UPCOMING LEGAL CHALLENGES FOR CROSS-BORDER eHEALTH SERVICES IN THE EU

The paper briefly describes the current EU legal framework in the healthcare field and assess to which extent it could apply to the provision of cross border eHealth services. In particular, it analyses the provision of such services from the free movement angle, i.e. whether EU law guarantees to health professionals access to and exercise of activiti es in the 3rd type of situations, as well as whether the insured persons have the right to reimbursement of costs of such healthcare from their social security system.


INTRODUCTION
There are essentially three categories of situations, which fall under the scope of the fundamental freedom to provide services.
The situation explicitly foreseen in Article 56 TFEU is where providers are moving to another Member State to provide their services on a temporary and occasional basis (in this article also called "the 1st type of situations"). In addition, the Court of Justice of the EU ("the CJEU") has established that free movement of services comprises two other types of situations, namely where the service recipients move to another Member State ("the 2nd type of situations") 2 and where neither the service provider nor the recipient move across a border, but only the service itself ("the 3rd type of situations") 3 .
In the healthcare field, all three situations raise specific legal issues, which have required the introduction of measures on the EU level and, as argued in the following, will necessitate further action.
The paper will briefly describe the current EU legal framework in the healthcare field and assess to which extent it could apply to the provision of cross-border eHealth services. In particular, it will analyse the provision of such services from the free movement angle, i.e. whether EU law guarantees to health professionals access to and exercise of activities in the 3rd type of situations, as well as whether the insured persons have the right to reimbursement of costs of such healthcare from their social security system. By contrast, the paper will not consider another equally important angle of eHealth services, namely the use and transfer of electronic health data 4 . The legal challenges related to eHealth from the perspective of data transfer, data protection and cybersecurity have been analysed by many authors, including at the conferences organised by the International Network of Doctoral Studies in Law (e.g. Januševičienė, 2017;Sogomonjan, Kerikmäe, 2017). However, there is paucity of literature assessing such challenges from the free movement of healthcare services viewpoint.
This topic is very relevant to our times, where the COVID-19 crisis has revealed the importance of access to healthcare in general and access to healthcare via information and communications technology ("ICT") in particular. A number of Member States, such as France, Poland, Belgium, have relaxed their limitations to the latter services during the crisis (Chittim et al., 2020), as they proved to be essential for guaranteeing healthcare in the midst of the pandemic 5 .

The free movement for health professionals
In the light of public health, most health professions are regulated in the Member States. Thus, free movement of health professionals would hardly be possible without a recognition mechanism of their qualifications. Currently, Directive 2005/36/EC on the recognition of professional qualifications ("the PQD"), which was modernised in 2013, takes care of this and related aspects. In particular, the PQD lays down the rules under which Member States recognise professional qualifications obtained in other Member States and authorise the pursuit of that profession on their territory.
Under these rules, professionals can work temporarily in another EU Member State or can pursue a permanent activity in that State as employed or self-employed persons.
Under the PQD, qualifications are recognised according to three systems: 1) automatic recognition of qualifications applies to those professions for which minimum training requirements are harmonised at the EU level (general care nurses, midwives, doctors (basic medical training and specialist doctors), dentists, including specialist dentists, pharmacists, architects and veterinary surgeons); 2) the general system for the recognition of qualifications applies to most other regulated professions (in the healthcare field, e.g. physiotherapists, dental technicians, psychologists); 3) recognition on the basis of professional experience (applies to the professional activities listed in Annex IV to the PQD; the list, however, does not contain health professions). 4 Indeed, e.g. telemedicine by its nature involves personal data processing through the generation and/or transmission of personal data related to health (European Commission, 2012b, p. 13) and access to electronic health record by both the treating physician and the patient could be considered as a key element in realising cross-border care (Hervey et al., 2017, p. 246). 5 Consequently, such a situation might raise questions about the proportionality of the previous restrictions.
In order for the provisions on the automatic recognition of qualifications to apply, the PQD is, in principle, also a measure of legal harmonisation laying down minimum requirements for the training of the professions concerned. This is particularly true in the healthcare field, because, with the exception of architects and veterinarians, all the professions covered by the provisions on the automatic recognition of qualifications are health professions.
As regards the movement of health professionals to another Member State to provide their services on a temporary and/or occasional basis, according to the PQD, the recognition process in such instances is not applicable, i.e. such professionals can work in another Member State solely with a prior declaration, renewable once a year (Article 7(1) PQD). Whether and to what extent such a declaration can be required, has to be assessed under Directive (EU) 2018/958 on a proportionality test before adoption of new regulation of professions ("the PTD").
Under Article 6 PQD, the host Member State shall exempt service providers established in another Member State from the requirements, which it places on professionals established in its territory relating to: (a) authorisation by, registration with or membership of a professional organisation or body; (b) registration with a public social security body for the purpose of settling accounts with an insurer relating to activities pursued for the benefit of insured persons. However, the service provider shall inform this body of the services, which he has provided. Some authors have argued that, based on the principles formulated by the CJEU in cases Kohll, C-158/96 and Decker, C-120/95, Article 6(b) PQD, together with Article 56 TFEU, should be interpreted as having the effect that cross-border services provided by health professionals on the territory of another Member State on a temporary and occasional basis must be covered by the statutory social security system of that Member State (Zaglmayer, 2016, pp. 156-158). Even if the situation assessed in cases Kohll and Decker concerned the movement of patients (the 2nd type of situations), the same principles should apply in a "reverse" case of the movement of a health professional. Currently, there is no case-law clarifying this issue.

The free movement for patients
Settled case-law of the CJEU concerning cross-border movement of patients to receive healthcare was eventually codified in Directive 2011/24/EU on the application of patients' rights in cross-border healthcare ("the PRD"). The PRD, inter alia, ensures the rights of patients to reimbursement of cross-border healthcare costs by their statutory social security system and complements the rights granted under the EU Social Security Coordination Regulations ("the SSCRs") 6 .
Under the SSCRs, insured persons are entitled to receive necessary healthcare in another Member State during their stay in that State, as if the persons concerned were insured under the legislation of that State. In other words, during a stay in another Member State, individuals are entitled to receive necessary healthcare under the same conditions as insured persons in that Member State. This right is confirmed by the European Health Insurance Card (EHIC), which is issued by the health insurance provider of the insured person. Under the SSCRs, the insured person may also travel to another Member State for healthcare, but only with the authorisation of the competent institution of the Member State of affiliation. There are two conditions for issuing this permit. First, the treatment in question is provided for by the legislation of the Member State in which the person concerned resides and, second, in that country, such treatment cannot be granted within a medically justified time, having regard to the patient's current state of health and presumed course of illness.
Meanwhile, according to the case-law of the CJEU codified in the PRD, Member States are generally obliged to reimburse insured persons cost of healthcare provided in another Member State, if these services are among the services to which the insured person is entitled in the Member State of affiliation. In particular, these costs must be reimbursed even if the above-mentioned conditions under the SSCRs are not fulfilled. However, given the serious risk of financial imbalances in the social security system and the objective of maintaining balanced and accessible medical and inpatient services, the CJEU has recognised that EU law does not in principle preclude prior authorisation in the case of inpatient care or highly specialised and expensive medical infrastructure or equipment. However, the system of prior authorisation shall be restricted to what is necessary and proportionate with regard to the aims sought.

The definition of eHealth services
The PRD is the first and, currently, the only binding EU act regulating some issues related to cross-border provision of eHealth services. It employs both the term "eHealth services" and "telemedicine". First, Recital 26 of the PRD states essentially that the freedom to provide services should apply to patients seeking to receive "healthcare provided in another Member State through other means, for example through eHealth services" 7 . Further, under Article 3(d) PRD, "[in] the case of telemedicine, healthcare is considered to be provided in the Member State where the healthcare provider is established". In addition, Article 7(7) PRD allows the Member State of affiliation to impose on an insured person "seeking reimbursement of the costs of cross-border healthcare, including healthcare received through means of telemedicine", the same conditions, criteria of eligibility and regulatory and administrative formalities, as it would impose if this healthcare were provided in its territory.
However, neither of the concepts are defined in the PRD or other legally binding EU acts. In the European Commission's ("the EC") documents, eHealth is defined very broadly as "the use of ICT in health products, services and processes combined with organisational change in healthcare systems and new skills, in order to improve health of citizens, efficiency and productivity in healthcare delivery, and the economic and social value of health. eHealth covers the interaction between patients and health-service providers, institution-to-institution transmission of data, or peer-to-peer communication between patients and/or health professionals" (European Commission, 2012a, p. 3). Based on this 7 Here and further the author's emphasis.
definition, eHealth encompasses a much broader range of activities than just healthcare services: it also includes, e.g. products and processes 8 . For the first time "telemedicine" was defined by the EC in 2008 as "the provision of healthcare services, through the use of ICT, in situations where the health professional and the patient (or two health professionals) are not in the same location. It involves secure transmission of medical data and information, through text, sound, images or other forms needed for the prevention, diagnosis, treatment and follow-up of patients" (European Commission, 2008, p. 3) 9 . Thus, telemedicine specifically concerns provision of healthcare services (defined in the PRD as services provided by health professionals to patients to assess, maintain or restore their state of health, including the prescription, dispensation and provision of medicinal products and medical devices) through the use of ICT. Telemedicine entails electronic transfer of data and encompasses a wide variety of services, including consultations and medical interventions, such as surgeries. Those most often mentioned in peer reviews are teleconsultation, telediagnosis (teleradiology, telepathology, teledermatology etc.), telesurgery, telemonitoring.
This definition was included and further developed in the EC's staff working document SWD(2012) 414 final. According to it, health information portals, online pharmacy, electronic health record systems, electronic transmission of prescriptions or referrals (ePrescriptions, eReferrals) are not regarded as telemedicine services. ePrescription is, e.g. excluded as it is an ancillary and independent act, which can also be delivered in a face-to-face meeting with a doctor (European Commission, 2012b, p. 3).
Based on the above-definitions, when talking about healthcare services delivered via ICT in the EU context, it is more correct to employ the term "telemedicine". On the other hand, this concept still covers a very broad range of services 10 . For the purposes of the current paper, the telemedicine services will be further classified into: − professional-to-patient services (e.g. alcohol abuse therapy using videoconferencing equipment).
Such services are already quite commonly used since long time, in particular, in remote areas and long-haul ships; − professional-to-professional services (e.g. teledermatology consultation between a general practitioner and a specialist that allows patients to obtain a specialist assessment of their skin problem when they visit their own doctor (eHealth Stakeholder Group, 2014, pp. 14-15)); − services provided via collaborative economy platforms (e.g. health professionals offering their services on a temporary and occasional basis through an eHealth platform, but engaging in a constant activity in their Member State of establishment).
The Digital Agenda for Europe sets out to achieve widespread deployment of telemedicine services by 2020 (European Commission, 2010, pp. 29-30). Through the eHealth Action Plan 2012-2020, the EC aims to support patients and healthcare workers, to connect devices and technologies and 8 The World Health Organisation (WHO) provides a similarly wide definition of "eHealth" (World Health Organisation, 2020). 9 The WHO's definition of "telemedicine" is similar to the EC's one (World Health Organisation, 2009, pp. 8-9). 10 See more about the range of activities covered under the term "telemedicine": European Commission. Market study on telemedicine (European Commission, 2018b).
to invest in making medicine more personalised (European Commission. 2012a). In addition, digital health is one sector of the Digital Single Market ("the DSM"), which is one of the EC's main priorities. In this direction, in 2018, the EC adopted an action plan in order to enable the digital transformation of health and care in the DSM (European Commission, 2018a).

Access to and exercise of telemedicine activities in the Member State of establishment
In the EC's view, a specific feature of telemedicine services is that they have a dual nature, i.e. they are at the same time healthcare services and Information Society ("IS") services (European Commission, 2008, p. 9) 11 .
With regard to telemedicine activities as healthcare services, the TFEU provisions concerning the freedom of establishment essentially require that Member States do not maintain in force any national rules or practices, which restrict access to and exercise of activities in that State, unless those restrictions are justified by imperative reasons of public interest and are proportionate with respect to the aims sought 12 . This test should apply to national provisions effectively restricting telemedicine activities, such as the Polish provisions requiring the physical presence of the patient and health professional at the same time and in the same place, for a medical act to be legally valid (European Commission, 2012b, p. 5) 13 , Dutch, German and Austrian rules rendering in-person examination conditional for reimbursement, therefore, prohibiting remote "first time encounters" with the patient (Hervey et al., 2017, p.

247) etc.
Moreover, in the field of regulated professions, including health professions, the PTD requires that Member States undertake an assessment of proportionality in accordance with the rules laid down in this Directive before introducing new, or amending existing, legislative, regulatory or administrative provisions restricting access to, or the pursuit of, regulated professions. The PTD does not expressly stipulate whether this obligation also applies to the introduction and amendment of national provisions restricting pursuit of professional activities via ICT. However, nothing in the Directive allows claiming that such national provisions are out of reach of the PTD. Therefore, before introducing such national provisions, Member States should undertake an assessment of their proportionality and notify the EC thereof after the adoption, in line with the requirements of the PTD.
With regard to telemedicine activities as IS services, Directive 2000/31/EC on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market ("the eCommerce Directive") creates a legal framework to ensure the free movement of IS services, where the latter are defined 14 as a "service normally provided for remuneration, at a distance, by 11 Although there are opinions, which argue that clinical telemedicine, such as healthcare services, should be distinguished from informative telemedicine, such as IS services (Simon, Lucas, 2013, p. 10). 12 Note, however, that although healthcare services fall under Article 56 TFEU, they are excluded from the scope of Directive 2006/123/EC on services in the internal market ("the Services Directive"). 13 The Polish Medical Activity Act allows telemedicine services since 2015. 14 In Article 1(1)(b) of Directive (EU) 2015/1535 laying down a procedure for the provision of information in the field of technical regulations and of rules on Information Society services ("the TRIS Directive"). electronic means and at the individual request of a recipient of services". Thus, e.g. telephone medical consultations or medical call-centers providing services through traditional voice telephony are not IS services (European Commission, 2012b, p. 9).
Where telemedicine services fall under this definition, the eCommerce Directive prohibits Member States from making the taking up and the pursuit of the activity of an IS service provider subject to prior authorisation requirement (Article 4(1) of the Directive).
The TRIS Directive further provides that Member States wishing to adopt a regulation on telemedicine services as IS services will have to notify it to the EC and to other Member States before adoption. This requirement seeks to verify that the future regulation will not create obstacles to the free movement of IS services and to the freedom of establishment of IS service providers within the internal market.

Right to provide cross-border telemedicine services to patients in another Member State
It has to be noted that the PQD is not applicable where telemedicine services are provided: under Article 5(2) PQD, it only applies where a health professional physically moves to another Member State to provide services. Thus, the above-mentioned legal framework concerning temporal and/or occasional work of health professionals in another Member State with a prior declaration does not apply in case of telemedicine.
Under the TFEU, as a general rule, Member States should not adopt any national law, which would prevent service providers from exercising their freedom to provide telemedicine services. Any obstacle to the freedom to provide services across borders is prohibited, unless justified by imperative reasons of public interest, e.g. on the grounds of public health. Hurdles of an administrative and reimbursement nature might represent obstacles in this regard, and Member States should prove that they are justified (European Commission, 2012b, p. 5).
Moreover, under the eCommerce Directive, if the health professional complies with the legislation applicable to the taking up and exercise of an IS service in his Member State of establishment, he will in principle be free to provide its services in other Member States (Articles 3(1) and 3(2)). This is known as the "country-of-origin principle" (European Commission, 2012b, p. 12). However, Article 3(4)(a)(i) of the eCommerce Directive allows Member States to restrict eCommerce services for reasons of public health on a case-by-case basis and with regard to a particular online service from another Member State (European Commission, 2012b, p. 9).

Reimbursement of costs of cross-border telemedicine services
As already mentioned, the PRD is the first legally binding act on the EU level addressing some issues concerning the provision of cross-border telemedicine services. Essentially, it clarifies that the right to reimbursement under this directive applies in the 3rd type of situations and regulates certain issues, e.g. defines that the "Member State of treatment" in the case of telemedicine is the Member State where the healthcare provider is established.
However, not all the issues relevant for the provision of cross-border telemedicine are addressed by this directive. Some Member States, e.g. reimburse/cover domestically only face-to-face encounters with the health professional. Without prejudice to the proportionality of such national provisions in general (see above, Part 3.2 of this paper), the PRD does not clarify whether such Member States are obliged to reimburse cross-border telemedicine services (e.g. services of a psychologist abroad through electronic means, if the system of affiliation requires a face-to-face encounter) (Bensemmane, Baeten, 2019, p. 19). Some authors read Article 7(7) PRD as allowing the face-to-face first encounter as a regulatory or administrative measure, justified as long as it is not an unnecessarily stringent requirement impeding cross-border teleconsultations (Hervey et al., 2017, p. 248).
In addition to certain ambiguities concerning the application of the PRD to telemedicine services, a more important issue is caused by non-applicability of the SSCRs in the 3rd type of situations. Similarly as in case of the PQD, Article 20 of Regulation (EC) No 883/2004 expressly requires the physical presence of the patient in the Member State of treatment, i.e. the one of the healthcare provider.
In this respect, it has to be noted that if the conditions for granting the authorisation established in the SSCRs are fulfilled, in most of the cases it would be more beneficial for the patient to use the SSCRs', compared to the PRD's, "avenue" for cross-border healthcare services. Having in mind the authorisation system under the SSCRs, there is no reason for not extending the application of the SSCRs to the 3rd type of situations.

Professional-to-professional cross-border telemedicine services
Further to the fact that the SSCRs are generally not applicable in case of cross-border telemedicine services, it is not clear whether the PRD and, accordingly, the right to reimbursement, applies to the costs of professional-to-professional cross-border telemedicine services.
On the one hand, the quite broad wording of the relevant provisions of the PRD could allow its interpretation as encompassing such services: Article 3(a) PRD defining "healthcare", e.g. does not require it to be directly provided by health professionals to patients. Further, Article 7(1) PRD stipulates quite broadly that what has to be reimbursed, is "the costs incurred by an insured person who received cross-border healthcare". On the other hand, e.g. Article 4 PRD regulating the responsibilities of the Member State of treatment might be read as entailing that there is just one Member State of treatment, thus effectively impeding cross-border professional-to-professional telemedicine.
In light of the above, it could be concluded that the PRD was not specifically intended to regulate professional-to-professional cross-border services and many ensuing questions, such as the responsibilities of the involved Member States, are left unanswered.
3.6. Cross-border telemedicine services provided via collaborative economy platforms As regards telemedicine services provided via collaborative economy platforms, an additional complication occurs concerning the legal status of the intermediary (the platform).
The current EU approach on collaborative platforms in general is based on case-by-case assessments whether a platform provides the underlying services itself or not (European Commission, 2016, p. 6). E.g. in case Asociación Profesional Elite Taxi, C-434/15, the CJEU has decided that Uber renders a transport service rather than an IS service. On the other hand, with respect to Airbnb the CJEU has held that an intermediation service which, by means of an electronic platform, is intended to connect, for remuneration, potential guests with professional or non-professional hosts offering short-term accommodation services, while also providing a certain number of services ancillary to that intermediation service, must be classified as an IS service under the eCommerce Directive (case Criminal proceedings against X, C-390/18).
Based on this approach, if it is established that the platform only provides an IS service, the eCommerce Directive would be applicable to such a platform. In such a case, notably, the PRD does not provide an answer to the question whether the reimbursement of costs for cross-border telemedicine services includes remuneration to such an intermediary.
However, if the platform is considered as also (or only 15 ) a healthcare provider, the legal situation is more complicated.
First, under the relevant provisions of the TFEU, any national limitations concerning such a model of telemedicine service provision would have to be justified and proportionate. As is also the case in other instances where only the proportionality test applies, this does not ensure legal certainty, because any national limitations would have to be challenged in the national courts in individual cases.
Second, as mentioned above, the PRD explicitly applies to telemedicine services. In this respect, according to the PRD, the standards and guidelines relating to healthcare provision of the Member State where the healthcare provider (the platform) is established should apply. However, this could be impossible to ensure in practice, if the platform engages health professionals established in other Member States.
Third, the PQD does not apply to telemedicine services. However, in light of public health, it would be reasonable to require at least some kind of notification requirement in the Member State where the platform is established, if health professionals from other Member States are engaged by the platform (Hatzopoulos, Roma, 2017, p. 117). In case of health professionals with a third country diploma, there should be a recognition procedure, to make sure that the minimum standards laid down in the PQD are observed (see, by analogy, Article 2(2) PQD for physically moving doctors).

CONCLUSIONS
In addition to the free movement provisions in the TFEU, in the 1st type of situations (where a health professional moves), the PQD and the PTD apply in the healthcare field. In the 2nd type of situations (where a patient moves), the SSCRs and the PRD are applicable. However, neither the PQD, nor the SSCRs apply in the 3rd type of the situations, i.e. where healthcare services are provided via ICT across a border.
In the EU, healthcare services provided via ICT are defined as "telemedicine" rather than "eHealth services". On the other hand, "telemedicine" still covers a very heterogeneous field. Therefore, legal issues could better be tackled by approaching the various situations covered by this concept separately, such as professional-to-patient services, professional-to-professional services and services provided via collaborative economy platforms.
The access to and exercise of cross-border telemedicine activities belong to the Member States' regulatory competence. The TFEU, the eCommerce Directive and the PRD only require, in essence, that the Member States' measures limiting or restricting such activities are justified by important public interest reasons and are proportionate with respect to the aims sought. Thus, on the one hand, lack of EU-level approach could result in having an unnecessarily too restrictive and fragmented national regulation in the EU, where the cross-border telemedicine could be impeded by the Member States who have a more reserved approach domestically.
The article has argued that in order to ensure cross-border provision of telemedicine services, some of the issues to be foremost addressed on the EU level concern the non-applicability of the SSCRs in case of cross-border telemedicine, as well as the lack of clarity in the PRD as to whether and how cross-border telemedicine services, including professional-to-professional services and services provided via collaborative economy platforms, should be reimbursed from the social security system of the insured person.
On the other hand, some EU-level measures are indispensable for the purposes of ensuring a high level of public health, in particular, with regard to the emerging field of telemedicine services provided via collaborative economy platforms. First, in light of the risks involved, the current EU approach on case-by-case assessment of such platforms might be considered unsatisfactory in the healthcare field. Second, the non-applicability of the PQD in the 3rd type of the situations could pose public health risks, if national provisions of certain Member States are too lenient. Therefore, a notification requirement in the Member State where the platform is established, if health professionals from other Member States are engaged by the platform, should be introduced in the PQD. In case of health professionals with a third country diploma, a recognition procedure should apply.