The FTC’s recent policy statement on the Health Breach Notification Rule (the “Rule”) substantially impacts the consumer-facing digital health industry by significantly expanding (a) the scope of entities subject to the Rule and (b) data practices that constitute a breach. Under the new guidance, any entity that collects health data from both a connected device and the consumer (excluding entities already subject to HIPAA) will be treated as a “vendor of Personal Health Records” (“PHR Vendor”) subject to the Rule. Moreover, PHR Vendors that share such information without the individual’s authorization will trigger the Rule’s breach notification requirements.
The Rule applies to PHR Vendors, PHR related entities, and their third party service providers that collect data about an individual from multiple sources – excluding entities that are subject to HIPAA. The “multiple sources” requirement was historically interpreted to require collecting information from more than one entity (such as from multiple distinct health apps). In its policy statement, however, the FTC explained that “multiple sources” also includes data collected from a single consumer through more than one mechanism – e.g., a health app may be a PHR Vendor if it collects information from a consumer directly and from a connected device the consumer uses in connection with the app. As another example, an app that collects health data directly from the consumer (e.g., blood...
In a 2017 piece in The New York Times, voting expert Ari Berman wrote, “The Voting Rights Act of 1965 outlawed tactics that prevented blacks, Hispanics and other minority groups from voting. But fo...