Remote monitoring of cardiac implanted electronic devices: legal requirements and ethical principles - ESC Regulatory Affairs Committee/EHRA joint task force report

Abstract

The European Union (EU) General Data Protection Regulation (GDPR) imposes legal responsibilities concerning the collection and processing of personal information from individuals who live in the EU. It has particular implications for the remote monitoring of cardiac implantable electronic devices (CIEDs). This report from a joint Task Force of the European Heart Rhythm Association and the Regulatory Affairs Committee of the European Society of Cardiology (ESC) recommends a common legal interpretation of the GDPR. Manufacturers and hospitals should be designated as joint controllers of the data collected by remote monitoring (depending upon the system architecture) and they should have a mutual contract in place that defines their respective roles; a generic template is proposed. Alternatively, they may be two independent controllers. Self-employed cardiologists also are data controllers. Third-party providers of monitoring platforms may act as data processors. Manufacturers should always collect and process the minimum amount of identifiable data necessary, and wherever feasible have access only to pseudonymized data. Cybersecurity vulnerabilities have been reported concerning the security of transmission of data between a patient’s device and the transceiver, so manufacturers should use secure communication protocols. Patients need to be informed how their remotely monitored data will be handled and used, and their informed consent should be sought before their device is implanted. Review of consent forms in current use revealed great variability in length and content, and sometimes very technical language; therefore, a standard information sheet and generic consent form are proposed. Cardiologists who care for patients with CIEDs that are remotely monitored should be aware of these issues.

The growing field of digital psychiatry: current evidence and the future of apps, social media, chatbots, and virtual reality

“…Taking examples and adopting models from other areas of health care may speed up the process of building appro priate regulatory frameworks. For example, remote monitoring in cardiology is well established and regulated already, with ap propriate reimbursement models in place 220 .…”

Cardiac Society of Australia and New Zealand (CSANZ) Position Statement on the Follow-Up of Cardiovascular Implantable Electronic Devices 2022

“…It is time consuming and requires substantial administrative and technical support from cardiac device physiologists. The expectations and responsibilities of all involved parties must be clearly defined, and patient education is paramount [5][6][7][8]. Both patient and clinic responsibilities should be clearly documented.…”

“…This report draws heavily from accepted practice standards and guidelines of the international electrophysiology bodies [1][2][3][4][5][6][7][8][9][10][11][12][13][14][15][16][17][18]. International recommendations for CIED follow-up are largely based on a consensus that has been developed in tandem with the evolution of CIEDs from simple non-programmable pacemakers (PPMs) to complex devices with a multiplicity of functions and extensive health and technical data storage.…”

Remote Monitoring of CIEDs—For Both Safety, Economy and Convenience?

“…It is important that both the manufacturers of CIEDs and the clinics receiving data from RM have systems that comply with these regulations. The European Society of Cardiology has published a task force report on this subject [ 68 ] and it has also been discussed by others [ 69 ]. In addition to data safety, there are legal and ethical issues regarding the data once they are received by the hospital.…”