AdvaMed approves voluntary data access best practices for medtech companies and health systems
AdvaMed's Digital Health Tech board approved voluntary Data Access Principles & Best Practices, announced October 28, setting four principles for how medtech companies and U.S. health systems share data.
This story was produced through MarketScale. See how Healthcare teams put it to work with Executive Thought Leadership.
Key takeaways
The framework covers data vendors need to implement, monitor and improve technology, with expectations for transparency, stewardship and de-identification.
Watch for the first RFPs, security questionnaires or data use agreements that cite the principles by name; a voluntary document gains weight only when buyers adopt it.
Free workspace
Turn your Healthcare expertise into content.
Record interviews, organize footage, and write with AI on a free trial of the MarketScale platform for qualifying companies. No demo required, no credit card.
To improve how a surgical technology performs, its maker may need to see what happens to the patient before and after the procedure, as well as inside the operating room. That's how Robert Cohen, chair of AdvaMed's Digital Health Tech Board of Directors, described the problem on October 28, when AdvaMed announced that the board had approved a voluntary set of Data Access Principles & Best Practices for medtech companies and U.S. health systems.
Cohen also works for a vendor. He is vice president of innovation and technology for Stryker's orthopaedic group. In the announcement he tied data access directly to AI, saying that good data is what lets developers build, validate and refine AI-enabled tools. According to AdvaMed, the framework makes patient trust the core of its work to improve care, support research and push innovation forward, artificial intelligence included.
That leaves hospital privacy, legal and procurement teams with one practical question. Can a voluntary industry document change how these data deals are negotiated? The answer depends on what the four principles ask for, what health systems get back, and who wrote the document.
Four principles, one scope
The title spells out the scope: these are AdvaMed's data access principles and best practices, written specifically for introducing technology into a health system. The document covers the data a company needs to implement a product, fit it into clinical workflows, tune its performance, monitor safety and quality, and improve products and services over time. The four principles are:
- Transparency and clear expectations: use agreements, documentation and privacy disclosures to state what data are collected, how they are used and protected, and who is responsible for what.
- Responsible data stewardship: comply with applicable law, limit identifiable data to permitted purposes, address retention, and support all of it with oversight, training and governance.
- De-identification as a foundation for innovation: rely on recognized methods, test regularly that they work, protect against re-identification, and support lawful uses of de-identified data on agreed terms.
- Responsible AI and advanced analytics: keep data practices transparent and oversight risk-based, and evaluate performance, safety and potential bias throughout the technology's lifecycle.
The de-identification principle does not name a single method. It asks for periodic checks that the chosen method still works, which treats de-identification as something maintained over time instead of a box ticked at contract signing.
The AI principle stretches in a similar direction. Evaluating performance, safety and bias "throughout the lifecycle" implies monitoring that continues after go-live. That would matter if health systems carry the language into contracts, because it gives a buyer a written basis to ask how a vendor will watch an AI tool once it's in clinical use.
The framework reaches past health information covered by federal health privacy law. It also addresses other clinical, device and operational data, so an agreement modeled on it would put both categories under the same terms.
What comes back to the hospital
The framework supports reciprocal sharing of data and insights: appropriately safeguarded benchmarking, quality and safety information, plus real-world data health systems can use to improve care.
That clause makes the document more than a list of what vendors want. Cohen's surgical example has the hospital supplying data from before, during and after a procedure. The reciprocity language sets up an expectation that useful information flows back in return, so a health system has something to ask for when the data request arrives.
Mick Farrell, chairman and CEO of Resmed and chair of AdvaMed's main board, linked data access to understanding how technology performs in the real world and to tailoring care for each patient. In his view, digital transformation works only when patients, clinicians and innovators advance as a group. Scott Whitaker, AdvaMed's president and CEO, called the document a practical tool that companies and health systems can use to build trust and settle data-sharing questions, so that privacy and innovation move ahead side by side.
The goal is to learn more from technology so we can do more for patients., Robert Cohen, chair, AdvaMed Digital Health Tech Board of Directors, and vice president, innovation and technology, orthopaedic group at Stryker
Written by the vendor side
The document comes from AdvaMed's Digital Health Tech division, whose members include medical device manufacturers, software developers, AI companies, consumer technology firms, pharmaceutical organizations and data and analytics companies. The division lists data access alongside AI regulation, cybersecurity, reimbursement, interoperability and global regulatory harmonization as its working priorities.
The division calls itself the voice of digital health within the medtech industry and says it works to shape policies, best practices and standards. It lists contributing to frameworks and principles as a membership benefit. Whitaker credited "the member company experts who brought this work forward." A health system's counsel should therefore read the principles as an industry-drafted opening position, even where the terms are balanced.
The process moved quickly. In its analysis of the one-page summary AdvaMed posted, Shattered noted that the document records an approval date of October 19, 2026, nine days before the public announcement. Two days after the announcement, AdvaMed filed comments with the FDA on generative AI.
Timeline
AdvaMed; Shattered
The fourth principle calls for risk-based oversight of AI and advanced analytics, including checks on performance, safety and potential bias. That suggests the association wants data governance treated as part of its wider AI policy position, not as a separate track added later. The FDA comments make the link plain: they urge a risk-based approach to regulating generative AI-enabled medical devices. The division's featured resources also include an AI Policy Roadmap aimed at Congress.
Shattered took a similar view from the developer's side. It said the patient-trust framing makes data governance a precondition for AI features, not a compliance afterthought added at release. For engineering teams shipping connected devices and analytics into hospitals, that would mean data handling decisions get made at design time, before the contract is negotiated.
Where the framework earns its weight
Because the framework is voluntary, hospital privacy teams could still find the hardest data-sharing terms settled one contract at a time.
AdvaMed's stated goal is narrower than industry-wide adoption, and easier to measure. The group wants clearer expectations to cut the delays that slow contracting and implementation, and to help companies and health systems form productive partnerships built on trust. If the document works, the proof will be shorter negotiations, not a long list of signatories.
Cohen's own description answers part of that. He called the best practices a common starting point for collaboration, and a starting point is all a contract template needs to be if it saves both legal teams the first few rounds of drafting.
When a vendor cites these principles, ask four things. Which recognized de-identification method does it use, and how often does it test that method's effectiveness? How will it evaluate an AI tool's performance, safety and potential bias after go-live? What benchmarking, quality and safety data will come back to the health system under the agreement?
The signal to watch is on the buying side. If health system RFPs, security questionnaires or data use agreements start citing the AdvaMed principles by name, and asking for the reciprocal benchmarking data alongside them, the framework will have done what it set out to do: give both sides of the table the same first page.
Sources
Your experts belong here
Every story in MarketScale Healthcare starts with a company putting its clinicians, service-line leaders, and field engineers on the record. Buyers are already reading this topic. The only question is whose experts they find.
Service-line buyers vet vendors quietly, and your clinicians become the proof they find while doing it.
About the author
The MarketScale Newsroom reports on the companies, technologies, and trends shaping 16 B2B industries. It turns primary sources and expert commentary into clear, useful coverage for the people doing the work.
