HR6117-119

1. Short title This Act may be cited as the Patient Device Data Access Act of 2025.

2. Sharing of patient-specific data by device manufacturers Subchapter A of chapter V of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 351 et seq.) is amended by adding at the end the following: The Secretary may require the manufacturer of a covered device, at the request of a patient who is using or has used such covered device, to disclose all patient-specific data that is— recorded or transmitted by such device; and accessible to the manufacturer. Any requirement imposed on manufacturers under subsection (a) shall be by regulation. Any requirement imposed under subsection (a) shall be applicable with respect to all manufacturers of covered devices. In issuing any regulation under paragraph (1), the Secretary shall take into consideration the guidance issued in October 2017 by the Food and Drug Administration titled Manufacturers Sharing Patient-Specific Information from Medical Devices with Patients Upon Request. If the Secretary issues regulations under paragraph (1), the Secretary may include in such regulations provisions requiring the manufacturer of a covered device to do the following: At the request of a patient, disclose patient-specific data referred to in subsection (a), where possible— in a format that is understandable to the patient; and to the extent practicable, in a format preferred by the patient. Publish on the public website of the manufacturer of a covered device— an indication that such device is a covered device subject to regulation under this section; what types of patient-specific data, if any, are— being recorded or transmitted by the covered device; and accessible to the manufacturer; and whether and how the manufacturer utilizes patient data, not including any proprietary information of the manufacturer. Make publicly available, by posting on the manufacturer’s website, the method by which patients who are using or have used the covered device may request their own patient-specific data described in subsection (a). Notify, where possible, patients who are using or have used the covered device about how they can access patient-specific data described in subsection (a). Notify patients if their covered device is subject to a recall, has a software update, or has generated an error message. This section does not authorize the Secretary to require the manufacturer of a covered device— to disclose data that is— recorded, transmitted, and retained in a closed system; and inaccessible to the manufacturer; to redesign the covered device to enable disclosure of patient-specific data; or to disclose patient-specific data that is inaccessible to the manufacturer. In this section: The term covered device means any electronic device that is— intended for use in the diagnosis, cure, mitigation, treatment, or prevention of disease; implanted into a patient’s body; used for the purposes of remote monitoring; and capable of recording or transmitting patient data. The term patient-specific data— means data unique to an individual patient or unique to the patient’s treatment or diagnosis that is recorded or transmitted by a covered device; includes data described in subparagraph (A) irrespective of whether such data, absent regulation under this section, would otherwise be required by law to be disclosed to the patient or their physician; and shall include— information recorded by a covered device regarding usage, alarms, or outputs; and pulse oximetry data, heart electrical activity data, and data on rhythms as monitored by a pace maker. The term inaccessible to the manufacturer means data that is not reasonably accessible. Section 303(f)(1)(A) of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 333(f)(1)(A)) is amended by inserting , including any such requirement under section 524C, after a requirement of this Act which relates to devices. 524C.Sharing of patient-specific data by device manufacturers(a)Requirement authorizedThe Secretary may require the manufacturer of a covered device, at the request of a patient who is using or has used such covered device, to disclose all patient-specific data that is—(1)recorded or transmitted by such device; and(2)accessible to the manufacturer.(b)Regulations(1)IssuanceAny requirement imposed on manufacturers under subsection (a) shall be by regulation.(2)Applicability to all manufacturers of covered devicesAny requirement imposed under subsection (a) shall be applicable with respect to all manufacturers of covered devices.(3)ConsiderationIn issuing any regulation under paragraph (1), the Secretary shall take into consideration the guidance issued in October 2017 by the Food and Drug Administration titled Manufacturers Sharing Patient-Specific Information from Medical Devices with Patients Upon Request.(4)ContentsIf the Secretary issues regulations under paragraph (1), the Secretary may include in such regulations provisions requiring the manufacturer of a covered device to do the following:(A)At the request of a patient, disclose patient-specific data referred to in subsection (a), where possible—(i)in a format that is understandable to the patient; and(ii)to the extent practicable, in a format preferred by the patient.(B)Publish on the public website of the manufacturer of a covered device—(i)an indication that such device is a covered device subject to regulation under this section;(ii)what types of patient-specific data, if any, are—(I)being recorded or transmitted by the covered device; and(II)accessible to the manufacturer; and(iii)whether and how the manufacturer utilizes patient data, not including any proprietary information of the manufacturer.(C)Make publicly available, by posting on the manufacturer’s website, the method by which patients who are using or have used the covered device may request their own patient-specific data described in subsection (a).(D)Notify, where possible, patients who are using or have used the covered device about how they can access patient-specific data described in subsection (a).(E)Notify patients if their covered device is subject to a recall, has a software update, or has generated an error message.(c)ExceptionsThis section does not authorize the Secretary to require the manufacturer of a covered device—(1)to disclose data that is—(A)recorded, transmitted, and retained in a closed system; and(B)inaccessible to the manufacturer;(2)to redesign the covered device to enable disclosure of patient-specific data; or(3)to disclose patient-specific data that is inaccessible to the manufacturer.(d)DefinitionsIn this section:(1)The term covered device means any electronic device that is—(A)intended for use in the diagnosis, cure, mitigation, treatment, or prevention of disease;(B)implanted into a patient’s body;(C)used for the purposes of remote monitoring; and(D)capable of recording or transmitting patient data.(2)The term patient-specific data—(A)means data unique to an individual patient or unique to the patient’s treatment or diagnosis that is recorded or transmitted by a covered device;(B)includes data described in subparagraph (A) irrespective of whether such data, absent regulation under this section, would otherwise be required by law to be disclosed to the patient or their physician; and(C)shall include—(i)information recorded by a covered device regarding usage, alarms, or outputs; and(ii)pulse oximetry data, heart electrical activity data, and data on rhythms as monitored by a pace maker.(3)The term inaccessible to the manufacturer means data that is not reasonably accessible..

524C. Sharing of patient-specific data by device manufacturers The Secretary may require the manufacturer of a covered device, at the request of a patient who is using or has used such covered device, to disclose all patient-specific data that is— recorded or transmitted by such device; and accessible to the manufacturer. Any requirement imposed on manufacturers under subsection (a) shall be by regulation. Any requirement imposed under subsection (a) shall be applicable with respect to all manufacturers of covered devices. In issuing any regulation under paragraph (1), the Secretary shall take into consideration the guidance issued in October 2017 by the Food and Drug Administration titled Manufacturers Sharing Patient-Specific Information from Medical Devices with Patients Upon Request. If the Secretary issues regulations under paragraph (1), the Secretary may include in such regulations provisions requiring the manufacturer of a covered device to do the following: At the request of a patient, disclose patient-specific data referred to in subsection (a), where possible— in a format that is understandable to the patient; and to the extent practicable, in a format preferred by the patient. Publish on the public website of the manufacturer of a covered device— an indication that such device is a covered device subject to regulation under this section; what types of patient-specific data, if any, are— being recorded or transmitted by the covered device; and accessible to the manufacturer; and whether and how the manufacturer utilizes patient data, not including any proprietary information of the manufacturer. Make publicly available, by posting on the manufacturer’s website, the method by which patients who are using or have used the covered device may request their own patient-specific data described in subsection (a). Notify, where possible, patients who are using or have used the covered device about how they can access patient-specific data described in subsection (a). Notify patients if their covered device is subject to a recall, has a software update, or has generated an error message. This section does not authorize the Secretary to require the manufacturer of a covered device— to disclose data that is— recorded, transmitted, and retained in a closed system; and inaccessible to the manufacturer; to redesign the covered device to enable disclosure of patient-specific data; or to disclose patient-specific data that is inaccessible to the manufacturer. In this section: The term covered device means any electronic device that is— intended for use in the diagnosis, cure, mitigation, treatment, or prevention of disease; implanted into a patient’s body; used for the purposes of remote monitoring; and capable of recording or transmitting patient data. The term patient-specific data— means data unique to an individual patient or unique to the patient’s treatment or diagnosis that is recorded or transmitted by a covered device; includes data described in subparagraph (A) irrespective of whether such data, absent regulation under this section, would otherwise be required by law to be disclosed to the patient or their physician; and shall include— information recorded by a covered device regarding usage, alarms, or outputs; and pulse oximetry data, heart electrical activity data, and data on rhythms as monitored by a pace maker. The term inaccessible to the manufacturer means data that is not reasonably accessible.