Approvals and Permits for Medical Websites and Apps

By David Pan | Nigel Zhu | Emily Hu

Series Foreword

The Internet has been changing our lives at an unprecedented pace. In addition to E-shopping and food delivery, Internet medical services have become a significant part of our life. People start trying online diagnosis services when they feel sick; when they visit a doctor, they make online appointments beforehand; people also buy pharmaceuticals online as opposed to from brick and mortar pharmacies. Moreover, Internet medical services have permeated into our life, largely unnoticed. Our watches can measure our heart rate, electrocardiograph and even blood pressure, and more and more medical tests and assessments that were only available at hospitals can now be done remotely from home.

In tandem with growth opportunities, the fast-developing Internet medical technologies also pose new compliance challenges to business operators. What is the scope of legitimate online drug sales? Can prescription drugs be sold online? What telecommunication permits and approvals are required for online diagnosis, registration and sales via an APP? Do APPs and devices that feature medical monitoring or testing constitute medical devices? What are the requirements on drug transportation and logistics? How to protect personal information in Internet medical services? These are all common questions related to Internet medical services, yet their answers are far from clear to those who run the businesses.

Based on our law practices, we have prepared a series of articles in relation to Internet medical services, in the hope to help healthcare businesses to better understand relevant legal framework and regulatory trends. This article is the first of the series: Approvals and Permits for Medical Websites and APPs.

With the continuous development of the Internet and medical technology, “Internet + Health” has been gradually being widely adopted as one of the new medical service modes. Such a combination brings technological development to medical institutions, doctors, medical service consumers and other participants in the medical sector. 

Pursuant to the Framework Plan of China Health 2030 and the Guiding Opinions of the State Council on Actively Promoting “Internet +” Actions (Guo Fa [2015] No. 40), the General Office of the State Council officially issued the Opinions on the Promotion of Development of “Internet + Health” (Guo Ban Fa [2018] No. 26) (hereinafter referred to as the “Opinions”), stressing the improvement of the service systems and supporting systems for “Internet + Health”. Under the Opinions’ guidance, a large number of Internet medical enterprises flourished, such as “Ding Xiang Yuan”, “Chun Yu Doctor” and “AliHealth”, and various medical websites and Apps are constantly emerging.

In addition to encouraging the development of “Internet + Health”, policies also emphasize government supervision, requiring relevant companies and institutions to comply with legal and regulatory requirements in the process of business mode innovation. This article aims to briefly analyze various approvals and permits requisite for the main functions of medical websites and Apps, so as to help companies navigate the medical websites and Apps regulations.

I. Definition of Medical Websites and Apps

Most Internet medical enterprises and institutions have already launched websites with various functions. Due to the advancement of mobile Internet technology, as well as the convenience of mobile Apps and user stickiness, developers have invested heavily in the development and operation of Apps, hence many medical Apps have more sophisticated functions than their corresponding websites.

The definition of website is straightforward. As for Mobile Internet Applications (Apps), according to the Regulations on the Management of Mobile Internet Application Information Services [1] issued by the Central Cyberspace Affairs Commission (hereinafter referred to as the “CAC”) on June 28, 2016, it refers to “application software acquired through pre-installment, downloads and other means and run on smart mobile terminals to provide information services to users”. Accordingly, websites and Apps that feature various medical-related functions (see Part III) are the “medical websites and Apps” to be discussed in this article. It should be noted that, the Apps[2] referred here include not only Apps installed on smart communication devices such as mobile phones, but also Apps used in combination with other devices (mainly professional medical equipment such as blood pressure monitors and blood testers, but also include household equipment).

II. Approvals for Medical Websites and Apps

In practice, medical websites and Apps have functions such as online registrations, inquiries, sales of drugs (including special foods) and medical devices, medical big data and cloud services, health management, medical information, etc. Currently, the approvals required for these functions mainly include permits for value-added telecommunications services, drug information services and drug supply services, and medical device information services and medical device supply services.

A. Value-added telecommunications services

Medical websites and Apps provide services such as online inquiries, for-profit medical information services, and cloud platforms for medical big data, which involve business modes such as online data processing, voice and image communications. According to the Classification Catalogue of Telecommunications Services (2015) [3] (hereinafter referred to as the “Catalogue”), businesses that use the Internet to provide users with online data processing and transaction processing, domestic real-time interactive or on-demand voice and image communication connecting two or multiple points, e-mail services, information services and other relevant businesses, fall into the category of value-added telecommunications services and shall be regulated by relevant telecommunications laws and regulations.

The major value-added telecommunication services involved in medical websites and Apps include: (1) B11 - Internet data center services; (2) B21 - Online data processing and transaction processing services; (3) B25 - Information services. Please see Part III for details.

B. Drug and medical device related services

According to the Administrative Measures on Internet Drug Information Services [4], services involving provision of drug (medical device) information to Internet users via the Internet are subject to the approvals for Internet drug information service. For-profit Internet drug information service refers to the activities that provide online users with drug information for a charge, whereas non-profit Internet drug information service refers to the activities providing public and shared drug information for no charge. In addition, Paragraph 2 of Article 9 and Article 15 of the Administrative Measures on Supervision and Administration of Online Sales of Medical Devices [5] require entities engaged in online sales of medical devices to obtain the “Internet Drug Information Services Certificate”. As functions of most medical websites and Apps include providing information of drugs and medical devices, such as medical information, online inquiries, and drug sales, these websites and Apps must obtain the “Internet Drug Information Services Certificate”.

In terms of drug (medical device) sales, the Interim Provisions for the Examination and Approval of Internet Drug Trading Services [6] clarifies that e-commerce activities that provide drug (medical device) transaction services via the Internet must obtain the “Internet Drug Trading Services Agent Certificate”. Approvals are required for (i) drug manufacturing companies; or (ii) drug wholesale companies that conduct Internet drug transactions with entities other than their intra-group members through its own website, or companies that sell drug directly to individual consumers online, such entities must be approved by drug regulatory authorities and obtain the “Internet Drug Trading Service Agent Certificate”. It should be noted that, currently, Internet drug transactions are limited to over-the-counter drugs, and only authorized drug distributors can sell drugs directly to individual consumers online.

C. Special regulations for medical devices

According to Article 9 of the Administrative Measures on Supervision and Administration of Online Sales of Medical Devices, “entities engaged in online sales of medical devices shall sell medical devices online through their own website or a third-party medical devices online trading platform”. Accordingly, online sale channels of medical devices can be divided into self-run websites and third-party platforms. Regardless of the sales channel, the entity should obtain a permit or file a record in accordance with law.

First, for self-run websites, the Administrative Measures on Supervision and Administration of Online Sales of Medical Devices clarify the principle of “consistency between online and offline operations”. The entity-applicant engaged in medical device online sales should be those medical device manufacturing and trading companies that are licensed or registered for such operations and their sales are conducted in accordance with relevant regulations about the Marketing Authorization Holder (i.e. medical device registrant or the filing person) in the Regulations on Supervision and Administration of Medical Devices [7] and the Administrative Measures on Supervision and Administration of Online Sales of Medical Devices. According to Articles 30 and 31 of the Regulations on Supervision and Administration of Medical Devices, those who engaged in the online sales of Category II medical devices shall file with competent authorities, and those who sell Category III medical devices shall be licensed. Such websites should also complete medical device online sales filings with drug regulatory authorities in accordance with Article 8 of the Administrative Measures on Supervision and Administration of Online Sales of Medical Devices.

As for third-party platforms, since they merely provide web space, virtual trading places, trading rules, market making, electronic orders and other trading services to facilitate trading activities (as opposed to directly participating in sales), they are only required to file with authorities as third-party platforms for medical device online transaction services, as prescribed in the Administrative Measures on Supervision and Administration of Online Sales of Medical Devices. [8] Companies that conduct online sales on third-party platforms shall meet respective requirements of manufacturing licenses, trading licenses or records, in accordance with the Article 7 of the Administrative Measures on Supervision and Administration of Online Sales of Medical Devices. Those engaged in Category II devices must file with authorities, and those engaged in Category III devices must obtain a trading license. Apart from the above requirements, enterprises still need to complete medical device online sales filings. 

III. Function-specific Permits

Taking the major functions of current medical websites and Apps as examples (such as online registrations, online inquiries, sales of drugs and medical devices, medical big data and cloud services, health management, medical information, etc.). In this section, we will analyze specific permits required for different functions of various medical websites and Apps.

A. Online registration

Online registration is used for patients to make appointment or reserve for registration with medical institutions or enterprises, which publish the outpatient arrangement of different medical institutions (departments) and different doctors on their websites or Apps. This function emerges for the alleviation of long-last hardship in hospital registration, and makes in-hospital inquiries more orderly, timely and convenient by guiding patients to pre-arrange online. Notable websites and Apps in this regard are “91160 Registration Website” (www.91160.com), “HaoDaiFu Online” (www.haodf.com), “Weiyi” (www.guahao.com), etc.

Medical websites and Apps with the online registration function are subject to the permit for value-added telecommunications services (B25 - Information services). According to the Catalogue, “Information services” refer to the information services based on information collection, exploitation, processing and construction of information platform, and provided for users through the public communication network or the Internet. Depending on the means of information organization, transmission and other aspects, information services mainly include “information publication platform and delivery services”, “information search and inquiry services”, “information community platform services”, “instant information interaction services”, “information protection and processing services”, etc. Considering the characteristics of online registration, services provided by Internet medical companies that publish registration information on behalf of medical institutions and doctors, or medical institutions which publish such information themselves, conform to the definition of the “Information publication platform and delivery services” under the “Information services”. Therefore, they should obtain the permit of Information services.

The Administrative Measures on Internet Information Services [9] further differentiate permits under “Information services”. Specifically, a licensing system (hereinafter referred to as the “ICP license”) is implemented for commercial Internet information services, and a filing system (hereinafter referred to as the “ICP filing”) for non-commercial Internet information services. The distinction between “commercial” or “non-commercial” depends on whether the service provided is “for a charge”. The payer in this case includes not only users who browse the website, but also the entities or individuals who post information on the website. For websites operated by medical enterprises, although users normally do not pay for the website or the App, if the website owner charges medical institutions or doctors for posting information, such a mode still falls into the “commercial” category. In this case, Internet medical enterprises should apply for an ICP license. Websites operated by medical institutions do not charge medical institutions for publishing registration information, nor do they charge users for browsing the information, thus falling into the “non-commercial” category, and accordingly only an ICP filing is necessary.

B. Online inquiries

In this case, Internet medical enterprise serves as a platform to provide online inquiry services to medical institutions, doctors and patients. The platform integrates the information from medical institutions and doctors, and, by means of various communication methods such as graphics, phone calls, and video calls, enables doctors to diagnose online. At the same time, patients can choose different medical institutions, departments and doctors for free or paid online inquiries. Notable websites and Apps featuring such a function include “Weiyi” (www.guahao.com), “Ping’an Haoyisheng” (www.jk.cn), “AliHealth” (www.alihealth.cn), etc.

In order to achieve this function, medical enterprises must first publish information such as introductions and consultation fees on behalf of medical institutions and doctors, which constitutes “information publication platform and delivery services” under “B25 - Information services”. Moreover, unlike online registration, this function relies on multiple telecommunication means such as graphics, phone calls, and video calls for inquiries between doctors and patients. This type of online services, operated on the client software running on a computer or a smart terminal device and provides users with services of real-time information such as messages and files, is a type of “instant information interaction services” under “B25 - Information services”. Considering that a medical enterprise either collects information publication fees from medical institutions and doctors, or charges patients for inquiry services, which are “commercial” Internet information services, it should obtain an ICP license.

In addition, during or after the online inquiry, medical institutions or doctors may advise patients on medical solutions based on the patient’s condition, which may involve the purchase and use of drugs or medical devices. In this case, the medical enterprise should determine whether it should obtain a commercial or non-commercial “Internet Drug Information Service Certificate”.

C. Sales of drugs and medical devices

Most medical websites and Apps now feature online drug (medical device) sales services, where patients can purchase drugs for treatment after online consultation. Such websites and Apps include Chun Yu Doctor (www.chunyuyisheng.com), Dingxiang Doctor (dxy.com), etc. In addition, medical e-commerce platforms that specialize in online drug sales and procurement services have also emerged. These platforms, such as Kang Aiduo Online Pharmacy (360kad.com), Dingdang Kuaiyao (www.ddky.com) and AliHealth Pharmacy (www.alihealth.cn), are equipped with professional physicians to provide drug consultation services, and a full range of drugs which can be delivered to your door. 

In order to complete the transaction of drugs (medical devices) between pharmacies and consumers, sales websites must first publish information on pharmacies and drugs for consumers to browse and select. Such function falls into the scope of “information publication platform and delivery service” under “B25 - Information services”. Generally, a sales website does not charge information publishers or the viewers in the process. Therefore, the service is a "non-commercial internet information service", which requires an ICP filing only.

In addition to ICP filing, according to the Catalogue, “online data processing and transaction processing services” include “transaction processing services”, “electronic data interchange services” and “Internet / electronic device data processing services”. Nowadays, typical commodity e-commerce websites and Apps (such as Taobao, JD.com, etc.) are required to obtain a value-added telecommunications business license (hereinafter referred to as the "EDI license") under "B21 - Online data processing and transaction processing services". Drug sales websites normally provide services for online transactions between pharmacies and consumers, such as online transaction platforms, online payment, and online logistics, which are typical “transaction processing services”. Hence, undertakings of such websites should also obtain an EDI license.

It is worth noting that, self-operated drug sales platforms, which specifically refer to drug sales enterprises selling their own drugs on the Internet, are only used as online display platforms for drugs and are regarded as an online extension of offline sales activities. Thus, they do not actually provide online data processing and transaction processing services for transactions with other parties. Therefore, such drug supply enterprises can engage in online sales business without an EDI license, provided that they fulfill their obligations of ICP filing.

In addition to meeting the requirements of the abovementioned value-added telecommunications permits, drug sales websites and Apps should also apply for a license or shall file for the sales of drugs or medical devices on the Internet. As long as the website has the function of drug sales, it should obtain the "Internet drug information services certificate" and "Internet drug trading service agent certificate". If the website also trades medical devices, it should go through the corresponding approval or filing procedures depending on the nature of the website, i.e. a self-run website or a third-party platform. Specifically, with regard to medical devices sales through a self-run website, the principle of "online and offline consistency" should be followed: for the sales of Category II medical devices, the undertaking should fulfill medical device operation filings and medical device online sales filings; for the sales of Category III medical devices, the undertaking should obtain the medical device operation license and conduct medical device online sales filings. As for medical devices sales through a third-party website, regardless of the type of medical device, the undertaking of the platform simply needs to conduct third-party platforms filing for medical device online transaction services.

In practice, the medical sales website may also sell special foods, such as health foods, food for special medical use, infant formula milk powder and other infant formula food. In that case, the website needs to apply for a food business license separately.

D. Medical Big Data and Cloud Services

The purpose of developing and operating websites and Apps providing medical big data and cloud services is to exploit, develop, share and apply big data in the medical health industry. Depending on the primary services provided, enterprises can be divided into enterprises focusing on medical IT solutions and enterprises engaged in secondary development of medical big data. The former, such as Annet Information (www.annetinfo.com), Lan Won Technology (www.lanwon. com), Kyee (www.kyee.com.cn) and MEC Digital Healthcare (www.cecsm.com), addresses the upgrade of internal management systems and data integration systems of hospitals, and launch module products with medical information features, such as Medical Internet of Things, HRP, HCRM, etc. The latter, such as Kindo Medical (www.kindo.com), Shenzhen Evidence-based Medicine (www.ebmsz.com), Wanliyun (www.wlycloud.com), Yino Smart (www.szyino.com), OrigiMed (www.origimed.com), etc, focuses on a certain sub-field, for example, medical imaging, dental clinics, single diseases (tumors, cardiovascular and cerebrovascular diseases), etc. They are basically targeting hospitals, doctors, research institutions, and new drug R & D enterprises, and offer to the market clinical decision support systems, research reports, big data cloud platforms and other products.

According to the Catalogue, “Internet resource collaboration services” under “B11 - Internet data center services” refers to services provided to users, leveraging devices and resources erected above the data center, through the Internet or other networks, in ways such as acquisition at any time, use on demand, expansion at any time, and collaborative sharing, such as data storage, Internet application development environment, Internet application deployment, and operation management.

If the medical big data enterprise involves the Internet resource collaboration services in the operation process, that is, provides traditional data center services through the Internet, for example, providing users like medical health institutions with data storage, Internet application development environment, Internet application deployment, and operation management, then the enterprise should be recognized as a user of cloud infrastructure or platforms, thus being required to apply for the Value-added telecommunications business license for “B11 - Internet data center services” (hereinafter referred to as the “IDC license”). If the medical big data enterprise only provides software for users, and the medical institution or other users have to pay to use the software, then the medical big data company is essentially a mere user of cloud infrastructure users, and it does not provide traditional data center services, therefore no IDC license required.

In practice, in consideration of cost and technical issues, Internet medical big data enterprises generally hire a third-party data center cloud infrastructure or platform for application development, aiming to realize the function of medical health big data collection, storage, analysis, and sort-out, or provide medical institutions with internal management systems, monitoring data storage integration and other services. Therefore, in general, Internet medical big data enterprises do not need to apply for the IDC license, but it is still of necessity to make a judgment based on the specific type of cloud service used by enterprises in the development and operation process.

E. Health management

In recent years, the Internet medical industry has been shedding light on health management services. Undertakings either independently develop dedicated health management websites and Apps, or add this function to their original websites and Apps. Such type of websites and Apps collect, process, and use the health data of users by manual recording, device recording, or platform docking with hospitals’ data system, to provide users services, such as health assessments, physical sign recording, physical examination appointments, or health planning. Notable websites and Apps with such function are "Ciyun Health" (ciyun.cn), "Miao Health" (a.miao.cn) and "Kang Kang Online" (www.kkol.com.cn).

The function of health management builds on the collection, development, processing of a large number of users’ health information, and information platform construction. It may involve all the value-added telecommunications services in the category of “Information services”, including “information publication platform and delivery service”, “information search services”, “information community platform services”, “instant information exchange services” and “information protection and processing services”. Moreover, such services may cover paid services as well as free services. Even health assessments and health plans can be divided to general free assessments and personalized paid plans using users’ physical data as evaluation indicators. Therefore, a website or an App with a health management function is required to apply for an ICP license or conduct ICP filing depending on whether the service provided is “paid” or not.

In addition, some medical Apps can be connected to hardware devices such as blood pressure monitors, blood glucose meters, and all-in-one computers, which support the entry of users’ health data and perform disease monitoring and prevention in real time. If such Apps meet the medical device qualification criteria, they should also obtain the permits for medical devices. Regarding the analysis of this issue, please refer to the author’s article Compliance Essentials for Medical Health Apps.

F. Medical information

The comprehensive medical websites and Apps, such as “Ding Xiang Yuan” (dxy.cn) and “Jian Kang Zhi Lu” (www.jkzl.com), generally provide medical information. The function not only educates users with medical knowledge, but also introduces the treatment methods and medication warnings for various common diseases, as a matter of fact, offering a typical “information service”. Depending on whether the information provided is paid or not, the requirements for obtaining an ICP license or ICP filing shall be met. In addition, if the function involves providing users with relevant information on drugs or medical devices, then the Internet Drug Information Services Qualification Certificate must be obtained.

The above is a brief summary of qualifications for various functions of existing medical websites and Apps on the market. As "Internet + Health" continuously expands and service models are constantly refined, relevant laws, regulations, and regulatory systems will be perfected synchronously. Medical institutions or enterprises should pay attention to relevant legal issues, and, considering their own conditions and situation, abide by laws and regulations and meet regulatory requirements in the process of launching service functions and innovating business models.

Appendix

Brief Summary of Qualifications for Operating Medical Websites and Apps

* If the sales of special food (health food, food for special medical use, infant formula milk powder and other infant formula food) are included, it is required to apply for the Food operation license.

Llinks note: Application for the Internet drug trading services qualification certificate and the Good supply practice for pharmaceutical products certificate (GSP certificate)[10] has been closed.

【Endnote】

---

[1]  The Regulations on the Management of Mobile Internet Application Information Services were issued by the Central Cyberspace Affairs Commission and took effect on August 1, 2016.

[2]  For example, Apple Watch Series 5 includes a heart rate detection app that functions like ECG. The existence and function of this App, may lead Apple Watch to be identified as a medical device. Therefore, Apple disabled the ECG function on the Apple Watch sold in Mainland China, without the approval of relevant Chinese regulatory authorities.

[3]  The Classification Catalogue of Telecommunications Services (2015) was issued by the Ministry of Industry and Information Technology of the PRC and revised on June 6, 2019.

[4]  The Administrative Measures on Internet Drug Information Services were issued by the China Food and Drug Administration (former) and revised on November 17, 2017.

[5]  The Administrative Measures on Supervision and Administration of Online Sales of Medical Devices were issued by the China Food and Drug Administration (former) and took effect on March 1, 2018.

[6]  The Interim Provisions for the Examination and Approval of Internet Drug Trading Services were issued by the China Food and Drug Administration (former) and took effect on December 1, 2005.

[7]  The Regulations on Supervision and Administration of Medical Devices were issued by the State Council and revised on May 4, 2017.

[8]  The Interpretation on the Administrative Measures on Supervision and Administration of Online Sales of Medical Devices, http://samr.cfda.gov.cn/WS01/CL1725/220100.html (last visit: February 20, 2020)

[9]  The Administrative Measures on Internet Information Services were issued by the State Council and revised on January 8, 2011.

[10]  Guo Yao Jian Fa [2019] Decree No. 45: Notice on Studying, Publicizing and Implementing the PRC Drug Administration Law issued by the National Medical Products Administration.

---

Authors:

	David Pan Lawyer | Partner [phone] [phone] [e-mail]
	Press and hold the QR code to find out more about the author

Nigel Zhu Lawyer

Emily Hu

往期分享

长按下图识别二维码关注我们

© 通力律师事务所

本微信所刊登的文章仅代表作者本人观点, 不代表通力律师事务所的法律意见或建议。我们明示不对任何依赖该等文章的任何内容而采取或不采取行动所导致的后果承担责任。如需转载或引用该等文章的任何内容, 请注明出处。

点击“阅读原文”，直达通力官网了解更多资讯！