An Overview of Healthtech Regulation in India: Part 1
- Home
- An Overview of Healthtech Regulation in India: Part 1
The Covid-19 pandemic exacted a brutal toll in two seemingly interminable years, between 2020 and 2021, and continues to affect lives, livelihood and economic damage. Those who have been infected (a number that likely accounts for a majority of our population at this point) and survived continue to struggle with lingering, sometimes inexplicable symptoms, known as ‘Long COVID’.
When we look back at this dark period and wonder if there was a silver lining to any of this, perhaps we will point to how the pandemic led to the unprecedented global adoption of digital technologies in the life sciences and healthcare industries.
Healthcare has always been a high contact industry. But then the pandemic brought clinical trials, supply chains and sales rep visits to a grinding halt, and the industry was forced to acknowledge that change was no longer optional. The life sciences industry “transitioned from a technologically averse, inwards looking model, to working in an agile and collaborative manner”. Novel technologies that were expected to evolve over a decade were adopted in months, sometimes days. Vaccines were developed and approved over the fastest timeline in human history. Clinical trials became “remote” and “decentralised”. The industry pivoted to embrace the new operational realities that were emerging. And patients became more amenable to remote healthcare solutions, triggering an overnight explosion in the proliferation, evolution, and financing of “healthtech”.
Yet, even as technology leaped ahead, law followed cautiously after.
In this piece, we look at some of the different kinds of healthtech platforms operating in India today, and analyse the patchwork of laws and regulations that struggle to regulate the sector.
These are the most popular healthtech business models currently in the market, although more emerge every day:
The legal and regulatory framework that governs healthtech companies is largely a patchwork of existing technology, consumer and data protection laws, with a smattering of ‘digital health’ regulations:
1. Telemedicine Practice Guidelines, 2020[1]
The Telemedicine Practice Guidelines notified in March 2020 provide a framework for registered medical practitioners to follow for teleconsultations. The guidelines focus on platform aggregators.
Guideline 5 lays down certain mandatory requirements for these platforms. For instance, they must ensure that consumers consult only with “registered medical practitioners” (RMPs) i.e. professionals duly registered with national or State Medical Councils, conduct their due diligence before listing any RMP on its online portal, and create a proper grievance redressal mechanism.
The Guidelines also clarify that technology platforms based on artificial intelligence/machine learning are not allowed to counsel the patients or prescribe medicines. Only a RMP may so counsel or prescribe and must directly communicate with the patient in this regard. The Guidelines also prescribe strict consequences for non-compliance, including blacklisting of the platform.
In April 2020, the Department of Clinical Psychology, National Institute of Mental Health and Neurosciences issued the guidelines for tele-psychotherapy services. However, unlike the Telemedicine Practice Guidelines, these do not appear to impose separate obligations for platforms providing aggregation services.
2. Consumer Protection Act, 2019[2], and the Consumer Protection (E-Commerce) Rules, 2020[3]
These rules have been put into place to regulate e-commerce marketplaces. Since several platforms have online stores where customers can purchase fitness equipment and health supplements, compliance with these rules would also become relevant. These platforms must require sellers “to ensure that descriptions, images, and other content pertaining to goods or services on their platform are accurate and correspond directly with the appearance, nature, quality, purpose and other general features of such good or service”. This information must be provided in a clear and accessible manner. Further, these platforms must also publish the terms and conditions that govern their relationship with sellers on its platform, a description of any differentiated treatment which they give or might give between goods or services or sellers of the same category.
For inventory e-commerce entities, the duties include display of accurate information relating to all sale related details (return/exchange/payment method/shipping, etc.), ensuring accuracy in advertisements and ensuring authenticity of products as advertised.
3. Food Safety and Standards (Health Supplements, Nutraceuticals, Food for Special Dietary Use, Food for Special Medical Purpose, Functional Food, and Novel Food) Regulations, 2016 (the Nutraceuticals Rules)[4]
Due to the nature of the product, there are certain additional rules for sale of health supplements, nutraceuticals and the like. The rules require food business operators to ensure that health claims in respect of an article are based on adequate level of documentation and valid proof and that these non-drug claims are subject to prior approval by the Food Authority. Further, comprehensive product information, safety and claims support data and shall periodically get it reviewed and scrutinised by a scientist or expert with relevant qualifications and experience. Since healthtech businesses act as platforms hosting these products, in order to comply with due diligence obligations in the intermediary guidelines, they must reasonably comply with these regulations as well.
4. Drugs and Cosmetics Act, 1940[5] and Drugs and Cosmetics Rules, 1945[6]
The principal legislation governing the manufacture, sale, and distribution of drugs and cosmetics in India is the Drugs and Cosmetics Act, 1940 (D&C Act) read with the Drugs and Cosmetics Rules, 1945 (D&C Rules), and the Pharmacy Act, 1948.
The D&C Act requires that, in order to manufacture for sale or distribution, sell, distribute, or stock, or offer for sale, the person must have a valid licence. Further, drugs in Schedule H, Schedule H-1 or Schedule X of the D&C Rules can be sold only against a valid prescription signed by a registered medical practitioner. For the issuance of a prescription, it is mandatory for the RMP to examine the patient as required by the Medical Council of India. This calls into question the model of telephonic authorisation to sell prescription drugs.
According to the draft Drugs and Cosmetics (Amendment) Rules, 2018 (aka the E-Pharmacy Rules – see below), a prescription generated by the e-pharmacy, through its own panel of doctors would also be valid. For those who believe prescriptions are the weak link in the business model of online pharmacies and ask what systems and controls such pharmacies must implement to verify the authenticity of prescriptions, or argue that a doctor employed by an organisation that sells drugs may have a conflict of interest while prescribing those drugs, it is worth noting that the draft E-Pharmacy Rules do not address these points.
The Drugs and Cosmetics Act also deals with counterfeiting of drugs. Manufacturing, sale and distribution (Sections 16, 17-A, 17-B and 18) and import (Sections 9-A, 9-B and 10) of counterfeit drugs is prohibited and attracts penalty (Sections 13 and 27).
5. Drugs and Cosmetics (Amendment) Rules, 2018 (E-Pharmacy Rules)[7]
The D&C Act and D&C Rules govern the offline sale of drugs but understandably, do not make specific reference to online sale. The Pharmacy Act, 1948 and Pharmacy Practice Regulations, 2015 impose certain obligations and duties on pharmacists in connection with the preparation and sale of drugs, but again do not appear to envisage online sales of drugs.
To regulate the sale of drugs online, a sub-committee was constituted by the Drugs Consultative Committee, a statutory body under the D&C Act. Based on the recommendations of this sub-committee submitted in its 2016 report, the draft E-Pharmacy Rules were issued but not notified by the Ministry of Health and Family Welfare on 28-8-2018.
These rules have not yet been notified and as such, are not yet law. In their draft form, they provide legal recognition to e-pharmacies that are currently operating without a specific legislation to govern them. Under these rules, an e-pharmacy has been defined as “the business of distribution or sale, stock, exhibit or offer for sale of drugs through web portal or any other electronic mode”. (Rule 67-I)
So, does an online pharmacy that does not carry its own inventory but functions as an online marketplace for licensed ‘physical’ pharmacies, even fall within the definition of an e-pharmacy under the E-Pharmacy Rules? This was the argument raised by a group of online pharmacies before the Madras High Court in Tamil Nadu Chemists and Druggists Assn. v. Union of India[8] and the Delhi High Court in Zaheer Ahmed v. Union of India[9], as a defence against petitions filed in those courts seeking a ban on online sales of drugs. While the Delhi High Court did ban online sale of drugs, the Madras High Court did not.
The rules provide for mandatory registration of the e-pharmacy (Rule 67-J) and setting up a grievance redressal mechanism [Rule 67-N(2)]. E-pharmacies must register with the Central Licensing Authority and pay a licence fee of 50,000 rupees (Rule 67-L). The rules clarify that e-pharmacy registration holder shall not carry out e-pharmacy with respect to the drugs covered under the categories of the narcotic and psychotropic as referred to in the Narcotic Drugs and Psychotropic Substances Act, 1985 (61 of 1985), tranquilisers and the drugs as specified in Schedule X of Drugs and Cosmetics Rules (Rule 67-M). The e-pharmacy registration holder, on receipt of the prescription shall arrange the registered pharmacist to verify the details of the patient and dispense the drugs.
However, this does not line up with the recommendations by a sub-committee constituted by the Drugs Consultative Committee under the Drugs Controller General of India (DGCI) in 2016 which recommended online sale of drugs on the basis of an electronically generated and digitally signed prescription to prevent misuse (multiple use of one prescription or forged prescriptions).
The sub-committee had noted that there are some “alarming risks” involved in case of sale of drugs through the internet. First, monitoring of fake and illegal pharmacies could be a challenge and cyber experts need to be employed to tackle such cases. Secondly, a scanned copy of a prescription is not considered authentic under the D&C Act as well as under the Information Technology Act, 2000. One prescription can be uploaded on two different e-pharmacy sites, leading to drug abuse.
Further, the Electronic Health Record (EHR) Standards, 2016 issued by Ministry of Health, also state that it must be ensured that e-prescription is digitally signed by a registered medical practitioner. These stipulations are not found in the E-Pharmacy Rules.
There are, however, in-built privacy safeguards within the E-Pharmacy Rules. Rule 67-K provides that the information collected by the e-pharmacy through prescriptions or otherwise cannot be shared with any other person apart from the Central/State Government for “public health purposes”. Further, there is a strict data localisation mandate. Rule 67-K(3) provides that:
“(3) The e-pharmacy portal shall be established in India through which they are conducting the business of e-pharmacy and shall keep the data generated localised:
Provided, that in no case the data generated or mirrored through e-pharmacy portal shall be sent or stored, by any means, outside India.”
Finally, there is a bar on advertising drugs through e-pharmacy. Rule 67-S provides that “No e-pharmacy shall advertise any drug on radio or television or internet or print or any other media for any purpose.”
Healthtech is the blue-eyed belle of the venture capital ball this season. Like most innovative and disruptive new age industries, it has moved fast, broken things and sought permission later.
Law continues to lag behind commerce in this fast-paced industry, in particular, the law relating to privacy and data protection. Healthtech players collect a tremendous amount of sensitive personal data, with limited protections around the basis for their collection, how they are to be protected and how, if at all, they can be monetised.
Part 2 of this series will focus on data and privacy laws in the digital health environment.
A version of this article appeared in https://www.scconline.com/blog/post/2021/08/06/an-overview-of-health-tech-regulation-in-india-part-1/#_ftnref2.
* Varunavi Bangia’s research has been acknowledged by the Author.[1] See here.
[2] See here.
[3] See here.
[4] See here.
[5] See here.
[6] See here.
[7] See here.
Copyright © 2025 | Ronin Legal | Website Maintained by Law Strings Management | Privacy Policy | Cookie Policy | Terms of Use
