United States of America: Announced FTC Amendments to Health Breach Notification Rule

On 18 May 2023, the US Federal Trade Commission (FTC) proposed amendments to the Health Breach Notification Rule (HBNR). The Health Breach Notification Rule (HBNR) applies to vendors of personal health records and related entities that are not covered by the Health Insurance Portability and Accountability Act (HIPAA). The FTC stated that in response to the increasing use of health apps and direct-to-consumer health technologies that collect an increasing amount of sensitive consumer health information, it aims to expand the HBNR applicability and clarify obligations. Under the proposed amendments, health applications and similar technologies would be subject to HBNR, and an entity’s unauthorised disclosure of health data would qualify as a “breach of security”, requiring reporting. Furthermore, the amendments outline the information that entities would be required to provide to consumers in case of data reach, such as potential harm resulting from the security incident and the third parties that might have acquired their health data. The public consultation on the proposed amendments will open following the publication in the Federal Register.