When doing an ECG test, the electrodes are much more conductive than dry skin, so the possibility of triggering fibrillation or other arrhythmia from small voltages is present and needs to be taken very seriously. Most pacemaker pulses for implanted pacemakers are from 2mV to 250mV. That's not a whole lot of voltage, and if your device accidentally drives that to the heart, you could be in a great deal of trouble.
Short answer: Read IEC 60601-2-25.
Medium answer: To do it these days, you need to have all your digital signals opto-isolated across a physical isolation boundary, and your power source has to be isolated (i.e. transformers). There are very detailed and strict requirements on what kind of protection those need to be capable of, which involves being able to withstand being zapped with many kiloVolts and not crossing the boundary.
All your amplification and data processing needs to take place upstream of your isolation boundary, with basically nothing but a UART crossing it. In short, you basically have to make a custom PCB to do it properly.
Use something like the TI ADS1298 as an analog front end, which you can communicate to through SPI.