The Federal Trade Commission recently announced revisions to its health data breach notification measures in a bid to protect individuals’ health information regardless of the platform or technology being used. This action addresses a gap in current regulations, as health apps are generally not covered by the Health Insurance Portability and Accountability Act (HIPAA).
The updates to the health breach notification final rule (RIN 3084-AB56) were issued on Friday and include changes to the definition of “public health record related entity” to clarify that these entities include individuals offering products and services online, such as mobile applications, or vendors of personal health records. This move by the FTC is significant as it aims to ensure that individuals’ health information is protected regardless of whether it is stored in a physical file cabinet or on a digital device.
By expanding the definition of entities subject to health data breach notification requirements, the FTC is taking proactive steps to safeguard sensitive health information and promote accountability in the digital health landscape. These updates aim to enhance privacy and security measures for consumers using health-related apps and technologies. Overall, this action by the FTC is an important step towards protecting individuals’ sensitive health information from unauthorized access.