The FDA’s strategic vision for monitoring high-risk medical devices emphasizes the role of postmarket registries. Registries are cost-effective relative to traditional clinical trials and can enroll large numbers of patients to provide generalizable observations and identification of safety events. Although they differ in their structure, study goals, and stewardship, registries facilitate advancements in device use, manufacture, and design. Registries are particularly useful for cardiovascular devices. The FDA and CMS can mandate postmarket registries as a condition of approval or reimbursement, respectively. However, some registries involve compulsory enrollment with no opt-out mechanism. Although regulators provide some guidance and oversight on study design, there has been little evaluation of the legal and ethical implications of compulsory medical device registries. In particular, it is unclear whether compulsory registries accord with health privacy laws and ethical standards for human subjects research. We discuss the emerging and integral role of registries in FDA’s medical device postmarket repertoire and evaluate the applicability of HIPAA, state health privacy laws, and the Common Rule to compulsory registries. We assess whether compulsory registries satisfy fundamental ethical principles, and propose guidelines for registry development, including rules for enrollment, consent, data use, and access to data.