FTC’s New Frontier: Regulating Non-HIPAA Health Data

The field of health data privacy is undergoing a significant re-evaluation, driven by the Federal Trade Commission’s (FTC) increasingly assertive stance on non-HIPAA health data. While the Health Insurance Portability and Accountability Act (HIPAA) has long been the bedrock of patient data protection within traditional healthcare settings, the proliferation of digital health apps and wearable devices has created a vast ecosystem of sensitive health information operating outside its direct purview. This regulatory tension, marked by the FTC’s ramped-up enforcement of its Health Breach Notification Rule, has sparked intense debate among industry groups and privacy advocates regarding the appropriate boundaries of federal oversight.

The FTC’s Expanding Reach and the Health Breach Notification Rule

The FTC’s Health Breach Notification Rule (HBNR), initially promulgated in 2009, was designed to fill a critical gap in health data privacy. It mandates that vendors of personal health records (PHRs) and related entities, as well as third-party service providers, notify consumers, the FTC, and in some cases, the media, following a breach of unsecured identifiable health information. In recent years, the FTC has significantly broadened its interpretation and enforcement of this rule, extending its reach to cover a wide array of health apps and connected devices that collect and share sensitive user data. This expanded enforcement reflects a growing concern over the opaque data sharing practices of many digital health platforms. The FTC’s position is that if an app collects health information from consumers, even if it’s not directly integrated with a HIPAA-covered entity, it falls under the HBNR’s jurisdiction when a breach occurs. This has led to a number of enforcement actions, signaling a clear shift in regulatory expectations for companies operating in the non-HIPAA health data space. The number of enforcement actions taken under the FTC Health Breach Notification Rule has seen a notable increase, underscoring the Commission’s commitment to this area FTC Health Breach Notification Rule enforcement actions data. For instance, the FTC took its first HBNR enforcement action against GoodRx in February 2023, followed by actions against BetterHelp and Premom later that year. Plus, in April 2024, the FTC finalized amendments to the HBNR, which took effect on July 29, 2024, further broadening the rule’s scope and clarifying that unauthorized sharing of health data constitutes a “breach”. The core argument from the FTC’s perspective is that consumers expect their health data, regardless of where it is collected, to be handled with care and transparency, and that the HBNR provides a necessary backstop for privacy where HIPAA does not apply.

Arguments for Broader FTC Oversight: The Privacy Advocates’ Perspective

Privacy advocates, such as the Center for Democracy and Technology (CDT), largely support the FTC’s more aggressive enforcement. Their arguments center on the critical need to protect sensitive health information that flows through digital health applications, which often lack the strong privacy safeguards mandated by HIPAA. The CDT, in its public comments and policy papers, emphasizes several key points:

• The “HIPAA Gap”: They highlight the significant portion of health data collected by consumer-facing apps that is not covered by HIPAA, creating a “HIPAA gap” where sensitive information can be shared, sold, or exposed without adequate consumer knowledge or consent. This includes data from fitness trackers, mental health apps, fertility trackers, and symptom checkers.
• Lack of Transparency and Consent: Many apps collect vast amounts of user data, including highly personal health details, often burying data sharing agreements in lengthy, inscrutable terms of service. Privacy advocates argue that this does not constitute informed consent, and users are frequently unaware of how their data is being used by third parties, including advertisers or data brokers.
• Potential for Discrimination and Harm: The sharing of sensitive health data, particularly related to mental health, reproductive health, or chronic conditions, can lead to discrimination in employment, insurance, or other areas. Breaches of this data can have deep and lasting negative impacts on individuals.
• FTC’s Consumer Protection Mandate: The FTC’s broad mandate to protect consumers from unfair and deceptive practices makes it the natural agency to oversee these non-HIPAA entities. The HBNR, when applied expansively, becomes a powerful tool to ensure accountability and incentivize better data security practices.

From this perspective, the FTC’s actions are not an overreach but a necessary evolution of consumer protection in the digital age, ensuring that the spirit of health data privacy extends beyond the traditional doctor’s office.

Industry Concerns: The Boundaries of Jurisdiction and Regulatory Burden

On the other side of the debate, industry groups, including the American Medical Association (AMA), express concerns about the FTC’s expanding jurisdiction and the potential for regulatory overlap or undue burden on companies. While acknowledging the importance of data privacy, their arguments often focus on the practical implications and the distinct nature of different types of health data. The AMA, representing physicians, has submitted formal comment letters expressing its perspective on various aspects of health data regulation. While their primary focus is often on HIPAA-covered entities, their commentary touches upon the broader ecosystem of health data. Key arguments from industry and some healthcare associations include:

• Distinction Between Clinical and Consumer Data: Industry stakeholders often argue for a clear distinction between data generated in a clinical context (covered by HIPAA) and consumer-generated health data from non-medical devices or apps. They contend that applying the same stringent rules to all health-related data, regardless of its source or intended use, might stifle innovation in the digital health space.
• Regulatory Overlap and Confusion: Concerns are raised about potential overlaps between FTC enforcement and existing or future state-level privacy laws, leading to a patchwork of regulations that are difficult for companies to navigate. This can create uncertainty and increase compliance costs, particularly for smaller startups.
• Definition of “Personal Health Record”: Some argue that the FTC’s interpretation of “personal health record” under the HBNR has become overly broad, encompassing nearly any app that touches health-related data, regardless of whether it truly functions as a “record” in the traditional sense. This expansive definition, they contend, was not the original intent of the rule.
• Burden on Innovation: Excessive regulatory burden, especially on early-stage companies, could hinder the development of innovative digital health solutions that genuinely benefit consumers. They suggest that a more nuanced approach, perhaps with tiered regulations based on data sensitivity or intended use, would be more appropriate.

These arguments highlight the tension between strong consumer protection and the desire to foster a dynamic and innovative digital health market. Public comments submitted by healthcare associations to the FTC often reflect these concerns, advocating for clarity and a balanced approach to regulation AMA formal comment letters on health data privacy.

Shifting Compliance Risks for Non-HIPAA Digital Health Apps

For legal counsel and healthcare policy analysts, the ongoing debate and the FTC’s proactive enforcement signal a significant shift in compliance risks for non-HIPAA digital health apps. The traditional comfort zone of operating outside HIPAA’s direct oversight is rapidly diminishing. Companies developing or investing in digital health solutions that collect any form of health-related data must now consider the HBNR as a primary regulatory framework. Key takeaways for compliance include:

• Enhanced Due Diligence on Data Practices: Companies must conduct thorough due diligence on their data collection, storage, sharing, and security practices. This extends to third-party vendors and partners.
• Transparent User Consent: Moving beyond boilerplate terms of service, companies need to implement clear, granular, and easily understandable consent mechanisms for data collection and sharing, particularly for sensitive health information.
• Strong Security Measures: Investment in strong cybersecurity infrastructure and protocols is paramount to prevent data breaches, which can trigger HBNR notifications and significant reputational and financial penalties.
• Proactive Breach Response Planning: Developing and regularly testing a complete breach response plan is important. This includes clear communication strategies for affected users and timely notification to the FTC.
• Monitoring Regulatory Developments: The regulatory field is dynamic. Continuous monitoring of FTC guidance, enforcement actions, and relevant state privacy laws is essential to maintain compliance.

The debate surrounding FTC oversight of non-HIPAA health data shows a broader societal imperative: to safeguard sensitive personal information in an increasingly data-driven world. While the specifics of jurisdiction and regulatory burden will continue to be refined, the direction is clear, accountability for health data, irrespective of its collection point, is becoming the norm.

Methodology and Source Note: This analysis is based on a synthesis of arguments presented in public regulatory filings, specifically focusing on the Federal Trade Commission’s Health Breach Notification Rule public docket, formal comment letters from organizations such as the American Medical Association, and position papers from privacy advocacy groups like the Center for Democracy and Technology.