FTC Launches Health Data Privacy Showdown

Does the FTC have this authority?

https://www.politico.com/newsletters/future-pulse/2023/05/23/a-health-data-privacy-showdown-00098249

A health data privacy showdown
By Ben Leonard and Erin Schumaker - May 23, 2023

The Federal Trade Commission’s notice last week about its plan to crack down on health care companies that use customer data for marketing signals legal warfare to come.

That’s according to the legal experts Ben consulted.

The plan to use a 14-year-old cybersecurity rule “really is pushing the envelope,” said Kirk Nahra, a privacy attorney at law firm WilmerHale.

He added: The agency is “retroactively” looking to “revise the rule to fit enforcement actions that it has already taken.”

Nahra expects plenty of comments about the notice’s scope — at this point, it remains a proposal, not a final rule — and potential legal challenges if the FTC doesn’t scale it back.

“They are 100 percent right that health data … does need more comprehensive privacy regulation, but I’m not sure FTC has been given sufficient tools by Congress to do this,” added Deven McGraw, a former high-ranking HHS Office for Civil Rights official and lead of data stewardship and sharing at biotech firm Invitae.

What’s in the proposal? It aims to explain how the FTC’s 2009 Health Breach Notification Rule, initially designed to set out companies’ responsibilities when hackers access their systems, applies to data-sharing for marketing purposes.

If finalized, the proposal would require health care companies to obtain customer approval before sharing their customers’ personally identifiable health information.

It would clarify that health apps, including those offering health services and supplies — broadly defined to include fitness, sleep, diet, and mental health products and services, among a list of categories — would be subject to regulations requiring the companies to notify customers if their identifiable data is accessed by business partners or shared for marketing.

Recent history: Until February, when it reached a settlement with drug price tracker and telehealth provider GoodRx for allegedly violating the rule, the FTC had never used it against companies that knowingly shared customer data with business partners.

What’s next: The FTC said it is looking forward to reviewing comments on its proposal.