I don't know the actual legality. But here's what I do know from attempting to implement multiple projects within the US for clinical care and for clinical research: most providers, hospitals, and pharmaceutical companies we have worked with have balked at the ability to have high resolution data fed into their medical record or research data systems. In most cases, they are worried that if they had the data, they would have to act on it were something to be concerning. And they do not want that responsibility.
Example: we were in talks to feed in near-realtime blood glucose, activity, and blood pressure measurements from patients on a clinical trial. Surely that would be useful for better sussing out the effects of a research drug than the current process (patient comes in every few months to get measured or have their log data entered or meter data downloaded)? Nope, multiple top 5 pharma companies didn't want the responsibility and liability of seeing their data that often, because what if a patient had super low or super high glucose and they later died? You had the ability to act on it but didn't.
They'd rather just not have it at all. It sounds ridiculous. And again, I don't know the actual legal/liability issues, but based on my experience with malpractice cases, I could see a viable case to be made. And there are certainly institutions out there who believe the benefit is worth the cost of that responsibility for certain use cases. But my experiences have definitely made me reconsider some of these things.
All that said, I am definitely in favor of collecting more health data (somehow), because until we have more data we won't know its utility. So far, in general it has been shown that more testing and more information often doesn't lead to better outcomes, but the cost of data is getting lower -- aside from aforementioned liability cost/fear.