As the Federal Trade Commission (FTC) gets significantly more active in enforcing its health care privacy rules, it has teamed with HHS to update a joint guide that can help organizations determine which agency’s rules apply to their specific situation.^[1]

“Collecting, Using, or Sharing Consumer Health Information? Look to HIPAA, the FTC Act, and the Health Breach Notification Rule,” explains organizations’ obligations under those laws to maintain the privacy and security of consumers’ health information and provide notification if they experience a breach.

Protecting the privacy and security of personal health data is a high priority for the FTC, which has brought four cases so far this year, including enforcement actions that alleged violations of the 14-year-old Health Breach Notification Rule (HBNR).^[2]

In July, the FTC proposed changes to the HBNR, clarifying that it applies to health apps and other similar technologies that did not exist when the rule was first written. The FTC’s HBNR requires vendors of personal health records and related entities not covered by HIPAA to notify individuals, the FTC, and, in some cases, the media of a breach of unsecured personally identifiable health data. It also requires third-party service providers to vendors working with those health record vendors to notify them following the discovery of a breach.