Makers of health-related mobile apps and other businesses will soon be covered by the Federal Trade Commission’s (FTC) amended rule on health data breach notifications, which takes effect on July 29. These amendments, finalized in April, significantly expand the scope of the FTC’s breach notification rule, encompassing companies that provide healthcare services and aggregate health information from multiple sources. Previously, these companies, often developers of health apps, were not covered under the Health Insurance Portability and Accountability Act (HIPAA).
As highlighted in a recent report, the amendments bring new compliance challenges. Legal professionals note that the FTC’s lack of specificity regarding what constitutes “authorized access” to health information could result in increased litigation. Without clear definitions, companies may struggle to determine what constitutes permissible actions under the revised rules.
These changes make it imperative for businesses dealing with health data to reassess their compliance frameworks and seek legal counsel to navigate the updated requirements. The FTC’s shift aims to boost consumer protection in the rapidly evolving digital health landscape, but it also opens the door to potential legal disputes as companies and courts interpret the new regulations.
Attorneys specializing in privacy and healthcare law will be crucial in helping businesses understand and implement these changes, ensuring that they mitigate risks associated with the expanded regulatory scope. The legal community should prepare for an uptick in litigations as the industry adjusts to the FTC’s updated breach notification rule.