Alpo Värri

The inclusion of artificial intelligence (AI) into the software of medical devices offers features that cannot be easily achieved by other means. To protect the health, safety and fundamental rights of the citizens in the European Union (EU), the European Parliament has approved the AI Act that regulates the use of AI within the EU. The AI Act introduces non-trivial requirements that apply to medical-device AI in parallel with the European Medical Device Regulation. Recently, the European Commission suggested revising the AI Act in a way that excludes medical devices from most of its discussion. This change appears to set the use of AI in different domains on separate paths, which in turn may leave manufacturers in uncertainty about how to address the requirements for products to be launched in the near future. This paper compares three different regulatory approaches to introducing AI-enabled medical devices to the market. The approaches differ in how thoroughly the manufacturer implements the requirements of the AI Act. As several international AI standards already exist, and many more are currently under late-stage development, it is advisable to consider what these standards can tell us the state of the art in the AI system design.

The European Union artificial intelligence act (AI Act) establishes the rules for the application of artificial intelligence (AI) systems within the European Union. The AI Act is to be complemented with the harmonised standards that provide the presumption of conformity to the AI Act if implemented fully in the organisation that provides the AI system. The joint technical committee 21 (JTC 21) of CEN and CENELEC has been assigned the responsibility to prepare these standards. Work is under way to develop standards for AI risk management, AI cybersecurity, AI quality management, Quality and governance of datasets in AI, AI trustworthiness framework and AI conformity assessment. As medical devices incorporating an AI component are also within scope of the AI Act, these standards apply to medical devices, too. For this reason, medical device experts need to contribute to the AI standardisation work so that the resulting standards will be feasible in the health sector. The challenge in the work is to make several standards good and compatible with each other in the presence of a plurality of opinions and a hurry to produce the standards in time.

The Finnish law about the secondary use of health data has made it possible to use also the data in the Kanta national health and social welfare data repository, the Kanta Services for secondary purposes such as scientific research, innovation and development, education, statistics and information management. The Kanta Services contain also a personal health record data repository, the Kanta PHR. The large amount of health data in the Kanta Services makes it an interesting source for various secondary purposes. This paper studies the opportunities, but also obstacles to the secondary use of Kanta data. The study focuses on two use cases, the Kanta PHR data use and the Patient Data Repository use for disease risk predictor development. The topic is studied by analysing laws, Kanta system documents, scientific literature, current discussions of the topic in public and three expert interviews. The literature search analysed for relevance all articles with keyword Kanta in the Finnish Journal of eHealth and eWelfare since year 2024 and also other scientific literature discussing Kanta Services and secondary use.The result of the Kanta PHR use case study was that although the EU General Data Protection Regulation would allow the secondary use of the Kanta PHR data based on consent, the current Kanta Services applications do not support this at all. Disease risk predictor development is possible with Kanta patient data repository data in scientific research, but innovation and development activities face administrative difficulties because only aggregated Kanta data is allowed to use for these purposes. Information management can make use of aggregated Kanta Services data and it can be used for benchmarking the quality of a health delivery unit to other similar units in Finland.While protecting the privacy of the individuals’ data in the Kanta Services, improvements to the secondary use law are suggested. These include the easier access to non-aggregated health data for research and development, possibilities to individuals to consent the secondary use of their Kanta PHR data and allowing the use of risk calculations for automatically inviting persons at risk to health check-ups. It is also recommended that lessons are learned from the Finnish secondary use law and the European Union European Health Data Space law allows more flexible use of health data for secondary purposes from those individuals that allow it.

Hypertrophic cardiomyopathy (HCM) is the most common inherited genetic heart disease, and its most feared outcome is a sudden death even in a young otherwise healthy adult. The EU-funded project SMASH-HCM aims at dramatically improving HCM stratification and disease management, both for clinicians and patients. The project combines data from the patients at multiple levels, from genetic and molecular data to in-silico physiological and family history data and creates in-vitro and computational models of the disease at these various levels. A digital twin of the patient will be formed based on these data modelling tasks. Modelling approaches, data-driven artificial intelligence and knowledge existing in literature will complement each other to provide decision support for the clinicians to optimize interventions, and actionable information about the disease status and development will be offered to the patient.

The COVend project aims at delivering a new effective therapy, FX06, against the SARS-CoV-2 virus infection for the management of the COVID-19 disease in hospitals. Nine of the 17 partners of the project consortium are hospitals responsible for collecting study subjects and administering the FX06 therapy to the patients. Although the clinical trial (IXION) has the main role in the project, the project has also a work package which develops and applies artificial intelligence (AI) methods to the data collected during the 28-day study period from the patients receiving the therapy. The AI work package applies exploratory data analysis methods to find patterns and profiles of the patients. Combined with the data about treatment methods and patient outcomes, the aim is to provide decision support for the therapy intervention in the later stage of the project.

The European Parliament has approved new legislation, the Digital Services Act (DSA) and Digital Markets Act (DMA) to improve the functioning of the internal market of intermediary services in the European Union (EU) where there is a risk that the major so-called gatekeeper companies can exercise unfair control of core platform services. The purpose of this study was to investigate, what health information systems could be in the scopes of these acts and what requirements the acts may have for the production, the sale and the use of health information systems. The act texts were examined bearing in mind what types of health information systems exist and what their user bases are. Those health information systems that can belong or do not belong to the groups of systems regulated by the DMA and DSA were identified. The most relevant requirements for these systems were also identified from these acts. The result of the study is that these acts have only minor consequences for the healthcare information systems sector as they are not often intermediary (hosting) services in the meaning of the DSA or gatekeepers in the meaning of the DMA. The emerging digital healthcare platforms are most affected by the new DSA and secondly such peer support patient portals where patients can supply content for others to see. Apparently, no digital healthcare platform has yet reached such a size or a dominant role within the EU that it would fall under the scope of the DMA. The two above mentioned healthcare related intermediary services have due diligence obligations to remove illegal contents from their services and to treat their business and consumer customers fairly. The obligations include clear and fair terms and conditions, the provision of a single point of contact for users and authorities, content moderation, complaint handling, marking advertising clearly, annual reporting, and responding to the contacts from the authorities. The obligations increase when the size of the enterprise increases. It is still too early to produce healthcare information systems specific guidance to support the implementation of these two acts as the acts themselves and potential upcoming general guidance documents can serve the health information systems community sufficiently well.

Background: The lack of an international standard for assessing and communicating health app quality and the lack of consensus about what makes a high-quality health app negatively affect the uptake of such apps. At the request of the European Commission, the international Standard Development Organizations (SDOs), European Committee for Standardization, International Organization for Standardization, and International Electrotechnical Commission have joined forces to develop a technical specification (TS) for assessing the quality and reliability of health and wellness apps. Objective: This study aimed to create a useful, globally applicable, trustworthy, and usable framework to assess health app quality. Methods: A 2-round Delphi technique with 83 experts from 6 continents (predominantly Europe) participating in one (n=42, 51%) or both (n=41, 49%) rounds was used to achieve consensus on a framework for assessing health app quality. Aims included identifying the maximum 100 requirement questions for the uptake of apps that do or do not qualify as medical devices. The draft assessment framework was built on 26 existing frameworks, the principles of stringent legislation, and input from 20 core experts. A follow-up survey with 28 respondents informed a scoring mechanism for the questions. After subsequent alignment with related standards, the quality assessment framework was tested and fine-tuned with manufacturers of 11 COVID-19 symptom apps. National mirror committees from the 52 countries that participated in the SDO technical committees were invited to comment on 4 working drafts and subsequently vote on the TS. Results: The final quality assessment framework includes 81 questions, 67 (83%) of which impact the scores of 4 overarching quality aspects. After testing with people with low health literacy, these aspects were phrased as “Healthy and safe,” “Easy to use,” “Secure data,” and “Robust build.” The scoring mechanism enables communication of the quality assessment results in a health app quality score and label, alongside a detailed report. Unstructured interviews with stakeholders revealed that evidence and third-party assessment are needed for health app uptake. The manufacturers considered the time needed to complete the assessment and gather evidence (2-4 days) acceptable. Publication of CEN-ISO/TS 82304-2:2021 Health software – Part 2: Health and wellness apps – Quality and reliability was approved in May 2021 in a nearly unanimous vote by 34 national SDOs, including 6 of the 10 most populous countries worldwide. Conclusions: A useful and usable international standard for health app quality assessment was developed. Its quality, approval rate, and early use provide proof of its potential to become the trusted, commonly used global framework. The framework will help manufacturers enhance and efficiently demonstrate the quality of health apps, consumers, and health care professionals to make informed decisions on health apps. It will also help insurers to make reimbursement decisions on health apps.

The DiHECO project aims at studying the role and potential of digital healthcare platforms in the European, mostly publicly arranged, healthcare service ecosystem. The project, divided into a few subprojects, tries to identify areas of research that can grow into impactful larger European projects with industry co-operation. DiHECO aims also at further developing the capacity of participants, particularly the Kaunas University of Technology, to perform relevant research in this area. In its first year, the project has made progress according to plan through joint research activities and networking events. These include the digital health tracks of the researcher and industry forum of the ICTE 2021 conference and two grant writing workshops and a scientific writing workshop.

The Envision project aims at developing artificial intelligence-based tools for supporting the treatment of critically ill COVID-19 patients in the intensive care unit. Twelve European hospitals participate in the collection of patient data for the development and validation of the artificial intelligence tools. Ten potential use cases have been identified as development targets. Data analysis and results from expert interviews are applied to define the clinically most relevant parameters and functional use cases to be used in providing decision support for the clinicians in the intensive care units for this patient group. The resulting artificial intelligence-based tool may be beneficial in the management of the next similar epidemics, as well.