H.R. 6117: Patient Device Data Access Act of 2025

The Patient Device Data Access Act of 2025 is a legislative proposal that aims to enhance patients' access to personal data recorded or transmitted by certain medical devices. Here are the key points of the bill:

Data Access Requirement

The bill allows patients to request access to all personal data that is recorded or transmitted by a medical device they are using, which is also available to the manufacturer of that device. This includes:

• Data that is actively recorded by the device.
• Data that has been transmitted for analysis or storage by the manufacturer.

Regulatory Oversight

The Secretary (of Health and Human Services) is authorized to impose regulations that enforce this data-sharing requirement. The regulations will ensure:

• All manufacturers of covered devices are treated equally.
• Patient-specific data is disclosed in a manner that is understandable and preferably in a format that the patient requests, when possible.
• Manufacturers inform patients whether the device is subject to recall, has a software update, or has generated an error message.

Manufacturer Responsibilities

Manufacturers of covered devices will have to:

• Make notifications publicly available on their websites regarding the types of patient-specific data recorded or transmitted by the device.
• Provide clear instructions on how patients can request access to their data.
• Alert patients about how they can access their data and any relevant updates affecting their device.

Covered Devices Definition

The term "covered device" refers to any electronic medical device that:

• Is used for diagnosis, treatment, or prevention of diseases.
• Can be implanted in the body.
• Is used for remote health monitoring.
• Records or transmits patient data.

Exemptions

The bill does not require manufacturers to disclose data that:

• Is recorded and retained in a closed system that the manufacturer cannot access.
• Requires manufacturers to redesign their devices to enable data disclosure.
• Is otherwise inaccessible to the manufacturer.

Civil Penalties

The bill also includes provisions for civil penalties on manufacturers that fail to meet the data disclosure requirements outlined in the act.

Relevant Companies

• MDT - Medtronic, a medical device company that manufactures various devices including heart devices which may need to comply with this act's disclosure requirements.
• ABBV - AbbVie, which may be affected through its medical devices that monitor patient-specific data.
• ISRG - Intuitive Surgical, known for surgical robots that could be impacted by increased patient access to data.