CGM Data Privacy and Cybersecurity

CGM Data Privacy and Cybersecurity

Introduction

A continuous glucose monitor (CGM) is a wearable sensor that measures glucose under the skin and sends readings to a phone, a receiver or an insulin pump around the clock. That steady stream is useful. It is also personal health information, and it moves over wireless links and through company cloud services. FDA puts the trade-off plainly: medical devices are increasingly connected to the internet, hospital networks and other medical devices, and those same features raise cybersecurity risk [4]. Below we look at where the real risks sit, which rules actually cover CGM data as of October 2026, and what manufacturers and users can do. For the wider device picture, see our article on cybersecurity in connected CGM ecosystems.

CGM Data Privacy Concerns

CGM systems collect sensitive personal health information, starting with glucose readings and often including medication and other health details the user logs in the companion app. Three kinds of exposure come up again and again:

• Unauthorized access: Someone who gets into a CGM account or device could see a detailed record of a person's glucose patterns. FDA's warning about medical devices in general applies here: like other computer systems, they can be vulnerable to security breaches [4].
• Data breaches: CGM manufacturers, healthcare providers and insurers all hold health data, and any of them can be breached. Reportable health data breaches are frequent enough that JAMA researchers tracked their trends year by year from 2010 through 2017 [6].
• Surveillance and data sharing: The everyday risk is often ordinary data sharing, not hacking. Here's what surprised us: in a 2019 BMJ study of 24 top-rated medicines-related Android apps, 19 shared user data, and about two-thirds of the 55 companies that received it offered data collection and analysis services such as analytics or advertising [5]. That study didn't test CGM apps. It is still a good reason to read a CGM app's privacy policy and sharing settings rather than assume the data stays put.

Cybersecurity Risks

A CGM is rarely a standalone gadget. FDA's premarket guidance treats a connected device as one element of a larger system that can include other devices, networks and software update servers, and it warns that a weakness anywhere in that system can affect the device's safety or effectiveness [2]. The main risks:

• Device hacking: The clearest real-world case on FDA's cybersecurity page involves a pump system that includes a CGM. In September 2022, FDA alerted users to a cybersecurity risk in the Medtronic MiniMed 600 series insulin pump system (for example, the MiniMed 630G and 670G), whose pump, CGM transmitter and meter communicate wirelessly [4]. A nearby unauthorized person would have needed to reach the pump while it was being paired with other system components, and FDA said it was not aware of any reports related to the vulnerability [4]. Those pumps have since been superseded: as of October 2026, MiniMed's US pump pages list the MiniMed 780G and MiniMed Flex [8].
• Network vulnerabilities: Flaws can sit in the wireless technology itself rather than in one company's design. In March 2020, FDA informed patients, providers and manufacturers about potential cybersecurity vulnerabilities in certain medical devices that use Bluetooth Low Energy [4].
• Software vulnerabilities: Device software is built partly from third-party components, so one flawed component can show up in many products. FDA now requires a software bill of materials (SBOM), a list of the software components inside a device, for "cyber devices" [2]. FDA also notes that several commercial products with cryptographic protections have had exploitable vulnerabilities because of how the cryptography was configured or implemented [2].

Regulations and Guidelines

Three frameworks come up most often. Each covers less than people tend to assume:

• HIPAA: The Health Insurance Portability and Accountability Act of 1996 (HIPAA) applies to covered entities, meaning health plans, healthcare clearinghouses and healthcare providers that conduct HIPAA transactions such as electronic claims, and to the business associates that work for them [1]. CGM data in your clinic's records is covered. A company that is neither a covered entity nor a business associate falls outside HIPAA [1], and that can include the maker of a manufacturer's or over-the-counter CGM app you upload readings to. In that case the company's privacy policy and other laws govern it instead. We look at that gap more broadly in data privacy in consumer health wearables.
• FDA guidelines: FDA reviews cybersecurity as part of whether a device is safe and effective. Its current premarket guidance, "Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions," was issued on February 3, 2026, and replaced the version issued June 27, 2025 [2]. Since March 29, 2023, section 524B of the Federal Food, Drug, and Cosmetic Act has required makers of cyber devices (devices with sponsor-authorized software that can connect to the internet and could be vulnerable to cyber threats) to include cybersecurity information in their premarket submissions [2]. For devices already on the market, FDA's December 2016 guidance on postmarket management of cybersecurity is the companion document [7].
• ISO 27001: ISO/IEC 27001 sets requirements for an information security management system, the policies and processes an organization uses to manage security risk [3]. It is a general standard used across industries, and medical device makers can adopt it alongside device-specific standards [9]. It contains no guidelines written for CGM data. The current edition is ISO/IEC 27001:2022, which replaced the 2013 edition [3]. Certification speaks to a company's security management, not to the design of a particular sensor or app.

Mitigation Measures

Most protections are the manufacturer's job, and that is where FDA's guidance puts its weight. Users still control a few of them.

• Encryption: FDA recommends that manufacturers use cryptographic algorithms and protocols to meet its secure-by-design objectives. Picking a strong algorithm isn't enough on its own, so the guidance also gives specific advice on how the cryptographic scheme is selected and implemented across the device and the larger system it works in [2].
• Secure authentication: The same guidance asks that a device and its system be able to prove two things: that information came from a trusted source without being altered in transit, and that the device, app or user on the other end is who it claims to be [2]. On the user side, if a CGM app or account offers two-step sign-in, turning it on adds a check beyond the password.
• Regular updates and patches: For cyber devices, section 524B requires manufacturers to make postmarket updates and patches available, and to fix critical vulnerabilities that could cause uncontrolled risks out of cycle, as soon as possible [2]. Those fixes only help once they are installed on the phone app, receiver or pump.
• Patient education: FDA treats labeling as a security control. Its guidance says that telling users about relevant security information in the device labeling may help reduce cybersecurity risk, and that any security tasks handed to users should be checked in usability testing to make sure users can actually do them [2]. The security and privacy sections of a CGM's user guide and app settings are among the few places where the user, not the manufacturer, makes the call.

Conclusion

The rules split along a line most CGM users never see. FDA reviews whether a CGM is built and maintained securely [2]. HIPAA protects the copy of your glucose data held by your clinic or health plan, but usually not the copy sitting in a manufacturer's or over-the-counter app, where the company's privacy policy does most of the work [1]. That makes the app's sharing settings worth as much attention as the sensor. Whether broader privacy rules for consumer health apps will close that gap is still an open question.