Loading
Expert Witness Insights by Area of Expertise
8 min read
Areas of Expertise :
Data Privacy, Cybersecurity, Health Insurance Portability and Accountability Act (HIPAA), Medical Devices, Digital Forensics
Published Date:
Last Modified Date:
Digital pill and medication-monitoring technologies can raise privacy, consent, cybersecurity, data-reliability, and evidentiary issues because sensitive health information may move through connected sensors, wearable devices, applications, databases, and provider systems. This article explains HIPAA and other privacy considerations, voluntary participation and authorization issues, cybersecurity risks, limitations of digital ingestion records, and how cybersecurity, digital-forensics, medical-device, software, privacy, and clinical experts may analyze disputed data and system reliability.
Digital medication monitoring can help clinicians and patients track medication use, but it also raises questions about privacy, consent, cybersecurity, data accuracy, and the interpretation of monitoring records.
Abilify MyCite brought these concerns into public view after the U.S. Food and Drug Administration approved the drug-device combination in 2017. Although the product is now listed as discontinued, ingestible event-marker technology continues to develop.
This guide explains the privacy, consent, cybersecurity, and evidentiary issues associated with digital medication monitoring. It also examines how qualified experts may analyze the technology, data flows, system reliability, and resulting digital records.
Abilify MyCite combined aripiprazole with an ingestible sensor. Its system included the tablet, a wearable patch, a smartphone application, and a web-based portal for healthcare professionals and caregivers.
The U.S. Food and Drug Administration approved Abilify MyCite for certain uses in adults with schizophrenia and bipolar I disorder and as adjunctive treatment for major depressive disorder. The FDA stated that the system's ability to improve medication compliance had not been established.
The labeling also states that using Abilify MyCite to track ingestion in real time or during an emergency is not recommended because detection may be delayed or may not occur. Although most ingestions were expected to be detected within 30 minutes, it could take up to two hours for the app and portal to detect an ingestion.
The FDA's current Orange Book lists all six strengths of the Abilify MyCite Kit in the Discontinued Drug Product List. Ingestible event-marker technology nevertheless continues to develop. FDA classifies the ingestible event marker under 21 C.F.R. § 880.6305, with OZW as its primary product code, and cleared the Otsuka Digital Feedback Device in June 2025.
The privacy implications of a digital pill depend on the specific system and its intended use. The original Abilify MyCite system recorded medication-ingestion information through an ingestible sensor, wearable patch, mobile application, and web portal.
The Otsuka Digital Feedback Device can collect more than ingestion events. FDA documentation for the device describes a wearable sensor capable of collecting heart rate, activity, body position, and time-stamped patient-logged events, including events associated with the ingestible sensor. Its software processes, displays, and stores information obtained from the sensors.
For attorneys evaluating a dispute, it is not enough to ask whether health information was collected. Relevant questions may include:
These details can affect both privacy analysis and the reliability of digital evidence.
Digital Evidence
Electronic Authentication
Information Security
Data Analysis
Medical Records Review
Digital medication monitoring can help clinicians and patients track medication use, but it also raises questions about privacy, consent, cybersecurity, data accuracy, and the interpretation of monitoring records.
Abilify MyCite brought these concerns into public view after the U.S. Food and Drug Administration approved the drug-device combination in 2017. Although the product is now listed as discontinued, ingestible event-marker technology continues to develop.
This guide explains the privacy, consent, cybersecurity, and evidentiary issues associated with digital medication monitoring. It also examines how qualified experts may analyze the technology, data flows, system reliability, and resulting digital records.
Abilify MyCite combined aripiprazole with an ingestible sensor. Its system included the tablet, a wearable patch, a smartphone application, and a web-based portal for healthcare professionals and caregivers.
The U.S. Food and Drug Administration approved Abilify MyCite for certain uses in adults with schizophrenia and bipolar I disorder and as adjunctive treatment for major depressive disorder. The FDA stated that the system's ability to improve medication compliance had not been established.
The labeling also states that using Abilify MyCite to track ingestion in real time or during an emergency is not recommended because detection may be delayed or may not occur. Although most ingestions were expected to be detected within 30 minutes, it could take up to two hours for the app and portal to detect an ingestion.
The FDA's current Orange Book lists all six strengths of the Abilify MyCite Kit in the Discontinued Drug Product List. Ingestible event-marker technology nevertheless continues to develop. FDA classifies the ingestible event marker under 21 C.F.R. § 880.6305, with OZW as its primary product code, and cleared the Otsuka Digital Feedback Device in June 2025.
The privacy implications of a digital pill depend on the specific system and its intended use. The original Abilify MyCite system recorded medication-ingestion information through an ingestible sensor, wearable patch, mobile application, and web portal.
The Otsuka Digital Feedback Device can collect more than ingestion events. FDA documentation for the device describes a wearable sensor capable of collecting heart rate, activity, body position, and time-stamped patient-logged events, including events associated with the ingestible sensor. Its software processes, displays, and stores information obtained from the sensors.
For attorneys evaluating a dispute, it is not enough to ask whether health information was collected. Relevant questions may include:
These details can affect both privacy analysis and the reliability of digital evidence.
Not all information generated by a health-related application or connected medical device is automatically protected by the Health Insurance Portability and Accountability Act of 1996, commonly known as HIPAA.
HIPAA applies to covered entities and their business associates. HHS explains that when an individual directs health information to an app that is neither a covered entity nor a business associate, the information may no longer be protected by the HIPAA Rules after the app receives it. An app developer or other entity that creates, receives, maintains, or transmits protected health information on behalf of a covered entity may instead be a business associate subject to HIPAA.
Information outside HIPAA is not necessarily unregulated. The Federal Trade Commission's Health Breach Notification Rule applies to certain vendors of personal health records and related entities that are not covered by HIPAA for the relevant activities. The FTC updated the rule in 2024 to clarify its application to health apps and similar technologies. Other laws may also apply depending on the facts and jurisdiction.
Digital pill privacy also raises a broader question: When is participation in medication monitoring genuinely voluntary?
Consent to medical treatment, permission granted through an application, and authorization to disclose protected health information are not interchangeable. Under HIPAA, covered entities may use or disclose protected health information for many treatment, payment, and healthcare-operations purposes without separate authorization, while certain other uses and disclosures require authorization subject to the Privacy Rule's requirements and exceptions.
Digital medication monitoring can introduce an additional decision about whether to use a monitored medication or monitoring system. Whether that choice is separate from the medication itself depends on the product, treatment setting, available alternatives, and applicable law.
Researchers have raised concerns about patient autonomy, privacy, data access, and other ethical implications of digital medication monitoring. Whether any particular arrangement is voluntary or legally permissible depends on its facts and the applicable law.
Relevant questions may include:
A digital medication system can involve several connected components, including an ingestible sensor, wearable device, smartphone application, wireless connection, database, cloud service, and provider portal. Each component may introduce different security risks.
The FDA's current medical-device cybersecurity guidance recommends cybersecurity risk-management practices for device design, development, and premarket submissions. Federal law also imposes specific cybersecurity requirements for certain premarket applications or submissions involving devices that meet the statutory definition of a cyber device.
The 2025 510(k) summary for the Otsuka Digital Feedback Device describes encryption for data at rest and in transit, improved Bluetooth pairing security, and protections associated with software updates.
Those safeguards address specific cybersecurity risks, but they do not eliminate every security or privacy concern. A dispute may require analysis of:
The relevance of each factor depends on how the system operated and what conduct or incident is disputed.
Digital medication records may become relevant in disputes involving healthcare treatment, privacy, cybersecurity incidents, insurance, product performance, or other matters involving medication use.
A recorded ingestion event should not automatically be treated as conclusive evidence of medication adherence. The original Abilify MyCite labeling acknowledged that detection could be delayed and that some ingestions might not be detected.
When digital medication records are disputed, useful questions can include:
Technical evidence may document an event without necessarily establishing broader conclusions about medication use, patient behavior, or compliance.
No single expert discipline will fit every digital-pill dispute. The appropriate expertise depends on the technical, medical, privacy, or evidentiary issue involved.
For cybersecurity or digital-forensics issues, an expert may examine system logs, access records, metadata, encryption practices, and incident evidence to explain how information moved through the system and whether the technical evidence is consistent with an alleged unauthorized access or disclosure.
When the dispute centers on health-information privacy or HIPAA, an expert may analyze data flows, organizational roles, privacy policies, authorization records, and relevant operational practices. Any opinion remains subject to the expert's qualifications and the court's limits on legal-opinion testimony.
A medical-device, biomedical engineering, or software expert may analyze sensors, firmware, applications, communication protocols, and databases to distinguish documented device capabilities from assumptions about what an ingestion record means.
A psychiatry or clinical expert may be relevant when a dispute involves psychiatric treatment, medication management, clinical decision-making, monitoring practices, or a patient's clinical decision-making capacity. Whether legally valid informed consent was obtained is a separate question governed by the applicable law and the facts of the case.
In federal proceedings governed by the Federal Rules of Evidence, Rule 702 requires the proponent to demonstrate to the court that it is more likely than not that the rule's admissibility requirements are satisfied. The testimony must, among other requirements, help the trier of fact, rest on sufficient facts or data, use reliable principles and methods, and reflect their reliable application to the facts.
An expert may explain specialized technical or professional issues. The permissible scope of opinions addressing legal standards or ultimate issues depends on the governing law and the court's evidentiary rulings.
Is Abilify MyCite still available in the United States?
The FDA's current Orange Book lists all six strengths of Abilify MyCite in the Discontinued Drug Product List. That listing does not by itself mean the FDA withdrew the product for safety or effectiveness reasons.
Are digital pill records protected by HIPAA?
Sometimes. HIPAA depends on whether the information is protected health information and whether the entity handling it is acting as a covered entity or business associate. Other federal or state privacy laws may apply outside HIPAA.
Does a digital pill prove that a patient followed a medication regimen?
Not necessarily. Detection delays, missed events, and the limits of what the system measures should be considered before drawing broader conclusions about adherence.
What privacy issues can arise from digital medication monitoring?
Potential issues include data collection and access, consent, cybersecurity, retention, unauthorized disclosure, and whether participation was voluntary.
What type of expert may be needed in a digital pill privacy dispute?
Depending on the issue, relevant expertise may include cybersecurity, digital forensics, health information privacy, medical-device engineering, software, or psychiatry. Some disputes may require more than one discipline.
Not all information generated by a health-related application or connected medical device is automatically protected by the Health Insurance Portability and Accountability Act of 1996, commonly known as HIPAA.
HIPAA applies to covered entities and their business associates. HHS explains that when an individual directs health information to an app that is neither a covered entity nor a business associate, the information may no longer be protected by the HIPAA Rules after the app receives it. An app developer or other entity that creates, receives, maintains, or transmits protected health information on behalf of a covered entity may instead be a business associate subject to HIPAA.
Information outside HIPAA is not necessarily unregulated. The Federal Trade Commission's Health Breach Notification Rule applies to certain vendors of personal health records and related entities that are not covered by HIPAA for the relevant activities. The FTC updated the rule in 2024 to clarify its application to health apps and similar technologies. Other laws may also apply depending on the facts and jurisdiction.
Digital pill privacy also raises a broader question: When is participation in medication monitoring genuinely voluntary?
Consent to medical treatment, permission granted through an application, and authorization to disclose protected health information are not interchangeable. Under HIPAA, covered entities may use or disclose protected health information for many treatment, payment, and healthcare-operations purposes without separate authorization, while certain other uses and disclosures require authorization subject to the Privacy Rule's requirements and exceptions.
Digital medication monitoring can introduce an additional decision about whether to use a monitored medication or monitoring system. Whether that choice is separate from the medication itself depends on the product, treatment setting, available alternatives, and applicable law.
Researchers have raised concerns about patient autonomy, privacy, data access, and other ethical implications of digital medication monitoring. Whether any particular arrangement is voluntary or legally permissible depends on its facts and the applicable law.
Relevant questions may include:
A digital medication system can involve several connected components, including an ingestible sensor, wearable device, smartphone application, wireless connection, database, cloud service, and provider portal. Each component may introduce different security risks.
The FDA's current medical-device cybersecurity guidance recommends cybersecurity risk-management practices for device design, development, and premarket submissions. Federal law also imposes specific cybersecurity requirements for certain premarket applications or submissions involving devices that meet the statutory definition of a cyber device.
The 2025 510(k) summary for the Otsuka Digital Feedback Device describes encryption for data at rest and in transit, improved Bluetooth pairing security, and protections associated with software updates.
Those safeguards address specific cybersecurity risks, but they do not eliminate every security or privacy concern. A dispute may require analysis of:
The relevance of each factor depends on how the system operated and what conduct or incident is disputed.
Digital medication records may become relevant in disputes involving healthcare treatment, privacy, cybersecurity incidents, insurance, product performance, or other matters involving medication use.
A recorded ingestion event should not automatically be treated as conclusive evidence of medication adherence. The original Abilify MyCite labeling acknowledged that detection could be delayed and that some ingestions might not be detected.
When digital medication records are disputed, useful questions can include:
Technical evidence may document an event without necessarily establishing broader conclusions about medication use, patient behavior, or compliance.
No single expert discipline will fit every digital-pill dispute. The appropriate expertise depends on the technical, medical, privacy, or evidentiary issue involved.
For cybersecurity or digital-forensics issues, an expert may examine system logs, access records, metadata, encryption practices, and incident evidence to explain how information moved through the system and whether the technical evidence is consistent with an alleged unauthorized access or disclosure.
When the dispute centers on health-information privacy or HIPAA, an expert may analyze data flows, organizational roles, privacy policies, authorization records, and relevant operational practices. Any opinion remains subject to the expert's qualifications and the court's limits on legal-opinion testimony.
A medical-device, biomedical engineering, or software expert may analyze sensors, firmware, applications, communication protocols, and databases to distinguish documented device capabilities from assumptions about what an ingestion record means.
A psychiatry or clinical expert may be relevant when a dispute involves psychiatric treatment, medication management, clinical decision-making, monitoring practices, or a patient's clinical decision-making capacity. Whether legally valid informed consent was obtained is a separate question governed by the applicable law and the facts of the case.
In federal proceedings governed by the Federal Rules of Evidence, Rule 702 requires the proponent to demonstrate to the court that it is more likely than not that the rule's admissibility requirements are satisfied. The testimony must, among other requirements, help the trier of fact, rest on sufficient facts or data, use reliable principles and methods, and reflect their reliable application to the facts.
An expert may explain specialized technical or professional issues. The permissible scope of opinions addressing legal standards or ultimate issues depends on the governing law and the court's evidentiary rulings.
Is Abilify MyCite still available in the United States?
The FDA's current Orange Book lists all six strengths of Abilify MyCite in the Discontinued Drug Product List. That listing does not by itself mean the FDA withdrew the product for safety or effectiveness reasons.
Are digital pill records protected by HIPAA?
Sometimes. HIPAA depends on whether the information is protected health information and whether the entity handling it is acting as a covered entity or business associate. Other federal or state privacy laws may apply outside HIPAA.
Does a digital pill prove that a patient followed a medication regimen?
Not necessarily. Detection delays, missed events, and the limits of what the system measures should be considered before drawing broader conclusions about adherence.
What privacy issues can arise from digital medication monitoring?
Potential issues include data collection and access, consent, cybersecurity, retention, unauthorized disclosure, and whether participation was voluntary.
What type of expert may be needed in a digital pill privacy dispute?
Depending on the issue, relevant expertise may include cybersecurity, digital forensics, health information privacy, medical-device engineering, software, or psychiatry. Some disputes may require more than one discipline.
Digital Evidence
Electronic Authentication
Information Security
Data Analysis
Medical Records Review
Expert Witness Insights by Area of Expertise
Expert Witness Insights by Area of Expertise