GDPR and Medical Devices

• The right to be informed of the type of processing of their data that will be taking place
• The right to access and review the data that is being used to make decisions on the data subject
• The right to be forgotten once the service provided is completed
• The right to data portability, where the service provider must provide the data subject their data in electronic format

These rights have many specific processing requirements built around them and the relevant Supervisory Authorities, those organizations that enforce GDPR, will have opinions on how these rights should be applied.

That said, GDPR is not much different, functionally, from HIPAA. If a medical device was created with a strong HIPAA understanding, making the device GDPR compliant may not be as burdensome as it initially seems. Still, GDPR imposes a software development burden on medical devices, from communications and storage to processing and data collection, as well as consent, and devices that have yet to be updated likely need revision in order to become GDPR compliant.