Regulation & your data

The rules of the road

Regulation & your data

As biosensors moved from gadgets to diagnostics, regulators started catching up: building reimbursement pathways, clearance categories, and (slowly) privacy rules. This is the landscape that decides whether a given wearable is a toy, a covered medical device, or a data pipeline you don't fully control.

From consumer electronics to "software as a medical device"

The FDA's formal sensor-based digital health technology (sDHT) list marks the point where a wearable becomes regulated Software-as-a-Medical-Device. Crossing that line means proving the device delivers absolute diagnostic accuracy in messy, real-world conditions, not just a relative trend you can watch over time. The devices that clear it — cuffless BP from Aktiia and Biobeat, the Hexoskin ECG shirt, CGMs from Dexcom and Abbott — are the ones that earn high clinical scores here. General-wellness devices, however polished, don't.

Programs pushing wearables into mainstream care

FDA / CMS — ACCESS & TEMPO

Pilot programs designed to facilitate insurance reimbursement for therapeutic wearables — a prerequisite for devices to become a covered part of treatment rather than an out-of-pocket extra.

ARPA-H — Delphi

A program targeting low-cost biosensors, signaling institutional prioritization of continuous physiological monitoring and cheaper access.

FDA — OTC CGM pathway

A new route that moved continuous glucose monitors from prescription-only into over-the-counter products (Stelo, Lingo) for prediabetics, pediatrics and metabolic-wellness users.

FDA — sDHT list

The formal category that turns qualifying sensor devices into regulated medical-device software, raising the evidentiary bar for clinical claims.

The privacy gap: why your watch isn't covered like your chart

A lot of people assume HIPAA covers their wearable data. Mostly it doesn't. HIPAA governs data held by healthcare providers and insurers, not, as a rule, the data your consumer watch or ring sends to a manufacturer's app. That gap is what prompted bills like the SMARTWATCH Data Act, which would restrict unauthorized sharing of consumer health data.

Before you trust a device with sensitive data, it's worth checking whether you can export and delete it, who it gets shared with, and where it's stored. A device's data architecture and its empowerment score speak directly to that.

Two cautions the FDA has made explicit

Non-invasive "glucose" watches & rings

In 2024 the FDA warned against unauthorized smartwatches and rings that claim to measure blood glucose without piercing the skin — none are cleared, and acting on erroneous readings can lead to dangerous insulin dosing. Treat any needle-free glucose claim (e.g. KnowU) as unproven until cleared.

Cuffless blood pressure still needs a cuff

Optical cuffless BP (Aktiia/Hilo) is a real advance and FDA-cleared for OTC use — but it requires periodic calibration against a traditional oscillometric cuff, and studies note it can struggle to capture nocturnal BP dipping. It supplements, not replaces, validated measurement.

What this means for you

Clearance is roughly the difference between a number you can act on and a number that's only interesting. When a device is FDA-cleared for a specific claim, that claim has actually been tested; everything outside the clearance is "general wellness," however confident the marketing sounds. Clearance also says nothing about privacy, since a cleared device can still leave your data outside HIPAA. That's why WearScore keeps the two questions apart: clinical value asks whether you can trust and act on the output, and empowerment value asks whether you own and control the data behind it.

Patient education, not legal or medical advice. Regulatory programs, clearances and proposed legislation evolve and vary by country — verify current status with the FDA, CMS, or the relevant authority and with the manufacturer before relying on any device.