Government healthcare programs are bankrupting Federal and State governments in the United States. To add to the pressure, employer-provided health insurance takes an ever-greater share of corporate income. The Federal government’s response has been to require individual health insurance coverage and start creating a set of government bureaucracies that are intended to control costs.

Part of the reason for this is a complex relationship between subsidized healthcare; subsequent high public demand for the subsidized care; a consequent shortage of healthcare resources and therefore, ever-higher prices for relatively scarce healthcare. An increasingly popular way to escape from the system is to leave the United States and receive healthcare outside the U.S., a phenomenon often known as “medical tourism.”

Medical tourism is of course an old phenomenon. Wealthy patients for centuries have gone to areas well-known for cures, such as spas and hot springs, including the famous town of Spa in Germany, or Bath in England. And with the advent of air travel, wealthy patients for decades have traveled transcontinentally for medical care. Patients in countries with government health systems have long traveled internationally for better care or to avoid the lengthy wait-times to receive government healthcare. The new medical tourism phenomenon in the U.S. is that patients are bypassing good care nearby to get good but more economical care overseas. Until recently, the phenomenon in the United States has focused on Latin America, as well as East and South Asia, primarily due to much lower cost structures and an increasingly sophisticated healthcare infrastructure. India in particular, along with Thailand, has been at the forefront of providing a high level of care for complex surgeries, such as cardiac surgery, with lengthy rehabilitation schedules. From the perspective of developing U.S. markets, both of these destinations have a high level of medical expertise, but suffer from unfamiliarity to patients and a lengthy travel time, as we shall see.

Medical tourism has heretofore essentially been limited to patients paying out of their own pockets. Part of the reason is programmatic: the Federal Medicare program will not pay for healthcare services outside the U.S. except in certain very limited circumstances. The private market is very different: theoretically, there are few limits on large private employers and insurers providing for or encouraging medical tourism, but this has not been the norm. Partly, the hesitancy to embrace medical tourism is driven by patients: patients seek care close to their homes, so they prefer care in the U.S. And there is no economic reason to go abroad for less costly primary care; therefore, routine and primary care is usually local. Specialist care, for which travel is undertaken, is usually care from a physician or medical center with cutting-edge expertise. This care would also usually be sought in the U.S. However, there are certain complicated procedures, such as heart bypasses, hip and knee replacements, or other major surgeries, which have established protocols (not needing one-of-a-kind specialists) and which are expensive in both hospital and post-acute recovery expenses. There are also procedures, or drugs or devices that have not been approved in the U.S. by regulators, and so are only available overseas. These types of healthcare services have been the services most likely to be successfully offered through medical tourism.

These needs for less expensive care or care not otherwise available, have met with an initial response: large employers are increasingly considering offering medical tourism to their employees as a healthcare option. It is being considered in some cases as a serious potential solution to increasing healthcare costs. However, much care must be taken in the presentation of medical tourism options. Rather than requiring overseas care (which could generate costly negative blowback from employees), it is possible employers will offer medical tourism as an option, whereby employees could be told that they could (i) get an operation locally with a significant co-pay or (ii) travel overseas to receive the operation with no, or much smaller, co-pay. Smaller co-pays (with a difference of a few hundred or even a thousand dollars) may not incentivize patients to go overseas for care. However, with respect to an operation costing, say, $200,000, employers are looking at requiring a significant patient co-pay for domestic care (which could be up to tens of thousands of dollars) versus providing free overseas care. A serious incentive such as this may lead to an embrace by employees of the overseas option.

Of course, one major issue for U.S. patients will be quality of care (or perception of quality). Rightly or wrongly, U.S. patients will be concerned about quality of overseas care vis a vis the U.S. system. In this light, getting Joint Commission International (“JCI”) accreditation can be of great benefit. JCI is an affiliate of the Joint Commission, a widely respected U.S.-based accreditation organization which provides surveys and accreditation to healthcare providers in the U.S. It is not simply a matter of patient comfort, because few patients will understand the full import of gaining such accreditation. The greater impact will be on hospitals, doctors and other U.S. healthcare actors who may refer or be consulted by patients for their opinion, and who will more likely understand what Joint Commission accreditation means. Accreditation (and preparing for it) also has a salutary impact on an organization’s performance, and helps concretize the standards that are expected, and will assist with successful implementation of a medical tourism program.

Another issue is providing U.S.-licensed doctors.  There are examples of U.S.-licensed doctors practicing overseas, but not a great number, because the financial rewards of practicing in the U.S. are significant. There are many successful operations without U.S.-licensed doctors as the care directors, but the lack of U.S.-licensed doctors may continue to be a significant issue with the expansion of medical tourism among U.S. patients, who tend to trust U.S. doctors. The resistance of U.S. doctors to practicing overseas is also sometimes a question of distance: this is a potential advantage that the Caribbean and Latin American sites have over Indian and other Asian sites, due to their geographical proximity to the U.S.   India does offer significant advantages over many competing sites, but operators who want to “move to the next level” have to take on this issue of providing U.S.-licensed (or U.S.-trained) doctors to American patients.

One major legal issue that is too little addressed is legal liability. The U.S. is an infamously litigious society, and many persons and organizations get involved with facilitating medical tourism without understanding what legal risks it entails.   For example, some U.S. persons have acted as healthcare “travel agents” for patients and have subsequently been sued in U.S. court when the procedure outside the U.S. went wrong. Facilitators in the U.S. must have a written understanding with U.S. patients. This agreement should cover a number of issues, but must provide a patient acknowledgement that the facilitator is not responsible in any way for the success or non-success of the medical services, and is not liable for any outcome, including injury or death. The facilitator’s role must be spelled out clearly and limited.

The same should be true of the non-U.S. providers. They should be clear in providing information on what is being offered and guaranteed (or not). A standard packet of forms regarding health evaluations, practices, outcomes and medical records should be prepared ahead of time with counsel. The relationship with the U.S. medical tourism facilitator should also be clearly spelled out.

The legal climate in U.S. healthcare is changing in unexpected ways due to the passage of the 2010 health bill. The Patient Protection and Affordable Care Act (“PPACA”), also known as “Obama Care,” would seem to have no direct impact on medical tourism. However, the indirect impact of PPACA could be profound. PPACA seeks to control costs through a super-bureaucracy which will directly control U.S. healthcare costs through (presumably) cutting coverage of certain products and services and lowering provider reimbursement, or a combination of both. If this new bureaucracy succeeds where all others have failed, U.S. healthcare costs will go down and the need for medical tourism will fade. Even if the super-bureaucracy fails, and the incentives for medical tourism remain in place, greater governmental control over employer health insurance might easily lead to U.S. healthcare providers lobbying the government to require a “Buy American” mandate into health insurance or create more subtle disincentives, such as: disallowing travel expenses; creating minimum and maximum provider charges; or disallowing per diem post-acute care recovery payments, for example. As the government gets more involved in directing healthcare, it will naturally, as it already does in Medicare, favor domestic providers over overseas providers in ways large and small. Of course, this is all speculative; no such regulations have been announced or put in force, but it is worth considering this issue and remaining aware of it.

India is an interesting case for medical tourism. With a large English-speaking healthcare workforce, it is a natural choice for U.S.-directed medical tourism. However, as noted, long air flights from the U.S. and a relative shortage of U.S.-certified doctors have created issues for many potential patients. And of course, an increasingly wealthy India means that the cost differential between India and the U.S. is more or less constantly being whittled away.

India has been sought out particularly for high-cost surgeries, such as heart bypasses, which have lengthy rehabilitation periods. The trend has grown as Indian healthcare has continued to receive good press and word-of-mouth recommendations from returning patients. In addition, the rising prestige of Indian hospitals, physicians and medical staff and the greater profile of Indian medical products and pharmaceutical companies no doubt also has had a role in increasing the comfort level of U.S. patients with receiving care in India.

Although increasing wealth in India and an increasing domestic demand for sophisticated medical care will no doubt raise the cost of healthcare in India over time, such is the pace of U.S. medical inflation, that India will not soon catch the U.S. in healthcare costs. And in an increasingly globalized market, even services that seem naturally local, such as healthcare, will be provided in the global marketplace.   By paying attention to the fundamental issues of quality, quality perceptions, accreditation, legal structure and the evolving legal landscape in the U.S., Indian healthcare providers have a bright future in succeeding in this new marketplace.

Eric Hargan is a Shareholder in Greenberg Traurig’s healthcare department, based in Chicago, Illinois. He formerly served in the position of Deputy Secretary of the U.S. Department of Health and Human Services in Washington, D.C. and as a U.S. representative to the World Health Organization. He may be reached at hargane@gtlaw.com; phone (312) 208-7089.

by Eric Hargan

Madras High Court Rules That Foreign Lawyers May “Fly-In and Fly-Out” To Provide Advice on Foreign Law to Indian Clients

On February 21, 2012 the Madras High Court in A.K Balaji v. Govt. of India [2012] 18 taxmann.com 283 (Madras) observed that foreign law firms/lawyers may visit India for a temporary period on a ‘fly in and fly out’ basis to advise their clients in India on foreign law/international legal issues.

In the instant case, most of the respondent law firms were carrying out consultancy/support services in the field of protection and management of intellectual, business, and industrial proprietary rights, carrying out market surveys and market research, and publication of reports and journals without rendering any legal service including advice in the form of opinions.

The question involved was whether foreign firms and foreign lawyers are entitled to practice on the litigation side and non-litigation side in any manner within the territory of India or not. The High Court held that:

• Foreign law firms or foreign lawyers cannot practice the profession of law in India either on the litigation or non-litigation side, unless they fulfill the requirement of the Advocates Act, 1961 and the Bar Council of India Rules.
• There is no bar either in the Act or the Rules for the foreign law firms or foreign lawyers to visit India for a temporary period on a ‘fly in and fly out’ basis, for the purpose of giving legal advice to their clients in India regarding foreign law or their own system of law and on diverse international legal issues.
• Moreover, with regard to the aim and object of the International Commercial Arbitration introduced in the Arbitration and Conciliation Act, 1996, foreign lawyers cannot be debarred to come to India and conduct arbitration proceedings for disputes arising out of a contract relating to international commercial arbitration.
• P.O. companies providing wide range of customized and integrated services and functions to its customers like word-processing, secretarial support, transcription services, proofreading services, travel desk support services, etc. do not come within the purview of the Advocates Act, 1961 or the Bar Council of India Rules. However, in the event of any complaint made against these B.P.O. Companies violating the provisions of the Act, the Bar Council of India may take appropriate action against such erring companies.

Therefore in the light of the scheme of the Act if a lawyer from a foreign law firm visits India to advice his client on matters relating to the law which is applicable to their country, for which purpose he ‘flies in and flies out’ of India, there could not be a bar for such services rendered by such foreign law firm/foreign lawyer.

The case presented interesting issues on whether foreign lawyers can come to India for the purpose of offering legal advice to their clients here on foreign law and whether any provision of law prohibits practice of foreign law in India.

Mr. Aseem Chawla is a Partner, and Ms. Surabhi Singhi is an Associate, Amarchand & Mangaldas & Suresh A. Shroff & Co., based out of Delhi, India. Mr. Chawla leads the tax practice group of the firm and can be contacted at aseem.chawla@amarchand.com. Ms. Singhi is an Associate with the tax practice group of the firm and can be contacted at surabhi.singhi@amarchand.com.

Background

Reflecting the Indian economy’s globally feted growth in recent years, its healthcare industry and market for medical devices have witnessed a significant upswing. Some estimates suggest that the Indian healthcare industry may grow to around USD 238.76 billion by 2020. The Indian medical technology industry (covering devices as well as software, re-agents etc. but excluding medicines) has been estimated to reach around USD 5 billion in 2012 with an annual growth of up to 15% (as reported by Confederation of Indian Industry and Deloitte in 2010 in “Medical Technology in India – Riding the growth curve”).

The Indian healthcare system has made significant strides since India’s independence in 1947, particularly in addressing life expectancy, infant mortality rate and containment/eradication of previously virulent diseases. India is globally the third largest producer (by volume) of pharmaceutical drugs (as noted on the official website of the Indian Government’s Department of Pharmaceuticals) and already attracts sizeable numbers of “medical tourists” from Europe and North America due to the availability of world class doctors and facilities at relatively low cost. However, paradoxically, access to quality healthcare in India remains very limited for the general public, particularly outside its large cities and for the economically disadvantaged. In this context, the Indian government’s healthcare policies and the regulatory framework governing the manufacture and sale of medical devices assumes importance. This article discusses certain key elements of the current legal and regulatory framework as well as proposed legislative and policy initiatives.

Existing Regime

The regulation of medical devices in India emerged rather slowly over the last few decades. The primary law dealing with medical devices is the Drugs and Cosmetics Act, 1940 and the accompanying Drugs and Cosmetics Rules, 1945 (collectively, “Drugs Act”).

While the Drugs Act is principally a statute dealing with pharmaceutical/medicinal formulations, in 1983, the definition of ‘drug’ under the Drugs Act was expanded to include devices intended for internal or external use in the diagnosis, treatment, mitigation or prevention of disease or disorder in human beings. The specific devices covered by the Drugs Act are notified by the Indian Government. The Drugs Act covers a product’s supply chain from manufacturing to testing, distribution and sale, including, inter alia, registration of the manufacturing premises (in India or elsewhere), import license, sale and distribution license, clinical trial requirements, compliance with labeling and manufacturing standards and requirements.

The (very limited) initial list of regulated devices has been expanded over the years to include about thirty items including (i) In–vitro diagnostic devices for HIV, (ii) Cardiac Stents and Orthopedic Stents, (iii) Catheters, (iv) Intra Ocular Lenses, (v) Bone Cement, (vi) Heart Valves and (vii) Internal Prosthetic Replacements.

Evidently, the list still remains quite small, leaving out a multitude of medical devices, including commonly marketed items like gluco-meters used in homes as well as hospitals for checking blood sugar levels, and high-value medical devices like pace-makers. Such devices are not specifically within the scope of the Drugs Act and appear to fall into a grey area (as opposed to the detailed regulations for such devices in certain jurisdictions).

A review of the Drugs Act also reveals that drugs and pharmaceuticals are regulated by provisions aimed at addressing public health and safety concerns. These include provisions that deal with the adulteration of drugs and spurious drugs, but would not cover devices. As a result, important public health and safety aspects of medical devices remain largely unaddressed. So, while the Drugs and Cosmetics Rules, 1945 contain a few schedules dedicated to medical devices (including Schedule M-III relating to requirements of factory premises for medical devices and Schedule R-1 relating to quality specifications of specified devices), they are inadequate in dealing with the wide variety of medical devices being marketed in a fast growing sector.

Another feature of India’s regulation of drugs/medical devices is that it is divided between authorities under (A) the central government of India (“GOI”) and (B) the various State governments (India currently comprises 28 States). This arises from the federal system in India, as reflected in India’s Constitution (which contains 3 lists demarcating matters to be legislated and implemented by GOI and the State governments). “Drugs” features on the “Concurrent List”, i.e., matters on which both the GOI and State governments have competence. Interestingly, since “Public health and sanitation; hospitals and dispensaries” is listed under the “State List”, healthcare is primarily a matter under the State governments.

Broadly, the regulatory machinery consists of the Central Drugs Standard Control Organization (“CDSCO”), under the Drugs Controller General of India (“DCGI”), Ministry of Health and Family Welfare, GOI. This is the central regulatory agency, which works in conjunction with the State Drug Control Organizations to administer the provisions of the Drugs Act. The Drugs and Technical Advisory Board (“DTAB”) is another nodal agency, set up under the provisions of the Drugs Act to advise the GOI and State governments regarding technical matters relating to the Drugs Act. Further, the Ministry of Health and Family Welfare has established numerous Medical Device Advisory Committees (“MDACs”) dealing with various categories of medical devices (e.g., reproductive & urology devices, ophthalmic devices, etc.). Their primary objective is to advise and assist the DCGI in reviewing applications for new medical devices covered under the Drugs Act, and clinical trials regarding the same. Additionally, the MDACs also have the power to identify devices that need to be regulated/notified by the GOI and prepare guidelines for research and development of new medical devices relevant to India.

There is a further division of responsibilities within this regulatory machinery. The regulation of manufacture, sale and distribution of drugs and regulated devices is primarily the concern of the State authorities while the central agencies (primarily CDSCO and DGCI) are responsible for approval of new drugs, clinical trials, laying down the standards, control over the quality of imported drugs and regulated devices, coordination of the activities of State authorities, etc.

The co-existence of multiple regulatory agencies makes the tracking and understanding of regulatory landscape and developments a cumbersome and daunting task. Added to this, the notification based approach has made the development of regulation very ad-hoc. Often industry players need to reach out to the regulator(s) to seek clarifications. Such a situation gives rise to uncertainty for manufacturers and distributors of most types of medical devices and also compromises protection of public safety and health. This certainly does not bode well for the medical devices market (that is poised to grow exponentially) and customers/users. Unwittingly, this splitting of powers between the GOI and State governments has also created some challenges in the effective regulation of medical devices since any centralized dedicated regulation of medical devices can easily upset this delicate balancing of responsibilities.

That there is a great need for comprehensive regulation of medical devices in India is not in question. As has been noted by Association of Indian Medical Device Industry (“AIMED”), medical devices form an entirely different category as opposed to medicines. In our view, attempting to regulate them through a legislation originally drafted in respect of medical drugs/pharmaceuticals will inevitably be a difficult exercise, given the varied nature of medical devices and the fact that an entirely different set of quality/safety standards would apply to them (as opposed to drugs). In recognition of this need, several efforts have been made to address the situation.

Key Efforts

Certain amendments to the Drugs Act were proposed by way of the Drugs and Cosmetics (Amendment) Bill 2007 (“2007 Amendment Bill”). It includes a proposal to amend the definition of ‘drug’ in order to expand its scope and include various types of medical devices, including any “medical device, medicated device, instrument, apparatus, appliance, material, software necessary for their application, intended for internal or external use in human beings or animals, whether used alone or in combination, as may be specified from time to time by the Central Government …for the purpose of diagnosis, prevention, monitoring, treatment or mitigation of any disease or disorder; diagnosis, monitoring, treatment, alleviation of or compensation for, any injury or handicap; investigation, replacement or modification of anatomy or physiology; or control of conception, and which does not achieve its intended action primarily by any pharmacological or immunological or metabolical process…” While this proposed definition of ‘drug’ aims to cover a broad spectrum of medical devices generally, it falls short of being a significant step forward as it continues to depend on the specific notification of such devices.

Another proposal in the 2007 Amendment Bill is to replace one of the central regulatory bodies, i.e. the DTAB with another agency, the Central Drugs Authority, to advise the GOI and State governments on matters relating to both allopathic and Indian systems of medicine. DTAB currently advises the government on technical matters relating to the Drugs Act, which includes medical devices; however, there is a lack of clarity on how a substitute nodal body such as the proposed Central Drugs Authority would impact or even address some ongoing challenges and issues in relation to the regulation of medical devices.

An overview of the proposed amendments vide the 2007 Amendment Bill, currently pending in the Indian Parliament, shows that these amendments would not be a significant change in direction from the substantive approach to medical devices in the current Drugs Act. The root issues as have been noted by legal commentators and industry, i.e., the problems inherent to using a legislation originally meant for dugs/pharmaceuticals to regulate medical devices, would remain unaddressed.

A more meaningful effort is the draft Medical Devices Regulation Bill, 2006 (“MDR Bill”), proposed by the Department of Science & Technology, GOI, as a consolidated and comprehensive set of regulations specific to medical devices. In contrast to the regime under the Drugs Act, the MDR Bill is intended as a comprehensive and dedicated regulation of medical devices with special focus on public health and safety aspects. The MDR Bill seeks the establishment of a national level regulator aimed at establishing and maintaining a national system of controls for the quality and safety of medical devices. It covers important aspects right from design, standards and manufacturing to testing, packaging, labeling, import, sale, use, and disposal requirements. Importantly, the definition of a ‘medical device’ in the MDR Bill is in line with internationally accepted norms. The complexity of and wide variety of medical devices is recognized and the classification of devices (and regulation) is according to the level of risk associated with them. The approach is to put in place a principle based substantive law rather than mere procedure and license based regulation. This proposal continues to languish due to objections by various States to its provisions, including a perceived dilution of the powers of State regulatory agencies.

Another effort for a comprehensive regulation has been made by the DTAB, which formulated a revised set of guidelines intended to replace and expand the existing Schedule M-III under the Drugs and Cosmetics Rules, 1945. The proposed Schedule M-III proposes regulations for inspection and monitoring of medical devices that in some respects even betters the standard proposed by the MDR Bill, e.g., it provides explicit provisions allowing for the withdrawal of devices that may compromise the health and/or safety of patients or users even after it is installed, maintained and used as per prescribed regulations). It also expands the scope of the definition of ‘drug’ under the Drugs Act by providing broader criteria by which various types medical devices will be deemed to be included within the definition of ‘drugs’ under the Drugs Act. Further, like in the MDR Bill, this proposed schedule also seeks to classify medical devices according to risk levels associated with the use of such devices (e.g.: thermometers would be classified as low risk devices while heart-valves would be ‘high-risk’ devices) – the monitoring and regulatory requirements for medical devices would be calibrated accordingly.

However, while the proposed Schedule M-III was formulated in 2009, it seems to have stagnated. An expert committee was set up in 2009 to review, inter alia, the proposed Schedule M-III and recommend a suitable course of action in relation to the regulation of medical devices but could not take it further – the AIMED and other industry players have made a number of submissions to the DTAB in this regard but there has been little discernible progress. Also, the issue with regulating medical devices through the Drugs Act is not addressed as this proposal seeks to use the existing statutory framework. To our mind, this would not address the fundamental gap in the present system of governing medical devices as ‘deemed’ drugs and pharmaceutical formulations. Therefore, the case for having a comprehensive and full-fledged statute to provide governance and regulation of medical devices in India remains strong.

Unfortunately, any major step forward presents difficult challenges. On the one hand, there is a clear need for a focused and dedicated legislation for regulating medical devices in India, and on the other hand, the creation of a centralized regulatory framework causes a perceived dilution in the separate powers of the GOI and State governments.

There is a great need for policy makers and law makers to step up the efforts to meaningfully set out regulations for medical devices in India. Given the interest and media coverage that this issue has received recently, it is hoped that the concerned powers will make a sustained effort to resolve the difficult issues (including the particular challenge of consensus building among the States and GOI) and pass a dedicated law through the Parliament.

Debashish Sankhari is a Partner in the M&A practice at AZB & Partners and has experience in corporate/advisory and commercial transactions in a broad range of sectors. Shuchi Sinha is a Senior Associate working in the M&A and debt finance practice at AZB & Partners, and has advised clients on investments/financing for various industries including pharmaceuticals, healthcare diagnostics and medical services.

By Debashish Sankhari and Shuchi Sinha

To meet their staffing needs in India, many businesses, both domestic and foreign, engage contract labor for the scalability and flexibility it provides in managing human resource and head count. This approach raises several legal compliance issues that must be dealt with both up-front and on an ongoing basis. This article provides a road map for managing the legal and regulatory risks of engaging contract labor.

1. What the Law Permits

In a nutshell, the Contract Labour (Regulation & Abolition) Act, 1970 (the “Act”) permits companies and establishments (the “Employer(s)”) in the manufacturing and services sectors to engage contract labor through contractors for performing tasks that do not form part of the “core” operations. Core operations are those activities for which a company or establishment has primarily been established. The Act allows the Government to prohibit Employers from employing contract labor in any of its core process or operations. The Government, prior to issuing a prohibitory notification for engaging contract labor in any process evaluates whether –

• the process or operation is incidental or necessary for the Employer;
• the work performed by contract labor is permanent in nature;
• such process or work is ordinarily performed by regular employees of other similar Employers; and
• sufficient number of whole-time employees can be deployed to perform the work.

By engaging contract labor in the incidental activities, Employers can concentrate on developing their core competencies and non-core activities are performed by contract labor whose management is in the hands of contractors who employ and control them.

2. Applicability of the Act

The Act is applicable to every Employer or contractor who employs or has employed 20 or more contract laborers on any day during the previous twelve months. The Employer is treated as a single unit without reference to the nature of work that is being executed by the contract labor. The workmen include any person who is employed by a contractor to work in a company or establishment to perform any skilled, semi-skilled or unskilled manual supervisory, technical or clerical work.

For example, if a Company X,an IT company, has executed a contract to provide certain services (say call center or development of certain software) to its client for which Company X requires about 40-50 people to complete the project. The term of the contract is 1 year.  However, Company X already has more than 300 employees and does not want to increase its head counts by engaging 40-50 people for performing the contract. It decides to outsource the entire contract to another service provider whose employees’ will provide the services at the site of Company X while Company X will provide the entire infrastructure required to perform the said services. Such arrangements / contracts come within the purview of the Act. However, people employed in managerial or administrative positions are outside the ambit of the Act as they work on contracts directly executed between them and their employer.

The Act is not applicable if the work performed by a contract labor is of a sporadic nature. It is the Government that decides if the work is of a casual or intermittent nature and its decision regarding the same is final. Basically, any work performed for more than 120 days in a year in a company or establishment is not considered as work of an intermittent nature. Consequently, contract labor is usually engaged by the Employers for performing support services such as security, catering, courier, construction and maintenance, gardening, house keeping, transport etc.

3. Compliances under the Act

The Act requires both the “principal employer” and the contractor to fulfill their respective statutory obligations. Principal employer is the one who employs contract labor through a contractor. “Contractor” in relation to an Employer means a person who – (a) undertakes to perform a job for the Employer through contract labor other than mere supply of goods or articles of manufacture; or (b) supplies contract labor for any work of the Employer & includes a sub-contractor.

In case of a factory, any one of the “owner”, the “occupier” or the “manager” (as per the Factories Act, 1948) is considered a principal employer whereas, in case of a company or establishment, the person who is in control and supervision of such company or establishment is considered to be the principal employer.

As per the Act – (a) the Employer must be registered with the authorities; and (b) the contractor must have a valid license from the authorities prior to engaging contract labor.

In the case of Workmen of Best & Crompton Industries Ltd. v. Best & Crompton Industries Ltd., the Madras High Court held that the principal employer must engage contract labor through a contractor who has a valid license, because an invalid license of a contractor would imply direct employment of contract labor by the principal employer. The license issued by the authorities is job specific, and cannot be transferred for any other job and is indicative of the number of contract laborers a contractor can employ for a given job.

The contractor is responsible for providing all statutory benefits to contract labor and if he fails, the obligation falls on the principal employer.   The Supreme Court in People’s Union for Democratic Rights v. Union of India held that if the contractor fails to fulfill its duties under the Act then the principal employer is under an obligation to provide all amenities and benefits prescribed under the law to contract labor deployed at its establishment. The principal employer must witness disbursement of wages to the contract labor by the contractor (who is essentially the employer of the contract labor). If the principal employer steps in on behalf of the contractor to provide facilities and benefits to the contract labor then such a principal employer is entitled to recover the money spent, from the contractor. Non-compliance with provisions of the Act can lead to imposition of monetary & penal sanctions.

4. Guidelines for Engaging Contract Labor

While engaging contract labor, the Employers must execute contracts with the contractors and such agreements must clearly define the terms of engagement of the contract labor.

The Employer must ensure that it does not appoint one of its own employees’ as a contractor through whom it engages contract labor. In case of a dispute between contract labor and principal employer, the courts may lift the veil to ascertain the intent of the management and/or check genuineness of such an agreement. If the principal employer is employing and controlling the contract labor through its own employee posing as a contractor then the principal employer is, without actually increasing its head count, controlling the contract labor. In the case of Indian Petrochemicals Corporation Limited v. Shramik Sena, the Supreme Court held that such contracts are sham and bogus and are liable to be set aside.

The Supreme Court in Haldia Refinery Canteen Employees Union & Others vs. Indian Oil Corporation Limited laid down certain guidelines for engaging contract labor:

• Principal employer must not interfere with the contractor for engaging contract labor. Contractor must have free hand to engage its employees;

• Wages should be disbursed by the contractor, principal employer must not have any direct role to play except deploy its representative in whose presence salaries are distributed by the contractor to the contract labor (as required under the Act);

• Contractor is liable to pay all statutory benefits such as provident fund contributions, leave salary, medical benefits, and observe statutory working hours for its employees. Principal employer should avoid managing the contract labor;

• Contractor is responsible for proper maintenance of registers, records and accounts for compliance with statutory provisions/obligations;

• Contractor should maintain records of payments of wages etc. and for deposit of provident fund contributions with authorities;

• Contractor is liable to defend/indemnify the principal employer from any liability or penalty which may be imposed by State/Government authorities for any violation by the contractor of such laws, regulations and also against all claims, suits or proceedings that may be brought against the principal employer arising under or incidental to or by reason of the work provided/assigned under the contract brought by the employees of the contractor, third party or Government authorities.

The Supreme Court in the case of Hindalco Industries Ltd. vs. Association of Engineering Workers observed that – (a) the workmen were employed for long years and despite a change of contractors the same workers continued to be employed at the establishment and; (b) there was evidence on record to establish the ultimate control of management on such contract employees. Under such circumstances, the Court would be entitled to pierce the veil and arrive at a finding that the justification relating to appointment of a contractor is sham or nominal and in effect and substance there exists a direct relationship of employer and employee between the principal employer and the workmen.

The principal employer has a right to assess the abilities and skills of the workers employed by the contractor to ensure the quality of service provided under the contract, without actually managing or directing such contract labor. While engaging contract labor, the principal employer must abstain from – (a) controlling their appointment and terms of appointment; (b) controlling them directly or indirectly; (c) taking disciplinary action; (d) supervising their work directly; and (e) dismissing or removing contractor’s employees from service. The principal employer must only exercise a supervisory role to ensure that well qualified & capable people render the required services properly. The principal employer should communicate with the contractor only.

5.         Absorption of Contract Labor

As stated above, the Act empowers the Government to prohibit employment of contract labor in any process, operation or other work in any company or establishment. Once the appropriate Government issues a prohibitory notification banning engagement of contract labor, it will not be possible for an Employer to engage contract labor on that job, process or operation. The Supreme Court in the case of Air India Statutory Corporation v. United Labor Union held the view that if a prohibitory notification has been issued by the Government then contract labor engaged in those prohibited activities would be considered the direct employee of the principal employer and shall acquire a right to automatic absorption into the service of the principal employer.

In a subsequent judgment of Steel Authority of India Limited v. National Union Water Front Workers (“SAIL Judgment”), Supreme Court set aside the Air India judgment. In the SAIL judgment, the Supreme Court held that prohibition notification issued by the Government does not mean automatic absorption of contract labor in a company or establishment. It is essential that the court must consider the terms of a contract to establish if the contract under which the labor is appointed for work is a genuine contract or is a mere ruse/camouflage to evade compliance with the provisions of the Act. If it is found that the contract is a camouflage then contract labor must be treated as an employee of the principal employer who will have to regularize such contract labor. However, if the contract is genuine then the principal employer at its own discretion can employ contract labor as a regular employee by giving them preference over others. But under no circumstances, is the principal employer under any obligation to absorb contract labor on its rolls if employment of contract labor in certain activities is prohibited by the Government authorities.

Consequently, certain ancillary jobs in a company or establishment can be performed by the contract labor engaged through contractors provided the Government has not banned their employment on those jobs and they are given all their statutory benefits. Although contract labor is an effective way for an Employer to have access to additional human resource without increasing its head count, it is pertinent to understand the finer nuances of engaging contract labor and the related law prior to engaging contract labor so as to avoid unwarranted disputes with them.

Sunil Tyagi is a Senior Partner and Namrata Wadhawan a Senior Associate at ZEUS Law Associates. ZEUS is a corporate commercial law firm based in India. One of its areas of specialization is employment law related transactional and litigation work. Sunil and Namrata can be contacted at sunil.tyagi@zeus.firm.in and namrata.wadhawan@zeus.firm.in.

By Sunil Tyagi & Namrata Wadhawan

India is one of the largest medical device markets in Asia. This market is expected to grow at 15% a year for the foreseeable future. A growing middle class has led the government to allocate the equivalent of 5% of annual GDP to expand and improve health care in the country. Despite this, it is expected that the greatest demand for medical devices will come from private hospitals and clinics. Currently, 75% of India’s medical device market consists of imports. This webinar will discuss the nuts and bolts of importing medical devices into India, including tax consequences. Panelists will also cover joint ventures for the manufacture of medical devices in India for both the domestic and export market, clinical investigations and quality standards. Topics will include India’s Drugs and Cosmetics Act and Rules, and their implementation by the Central Drugs Standard Control Organization (CDSCO) as the key medical device regulatory organization in India. Specific attention will be given to structuring transactions, the regulatory framework, as well as proposals for creating a comprehensive framework and single regulatory body specifically for medical devices.

Moderator: Bhalinder L. Rikhye, Peltz & Walker, New York

Speakers:

Amy Hariani, Director and Legal Counsel for the U.S.-India Business Council (USIBC), Washington, D.C. Ms. Hariani manages the Life Sciences and Legal and Professional Services portfolios.

Rohan Shah, Managing Partner Economic Laws Practice (ELP), Mumbai. Mr Shah is well known for his expertise on advisory, policy and controversial issues related to domestic and international taxation in India.

Third speaker to be announced

There will be a 15 minute question and answer period

by

ABA Section of International Law

Your Gateway to International Practice

The development of medical devices has extended the ability of physicians to diagnose and treat diseases, and has made great contributions to health by improving the quality of life of patients. Generally, medical devices would include any instrument, apparatus, machine, appliance, implant, in vitro reagent or calibrator, software, material or other similar or related article. However, in India, the medical devices employed in internal or external use in the diagnosis, treatment, mitigation or prevention of disease or disorder in human beings or animals are considered to be “drugs” as notified by the central government in its official gazette after consultation with the Drugs Technical Advisory Board. Those medical devices not notified as drugs only require an import or manufacturing license and no quality check system exist for them.

Regulatory framework

At the moment, in India there is no single comprehensive specific law regulating medical devices. The import, manufacturing, sale and distribution of medical devices are regulated under the Drugs and Cosmetics Act, 1940 (“India Act”), the Drugs and Cosmetics Rules, 1945 (“Rules”); and the Central Drugs Standard Control Organization (“CDSCO”). The Ministry of Health and Family Welfare (“Ministry”) is the principal regulator. A draft Bill on “Regulation of Medical Devices” (“the Bill”) has been pending since 2006. Once implemented, it will, perhaps, streamline the medical devices sector. Until such time, one has to refer to multifarious regulations.

With effect from March 1, 2006, the Ministry approved a set of procedures follow for the import as well as manufacture of medical devices in India. The Drugs Technical Advisory Board, which provides technical guidance to CDSCO, proposed certain changes in the Rules, which among others provides a categorization of medical devices into four classes. This classification is based on the risk level, intended use and on adverse effect of the devices on the human body based on the potential risks associated with the technical design and manufacture of these devices. The classes of devices are: (i) Class A: Low risk devices and equipment such as thermometers and tongue depressors; (ii) Class B: Low to moderate risk devices including hypodermic needles and suction equipment; (iii) Class C: Moderate to high risk equipment like lung ventilators and bone fixation plates; and (iv) Class D: High risk devices such as heart valves and implantable defibrillators. The regulatory control becomes stringent with each progressive class and the conformity assessments are proportionate to device classification.

Import of medical devices

Presently, the import of medical devices is largely unregulated and medical devices can be freely imported into India. The purchaser (whether it is a government hospital, a private hospital or a doctor) evaluates the quality of the product being purchased. Normally, the U.S. Food and Drug Authority (“FDA”) and the European Conformite Europeenne (“CE”) approved products are preferred because of their better quality and performance. It is necessary to follow the procedures for registering and obtaining a license as laid down under the Rules. Import licenses are conditional and granted for a period of three years. Breach of any of the stipulated conditions may lead to the cancellation of the license.

To be registered in India, the imported device must be approved for sale in the manufacturer’s country of origin. If the device has already received approval from an agency abroad, such as, the U.S. FDA, evidence of such approval must be provided along with a copy of quality standard ISO/EN certification which assesses the quality and risk of the devices manufacturing facility. Medical devices with prior approval from any of the recognized regulatory authorities, like FDA and CE are subjected to an abridged evaluation in India.

If a device is not approved for marketing in the country of origin, the importer has to submit additional evidence such as reports of clinical trials, details of sales, certificates of satisfactory use from medical specialists about the use of the device and details of product complaints, if any. If a device incorporates a medicinal product, which is likely to act upon the body in conjunction with the device, it is pertinent to provide relevant data on the safety, quality, and usefulness of the medicinal substance used along with data on compatibility with medicinal products, clinical data and published articles, if any. 

The manufacturer must also have complied with product standards and home country quality control requirements. The manufacturer of the devices, the importer or his agent must file an application to obtain a registration certificate with respect to the premises where the devices are manufactured and with regard to the devices. The product information and the undertakings with respect to product standards, safety and effectiveness requirements and quality systems in the country of origin are necessary to be furnished. Crucially, a brief description of the device, its intended use and method of use, medicals specialty in which the device is used, the qualitative and quantitative particulars of the constituents, device master file with details of the manufacturing process/flow chart and the component/material used and risk assessment as per ISO 14971 are necessary to be provided. Once a medical device reaches the market in India, the manufacturer has to adhere to requirements of post-marketing surveillance (“PMS”) norms to systematically monitor the performance of the device. PMS involves procedures for maintenance of records, complaint handling, adverse incident reporting and procedures for product recall.

Manufacture of medical devices

The manufacture of medical devices in India requires a license from the government. An application for the license is made with a brief description of the manufacturing process, details of the manufacturing standards and “best practices” \ that will be followed by the company, as well as product evaluation, , standards, and procedures for testing the device. The Rules prescribed in Schedule M-III list mandatory “good manufacturing practices” that manufacturing companies must follow. The law provides that any manufacturing can be done under the direction and supervision of only a whole-time employee of the manufacturer and who is qualified to do so. India has several stringent industrial and labor laws that make the occupier of the manufacturing plant, responsible for any breach in compliance. The occupier is generally the managing director of the company that runs the manufacturing unit or a director on the board of directors and can be fined up to INR 0.2 million or imprisoned up to two years for any non compliance.

As proposed under the Bill, the regulatory authority sets up an expert committee to consider proposals and evaluate medical devices that do not have any benchmark certification. The committee after completing its assessment forwards its opinion regarding suitability of the device to the competent licensing authority which can grant of permission for the device to be launched in the market. The licensing authority after joint inspection and verification forwards the license to Central License Approving Authority (“CLAA “) for approval. The license is finally issued in form 28 of the Rules after due approval of CLAA. The stockist and retail sellers of medical devices are also required to obtain sales licenses from the respective state licensing authorities for medical devices.

Clinical investigations

At present, clinical trial studies are not regulated in India. However, a set of good clinical practices guidelines laid down by the CDSCO govern clinical trials and specify the responsibilities, inter alia, of sponsors, investigators, and ethics committees. In 2010, CDSCO released a guidance document on the requirements for conducting clinical trials of medical devices in India (“Guidance”). It is necessary to file an application with the CDSCO before conducting the study and the application should indicate the precise intent of the application (e.g. whether the application is for a feasibility study or a safety and efficacy study, or a post market study). The entity sponsoring the study must also submit a declaration on its letterhead prescribing the extent of delegation of responsibilities to an individual who is appointed as the Principle Investigator. It is also necessary to provide the global regulatory status of the device (particularly when 5 Global Harmonization Task Force (“GHTF “) countries i.e. U.S.A., Australia, Japan, Canada and European Union are involved) along with detailed technical data.

Though the document is still non-binding, it provides sufficient procedural information regarding the method to all stakeholders.

Medical devices: Quality standards

According to the Guidance, all medical devices sold in this country should carry the ICAC mark (Indian Conformity Assessment Certificate) to indicate their conformity with the provisions of the schedule of the Guidance to enable them to move freely within the country. CLAA adopts and recognizes quality standard BIS 15575 or its revisions and quality standard ISO 13485 in respect of the specifications to be followed for quality for the manufacturer to demonstrate conformity with the relevant regulatory requirements. Any reference to the harmonized standards includes the monographs of the Indian pharmacopoeia and U.S., EU pharmacopoeia wherever applicable, notably on surgical sutures and on combination of pharmaceutical and devices.

It is necessary that the labels on the packaging material for medical devices comply with the relevant ISO standards. It is also necessary to denote internationally accepted symbols regarding sterilization, single use etc, as per ISO 15223-1:2007. When medical devices are sold in bulk the packaging material of individual devices do not have to bear the date of manufacture, which must appear on the bulk packaging material.

In light of the growing usage of medical devices, stringent regulatory standards are essential to ensure that the devices are tested, safe and with minimum adverse reactions. Standards regarding safety, risk elements, effectiveness, efficiency and performance of the medical devices need to be well established. It will be interesting to see how the regulatory scenario changes if and when the Bill is enacted into law. Apart from the Bill, there are different proposals for regulating India’s medical devices sector by different regulatory bodies, like amending the India Act and Rules proposed by the Ministry. The intergovernmental dispute is a cause for concern and confusion for India’s medical devices industry.

Neeraj Dubey is a principal senior associate and commercial lawyer with PSA Legal Counselors. He heads the Food & Pharma and IPR practice areas of his firm. He may be contacted at n.dubey@psalegal.com.

By Neeraj Dubey

India has long been a highly popular destination for visitors from around the globe, and growth in the travel & tourism sector has been steadily increasing. But with all due respect to the heritage attractions of the country, the increase is attributable, in large part, to the increasing attraction of medical tourism. India has built hospitals with cutting edge medical technology, and boasts of physicians educated in the finest medical schools in the world. Medical procedures and hospital admissions cost a fraction of that in the U.S. Information about a patient can be sent in milliseconds from the patient’s home caregiver to the facilities in India, and back again when the procedure has been completed. Doctors on opposite sides of the globe can consult over the Internet or email in real time, sometimes even during surgery.

But what happens to that information in transit and in the offices of the physicians and hospitals?

Medical records are increasingly created, transmitted and stored in electronic formats. Recent media reports of personal data breaches, many from distinguished medical centers such as Stanford and University of California Los Angeles (“UCLA”), can serve to reduce trust in electronic medical record systems and, by extension, the caregivers themselves. This was not such a looming concern in the word of paper records but in the digital age, where information can be stolen, accessed or lost in milliseconds, and where identity theft is a constant shadow, the development of medical tourism may well be linked to the means by which patients’ health information – the most sensitive of personal data – is appropriately safeguarded through laws, and information management practices of India and the U.S.

Given these concerns about the security of their health information, a threshold question may arise as to why people would rush to India, a country in which information protection is still in an evolutionary state, for treatment. One simple reason is that medical treatment package prices in India are 35% to 40% less than the total treatment cost in U.S. or U.K. According to the Indian industry association, Associated Chambers of Commerce and Industry (“ASSOCHAM”), medical tourism industry is a growing sector in India. The medical tourism industry in India, which is currently poised at around Rs. 4,500 crore is likely to be worth Rs. 10,800 crore by 2015. The cost of certain surgical procedures is one-tenth of what it is in the U.S. and Western Europe and sometimes even lesser. According to a survey report conducted by Wockhardt Hospitals, the number of “outsourced patients” has nearly doubled in the last few years. No wonder: one of the patients of Wockhardt has said that his surgery cost him $11,000, a bargain-basement price that was a quarter of what hospitals in North Carolina were quoting. With the debate raging over health care reform, growing numbers of Americans aren’t waiting for Washington: they are, in effect, outsourcing their own medical care to India.

Yet, there are very few studies on the management of patient medical information, between India and the U.S. The absence of an internationally agreed definition of medical tourism, and of a common methodology for data collection, is one of the main reasons for the paucity of such data. It is possible, though, to compare the schemes for protection of the confidentiality and security of medical information in the U.S. and India, and in so doing ascertain potential effects of the distinctions in medical confidentiality on the future growth of Indian medical tourism.

Privacy of Medical Information in the United States

A physician or medical center that sends patient information to caregivers in India must do so in a manner that complies with applicable law, and must safeguard any such information received from India with regard to their patients. Privacy law in the U.S. healthcare system is defined by the basic law for healthcare confidentiality, the Health Information Portability and Accountability Act of 1996 (“HIPAA”). HIPAA is most widely known for its regulations governing medical confidentiality, the HIPAA Privacy Rule and the HIPAA Security Rule. The former comprises of more than 800 pages of standards and requirements that, distilled to their essence, require the caregiver to implement practices to assure that patient-identifiable health information is not disclosed to anyone without authorization of the patient, except for uses of that information that concern treatment, payment or operations of the particular caregiver, and other derogations. In this way, HIPAA greatly resembles the privacy scheme of the European Union in Privacy Directives EC 94/46. The HIPAA Security Rule, which is far shorter, was promulgated to enable privacy in the age of digital medical records. Its standards require physical, technical and administrative (policy and procedure) safeguards for uses, disclosures and storage of electronic medical information. Examples of such safeguards include encryption of patient-identifiable information in storage and transit; access controls, including passwords or biometrics; and due diligence in the selection of business associates who may access that information or to whom it is disclosed. The Privacy and Security Rules are enforced by the Office For Civil Rights of the U.S. Department of Health and Human Services (“DHHS”), which has the authority, after appropriate administrative proceedings, to levy fines of up to $1,000,000 USD per violation. It recently has imposed a number of monetary sanctions, and has begun a program of “spot” (surprise) audits of medical facilities.

HIPAA was supplemented and strengthened in 2009 by the HITECH Act (Health Information Technology for Economic and Clinical Health), which became effective in February, 2010. HITECH sets forth requirements for responses to data breaches, including notification to affected patients. If the breach comprises more than five hundred patients, the entity is required to also notify the media and the Secretary of DHHS. HITECH also gave states attorneys general jurisdictions to bring proceedings for HIPAA violations if DHHS declines to do so. The HITECH Act extends the reach of HIPAA to “Business Associates,” such as law firms, consulting firms and outsourced medical records and billing entities in the U.S. and, significantly, it also provides a basis for liability to healthcare providers if they fail to exercise due diligence in selecting Business Associates who then breach patient confidentiality through data breaches.

HIPAA is a minimum standard for the security and privacy of medical information. U.S. states may impose stricter requirements that HIPAA and many have done so (these include California, Massachusetts, North Carolina and New York, among others).

Medical Information Privacy in India

Protections for medical information in India may be found in the Constitution and two legislative Acts. The key to whether this network of provisions can provide sufficient protection to assure U.S. patients of confidentiality, however, depends upon the rigor of enforcement.

India has a strong network of provisions that cover medical information privacy. Article 21 of Constitution of India, 1950 states that “No person shall be deprived of his life or personal liberty except according to procedure established by law.” The Right to Privacy has been read into this Section, as an integral part of the fundamental right to live life with dignity. Courts in India have held that the Right of Privacy may, apart from contract, also arise out of a particular specific relationship that may be commercial, matrimonial, or even political. A doctor-patient relationship is considered fiduciary in nature, but is also professionally a matter of confidence. Therefore, doctors are morally and ethically bound to maintain confidentiality. In such a situation, public disclosure of even true private facts may amount to an invasion of the Right of Privacy, which may sometimes lead to the clash of one person’s right to be let alone” with another person’s right to be informed.

The Right to Privacy is an essential component of right to life envisaged by Article 21. The right however, is not absolute. It may be lawfully restricted for the prevention of crime, disorder or protection of health or morals or protection of rights and freedom of others, as in the case of Mr. X v. Hospital Z [(1998) 8 SCC 296], wherein the apex court of India held that the hospital owes a ‘duty of care’ to disclose the HIV positive condition of the patient to the person he was likely to be married to. Such disclosure was held to be a ‘reasonable restriction’ on the right to privacy of the patient.

Apart from the essential fundamental right to privacy granted to citizens under the Constitution of India, specific protections have been granted to information relating to medical history, records, biometric information, physical and mental condition etc. under two important enactments, namely, the Indian Medical Council Act, 1956 and the Information Technology Act, 2000 and the rules formulated thereunder, as detailed hereafter.

The Indian Medical Council Act, 1956

Regulations 2.2 and 7.14 framed under the Indian Medical Council Act hold that information about a patient’s ailment cannot be disclosed without patient consent.

Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“Privacy Rules”)

These Rules have been formulated under the Information Technology Act, 2000, and are the first of its kind in relation to data protection and privacy in India.

Rule 3 provides an inclusive definition of ”Sensitive Personal Data or Information.” It states that sensitive personal data or information includes, amongst other things, “(c) Physical, physiological and mental health condition, (d) Sexual orientation, (e) Medical records and History, (f) Biometric information, (g) any details relating to above clauses as provided to body corporate for providing service and (h) any of the information received under above clauses by body corporate for processing, stored or processed under lawful contract or otherwise.”

Rule 6 sets forth that disclosure of sensitive personal data or information by a body corporate to any third party shall require prior permission from the provider of such information, who has provided such information under lawful contract or otherwise, unless such disclosure has been agreed to in the contract between the body corporate and provider of information, or where the disclosure is necessary for compliance of a legal obligation.

Rule 8 requires “Reasonable Security Practices and Procedures” to be maintained by bodies corporate. A body corporate or a person on its behalf shall be considered to have complied with reasonable security practices and procedures, if they have implemented such security practices and standards and have a comprehensive documented information security programme and information security policies that contain managerial, technical, operational and physical security control measures that are commensurate with the information assets being protected with the nature of business. In the event of an information security breach, the body corporate or a person on its behalf shall be required to demonstrate as and when called upon to do so by the agency mandated under the law, that they have implemented security control measures as per their documented information security programme and information security policies. The Rule provides that the International Standard IS/ISO/IEC 27001 on Information Security is one such standard that may be followed by bodies corporate. If a body corporate chooses its own standards of self-regulation, it is required to get its codes of best practices duly approved and notified by the Central Government for effective implementation.

Information Technology Act, 2000 (“IT Act”)

Section 43 A of the IT Act permits “Compensation for failure to protect data.” Where a body corporate is negligent in implementing and maintaining reasonable security practices and procedures regarding sensitive personal data and thereby causes wrongful loss or wrongful gain to any person, it shall be liable to pay damages by way of compensation to the person so effected. However, this must be read with the Privacy Rules, which provide that a body corporate or person on its behalf, who has implemented ‘reasonable security standards and procedures’ as prescribed under Rule 8 above, shall be deemed to have complied with the expected duty of care under the IT Act.

Section 66 E of the IT Act prescribes punishment for violation of privacy”. It states that whoever intentionally or knowingly captures, publishes or transmits the image of a private area of any person without his or her consent, under circumstances violating the privacy of that person shall be punished with imprisonment, which may extend to three years or with fine not exceeding Rs. 2,00,000, or with both.

Section 72 of the Information Technology Act, 2000 lays down the penalty for breach of confidentiality and privacy, as imprisonment for a term which may extend to two years, or fine which may extend to Rs. 1,00,000, or with both.

Section 72 A of the Information Technology Act, 2000 lays down the punishment for disclosure of information in breach of lawful contract, and provides for penalties for intentional unauthorized access to personal information of another.

Although there may have been numerous civil and criminal proceedings initiated against the violators of the IT Act, enforcement of these provisions may still be characterized as “work in progress.” The legislature has created various statutory bodies/courts to try matters related to the IT Act, but it is underutilized. Breaches under the Privacy Rules have not been reported, consequently giving rise to a lack of jurisprudential data on the efficacy of enforcement. Accordingly, patients may take little comfort from the presence of a robust legislative mechanism to enforce the IT Act and Privacy Rules until there is evidence of specific proceedings to enforce the Privacy Rules.

India has various statutes, rules and regulations that govern and regulate the protection of personal data, information, and privacy of individuals, and. the Constitution of India has been read to include a ‘right to privacy’ as a part of the fundamental right to life of individuals,, But it is the enforcement of these laws that will eventually determine whether medical tourism “consumers” will retain sufficient confidence in the privacy of their medical information transmitted between India and the U.S. to fuel the growth of the medical tourism industry.

Kenneth N. Rashbaum, Esq., is Principal of Rashbaum Associates, LLC, in New York (www.rashbaumassociates.com). He focuses his practice on information governance and data protection compliance for multinational corporations and healthcare providers. A counselor, litigator and trial lawyer with over twenty-five years experience in representation of life sciences entities, Ken is an active member of the American Bar Association Section of International Law, and writes and speaks extensively on international data protection and data privacy issues. He can be contacted at krashbaum@rashbaumassociates.com

Sajai Singh is a Partner with J. Sagar Associates (JSA), a full service corporate law firm in India. As a head of the Technology Practice of JSA, he focuses on emerging technologies, business process outsourcing and biotechnology. He also undertakes transactional work with a focus on representing emerging technology companies in areas of inbound investments in India, venture capital investments, joint ventures, strategic alliances, mergers and acquisitions. He can be contacted at sajai@jsalaw.com.

By Kenneth N. Rashbaum and Sajai Singh