Liability for remote patient monitoring failures

Introduction

Remote Patient Monitoring (RPM) involves the collection and transmission of patient information outside traditional clinical settings through connected devices, mobile applications, wearable sensors, telehealth platforms, and other digital technologies. Data may include heart rate, blood pressure, oxygen saturation, glucose levels, temperature, or other health indicators.

Liability for RPM failures arises when inaccurate measurements, device malfunction, software failures, communication interruptions, inadequate clinical review, or delayed responses contribute to patient injury. Because RPM involves several interconnected actors, responsibility may potentially be divided among the device manufacturer, software developer, healthcare provider, monitoring service, clinician, telecommunications provider, and healthcare institution.

Duty of care in remote monitoring

A healthcare provider undertaking RPM generally assumes a duty to operate the monitoring system with reasonable professional care. The precise scope depends on the contractual arrangement, applicable professional standards, and the patient's circumstances.

The duty may include:

• selecting an appropriate monitoring system;
• ensuring that equipment is properly configured;
• establishing reasonable alert thresholds;
• ensuring that clinicians receive relevant alerts;
• reviewing clinically significant information within an appropriate timeframe;
• maintaining appropriate escalation procedures; and
• communicating with patients when intervention is required.

However, a provider does not necessarily guarantee that every abnormal physiological event will be detected.

Failure to respond to alerts

One of the most significant RPM risks is an unreviewed or delayed alert. A monitoring device may correctly identify an abnormal measurement, but if the alert is not transmitted, received, reviewed, or acted upon, the patient may suffer harm.

Liability may depend on which stage failed.

For example:

Patient → sensor → software → communication system → monitoring platform → clinician → intervention

A failure at any point can potentially contribute to injury.

The claimant must generally identify the relevant duty and establish that the failure fell below the applicable standard of care.

Clinician liability

A clinician responsible for reviewing RPM information may face professional-negligence liability where they fail to respond reasonably to clinically significant information.

Traditional medical-negligence principles remain relevant.

In Bolam v Friern Hospital Management Committee (1957), the court developed the traditional professional-standard approach. The principle was later qualified by Bolitho v City and Hackney Health Authority (1997), which emphasized that professional opinion relied upon in defending clinical conduct must withstand logical analysis.

Applied to RPM, a clinician may not necessarily be negligent simply because a different clinician would have responded differently. However, ignoring an obviously significant alert without a reasonable clinical explanation may expose the clinician or institution to liability.

Australian law: Rogers v Whitaker

In Rogers v Whitaker (1992) 175 CLR 479, the High Court of Australia addressed medical negligence and disclosure of material risks.

The case is relevant to RPM because digital monitoring does not eliminate traditional professional duties. A healthcare provider remains responsible for communicating material information and making appropriate clinical decisions within the circumstances.

The fact that data are collected automatically does not transfer all responsibility to the technology.

Device manufacturer liability

A medical device manufacturer may potentially be liable when an RPM device is defective.

Potential defects include:

• inaccurate sensors;
• unreliable measurements;
• defective alarms;
• inadequate instructions;
• software errors;
• insufficient validation;
• cybersecurity vulnerabilities affecting functionality; or
• failure to warn about material limitations.

Product-liability principles may apply depending upon the jurisdiction and whether the device qualifies as a regulated medical device.

In the United States, the Food and Drug Administration (FDA) regulates many medical devices, including certain remote-monitoring technologies. Regulatory compliance may be relevant evidence but does not automatically resolve every civil-liability issue.

Software and algorithmic failures

RPM systems increasingly use software to filter data and determine whether an alert should be generated.

An algorithm may therefore:

• incorrectly classify a dangerous reading as normal;
• generate excessive false alarms;
• suppress clinically important information;
• fail after a software update; or
• malfunction because of inaccurate patient data.

Responsibility may potentially rest with the developer, healthcare institution, or both, depending on contractual arrangements and the foreseeability of the failure.

The central issue is whether the system was reasonably designed, validated, implemented, and maintained for its intended medical purpose.

Communication failures

Remote monitoring depends upon reliable communication between the patient's device and the monitoring service.

A failure may occur because of:

• loss of internet or cellular connectivity;
• incorrect device pairing;
• battery failure;
• server outage;
• data-transfer error;
• incompatible software updates; or
• failure to notify clinicians that monitoring has stopped.

Healthcare providers should therefore establish procedures for identifying when monitoring becomes inactive.

A patient may reasonably assume that a monitoring service is functioning unless appropriately informed otherwise. Consequently, failure to notify a patient of a material monitoring interruption can become legally significant where foreseeable harm follows.

Institutional liability

Hospitals and healthcare organizations may face vicarious liability for negligent conduct by employees or agents. They may also face direct liability for systemic failures such as inadequate training, defective monitoring protocols, insufficient staffing, or poor implementation.

For example, if a hospital establishes an RPM program without ensuring that alerts are reviewed within an appropriate timeframe, the problem may be institutional rather than attributable solely to an individual clinician.

Respondeat superior and institutional responsibility

In the United States, respondeat superior may make an employer responsible for torts committed by employees acting within the scope of employment.

The doctrine does not necessarily make the employer liable for every technological failure. Courts must examine the employment relationship and the specific conduct involved.

Healthcare institutions may also face direct negligence claims concerning their own systems and policies.

Causation

Causation is often the most difficult issue in RPM litigation.

A claimant must generally establish that the monitoring failure materially contributed to the injury.

For example, suppose an RPM device fails to transmit an abnormal cardiac reading. The patient later suffers a serious event. The claimant may need expert evidence showing that timely transmission and clinical intervention would probably have prevented or reduced the injury.

If the medical outcome would have occurred even with timely monitoring, causation may not be established.

Daubert and scientific evidence

In Daubert v. Merrell Dow Pharmaceuticals, Inc. (1993), the U.S. Supreme Court addressed the admissibility of scientific expert testimony.

RPM litigation can require sophisticated expert evidence concerning device reliability, algorithmic performance, clinical thresholds, signal quality, and medical causation. Courts may therefore scrutinize whether proposed expert opinions are based on reliable scientific methodology.

Product warnings and learned intermediary considerations

RPM manufacturers may have duties to provide adequate instructions and warnings concerning limitations of their products.

The learned intermediary doctrine, traditionally associated with pharmaceutical products, may sometimes be relevant by analogy where healthcare professionals serve as intermediaries between manufacturers and patients. However, the doctrine does not automatically eliminate a device manufacturer's liability for defective design, inadequate instructions, or other product defects.

Australian consumer protection

In Australia, the Australian Consumer Law (ACL) may be relevant to certain products and services. Depending upon the circumstances, guarantees concerning acceptable quality, fitness for purpose, and other statutory protections may apply.

Therapeutic goods and medical devices are also subject to regulation under the Therapeutic Goods Act 1989 (Cth) and associated regulatory frameworks.

Healthcare organizations should therefore consider both professional negligence and statutory consumer protections when implementing RPM systems.

Case law

Bolam v Friern Hospital Management Committee (1957) — establishes the traditional professional standard relevant to medical negligence.

Bolitho v City and Hackney Health Authority (1997) — requires professional clinical reasoning relied upon by defendants to be logically defensible.

Rogers v Whitaker (1992) — Australian authority concerning medical duty and material risk disclosure.

Donoghue v Stevenson (1932) — foundational duty-of-care principles relevant to manufacturers and foreseeable users.

Grant v Australian Knitting Mills (1936) — Australian product-liability authority concerning defective products and consumer injury.

Daubert v Merrell Dow Pharmaceuticals (1993) — important authority concerning reliability of expert scientific evidence.

These cases predate modern RPM systems, but their principles can be adapted to disputes involving connected medical technologies.

Allocation of liability

Responsibility can be divided according to the stage at which failure occurred:

The ultimate allocation depends upon the governing jurisdiction, contractual relationships, evidence, and causation.

Governance safeguards

A robust RPM program should include:

• validated medical devices;
• documented clinical alert thresholds;
• reliable data transmission;
• real-time system-status monitoring;
• clear responsibility for reviewing alerts;
• escalation protocols;
• backup communication mechanisms;
• clinician training;
• cybersecurity protections;
• audit logs;
• regular system testing;
• patient instructions; and
• procedures for notifying patients when monitoring becomes unavailable.

Importantly, organizations should avoid creating a monitoring arrangement that implies continuous clinical supervision when the service does not actually provide it.

Conclusion

Liability for remote patient monitoring failures is governed primarily through existing principles of medical negligence, product liability, institutional responsibility, consumer protection, professional standards, and causation.

The critical legal question is usually not simply whether technology failed, but which actor had responsibility for preventing the failure and whether reasonable precautions would have prevented the resulting harm.

Cases such as Bolam, Bolitho, Rogers v Whitaker, Donoghue v Stevenson, Grant v Australian Knitting Mills, and Daubert provide foundational principles for assessing professional duties, manufacturer responsibility, scientific evidence, and causation.

Effective RPM governance should therefore establish a clearly documented chain of responsibility from patient device → data transmission → software → monitoring service → clinician → clinical intervention. Where a foreseeable failure occurs within that chain and causes preventable injury, the responsible parties may face legal liability according to their respective duties and contributions.