The Federal Trade Commission has issued a Policy Statement instructing health app and connected device companies to comply with existing data breach notification rules. A “breach of security” under the new regulation includes the acquisition of identifiable health information without the authorization of the individual.
A “breach of security” does not only mean a cybersecurity mishap, or the result of “nefarious activity,” but also prohibits the sharing of protected data without the consent of the user.
Upon discovery of a data breach, a health entity is obligated to notify each affected United States citizen, as well as the FTC.
Privacy laws are meant to protect patients’ personal health data, and when institutions fail to protect personal data they may be sued for damages. In recent years much health data has been leaked and stolen, causing significant damages to plaintiffs who have taken legal action.