Health Breach Notification Rule

Federal RegisterMay 30, 2024

Ask Donna

What actually matters in this document.

Text

FEDERAL TRADE COMMISSION

16 CFR Part 318

RIN 3084-AB56

Health Breach Notification Rule

AGENCY:

Federal Trade Commission.

ACTION:

Final rule.

SUMMARY:

The Federal Trade Commission (“FTC” or “Commission”) is amending the Commission's Health Breach Notification Rule (the “HBN Rule” or the “Rule”). The HBN Rule requires vendors of personal health records (“PHRs”) and related entities that are not covered by the Health Insurance Portability and Accountability Act (“HIPAA”) to notify individuals, the FTC, and, in some cases, the media of a breach of unsecured personally identifiable health data.

DATES:

The amendments are effective July 29, 2024.

ADDRESSES:

Relevant portions of the record of this proceeding, including this document, are available at

https://www.ftc.gov

and

https://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT:

Ryan Mehm, (202) 326-2918,

rmehm@ftc.gov,

and Ronnie Solomon, (202) 326-2098,

rsolomon@ftc.gov,

Bureau of Consumer Protection, Federal Trade Commission.

SUPPLEMENTARY INFORMATION:

The amendments: (1) clarify the Rule's scope, including its coverage of developers of many health applications (“apps”); (2) clarify what it means for a vendor of personal health records to draw PHR identifiable health information from multiple sources; (3) revise the definition of breach of security to clarify that a breach of security includes data security breaches and unauthorized disclosures; (4) revise the definition of PHR related entity; (5) modernize the method of notice; (6) expand the content of the notice; (7) alter the Rule's timing requirement for notifying the FTC of a breach of security; and (8) improve the Rule's readability by clarifying cross-references and adding statutory citations, consolidating notice and timing requirements, articulating the penalties for non-compliance, and incorporating a small number of non-substantive changes.

I. Background

Congress enacted the American Recovery and Reinvestment Act of 2009 (“Recovery Act” or “the Act”),

in part to advance the use of health information technology and, at the same time, strengthen privacy and security protections for health information. Recognizing that certain entities that hold or interact with consumers' personal health records were not subject to the privacy and security requirements of HIPAA,

Congress created requirements for such entities to notify individuals, the Commission, and, in some cases, the media of the breach of unsecured identifiable health information from those records.

Am. Recovery and Reinvestment Act of 2009, Public Law 111-5, 123 Stat. 115 (2009).

Health Ins. Portability and Accountability Act, Public Law 104-191, 110 Stat. 1936 (1996).

Specifically, section 13407 of the Recovery Act created certain protections for “personal health records” or “PHRs,”

electronic records of PHR identifiable health information on an individual that can be drawn from multiple sources and that are managed, shared, and controlled by or primarily for the individual.

Congress recognized that vendors of personal health records and PHR related entities (

i.e.,

companies that offer products and services through PHR websites or access information in or send information to personal health records) were collecting consumers' health information but were not subject to the privacy and security requirements of HIPAA. Accordingly, the Recovery Act directed the FTC to issue a rule requiring these non-HIPAA covered entities, and their third party service providers, to provide notification of any breach of unsecured PHR identifiable health information. The Commission issued its Rule implementing these provisions in 2009.

FTC enforcement of the Rule began on February 22, 2010.

42 U.S.C. 17937.

42 U.S.C. 17921(11).

74 FR 42962 (Aug. 25, 2009) (“2009 Final Rule”).

The Rule the Commission issued in 2009 (“2009 Rule”) requires vendors of personal health records and PHR related entities to provide: (1) notice to consumers whose unsecured PHR identifiable health information has been breached; (2) notice to the Commission; and (3) notice to prominent media outlets

serving a State or jurisdiction, in cases where 500 or more residents are confirmed or reasonably believed to have been affected by a breach.

The Rule also requires third party service providers (

i.e.,

those companies that provide services such as billing, data storage, attribution, or analytics) to vendors of personal health records and PHR related entities to provide notification to such vendors and entities following the discovery of a breach.

The Recovery Act does not limit this notice to particular types of media. Thus, an entity can satisfy the requirement to notify “prominent media outlets” by, for example, disseminating press releases to a number of media outlets, including internet media in appropriate circumstances, where most of the residents of the relevant State or jurisdiction get their news. This will be a fact-specific inquiry that will depend on what media outlets are “prominent” in the relevant jurisdiction. 74 FR 42974.

16 CFR 318.3, 318.5.

Id.

§ 318.3(b).

The 2009 Rule requires notice to individuals “without unreasonable delay and in no case later than 60 calendar days” after discovery of a data breach.

If the breach affects 500 or more individuals, notice to the FTC must be provided “as soon as possible and in no case later than ten business days” after discovery of the breach.

The FTC makes available a standard form for companies to use to notify the Commission of a breach,

and posts a list of breaches involving 500 or more individuals on its website.

Id.

§ 318.4(a).

Id.

§ 318.5(c).

Fed. Trade Comm'n, Notice of Breach of Health Information,

https://www.ftc.gov/system/files/documents/rules/health-breach-notification-rule/health_breach_form.pdf.

Fed. Trade Comm'n, Notices Received by the FTC Pursuant to the Health Breach Notification Rule,

https://www.ftc.gov/system/files/ftc_gov/pdf/Health%20Breach%20Notices%20Received%20by%20the%20FTC.pdf

(last visited Dec. 2, 2022).

The 2009 Rule applies only to breaches of “unsecured” health information, which the Rule defines as health information that is not secured through technologies or methodologies specified by the Department of Health and Human Services (“HHS”). The Rule does not apply to businesses or organizations covered by HIPAA.

HIPAA-covered entities and their “business associates” must instead comply with HHS's breach notification rule.

Per HHS guidance, electronic health information is “secured” if it has been encrypted according to certain specifications set forth by HHS, or if the media on which electronic health information has been stored or recorded is destroyed according to HHS specifications.

See

74 FR 19006;

see also

U.S. Dep't of Health & Human Servs.,

Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals

(July 26, 2013),

https://www.hhs.gov/hipaa/for-professionals/breach-notification/guidance/index.html.

PHR identifiable health information would be considered “secured” if such information is disclosed by, for example, a vendor of personal health records, to a PHR related entity or a third party service provider, in an encrypted format meeting HHS specifications, and the PHR related entity or third party service provider stores the data in an encrypted format that meets HHS specifications and also stores the encryption and/or decryption tools on a device or at a location separate from the data.

45 CFR 164.400 through 164.414.

Since the Rule's issuance, apps and other direct-to-consumer health technologies, such as fitness trackers and wearable blood pressure monitors, have become commonplace.

Further, as an outgrowth of the COVID-19 pandemic, consumer use of such health-related technologies has increased significantly.

See, e.g.,

Kokou Adzo,

App Development in Healthcare: 12 Exciting Facts,

TechnoChops (Jan. 3, 2023),

https://www.technochops.com/programming/4329/app-development-in-healthcare/;

Emily Olsen,

Digital health apps balloon to more than 350,000 available on the market, according to IQVIA report,

MobiHealthNews (Aug. 4, 2021),

https://www.mobihealthnews.com/news/digital-health-apps-balloon-more-350000-available-market-according-iqvia-report;

Elad Natanson,

Healthcare Apps: A Boon, Today and Tomorrow,

Forbes (July 21, 2020),

https://www.forbes.com/sites/eladnatanson/2020/07/21/healthcare-apps-a-boon-today-and-tomorrow/?sh=21df01ac1bb9.

See id. See also

Lis Evenstad,

Covid-19 has led to a 25% increase in health app downloads, research shows, ComputerWeekly.com

(Jan. 12, 2021),

https://www.computerweekly.com/news/252494669/Covid-19-has-led-to-a-25-increase-in-health-app-downloads-research-shows

(finding that COVID-19 has led to a 25% increase in health app downloads); Jasmine Pennic,

U.S. Telemedicine App Downloads Spikes During COVID-19 Pandemic,

HIT Consultant (Sept. 8, 2020),

https://hitconsultant.net/2020/09/08/u-s-telemedicine-app-downloads-spikes-during-covid-19-pandemic/

(“US telemedicine app downloads see dramatic increases during the COVID-19 pandemic, with some seeing an 8,270% rise YoY.”).

In May 2020, the Commission announced its regular, ten-year review of the Rule and requested public comment about potential Rule changes.

The Commission requested comment on, among other things, whether changes should be made to the Rule in light of technological changes, such as the proliferation of apps and similar technologies. The Commission received 26 public comments.

85 FR 31085 (May 22, 2020).

Comments are available at

https://www.regulations.gov/docket/FTC-2020-0045/comments.

Many of the commenters in 2020 encouraged the Commission to clarify that the Rule applies to apps and similar technologies.

In fact, no commenter opposed this type of clarification regarding the Rule's coverage of health apps. Several commenters pointed out examples of health apps that have abused users' privacy, such as by disclosing sensitive health information without consent.

Several commenters noted the urgency of this issue, as consumers have further embraced digital health technologies during the COVID-19 pandemic.

Commenters argued the Commission should take additional steps to protect unsecured PHR identifiable health information that is not covered by HIPAA, both to prevent harm to consumers

and to level the competitive playing field among companies dealing with the same health information.

To that end, commenters not only urged the Commission to revise the Rule, but also to increase its enforcement efforts.

E.g.,

Am. Health Info. Mgmt. Ass'n (“AHIMA”) at 2; Kaiser Permanente at 3; Allscripts at 3; Am. Acad. of Ophthalmology at 2; All. for Nursing Informatics (“ANI”) at 2; Am. Med. Ass'n (“AMA”) at 4; Am. Coll. of Surgeons at 6; Physicians' Elec. Health Rec. Coal. (“PEHRC”) at 4 (“Apps that collect health information, regardless of whether or not they connect to an EHR, must be regulated by the FTC Health Breach Notification Rule to ensure the safety and security of personal health information.”); Am.'s Health Ins. Plans (“AHIP”) and Blue Cross Blue Shield Ass'n (“BCBS”) at 2; The App Ass'n's Connected Health Initiative (“CHI”) at 3.

Kaiser Permanente at 7; The Light Collective at 2; Am. Acad. of Ophthalmology at 2; PEHRC at 2-3.

Lisa McKeen at 2-3; Kaiser Permanente at 7-8; AMA at 3; Off. of the Att'y Gen. for the State of Cal. (“OAG-CA”) at 3-4; Healthcare Info. and Mgmt. Sys. Soc'y (“HIMSS”) and Personal Connected Health All. (“PCH Alliance”) at 4-5.

Georgia Morgan; Am. Acad. of Ophthalmology at 2-3 (arguing that consumers do not know all the ways their data is being used by third parties, and the downstream consequences of data being used in this way may ultimately erode a patient's privacy and willingness to disclose information to his or her physician); Coll. of Healthcare Info. Mgmt. Exec.'s (“CHIME”) at 3 (arguing that apps' privacy practices impact the patient-provider relationship because providers do not know what technologies are sufficiently trustworthy for their patients); AMA at 2-3 (expressing concern that patients share less health data with health care providers, perhaps because of “spillover from privacy and security breaches”).

Kaiser Permanente at 2, 4; Workgroup for Elec. Data Interchange (“WEDI”) at 2; AHIP and BCBS at 3 (“[HIPAA] covered entities, such as health plans, that use or disclose protected health information should not be subject to stricter notification requirements than those imposed on vendors of personal health records or other such entities. Otherwise, the Federal government will be providing market advantages to particular industry segments with the effect of dampening competition and harming consumers.”).

Kaiser Permanente at 4; Fred Trotter at 1; Casey Quinlan at 1; CARIN Alliance at 2. At the time of this document's publication, the Commission has brought two enforcement actions under the Rule; the first against digital health company GoodRx Holdings, Inc., and the second against an ovulation-tracking mobile app marketed under the name “Premom” and developed by Easy Healthcare, Inc.

United States

GoodRx Holdings, Inc.,

No. 23-cv-460 (N.D. Cal. Feb. 17, 2023),

https://www.ftc.gov/legal-library/browse/cases-proceedings/2023090-goodrx-holdings-inc; United States

Easy Healthcare Corp.,

No. 1:23-cv-3107 (N.D. Ill. June 22, 2023),

https://www.ftc.gov/legal-library/browse/cases-proceedings/202-3186-easy-healthcare-corporation-us-v.

A. The Commission's 2021 Policy Statement

On September 15, 2021, the Commission issued a Policy Statement providing guidance on the scope of the Rule. The Policy Statement clarified that the Rule covers most health apps and similar technologies that are not covered by HIPAA.

The Rule defines a “personal health record” as “an electronic record of PHR identifiable health information on an individual that can be drawn from multiple sources and that is managed, shared, and controlled by or primarily for the individual.”

As the Commission explained in the Policy Statement, many makers and purveyors of health apps and other connected devices are vendors of personal health records covered by the Rule because their products are electronic records of PHR identifiable health information.

Statement of the Commission on Breaches by Health Apps and Other Connected Devices, Fed. Trade Comm'n (Sept. 15, 2021),

https://www.ftc.gov/system/files/documents/public_statements/1596364/statement_of_the_commission_on_breaches_by_health_apps_and_other_connected_devices.pdf

(“Policy Statement”).

16 CFR 318.2.

The Commission explained that PHR identifiable health information includes individually identifiable health information created or received by a health care provider,

and that “health care providers” include any entities that “furnish[ ] health care services or supplies.”

Because these health app purveyors furnish health care services to their users through the mobile applications they provide, the information held in the app is PHR identifiable health information, and therefore many health app purveyors likely qualify as vendors of personal health records.

Id.

§ 318.2, incorporating in part the definition from section 1171(6) of the Social Security Act (42 U.S.C. 1320d(6)).

Id.

§ 318.2; 42 U.S.C. 1320d(6), d(3).

See

Policy Statement at 1.

The Policy Statement further explained that the statute directing the FTC to promulgate the Rule requires that a “personal health record” be an electronic record that can be drawn from multiple sources.

Accordingly, health apps and similar technologies likely qualify as personal health records covered by the Rule if they are capable of drawing information from multiple sources. The Commission further clarified that health apps and other products experience a “breach of security” under the Rule when they disclose users' sensitive health information without authorization;

a breach is “not limited to cybersecurity intrusions or nefarious behavior.”

The Policy Statement provided this example: “[I]f a blood sugar monitoring app draws health information only from one source (

e.g.,

a consumer's inputted blood sugar levels), but also takes non-health information from another source (

e.g.,

dates from your phone's calendar), it is covered under the Rule.”

Id.

at 2.

16 CFR 318.2.

Policy Statement at 2. In the Statement of Basis and Purpose to the 2009 Final Rule published in the

Federal Register

(“2009 Rule Commentary”), the Commission, in addressing questions about how the extent of individual authorization should be determined, stated data sharing to enhance consumers' experience with a PHR is authorized only if such use is consistent with the entity's disclosures and individuals' reasonable expectations. For anything beyond such uses, the Commission expects vendors of personal health records and PHR related entities to limit the sharing of consumers' information, unless the consumers exercise “meaningful choice” in allowing sharing. The Commission believes burying disclosures in lengthy privacy policies does not satisfy the standard of “meaningful choice.” 74 FR 42967.

B. Enforcement History

In 2023, the Commission brought its first enforcement actions under the Rule against vendors of personal health records. In February 2023, the Commission brought an enforcement action alleging a violation of the Rule against GoodRx Holdings, Inc. (“GoodRx”), a digital health company that sells health-related products and services directly to consumers, including prescription medication discount products and telehealth services through its website and mobile applications.

United States

GoodRx Holdings, Inc.,

No. 23-cv-460 (N.D. Cal. Feb. 17, 2023),

https://www.ftc.gov/legal-library/browse/cases-proceedings/2023090-goodrx-holdings-inc.

In its complaint, the Commission alleged that between 2017 and 2020, GoodRx, as a vendor of personal health records, disclosed more than 500 consumers' unsecured PHR identifiable health information to third party advertising platforms like Facebook and Google, without the authorization of those consumers. As charged in the complaint, these disclosures violated explicit privacy promises the company made to its users about its data sharing practices (including about its sharing of PHR identifiable health information). The Commission alleged GoodRx broke these promises and disclosed its users' prescription medications and personal health conditions, personal contact information, and unique advertising and persistent identifiers. The Commission charged GoodRx with violating the Rule by failing to provide the required notifications, as prescribed by the Rule, to (1) individuals whose unsecured PHR identifiable health information was acquired by an unauthorized person, (2) the Federal Trade Commission, and (3) media outlets. 16 CFR 318.3 through 318.6. The Commission entered into a settlement that imposed injunctive relief and required GoodRx to pay a $1.5 million civil penalty for its alleged violation of the Rule.

In addition, the Commission alleged GoodRx's data sharing practices were deceptive and unfair, in violation of section 5 of the FTC Act.

Similarly, on May 17, 2023, the Commission brought its second enforcement action under the Rule against Easy Healthcare Corporation (“Easy Healthcare”), a company that publishes an ovulation and period tracking mobile application called Premom, which allows its users to input and track various types of health and other sensitive data. Similar to the conduct alleged against GoodRx, Easy Healthcare disclosed PHR identifiable health information to third party companies such as Google and AppsFlyer, contrary to its privacy promises, and did not comply with the Rule's notification requirements. The Commission entered into a settlement that imposed injunctive relief and required Easy Healthcare to pay a $100,000 civil penalty for its alleged violation of the Rule.

United States

Easy Healthcare Corporation,

No. 1:23-cv-3107 (N.D. Ill. June 22, 2023),

https://www.ftc.gov/legal-library/browse/cases-proceedings/202-3186-easy-healthcare-corporation-us-v.

C. Notice of Proposed Rulemaking

Having considered the public comments on the regulatory review notification and its Policy Statement, on June 9, 2023, the Commission issued a notice of proposed rulemaking (“NPRM”)

proposing to revise the Rule, 16 CFR part 318, in seven ways:

88 FR 37819 (“2023 NPRM”).

• First, the Commission proposed to revise several definitions in order to clarify the Rule and better explain its application to health apps and similar technologies not covered by HIPAA. Consistent with this objective, the NPRM modified the definition of “PHR identifiable health information” and added two new definitions (“health care provider” and “health care services or supplies”). These proposed changes were consistent with a number of public comments supporting the Rule's coverage of these technologies.

• Second, the Commission proposed to revise the definition of “breach of security” to clarify that a breach of security includes an unauthorized acquisition of PHR identifiable health information in a personal health record that occurs as a result of a data security breach or an unauthorized disclosure.

• Third, the Commission proposed to revise the definition of “PHR related entity” in two ways. Consistent with its proposal to clarify that the Rule applies to health apps, the Commission first proposed clarifying the definition of “PHR related entity” to make clear that the Rule covers entities that offer products and services through the online services, including mobile applications, of vendors of personal health records. In addition, the Commission proposed revising the definition of “PHR related entity” to provide that entities that access or send unsecured PHR identifiable health information to a personal health record—rather than entities that access or send

any

information to a personal health record—are PHR related entities.

• Fourth, the Commission proposed to clarify what it means for a personal health record to draw PHR identifiable health information from multiple sources.

• Fifth, in response to public comments expressing concern that mailed notice is costly and not consistent with how consumers interact with online technologies like health apps, the Commission proposed to revise the Rule to authorize electronic notice in additional circumstances. Specifically, the proposed Rule adjusted the language in the “method of notice section” and added a new definition of the term “electronic mail.” The proposed Rule also required that any notice delivered by electronic mail be “clear and conspicuous,” a newly defined term, which aligns closely with the definition of “clear and conspicuous” codified in the FTC's Financial Privacy Rule.

16 CFR 313.3(b). The FTC's Financial Privacy Rule requires financial institutions to provide particular notices and to comply with certain limitations on disclosure of nonpublic personal information. Using a comprehensive definition of “clear and conspicuous” based on the Financial Privacy Rule definition aims to ensure consistency across the Commission's privacy-related rules.

• Sixth, the Commission proposed to expand the required content of the notice to individuals, to require that consumers whose unsecured PHR identifiable health information has been breached receive additional important information, including information regarding the potential for harm from the breach and protections that the notifying entity is making available to affected consumers. In addition, the proposed Rule included exemplar notices, which entities subject to the Rule could use to notify consumers in terms that are easy to understand.

• Seventh, in response to public comments, the Commission proposed to make a number of changes to improve the Rule's readability. Specifically, the Commission proposed to include explanatory parentheticals for internal cross-references, add statutory citations in relevant places, consolidate notice and timing requirements in single sections, respectively, of the Rule, and add a new section that plainly states the penalties for non-compliance.

The NPRM also included a section discussing several alternatives the

Commission considered but did not propose. Although the Commission did not put forth any proposed modifications on those issues, the Commission nonetheless sought public comment on them.

The Commission received approximately 120 comments in response to the NPRM from a wide spectrum of stakeholders, including consumers, consumer groups, trade associations, think tanks, policy organizations, private sector entities, and members of Congress.

As discussed in detail below, commenters addressed the seven topics on which the Commission proposed changes, responded to particular points on which the Commission requested comment, offered additional comment on alternatives that the Commission considered but did not propose, and provided comment on other topics. The majority of commenters expressed support for the Commission's proposed changes.

Comments are available at

https://www.regulations.gov/document/FTC-2023-0037-0001/comment.

The Commission believes the amendments are consistent with the language and intent of the Recovery Act, address the concerns raised by the public comments in response to the NPRM, and will ensure the Rule remains current in the face of changing business practices and technological developments.

II. Analysis of the Final Rule

The following discussion analyzes the amendments to the Rule.

A. Clarification of Entities Covered

1. The Commission's Proposal To Clarify the Entities Covered

The Commission proposed changes to several definitions in § 318.2 to clarify the Rule's application to health apps and similar technologies not covered by HIPAA. First, the proposed Rule revised the definition of “PHR identifiable health information” to remove a cross-reference and instead import language from section 1171(6) of the Social Security Act, 42 U.S.C. 1320d(6), which is also referenced directly in section 13407 of the Recovery Act. The proposed Rule defined “PHR identifiable health information” as information (1) that is provided by or on behalf of the individual; (2) that identifies the individual or with respect to which there is a reasonable basis to believe that the information can be used to identify the individual; (3) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual; and (4) is created or received by a health care provider, health plan (as defined in 42 U.S.C. 1320d(5)), employer, or health care clearinghouse (as defined in 42 U.S.C. 1320d(2)).

The Commission explained that this proposed definition covers traditional health information (such as diagnoses or medications), health information derived from consumers' interactions with apps and other online services (such as health information generated from tracking technologies employed on websites or mobile applications or from customized records of website or mobile application interactions), as well as emergent health data (such as health information inferred from non-health-related data points, such as location and recent purchases). The Commission sought comment as to whether any further amendment of the definition was needed to clarify the scope of data covered.

Second, the NPRM proposed to define the term “health care provider” that appears in the proposed definition of “PHR identifiable health information” (“is created or received by a health care provider”). The Commission proposed to define this term in a manner similar to the definition of “health care provider” found in 42 U.S.C. 1320d(3) (and referenced in 42 U.S.C. 1320d(6), which is directly referenced in section 13407 of the Recovery Act), to mean a provider of services (as defined in 42 U.S.C. 1395x(u)), a provider of medical or other health services (as defined in 42 U.S.C. 1395x(s)), or any other entity furnishing health care services or supplies. The Commission observed that this proposed definition, which is consistent with the statutory scheme, differs from, but does not contradict, the definitions or interpretations adopted by HHS. The Commission sought comment on defining this term more broadly than the term is used in other contexts.

Third, the NPRM proposed to define “health care services or supplies” (the final term in the definition of “health care provider”) to include any online service, such as a website, mobile application, or internet-connected device that provides mechanisms to track diseases, health conditions, diagnoses or diagnostic testing, treatment, medications, vital signs, symptoms, bodily functions, fitness, fertility, sexual health, sleep, mental health, genetic information, diet, or that provides other health-related services or tools. The Commission explained that this change clarified that the Rule applies generally to online services, including websites, apps, and internet-connected devices that provide health care services or supplies, and clarified that the Rule covers online services related not only to medical issues (by including in the definition terms such as “diseases, diagnoses, treatment, medications”) but also wellness issues (by including in the definition terms such as “fitness, sleep, and diet”).

The Commission explained that these proposed changes to the definitions clarified that developers of health apps and similar technologies providing “health care services or supplies” qualify as “health care providers,” such that any individually identifiable health information these products collect or use would constitute “PHR identifiable health information” covered by the Rule. The Commission explained that these proposed changes further clarified that a mobile health application can be a “personal health record” covered by the Rule and the developers of such applications can be “vendors of personal health records.”

2. Public Comments Regarding the Commission's Proposal To Clarify the Entities Covered

The Commission received numerous comments on the application of the Rule to health apps and similar technologies. A substantial number of commenters supported the Rule's application to health apps and similar technologies not covered by HIPAA as necessary in light of the explosion of health apps and the associated dangers to the privacy and security of consumers' health information.

Notably, support for the

Commission's proposals came from a variety of commenters—industry associations,

businesses,

members of Congress,

consumer or patient advocacy groups,

individual consumers,

and anonymous sources.

Many commenters argued that safeguards for non-HIPAA covered health data are essential,

particularly because consumers generally are not aware of varying legal protections for health data.

Indeed, according to some commenters, requiring notification to consumers of the breach of health information not protected by HIPAA is precisely what Congress intended by authorizing the FTC to issue this Rule; the Commission's proposed changes are, therefore, consistent with the goals of the Recovery Act.

Some commenters argued that Federal privacy legislation is needed to protect non-HIPAA covered health data, but, in the interim, the Commission should strengthen its Rule to protect consumer health data to the extent possible.

Other commenters urged the Commission to take even broader measures in this Rule, such as imposing breach prevention measures,

banning health-based surveillance technologies or targeted advertising,

banning selling or sharing of health data not necessary to provide patient care or mandating data retention limits and deletion,

or requiring adherence to standardized terms of service with strong privacy protections.

See generally,

Am. Acad. of Fam. Physicians (“AAFP”); AHIP; AHIMA; Ass'n of Health Info. Outsourcing Serv.'s (“AHIOS”); AMA; Am. Med. Informatics Ass'n (“AMIA”); ANI; Anonymous 1; Anonymous 2; Anonymous 3; Anonymous 4; Anonymous 9; Anonymous 10; Anonymous 11 ; Anonymous 14; Am. Osteopathic Ass'n (“AOA”); Ella Balasa; Beth Barnett; Lauren Batchelor; Bipartisan Pol'y Ctr. (“BPC”); Alan Brewington; Ctr. for Democracy & Tech. (“CDT”); Ctr. for Digit. Democracy (“CDD”); Confidentiality Coal.; Consumer Rep.'s; Elec. Frontier Found. (“EFF”); Elec. Priv. Info. Ctr. (“EPIC”); Dave K.; Members of the House of Representatives; MRO Corp. (“MRO”); Omada Health; Pharmed Out; Planned Parenthood Federation of Amer. (“Planned Parenthood”); CB Sanders; Robb Streicher; SYNGAP1 Foundation and SYNGAP1 Foundation 2; Devin Thompson; Janice Tufte; Michael Turner; U.S. Public Interest Research Group (“U.S. PIRG”); UL Sol.'s; Grace Vinton; WEDI; Anli Zhou. Some commenters elaborated on the nature of the risks to consumers' health data and on the importance to consumers. Two commenters, for example, described research they had performed regarding mental health and/or reproductive health apps' disclosure of consumers' health data to third parties. Mozilla at 3-4; Consumer Reports at 2. Another commenter, a public interest group and advocacy organization, attached a petition containing 9,659 signatures

asking for strong rules to protect digital health privacy. US PIRG at 5-230.

E.g.,

AAFP, AHIMA, AHIOS, AMA, AMIA, AOA; Network Advert. Initiative (“NAI”).

E.g.,

Mozilla; MRO; Omada Health; UL Sol.'s.

See

Members of the House of Representatives (six members of Congress expressing support for the proposed changes).

E.g.,

CDD; CDT; EFF; U.S. PIRG.

Ella Balasa; Beth Barnett; Lauren Batchelor; Alan Brewington; Sean Castillo; Dave K.; CB Sanders; Robb Streicher; Devin Thompson; Janice Tufte; Michael Turner; Grace Vinton; Anli Zhou.

Anonymous 1; Anonymous 2; Anonymous 3; Anonymous 4; Anonymous 5; Anonymous 6; Anonymous 9; Anonymous 10; Anonymous 11; Anonymous 14.

See, e.g.,

AAFP at 1-2; AHIMA at 2; AHIOS at 2; Anonymous 5 at 1; AOA at 1; Am. Speech-Language-Hearing Ass'n (“ASHA”) at 1; Am. Psychiatric Ass'n (“APA”) at 1; CDT at 3-4; CHIME at 2; EFF at 1; Generation Patient at 1; HIMSS at 2; HIMSS Elec. Health Rec. Ass'n (“HIMSS EHR Ass'n”) at 1; MRO at 1-2; Omada Health at 2; PharmedOut at 1; Planned Parenthood at 2-3; Michael Turner at 1; WEDI at 1-4.

AHIMA at 2; Anonymous 5 at 1; ASHA at 1; EFF at 1; WEDI at 2. One commenter, a software company that assists digital health companies with legal compliance, argued that three factors, in particular, support greater protection for digital health data: (1) consumers mistakenly believe HIPAA covers all health data; (2) there is a culture within some digital health companies that favors rapid adoption of products to secure venture capital even when compliance infrastructure is lacking; and (3) digital health products deal with sensitive data and inherently present a greater privacy risk given their heavy reliance on data and data exchange compared to traditional medicine. Tranquil Data at 1.

Confidentiality Coal. at 2; Consumer Rep.'s at 4.

See, e.g.,

AAFP at 2. One commenter, an industry coalition focused on health IT and health care information exchange, emphasized a significant privacy problem adjacent to the Rule: whether HIPAA covered entities should warn patients about the privacy risks associated with health apps and what the Federal government can do to apply equal privacy protections to health data, notwithstanding HIPAA's limitations.

See

WEDI at 3. One commenter supported the proposed changes but argued the Commission should work with Congress to update antiquated terms like “personal health record.” HIMSS at 3.

Ella Balasa at 2; PharmedOut at 1.

Light Collective at 5.

EFF at 2.

Texas Med. Ass'n (“TMA”) at 1-2.

Although many commenters expressed support for the proposed changes, several business coalitions, industry associations and individual firms opposed the changes, which, they argued, are inconsistent with Congress's intent in the Recovery Act to address a narrow subset of “personal health records” and therefore exceed the FTC's statutory authority.

According to some comments, Congress should address any privacy issues that exceed the narrow scope of the Recovery Act. These commenters also contend that if the Commission believes there has been a violation of section 5, then the Commission needs to engage in an FTC Act section 18 rulemaking.

One commenter argued further that consumers have different privacy expectations for an electronic health record offered by their physician versus a fitness app (for example) that they download themselves, and the Commission's Rule should respect those differing expectations.

See, e.g.,

Ass'n of Nat'l Advertisers, Inc. (“ANA”) at 4-5; Comput. & Commc'n's Indus. Ass'n (“CCIA”) at 2-3; Chamber of Com. (“Chamber”) at 1-3; CHI at 2; Consumer Tech. Ass'n (“CTA”) at 2; Lab'y Access and Benefits Coal. (“LAB”) at 1; Priv. for Am. at 1-2; TechNet at 2.

Priv. for Am. at 2-3; Chamber at 6-7; Health Innovation All. (“HIA”) at 1.

see also

42 U.S.C. 17937.

109

At least one commenter urged a somewhat similar interpretation, contending that a relevant inquiry in determining whether a service offers a personal health record is “the terms under which a product or service is offered to consumers. If an entity promotes its offering as addressing, improving, tracking, or informing matters about a consumer's health, then that entity's offering would be subject to the rule. Thus, any product or services that tracks or addresses physical activity, blood pressure, heart rate, digestion, strength, genetics, sleep, weight, allergies, pain, and similar characteristics would be subject to a PHR rule.”

See

WPF at 10.

The Commission notes a general retailer (one that sells food products, children's toys, garden supplies, healthcare products (such as pregnancy tests), or apparel (such as maternity clothes)) offering consumers an app to purchase and access purchases of these products—by itself—would not make the retailer a vendor of personal health records. In this scenario, purchase information relating to certain items—such as a pregnancy test or maternity clothes from a retailer—may reveal information about that person's health. While this purchase information may be PHR identifiable health information, the retailer in this scenario is not a vendor of personal health records because the app is only tangentially related to health. The Commission notes, however, there may be scenarios where a general-purpose retailer described above may become a vendor of personal health records under the Rule, such as where the retailer offers an app with features or functionalities that are sold, marketed, or promoted as more than tangentially relating to health.

In addition, the Commission reiterates a personal health record must be an electronic record of PHR identifiable health information on an individual, must have the technical capacity to draw information from multiple sources, and must be managed, shared, and controlled by or primarily for the individual. The Commission also notes that purchases of items at a brick and mortar retailer where there is no app, website, or online service to access or track that purchase information electronically is not a personal health record, because there is no electronic record at issue. Contrary to the assertions of some commenters, these definitions do not result in undue breadth, because they do not function in isolation. The Commission provides the following examples to illustrate the interplay of these definitions with the definition of “personal health record”:

•

Example 1:

Health advice app or website A, which is not covered by HIPAA, provides information to consumers about various medical conditions. Its function is purely informational; it does not provide any mechanism through which the consumer may track or record information. Health advice app or website A is not a personal health record, because it is not an electronic record of PHR identifiable health information on an individual.

•

Example 2:

Health advice app or website B, which is not covered by HIPAA, provides information to consumers about various medical conditions and provides a symptom tracker, available to consumers who log into the site with a username and password, in which consumers may input symptoms and receive potential diagnoses. Health advice app or website B is an electronic record of PHR identifiable health information on an individual, because its information is provided by the individual, it identifies the individual (via username and password), it relates to the individual's health conditions (the symptoms), and is received by a health care provider (

i.e.,

the entity providing the site itself, as that entity is furnishing the health care service of an online service that provides mechanisms to track symptoms). However, health advice app or website B is not a personal health

record to the extent the site does not have the technical capacity to draw information from multiple sources (

i.e.,

if the consumer is its only source of information).

•

Example 3:

Health advice website C, which is not covered by HIPAA, functions in the same way as health advice app or website B, except that it collects geolocation data via an application programming interface (“API”). For the reasons stated in Example 2, it is an electronic record of PHR identifiable health information on an individual. It also has the technical capacity to draw information from multiple sources (consumer inputs and collection of geolocation data through the API. It is managed primarily for the individual (

i.e.,

to provide the individual health advice). Therefore, health advice app or website C is a personal health record.

•

Example 4:

Health advice app or website D, which is not covered by HIPAA, functions in the same way as health advice app or website B, except that it also draws information from a data broker and connects that information to some of its individual users to provide them with more accurate diagnostic suggestions. For the reasons stated in Example 2, it is an electronic record of PHR identifiable health information on an individual. It also has the technical capacity to draw information from multiple sources (the consumer and the data broker) and is managed by or primarily for the individual. Therefore, health advice app or website D is a personal health record.

Whether a health app or other electronic record constitutes a personal health record (and is therefore subject to the Rule) is a fact-intensive inquiry whose outcome depends not only on the nature of the information contained in that record, but also on numerous other factors, such as its “technical capacity,” its source(s) of information, and its relationship to the individual.

Finally, the Commission notes a non-substantive, organizational change relating to the definition of “PHR identifiable health information.” In the 2023 NPRM, the Commission proposed revising “PHR identifiable health information” by importing language from section 1171(6) of the Social Security Act, 42 U.S.C. 1320d(6), which is referenced directly in section 13407 of the Recovery Act. To hew more closely to the organization of the Recovery Act, and to preserve the word “includes” in the phrase “includes information that is provided by or on behalf of the individual,” the Commission revised slightly the order of the elements in the definition of “PHR identifiable health information.”

B. Clarification of What It Means for a Personal Health Record To Draw Information From Multiple Sources

1. The Commission's Proposal Regarding What It Means for a Personal Health Record To Draw Information From Multiple Sources

The Commission proposed amending the definition of the term “personal health record” to clarify what it means for a personal health record to draw information from multiple sources. Under the 2009 Rule, a personal health record is defined as an electronic record of PHR identifiable health information that can be drawn from multiple sources and that is managed, shared, and controlled by or primarily for the individual. Under the Commission's proposed definition, a “personal health record” would be defined as an electronic record of PHR identifiable health information on an individual that has the technical capacity to draw information from multiple sources and that is managed, shared, and controlled by or primarily for the individual.

Changing the phrase “that can be drawn from multiple sources” to “has the technical capacity to draw information from multiple sources” serves several purposes. First, it clarifies a product is a personal health record if it can draw information from multiple sources, even if the consumer elects to limit information to a single source only, in a particular instance. For example, a depression management app that accepts consumer inputs of mental health states and has the technical capacity to sync with a wearable sleep monitor is a personal health record, even if some customers choose not to sync a sleep monitor with the app. Thus, whether an app qualifies as a personal health record would not depend on the prevalence of consumers' use of a particular app feature, like sleep monitor-syncing. Instead, the analysis of the Rule's application would be straightforward: either the app has the technical means (

e.g.,

the application programming interface or API) to draw information from multiple sources, or it does not. Next, adding the phrase “technical capacity to draw information” clarifies a product is a personal health record if it can draw any information from multiple sources, even if it only draws health information from one source. This change further clarifies the Commission's interpretation of the Recovery Act, as explained in the Policy Statement.

110

Policy Statement at 2.

The Commission sought public comment as to whether this revised language sufficiently clarifies the Rule's application to developers and purveyors of products that have the technical capacity to draw information from more than one source. The Commission invited comment on its interpretation that an app is a personal health record because it has the technical capacity to draw information from multiple sources, even if particular users of the app choose not to enable the syncing features. The Commission also requested comment about whether an app (or other product) should be considered a personal health record even if it only draws health information from one place (in addition to non-health information drawn elsewhere); or only draws identifiable health information from one place (in addition to non-identifiable health information drawn elsewhere). The Commission further requested comment about whether the Commission's bright-line rule (apps with the “technical capacity to draw information” are covered) should be adjusted to take into account consumer use, such as where no consumers (or only a de minimis number) use a feature, and about the likelihood of such scenarios. For example, the Commission offered an example of an app that might have the technical capacity to draw information from multiple sources, but its API is entirely or mostly unused, either because it remains a Beta feature, has not been publicized, or is not popular.

2. Public Comments Regarding What It Means for a Personal Health Record To Draw Information From Multiple Sources

Many commenters supported the Commission's proposal amending the definition of a “personal health record.”

111

Commenters noted, for instance, this change would help to ensure that many services that collect PHR identifiable health information are covered by the Commission's Rule,

112

and would help to promote greater privacy and security for health information,

113

while still “hewing to

the limitations of the statute.”

114

Some commenters noted without this change, developers of personal health records (such as app developers) might have incentives to design their products in ways that would intentionally skirt the Rule's requirements (such as by restricting a consumer's ability to import data from other sources).

115

Others noted the importance of the Rule covering apps with the technical capacity to draw information from multiple sources even where such capacity is not used by the consumer.

116

111

Ella Balasa at 1; TMA at 4 (arguing that “PHRs include applications with the technical capacity to draw information from multiple sources, regardless of the patient's preference to activate the technical capability.”); Consumer Rep.'s at 6; AAFP at 3; AHIMA at 4-5; AMA at 4; CHIME at 4; CDT at 13; AOA at 3.

112

AHIMA at 4-5.

113

AAFP at 3.

114

Consumer Reports at 5-6.

115

AHIP at 2-3; CDT at 13 (arguing that changes remove “incentives for companies to technically design products and services to not trigger the HBNR to avoid any need to provide consumer notice.”).

116

AHIOS at 4; CARIN Alliance at 4.

Other commenters opposed this proposal.

117

Some argued the proposed clarification regarding what drawing information from multiple sources means runs counter to Congress's statutory intent,

118

because virtually every app has some sort of integration (

e.g.,

for analytics) through which it draws information other than from the consumer.

119

One commenter asserted the change would broaden the scope of the Rule to the point that it would sweep in online services that should not be thought of as a personal health record (such as email apps),

120

or otherwise create confusing standards for app developers or reduce innovation.

121

In addition, commenters expressed concern this change would sweep in apps or online services that have the technical capacity to draw from multiple sources during the development or testing phase of the product, or would sweep in products with unused, unavailable, or unpublicized APIs or integrations that count as a source.

122

One commenter expressed concern about lack of clarity, such as in scenarios where a user is required to pay for an upgrade to access a feature or integration that draws information from another source.

123

Some commenters also expressed concern that apps and online services that are subject to HIPAA (

i.e.,

HIPAA-covered entities or business associates) should be carved out of the definition of a personal health record.

124

Other commenters expressed broader concern with the definition of “personal health record,” urging the Commission to, for example, abandon the purportedly outdated term in favor of a more modern one.

125

For instance, some commenters urged that the Commission abandon or tweak the requirement that the personal health record be “managed, shared, and controlled by or primarily for the individual.”

126

117

NAI at 6 (urging that the Commission make clear that a personal health record is one that “not only has the technical capacity to draw PHR identifiable health information from multiple sources, but that it also has the functionality and actually does incorporate data from multiple sources.”); ANA at 7; ACLA at 1-2.

118

NAI at 6.

119

Chamber at 4-5; Priv. for Am. at 5-6; NAI at 6.

120

CCIA at 6.

121

CTA at 11; AdvaMed at 5; CHI at 5.

122

CHI at 5 (asking the Commission to clarify that an “app having the ability to draw from multiple sources with some changes to the app's coding/APIs is not within this definition's threshold.”); ACLA at 1 (arguing “[i]f a feature is unused by individuals `because it remains a Beta feature,' then in fact it does not have the `technical capacity' to draw an individual's information from other sources, unless and until its functionality has been enabled by the vendor. The mere possibility that an application vendor

might

sometime in the future enable that functionality should not bring the electronic record within the scope of the definition of `personal health record.' ”) (emphasis in original); CTA at 11 (arguing Rule should instead have bright-line test that assesses whether the app actually draws health information from multiple sources); AdvaMed at 5 (arguing the Commission should decline to adopt multiple sources changes because it could cause confusion and potentially sweep in apps or services with features that have not been made available to consumers, such as APIs connected to the PHR that have not been publicized).

123

WPF at 9.

124

Omada at 5; Datavant at 3.

125

HIMSS at 3 (urging the Commission to work with Congress to craft a definition more consonant with technological realities).

126

AHIOS at 4; MRO at 4.

Another commenter expressed concern the proposed change could sweep in services that draw any information from multiple sources, regardless of whether that information is identifiable health information.

127

NAI at 6.

3. The Commission Adopts the Proposed Changes Clarifying What It Means for a Personal Health Record To Draw Information From Multiple Sources

After considering the comments received, the Commission adopts the proposed amendment without change. This amendment will help clarify the types of entities covered by the Rule. The definition does not create undue breadth or deviate from Congressional intent; rather, the changes are consistent with the language of the Recovery Act, and only serve to give meaning to the phrase “can be drawn” in the Recovery Act in a way that is consistent with the current state of technology. They are also necessary to keep pace with technological change, which has enabled firms to offer consumers mobile electronic records of their health information that contain numerous integrations. To illustrate the intended meaning of the proposed revisions to the term “personal health record,” the Commission reiterates examples from the 2023 NPRM of two non-HIPAA covered diet and fitness apps available for consumer download in an app store. Under the amended Rule, each is a personal health record.

•

Example 1:

Diet and fitness app Y allows users to sync their app with third-party wearable fitness trackers. Diet and fitness app Y has the technical capacity to draw identifiable health information both from the user (

e.g.,

name, weight, height, age) and the fitness tracker (

e.g.,

user's name, miles run, heart rate), even if some users elect not to connect the fitness tracker.

•

Example 2:

Diet and fitness app Y has the ability to pull information from the user's phone calendar via the calendar API to suggest personalized healthy eating options. Diet and fitness app Y has the technical capacity to draw identifiable health information from the user (

e.g.,

name, weight, height, age) and non-health information (

e.g.,

calendar entry info, location, and time zone) from the user's calendar.

As these examples make clear, and in response to one commenter's concern that the changes would sweep in services that do not draw any health information,

128

the Commission notes the Rule still requires drawing PHR identifiable health information from at least one source to count as a personal health record.

128

NAI at 6.

The Commission declines to make other requested changes to the definition of personal health record. First, the Commission declines to include an express exemption for HIPAA-covered entities within the definition of personal health record because § 318.1 of the Rule already specifically exempts businesses or organizations covered by HIPAA.

129

Second, the Commission declines to exempt apps and services where there are available but unused or unpublicized APIs or integrations. Similarly, the Commission declines to exempt apps and services from the definition just because they are drawing information from multiple sources while undergoing product or beta testing and are not yet in their final form.

130

The Commission notes a product feature or integration that exists

and that is able to draw PHR identifiable health information counts as a source under the Rule. Exempting such instances would be contrary to the purpose of the Rule and would impermissibly limit notification of breaches just because a product feature is not widely disseminated, used, or in its final form. The Commission notes under the Rule, a covered entity that experienced a breach of security of unsecured PHR identifiable health information triggering the Rule would not be exempt because the breach occurred in the context of such scenarios.

129

See, e.g.,

16 CFR 318.1(a) (Rule “does not apply to HIPAA-covered entities, or to any other entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity.”);

see also

16 CFR 318.2 (exempting business associates and HIPAA-covered entities from the Rule's definitions of “PHR related entity” and “vendor of personal health records.”).

130

ACLA at 1-2; CTA at 11; AdvaMed at 5.

Further, and importantly, the Rule is triggered only by breaches of unsecured PHR identifiable health information and does not apply to information that is protected or “secured” through the use of a technology or methodology specified by the Secretary of Health and Human Services in the guidance issued under section 13402(h)(2) of the American Reinvestment and Recovery Act of 2009, 42 U.S.C. 17932(h)(2).

131

The Rule, therefore, creates appropriate incentives for product testing with de-identified data or that secures information through certain specifications, such as through specified encryption methods.

131

See

74 FR 19006;

see also

U.S. Dep't of Health & Human Servs.,

Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals

(July 26, 2013),

https://www.hhs.gov/hipaa/for-professionals/breach-notification/guidance/index.html.

Third, the Commission declines, as one commenter requested,

132

to expressly exempt scenarios where a change is required to an app's coding to draw information from another source. The Commission notes, however, it does not intend to cover instances where an app can draw from multiple sources only through changes to the design or underlying software code and where the app developer does not implement those changes.

132

CHI at 5 (asking the Commission to clarify that an “app having the ability to draw from multiple sources with some changes to the app's coding/APIs is not within this definition's threshold.”).

In addition, the Commission declines to remove from the definition of personal health record the requirement that it be “managed, shared, and controlled by or primarily for the individual.” This language mirrors the Recovery Act's statutory definition of personal health record.

133

Further, this language provides a boundary to the definition. Even if a website or app has the technical capacity to draw information from multiple sources (for example, because it has integrations for advertising or analytics), it must still be “managed, shared, and controlled by or primarily for the individual” to be covered by the Rule.

133

42 U.S.C. 17921(11).

Generally, a personal health record is an electronic record of an individual's health information by which the individual maintains access to the information and may have, for example, the ability to manage, track, control, or participate in his or her own health care. If these elements are not present, the website or app may not be “managed, shared, and controlled by or primarily for the individual,” and would not, therefore, constitute a personal health record.

C. Clarification Regarding Types of Breaches Subject to the Rule

1. The Commission's Proposals

a. The Commission's Proposal Regarding “Breach of Security”

The Commission proposed a definitional change to clarify that a breach of security under the Rule encompasses unauthorized acquisitions that occur as a result of a data breach

an unauthorized disclosure. The Commission's proposal underscores that a breach of security is not limited to data exfiltration, and includes unauthorized disclosures (such as, but not limited to, a company's unauthorized sharing or selling of consumers' information to third parties that is inconsistent with the company's representations to consumers). The Rule previously defined “breach of security” as the acquisition of unsecured PHR identifiable health information of an individual in a personal health record without the authorization of the individual, which language mirrored the definition of “breach of security” in section 13407(f)(1) of the Recovery Act.

Accordingly, consistent with the Recovery Act definition, the Policy Statement, FTC enforcement actions under the Rule, and public comments received, the Commission proposed amending the definition of “breach of security” in § 318.2 by adding the following sentence to the end of the existing definition: “[a] breach of security includes an unauthorized acquisition of unsecured PHR identifiable health information in a personal health record that occurs as a result of a data breach or an unauthorized disclosure.” The change was intended to make clear to the marketplace that a breach includes an unauthorized acquisition of identifiable health information that occurs as a result of a data breach or an unauthorized disclosure, such as a voluntary disclosure made by the PHR vendor or PHR related entity where such disclosure was not authorized by the consumer.

The NPRM, like the 2009 Rule, continued to include a rebuttable presumption for unauthorized access to an individual's data; it stated when there is unauthorized access to data, unauthorized acquisition will be presumed unless the entity that experienced the breach “has reliable evidence showing that there has not been, or could not reasonably have been, unauthorized acquisition of such information.”

b. The Commission's Related Proposal To Not Define the Term “Authorization” in the Rule

In the 2023 NPRM, the Commission stated it had considered defining the term “authorization,” which appears in § 318.2's definition of “breach of security,” but did not propose any such change in the NPRM.

The Commission considered defining “authorization” to mean the affirmative express consent of the individual and then defining “affirmative express consent” consistent with State laws that define consent, such as the California Consumer Privacy Rights Act, Cal. Civ. Code 1798.140(h).

134

Such changes would have ensured notification is required anytime there is acquisition of

unsecured PHR identifiable health information without the individual's affirmative express consent for that acquisition—such as when an app discloses unsecured PHR identifiable health information to another company, having obtained nominal “consent” from the individual by using a small, greyed-out, pre-selected checkbox following a page of dense legalese.

134

As noted in the 2023 NPRM, the Commission considered defining “affirmative express consent” as any freely given, specific, informed, and unambiguous indication of an individual's wishes demonstrating agreement by the individual, such as by a clear affirmative action, following a clear and conspicuous disclosure to the individual, apart from any “privacy policy,” “terms of service,” “terms of use,” or other similar document, of all information material to the provision of consent. Acceptance of a general or broad terms of use or similar document that contains descriptions of agreement by the individual along with other, unrelated information, does not constitute affirmative express consent. Hovering over, muting, pausing, or closing a given piece of content does not constitute affirmative consent. Likewise, agreement obtained through use of user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice, does not constitute affirmative express consent.

See

88 FR 37830 n.78.

The Commission did not, however, propose to define “authorization” because (1) the 2009 Rule Commentary already provided guidance on the types of disclosures the Commission considers to be “unauthorized”;

135

(2) recent Commission orders, such as the Commission's enforcement actions against GoodRx and Easy Healthcare,

136

also make clear that the use of “dark patterns,” which have the effect of manipulating or deceiving consumers, including through use of user interfaces designed with the substantial effect of subverting or impairing user autonomy and decision-making, do not satisfy the standard of “meaningful choice”; and (3) Commission settlements establish important guidelines involving authorization (the Commission's recent settlement with GoodRx, alleging violations of the Rule, highlights that disclosures of PHR identifiable health information inconsistent with a company's privacy promises constitute an unauthorized disclosure).

135

See, e.g.,

74 FR 42967.

136

United States

GoodRx Holdings, Inc.,

No. 23-cv-460 (N.D. Cal. 2023),

https://www.ftc.gov/legal-library/browse/cases-proceedings/2023090-goodrx-holdings-inc; United States

Easy Healthcare Corp.,

No. 1:23-cv-3107 (N.D. Ill. 2023),

https://www.ftc.gov/legal-library/browse/cases-proceedings/202-3186-easy-healthcare-corporation-us-v.

The Commission sought public comment about:

• Whether the commentary above and FTC enforcement actions under the Rule provide sufficient guidance to put companies on notice about their obligations for obtaining consumer authorization for disclosures, or whether defining the term “authorization” would better inform companies of their compliance obligations.

• To the extent that including such definitions would be appropriate, the definitions of “authorization” and “affirmative express consent,” as described above, and the extent to which such definitions are consistent with the language and purpose of the Recovery Act.

• What constitutes an acceptable method of authorization, particularly when unauthorized sharing is occurring.

137

For example, the Commission sought comment about when a vendor of personal health records or a PHR-related entity is sharing information covered by the Rule, is it acceptable for that entity to obtain the individual's authorization to share that information when an individual clicks “agree” or “accept” in connection with a pre-checked box disclosing such sharing? Is it sufficient if an individual agrees to terms and conditions disclosing such sharing but that individual is not required to review the terms and conditions? Or is it sufficient if an individual uses a health app that discloses in its privacy policy that such sharing occurs, but the app knows via technical means that the individual never interacts with the privacy policy?

See

88 FR 37832.

• Whether there are certain types of sharing for which authorization by consumers is implied because such sharing is expected and/or necessary to provide a service to consumers.

2. Public Comments

a. Public Comments Regarding “Breach of Security”

Many commenters supported the Commission's proposed amendment to the definition of “breach of security.”

138

One commenter noted the change is consistent with the broad definition of “breach of security” in the Recovery Act, which refers explicitly to the acquisition of PHR identifiable health information without the authorization of an individual (rather than the authorization of an entity holding the data, as is the case where a breach involves data theft or exfiltration).

139

Commenters also noted the amendment would ensure notice, accountability, and regulatory oversight, regardless of the underlying cause of the unauthorized acquisition.

140

Commenters noted that breaches encompass more than just cybersecurity intrusions.

141

Commenters also argued that a company's voluntary unauthorized disclosure can be just as damaging as data theft.

142

For instance, a commenter noted that unauthorized disclosures of health information may cause embarrassment, perpetuate stigma about patients' conditions, deter patients from seeking care, interfere in the patient-physician relationship, or impact patients' employment.

143

Moreover, voluntary, unauthorized disclosures increase the risk of additional unauthorized acquisition and sharing of this information among bad actors.

144

138

See, e.g.,

TMA at 3; U.S. PIRG at 2-3; AAFP at 3; AHIMA at 3; AMA at 3-4; AMIA at 3; AOA at 2-3; AHIOS at 3; CDT at 11-12; CHIME at 4; EPIC at 5-6.

139

Consumer Rep.'s at 4.

140

CDT at 11-12; U.S. PIRG at 2-3.

141

AMA at 4; CDT at 11-12; EPIC at 5.

142

AAFP at 3; CDT at 11-12.

143

AOA at 2.

144

AHIMA at 3.

Some commenters supported expanding or changing the definition further. Specifically, some commenters urged the Commission to amend the definition to encompass (1) exceeding authorized access or use of PHR identifiable health information, such as where a company collects data for one purpose, but later uses or discloses that data for a second, undisclosed purpose;

145

or (2) the collection or retention of PHR identifiable health information beyond what is necessary to provide the associated service to an individual consumer.

146

One commenter asked the Commission to clarify that the Rule would be triggered by unauthorized use of or access to information derived from PHR identifiable health information, and to define the phrase acquisition.

147

145

FPF at 12-15.

146

EPIC at 5-7; U.S. PIRG at 2-3.

147

Mozilla at 6-7.

Some commenters, however, urged the Commission to not amend the definition at all. These commenters expressed concern the amendment would cause the Rule to exceed what Congress intended in the Recovery Act and transform the Rule into an opt-in notice and consent privacy regime.

148

Commenters argued further the proposed changes would cause consumer notice fatigue,

149

consumer panic,

150

or over-reporting by companies.

151

One commenter urged the Commission to limit the definition of “acquisition” to actual acquisition, and exclude instances of access or disclosure where the information was not actually acquired by a third party.

152

Commenters argued the proposed definition would be burdensome and force companies to limit certain beneficial disclosures to certain third parties, such as disclosures to support internal operations, detect security vulnerabilities or fraud, for law enforcement, and other purposes.

153

148

Chamber at 6; Priv. for Am. at 2-5; ANA at 6-7.

149

SIIA at 3; CTA at 13-14.

150

CCIA at 4-5, 7 (arguing that requiring notification for unauthorized disclosures could cause consumers to worry in the absence of harm, such as where it is “typical” to disclose such information.)

151

CTA at 13-14.

152

Id.

at 14-16.

153

TechNet at 3; Chamber at 7; CCIA at 5-6.

Some commenters also urged that the Commission adopt carve-outs so that certain conduct would not be deemed breaches of security under the Rule. Commenters requested exemptions consistent with or found in HIPAA or

under State breach notification laws, such as exemptions for disclosures to certain types of entities or for certain purposes, or where there is inadvertent or unintentional access, use, or disclosure.

154

Commenters also proposed safe harbors for companies that implement recognized security or privacy safeguards;

155

and one commenter proposed safe harbors that would apply where data is shared with “affiliated businesses,” where there is inadvertent but “good-faith” access by a company employee, where a company makes good faith efforts to inform consumers of disclosures to third parties, and where companies take steps to contractually limit downstream uses of the data.

156

Other commenters expressed support for exempting disclosures of PHR identifiable health information to public health authorities for public health purposes, noting the amended definition could discourage such disclosures.

157

154

CHI at 4 (stating the FTC “should explicitly except the same situations from disclosure that are excepted from HIPAA disclosures, and/or try to align exceptions with those found in State privacy statutes.”); CTA at 16; HIA at 2; TechNet at 3 (arguing the Rule should adopt exemptions that encompass “actions taken to prevent and detect security incidents, to comply with a civil, criminal, or regulatory inquiry or investigation, to cooperate with law enforcement agencies concerning conduct or activity that the data controller reasonably and in good faith believes may be illegal, to perform internal operations consistent with a consumer's expectations, and to provide a product or service that a consumer requested.”); CCIA at 5-6 (arguing the Rule should exempt disclosures relating to a host of purposes, including: preventing and detecting security incidents and fraud, complying with legal process, cooperating with law enforcement, performing internal operations consistent with consumer expectations, providing a service requested by the consumer, protecting “the vital interests of the consumer,” or processing data relating to public health); Chamber at 7 (arguing if the Commission does amend the definition of breach of security, it “should provide exceptions for legitimate and societally beneficial uses of data that other privacy laws have for failure to honor opt-in including but not limited to network security, prevention and detection of fraud, protection of health, network maintenance, and service/product improvement.”); LAB at 2.

155

DirectTrust at 1-2.

156

ATA Action at 2.

157

Network for Pub. Health L. and Texas A&M Univ. at 1-2.

b. Public Comments Regarding Defining “Authorization”

Commenters were divided as to whether the Commission should define “authorization.” Some commenters supported defining “authorization” to provide greater guidance to companies, to promote transparency, and to discourage buried or inconspicuous disclosures relating to health information, or approaches to consent that are not meaningful because they are confusing or coercive.

158

To further regulatory consistency, some commenters supported adding a definition of “authorization” that is consistent with how that term is defined in other health-related laws, such as under HIPAA

159

or State health privacy laws that define consent or authorization (such as the California Consumer Privacy Rights Act

160

or the Washington My Health, My Data Act).

161

158

AHIP at 4; Light Collective at 4; MRO at 2-3; Mozilla at 4; CARIN Alliance at 10; Consumer Rep.'s at 9;

see also

PharmedOut at 3 (arguing that defining “authorization” is crucial but urging the Commission go further and place substantive restrictions on what companies can do with consumer health data.).

159

AdvaMed at 7 (arguing that any definition of “authorization” or “affirmative express consent” should take into account the necessity for medical technologies and medical technology companies to be able to operate and communicate under standards consistent with those governing HIPAA covered entities and others in the health care ecosystem. These standards permit certain uses and disclosures of individually identifiable health information without express consent where necessary for the provision of timely and effective health care); MRO at 3; AHIMA at 7-8.

160

AHIOS at 3.

161

Consumer Rep.'s at 9.

By contrast, some commenters opposed defining the term—or opposed a requirement under the Rule that entities be required to get authorization before disclosing PHR identifiable health information.

162

Commenters argued that Congress had not granted the Commission the authority to define “authorization” in the Recovery Act,

163

or that doing so would import a substantive consent requirement that is outside the scope of the Rule, converting a breach notice Rule into an opt-in privacy regime.

164

Other commenters noted that requiring a specifically defined authorization would create an inflexible standard that would not evolve with changes in technology.

165

Other commenters opposed a requirement that consumers should be required to review terms before agreeing to use a service, contending that this would not increase consumer understanding of terms.

166

162

HIA at 2 (arguing that “[r]outine disclosures of data should be allowed in certain contexts without additional need for authorizations”); CTA at 16-17; AdvaMed at 7-8; ACLA at 6; Confidentiality Coal. at 4-5.

163

Confidentiality Coal. at 4-5.

164

CTA at 16-17 (arguing that the Rule does not allow the Commission to impose “substantive consent requirements” that would be burdensome and “likely not administrable for many companies.”).

165

SIIA at 4.

166

CHI at 7.

Some commenters endorsed other approaches that would exempt from any requirement of affirmative express consent certain types of disclosures of PHR identifiable health information, such as to service providers, data processors, and entities that assist with combatting fraud and promoting safety.

167

Some commenters urged a disclosure be deemed authorized if the disclosure is consistent with a company's privacy notices or policies or where applicable State privacy laws require affirmative consent or provide for the right to opt-out, without the need to define affirmative express consent under the Rule.

168

One commenter argued that authorization should be met when a consumer agrees to opt-in to certain data sharing, such as by clicking a box proximate to a disclosure of material terms.

169

167

FPF at 10 (arguing that “an organization may share information with a service provider operating on their behalf to provide storage; may share information to protect the safety or vital interests of an individual or react to a public health emergency; or to protect themselves against security incidents and fraud. In each of these situations, data protection laws typically invoke a variety of non-consent measures, including data minimization, transparency, notice to the end-user or the regulator, and opportunities to object.”); Chamber at 7.

168

Confidentiality Coal. at 4-5; SIIA at 4; CHI at 7.

169

CTA at 17.

3. The Commission Adopts the Proposed Changes to the Definition of “Breach of Security”

After carefully considering the public comments, the Commission adopts the proposed amendment without change. The final rule definition is consistent with the statutory definition in the Recovery Act, the Policy Statement,

170

and recent Commission enforcement actions under the Rule. The Commission notes the statutory definition in the Recovery Act is sufficiently broad to cover both cybersecurity intrusions as well as a company's intentional but unauthorized disclosures of consumers' PHR identifiable health information to third party companies. In addition, the Commission finds persuasive the comment noting the Recovery Act's definition of “breach of security” refers to the acquisition PHR identifiable health information without the authorization of an individual, rather than the authorization of the entity holding the data.

171

The definition is

also consistent with public comments received by the Commission in 2020 (when the Commission announced its regular, ten-year review of the Rule and requested public comments about potential Rule changes

172

), which urged the Commission to clarify what constitutes an unauthorized acquisition under the Rule.

173

Importantly, the amendment to the definition of “breach of security” in § 318.2 does not depart from the 2009 Rule Commentary or the Commission's enforcement policy under the Rule. Instead, it further underscores the 2009 Rule Commentary and subsequent Commission enforcement actions that unauthorized disclosures (

i.e.,

sharing inconsistent with consumer expectations) can be a “breach of security” that triggers the Rule.

174

170

The Commission's Policy Statement makes clear that “[i]ncidents of unauthorized access, including sharing of covered information without an individual's authorization, triggers notification obligations under the Rule,” and that a breach “is not limited to cybersecurity intrusions or nefarious behavior.” Policy Statement at 2.

171

Consumer Rep.'s at 5 (noting “the Recovery Act frames breaches of security in relation to individuals, rather than to vendors of personal health records or PHR related entities,” and defines

breach of security as “acquisition of such information without the authorization of the individual.”)

172

85 FR 31085 (May 22, 2020).

173

See

Public Comments in response to May 2020 Request for Public Comments in connection with regular, ten-year review of Rule: AMA at 5-6 (“The FTC should define `unauthorized access' as presumed when entities fail to disclose to individuals how they access, use, process, and disclose their data and for how long data are retained. Specifically, an entity should disclose to individuals exactly what data elements it is collecting and the purpose for their collection”; “[T]he FTC should define `unauthorized access' as presumed when an entity fails to disclose to an individual the specific secondary recipients of the individual's data.”); AMIA at 2 (recommending the FTC “[e]xpand on the concept of `unauthorized access' under the definition of `Breach of security,' to be presumed when a PHR or PHR related entity fails to adequately disclose to individuals how user data is accessed, processed, used, reused, and disclosed.”); OAG-CA at 5-6 (urging the FTC to include “impermissible acquisition, access, use, disclosure” under the definition of breach.). These comments can be found at

https://www.regulations.gov/docket/FTC-2020-0045.

174

The 2009 Rule Commentary noted other examples illustrating that unauthorized sharing or transferring of information constitutes a breach of security, including that the unauthorized downloading or transfer of information by an employee can constitute a breach of security; that inadvertent access by an unauthorized employee reading or sharing information triggers the Rule's notification obligations; and notes that given the highly personal nature of health information, “the Commission believes that consumers would want to know if such information was read or shared without authorization.”

See

74 FR 42966-67.

The Commission declines to adopt any specific exemptions or safe harbors to the definition of breach of security. Unlike the section of the Recovery Act that governs breach notifications under HIPAA,

175

Congress did not provide for any specific, enumerated exemptions for breaches under the Commission's Rule. Moreover, the Commission's Rule provides for a rebuttable presumption for certain types of access: when there is unauthorized access to data, unauthorized acquisition will be presumed unless the entity that experienced the breach “has reliable evidence showing that there has not been, or could not reasonably have been, unauthorized acquisition of such information.” That is, companies can rebut the presumption of acquisition in instances of unauthorized access by providing reliable evidence disproving acquisition. The Commission has previously offered guidance on what counts as unauthorized access and reiterates that guidance here.

176

175

42 U.S.C. 17921;

see also

U.S. Dep't of Health & Human Servs.,

Breach Notification

(July 26, 2013),

https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html.

Under the Recovery Act's definition of “breach of security” for the Rule governing HIPAA-covered entities and business associates, the statute explicitly provides for three exceptions: (1) unintentional acquisition, access, or use of protected health information by a workforce member or person acting under the authority of a covered entity or business associate, if such acquisition, access, or use was made in good faith and within the scope of authority; (2) the inadvertent disclosure of protected health information by a person authorized to access protected health information at a covered entity or business associate to another person authorized to access protected health information at the covered entity or business associate, or organized health care arrangement in which the covered entity participates; and (3) if the covered entity or business associate has a good faith belief that the unauthorized person to whom the impermissible disclosure was made, would not have been able to retain the information.

See

45 CFR 164.400 through 164.414. In the first two cases, the information cannot be further used or disclosed in a manner not permitted by the Privacy Rule. These exceptions are not found in the provisions of the Recovery Act authorizing the FTC's Health Breach Notification Rule; this makes sense, given there is no analogous Privacy Rule, Security Rule, or required Business Associate agreements outside the HIPAA sphere governing entities covered by the FTC's Health Breach Notification Rule.

176

The Rule continues to provide that, when there is unauthorized access to data, unauthorized acquisition will be presumed unless the entity that experienced the breach “has reliable evidence showing that there has not been, or could not reasonably have been, unauthorized acquisition of such information.” As noted in the 2009 Rule Commentary, the presumption was intended to address the difficulty of determining whether access to data (

i.e.,

the opportunity to view the data) did or did not lead to acquisition (

i.e.,

the actual viewing or reading of the data). In these situations, the Commission stated that the entity that experienced the breach is in the best position to determine whether unauthorized acquisition has taken place. In describing the rebuttable presumption, the Commission provided several examples. It noted that no breach of security has occurred if an unauthorized employee inadvertently accesses an individual's PHR and logs off without reading, using, or disclosing anything. If the unauthorized employee read the data and/or shared it, however, he or she “acquired” the information, thus triggering the notification obligation in the Rule. Similarly, the Commission provided an example of a lost laptop: If an entity's employee loses a laptop in a public place, the information would be accessible to unauthorized persons, giving rise to a presumption that unauthorized acquisition has occurred. The entity can rebut this presumption by showing, for example, that the laptop was recovered, and that forensic analysis revealed that files were never opened, altered, transferred, or otherwise compromised.

See

74 FR 42966.

4. The Commission Affirms Its Proposal Not To Define “Authorization”

After carefully considering the public comments, the Commission declines to define “authorization,” as that term appears in § 318.2's definition of “breach of security.” The Commission finds persuasive the public comments suggesting that imposing an affirmative express consent requirement would not be appropriate or warranted in all cases.

The Commission believes whether a disclosure is authorized under the Rule is a fact-specific inquiry that will depend on the context of the interactions between the consumer and the company; the nature, recipients, and purposes of those disclosures; the company's representations to consumers; and other applicable laws. The Commission reiterates the 2009 Rule Commentary, which states a use of data is “authorized” only where it is consistent with a company's disclosures and consumers' reasonable expectations and where there is meaningful choice in consenting to sharing—buried disclosures do not suffice.

177

The 2009 Rule Commentary states: “[g]iven the highly personal nature of health information, the Commission believes that consumers would want to know if such information was read or shared without authorization.” It further states that data sharing to enhance consumers' experience with a PHR is authorized only “as long as such use is consistent with the entity's disclosures and individuals' reasonable expectations” and that “[b]eyond such uses, the Commission expects that vendors of personal health records and PHR related entities would limit the sharing of consumers' information, unless the consumers exercise meaningful choice in consenting to such sharing. Buried disclosures in lengthy privacy policies do not satisfy the standard of `meaningful choice.' ” 74 FR 42967.

The Commission's recent enforcement actions alleging violations of the Rule against GoodRx and Easy Healthcare further highlight that disclosures of PHR identifiable health information inconsistent with a company's privacy promises constitute an unauthorized disclosure. These recent Commission orders also make clear that the use of “dark patterns,” which have the effect of manipulating or deceiving consumers, including through use of user interfaces designed with the substantial effect of subverting or impairing user autonomy and decision-making, undercut an entity's assertion that consumers exercised “meaningful choice.”

In response to public comments seeking more guidance on what constitutes an unauthorized disclosure under the Rule,

178

the Commission

offers the following, non-exhaustive examples relating to authorization:

178

TechNet at 4; Tranquil Data at 4.

•

Example 1—Unauthorized Disclosure (Affirmative Misrepresentation):

A medication app offers a personal health record (not covered by HIPAA) which allows users to track information about their prescription medication history, such as prescription names, dosages, pharmacy and refill information, and the user's health conditions. The app voluntarily discloses PHR identifiable health information to third party companies for advertising and advertising-related analytics, in violation of the app's privacy representations to its users. The third parties that receive the PHR identifiable health information are able to use the information for their own business purposes, such as to improve the third party's own products and services, to infer information about consumers, or to compile profiles about consumers to use for targeted advertising. These disclosures are not authorized under the Rule because they are inconsistent with consumer expectations—the disclosures violate the app's privacy representations, and consumers would also not expect their PHR identifiable health information (which they input into the app to track their medications and health conditions) would be disclosed to, and used by, third party companies that use the data for their own economic benefit.

• By contrast, disclosures of PHR identifiable health information by the app in Example 1 would be authorized if made to service providers in the following circumstances: (1) the service providers assist with functions that are necessary to the operation and functioning of the medication app, or with services the consumer requested; (2) the service providers are contractually prohibited from using, sharing, or disclosing the PHR identifiable health information for any purpose beyond providing services to the medication app; and (3) the medication app's privacy notice clearly and conspicuously discloses the specific purposes for which it shares users' PHR identifiable health information with these service providers. Such authorized disclosures could include those to cloud storage providers that host user data in the health record in a secure fashion; payment processors who process user payments to the app; vendors that facilitate refill reminders or other communications from the app developer that directly relate to the provision of the personal health record or services the consumer requested; analytics providers that assist with tracking analytics relating to the app's functionality;

179

or companies that help to detect, prevent, or mitigate fraud or security vulnerabilities. Such disclosures are authorized because they are consistent with consumer expectations. Importantly, this sharing is disclosed to consumers in a clear and conspicuous manner, and is essential, and limited to, sharing the PHR identifiable health information with service providers solely to provide users with a safe and reliable personal health record experience.

179

This would include an analytics provider whose services are essential to the proper functioning of the app and not tied to marketing or advertising—this includes analytics tools to assist with crash reporting or to assess usage patterns (such as the frequency of use of certain features).

•

Example 2—Unauthorized Disclosure (Deceptive Omission).

The medication app from Example 1 shares PHR identifiable health information with a third party for purposes of targeting consumers with ads. The app does not disclose the sharing and also fails to obtain affirmative express consent from users whose information it shares. The third party company can use the PHR identifiable health information to market and advertise—on behalf of the medication app, on behalf of other companies, or on behalf of itself. It can also use the information to improve its own products and services. Such disclosures are not authorized because they are not consistent with consumer expectations (

i.e.,

without disclosure and without affirmative express consent, consumers would not expect that their PHR identifiable health information would be shared, sold, or otherwise exploited for a purpose other than providing the user with a personal health record, and are neither essential nor limited to sharing the PHR identifiable health information solely to provide users with a safe and reliable personal health record experience). This conclusion is also consistent with Commission enforcement actions relating to the sharing of health information (

e.g.,

GoodRx and Easy Healthcare), and those relating to the sharing of other types of sensitive information.

180

Fed. Trade Comm'n et al.

Vizio, Inc. et al.,

No. 17-cv-00758 (D.N.J. 2017),

https://www.ftc.gov/legal-library/browse/cases-proceedings/162-3024-vizio-inc-vizio-inscape-services-llc.

•

Example 3—Authorized Disclosure (Public Health Reporting):

A COVID-19 contact tracing app not covered by HIPAA allows users to self-report their COVID-19 diagnosis, and to notify the user's contacts of their diagnosis, or others with whom the individual may have come into physical contact. PHR identifiable health information about the individual's COVID-19 diagnosis is transmitted to public health authorities for public health-related purposes, such as public health reporting and analysis or to track areas where the virus is spreading the most rapidly. The contact tracing app discloses to users clearly and conspicuously the specific purposes for which it shares their PHR identifiable health information with public health authorities. These disclosures are authorized, and consistent with consumer expectations, because they are consistent with the company's relationship with the consumer (a PHR that allows a user to report their COVID-19 diagnosis in order to notify others) and are also appropriately disclosed.

Examples 1 and 3 provide guidance about scenarios in which limited disclosures of PHR identifiable health information are permitted without opt-in consent because it is necessary to provide a personal health record to a consumer, is consistent with consumer expectations, the sharing is disclosed to consumers, and (in the case of Example 1) the sharing is subject to protections like service provider agreements that limit the use of the data only for the purpose of providing that service to the consumer. Examples 1 and 3 are also consistent with HIPAA and State health privacy laws.

181

For instance, HIPAA permits disclosures for treatment, payment, and operations without patient authorization.

181

For example, Washington State's My Health, My Data Act permits sharing consumer health data to the “extent necessary to provide a product or service that the consumer to whom such consumer health data relates has requested from such regulated entity or small business.”

See

Revised Code of Washington (RCW) 19.373.030 (1)(b)(ii).

The Commission notes “breach of security” could cover more than just an unauthorized disclosure to a third party. For example, depending on the facts and scope of the authorizations, such as in the company's promises and disclosures to consumers, a “breach of security” could include unauthorized

uses.

There may be a “breach of security” where an entity exceeds authorized access to use PHR identifiable health information, such as where it obtains the data for one legitimate purpose, but later uses that data for a secondary purpose that was not originally authorized by the individual.

Finally, the Commission notes unauthorized access or use of derived PHR identifiable health information may also constitute a breach of security. The Commission noted in its 2023 NPRM that PHR identifiable health information includes “health

information derived from consumers' interactions with apps and other online services (such as health information generated from tracking technologies employed on websites or mobile applications or from customized records of website or mobile application interactions), as well as emergent health data (such as health information inferred from non-health-related data points, such as location and recent purchases).”

182

88 FR 37823.

D. Clarification of What Constitutes a “PHR Related Entity”

1. The Commission's Proposal Regarding “PHR Related Entity”

The NPRM proposed to revise the definition of “PHR related entity” in two ways. Consistent with its clarification that the Rule applies to health apps, the Commission proposed amending the definition of “PHR related entity” to make clear the Rule covers entities that offer products and services through the online services, including mobile applications, of vendors of personal health records. In addition, the Commission proposed revising the definition of “PHR related entity” to provide that entities that access or send unsecured PHR identifiable health information to a personal health record—rather than entities that access or send any information to a personal health record—are PHR related entities.

The Commission explained the first change (to cover online services) was necessary as websites are no longer the only means through which consumers access health information online. The Commission explained the second change—narrowing the scope of “PHR related entities” to entities that access or send unsecured PHR identifiable health information—was intended to eliminate potential confusion about the Rule's breadth and promote compliance by narrowing the scope of entities that qualify as PHR related entities.

183

The Commission identified remote blood pressure cuffs, connected blood glucose monitors, and fitness trackers as examples of internet-connected devices that could qualify as a PHR related entity when individuals sync them with a personal health record (

e.g.,

a health app).

184

The Commission explained, however, that a grocery delivery service that sends information about food purchases to a diet and fitness app would not be a PHR related entity if it does not access unsecured PHR identifiable health information in a personal health record or send unsecured PHR identifiable health information to a personal health record.

183

The proposed definition stated that a PHR related entity is an entity, other than a HIPAA-covered entity or an entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity, that (1) offers products or services through the website, including any online service, of a vendor of personal health records; (2) offers products or services through the websites, including any online services, of HIPAA-covered entities that offer individuals personal health records; or (3) accesses unsecured PHR identifiable health information in a personal health record or sends unsecured PHR identifiable health information to a personal health record. Although the Rule is only triggered when there is a breach of security involving unsecured PHR identifiable health information, the Commission explained it believed there is a benefit to revising the third prong of PHR related entity to make clear that only entities that access or send unsecured PHR identifiable health information to a personal health record—rather than entities that access or send any information to a personal health record—are PHR related entities. Otherwise, many entities could be a PHR related entity under the definition's third prong and such entities would then, in the event of a breach, need to analyze whether they experienced a reportable breach under the Rule. If an entity, per the proposed revision, does not qualify as a PHR related entity in the first place, there would be no need to consider whether it experienced a reportable breach. 88 FR 37825 n.54.

184

The Commission explained, for example, the maker of a wearable fitness tracker may be both a vendor of personal health records (to the extent that its tracker interfaces with its own app, which also accepts consumer inputs) and a PHR related entity (to the extent that it sends information to another company's health app). The Commission noted that regardless of whether the maker of the fitness tracker is a vendor of personal health records or a PHR related entity, its notice obligations are the same: it must notify individuals, the FTC, and in some case, the media, of a breach. 16 CFR 318.3(a), 318.5(b). 88 FR 37825 n.55.

The proposed Rule also revised § 318.3(b) by adding language establishing that a third party service provider is not rendered a PHR related entity when it accesses unsecured PHR identifiable health information in the course of providing services. The Commission explained it did not intend for any entity (such as a firm performing attribution and analytics services for a health app) to be considered both a PHR related entity (to the extent it accesses unsecured PHR identifiable health information in a personal health record) and a third party service provider, which could create competing notice obligations and confuse consumers with notice from an unfamiliar company. The Commission explained it considers such firms to be third party service providers that must notify the health app developers for whom they provide services, who in turn would notify affected individuals.

The Commission explained that distinguishing between third party service providers and PHR related entities would create incentives for responsible data stewardship and for de-identification because a firm would only become an entity covered by the Rule in relation to unsecured PHR identifiable health information. To the extent that firms must deal with unsecured PHR identifiable health information, PHR vendors would have incentives to select and retain service providers capable of treating data responsibly (

e.g.,

by not engaging in any onward disclosures of data that could result in a reportable breach) and incentives to oversee their service providers to ensure ongoing responsible data stewardship (which would avoid a breach).

The Commission observed in most cases, third party service providers are likely to be non-consumer facing. The Commission noted examples of PHR related entities would include, as noted above, makers of fitness trackers and health monitors when consumers sync their devices with a mobile health app. The Commission noted further examples of third party service providers would include entities that provide support or administrative functions to vendors of personal health records and PHR related entities.

2. Public Comments Regarding “PHR Related Entity”

The Commission received numerous public comments about the changes to the definition of PHR related entity. Most commenters supported the Commission's approach.

185

One commenter, an industry association for advertisers, noted that addition of the term “unsecured” in the definition of “PHR related entity” created a limitation on the definition's scope that counterbalances the breadth of including “any online service” in the definition.

186

Moreover, this commenter noted, the addition of “unsecured” creates appropriate incentives for firms to secure PHR identifiable health information and to choose partners who will be good data stewards.

187

This commenter noted that limiting the definition to “unsecured” PHR identifiable health information was consistent with the original intent of the Rule, to cover only the most sensitive types of data not covered by HIPAA.

188

185

ANI at 1; AAFP at 3; AHIMA at 3; AHIOS at 4; AOA at 3; CARIN Alliance at 3; CDT at 12; CHIME at 3; Confidentiality Coal. at 6; Consumer Rep.'s at 6; CHI at 5; DirectTrust at 4; EFF at 2; EPIC at 7.

186

NAI at 4-5.

187

Id.

at 5.

188

Id.

at 4.

A few commenters proposed changes to the definition of “third party service provider” to further distinguish the term from “PHR related entity.” One commenter recommended defining “third party service provider” as an

entity that only processes data.

189

This commenter argued the Commission could then impose liability on service providers for further use, sale, disclosure for incompatible purposes.

190

Another commenter recommended aligning the definition of “third party service provider” with the definition of “business associate” under HIPAA.

191

189

FPF at 10.

190

Id.

191

AdvaMed at 8.

Some commenters raised concerns that the Commission's approach did not provide sufficient clarity for companies trying to understand their obligations as either a third party service provider or PHR related entity.

192

Some commenters requested more examples of types of firms falling within each definition (

e.g.,

examples clearly establishing the status of health data brokers, health marketing firms, search engines, email providers, cloud storage providers)

193

—to facilitate compliance,

194

avoid overlapping notice requirements

195

and to prevent a loophole through which firms may attempt to avoid obtaining consumers' authorization for data disclosures and to avoid providing breach notifications.

196

One commenter urged the Commission to exempt from the definition of “PHR related entity” any firm that complies with the privacy and data security requirements of HIPAA.

197

192

SIIA at 3; CARIN Alliance at 4.

193

AHIMA at 3-4; AMIA at 3-4; CHI at 5; Direct Trust at 1; Light Collective at 4-5.

194

SCRS at 1.

195

NAI at 5.

196

MRO at 3.

197

AdvaMed at 5.

In response to the Commission's request for comment on whether an analytics firm would be a third party service provider, many commenters responded that an analytics firm should fall within that definition

198

for the reasons the Commission articulated: It would be confusing to consumers to receive a notice from a back-end service provider rather than the firm with whom the consumer has the relationship, and categorizing analytics firms (and firms that provide other services) as service providers will create incentives for PHR vendors and PHR related entities to choose their service providers with care. A few commenters, however, expressed concern about covering advertising, analytics, and cloud firms—and health information service providers (“HISPs”) more generally—as they are unable to determine whether the data they receive contains unsecured PHR identifiable health information; only the vendor of the PHR knows what their data transmissions contain.

199

One commenter urged the Commission to address the data recipient's unawareness of the content of the data by creating a safe harbor that exempts advertising, analytics and cloud providers that contractually limit their customers, vendors, or partners from sharing health information with them.

200

198

NAI at 5; TMA at 3; Consumer Rep.'s at 11.

199

CCIA at 7-8; CTA at 9-10; SIIA at 3; Direct Trust at 5.

200

CTA at 13.

3. The Commission Adopts the Proposed Changes to “PHR Related Entity”

After considering the comments received, the Commission adopts the proposed changes regarding “PHR related entity” without further change. The Commission affirms that (1) PHR related entities include entities offering products and services not only through the websites of vendors of personal health records, but also through any online service, including mobile applications; (2) PHR related entities encompass only entities that access or send unsecured PHR identifiable health information to a personal health record; and (3) while some third party service providers may access unsecured PHR identifiable health information in the course of providing services, this does not render the third party service provider a PHR related entity.

In response to commenters who expressed concern that certain data recipients will not be able to understand their obligations under the Rule because they are unaware of the content of the data transmissions they receive, the Commission highlights § 318.3(b), which states: “For purposes of ensuring implementation of this requirement, vendors of personal health records and PHR related entities shall notify third party service providers of their status as vendors of personal health records or PHR related entities subject to this Part.” This requirement puts data recipients on notice about the potential content of the data transmissions they receive.

Firms may also facilitate compliance by stipulating by contract whether transmissions of data will contain unsecured PHR identifiable health information. Both the sender and recipient of the data can monitor for compliance with those contractual agreements through the use of automated tools, internal auditing, external auditing, or other mechanisms, as appropriate to the size and sophistication of the firms and the sensitivity of the data. For example, a large advertising platform that has routinely received unsecured PHR identifiable health information, notwithstanding partners' promises not to send this information, may have different obligations to monitor the data it receives than small firms that do not engage in high-risk activities where the contract precludes sending such data and there is no history of such transmissions.

The Commission believes this approach—notice to service providers pursuant to § 318.3(b) coupled with contracts and oversight—is more appropriate than creating a safe harbor in the Rule that exempts firms that enter into contracts, as there is evidence from FTC cases that firms do not always abide by contractual obligations to safeguard data.

201

Compl. at ¶ 21,

In the Matter of Flo Health, Inc.,

FTC File No. 1923133 (Jan. 13, 2021),

https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3133-flo-health-inc;

Compl. at ¶ 14(d),

In the Matter of UPromise, Inc.,

FTC File No. 1023116 (Mar. 27, 2012),

https://www.ftc.gov/legal-library/browse/cases-proceedings/102-3116-c-4351-upromise-inc; Cf.

Compl. at ¶ 40,

U.S.

Easy Healthcare Corporation,

No. 1:23-cv-3107 (N.D. Ill. 2023),

https://www.ftc.gov/legal-library/browse/cases-proceedings/202-3186-easy-healthcare-corporation-us-v

(alleging that the defendant's disclosures of consumers' health information violated the policies of platforms to which it had agreed).

The Commission declines to change the definition of “third party service provider” to distinguish it further from a “PHR related entity,” for two reasons. First, the Commission notes the current definitions of “third party service provider” and “PHR related entity” align closely with the language prescribed by section 13407 and section 13424(b)(1)(A) of the Recovery Act. Jettisoning the current language entirely, as some commenters suggested, would not be consistent with the Recovery Act's requirements. Second, the Commission believes the current language, in conjunction with the examples provided below, will provide sufficient guidance to the market as to which types of firms fit within each definition.

In response to comments that requested examples of the types of firms that fall into the category of “third party service provider” or “PHR related entity,” the Commission provides the following examples. The Commission believes these examples, in conjunction with the language in § 318.3(b), will provide sufficient clarity about the obligations of third party service providers and PHR related entities to promote compliance, avoid overlapping notice, and prevent loopholes.

•

Example 1:

Four separate firms provide data security, cloud computing, advertising and analytics services to a health app (a personal health record), as specified by their service provider contracts, for the health app vendor's benefit. To perform the services specified in their respective contracts, the firms access unsecured PHR identifiable health information. The firms are “third party service providers” of the vendor of the personal health record (the maker of the health app) because they provide services to a vendor of a personal health record (the maker of the health app) in connection with the offering or maintenance of the app, and they access unsecured PHR identifiable health information as a result of these services. In the event of a breach, they should abide by their obligations as third party service providers.

•

Example 2:

An analytics firm provides analytics services to a health app (a personal health record). The analytics firm and health app vendor do not have a customized service provider contract, although the health app vendor agrees to the analytics firm's standard terms of service. The analytics firm accesses unsecured PHR identifiable health information (device identifier and whether the consumer has paid for therapy). The analytics firm uses that data both to provide analytics services to the health app and for its own benefit, for research and development and product improvement. The analytics firm is a third party service provider to the extent that it provides analytics services to the health app for the health app's benefit because it is then providing services to a vendor of a PHR in connection with the offering of the PHR and accessing unsecured PHR identifiable health information as a result of such services. However, the analytics firm is a PHR related entity, rather than a third party service provider, to the extent that it offers its services through the health app for its own purposes (

i.e.,

for research and development and product improvement) rather than to provide the services. In the event of a breach, the analytics firm must fulfill its notification obligations under the Rule according to which function it was performing in connection with the breach. If the functions are indistinguishable, then, pursuant to § 318.3(b), the Commission will consider the firm a third party service provider for policy reasons: a firm that functions, at least in part, as a service provider may not be consumer-facing, such that the consumer may be surprised by a breach notification from that entity. As a policy matter, it is better for the consumer to receive notice from the health app with whom the consumer directly interacts.

•

Example 3:

A health tracking website (a personal health record) integrates a search bar branded with its maker's logo, which enables its maker (a search engine firm) to offer its services through the website. The search engine firm is a PHR related entity because it offers its services through the website, which is a personal health record. The search bar branded with its maker's logo is consumer-facing, so the consumer would not be surprised to receive a notice from that company if it experiences a reportable breach. By contrast, if the health tracking website had contracted with the search engine firm to provide back-end search services to the website (rather than offering its own branded product or service through the website), and the search engine firm had accessed unsecured PHR identifiable health information as a result of such services, it would be a third party service provider. In the event of a breach, it should abide by its obligations as a third party service provider.

•

Example 4:

Digital readings from a fitness tracker offered by Company A can be integrated into a sleep app offered by Company B (in which the consumer may input other health information). Company A is a PHR related entity to the extent that it offers its fitness tracker product through an online service (Company B's sleep app), and to the extent that it sends unsecured PHR identifiable health information (fitness tracker readings) to a personal health record (the sleep app).

E. Facilitating Greater Opportunity for Electronic Notice

1. The Commission's Proposal Regarding Electronic Notice

The Commission proposed to authorize expanded use of email and other electronic means of providing clear and effective notice of a breach to consumers. In furtherance of this objective, the Commission proposed to update § 318.5 to specify that vendors of personal health records or PHR related entities that discover a breach of security must provide written notice at the last known contact information of the individual. Such written notice may be sent by electronic mail, if an individual has specified electronic mail as the primary contact method, or by first-class mail. The Commission proposed defining “electronic mail” in § 318.2 to mean email in combination with one or more of the following: text message, within-application messaging, or electronic banner. The Commission further specified that any notification delivered via electronic mail should be clear and conspicuous, and the proposed Rule defined “clear and conspicuous.” To assist entities that are required to provide notice to individuals under the Rule, the Commission developed a model notice for entities to use to notify individuals.

202

This model notice was attached as appendix A to the NPRM. 88 FR 37837.

2. Public Comments Regarding Electronic Notice

Nearly every comment submitted on this proposed change supported the Commission's efforts to update the Rule to allow for greater electronic notice.

203

One commenter noted electronic notices increase the likelihood that individuals will receive the notice, may reduce the time it takes for individuals to receive notice, and reduce the burden on entities providing notice.

204

Many commenters also supported the Commission's efforts to provide notice via more than one channel through the new definition of “electronic mail.”

205

203

AHIP at 5; AAFP at 3; AHIMA at 5; AHIOS at 3; Anonymous 3 at 1; Anonymous 10 at 1; Beth Barnett; CARIN Alliance at 7; CHI at 5-6; CHIME at 4; Consumer Reports at 8-9; CTA at 21; EPIC at 10; HIMSS at 4; George Mathew at 1; MRO at 3; NAI at 7; Dharini Padmanabhan at 1; Nancy Piwowar at 1. One commenter also stated while there are clear advantages to allowing increased use of electronic notification of data breaches, this notification method could also increase the likelihood that breaches escape public scrutiny. Identity Theft Res. Ctr. (“ITRC”) at 2.

204

AdvaMed at 5.

205

AAFP at 3; AHIMA at 5; Anonymous 3 at 1; CARIN Alliance at 7; CHIME at 4; CCIA at 7; EPIC at 10; NAI at 7.

However, not all commenters agreed with the Commission's proposal and some commenters offered other suggestions. Some objected to defining “electronic mail” to mean anything more than “email,” stating that electronic mail is commonly understood to mean email and nothing else.

206

A few commenters noted that defining multiple forms of electronic notice could result in entities collecting more information than necessary (and consumers having to provide more information than needed) in order to comply with the Rule.

207

Others preferred a single notice, arguing that multiple forms of notice is burdensome

and could result in over-notification, confusion, and notice fatigue among consumers.

208

One commenter stated the Commission should revise the definition of “electronic mail” to mean “one or more of the following that is reasonable and appropriate based on the relationship between the individual and the relevant vendor of personal health records or PHR related entity: email, text message, within-application messaging, or electronic banner.”

209

Another commenter encouraged the FTC to clarify the in-app messaging method must include push notifications in the event of a breach so consumers are made aware of a breach as soon as possible.

210

One commenter urged the Commission to specify in § 318.5(i) that a banner notice in the affected app or a website home page notice must be posted for a period of 90 days.

211

Another commenter noted that the different mechanisms listed in the proposed rule are not equivalent—this commenter noted that some are push notifications that a consumer is likely to see without directly interacting with the application, website, or device and some require consumer interaction with the application, website, or device in order to see the notification.

212

This commenter recommended that the requirement be selection of one push notification but that additional options like in-app notifications and website banners be supported as additional, secondary notice options.

213

One commenter stated the FTC may want to consider adding a provision allowing an individual to request a copy of the notice in other accessible formats, such as for hearing- or vision-impaired people, or in a non-English language.

214

Another commenter argued the Commission should take into consideration TCPA and CAN-SPAM compliance regarding the delivery of electronic notification. Another commenter stated the Commission's proposal to require two contact methods imposes a higher requirement than HIPAA and State breach notification laws.

215

206

ACLA at 5; Mass. Health Data Forum (“MHDF”) at 9.

207

Consumer Rep.'s at 7-8; CTA at 22. Consumer Reports further suggested the Commission clarify that substitute notice may be effectuated under the Rule via text message, in-app messaging, or electronic banners for consumers that do not wish to share a mailing or email address. Consumer Rep.'s at 8.

208

AdvaMed at 6; ACLA at 5; AHIP at 5; CTA at 21-22;

209

AdvaMed at 6.

210

AHIMA at 5.

211

TechNet at 5.

212

MHDF at 10.

213

Id.

214

AHIP at 5.

215

CHI at 6.

Many commenters endorsed the Commission's proposal that any notification delivered via electronic mail should be “clear and conspicuous,” a newly defined term in the Rule.

216

One commenter stated that consistent with FTC's desire for entities to provide a clear and conspicuous notice, the Commission should consider requiring an email subject line that starts with “Breach of Your Health Information” so that attention is appropriately drawn to the importance of the message content.

217

One commenter disagreed with the new definition, arguing that the definition is unnecessary and confusing, and urged the Commission to insert the “clear and conspicuous” definition directly into § 318.5 of the Rule.

218

216

AMA at 5; CHIME at 5; EPIC at 9.

217

TMA at 4.

218

NAI at 7.

Regarding the model notice, nearly all who commented on this topic urged the Commission to make the model notice voluntary.

219

One commenter suggested that using the model should be a safe harbor that shields entities from enforcement.

220

219

AdvaMed at 6; AHIP at 6; AMA at 6; CCIA at 7; CHI at 6; Consumer Rep.'s at 8-9; NAI at 7-8. One commenter stated that making the model notice mandatory can lead to industry consistency and it may be easier for consumers to understand the message and the contents if they are familiar with a uniform, standardized notice. AHIMA at 5. While the Commission generally agrees that uniform, consistent notices assist with consumer comprehension, the Commission declines to make the model notice compulsory because the facts and circumstances of each breach will vary. Plus, § 318.6 sets forth certain required elements of the content of the notice, so the presence of these elements in all breach notices achieves some degree of consistency across notices.

220

AHIP at 6.

3. The Commission Adopts the Proposed Changes Regarding Electronic Notice

The Commission adopts without change the modifications regarding § 318.5 involving electronic notice and adopts without change the definition of “electronic mail” in § 318.2. The Commission declines to make the other changes commenters requested. First, the Commission believes it is critical, especially given how consumers are accessing information today, to modernize the methods of notice to facilitate greater opportunities for electronic notice. The Commission believes the changes to § 318.5 and the new definition of “electronic mail”

221

in § 318.2 accomplish this objective.

221

The Commission disagrees with the commenters who urged the Commission to avoid defining “electronic mail” to mean anything more than “email.” ACLA at 5; MHDF at 9. The definition in § 318.2 is clear and unambiguous. Plus, section 13402(e)(1) of the Recovery Act requires that notification be provided via “written notification by first-class mail” or “electronic mail.” Accordingly, the Commission must use “electronic mail.”

In response to concerns raised about the two-part electronic notice, the Commission agrees with commenters who stated it increases the likelihood that individuals will encounter such notices.

222

The Commission does not agree that it is burdensome for entities to comply with this requirement. For example, an entity who complies with the notice requirement by notifying consumers via email plus posting a website notice likely would not need to expend significant additional time and resources by issuing the second part of the notice (

i.e.,

the website notice), and any “cost” of posting such a notice is outweighed by the benefit to consumers of learning of a breach involving their health information. The Commission also is not persuaded that consumers who, for example, receive an email about a breach coupled with an in-app notice about the same breach will be confused. The Commission believes consumers will understand that such notices relate to the same incident, especially given the Rule's requirement that the notices be “clear and conspicuous.” The Commission also does not find it problematic that the Rule requires notice effectuated via “electronic mail” to occur via two methods while other breach notice laws require one method. The Commission also notes while these amendments are intended to facilitate greater electronic notice, the Rule still permits notice via first-class mail. Accordingly, the contention that this Rule requires two methods of electronic notice is incorrect.

222

AAFP at 3-4 (noting AAFP appreciates “the proposed structure of providing notice in two different electronic formats to increase the likelihood individuals will see them”); CHIME at 5 (“CHIME is supportive of the FTC's approach to revise the “method of notice section” and to structure the breach notification in two parts in order to increase the likelihood that consumers encounter the notice.”); EPIC at 10 (“By requiring email

and

an in-app or website notice option, the expanded definition enables entities to have the best chance at notifying consumers regardless of whether they reliably check their email or continue to use the entity's app or website.”). The Commission also disagrees with the commenter who recommended that the Commission abandon the two-part notice and create a new definition of “electronic mail” where, for example, only a website notice alone would satisfy the notice requirement if such a notice was “reasonable and appropriate.” AdvaMed at 6. The Commission disagrees with this approach and declines to adopt it.

The Commission also declines, in response to public comments,

223

to mandate how notifications are effectuated when sent via “electronic mail,” as the Commission believes it is important to not be overly prescriptive given rapidly changing technologies.

The Commission emphasizes though, as described below, that the notice must satisfy the Rule's definition of “clear and conspicuous.”

223

See supra

notes 210-213.

Nor does the Commission believe, as some commenters argued, the two-part electronic notification will result in additional collections of information by notifying entities. The Commission agrees with commenters who stated entities are generally already collecting the information needed for notice via “electronic mail” and a data minimization issue does not exist.

224

CARIN Alliance at 6; EPIC at 10.

In response to the commenter who suggested the FTC consider adding a provision allowing an individual to request a copy of the notice in other accessible formats, such as for hearing- or vision-impaired people, or in non-English languages,

225

the Commission previously addressed a similar comment in the 2009 Rule Commentary. There, the Commission noted that section 13402(e)(l) of the Recovery Act requires that notification be provided via “written notification by first-class mail” or “electronic mail.” The Commission emphasized then, as we do today, that the Rule does not preclude notifications in accessible formats. The Commission supports their use in appropriate circumstances, in addition to the forms of notice prescribed by the Rule.

226

225

See supra

note 214.

226

74 FR 42972.

The Commission also adopts without modification the definition of “clear and conspicuous.” The Commission agrees with the commenter who indicated it is imperative that a breach notice be reasonably understandable and call attention to the significance of the information that is included in the notice.

227

The Commission believes its definition of “clear and conspicuous” will assist in achieving this objective. The Commission declines, however, to mandate specific language for the email subject line to satisfy the Rule's “clear and conspicuous” requirement, as one commenter had suggested.

228

The Commission emphasizes, however, that the clear and conspicuous requirement would require a notifying entity to use an email subject line that draws the reader's attention to the email notice. The Commission also declines to adopt the suggestion that the definition of “clear and conspicuous” be incorporated directly into § 318.5. The Commission believes the entities seeking information on what “clear and conspicuous” means will find it clearer to consult the definition in § 318.2.

227

AMA at 5.

228

See supra

note 217.

Turning to the model notice,

229

as the Commission noted in the NPRM, the model was intended for entities to use, in their discretion, to notify individuals, and the Commission adopts the same position here.

230

The model is voluntary and while the Commission believes it represents a best practice, using the model is not required to achieve compliance with the Rule.

229

The model notice is found in appendix A.

230

88 FR 37827.

The Commission declines to adopt the position that use of the model notice provides a safe harbor, although the Commission would take into consideration in an enforcement action an entity who follows the model notice. Further, the Commission notes an entity who follows the model notice can nevertheless violate the Rule in other ways. For example, an entity could follow the model notice but fail to provide timely notice. In such instances, providing a safe harbor because the entity utilized the model notice would be inappropriate.

F. Revisions to the Required Content of Notice

1. The Commission's Proposal Regarding Content of Notice

The Commission proposed five changes to the content of the notice. First, in § 318.6(a), as part of relaying what happened regarding the breach, the Commission proposed the notice to individuals also include a brief description of the potential harm that may result from the breach, such as medical or other identity theft. Second, the Commission proposed to amend the requirements for the notice under § 318.6(a) to include the full name, website, and contact information (such as a public email address or phone number) of any third parties that acquired unsecured PHR identifiable health information as a result of a breach of security, if this information is known to the vendor of personal health records or PHR related entity (such as where the breach resulted from disclosures of users' sensitive health information without authorization). Third, the Commission proposed modifications to § 318.6(b), which requires that

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.