Telehealth Regulation

Is the use of telehealth permitted?

Telehealth (or ‘telemedicine’) is generally permitted in Spain as there are no specific limitations or prohibitions regarding telehealth under Spanish law.

However, it should be noted that in Spain, health competences are transferred to the 17 different self-governing regions. Hence, each regional healthcare authority has the autonomy to allow, plan, or limit their healthcare system, including the types of services they offer such as telehealth.

Furthermore, the professional code of the Doctors and Dentists Bar Association limits teledentistry to patient orientation (during medical revisions) and second opinions, and only as long as it is clear that mutual identification and privacy is ensured.

Are there specific fields of healthcare in relation to which telehealth services are currently available, and do they involve the use of proprietary technology or platforms?

In general terms the fields of healthcare in which telehealth services are available in Spain include remote medical assistance (remote patient monitoring and second opinion) in medical specialties as psychology, dermatology, pediatrics, gynecology, oncology, dentistry, allergology, cardiology, ophthalmology, laboratories, and radiology. These services are in most of the cases offered by health insurance companies which use their own proprietary platforms (these platforms are developed by third parties, being the insurance companies or licensees).

Does the public health system include telehealth services, and if so, are such services free of charge, subsidised or reimbursed? Where the public health system does not include telehealth services, are such services covered by private health insurance?

In principle, public assistance could also cover telehealth services, however, each autonomous region of Spain is entitled to organise this as it sees appropriate. Telehealth services provided to the public assistance would have the same conditions that face-to-face services have, in terms of free of charge, subsidised or reimbursed.

Withstanding the above, some private health insurance companies are currently offering in Spain telehealth services.

Do specific privacy and/or data protection laws apply to the provision of telehealth services?

Telehealth services must be carried out in compliance with the current legislation on personal data protection. In particular, personal data processing is subject to fulfil with the obligations stated in the GDPR 2016/679. On a national level, Spanish Data Protection Act 3/2018 also applies.

How should the cross-border transfer of personal information collected and processed in the course of telehealth services be carried out to ensure compliance with applicable privacy laws?

According to the GDPR 2016/679, data concerning health are considered a special category of data. Therefore, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk (i.e., pseudonymisation and encryption of personal data).

In connection with international data transfers, as a consequence of the Schrems II judgment, data transfers to third countries (outside the EEA) under SCCs, will only be valid if the data exporter can verify on a case by case basis (by means of a risk assessment analysing the law of the recipient territory and circumstances of the transfer), that the it can be provided a level of protection of personal data which does not undermine the level of protection guaranteed to data subjects under EU law including the GDPR.

Are there any currently applicable codes of conduct on the use of telehealth systems and/or security of telehealth data in your jurisdiction?

No competent healthcare authority has published a code of conduct on a national basis. However, the Spanish Medical Association envisages telehealth in its Code of Ethics in the following terms:

• Where the clinical practice through consultation exclusively by letter, telephone, radio, newspapers or the internet, is contrary to ethical standards. The correct practice inevitably involves personal and direct contact between doctor and patient.
• In the event of a second opinion and medical check-ups, the use of email or other means of virtual communication and telehealth are allowed, whenever clear mutual identification and privacy are ensured.
• Patient guidance systems through telehealth or telephone consultation are consistent with medical ethics when used exclusively to help decision-making.

Furthermore, given the exceptional health emergency resulting from the COVID-19 pandemic, the Central Deontology Commission of the General Council of Official Medical Associations has published a document titled "Telemedicine in the Medical Act", which states, among other things, that in certain circumstances, such as the current COVID-19 pandemic, medical e-consultation may substitute for and sometimes complete the face-to-face medical act if face-to-face is not possible.

Therefore, the use of telematic means will comply with Medical Deontology, provided that there is consent by the patient, it is adapted to the deontological precepts applicable to the doctor-patient relationship, and the rights and safety of the patient is considered.

Are any specific laws, regulations, or self-regulatory instruments expected to be adopted in the near future?

It does not seem that a specific Spanish regulatory framework for telehealth is being developed. Nevertheless, there are some long-term projects and objectives programmed that will affect telemedicine, such as the Spanish Digital Strategy Plan to 2025, by the Ministry of Economy and Artificial Intelligence which aims to include telemedicine as a resource to improve the efficiency of the Spanish National Healthcare System.