How do you know? If they're doing tracking where tracking isn't necessary and don't disclose the full extent of tracking under some penalty for lying, then maybe the machine does have a microphone in it? How would you know without taking it apart? It's not like the doctor or device manufacturer are trustworthy on the privacy front.
That perception worries me. Medical information is confidential, it's the only reason doctors are trusted with such data. If this fundamental principle is corrupted, then nobody in healthcare can be trusted.
I've been involved in medical device development for close to two decades. It's like pulling teeth to get data collected and sent off remotely because it raises the device manufacturing cost, increases device development cost to add those features (and yeah, security is being taken a lot more seriously these days), raises operational cost because you either need your own server farm or to pay for a HIPAA-compliant online database, there's more work to be done in developing a frontend for the clinicians to view and use the data, etc.
In short, no one is adding cell data upload to a device on a whim. I remember a device I worked on a year ago that decided to avoid this although it was expected that many of the users would be in remote areasor had mobility problems. Instead the customer decided to store data on an SD card (need to record results from the patient so their therapy could be adjusted as needed) and have the clinician download it from the device (they made weekly visits) using a tablet that would then email it directly to the physican who prescribed the device.
I understand that we're all losing trust, but this is getting ridiculous.
The problem starts when third parties are involved. Now I've got a CPAP with a cellular modem in it. Where is that data going? Who's processing it? Who are they sharing it with? What are the security precautions? Can they change settings without me knowing? At least the thing doesn't have a microphone on it too...
Even beyond medical privacy, I've now got a device that reports where I am and when I'm asleep, to who-knows-who. That's a wealth of data and I have no idea who it's being shared with. I realize that my cellphone is an even better surveillance device, but I trust my cellphone provider a lot more than I trust all the companies involved in CPAP manufacture and monitoring. Google and Apple are a whole lot better at security than some medical company that outsources data management.