National Law Review January 20, 2022
Gicel Tomimbang, Kristin L. Bryan, Elliot Golding

The FTC’s recent policy statement on the Health Breach Notification Rule (the “Rule”) substantially impacts the consumer-facing digital health industry by significantly expanding (a) the scope of entities subject to the Rule and (b) data practices that constitute a breach. Under the new guidance, any entity that collects health data from both a connected device and the consumer (excluding entities already subject to HIPAA) will be treated as a “vendor of Personal Health Records” (“PHR Vendor”) subject to the Rule. Moreover, PHR Vendors that share such information without the individual’s authorization will trigger the Rule’s breach notification requirements.

PHR Vendors Include Health Apps, Too

The Rule applies to PHR Vendors, PHR related entities, and their third party service providers that...

Today's Sponsors

LEK
ZeOmega

Today's Sponsor

LEK

 
Topics: Apps, Cybersecurity, Digital Health, Govt Agencies, Health IT, HIPAA, mHealth, Patient / Consumer, Provider, Technology
OpenAI Launches ChatGPT Support for More Apple Desktop Apps
Every Choice Matters: Data Security And Privacy On AI-Enabled Apps
10 New AI Apps That Deserve Your Attention
AI-enabled apps top ECRI’s list of health tech hazards in 2025
Opinion: Mental health apps need a complete redesign

Share This Article