InLaw: Mayer Brown: Digital healthcare needs a more formal legal infrastructure

David Ellis, partner at Mayer Brown, and trainee solicitor Tiffany Wong argue that digital healthcare needs a more formal legal infrastructure to grow into a prime time industry

Let the children play . . . in the sandbox

A regulatory sandbox is a framework set up by a regulator to allow small scale, live testing of innovations (whether products or services) in a controlled and contained environment through the imposition of exemptions, waivers and/or licensing regimes. If it operates successfully, a regulatory sandbox should benefit both the regulator and the service provider – the regulator is able effectively to manage and supervise the service provider in an insulated manner minimising the risks should the new product or service have unintended or unforeseen adverse consequences, and the service provider can test its innovate products without waiting for a more comprehensive regulatory regime to be mapped out.

The regulatory sandbox for digital healthcare initiatives

Although the concept of the regulatory sandbox originated in the context of fintech to allow financial services regulators to implement control and supervision over innovative financial products, the concept is also suitable for digital healthcare initiatives.

In Singapore, the Ministry of Health (MoH) used a regulatory sandbox approach for its intended digital healthcare ecosystem. Launched in 2018, the Licensing Experimentation and Adaptation Programme, more commonly known as LEAP, permits entrants into the telemedicine market to apply for a regulatory sandbox from the MoH.

This is expected to achieve at least two outcomes:

For the service provider: to be able to introduce new healthcare models or evolve their current models in a safe manner under close supervision and communication with the MoH

For the MoH: to develop more timely, fit-for-purpose and effective regulations that support innovative digital healthcare services that benefit patients while safeguarding their interests

The MoH expects that healthcare services under the sandbox will eventually transition to licensed services. The ultimate vision is to implement a licensing regime over a broad range of healthcare services encompassing various digital healthcare initiatives such as telemedicine.

In England, the Care Quality Commission (CQC), an independent regulator of health and social care, has since 2019 launched its regulatory sandboxes with respect to digital triage, in other words, the digital healthcare service of directing people to the health and care services that best meet their needs).

Under the digital triage sandboxes, technology suppliers and the National Health Service (NHS) were able to test the robustness of digital triage technology such as software that provides treatment recommendations for specified conditions or software designed to output a subset of those medical conditions that match the input symptoms.

Following this trial, CQC recommended the NHS to develop standardised commercial contracts with technology service providers and to put in place accreditation schemes to ensure high standards of clinical performance.

Legal infrastructure for the regulatory sandbox

Existing legal infrastructure in Hong Kong

In Hong Kong, the Medical Council of Hong Kong is the statutory appointed body to handle registration and disciplinary regulation of medical practitioners, including the practice of telemedicine.

So far, the Medical Council has only published its guidelines, the Ethical Guidelines on Practice of Telemedicine, in December 2019 to provide general guidance on when telemedicine may be a suitable alternative to physical consultation and in a suitable case, the standard of conduct to be expected of the medical practitioner.

If digital healthcare including telemedicine is to be taken seriously as an alternative means to deliver healthcare services to the public, however, Hong Kong would require a comprehensive and carefully designed regulatory regime specifically tailored to the administration of digital healthcare services.

General guidelines and ethical principles may not suffice to effectively regulate the doctor-patient relationship and ensure that the patient is given the standard of care reasonably required in the circumstances.

Borrowing from the experience gained in Singapore and England, it may be beneficial to adopt the regulatory sandbox approach in Hong Kong with a view to eventually enacting new legislation and/or revising the Guidelines to implement a sophisticated regulatory framework for digital healthcare services.

Possible legal features of a regulatory sandbox in Hong Kong

The legal infrastructure of a regulatory sandbox could incorporate and combine various legal tools, including:

Conditional licensing of expressly newly permitted services (for example delivery of prescription drugs via online orders that does not go through a pharmacy) with close supervision by the regulator over whether conditions are satisfied

Restricted authorisation to engage in certain digital healthcare activities before full authorisation being granted after the experiment period (for example treatment of patients (that meet certain criteria) that doctors have never seen in person)

Imposing legal restrictions on specific digital healthcare services with specific exemptions being made available in particular circumstances

Imposing standard commercial contracts between the digital healthcare service provider and the technology service provider (with, for example, minimum delivery standards imposed on the technology service provider) to ensure the technology is of sufficient stability and quality so as to be able to support the digital healthcare service in question.

Limitations to the regulatory sandbox approach

A sandbox does not change the fact that digital healthcare service providers are providing services to real patients who may suffer harm should the regulations provide insufficient patient protection. Since a sandbox is essentially a case-by-case experiment taken by innovative service providers under the close supervision and guidance of the regulator there are risks associated with the uncertain nature of the sandbox and the possibility that the regulator may not have sufficient time and resources to devote to each one. In particular, unlike the financial sector, the regulators of the health sector are not anything like as well-resourced to monitor such projects.

Before launching any sandbox there needs to be clear thinking about what the expected next steps are to be. Otherwise, after the sandbox period is over the old regulations may simply re-apply and we will be back to square one.


Despite potential limitations to the regulatory sandbox approach identified above, experience from Singapore and England suggest that the regulatory sandbox approach should be considered as a viable process to eventually achieve efficient regulation of digital healthcare services in Hong Kong. With successful regulation, digital healthcare offers a tremendous opportunity to meet the challenge of providing better healthcare services to an ageing population without overburdening the financial resources of the Hong Kong Government.

As the Santana song goes ‘let the children play’.