I have a semi-related anecdote about surprises from devices. I use a CPAP. After a year, I went back to the doctor for a followup, and was asked to bring the SD card so they could review the data it collects. The device records the times and duration of use, various settings, and some metrics on breathing (apnea events, etc). I knew it recorded this stuff on an SD card. I brought the card to the appointment, but the…
I should think that perhaps the legal requirements should be:
1. Its capability of wireless communcation, and a brief description of what it does, and the power and frequency it uses, should be clearly marked on the package.
2. The included documentation should need to describe the details of the wireless communication, including whatever is mentioned on the package.
3. There should be required it can be disabled without disabling its other functions, and this feature must be documented.
The other things that you mention too, should be applicable. I agree with you that "I don't agree with the undisclosed enforcement mechanism, nor do I agree that treatment should be contingent on monitoring" and that "This is insanely invasive, even with disclosure, and ought to be illegal without explicit, obvious verbal and written disclosure".
The medical devices should not be doing such surveillance (and medical devices should ideally not require a computer, either).