By Jennifer K. Wagner<\/p>\n
<\/p>\n
On September 15, the Federal Trade Commission (FTC) issued a Policy Statement<\/a> \u201cOn Breaches by Health Apps and Other Connected Devices,\u201d the most recent step taken by the FTC to signal its interest in preventing abusive data practices and ensuring relevant consumer protections for digital health. This step came about through a 3-2 vote by the commissioners during an open commission meeting<\/a>.<\/p>\n <\/p>\n The focus of the statement is the Health Breach Notification Rule (HBN Rule), which we reported<\/a> last year in May 2020 was undergoing<\/a> a 10-year review by the FTC. During the 90-day public comment period, only 26 comments were submitted. Among them, for example, the American Medical Informatics Association (AMIA) criticized<\/a> the HBN rule as \u201cstructurally flawed\u201d and recommended that the FTC take the opportunity to develop guidance to clarify the scope of identifiable health information in a personal health record (PHR) and ultimately \u201creorient\u201d the HBN rule so that it is more suitable for the ever-changing digital health industry. The Healthcare Information and Management Systems (HIMSS) and Personal Connected Health Alliance (PCHAlliance) submitted joint comments<\/a>, describing the HBN Rule as \u201ca critical piece in a broader, overarching health data privacy regulatory system\u201d but also calling for the FTC to modernize its terminology to suit today\u2019s digital health environment. The CARIN Alliance expressed<\/a> its ongoing support for the HBN Rule, while the Connected Health Initiative suggested<\/a> broader legislative reform for data privacy was needed. It appears that only one Attorney General submitted public comments<\/a>: then California Attorney General Xavier Becerra\u2014notably now serving as Secretary<\/a> of the Department of Health and Human Services. In those comments, Becerra called upon the FTC to \u201calign\u201d the HBN Rule with the HIPAA rule on breach notifications, underscoring that such a tighter alignment \u201cbenefits consumers and serves Congress\u2019s intent.\u201d<\/p>\n <\/p>\n The FTC policy statement issued<\/a> this month was accompanied by comments or remarks by each of the commissioners. Commissioners Wilson<\/a> and Phillips<\/a> each filed dissenting statements criticizing the approach taken, with Wilson framing the statement not as a clarification but as an expansion of the HBN Rule and Phillips claiming the majority is \u201creimagining\u201d the scope and, in effect, circumventing \u201ctwo ongoing rulemaking processes.\u201d FTC Chair Khan\u2019s remarks<\/a> responded to the dissents and indicated the policy statement is \u201cconsistent with\u2014and, in fact, serves to clarify\u2014the FTC\u2019s earlier guidance\u201d on the HBN Rule. Commissioner Chopra\u2019s statement<\/a> called attention to the failures of predecessors on the Commission to enforce the HBN Rule and confirmed that the FTC has \u201cnot collected a single penny in penalties\u201d for consumer data breaches. In Commissioner Slaughter\u2019s prepared remarks<\/a>, she reminded everyone that the policy statement does not change the underlying law for the HBN Rule and made a bold closing, calling for the FTC to \u201clead a market shift towards data minimalism.\u201d<\/p>\n <\/p>\n The substance of the FTC Policy Statement<\/a> is straightforward. Apps that collect data from multiple sources through APIs (application programming interfaces) are covered by this rule. Breaches triggering the required notifications are any form of unauthorized access to individual\u2019s information, not merely malicious activity. Violations of the HBN Rule are punishable by civil penalties of up to $43,792 per violation per day. The FTC Policy Statement references the FTC Best Practices for Mobile Health App Developers<\/a> as well as the interactive tool<\/a> to help mobile health app developers understand which laws apply to their products issued five years ago in 2016.<\/p>\n <\/p>\n In the months and years ahead, we expect increasing attention by the FTC to digital health technologies. While the June 25, 2021 Supreme Court decision in Transunion LLC v. Ramirez<\/a> might have made it a bit trickier for the FTC to fulfill its consumer protection role, the digital health sector is an obvious target for more stringent enforcement of cybersecurity and privacy measures for the apps and platforms as well as closer scrutiny of mergers and acquisitions, data engineering practices, and health claims through the doctrinal lenses of anti-competition, fairness, and deception. Additionally, with President Biden\u2019s nomination of Alvaro Bedoya<\/a> to replace Commissioner Chopra at the FTC and increasing pressure from senators<\/a> for new consumer data privacy rulemaking, all signs point toward the FTC taking a more aggressive approach to ensure fairness in digital health.<\/p>\n <\/p>\n <\/p>\n Jennifer K. Wagner, J.D., Ph.D., is a solo practicing attorney and an assistant professor of law, policy & engineering at Pennsylvania State University. She is a former contributing editor of the Genomics Law Report and has published scholarly articles in prominent legal and scientific journals, including the Journal of Law & Biosciences; Journal of Law, Medicine, & Ethics; Albany Law Journal of Science & Technology; Virginia Sports and Entertainment Law Journal; North Carolina Journal of Law and Technology; Nature Communications; Nature Medicine; American Journal of Human Genetics; Genetics in Medicine; and PLOS Genetics. She served as a AAAS Congressional Fellow in a U.S. Senator\u2019s office in 2014-2015, and her work has been cited by the Supreme Court of the United States. You may follow her on Twitter<\/a> as @DNAlawyer. Views expressed are her own. Dr. Wagner discloses she has related research on Consumer Protections for Genomics & Precision Health funded by NHGRI Grant No. R01HG0011051.<\/p>\n","protected":false},"excerpt":{"rendered":" By Jennifer K. Wagner On September 15, the Federal Trade Commission (FTC) issued a Policy Statement \u201cOn Breaches by Health Apps and Other Connected Devices,\u201d the most recent step taken by the FTC to signal its interest in preventing abusive data practices and ensuring relevant consumer protections for digital health. This step came about
\n
Read More »<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[36,43,32],"tags":[],"_links":{"self":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts\/430"}],"collection":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/comments?post=430"}],"version-history":[{"count":2,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts\/430\/revisions"}],"predecessor-version":[{"id":432,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts\/430\/revisions\/432"}],"wp:attachment":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/media?parent=430"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/categories?post=430"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/tags?post=430"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}