New EU legislation revolutionizes healthcare data access

Medical professionals generate vast amounts of data through the use of connected medical and health devices. Until now, this data has been solely in the hands of companies.

The Data Act

New EU legislation seeks to address this. The Data Act, which goes into effect on September 12, 2025, creates cross-sectoral harmonized rules for the fair use of and access to data.

Under this regulation, manufacturers must design devices so that data is:

• Accessible by default
• Structured and machine-readable

Scope

The Data Act covers:

• Raw data and pre-processed data that makes device outputs understandable
• Metadata, such as context and device status

It does not cover derived insights, such as diagnoses and treatment recommendations.

Who is involved

The Act defines key roles:

• Users—anyone who owns or uses the device (e.g. patients, hospitals)

• Data holders—typically the company that makes the connected device

Public sector benefits

In cases of high public interest, such as disease outbreaks, governments can request access to relevant device data to support rapid response and policy decisions.