How far will FTC expand Health Breach Notification Rule enforcement?

The FTC’s proposed Health Breach Notification Rule expansively targets health tech beyond HIPAA, encompassing health apps. Defining PHRs broadly, it mandates breach notification for acquired patient data. New rules aim to cover apps offering health services, broadening what constitutes a PHR and ‘healthcare providers.’ Yet, gaps in defining ‘authorization’ pose ambiguity. The absence of de-identification allowances or risk assessments for breaches adds complexity. Although fostering consumer confidence, the proposed changes raise concerns for tech firms regarding compliance, potential over-notification, and higher enforcement risks. Expected in upcoming months, the final rule holds significance for consumer protection and regulatory enforcement in health tech.