Relationships between medical technology companies and healthcare professionals can help advance development of medical technologies, promote their safe and effective use, and foster medical research and education. These relationships can also create risk under state and federal laws, such as the federal Anti-Kickback Statute. AdvaMed, a medical technology trade association, originally developed a set of voluntary guidelines for its members to use in structuring their interactions with healthcare professionals. The code was created in 1993 and is revised periodically, with updates increasing in frequency in the past five years.

While the code remains labeled a voluntary set of guidelines, AdvaMed requires its member companies to abide by the code. Certain states, including California, Connecticut, and Nevada, have made the code’s provisions mandatory. Disclosure databases and reporting requirements also have been created under the federal Sunshine Act and in California, Massachusetts, and Vermont. As the industry is well aware, whistleblowers and the government may attempt to argue that code noncompliance is evidence of improper intent in connection with allegations of federal Anti-Kickback Statute violations.

The most significant change to the code is the addition of a section titled “Data-Driven Technologies.” This new section reflects AdvaMed’s recognition of the growing role of digital health and data analytics in medical technology. It introduces a framework for ethical data use and governance, outlining the following principles entities should follow:

Principles of trust

• Use data for the benefit of patients – to improve access and outcomes; to advance research, development, and safety goals; and to benefit the healthcare ecosystem at large.
• Minimize personal data, as appropriate, to protect individuals’ privacy and prevent inappropriate identification of specific individuals.
• Use data for the purposes articulated to individuals or authorized by customers.

Principles of privacy, transparency, consent, and control

• Protect patient privacy in compliance with industry best practices and international standards where applicable.
• Personal data and the systems that process it are protected through appropriate organizational security measures designed to preserve confidentiality, integrity, and availability.
• Collect data transparently with appropriate notice and permission.
• Individuals have appropriate control over their personal data.

Principles of responsibility in data management

• Manage personal data in accordance with appropriate medical technologies standards of ethics and trustworthiness.
• Healthcare stakeholders, innovator personnel, and external vendors collaborate to deliver a clear understanding of the data that is collected, how it is used, and how it is protected.
• Manage data in accordance with requirements of healthcare stakeholders where applicable.
• Deploy appropriate technology to protect data and continuously improve systems and processes, and train teams in relevant aspects of data protection and cybersecurity to maintain a consistently high level of threat awareness.

Next steps

Medical technology companies and healthcare professionals should consider whether the 2025 code warrants updates to their compliance policies and procedures. The 2025 code provides helpful guideposts but does not override laws, regulations, or other governing codes that may be in effect. Stakeholders should keep this in mind as they consider their policies and procedures in light of the recent 2025 code revisions.

We will continue to monitor how the 2025 code updates impact the industry. If you have any questions about the revised 2025 code or how it may impact your compliance policies and procedures, please contact one of the authors of this article or a member of the firm’s Health & Life Sciences Group.