CGM Data Ownership and Cybersecurity

CGM Data Ownership and Cybersecurity

Introduction

A continuous glucose monitor (CGM) sends glucose readings from a sensor on the body to a phone or receiver (some feed an insulin pump directly), and often on to the manufacturer's cloud platform [4]. Two questions follow that data everywhere it goes. Who controls it? And how well is it protected from people who shouldn't see it or change it? As of October 2026, the short answer to the first is that US law gives patients access rights but no clear ownership rights [3].

Data Ownership

No US law explicitly recognizes ownership of medical data, and the same holds in several EU member states, according to a 2026 review in the Journal of Translational Medicine [3]. That leaves competing claims from patients, from the clinicians who order tests and keep the records, from researchers and from device manufacturers [3]. The same review points out that when a CGM uploads to a company's servers, the manufacturer gains access to those readings and generally tells patients little about how it will use them [3].

What patients do have under HIPAA (the Health Insurance Portability and Accountability Act) is a right of access: they can inspect and get copies of their health records and control who else can see them [3]. HIPAA binds only "covered entities," meaning health care providers, health plans and health care clearinghouses [3]. Here's what surprised us: a CGM maker's cloud platform or a third-party wellness app is generally not a covered entity, and glucose data stored there can fall entirely outside HIPAA [4]. In practice, the terms of service a user accepts when activating a sensor or downloading an app usually decide who controls that data [4].

The Federal Trade Commission (FTC) covers part of that gap. Section 5 of the FTC Act bars deceptive or unfair practices, which includes a company breaking its own privacy policy [3]. The FTC's Health Breach Notification Rule requires vendors of health records that HIPAA doesn't cover to notify affected people and the FTC, and sometimes the media, after a breach of unsecured identifiable health data [3]. A 2024 final rule updated it to explicitly include health apps and connected devices [4]. States add their own layer: Washington's My Health My Data Act (2023) lets people sue companies that collect or share their consumer health data without authorization [4]. We look at the same questions for fitness trackers and other gadgets in data privacy in consumer health wearables.

Cybersecurity Risks

Anything that communicates wirelessly can, in principle, be intercepted. A 2026 review in the Journal of Diabetes Science and Technology describes wirelessly connected CGMs and insulin pumps as potentially vulnerable to data interception and, in a worst case, to manipulation of dosing commands [4]. The FDA has warned about specific flaws. In September 2022 it alerted users of Medtronic's MiniMed 600 series insulin pump system, an earlier generation of MiniMed pumps that pairs wirelessly with a CGM transmitter, that a nearby unauthorized person could gain access to the pump while its components were being paired. If that happened, the pump might deliver too much or too little insulin [1].

The track record so far is one of vulnerabilities found and fixed rather than attacks on patients. For the cases on its cybersecurity alert list, the FDA says it isn't aware of any patient injuries or deaths from cybersecurity incidents, or that any specific devices in clinical use have been purposely targeted [1]. Protection still varies by product. The Diabetes Technology Society's DTSec standard and the IEEE 2621 standard give manufacturers frameworks for wireless diabetes device security, but adoption is uneven [4].

Regulations and Guidelines

In the US, device cybersecurity became a legal requirement in 2023. The Consolidated Appropriations Act, 2023, signed December 29, 2022, added section 524B, "Ensuring Cybersecurity of Devices," to the Federal Food, Drug, and Cosmetic Act (FD&C Act), and it took effect March 29, 2023 [1]. Section 524B applies to "cyber devices": devices that include software validated, installed or authorized by the sponsor, can connect to the internet, and have technological characteristics that could be vulnerable to cybersecurity threats [6].

A company seeking FDA authorization for a cyber device, whether through a 510(k), a premarket approval (PMA) application, a De Novo request or another premarket submission, now has three duties [6]. It must submit a plan to monitor and address postmarket vulnerabilities, including coordinated vulnerability disclosure. It must maintain processes that give reasonable assurance the device and related systems are cybersecure, and make updates and patches available. And it must provide a software bill of materials (SBOM), a list of the commercial, open-source and off-the-shelf software components inside the device [6]. The law doesn't reach back to submissions made before March 29, 2023, but it does apply when a previously authorized device gets a change that needs new premarket review [6].

The FDA explains how it expects companies to meet these duties in its guidance "Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions." As of October 2026, the current edition is the final guidance dated February 2026, which supersedes the edition issued June 27, 2025 [5]; that one replaced the September 27, 2023 edition [1]. It covers cybersecurity design, labeling and the documentation the FDA recommends in premarket submissions, and it addresses section 524B directly [5]. A separate 2016 final guidance covers managing cybersecurity vulnerabilities after a device is on the market [1].

In the EU, the General Data Protection Regulation (GDPR) covers the processing of EU residents' personal data and treats health data as a special category [2] [4]. It doesn't make anyone the owner of data. Instead, it gives rights to the person the data describes [4].

Best Practices

Manufacturers and users both have a part in keeping CGM data secure. For manufacturers, some of this list is no longer optional: section 524B requires makers of cyber devices to make postmarket updates and patches available [6]. Good practice includes:

• Using secure communication protocols, such as encryption and secure authentication
• Implementing robust access controls, including passwords and biometric authentication
• Regularly updating software and firmware to patch security vulnerabilities
• Providing clear guidelines for data ownership and usage that users can understand before they accept the terms

Conclusion

As of October 2026, the security side has firmer rules than the ownership side. Makers of internet-connected "cyber devices" now face statutory cybersecurity requirements when they submit new or changed devices to the FDA [6], while no US law explicitly settles who owns medical data [3]. Until that changes, the terms of service people accept when they activate a CGM or install its app do most of the work of deciding who can use their glucose data [4].