The FDA Will Now Accept Real-World Evidence for Devices Without the Patient Records Behind It

On December 16, 2025, the FDA finalized a change to what companies must hand over. In a bulletin from the agency’s newsroom and the guidance it accompanied, the FDA said it will accept real-world evidence for certain medical devices “without requiring that identifiable individual patient data collected from real-world data sources always be submitted.” The strength of that evidence gets judged case by case now. Commissioner Marty Makary called it a favor to patients: “We’re removing unnecessary barriers that have prevented us from using powerful real-world evidence to get life-changing treatments to patients faster.”

Read the sentence again with the eye of an auditor rather than a patient. The agency did not say the underlying records would be examined and then withheld for privacy. It said the identifiable, patient-level data no longer has to arrive with the submission. What arrives is the finished product. The work that produced it happens somewhere no reviewer is guaranteed to look.

Real-world data is what it sounds like: the exhaust of ordinary care, pulled from electronic health records, insurance claims, and registries, then cleaned, normalized, coded, and reshaped into something a regulator will accept. That transformation, from a messy chart to a “regulatory-grade” dataset, is not neutral. Someone decides which patients count, how a missing value gets filled, what a cause of death was, when a tumor “progressed.” Those decisions are made almost entirely inside private companies, under proprietary methods, before any outside researcher or reviewer sees the file. The investigative journalist and former medical researcher Maryanne Demasi laid the problem out in the second part of her series on real-world data: if neither researchers nor independent reviewers can trace the numbers back to the original medical records, no one can say whether they hold up. The December change pushes the traceable copy further out of reach.

Consider who holds the data. IQVIA, one of the largest curators, reports operations in more than 100 countries and more than $15 billion in annual revenue, and advertises access to more than 1.2 billion non-identified patient records. Komodo Health markets a “Healthcare Map” it describes as more than a trillion linked clinical records covering more than 330 million patients, refreshed daily. In oncology, the field where real-world evidence has moved fastest into regulatory decisions, the dominant curator is Flatiron Health, which Roche acquired in 2018 in a deal valued at about $1.9 billion.

Now the ownership. Roche is a drugmaker. Roche submits products to the FDA. Roche owns the company that curates the real-world data used to judge products like Roche’s, and Flatiron has held a multi-year research collaboration with the FDA’s Oncology Center of Excellence to help define what “regulatory-grade” even means. None of this is hidden; it is announced in press releases. The documents establish a structure in which the same commercial ecosystem that profits from an approval also builds and validates the instrument that measures it. They do not show that any dataset was cooked. They show something harder to shrug off: the instrument is proprietary, the incentives point one direction, and the party best placed to check the work is the party being checked.

We have seen what a closed database does when it drives policy. In May 2020, a company called Surgisphere supplied the data for a study in The Lancet reporting that hydroxychloroquine raised the risk of death in COVID-19 patients. Governments paused trials on the strength of it. Within weeks, the co-authors who did not work for Surgisphere asked to inspect the raw data and were refused; the company would not release the full dataset for an independent audit, citing client confidentiality. The Lancet retracted the paper and the New England Journal of Medicine retracted a companion study, because the authors could no longer vouch for the veracity of the primary sources. Hospitals said to have contributed records had never heard of the company.

No built-in verification system caught that. Outsiders caught it, because they could still demand the data, and when they were told no, the “no” was the tell. The December guidance rearranges exactly that. The refusal that exposed Surgisphere was only possible because the records were still expected to be producible on demand; confidentiality was the shield the company hid behind. The new rule takes a version of that shield and writes it into the front-door procedure. This is not a worry conjured by critics. Writing in the journal Leukemia in 2025, researchers asked plainly whether “real world data” is real world data at all, documenting how records shift as they move through commercial pipelines. The question is coming from inside the field.

The scale of the shift is still small, and worth stating precisely. Since 2016, 35 drugs, biologics, or vaccines have included real-world evidence in their applications, alongside more than 250 device authorizations. The change announced in December applies to devices. In the same document, the FDA said it “intends to consider updating its guidance for drugs and biologics.” Devices are the pilot. The prize is a system in which a drugmaker can support an approval with evidence distilled from records the regulator is no longer required to receive and outsiders cannot independently retrace.

Here is who has the data, and here is who does not. The vendors control the source records and the proprietary code that turns them into evidence, and the checks on that work happen inside the same companies. The FDA, under the new policy, can decline to take the patient-level source. The independent researchers who unraveled Surgisphere get the processed output and a description of the method, not the method itself. The agency has not said who audits the vendor pipelines, on what schedule, or whether any audit result is public. It has not required a trail that runs from a published figure back to a source record. And the extension to drugs and biologics, the one that would multiply the stakes, has not been written yet. That decision is still open. It is still waiting for someone in the building to say who, exactly, will be allowed to check the math.

Sources

1. FDA newsroom bulletin: de-identified real-world evidence for medical device submissions (December 16, 2025)
2. FDA: Use of Real-World Evidence to Support Regulatory Decision-Making for Medical Devices (finalized guidance)
3. Maryanne Demasi: The Real-World Data Dilemma, Part 2
4. The Lancet: retraction of the Surgisphere hydroxychloroquine registry study (2020)
5. Retraction Watch: Lancet and NEJM retract COVID-19 studies based on Surgisphere data (June 4, 2020)
6. Roche to acquire Flatiron Health (2018)
7. Flatiron Health: five-year research collaboration with the FDA on real-world data
8. IQVIA: corporate scale and real-world data holdings
9. Komodo Health: Healthcare Map platform overview
10. Leukemia (2025): “Are real world data real world data?”
11. Medical Design and Outsourcing: FDA eliminates the real-world evidence barrier in medical device reviews