Hospital device data rights arrive one purchase order at a time

The week

In September 2026, the European Union changed the default for the data that new hospital equipment records. A modern hospital is full of machines that keep logs. A CT scanner records every scan, every error and every hour its parts run. An infusion pump logs each dose. A laboratory analyzer counts samples and notes when a component starts to wear. For years, getting at those logs has usually meant asking the manufacturer, on the manufacturer’s terms.

The law behind this is the EU Data Act. It covers “connected products,” meaning physical items that generate data about their use and can share it, from industrial machines to cars to medical equipment, and the “related services,” such as apps, that make them work. The Data Act became applicable on September 12, 2025. From that date, users of connected products could ask for the data their products generate, and sellers had to describe that data before a contract was signed.

One obligation was deferred for a year. From September 12, 2026, connected products and related services placed on the EU market must be designed so that their data is accessible to the user by default, easily, securely and free of charge. This is often called “access by design”: data access is built in from the start, rather than something the customer has to negotiate for later.

The law goes further on how. Where relevant and technically feasible, access must be direct, meaning the user can pull data from the product itself rather than only through the manufacturer. The data must come in a structured, commonly used, machine-readable format, meaning organized in a standard way that a computer can process without someone retyping it.

There was an important limit. The design duty is not retroactive: products already on the market need not be retrofitted. A scanner installed last year will not suddenly gain a new data port.

And there was some uncertainty in the background. The Commission’s Digital Omnibus proposal, a package that would amend parts of the Data Act and other digital laws, was still being negotiated in the Council that week and had not changed the date. The Council is the EU body in which member state governments negotiate and approve legislation. For now, the date stood.

What the machines record, and who gets to read it

Hospitals and research laboratories run large fleets of connected equipment: imaging systems, infusion pumps, patient monitors, analyzers, sequencers, sterilization units and building systems. A sequencer reads genetic material; a sterilization unit cleans surgical instruments; building systems run heating, ventilation and power. Every one of them produces a steady stream of data.

The data these produce is useful for maintenance, utilization planning, quality work and research:

• Maintenance. Error logs and wear counts let engineers fix machines before they fail, rather than after a scanner goes down on a busy Monday.
• Utilization planning. Usage counts show which machines are overloaded and which sit idle, which matters when a single imaging system costs a great deal to buy and run.
• Quality work. Records of how equipment performed help clinical teams investigate problems and improve safety.
• Research. Device data can feed studies, including the development of new analytical tools.

Access to it has usually depended on the manufacturer’s service contract and tools. If the hospital wanted the data, it often needed the manufacturer’s software, the manufacturer’s engineer or the manufacturer’s permission. That gives the manufacturer considerable sway over who maintains the machine and at what price.

The design duty that applied from September 12 changes the default, but only for equipment placed on the market from that date. “Placed on the market” is the legal moment a product is first made available for sale in the EU. A CT scanner bought in 2024 may stay in service well into the 2030s. Hospital equipment is replaced slowly, so the new rule will take years to reach most of what a hospital actually runs.

The Act’s effect on a hospital’s estate therefore splits into three parts: equipment it buys from now on, equipment it already runs, and data the Act does not unlock on any equipment. Each calls for a different instrument. Organizations should take legal advice on how the Act interacts with medical device rules and health data law for specific products.

Equipment bought from now on

For new purchases, the Act gives the buyer both a design baseline and a disclosure duty. The baseline is access by design. The disclosure duty applies before a contract is signed: the seller or lessor must describe the data the product generates. That includes its type, format and estimated volume, whether it is produced continuously and in real time, and where it is stored and for how long. It must also say how the user can access, retrieve and delete it.

Most hospital tenders do not yet score that information. They should. A tender is the formal competitive process a public or large private hospital uses to buy equipment, in which suppliers submit bids that are scored against published criteria. If data access is not one of the criteria, it will not influence the decision.

Check whether the duty actually applies

Timing needs care. The design duty attaches to products placed on the market from September 12, and commentators differ on how it applies to models launched earlier but still on sale. A hospital buying a long-established analyzer model in 2027 should not assume access by design. It should ask the seller in writing whether the model falls under the duty, and price the answer into the evaluation. A model without access by design may still be the right purchase, but the hospital should know what it is giving up.

Write data into the specification

A practical step is to add a data section to the technical specification for every class of connected equipment. The technical specification is the document that tells suppliers what the hospital needs. Each team contributes:

• Biomedical engineering defines the operational data it needs, such as error logs, usage counts and component wear. Biomedical engineering, sometimes called clinical engineering, is the hospital team that maintains medical equipment.
• Research and quality teams add what they need.
• IT security states how access must be delivered.

Bids are then scored on the pre-contract disclosure, not on marketing claims. The contract should record the access method, any interface documentation and the format, and should require notice before a software update changes them. Without that last clause, a routine update could remove the access the hospital paid for, and nobody would notice until the data stopped.

Choose the access route deliberately

There are trade-offs. Direct access from a device can mean a new network interface to secure and monitor. A network interface is a connection point into the device from the hospital network, and every such point is something attackers might try. Access through the manufacturer’s cloud can mean a new data flow to assess under the GDPR, the EU’s General Data Protection Regulation, which governs personal data. Some hospitals will prefer a bulk export to their own data platform on a schedule. Whatever the method, the security team should approve it in the tender, not after installation.

Equipment already running

Installed equipment is outside the design duty, but not outside the Act. Since September 2025, a user has been able to ask the data holder for readily available product data, without undue delay and free of charge. The data holder is whoever controls the data, usually the manufacturer. It can also direct the data holder to share it with a third party, such as an independent maintenance provider. That right applies whenever the product was placed on the market.

This is a significant point that is easy to miss. The headline date in September 2026 was about design. The right to ask for data from existing equipment has existed for a year, and it covers the scanner bought in 2024 as much as one bought next spring.

Build a simple process for requests

Exercising it takes an internal process. Someone has to know which equipment generates which data, who the data holder is, and how to make a request. For most hospitals that means a short register, owned by biomedical engineering, listing high-value equipment classes and the data the hospital wants from each. A register here is just a maintained list, not a large software project.

Requests should be made in writing and logged with dates and responses. Clinical engineering teams then have evidence if a manufacturer delays or refuses. Over time, the log also shows which manufacturers cooperate readily, which is useful information for the next tender.

Use service contract renewals

Service contract renewals are the other lever. The Act allows a data holder to use non-personal product data only under an agreement with the user. Non-personal data is data that does not identify a person, such as a machine’s temperature readings or error codes. Many service agreements say little about the manufacturer’s own use of equipment data. A renewal is the moment to set out what the manufacturer may do with it, and what the hospital receives in return. If a manufacturer gains value from a hospital’s equipment data, for example to improve its products, the hospital is entitled to ask what it gets back.

Data the Act does not unlock

Some data stays out of reach on any equipment, new or old. Knowing the limits keeps expectations realistic.

Raw data, not the manufacturer’s conclusions

The access right covers raw and pre-processed data generated by use. It does not cover information the manufacturer derives or infers from that data, such as proprietary analytics or predictive maintenance scores. The hospital is entitled to the readings from the machine’s gauges, not to the manufacturer’s private interpretation of what those readings mean. A predictive maintenance score, which estimates when a part is likely to fail, is the manufacturer’s analysis and stays the manufacturer’s.

Trade secrets are protected. A data holder can require confidentiality measures and, in exceptional cases, refuse access, but it must then notify the competent authority. The competent authority is the national body each member state designates to oversee the Act.

Patient data stays under privacy law

Personal data brings another limit. Equipment that records patient identifiers, images or vital signs generates personal data, and the GDPR continues to govern it. A hospital asking for monitor data for a quality study still needs a lawful basis and appropriate safeguards. A lawful basis is one of the specific legal grounds the GDPR allows for using personal data. A third party receiving it, such as an analytics firm or an AI developer, needs its own basis and a data processing agreement, the contract that sets out how a provider may handle personal data on someone else’s behalf. The Data Act widens access to device data; privacy law still decides who may use the personal part of it.

US buyers can borrow the list

Outside the EU, the Act does not apply directly. US health systems buy much of the same equipment from the same manufacturers, though. Where a manufacturer builds access into a product for Europe, the capability often exists in the same model sold elsewhere. US buyers can ask for it in their own tenders, using the EU disclosure list as a template.

Where the money and the risk sit

Device data can sound like a niche concern for engineers. In practice it touches several of the things hospital executives and boards are accountable for.

Cost. Large equipment is among a hospital’s biggest capital and service expenses. When only the manufacturer can read a machine’s logs, the manufacturer is in a strong position at every service negotiation. When the hospital can get the data and share it with an independent maintenance provider, it has a credible alternative, and alternatives tend to improve terms. Usage data also helps answer a basic budgeting question: do we need another scanner, or better scheduling of the ones we have?

Uptime and patient care. A scanner or analyzer that fails without warning means delayed diagnoses, rescheduled patients and pressure on staff. Error logs and wear data allow engineers to plan repairs around clinical schedules. That benefit depends on actually receiving the data in a usable format, which is why the format and access method belong in the contract.

Security. Every new way of reaching a device is also a new way an attacker might try. A data feature added carelessly can open a gap in the hospital network. Having security approve the access route at the tender stage costs little; retrofitting controls after installation costs much more.

Privacy and reputation. Some device data identifies patients. Sharing it without a sound legal basis and proper agreements exposes the hospital to regulatory action and to loss of patient trust. The Data Act does not soften those obligations.

Research and innovation. Teaching hospitals and research institutes increasingly want to use device data for studies and to develop new tools, including AI. Clear rights to the raw data, and clear understanding of what stays with the manufacturer, make those projects easier to plan and less likely to stall in legal review.

These benefits do not arrive automatically on September 12. Each depends on the hospital asking for the data, in writing, in the right documents, at the right moment.

A teaching hospital’s first year under the Act

Take a teaching hospital with a large imaging department, a busy laboratory and a research institute.

In early 2027 it runs a tender for a new laboratory analyzer. Because it has added a data section to its specification, each bidder must provide the pre-contract disclosure: what data the analyzer produces, in what format and volume, where it is stored and for how long, and how the hospital can get it and delete it. One bidder offers a newly launched model with access by design and a documented export. Another offers a long-established model and, when asked in writing, cannot confirm that the design duty applies. The evaluation scores the difference, and the contract for the winning bid records the access method, the format and a requirement to give notice before any software update changes them. IT security has already approved a scheduled export to the hospital’s own data platform.

Meanwhile, the hospital’s existing CT scanners, bought years earlier, are outside the design duty. Biomedical engineering adds them to its register and sends a written request for error logs and usage data, asking that it also be shared with an independent maintenance provider the hospital is considering. The request and the manufacturer’s response are logged. When the scanners’ service contract comes up for renewal, the hospital uses the moment to set out what the manufacturer may do with the scanners’ non-personal data.

Finally, a research team wants to share patient monitor data with an AI developer. Here the Data Act is only part of the answer. The hospital confirms its lawful basis under the GDPR, puts safeguards in place and signs a data processing agreement, and the developer establishes its own basis. The team also learns that the monitor maker’s proprietary alert scores are derived data and not covered by the access right.

The paperwork that decides it

The hospitals that gain most will have a data section in every connected-equipment tender, bids scored on the disclosure, contracts that lock in the access method and format, a register of installed equipment with logged requests, service renewals used to set terms for data use, and privacy questions settled before any patient-linked data leaves the building.

The usual slips are easy to predict. A buyer assumes every new purchase comes with access by design, without checking when the model was placed on the market, or scores bids on marketing claims about “open data” rather than the formal disclosure. The security team sees the access method only after installation. Existing equipment is forgotten, although it already carries a right to request data, and service contracts are renewed without addressing the manufacturer’s own use of equipment data. Some expect the Act to unlock the manufacturer’s analytics or to override privacy law. It does neither.

Where the data rights are won or lost

• Do our tenders for connected equipment include a data section, and is the seller’s disclosure scored?
• For equipment we are about to buy, have we confirmed in writing whether the model falls under the design duty?
• Do our contracts record the access method and format, and require notice before an update changes them?
• Do we have a register of high-value installed equipment, the data we want from each and who holds it?
• Which service contracts renew in the next year, and what do they say about the manufacturer’s use of our equipment data?

With hindsight

A month on, the design duty is in force and the Digital Omnibus remains under negotiation. The rule that mattered for new equipment arrived on schedule; the debate about amending the wider Act continues.

Council compromise texts circulated over the summer and in September would narrow public-sector data requests to genuine public emergencies and ease cloud-switching rules for some contracts signed before September 2025. Neither change goes to the heart of the device-data provisions discussed here. As of October it had not been adopted, and the Data Act continues to apply as written.

Enforcement capacity is thin. A Cullen International benchmark published in September found that, as of August, only six of the 21 member states it surveyed had designated competent authorities for the Data Act. A right is only as strong as the body that stands behind it, and in many countries that body does not yet exist in practice.

That makes contracts more important than complaints for hospitals in the near term. A clause in a signed contract can be enforced through the ordinary commercial relationship; a complaint needs an authority with the staff to handle it. Hospitals that write data terms into tenders and service renewals now will be in a stronger position than those waiting for regulators to act.

The installed-base problem described here is structural. Its effect will fade only as equipment is replaced, which in imaging and laboratory fleets takes many years. For most of the coming decade, a hospital will run a mix of equipment built with access by design and equipment reached only by request. Managing that mix is a routine operational task, not a one-time project.

The law sets a minimum; procurement does the rest. Organizations should follow Commission and national guidance and confirm specific positions with counsel.