On September 15, the Federal Trade Commission (“FTC”) and U.S. Department of Health and Human Services (“HHS”) announced an updated joint publication describing the privacy and security laws and rules that impact consumer health data. Specifically, the “Collecting, Using, or Sharing Consumer Health Information? Look to HIPAA, the FTC Act, and the Health Breach Notification Rule” guidance provides an overview of the Health Insurance Portability and Accountability Act, as amended, and the implementing regulations issued by HHS (collectively “HIPAA”); the FTC Act; and the FTC’s Health Breach Notification Rule (“HBNR”) and how they may apply to businesses. This joint guidance follows a recent surge of FTC enforcement in the health privacy space. We offer a high level summary of the requirements flagged by the guidance.
- HIPAA: The guidance reminds businesses that HIPAA applies to covered entities (i.e., health plans, health care providers that conduct standard health care transactions electronically, or health care clearinghouses) and their business associates (i.e., companies that provide services that involve access to or maintenance of protected health information (“PHI”)) and provides an overview of HIPAA’s implementing regulations (i.e., the Privacy Rule, the Security Rule, and the Breach Notification Rule). The guidance places particular emphasis on the requirement to obtain individual authorization to collect, use, or disclose PHI, or, with respect to business associates, to enter into a business associate agreement to receive PHI from a covered entity.
- FTC Act: The guidance reminds businesses that the FTC Act, which applies to business entities whether or not they are subject to HIPAA, prohibits misleading consumers about the use or disclosure of their health information. At a general level, the guidance advises business to periodically review their data policies, procedures, and practices to (1) ensure consumer health data is secure, and (2) confirm any representations made to consumers about their health data are clear and conspicuous and consistent with actual practice. In addition to these general guidelines, the guidance also contains a number of specific examples of actions that may trigger FTC Act compliance concerns. With respect to HIPAA, the guidance flags that “if the information surrounding your HIPAA authorization is deceptive or misleading (such as by implying that to receive treatment, the consumer must agree to have their data used for advertising purposes), then that’s a violation of the FTC Act.” The guidance also reminds businesses that they should not falsely assert HIPAA compliance, which was an issue raised in the FTC’s enforcement action against GoodRx, and should ensure that any claims about deleting personal information upon request align with the business’s actual practice.
- HBNR: The guidance explains that the HBNR applies to certain entities not covered by HIPAA (i.e., vendors of personal health records (“PHR”), PHR related entities, and third party service providers), including health apps and other connected devices. The HBNR requires such entities to notify individuals, the FTC, and, in some cases, the media following a breach involving unsecured identifiable health information. Under the HBNR, a “breach” includes not only cybersecurity incidents, but also unauthorized disclosures of consumer health information. The guidance aligns with the FTC’s September 2021 “Statement of the Commission on Breaches by Health Apps and Other Connected Devices.”
The guidance encourages businesses offering health apps to review the FTC-HHS Mobile Health App Interactive Tool, which is a questionnaire designed to help mobile health app developers identify federal laws and regulations that may apply to their products, as well as the FTC’s best practices guidance for mobile health app developers and the HHS Office for Civil Rights’ resources for mobile health apps developers.