Medical Device Privacy, Cybersecurity & Regulatory Counsel
Attorney-led privacy, cybersecurity, and data protection counsel for manufacturers of connected devices, instruments, remote monitoring systems, and companion apps. We build privacy and security into your design controls and quality system so they hold up in an FDA premarket review, an inspection, a notified body audit, a supervisory authority inquiry, and a hospital security review.
Privacy counsel who speaks design controls
Most privacy advice is written for websites and HR systems. A medical device is different. Data is generated by hardware in a patient’s body or home, relayed through a bedside monitor or a smartphone, stored on a multi-region cloud platform, reviewed by clinicians, serviced by field engineers, and reused by R&D. Each hop carries its own legal obligations, and those obligations differ by country.
The same connections that make the device useful make it a cybersecurity target, and cybersecurity is now a regulatory gate in its own right. A vulnerability can trigger FDA, EU, breach notification, securities, and contractual obligations at once, each on its own clock.
Joshua Carlson has spent 15 years working inside that architecture with product security, regulatory, quality, clinical, and engineering teams. We translate legal requirements into design inputs, risk controls, and verifiable documentation, so privacy and security become part of the design history file rather than a late-stage legal review.
Device privacy services
Available as fixed-fee projects, as part of a monthly fractional privacy officer plan, or embedded with your product team for a program or launch.
Privacy by Design in the QMS
- Privacy requirements as design inputs and verification criteria
- Privacy risk integrated with ISO 14971 risk files and security risk management
- SOPs, work instructions, and templates aligned to the FDA QMSR and ISO 13485
- Supplier controls and privacy terms for critical suppliers
PIAs & DPIAs
- GDPR Article 35 DPIAs for devices, platforms, and studies
- Privacy impact assessments for new products, releases, and design changes
- Transfer impact assessments for cross-border data flows
- Regulator-ready documentation that maps to your risk file
Device & Instrument Privacy
- Implantables, wearables, capital equipment, and lab and diagnostic instruments
- Device identifiers, serial numbers, logs, and service data
- Programmer and instrument data retention, export, and decommissioning
- Field service and remote support access controls
Remote Monitoring & Connected Care
- Home monitors, gateways, and clinician portals
- Controller and processor, or covered entity and business associate, role analysis
- Multi-region hosting, data residency, and access by global support teams
- Clinic onboarding terms and data processing agreements
Mobile Apps & Patient Companion Apps
- App privacy notices, permissions, and store disclosures
- SDK and analytics review, device identifiers, and tracking technologies
- Caregiver, minor, and proxy account design
- Software as a medical device (SaMD) and wellness-app boundary issues
Emergency Alerts & Clinical Notifications
- Alert routing to patients, caregivers, clinics, and third-party responders
- Notification consent and preference design
- Minimum necessary content in push, SMS, and email alerts
- Legal basis for disclosures in urgent and vital-interest scenarios
AI-Enabled Devices & Algorithms
- Training data rights, provenance, and legal basis
- EU AI Act classification and its interaction with the MDR and IVDR
- Automated decision and transparency obligations
- AI vendor and model-hosting agreements
Device Data & Secondary Uses
- Data classification: PHI, personal data, special category data, and non-personal device data
- Secondary use for R&D, product improvement, real-world evidence, and AI training
- De-identification, pseudonymization, and anonymization strategy
- Purpose limitation and compatibility analysis
Data Aggregator & Data Licensing Agreements
- Inbound and outbound data licenses and data sharing agreements
- Integration partner, EHR, and data platform agreements
- Restrictions on re-identification and onward transfer
- Data broker registration and state health data law exposure
Clickwrap, EULAs & Patient-Facing Terms
- Enforceable clickwrap and in-app assent flows
- End user license agreements for apps, portals, and instrument software
- Consent capture and records that survive challenge
- Plain-language terms for patients and clinicians
EU & International
- GDPR, including Articles 9, 25, 28, and 35
- Standard Contractual Clauses and the EU-U.S. Data Privacy Framework
- EU Data Act connected-product data obligations
- China PIPL cross-border transfer analysis and coordination with local counsel
U.S. PII & Health Data
- HIPAA role analysis and business associate agreements
- FTC Act Section 5 and the FTC Health Breach Notification Rule
- Washington My Health My Data Act and other consumer health data laws
- Comprehensive state privacy laws and their health data provisions
Post-Market Privacy Events
- Privacy and security impact review for field corrective actions
- Complaint handling and CAPA inputs for privacy events
- Breach assessment and multi-jurisdiction notification
- Patient, clinic, and customer communications
Not all device data is PHI, and not all of it is unregulated
The most common and most expensive mistake we see is a single privacy label applied to every data element a device produces. The right answer turns on what the data is, who holds it, why, and where. A practical starting map:
| Data category | Questions we work through |
|---|---|
| Device identifiers and serial numbers | Is the identifier linkable to a patient in your systems or a clinic’s? If so, it is likely personal data under the GDPR, and may be PHI when held for or on behalf of a covered entity. |
| Telemetry, logs, and diagnostics | Is it needed for safety, cybersecurity, and post-market surveillance? Can those purposes be documented as a legal basis without relying on consent? |
| Physiological and therapy data | Health data and special category data under GDPR Article 9. Which Article 9(2) condition applies, and does it change by country? |
| Patient and caregiver account data | Who is the controller for app accounts? Does a consumer health data law apply even where HIPAA does not? |
| Clinician and HCP data | Portal credentials, usage analytics, and audit logs are personal data too, often overlooked in DPIAs. |
| Aggregated and de-identified data | Does it meet HIPAA de-identification standards, the GDPR anonymization threshold, or only pseudonymization? Do your contracts permit the intended use? |
Classification depends on the specific facts, architecture, and contracts involved. This table is a general framework, not legal advice for any particular product.
Cybersecurity is a regulatory trigger, not just an engineering task
Under Section 524B of the Federal Food, Drug, and Cosmetic Act, a premarket submission for a cyber device must address cybersecurity, and FDA may refuse to accept a submission that does not. After launch, a single vulnerability or incident can start several legal clocks at once. We work with your product security team so the engineering record, the regulatory filings, the customer contracts, and the incident decisions all tell the same story.
Premarket & Section 524B
- Cyber device determinations and submission strategy
- Postmarket vulnerability monitoring and disclosure plans
- Review of cybersecurity documentation against FDA premarket guidance
- Response strategy for FDA cybersecurity deficiency letters
Security Risk Management
- Legal review of threat models and security risk assessments
- Alignment of security and safety risk under ISO 14971 and AAMI TIR57
- Privileged structuring of penetration tests and assessments, where appropriate
- Security controls as design inputs in the QMS
SBOM & Third-Party Components
- Software bill of materials programs and disclosure terms
- Open-source and off-the-shelf software license and support obligations
- Supplier security requirements and vulnerability notice clauses
- End-of-support and legacy device planning
Vulnerability Response & Disclosure
- Coordinated vulnerability disclosure policies and researcher engagement
- Controlled versus uncontrolled risk analysis and documentation
- Correction and removal reporting analysis under 21 CFR Part 806
- Security advisories and customer notifications
EU Cybersecurity Requirements
- MDR and IVDR Annex I IT security requirements and MDCG 2019-16
- NIS2 scope analysis, governance, and incident reporting
- Cyber Resilience Act analysis for connected products and software outside the MDR and IVDR
- Alignment of security evidence across notified body and authority reviews
Hospital & Customer Security Contracts
- Security questionnaires, MDS2 forms, and customer representations
- Security addenda, patching commitments, and support lifecycles
- Liability, indemnity, and insurance allocation for cyber events
- Remote access and service connectivity terms
When a cybersecurity event becomes a legal event
| Trigger | Obligations it can set in motion |
|---|---|
| New or modified cyber device submission | Section 524B content, including a plan to monitor, identify, and address postmarket vulnerabilities, processes that provide reasonable assurance of cybersecurity, and an SBOM. |
| Newly identified vulnerability | Risk assessment and documentation, coordinated disclosure, customer communications, and an analysis of whether a correction or removal report is required. |
| Incident affecting device function or patient safety | FDA medical device reporting analysis under 21 CFR Part 803 and EU MDR or IVDR vigilance reporting for serious incidents. |
| Incident involving personal or health data | HIPAA and state breach notification, GDPR notification to supervisory authorities within 72 hours where required, the FTC Health Breach Notification Rule, and contractual notice to hospitals and partners. |
| Significant incident at an EU entity in NIS2 scope | An early warning within 24 hours and an incident notification within 72 hours of becoming aware, subject to each member state’s implementing law. |
| Material incident at a public company | SEC Form 8-K Item 1.05 disclosure within four business days after the company determines the incident is material. |
Whether and when each obligation applies depends on the facts, the product’s regulatory status, the data involved, and the jurisdiction. This table summarizes common triggers and is not a complete list or legal advice for any specific event.
Where privacy and security meet device regulation
Device privacy and cybersecurity sit at the intersection of product regulation, data protection law, and security law. We align these requirements into one set of controls and one body of evidence, rather than separate programs that contradict each other.
Where a matter requires FDA submission strategy, notified body representation, or local counsel abroad, we coordinate with your regulatory team and outside counsel so the privacy and security positions are consistent across every filing.
Device and quality frameworks
Cybersecurity frameworks
Privacy and data frameworks
Built for cross-functional device teams
We work alongside Regulatory Affairs, Quality, Product Security, R&D, Clinical, Commercial, and the Legal and Privacy offices. Our deliverables are written to be used by engineers and auditors, not filed and forgotten.
Map
Trace the data and the attack surface from sensor to cloud to secondary use, including suppliers and support access.
Classify
Assign data categories, roles, and legal bases by jurisdiction and purpose.
Design
Convert legal requirements into design inputs, risk controls, contract terms, and notices.
Evidence
Produce the PIA, DPIA, and QMS records that show the work was done and verified.
Medical device privacy & cybersecurity FAQs
What makes a device a “cyber device” under Section 524B?
The statute defines a cyber device as one that includes software validated, installed, or authorized by the sponsor as a device or in a device, has the ability to connect to the internet, and contains technological characteristics that could be vulnerable to cybersecurity threats. FDA has interpreted these elements broadly, so many connected and software-driven devices should plan on meeting Section 524B requirements in their premarket submissions.
Why involve counsel in device cybersecurity rather than leaving it to engineering?
Engineering owns the controls, but many of the consequences are legal: statements in FDA submissions and customer security documentation are representations, vulnerability and incident decisions carry reporting deadlines, and contracts allocate liability for cyber events. Counsel can also help structure assessments to support privilege where appropriate, recognizing that courts have declined to protect reports prepared mainly for business purposes.
Is a medical device manufacturer a HIPAA covered entity?
Generally not simply because it makes devices. A manufacturer can become a business associate when it creates, receives, maintains, or transmits protected health information on behalf of a covered entity, which is common with some remote monitoring and cloud services. Even where HIPAA does not apply, the FTC Act, the FTC Health Breach Notification Rule, state consumer health data laws, and foreign laws such as the GDPR may.
Do we need a DPIA for a connected device?
Under GDPR Article 35, a DPIA is required where processing is likely to result in a high risk to individuals, and large-scale processing of health data is one of the examples listed in the regulation itself. Supervisory authorities also publish lists of processing that requires a DPIA. In practice, most connected devices that process health data of patients in the EU warrant one, and a well-built DPIA doubles as useful evidence in your risk management file.
Where does privacy fit in our quality management system?
Privacy requirements belong in design inputs, risk analysis, supplier controls, complaint handling, and change control. Handling privacy inside the QMS means design changes trigger a privacy review automatically and the evidence lives where auditors already look.
Can we use device data for R&D, product improvement, or AI training?
Often yes, but it depends on the legal basis for the original collection, what patients and customers were told, the contracts with clinics and partners, and whether the data is de-identified or anonymized to the applicable standard. For example, a business associate may de-identify PHI only if its business associate agreement permits it. We build a documented path for each intended secondary use before the data is used, not after.
How is this different from a privacy consultant?
We are licensed attorneys. Our analysis can be provided under attorney-client privilege where appropriate, our contract work is enforceable legal drafting, and we can represent you in regulator inquiries, audits, and negotiations.
Launching a connected device, preparing a 524B submission, or responding to a vulnerability?
Tell us about the product, the markets, and the timeline. We will scope a fixed-fee assessment or a plan that fits your release schedule.
This page is attorney advertising and provides general information only. It is not legal advice, and no attorney-client relationship is formed by reading it or contacting the firm. Past experience does not guarantee a similar outcome. Joshua Carlson is licensed in Minnesota; matters requiring advice under the law of another jurisdiction are handled in coordination with locally licensed counsel where required.