Ethical and Legal Implications of Remote Monitoring of Medical Devices

Abstract

r Millions of life-sustaining implantable devices collect and relay massive amounts of digital health data, increasingly by using user-downloaded smartphone applications to facilitate data relay to clinicians via manufacturer servers. r Our analysis of health privacy laws indicates that most US patients may have little access to their own digital health data in the United States under the Health Insurance Portability and Accountability Act Privacy Rule, whereas the EU General Data Protection Regulation and the California Consumer Privacy Act grant greater access to device-collected data. r Our normative analysis argues for consistently granting patients access to the raw data collected by their implantable devices. Context: Millions of life-sustaining implantable devices collect and relay massive amounts of digital health data, increasingly by using user-downloaded smartphone applications to facilitate data relay to clinicians via manufacturer servers. Whether patients have either legal or normative claims to data collected by these devices, particularly in the raw, granular format beyond that summarized in their medical records, remains incompletely explored. Methods: Using pacemakers and implantable cardioverter-defibrillators (ICDs) as a clinical model, we outline the clinical ecosystem of data collection, relay, retrieval, and documentation. We consider the legal implications of US and

Remote Monitoring of CIEDs—For Both Safety, Economy and Convenience?

“…It is important that both the manufacturers of CIEDs and the clinics receiving data from RM have systems that comply with these regulations. The European Society of Cardiology has published a task force report on this subject [ 68 ] and it has also been discussed by others [ 69 ]. In addition to data safety, there are legal and ethical issues regarding the data once they are received by the hospital.…”

Challenges in the remote monitoring of cardiac implantable electronic devices in 2021

“…European Union (EU) citizens, for example, are granted a greater access to device-collected data by the General Data Protection Regulation (GDPR), compared to US patients, whom rights are granted under the Health Insurance Portability and Accountability Act Privacy Rule [35]. The emerging role of smartphone applications will further modify the situation.…”

What Should Cardiac Patients Know About Device Cybersecurity Prior to Implantation?

“…The risks most familiar to both patients and clinicians are those related to privacy. 2 Data stored and transmitted by CIEDs monitor device function (eg, battery life, wire integrity) and patient status, such as detection of arrhythmias or changes in underlying disease in the case of heart failure. Data transmissions typically occur wirelessly through signals sent (either through radiofrequency telemetry or Bluetooth) from an implanted device to either a home monitor or a patient's smartphone, which then relays data to device manufacturers for storage on large servers.…”

“…9,10,11 Much like other forms of patient data, patient information stored in these devices and transmitted wirelessly is encrypted and subject to privacy provisions of the Health Insurance Portability and Accountability Act (HIPAA). 2 Currently, data that are stored and transmitted by CIEDs are shared only with treating physicians and other health care professionals, patients, regulatory bodies, payers, and researchers in accordance with HIPAA regulations. Preimplantation counseling rarely, if ever, includes a discussion of risks related to privacy, 12 and limited data suggest that patients who consider these risks at all view them as acceptable in light of the clinical benefits of receiving a device for their specific condition.…”

“…1 Devices such as permanent pacemakers, implantable cardioverter-defibrillators, and pulmonary artery pressure monitors for patients with heart failure store patient data and transmit it wirelessly to clinicians. Clinicians who implant these devices have legal and ethical obligations to obtain informed consent after outlining risks and benefits of surgical implantation to patients, 2 and they face policy mandates to engage in formal shared decision making with patients to align device-based therapy with patients' goals. 3 Regulators charged with premarket evaluation of these devices and their postmarket surveillance, particularly the US Food and Drug Administration (FDA), communicate established risks through approved labeling when marketing authority is granted.…”