Doctor-patient interactions are starting to evolve with the pandemic, having accelerated the use of videoconferencing and remote medical services.
As a true testament to the power of legal architecture, the solution described above was highly influenced by several legal factors.
First, the relatively small scale of operations conducted by the Client is worth noting.
Secondly, emphasis was placed on the process being as familiar as possible to the patients. Many were already using messaging apps to keep in touch with their doctors, and it was best to try and similarly maintain future interaction.
These two central aspects meant that a custom-made solution was not practical from a financial point of view and even more so when considering the patient's habits.
Requesting an appointment vs scheduling one
Requesting an appointment instead of directly scheduling one means that the Client cannot select a specific hour and date as to his desire. Rather, he indicates a convenient interval and receives a date confirmation once his appointment can be comfortably integrated into the medical centre's current schedule.
From a legal perspective, this is similar to how online marketplaces treat an order placed on a website: as a request for an offer and not as (offer) acceptance that would trigger a contractual obligation on their part. Famously, one of Europe's largest online marketplaces states in its general terms of service that the customer's order is accepted, and thus a contract is formed only upon shipping of the products. Just as e-commerce uses this business practice to prevent exhausted stock issues and other inconveniences, the solution allowed the medical centre to control how it organised its schedule.
Choosing your preferred video conferencing provider
Although a handful of players dominate the market, video conferencing providers come in all shapes and sizes. Looking forward to aspects concerning data privacy, we tried to figure out which one was best suited for the task at hand.
Highly accredited providers lacked usability (sometimes extreme), while the latter would bring in compliance questions.
**It is important to note that the medical centre operated in a jurisdiction that provided a high degree of flexibility as to its regulations regarding remote consultations**
The solution was to give patients a choice. When requesting an appointment, patients would also indicate their prefered provider. Of course, you would think this would open the flood gates to all sorts of exotic video conferencing apps, having patients request appointments via Discord or Cisco Webex. What ended up happening was exactly the opposite: over two months, 80% requested WhatsApp Videocall, the rest being split between Google Meet and Zoom.
From a data processing standpoint, this solution has the added benefit of allowing the patients to choose a trusted provider that maintains a privacy policy they agree with. In addition, this provider will be directly contracted by the patient and not as a subprocessor of the medical centre, its services being accessed as a stand-alone product and not integrated and offered via the medical centre's platform. Therefore, we concluded that signing data processing agreements at this point would not be mandatory.
Capturing consent via Typeform. Clickwrap Agreements. DPAs
Typeform is a form-building platform similar to Google Forms that, among other features, allows users to capture consent using a clickwrap type of agreement. Clickwraps require the contracting party to express consent by clicking a button or checking a box.
As opposed to Browsewrap Agreements (that do not require the user to engage in any affirmative manifestation to form the contractual relationship), or Sign-in-Wrap Agreements (that imply consent by creating an account and proceeding to the following screen by clicking a button), Clickwrap Agreements have an excellent track record with regards to valid contract formation, being highly enforceable in case of litigation.
In our case, users were asked the standard "Do you agree with our Terms of Service?" while also being provided with the specific excerpt regarding online appointments and a link to the entire ToS. Consent regarding data processing was captured via a subsequent question. The patient was finally asked to express consent for marketing communications to comply with GDPR provisions fully.
Finally, since our third-party service provider, Typeform, was acting as a data processor, we decided it would be best to sign a Data Processing Agreement. Depending on your jurisdiction, you may legally have to sign such agreements with all subprocessors you entrust with customer data. All major IT service providers have easily accessible and digitally signable DPAs, and any other reputable provider should be willing to sign a DPA upon request.
Need help drafting a DPA for your customers or reviewing a DPA you have to sign? Contact us.
Payments and refunds
Drawing yet again on the e-commerce parallel, we settled that payment would be due before services were provided.
Although legislation included the specific services in the non-refundable category, a refund policy was still necessary to inform patients about this aspect. This is similar to how many service providers have switched from privacy policies that ask for your consent to privacy notices that describe how data is being processed on a different legal ground.
*Sidenote* While setting up the payment infrastructure, one of the largest payment processors available on the market refused to provide its services, arguing for a high degree of refund demands and disputes concerning similar endeavours.
