Lesley Fair writes:
Shoppers can find a plethora of apps, trackers, and sensors that hold or capture almost every conceivable form of personal health information. If your business or nonprofit offers products like that or provides certain services to entities that do – and you aren’t subject to HIPAA – you may be covered by the FTC’s Health Breach Notification Rule (HBNR). The FTC has two new publications to help determine if the Rule applies to you and the steps you must take if there’s a breach. The FTC also unveiled another new resource to help you meet your compliance obligations.
Entities covered by the Health Breach Notification Rule must notify their customers, the FTC, and, in some cases, the media if there’s a breach of unsecured, individually identifiable health information. In September 2021, the Commission issued a Policy Statement clarifying that the Rule applies to makers of health apps, connected devices, and similar products. A breach under the HBNR includes both cybersecurity intrusions and instances of unauthorized access – for example, when sensitive health information is disclosed without the user’s authorization.
Read more at the FTC’s blog for businesses.