Mobile health apps must follow FTC breach notice rule after update
By 
Adrianne Appel2024-04-26T18:49:00
Mobile health applications and similar technologies must notify customers following a data breach or risk violating the Federal Trade Commission’s (FTC) health breach notification rule (HBNR), part of a broad update approved by the agency.
Many providers of direct health services, such as hospitals and doctors, are required to protect personal information under the Health Insurance Portability and Accountability Act (HIPAA). The HBNR pertains to health entities not beholden to HIPAA, such as certain vendors of health records, and requires them to notify individuals about data incidents.
The FTC has applied the HBNR to mobile health applications, as its recent enforcement actions against GoodRx and Easy Healthcare show.
THIS IS MEMBERS-ONLY CONTENT
You are not logged in and do not have access to members-only content.
If you are already a registered user or a member, SIGN IN now.
Related articles
-
News BriefCerebral set to pay $7M over alleged patient data sharing
The Department of Justice and Federal Trade Commission proposed telehealth company Cerebral pay a total of $7 million for its alleged sharing of patient data and deceptive business practices in violation of the FTC Act.
-
News BriefState AGs tell UnitedHealth to do more in cyberattack aftermath
UnitedHealth Group’s response to a major cyberattack in February that wreaked havoc with medical payments nationwide has been “inadequate” and must be improved immediately, a group of 22 state attorneys general told the company.
-
News BriefWilliams-Sonoma fined record $3.2M over admitted ‘Made in USA’ order violations
Kitchen and home retail company Williams-Sonoma agreed to pay nearly $3.2 million for failing to comply with a 2020 administrative order by the Federal Trade Commission prohibiting its marketing of imported goods as made in the United States.
More from Regulatory Policy
-
ArticleCompliance must focus on corruption as EU and U.K. seek to tackle rising risks
Corruption isn’t something that happens somewhere else, in other countries and committed by other people. Nowhere is corruption-proof, and new rules being introduced in the EU and the U.K. aim to focus compliance officers on the full gamut of risks in all jurisdictions and every sector.
-
ArticleEmployment law in the age of AI: Compliance considerations
Employment law in the age of AI is evolving faster than many companies can keep pace. As more states enact AI laws and as more case law piles on, chief compliance officers and in-house counsel must ensure that compliance policies and procedures evolve as AI legal and compliance risks evolve.
-
ArticleCompliance must future-proof AI projects to meet evolving regulations
AI implementations are surging, but many new systems are being abandoned after companies have invested in expensive projects. Now evolving AI regulation is adding to the list of reasons why new systems may fail. Compliance must watch emerging regulatory developments and ensure that any new AI tools are capable of ...