Ethical and Legal Implications of Remote Monitoring of Medical Devices
Open accessAbstract
Policy Points: Millions of life‐sustaining implantable devices collect and relay massive amounts of digital health data, increasingly by using user‐downloaded smartphone applications to facilitate data relay to clinicians via manufacturer servers. Our analysis of health privacy laws indicates that most US patients may have little access to their own digital health data in the United States under the Health Insurance Portability and Accountability Act Privacy Rule, whereas the EU General Data Protection Regulation and the California Consumer Privacy Act grant greater access to device‐collected data. Our normative analysis argues for consistently granting patients access to the raw data collected by their implantable devices. Context: Millions of life‐sustaining implantable devices collect and relay massive amounts of digital health data, increasingly by using user‐downloaded smartphone applications to facilitate data relay to clinicians via manufacturer servers. Whether patients have either legal or normative claims to data collected by these devices, particularly in the raw, granular format beyond that summarized in their medical records, remains incompletely explored. Methods: Using pacemakers and implantable cardioverter‐defibrillators (ICDs) as a clinical model, we outline the clinical ecosystem of data collection, relay, retrieval, and documentation. We consider the legal implications of US and European privacy regulations for patient access to either summary or raw device data. Lastly, we evaluate ethical arguments for or against providing patients access to data beyond the summaries presented in medical records. Findings: Our analysis of applicable health privacy laws indicates that US patients may have little access to their raw data collected and held by device manufacturers in the United States under the Health Insurance Portability and Accountability Act Privacy Rule, whereas the EU General Data Protection Regulation (GDPR) grants greater access to device‐collected data when the processing of personal data falls under the GDPR's territorial scope. The California Consumer Privacy Act, the “little sister” of the GDPR, also grants greater rights to California residents. By contrast, our normative analysis argues for consistently granting patients access to the raw data collected by their implantable devices. Smartphone applications are increasingly involved in the collection, relay, retrieval, and documentation of these data. Therefore, we argue that smartphone user agreements are an emerging but potentially underutilized opportunity for clarifying both legal and ethical claims for device‐derived data. Conclusions: Current health privacy legislation incompletely supports patients’ normative claims for access to digital health data.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The HIPAA Privacy Rule emphasizes the principle of using only the minimum necessary information for a given purpose.
“The rule emphasizes the principle of using only the minimum necessary information for a given purpose, and it addresses incidental uses and disclosures.”
From Ethical Framework for Harnessing the Power of AI in Healthcare and Beyond (2024) · cites this paper as [157]
HIPAA Privacy Rule §164.514 establishes guidelines for the handling of PHI in the US healthcare system.
“HIPAA's Privacy Rule §164.514establishes guidelines for the handling of PHI in the US healthcare system.”
From Ethical Framework for Harnessing the Power of AI in Healthcare and Beyond (2024) · cites this paper as [157]
Individuals have the right to access their PHI, request amendments, and receive an accounting of disclosures.
“Individuals have the right to access their PHI, request amendments, and receive an accounting of disclosures.”
From Ethical Framework for Harnessing the Power of AI in Healthcare and Beyond (2024) · cites this paper as [157]
The exceptions to HIPAA's prohibition on using or disclosing PHI include treatment, payment, healthcare operations, public health activities, and law enforcement purposes.
“These exceptions include treatment, payment, healthcare operations, public health activities, and law enforcement purposes.”
From Ethical Framework for Harnessing the Power of AI in Healthcare and Beyond (2024) · cites this paper as [157]
Covered entities are generally prohibited from using or disclosing PHI without individual authorization, except in specific cases outlined by the rule.
“Covered entities are generally prohibited from using or disclosing PHI without individual authorization, except in specific cases outlined by the rule.”
From Ethical Framework for Harnessing the Power of AI in Healthcare and Beyond (2024) · cites this paper as [157]
Covered entities must have contracts with their business associates who handle PHI on their behalf.
“Covered entities must have contracts with their business associates, who handle PHI on their behalf.”
From Ethical Framework for Harnessing the Power of AI in Healthcare and Beyond (2024) · cites this paper as [157]
Research use of PHI is allowed under certain conditions, with safeguards such as Institutional Review Board (IRB) approval.
“Research use of PHI is allowed under certain conditions, with safeguards such as Institutional Review Board (IRB) approval.”
From Ethical Framework for Harnessing the Power of AI in Healthcare and Beyond (2024) · cites this paper as [157]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Privacy in the age of medical big data
Price, W. N., & Cohen, I. G. (2019) · Nature Medicine · doi:10.1038/s41591-018-0272-7 · Cited by 1,522 · see citing works
Self-citationHindricks, G., Táborský, M., Glikson, M., Heinrich, U., Schumacher, B., Katz, A., Brachmann, J., Lewalter, T., Goette, A., Block, M. S., et al. (2014) · The Lancet · doi:10.1016/s0140-6736(14)61176-4 · Cited by 742 · see citing works
Slotwiner, D. J., Varma, N., Akar, J. G., Annas, G. J., Beardsall, M., Fogel, R. I., Galizio, N. O., Glotzer, T. V., Leahy, R. A., Love, C. J., et al. (2015) · Heart Rhythm · doi:10.1016/j.hrthm.2015.05.008 · Cited by 533 · see citing works
Huckvale, K., Torous, J., & Larsen, M. E. (2019) · JAMA Network Open · doi:10.1001/jamanetworkopen.2019.2542 · Cited by 312 · see citing works
The Creative Destruction of Medicine: How the Digital Revolution Will Create Better Health Care
Topol, E. J. (2011) · Thammasat University Digital Collections · Cited by 307 · see citing works
HIPAA and protecting health information in the 21st century
Cohen, I. G., & Mello, M. M. (2018) · JAMA · doi:10.1001/jama.2018.5630 · Cited by 273 · see citing works
Self-citationCreative Destruction of Medicine: How the Digital Revolution Will Create Better Health Care
Kim, J. A. (2013) · Healthcare Informatics Research · doi:10.4258/hir.2013.19.3.229 · Cited by 250 · see citing works
Engaging patients through open notes: an evaluation using mixed methods
Esch, T., Mejilla, R., Anselmo, M. K., Podtschaske, B. V., Delbanco, T., & Walker, J. (2016) · BMJ Open · doi:10.1136/bmjopen-2015-010034 · Cited by 155 · see citing works
Big Data, Big Tech, and Protecting Patient Privacy
Cohen, I. G., & Mello, M. M. (2019) · JAMA · doi:10.1001/jama.2019.11365 · Cited by 135 · see citing works
Self-citationPASSMAN, R., LEONG‐SIT, P., ANDREI, A., HUSKIN, A., TOMSON, T. T., BERNSTEIN, R., ELLIS, E., WAKS, J. W., & ZIMETBAUM, P. (2016) · Journal of Cardiovascular Electrophysiology · doi:10.1111/jce.12864 · Cited by 115 · see citing works
Kramer, D. B., Mitchell, S. L., Monteiro, J., et al. (2015) · Journal of the American Heart Association · doi:10.1161/jaha.115.001775 · Cited by 62 · see citing works
Self-citationWaks, J. W., PASSMAN, R. S., Matos, J. D., Reynolds, M. W., Thosani, A. J., Mela, T., Pederson, D. N., Glotzer, T. V., & ZIMETBAUM, P. J. (2018) · Heart Rhythm · doi:10.1016/j.hrthm.2018.06.027 · Cited by 58 · see citing works
Ethical and legal issues of ingestible electronic sensors
Gerke, S., Minssen, T., Yu, H., & Cohen, I. G. (2019) · Nature Electronics · doi:10.1038/s41928-019-0290-6 · Cited by 56 · see citing works
Self-citationCybersecurity Concerns and Medical Devices
Kramer, D. B., & Fu, K. (2017) · JAMA · doi:10.1001/jama.2017.15692 · Cited by 55 · see citing works
Self-citationRemote monitoring of cardiac implantable electronic devices (CIED)
Zeitler, E. P., & Piccini, J. P. (2016) · Trends in Cardiovascular Medicine · doi:10.1016/j.tcm.2016.03.012 · Cited by 46 · see citing works
Frailty, Physical Activity, and Mobility in Patients With Cardiac Implantable Electrical Devices
Kramer, D. B., Tsai, T., Natarajan, P. P., Tewksbury, E., Mitchell, S. L., & Travison, T. G. (2017) · Journal of the American Heart Association · doi:10.1161/jaha.116.004659 · Cited by 40 · see citing works
Self-citationOptimizing Implantable Cardioverter-Defibrillator Remote Monitoring
Ploux, S., Varma, N., Strik, M., Lazarus, A., & Bordachar, P. (2017) · JACC. Clinical electrophysiology · doi:10.1016/j.jacep.2017.02.007 · Cited by 39 · see citing works
Hsu, J. C., Saxon, L. A., Jones, P. W., Wehrenberg, S., & Marcus, G. M. (2015) · Heart Rhythm · doi:10.1016/j.hrthm.2015.04.030 · Cited by 28 · see citing works
Hsu, J. C., Birnie, D. H., Stadler, R. W., Cerkvenik, J., Feld, G. K., & Birgersdotter-Green, U. M. (2019) · Heart Rhythm · doi:10.1016/j.hrthm.2019.05.012 · Cited by 28 · see citing works
Kramer, D. B., Jones, P. W., Rogers, T. B., Mitchell, S. L., & Reynolds, M. R. (2016) · EP Europace · doi:10.1093/europace/euw267 · Cited by 20 · see citing works
Self-citationSteinhaus, D. A., Waks, J. W., Collins, R., et al. (2015) · The American Journal of Cardiology · doi:10.1016/j.amjcard.2015.03.047 · Cited by 10 · see citing works
Aripiprazole with digital ingestion tracking (Abilify MyCite).
(2019) · PubMed · Cited by 3 · see citing works
Flagged first, then by citations
Research works printed but not linked: 2
- [20]20. US Food and Drug Administration . Manufacturers Sharing Patient‐Specific Information from Medical Devices Upon Request: Guidance for Industry and Food and Drug Administration Staff. Silver Spring, MD: US Food and Drug Administration; 2017. https://www.fda.gov/media/98519/download. Accessed August 30, 2019. [Google Scholar]
- [22]22. US Department of Health and Human Services . OCR Privacy Brief: Summary of the HIPAA Privacy Rule. Washington, DC: US Department of Health and Human Services; 2003. https://www.hhs.gov/sites/default/files/privacysummary.pdf. Accessed November 29, 2019. [Google Scholar]
Cited by
Sorted by citations
Ethical Framework for Harnessing the Power of AI in Healthcare and Beyond
Nasir, S., Khan, R. A., & Bai, S. (2024) · IEEE Access · doi:10.1109/access.2024.3369912 · Cited by 152 · see citing works
- Authors
- COHEN, I. G., GERKE, S., & KRAMER, D. B.
- Affiliations
- Harvard University (US)
- Beth Israel Deaconess Medical Center (US)
- Corresponding author
- KRAMER, DANIEL B.
- Venue
- The Milbank Quarterly
- Publisher
- Wiley
- Published
- 2020-10-20
- Volume
- 98
- Issue
- 4
- Pages
- 1257-1289
- ISSN
- 0887-378X (ISSN-L)
- 1468-0009
- PMC
- PMC7772635
- OpenAlex
- W3092837942
- Cited by
- 65
- References
- 22
- Citations by year
- 2026: 8 · 2025: 20 · 2024: 15 · 2023: 11 · 2022: 6 · 2021: 5
- FWCI
- 5.18
- Type
- journal article
- Language
- en
- Open access
- green
- www.ncbi.nlm.nih.gov
- Locations
- Milbank Quarterly (publishedVersion)
- PubMed Central (publishedVersion)
- PubMed (publishedVersion)
- bepress Legal Repository (submittedVersion)
- eYLS (Yale Law School) (submittedVersion)
- Funders
- Novo Nordisk Fonden (NNF17SA0027784)
- Topics
- Physical Sciences › Computer Science › Information Systems › Thoreau and American Literature
- Social Sciences › Law › Digitalization, Law, and Regulation
- Health Sciences › Medicine › Public Health, Environmental and Occupational Health › Medical and Health Sciences Research
- Keywords
- remote monitoring, biomedical implants, cardiac pacemaker, implantable cardioverter-defibrillator, digital health data, patient data access, General Data Protection Regulation, California Consumer Privacy Act, mobile application, user agreements, data ownership, medical ethics
- MeSH terms
- Ethics, Medical, Europe, Humans, Pacemaker, Artificial, United States, Health Insurance Portability and Accountability Act, Patient Rights, Electronic Health Records
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
