had increased to over 50%.  Of those patients who used telehealth platforms, over 90% said that they planned to continue using those platforms post-COVID-19.[iii]  The digital technologies that enable telehealth are wireless/mobile devices and the applications that run on them.

Moving beyond virtual doctor’s visits through telehealth platforms is the concept of virtual care, whereby healthcare providers remotely deliver the full range of health services to patients by remotely monitoring patient condition and vitals (remote patient monitoring) using IoMT-connected wearables and wireless medical devices; and communicate with patients to provide treatment advice and answer their questions using wireless/mobile devices that enable live and secure video, audio and instant messaging communication.  This next step in the evolution of telehealth will truly change the traditional provider-centric model of healthcare delivery to patients to a patient-centric model where the wide range of healthcare services can be delivered virtually on-demand and remotely wherever the patient is located.   

Big Data analytics and AI/ML-powered healthcare solutions

  • Personalised/precision medicine: Personalised/precision medicine is another digital health solution that has recently gained traction.  These are healthcare models that are powered by Big Data analytics and/or AI/ML to ensure that a patient’s individual uniqueness (e.g., genome, microbiome, exposome, lifestyle, etc.) factors into prevention and the treatment (e.g., therapeutics, surgical procedures, etc.) of a disease condition that the patient is suffering from.  An example of this would be companion diagnostic tests that are used to predict a patient’s response to therapeutics based on whether they exhibit one or more biomarkers.  Large quantities of patient records, including measured data of one or more patient biomarkers, the therapeutic(s) the patient is taking and the patient’s clinical outcome, can be analysed using Big Data statistical software tools to determine the biomarker(s) associated with a particular clinical outcome when the patient is treated with a particular therapeutic; or be used to train AI/ML algorithms that can identify biomarker(s) of relevance and infer patient clinical outcomes when treated with a particular therapeutic.
  • AI/ML-enabled diagnostics: The application of advanced AI/ML algorithms and techniques to process healthcare data enables critical clinical insights that link previously unrelated data inputs (e.g., imaging features, genomic/proteomic/metabolomic/microbiome biomarkers, phenotypes, disease states, etc.) to disease conditions and progression.  This has resulted in diagnostic tests that have a high degree of predictive accuracy for some previously difficult-to-diagnose health conditions such as dementia, depression, Alzheimer’s, and also enabled more non-invasive methods to diagnose and monitor disease conditions (i.e., cancer) that previously required surgical biopsies or other more invasive techniques.
  • Intelligent drug design and discovery: The same data that is used to train AI/ML algorithms for personalised/precision medicine purposes can also be re-purposed to train algorithms that can be used for intelligent drug design and clinical cohort selection applications that aid in the discovery and the clinical study of new or novel therapeutics and re-purposing of existing therapeutics.

       For example, an AI/ML algorithm trained to predict biological target response and toxicity can be used to design novel (i.e., non-naturally occurring) chemical structures that have strong binding characteristics to a biological target with correspondingly low chemical and/or systemic toxicity.  This ability to design a therapeutic compound “backwards” from looking at desired attributes (e.g., binding strength, toxicity, etc.) and then custom designing a therapeutic compound with those attributes, instead of traditional drug discovery methods that screen millions of compounds for the desired attributes, is potentially game-changing.  Not only does it hold the promise to shorten the initial drug target discovery process as it moves away from looking for the proverbial “needle in a haystack” to a “lock and key” approach, but it will likely lead to drugs that have greater efficacy and fewer side effects for larger groups of patients. 

       Those novel chemical compounds can then be administered to clinical cohorts selected using AI/ML algorithms trained to choose the most suitable patients to enrol for clinical trials used to study the efficacy and toxicity of the compounds.  Currently, it takes an average 10–15 years and US$1.5–2 billion to bring a new drug to market with approximately half of the time and investment consumed during the clinical trial phases of the drug development cycle.  One of the main stumbling blocks in the drug development pipeline is the high failure rate of clinical trials.  Less than one third of all Phase II compounds advance to Phase III.  More than one third of all Phase III compounds fail to advance to approval.  One of the primary factors causing a clinical trial to fail is clinical cohort selection that fails to enrol the most suitable patients to a clinical trial.[iv]  Minimising errors in clinical cohort selection can potentially shorten the clinical trial phase and reduce the risk of clinical trial failures that are not attributable to the drug being studied.

Digital hospital

Traditional hospital workflows can be highly inefficient because of disorganisation in patient treatment workflows and difficulties that clinicians have in readily accessing or utilising patient medical information.  Through the use of digital medical information management tools, much of this inefficiency can be eliminated by ensuring less workflow downtime and gaps in the way that a patient is diagnosed and treated once he/she is admitted to a hospital and allowing patient medical information to be accessed anywhere within the hospital through a multitude of different means (e.g., workstation terminals, mobile devices, etc.) and from information stored externally from the hospital. 

EHR aggregation platforms

Large volumes of good quality patient EHR data is the fuel that drives many Digital Health Solutions.  The old adage of “garbage in, garbage out” applies particularly well to ML technologies.  Flawed or nonsense input data that is fed to even the most sophisticated ML algorithm will invariably produce nonsense outputs or predictions.  The integration of cloud-based EHR databases with advanced data extraction tools (e.g., natural language processing, automated annotations, etc.) has enabled companies to aggregate large volumes of good quality EHR data from fragmented (i.e., unaffiliated) clinical sources (e.g., sole practitioners, clinics, hospitals, etc.) distributed throughout the US and the rest of the world.            

5. Digital Health Legal Issues

There are many important legal issues that apply to digital health.  These issues can be broadly divided into two categories: intellectual property rights (IPRs); and regulatory compliance.


With respect to IPRs, there are registrable IPRs (e.g., patents, copyrights, etc.) and unregistered IPRs (e.g., data rights, trade secrets, know-how, etc.).

Patents and copyrights

With respect to digital health and patents, the most burning issue is subject-matter patentability (or what qualifies as patentable).  A series of US Supreme Court cases in the past 10 years have cast a shadow over the patentability of software (See Alice Corporation Pty. Ltd. v. CLS Bank International) and diagnostic methods (See Mayo Collaborative Services v. Prometheus Laboratories, Inc.[v] and Association for Molecular Pathology v. Myriad Genetics, Inc.).[vi]  Successfully navigating these patentability hurdles is often a critical part of protecting the substantial investments that companies make in bringing their digital health solutions into the marketplace.  Some recent US Supreme Court and Federal Circuit cases have begun to chip away at the patentability hurdles for diagnostics innovation (See Hikma Pharmaceuticals USA Inc. v. Vanda Pharmaceuticals Inc.[vii] and CardioNet, LLC v. InfoBionic, Inc.)[viii] and the current expectation is that future cases will continue to swing toward protection of this important area of innovation.  In other jurisdictions around the world, computational software-driven innovations face similar hurdles toward patentability.  

Copyrights can be used to protect software, including code for learning platforms such as various machine and deep-learning models.  Copyrights can also be used to protect databases and some types of data content that which is itself original (e.g., structured compilations of genomic sequencing data, structured compilations of images, audiovisual recordings, detailed diagrams, etc.), but cannot protect factual data (e.g., raw genomic sequencing data, metabolite data, proteomics data, etc.).  However, there may be other legal mechanisms that can be used to protect factual data, such as contract law and trade secret protection.

Trade secrets

Because of the current limitations of patent law, trade secret protection plays an outsized role in protecting digital health innovation relative to other industries.  However, trade secret law has inherent limitations that make it less protective of innovation than patents.  For example, trade secret law does not protect against third parties independently developing identical solutions (i.e., digital health innovations) and it requires that the trade secret owner marks their trade secrets and demonstrates that they are taking active measures to ensure that their trade secrets are not misappropriated. 

Data rights

Digital health solutions tend to both generate and utilise large quantities of health data; therefore, data rights are a vital component of digital health IPRs that need to be protected.  This is particularly true for digital health solutions that are powered by AI/ML algorithms as the accuracy of their predictions are largely determined by their training using large quantities of quality training data. 

As discussed above, raw factual data is generally not protectable under copyright law, so the primary means used to guard data rights is currently with contract and trade secret laws.  As the value of health data rights increases, the expectation is that the body of law dealing with data rights protection will also evolve to more adequately safeguard the rights of data owners.  

6. Regulatory Legal Issues

Moving beyond IPRs, compliance with state and federal regulations is also essential for digital health companies seeking to successfully develop, market or implement digital health solutions in the US.  

Data privacy

Continued access to medical data relies on patient trust and the laws and regulations that underpin that trust.  As data gathering and access are critical components of most digital health solutions, it is vital that digital health companies adopt data privacy policies and infrastructure that are compliant with the data privacy laws and regulations of the jurisdiction(s) in which they operate. 

In the US, the most pertinent data privacy laws are the Health Insurance Portability and Accountability Act (HIPAA), California Genetic Information Privacy Act (GIPA), California Consumer Privacy Act (CCPA) and the Virginia Consumer Data Protection Act (CDPA).  The jurisdictional boundaries of the HIPAA, GIPA, CCPA and CDPA are carved out based on both the entity gathering the data (HIPAA-Covered Entities and their Business Associates) and the legal residence of the individual whose data is being gathered.  That is, the HIPAA only applies to a statutorily defined group of Covered Entities such as health plans (e.g., health insurance companies, Medicare, Medicaid, etc.), healthcare clearinghouses (e.g., billing service, community health information systems, etc.), and healthcare providers (e.g., physicians, clinics, hospitals, pharmacies, etc.) that are considered traditional healthcare data custodians.  Importantly, this leaves a coverage gap for non-traditional healthcare data custodians such as the technology companies (e.g., Amazon, Apple, Facebook, Google, etc.) that have recently entered the healthcare marketplace through their IoT and mobile app product offerings that can diagnose and treat healthcare-related issues.  The first state to attempt to fill the HIPAA coverage gap was California when it enacted the CCPA in 2018.  The CCPA provides privacy rights and consumer protection for data obtained from residents of California irrespective of the type of business.  The California GIPA came into effect in 2022 and it places data collection, use, security and other disclosure requirements on direct-to-consumer genetic testing companies and provides their customers with access and deletion rights.  The Virginia CDPA came into effect in 2023 and is the most recent state-level data privacy law to come into effect.  It lays out clear regulations for companies that conduct business in Virginia regarding how they can control and process data.  It also gives consumers the right to access, delete and correct their data, as well as opt-out of personal data processing for advertising purposes.

Generally, the HIPAA, GIPA, CCPA and CDPA regulate how businesses collect, handle and protect an individual’s personal information (PI) to ensure their privacy and give them control over the sharing (informed consent) of their PI with third parties.

US Food and Drug Administration (FDA) regulatory

Another set of regulations that digital health companies must consider are those that regulate the safety and efficacy of digital health solutions.  The Federal Food, Drug and Cosmetic Act (FFDCA) and related laws are federal statutes that regulate food, drugs and medical devices.  The FFDCA is enforced by the FDA which is a federal agency under the US Department of Health and Human Services. 

Depending on whether the digital health solution is a device, system or software, the FDA may enforce a number of different regulations and programmes, including: 510(k) certification; Premarket Approval (PMA); Software as a Medical Device (SaMD); Digital Health Software Pre-certification Program (Pre-Cert Program); and Laboratory Developed Test regulated under the Clinical Laboratory Improvement Amendments programme.  One technology area of focus for the FDA recently is AI/ML-powered digital health software, which is dynamic by design and thus poses particular challenges for the FDA as the current regulatory regime is based on software being static by design.  The FDA recently launched a Digital Health Center of Excellence to further the advancement of digital health solutions and address the unique regulatory issues they pose.[ix] 

State-specific practice of medicine laws (telehealth and virtual health)

For telehealth and virtual health companies that provide physician consultations across state lines, the Interstate Medical Licensure Compact Commission regulates the licensure of physicians to practice telemedicine in member states.

The Interstate Medical Licensure Compact (IMLC) speeds up the licensure process for physicians practising telemedicine as it eliminates the need for them to individually apply for licences in each state they intend to practise in by allowing them to obtain an IMLC licence that is valid in all states that have joined the compact.  The following states have joined the IMLC: Alabama; Arizona; Colorado; Idaho; Illinois; Iowa; Kansas; Maine; Maryland; Michigan; Minnesota; Mississippi; Montana; Nebraska; Nevada; New Hampshire; Pennsylvania; South Dakota; Tennessee; Utah; Vermont; Washington; West Virginia; Wisconsin; Wyoming; and the District of Columbia and Guam.[x]

The Stark Law and Anti-Kickback Statutes (AKSs)

Telehealth and virtual health providers who enter into business arrangements with third parties that incentivise care coordination and patient engagement are also subject to federal Stark Law and AKSs.

The Stark Law (or physician self-referral law) prohibits referrals by a physician to another provider if the physician or his immediate family has a financial relationship with the provider.  The AKSs, meanwhile, bar the exchange of remuneration (monetary or in kind) for referrals that are payable by a federal healthcare programme like Medicare.

These laws provide another necessary consideration for telehealth companies as they can hinder opportunities for large health systems and companies to work together and to help smaller systems and hospitals develop their own platforms or take part in a larger telemedicine network.[xi]   

State and federal medical reimbursement laws and regulations

2020 has been a banner year for telehealth.  Even before the COVID-19 pandemic, the remote care delivery model had been gaining traction among patients, particularly those who have grown up with technology.

Currently, all 50 states and the District of Columbia now provide some level of reimbursement coverage for telehealth services for their Medicaid members.  At the federal level, the Mental Health Telemedicine Expansion Act was passed as part of the Omnibus Appropriations and Coronavirus Relief Package and the CONNECT for Health Act of 2019 and has been introduced but not passed.

7. Conclusions

The digital health sector experienced explosive growth even before the COVID-19 pandemic accelerated its adoption by mainstream payors, providers and patients.  With the continued rapid pace of change in digital health, the expectation is that the delivery of healthcare will continue to transform.  Within this transformation there will be some common themes.

The ability to gather data, generate clinical insights and transform those insights into actionable clinical solution(s) will form the foundation of value creation within digital health.  In this paradigm, data access becomes the new “oil rush” as data will fuel the analytics engines behind many future digital health solutions.  As a result, traditional technology players such as Amazon, Apple, Facebook and Google, may create substantial competition for traditional healthcare providers.  It remains to be seen whether those advantages will translate to success in the digital health marketplace.

Clinical adoption of digital health solutions will continue to be a challenge as there are significant clinician concerns about how to safely integrate these solutions into their day-to-day practice.  Moreover, digital health companies must navigate the myriad of state and federal regulations/laws relating to data privacy, FDA regulatory, practice of medicine, and medical reimbursement in order for their solutions to even be accessible by clinicians in the first place.

Lastly, there are brewing geopolitical factors that may impact how well digital health companies succeed in the marketplace.  Regional regulations on health data access and usage (e.g., General Data Protection Regulation, HIPAA, CCPA, etc.), reimbursement, and product approval are additional requirements to contend with for companies that are foreign to the jurisdiction.  Also, many countries have begun to aggressively invest in the gathering of healthcare data (especially whole genome data) on a national level, which can potentially be leveraged to give domestic companies an edge over foreign ones.  Examples of this are the UK Biobank Whole Genome Sequencing Project and Beijing Genome Institute (BGI) Million Chinese Genome Project.  It is conceivable (and likely) that the UK and China will implement data-access policies that specifically benefit domestic digital health companies to give them a home-grown advantage.   

8. Endnotes

[ii]           Stanford University School of Medicine (2017).  “Harnessing the Power of Data in Health, Stanford Medicine 2017 Health Trends Report”.  Retrieved from: [Hyperlink]

[iii]          Amwell (2020).  “From Virtual Care to Hybrid Care: COVID-19 and the Future of Telehealth”.  Retrieved from:  [Hyperlink]

[iv]          Harrer, et al.  “Artificial Intelligence for Clinical Trial Design.”  Trends in Pharmaceutical Sciences 40.8 (2019): 577–591.

[xi]          mHealth Intelligence (2020). “Stark Law Changes Should Benefit Telehealth, Remote Patient Monitoring”. Retrieved from: [Hyperlink]

Editor’s Note

This chapter has been written by a member of ICLG’s international panel of experts,
who has been exclusively appointed for this task as a leading professional in their field by Global Legal Group, ICLG’s publisher.
ICLG’s in-house editorial team carefully reviews and edits each chapter, updated annually, and audits each one for originality, relevance and style,
including anti-plagiarism and AI-detection tools.


Leave a Reply

Your email address will not be published. Required fields are marked *