by Libbie Canter, Anna D. Kraus, Elizabeth Brim, Ariel Dukes, Olivia Vega, and Jorge Ortiz

Top left to right: Libbie Canter, Anna D. Kraus, and Elizabeth Brim. 
Bottom left to right: Ariel Dukes, Olivia Vega, and Jorge Ortiz.
(Photos courtesy of Covington & Burling LLP)

On May 18, 2023, the Federal Trade Commission (“FTC”) announced a notice of proposed rulemaking (the “proposed rule”) to “strengthen and modernize” the Health Breach Notification Rule (“HBNR”).  The proposed rule builds on the FTC’s September 2021 “Statement of the Commission on Breaches by Health Apps and Other Connected Devices” (“Policy Statement”), which took a broad approach to when health apps and connected devices are covered by the HBNR and when there is a “breach” for purposes of the HBNR.  The proposed rule primarily would (i) amend many definitions that are central to the scope of the HBNR (e.g., “breach of security,” “health care provider,” and “personal health record”), and (ii) authorize expanded means for providing notice to consumers of a breach and require additional notice content. According to the FTC, these changes to the HBNR would ensure the HBNR “remains relevant in the face of changing business practices and technological developments.”  Below, we provide a brief summary of the history of the HBNR leading up to this proposed rule, a brief summary of the proposed rule, and a timeline for commenting.

Brief Background

The HBNR was promulgated in 2009 under the HITECH Act.  Under the HBNR, vendors of personal health records that are not otherwise regulated under HIPAA are required to notify individuals, the FTC, and, in some cases, the media following a breach involving unsecured identifiable health information.  When the HNBR was first promulgated, the term “breach” was understood to encompass traditional cybersecurity incidents, such as the hack of system by a bad actor or the loss of company equipment containing identifiable health information.  Third-party service providers also are required to notify covered vendors of a breach.  (As background, “unsecured” health information is information that is not secured through technologies or methodologies specified by the Department of Health and Human Services, primarily encryption for electronic information.)  

In 2021, the Policy Statement adopted a significantly broader interpretation of the HBNR.  Specifically, the Policy Statement specified that (1) a developer of any digital health solution that is “capable of drawing information from multiple inputs” is a vendor of a personal health records subject to the HBNR, and (2) the developer of a health app or connected device is a “health care provider” because it “furnish[es] health care services or supplies.”  Additionally, the Policy Statement specified that a “breach” for purposes of the HBNR is triggered not only by a cybersecurity incident, but also when “a health app, for example, discloses sensitive health information without users’ authorization.”

Since the issuance of the Policy Statement, the FTC has brought its first two enforcement actions under the HBNR, leveraging its broad interpretation of the meaning of “breach.”  For more information, see our blog posts on the GoodRx and Easy Healthcare enforcement actions. 

Key Provisions

• Updated Definitions: The proposed rule would amend existing definitions and create new definitions to “clarify that that mobile health applications are covered by the” HBNR and expand the types of events that trigger notice requirements.  Some takeaways include:
• • A revised “personal health records identifiable information” definition that the FTC believes will cover traditional health information, health information derived from consumers’ interactions with apps and other online services (i.e., health information generated from tracking technologies on websites or apps), and emergent health data (i.e., health information inferred from non-health-related data, such as location and recent purchases). A new “health care provider” definition that includes a provider of medical or other health services, or any other entity furnishing “health care services or supplies” (i.e., websites, apps, and Internet-connected devices that provide mechanisms to track health conditions, medications, fitness, sleep, etc.). A revised “personal health record related entity” definition that, among other things, specifies that only entities that access or send unsecured personal health record identifiable health information (rather than entities that access or send any information) to a personal health record qualify as a “personal health record related entity.”  Examples of devices that could qualify as a personal health record related entity include “[r]emote blood pressure cuffs, connected blood glucose monitors, and fitness trackers . . . when individuals synch [the device] with a personal health record (i.e., mobile health application).” A revised “personal health record” definition that adopts the Policy Statement’s view that a product is a personal health record if it “has the technical capacity to draw information” from multiples sources. This means that an app constitutes a personal health record, for example, if it has the capacity to accept user input and sync with a wearable sleep monitor.  The revised definition clarifies that the app will still be a personal health record even if the user never actually syncs the app with the sleep monitor.  It also clarifies that an app is still a personal health record if it can draw any information from multiple sources, even if it receives health information from only one source.
  • A modified “breach of security” definition, building on the Policy Statement and recent enforcement actions, which clarifies that the HBNR covers not only cybersecurity incidents, but also includes unauthorized disclosures of consumer health information to third parties.

• Method of Notice and Content: The proposed rule would allow vendors of personal health records that discover a breach to provide written notice via electronic email if the consumer has specified electronic email as the primary contact method.  The FTC would require, however, that a notification sent via email be sent in combination with a text message, within-application message, or electronic banner.  In addition, the FTC’s proposal would modify the content of the required notice to, among other things, require information about the potential harm stemming from the breach and the names of any third parties who might have acquired unsecured personally identifiable health information.  The FTC has developed and provided a model notice.

Comment Period

Stakeholders interested in commenting on the proposed rule will have 60 days from the date that the notice is published in the Federal Register.  

Libbie Canter is a Partner, Anna D. Kraus is Of Counsel, and Elizabeth Brim, Ariel Dukes, Olivia Vega, and Jorge Ortiz are Associates at Covington & Burling LLP. This post originally appeared on the firm’s blog.

The views, opinions and positions expressed within all posts are those of the author(s) alone and do not represent those of the Program on Corporate Compliance and Enforcement (PCCE) or of the New York University School of Law. PCCE makes no representations as to the accuracy, completeness and validity or any statements made on this site and will not be liable any errors, omissions or representations. The copyright or this content belongs to the author(s) and any liability with regards to infringement of intellectual property rights remains with the author(s).