Careers

Diversity

With 17 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Services

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

Randal Shaheen Quoted in National Law Journal on FTC’s Regulatory Approach

Peter Roskam Comments on Political Climate in National Law Journal

ADventures in Law

Dark Patterns Go International: FTC and International Consumer Protection Networks Conduct Sweep of ‘Deceptive Design Practices’ Related to Subscription Services, Privacy

Jeff Paravano, Michelle Hervey, Nick Mowbray Speak to Tax Club of Cleveland

<img decoding="async" loading="lazy" class="alignright wp-image-6759" src="https://www.bakerdatacounsel.com/wp-content/uploads/sites/5/2021/09/abstract-concept-pc-internet-GettyImages-993559176_1200x630_72dpi.jpg" alt="" width="438" height="230" />The U.S. Federal Trade Commission (FTC) issued a <a href="https://www.ftc.gov/system/files/documents/public_statements/1596364/statement_of_the_commission_on_breaches_by_health_apps_and_other_connected_devices.pdf">policy statement</a> on Sept. 15, 2021, warning that the decade-old Health Breach Notification Rule (the rule) – which applies to companies that handle personal health records or collect health data –  to notify consumers, the FTC and, in some cases, the media about data breaches. “In practical terms, this means that entities covered by the rule who have experienced breaches cannot conceal this fact from those who have entrusted them with sensitive health information.”
Introduced in 2009 as part of the American Recovery and Reinvestment Act of 2009, the rule extends to entities that are not subject to the Health Insurance Portability and Accountability Act but may operate in the healthcare space. During an open meeting on Wednesday, by a vote of 3-2, the FTC clarified the reach of the rule, indicating that it applies to health apps and devices that often “fail to invest in data security, leaving users exposed.” The FTC specifically called out health apps and wearable devices that track diseases, diagnoses, treatments, medications, fitness, fertility, sleep, mental health, diet, and other vital areas.
Generally, apps are subject to the rule if they are capable of obtaining health records from multiple sources. For example, if an app uses information that has been input by a user, along with data retrieved through an application programming interface from the fitness tracker or calendar on that person’s phone, it would be covered by the rule. The policy statement comes at a time when, as the FTC points out, the COVID-19 pandemic has caused an increase in telemedicine and the general use of Internet-based health tracking. “While this rule imposes some measure of accountability on tech firms that abuse our personal information, a more fundamental problem is the commodification of sensitive health information, where companies can use this data to feed behavioral ads or power user analytics.”
The lack of consensus on the policy, demonstrated by the 3-2 vote, saw the two opposing Commissioners issuing dissenting opinions against the policy. Commissioner Noah Phillips raised concerns that the rule was issued as the FTC is in the midst of a larger, more complicated rulemaking process. “The majority surely believe the result they adopt is what consumers of health apps want and need,” <a href="https://www.ftc.gov/public-statements/2021/09/dissenting-statement-commissioner-noah-joshua-phillips-regarding-policy">Phillips wrote</a>. “But the right way to go about it is to conclude the ongoing rulemaking process, especially when the statutory and regulatory interpretation on which the majority rely is far from clear.”
The FTC plans to enforce compliance with the rule by imposing financial penalties that can be as high as $43,792 per violation per day. The planned enforcement with penalties is seemingly more than a threat, because a Sept. 14, 2021 vote in the U.S. House Committee on Energy and Commerce saw <a href="https://energycommerce.house.gov/sites/democrats.energycommerce.house.gov/files/documents/Subtitle%20O_FTC%20Privacy%20Enforcement.pdf">the FTC being awarded $1 billion over 10 years</a> to address “unfair or deceptive acts or practices relating to privacy, data security, identity theft, data abuses and similar matters.”

core/freeform

Data Counsel

Privacy Governance and Technology Transactions

Digital Assets and Data Management

FTC Issues Statement Warning Health Apps to Notify Consumers About Data Breaches

Related Services

Featured Insights