1 Digital Health
1.1 What is the general definition of "digital health" in your jurisdiction?
Mexican legislation has not specifically defined "digital health". However, the Federal Commission for the Protection against Sanitary Risks (COFEPRIS) and other private and public entities are already addressing the matter in various aspects (i.e. regulation, guidelines, analysis, forums, etc.).
Nevertheless, a definition generally accepted in Mexico – although in constant evolution – is that digital health is a concept that incorporates Information and Communication Technologies, into sanitary assistance products, services and processes, as well as into organisations and institutions that may improve the health of individuals.
1.2 What are the key emerging digital health technologies in your jurisdiction?
Many areas of digital health technologies are rapidly developing in Mexico, such as: portable and ingestible devices; mobile health apps; artificial intelligence (AI); robot health carers; medicine applied robots; 3D organ printing; blockchain; telemedicine; machine learning; genome research; drones; augmented and virtual reality; and electronic records and big data, among others. As stated above, these technologies are in constant evolution.
In relation to the above, the most recent advances in digital health in Mexico have been mainly applied to three diseases: ischaemic heart disease; breast cancer; and diabetes. For example, with advances in the genetic analysis of diabetes, Mexican doctors and scientists may be able to predict which students within a student population are likely to develop diabetes, and therefore intercept with preventative measures that will save many costs in the future.
1.3 What are the core legal issues in digital health for your jurisdiction?
As a type of medical device aimed to be used by healthcare practitioners and patients, digital health has safety, quality and effectiveness implications. This is currently regulated by COFEPRIS, which grants marketing authorisations to products that are safe and effective.
Data protection is another important issue in the field of digital health. IT often involves the collection and/or transfer of data, and digital health could involve the collection and transfer of sensitive data. As a matter of fact, digital health is becoming more and more intrusive as it evolves, which is in itself a reason why the proper handling of personal information, especially the sensitive information, must be a core concern when dealing with new devices for digital health, thus having to bear in mind the concept of privacy by design. The mechanisms of data protection in Mexico are discussed further below.
It is advisable that entities offering digital health are aware of professional liability issues, and that they check whether their professional liability insurance covers events that may go wrong when providing digital health services, including providing services that require a medical licence or administering medical care.
1.4 What is the digital health market size for your jurisdiction?
The field of digital health is still relatively new in Mexico and its application in real life settings is still limited, however, it is rapidly growing, and the COVID-19 pandemic has certainly increased the rendering of remote health services, especially in the private sector. Additionally, due to the country size, Mexico is one of the most attractive markets in Latin America.
1.5 What are the five largest (by revenue) digital health companies in your jurisdiction?
The five largest digital health companies in Mexico are as follows:
- Eva.
- Zenda.
- Yana.
- Terapify.
- Sofía.
- Fundación Carlos Slim.
Please see the following for more information on the most prominent digital health companies in Mexico: https://wortev. capital/empresas-mexicanas-tecnologia-en-la-salud/.
2 Regulatory
2.1 What are the core healthcare regulatory schemes related to digital health in your jurisdiction?
Although developing, the field of digital health is still relatively new in Mexico and its application in real life settings is still limited. There are no specific healthcare regulatory schemes for digital health; the field is instead being covered by schemes which regulate medicinal products and medical devices, namely:
- the General Health Law (in Spanish, "Ley General de Salud ");
- the Health Law Regulations over Healthcare Products (in Spanish, "Reglamento de Insumos para la Salud ");
- Official Mexican Standards (NOMs), particularly the NOM-241-SSA1-2012 setting good manufacturing practices for medical devices and NOM-137-SSA1-2008 for the Labelling of Medical Devices;
- the Mexican Pharmacopoeia; and
- COFEPRIS' Rules listing healthcare products that do not require a marketing authorisation due to low risks on human health (published in December 2014).
COFEPRIS may already be addressing the need for regulations for mobile medical applications, especially for those that present health risks.
2.2 What other core regulatory schemes (e.g., data privacy, anti-kickback, national security, etc.) apply to digital health in your jurisdiction?
Since digital health implies health information management across computerised systems and the secure exchange of information between consumers, providers, payers and other suppliers and vendors, it is necessary to keep in mind the compliance with data protection laws in Mexico, as well as regulations dealing with e-commerce and electronic payments.
2.3 What regulatory schemes apply to consumer healthcare devices or software in particular?
Consumer devices require marketing authorisations from COFEPRIS in order to be marketed in Mexico. Marketing authorisation requirements, for medical devices in particular, depend on the level of risk involved in their use, according to a threefold classification system:
- Class I: products that are well known in medical practice and for which safety and efficacy have been proven. They are not usually introduced into a patient's body.
- Class II: products that are well known in medical practice but may have material or strength modifications. If introduced, they remain in a patient's body for less than 30 days.
- Class III: products either recently accepted in medical practice or that remain in a patient's body for more than 30 days.
The Mexican Pharmacopoeia provides manufacturers with specific rules and examples as guidance to classify medical devices.
Furthermore, COFEPRIS published a list of medical devices in 2014, which specifies which devices do not require regulatory approval in order to be marketed and sold in Mexico. Such products are usually those that are low risk to a patient's health.
In Mexico there is no specific regulation concerning the sanitary approval of algorithms, apps, software, etc. that could be used as healthcare tools. So far, in practice, COFEPRIS reviews these products on a case-by-case basis. In general, these digital products are not considered medical devices as in most cases they do not have direct contact with the human body.
In addition, since consumer devices or technologies are also collecting and transferring personal information to various parties, it is also necessary that they comply with data protection laws in Mexico, as well as with regulations dealing with e-commerce and electronic payments.
2.4 What are the principal regulatory authorities charged with enforcing the regulatory schemes? What is the scope of their respective jurisdictions?
The Mexican authority responsible for enforcing the regulatory framework is COFEPRIS. COFEPRIS analyses all medical devices, and if applicable, software that enables them to work.
Additionally, the National Center of Health Technology Excellence was created in order to develop guidelines to evaluate health technologies and clinical practices and manage medical equipment and telemedicine.
The National Institute of Transparency, Access to Information and Personal Data Protection (INAI) is the Data Privacy Authority (DPA) in Mexico. Its main purpose is the disclosure of governmental activities, budgets and overall public information, as well as the protection of personal data and the individuals' right to privacy. INAI has the authority to conduct investigations, review and sanction data protection controllers and processors, and authorise, oversee and revoke certifying entities
processors, and authorise, oversee and revoke certifying entities. The Ministry of Economy is responsible for informing and educating about the obligations for the protection of personal data between national and international corporations with commercial activities in the Mexican territory. Among other responsibilities, it must issue the relevant guidelines for the content and scope of the Privacy Notice in cooperation with the INAI.
The Federal Bureau for Consumer's Protection (PROFECO) monitors the compliance of the applicable provisions concerning information and advertising which could also be applicable to digital health. Additionally, PROFECO observes that "information or advertising of goods, products or services that are disseminated by any means or form must be truthful, verifiable, clear and free of texts, dialogues, sounds, images, trademarks, appellations of origin and other descriptions that lead or may lead to misleading, confusing, deceptive or abusive information".
At the beginning of 2021 PROFECO launched two initiatives in order to improve the self-regulation of e-commerce activities, which have boomed in Mexico as a consequence of the COVID-19 pandemic. The first one is the creation of a Code of Ethics for the regulation of e-commerce activities, and the second one if the grant of a digital trust seal, for those suppliers of online services who adhere to PROFECO's code of ethics, or who create a code of ethics that complies with PROFECO's guidelines, thus warranting a secure rendering of services for Mexican consumers.
2.5 What are the key areas of enforcement when it comes to digital health?
COFEPRIS can initiate ex officio legal proceedings to sanction non-compliance. Ultimately, these legal proceedings can result in the revocation of the marketing authorisation. COFEPRIS is also entitled to implement measures on behalf of public health, such as the seizure of products and ordering partial or total suspension of activities, services or adverts. Under certain conditions, COFEPRIS has statutory authority to revoke any manufacturing approval or impose sanctions, ranging from a fine of up to 16,000 times the minimum wage to closure of the establishment.
The imposition of administrative sanctions does not exclude civil and criminal liability. Administrative infringements can incur penalties ranging from a fine of up to 20,000 UMAS (Unit of Measure for Sanctions) to final closure of the establishment. Repeated infringement is also considered to be a criminal offence.
To read the full article click here
Originally Published by ICLG
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
