From Dr. Google to CE-marked medical devices: need for ethical and legal safeguards

In the last decades several mobile health applications (MHAs) have been developed to assist healthcare and patients in different medical and surgical fields. Nowadays more than 325,000 m-health apps were available in major app stores with more than 3.7 billion downloads and this number continues to increase daily. MHAs collect health information, provide guidelines for maintaining a healthy lifestyle or information about disease, make medical diagnosis, and assist in disease prevention and management. Despite this, there are some drawbacks that could be addressed. First, lack of adherence to the guidelines: MHAs reported low adherence to EAU (European Association of Urology) guidelines. As previously showed [1], [2], [3], [4] MHAs were developed without healthcare support and the most important tool is their usability: they are easy to navigate, but the quality is low. Second, security and privacy remain an important debated issue yet. Suniave et al. [5] reported that MHAs developers often fail to provide app privacy policies: in fact, when reported, the privacy is not often focused on the app itself [6]. Smith et al. [7] reported that security of smartphone users is not high and sometimes many people have access to their phone. The quality rating studies conducted [8], [9], [10] show that transparency, privacy policies [11] and security documentation are still critical factors to take effort in. If on one hand MHA seem to lack of specific safeguards, on the other hand, as reported by Zhou et al. [12] there are some specific barriers and facilitators of users adopting MHA that can help developers to meet their needs [13]. EU General Data Protection Regulation is a cornerstone of privacy regulation but is not fully taken into account in all its predictions by app developers [14]. Inclusion of new health technologies is more than often something that simply “happens” and, usually the inclusion of artificial intelligence (AI) for supplementary or replacement purposes has serious social repercussions. Ethics stands as a safeguard of any indiscriminate introduction or total takeover in crucial sectors, such as Healthcare. Usually, the rush of technology is faster than the Law and not all new applications of artificial intelligence have gone through prior screening, as if apps did not require prior screening for marketing/use. According to EU Regulation 2017/745 [15], “‘medical device’ means any instrument, apparatus, appliance, software, implant, reagent, material or other article intended by the manufacturer to be used, alone or in combination, for human beings for one or more of the following specific medical purposes: – diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease”. Based on risk level and invasiveness, medical devices are divided into Class I, Class IIa, IIb and III. The conformity assessment procedure for class I devices should be carried out, as a rule, under the sole responsibility of manufacturers, in view of the low level of vulnerability associated with such devices. In addition to this existing regulation, in December 2023 the European Parliament reached a provisional agreement with the Council on the so-called “AI act”, the first law in the matter ever. The agreed text will now have to be formally adopted by both Parliament and Council to become EU law. The purpose of this Regulation is to promote a human-centric approach ensuring a high level of protection of health, safety, fundamental rights, and democracy while supporting innovation and improving. AI tools were introduced to support diagnostic practice and brought into direct contact with the patient. Thanks to the AI act, together with previous regulations adopted at the European level (both the one on personal data protection and medical devices) the protection of the right to privacy as well as patient safety has been safeguarded. However, several studies are necessary to assess the impact of these new technologies in clinical practice, especially from the point of view of patients’ perceptions, level of satisfaction, and any critical issue identified, just like repercussions on medical practice, possible liability profiles, and the changing physician-patient relationship that may find itself being filtered no longer by “Doctor Google” but by CE-marked medical devices.