September 24, 2021

FTC Clarifies That Health Apps Have A Duty To Report Data Security Breaches

Bernard Nash

Cozen O'Connor

+ Follow Contact

Facebook

Send

Embed

Cozen O'Connor

The Federal Trade Commission (“FTC”) issued a policy statement clarifying that health apps that collect or use consumers’ health information are subject to the Health Breach Notification Rule’s notification requirements when the consumer data they collect is subject to unauthorized access.
The FTC’s policy statement notes that the American Recovery and Reinvestment Act of 2009 directed the FTC to ensure that web-based companies contact customers in the event of a data security breach and that, pursuant to the Act, the FTC issued the Health Breach Notification Rule (“Rule”), which requires vendors of personal health records to notify consumers and the FTC when such a breach occurs. The Rule is intended to ensure that entities who are not covered by the Health Insurance Portability and Accountability Act (“HIPAA”) are still accountable for the safety of consumers’ health information.
According to the FTC, health apps and wearable devices, which collect such sensitive and personal data as glucose levels, sleep cycles, heart health, and fertility, are increasingly targeted by scammers and hackers, but many apps do not have adequate privacy protections in place. Therefore, the FTC provided the policy statement to clarify the scope of the Rule, such that health apps and connected devices that can draw information from multiple sources (such as a wearable device and a user’s smartphone) must also comply with the Rule, and going forward it potentially subjects violators to monetary penalties of up to $43,792 per violation per day.

Send Print Report

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.