Antitrust Law Daily Wrap Up, PRIVACY NEWS: FTC outlines its health information privacy and security efforts before Congress, (Mar 22, 2016)

By Edward L. Puzzo, J.D.

The FTC has been working in various ways to protect the privacy and data security of consumers' health information—particularly in areas where health information is being collected, used, and shared outside of doctors’ offices or other traditional medical contexts—according to Jessica Rich, Director of the FTC’s Bureau of Consumer Protection. Rich testified today before the House Oversight and Government Reform Subcommittees on Information Technology and Health, Benefits, and Administrative Rules.

The Director noted that consumers are increasingly using new health-related devices, apps, and services to track their health-related information, such as glucose levels and diet. This data is then stored outside traditional medical contexts not covered by the privacy protections of the Health Insurance Portability and Accountability Act (HIPAA). There may be unauthorized disclosure of health data, which may be highly sensitive.

Law enforcement. The FTC believes it has jurisdiction over these new products, even where HIPAA does not. Under Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices in or affecting commerce, the FTC has acted to protect consumer health data. As an example, Rich cited actions against an online billing portal, PaymentsMD, that failed to inform consumers that it would be seeking highly-detailed medical information about them from pharmacies, medical labs, and insurance companies. The FTC obtained an order requiring PaymentsMD to destroy all information obtained as a result of its deceptive sign-up process and to refrain from making future privacy misrepresentations. Rich noted that the FTC has entered more than 60 settlements since 2001 regarding the failure to have appropriate data security practices in place regarding consumer data, including health data.

Policy initiatives and education. Rich also testified regarding recent FTC initiatives relating to the privacy and security of health information. These included a seminar on Consumer Generated and Controlled Health Data, a staff report on the Internet of Things (IoT), and FTC coordination with the Department of Health and Human Services' Office of the National Coordinator for Health Information Technology (ONC). She also testified about FTC efforts in consumer education and business guidance regarding better data security and privacy practices.

Additional authority. Finally, Rich reiterated the FTC's longstanding, bipartisan call for federal legislation that would (1) strengthen its existing data security authority and (2) require companies, in appropriate circumstances, to provide notification to consumers when there is a security breach.

News: Privacy ConsumerProtection FederalTradeCommissionNews