Medical device manufacturers regarding GDPR

The Data Protection Regulations (GDPR) of the European Union unifies and amends the data protection laws between the member states. One of the industries heavily affected by these regulations is the medical device industry. Medical device manufacturers handle vast amounts of sensitive data that must be protected while ensuring that the devices operate efficiently. This article will outline the most critical issues for medical device manufacturers regarding GDPR.

The European Union's General Data Protection Regulation (GDPR) took effect on May 25, 2018. This new legal framework unifies and standardizes data protection laws across the member states. The medical device industry is one of the industries highly impacted by these regulations. Manufacturers of medical devices handle vast amounts of sensitive data that need to be protected while still ensuring that the devices function effectively. This essay will outline the most critical issues for manufacturers of medical devices regarding the GDPR.

The GDPR and the MDR are two regulations that serve different purposes. Still, the commonality between the two is in the part that refers to protecting private/personal information. According to the GDPR, personal data must be collected and processed fairly and transparently. The GDPR defines personal data as any information that can be used to identify an individual. On the other hand, the MDR ensures that medical devices are safe and effective for patients. The MDR requires medical device manufacturers to collect clinical data to demonstrate safety and efficacy.

Under the MDR, manufacturers must collect clinical data for their medical devices. This data often includes personal data such as patient information covered under the GDPR. Therefore, medical equipment companies must comply with GDPR and MDR regulations when collecting and processing personal data.

Medical device manufacturers must ensure they comply with the GDPR and the MDR. This means that they must collect and process personal information per European regulations and act transparently toward the subjects of the information and the relevant stakeholders. It also means they must ensure that any personal information they collect is protected from unauthorized access, loss, or damage.

As medical device manufacturers collect clinical data to demonstrate safety and efficacy, they must ensure that they collect data in a way that protects people's privacy and rights. Medical device manufacturers must have a data protection policy that describes how data is collected, stored, and accessed and the steps taken to protect that data.

The introduction of the MDR has raised concerns about how the GDPR fits into this new regulatory framework. However, both regulations deal with data protection, and medical device manufacturers must comply. Medical device companies must ensure a clear policy to comply with the GDPR, outlining how they will collect, store and access personal data while protecting it from unauthorized access, loss, or damage. By having a personal data protection policy, medical equipment manufacturers can prove their commitment to protecting the private data of the data subjects (including medical staff, users, patients, etc.).

The reference between the MDR and the GDPR is detailed in the Medical Device Regulation (MDR) in Part 110 (EU 2017/745, Article 110). The MDR refers to regulation 45/2001, known as GDPR (refer to the link to GDPR), to avoid duplication between rules.

Beyond that, there is a reference in the European regulation of medical equipment, although seemingly marginal. Also, part 109, which refers to maintaining confidentiality, refers to personal information and directs the manufacturer to part 110 for reference as part of the regulatory requirements. This is enough, to sum up the regulation's connection to the issue of privacy protection.

Below are the five points that coordinate the GDPR reference regarding medical equipment manufacturers:

First and foremost, manufacturers of medical devices must ensure that the handling of personal data associated with the devices complies with the GDPR. Personal data includes any information that can identify an individual, such as name, address, email, and health information. This can consist of patient health and medical history data in a medical device context. Therefore, manufacturers must ensure that they have defined their data processing activities and identified any potential risks and vulnerabilities associated with this data.

Secondly, GDPR demands that medical device manufacturers ensure that data collected from the devices are processed legally, fairly, and transparently. This includes informing patients about the managed data types, their use, and who can access it. Manufacturers and healthcare providers must obtain informed consent from individuals before collecting, using, and sharing any personal data associated with medical devices.

Thirdly, the GDPR also mandates that medical device manufacturers design and build data protection by default into medical devices. This means that data protection measures must be incorporated into the design of the medical device, considering the risks and vulnerabilities of the specific data collected and processed. Using privacy and security by design practices can significantly help implement these data protection measures.

Fourthly, manufacturers of medical devices must ensure that they have appropriate measures in place to mitigate any security breaches effectively. In case of a violation, the manufacturer must promptly report it to the regulatory agencies and notify affected individuals. Medical device manufacturers must have breach notification procedures that are efficient and effective in protecting personal data.

Lastly, the GDPR requires medical device manufacturers to appoint a Data Protection Officer (DPO) to oversee the risks associated with collecting and processing personal data. The DPO ensures that the company complies with GDPR and provides a point of contact for individuals to raise concerns about data processing activities.

Therefore, it is essential to understand that compliance with the European regulation 2017/745 alone does not release the manufacturer from the obligation to protect the personal information of data subjects, nor does it remove it from acting according to the regulation intended for this purpose (GDPR).

In conclusion, the GDPR has significant implications for medical device manufacturers, including the requirement to ensure that personal data is collected and processed under the manufacturer's and with the option of controlling it.