The document clarifies that medical device manufacturers may share patient-specific data from a medical device with the patient using that specific device, and provides guidance on how to ensure the appropriate and responsible dissemination of such information.

The document, “Dissemination of Patient-Specific Information From Devices by Device Manufacturers,” clarifies that the privacy protection provisions put in place under the Health Insurance Portability and Accountability Act (HIPAA) don’t apply to manufacturers that wish to share medical device data with a patient being treated or diagnosed with that specific device. Further, medical device manufacturers may share such information without obtaining additional premarket review. However, the guidance specifies that any labeling provided to the patient by the manufacturer is subject to applicable requirements in the FD&C Act and FDA regulations.

The draft guidance defines patient-specific information as “any information unique to an individual patient or unique to that patient’s treatment or diagnosis that, consistent with the intended use of a medical device, may be recorded, stored, processed, retrieved, and/or derived from that medical device.”

The guidance states that generally, categories for patient-specific information may include but are not limited to:

  • Data a health care provider inputs to record the status and ongoing treatment of an individual patient.
  • Information stored by the device to record usage, alarms or outputs (e.g., pulse oximetry data, heart electrical activity and rhythms as monitored by a pacemaker).
  • Patient-specific case logs entered into a medical device by a health care provider.

Since the information may be used to facilitate continuity of care, the FDA recommends that manufacturers ensure the information provided is interpretable and useful, and that they include relevant context to avoid any misinterpretation of the data by the patient.

Manufacturers should also include information on whom to contact for follow-up information, and advise patients to contact their health care providers should they have any follow-up questions related to their patient-specific information.