Hospital device data rights arrive one purchase order at a time

The week

The EU Data Act became applicable on September 12, 2025. From that date, users of connected products could ask for the data their products generate, and sellers had to describe that data before a contract was signed. One obligation was deferred for a year. From September 12, 2026, connected products and related services placed on the EU market must be designed so that their data is accessible to the user by default, easily, securely and free of charge. Where relevant and technically feasible, access must be direct. The data must come in a structured, commonly used, machine-readable format. The design duty is not retroactive: products already on the market need not be retrofitted. The Commission’s Digital Omnibus proposal, which would amend parts of the Data Act, was still being negotiated in the Council that week and had not changed the date.

Hospitals and research laboratories run large fleets of connected equipment: imaging systems, infusion pumps, patient monitors, analyzers, sequencers, sterilization units and building systems. The data these produce is useful for maintenance, utilization planning, quality work and research. Access to it has usually depended on the manufacturer’s service contract and tools. The design duty that applied from September 12 changes the default, but only for equipment placed on the market from that date. A CT scanner bought in 2024 may stay in service well into the 2030s. The Act’s effect on a hospital’s estate therefore splits into three parts: equipment it buys from now on, equipment it already runs, and data the Act does not unlock on any equipment. Each calls for a different instrument. Organizations should take legal advice on how the Act interacts with medical device rules and health data law for specific products.

Equipment bought from now on

For new purchases, the Act gives the buyer both a design baseline and a disclosure duty. Before a contract is signed, the seller or lessor must describe the data the product generates. That includes its type, format and estimated volume, whether it is produced continuously and in real time, and where it is stored and for how long. It must also say how the user can access, retrieve and delete it. Most hospital tenders do not yet score that information. They should.

Timing needs care. The design duty attaches to products placed on the market from September 12, and commentators differ on how it applies to models launched earlier but still on sale. A hospital buying a long-established analyzer model in 2027 should not assume access by design. It should ask the seller in writing whether the model falls under the duty, and price the answer into the evaluation.

A practical step is to add a data section to the technical specification for every class of connected equipment. Biomedical engineering defines the operational data it needs, such as error logs, usage counts and component wear. Research and quality teams add what they need, and IT security states how access must be delivered. Bids are then scored on the pre-contract disclosure, not on marketing claims. The contract should record the access method, any interface documentation and the format, and should require notice before a software update changes them.

There are trade-offs. Direct access from a device can mean a new network interface to secure and monitor. Access through the manufacturer’s cloud can mean a new data flow to assess under the GDPR. Some hospitals will prefer a bulk export to their own data platform on a schedule. Whatever the method, the security team should approve it in the tender, not after installation.

Equipment already running

Installed equipment is outside the design duty, but not outside the Act. Since September 2025, a user has been able to ask the data holder for readily available product data, without undue delay and free of charge. It can also direct the data holder to share it with a third party, such as an independent maintenance provider. That right applies whenever the product was placed on the market.

Exercising it takes an internal process. Someone has to know which equipment generates which data, who the data holder is, and how to make a request. For most hospitals that means a short register, owned by biomedical engineering, listing high-value equipment classes and the data the hospital wants from each. Requests should be made in writing and logged with dates and responses. Clinical engineering teams then have evidence if a manufacturer delays or refuses.

Service contract renewals are the other lever. The Act allows a data holder to use non-personal product data only under an agreement with the user. Many service agreements say little about the manufacturer’s own use of equipment data. A renewal is the moment to set out what the manufacturer may do with it, and what the hospital receives in return.

Data the Act does not unlock

Some data stays out of reach on any equipment, new or old. The access right covers raw and pre-processed data generated by use. It does not cover information the manufacturer derives or infers from that data, such as proprietary analytics or predictive maintenance scores. Trade secrets are protected. A data holder can require confidentiality measures and, in exceptional cases, refuse access, but it must then notify the competent authority.

Personal data brings another limit. Equipment that records patient identifiers, images or vital signs generates personal data, and the GDPR continues to govern it. A hospital asking for monitor data for a quality study still needs a lawful basis and appropriate safeguards. A third party receiving it, such as an analytics firm or an AI developer, needs its own basis and a data processing agreement. The Data Act widens the channel. It leaves privacy law as the gate.

Outside the EU, none of this applies directly. US health systems buy much of the same equipment from the same manufacturers, though. Where a manufacturer builds access into a product for Europe, the capability often exists in the same model sold elsewhere. US buyers can ask for it in their own tenders, using the EU disclosure list as a template.

With hindsight

A month on, the design duty is in force and the Digital Omnibus remains under negotiation. A September 2026 Presidency compromise text proposed changes such as narrowing public-emergency data requests and easing cloud-switching rules for some legacy contracts. As of October it had not been adopted, and the Data Act continues to apply as written. Enforcement is uneven. A law firm survey published in September found fully operational Data Act authorities in only six member states, including Germany and the Netherlands. That makes contracts more important than complaints for hospitals in the near term. The installed-base problem described here is structural. Its effect will fade only as equipment is replaced, which in imaging and laboratory fleets takes many years. Organizations should follow Commission and national guidance and confirm specific positions with counsel.