Data liberation advocate Hugo Campos has scored a small victory in his ongoing battle to gain access to potentially life-saving data generated from the implantable cardioverter-defibrillator in his chest. Campos now gets XML files of reports from his defibrillator after device manufacturer Medtronic agreed to supply Campos' doctors at Stanford Hospital & Clinics with a script to run in Medtronic's Paceart cardiac device management software.

But Campos still feels like this was only a small victory in his longstanding struggle – a victory that came about almost by accident.

On June 1, Medtronic CEO Omar Ishrak sent out an almost innocuous tweet discussing his experience with a popular fitness app. "Using Runtastic to track progress with running; find it motivating & pushes me to improve. Here is my morning run," Israk tweeted, along with a screen shot with the data from the run.

Four days later, Campos shot back: "@MedtronicCEO Thumbs up on using #mHealth apps to track progress. Thumbs down for not giving same access to patients with your devices #FAIL."

Fellow "empowered patients" Dave deBronkart and Casey Quinlan also chimed in. "@MedtronicCEO Glad u feel motivated by seeing yr Runtastic device data. See the irony, compared to your not letting @HugoOC see his? (Srsly)," wrote deBronkart, who is well known as "ePatient Dave." (DeBronkart's tweet has been retweeted seven times and named a favorite by five people.)

"I thought it was incredibly ironic," Campos said in an interview with MobiHealthNews.

Campos, of Oakland, Calif., has the Medtronic device to treat his hypertrophic cardiomyopathy – abnormally thick heart muscles that make the heart work harder to pump blood – since 2007. "It's potentially saved my life a couple of times," Campos said of the defibrillator.

A founding board member of the Society for Participatory Medicine, Campos said he has been asking Medtronic for access to the raw data from the implanted device since 2008, so the tweet to Ishrak was not the first communication Campos has had with the Minneapolis-based company. However, it seems to have gotten the ball rolling.

Ishrak, whom Campos has never met, sent a direct Twitter message to the patient not long after the public exchange: "Thanks @HugoOC for your continued input. I've asked my team to work with you on these issues." Campos confirmed that Medtronic did in fact follow up, and that led to the release of the XML files via the Stanford arrhythmia clinic.

"It was helpful," Campos said of the Paceart script, but he still feels unsatisfied. "In my mind, I thought, 'Well played,'" he reported. "It gave me something to gnaw on."

However, he said the reports are incomplete and incremental, kind of like an incremental backup of a hard drive or database that only reflects changes made since the last report. "I was not empowered by this," said Campos, who was a guest on a MobiHealthNews podcast in February. "Control still rests in the hand of the provider. It's still a billable service."

From the device-maker's perspective, the data might have competitive value as well, which is why Medtronic does not make any of it available through its patient portal. Campos said the portal "provides absolutely no information of use to patients," just informing them of the date of the next query and data upload from the implant. "This would be a perfect place for a Blue Button," Campos said, referring to a federal initiative to streamline patient downloading of their own records.

And therein lie two core issues: money and control. In a fee-for-service environment, hospitals and practices naturally will fight to preserve revenue streams from interpreting device data. Campos understands the concern healthcare professionals might have about patients engaging in self-diagnosis from complex medical devices, but dismissed that argument. "I believe it that it's much more harmful to not have information," he said.

"It's a big cultural change that we need to go through," Campos added. Even with the possibility of earning extra revenue from interpreting Campos' data, the clinic might view him as a difficult patient because he is asking his providers to do more work. "I don't enjoy being put in this position," Campos said.

"Are we even ready for participatory medicine?" he wondered.

The debate also is a matter of ownership rights, according to Campos. "The device is paid for and it's part of me," he noted. "It's more intimate than my mobile phone."

Interestingly, as Campos himself has said, breakthroughs such as the low-cost AliveCor ECG-on-a-smartphone are blurring some of the lines between medical device and mobile phone. This is where regulation has not kept pace with innovation.

The Food and Drug Administration, of course, has had the digital health world on edge for some time waiting for a final guidance on mobile medical apps. The FDA does not, however, regulate data from implanted medical devices.

Also, while the HIPAA privacy rule, in force since 2002, expressly gives patients the right to view the contents of their medical records, data from medical devices is not considered part of the record. Reports generated by vendors like Medtronic do become part of the medical records, but only after a physician reviews and signs off.

"It's not right," Campos contended. "We need to start thinking of data rights."