Senior Counsel Jennifer Hennessy was quoted in the Law360 article, “Amid Pandemic, Health Apps Face Privacy Law Patchwork,” which discussed how in a surging market thanks to the coronavirus pandemic, developers of mobile health apps are facing challenges on how to comply with a patchwork of state data security laws.
Much of the traditional health care space is covered by the rigorous data security requirements outlined by federal regulators in the Health Insurance Portability and Accountability Act, or HIPAA. But other companies, like private businesses building apps to screen employees for symptoms of COVID-19, may not be subject to HIPAA’s requirements despite handling sensitive health data.
Separately, the current FTC in May solicited input about whether it should change a decade-old, little-used rule requiring companies that are not covered by HIPAA but still handle health information to publicly report data breaches. The commission asked for advice on whether it should change its Health Breach Notification Rule in light of “legal, economic, and technological changes,” including “developments in health care products or services related to COVID-19.”
The FTC noted at the time that more companies may soon be covered by its rule as patients increasingly turn to technologies such as virtual assistants and mobile health apps that might not be subject to HIPAA. Those companies are instead struggling to navigate a slew of differing state laws addressing how health data should be protected and how to handle a potential data breach. “We think health care and HIPAA go together in this country, and that’s true most of the time, but not always,” Hennessy said.
Much of the traditional health care space is covered by the rigorous data security requirements outlined by federal regulators in the Health Insurance Portability and Accountability Act, or HIPAA. But other companies, like private businesses building apps to screen employees for symptoms of COVID-19, may not be subject to HIPAA’s requirements despite handling sensitive health data.
Separately, the current FTC in May solicited input about whether it should change a decade-old, little-used rule requiring companies that are not covered by HIPAA but still handle health information to publicly report data breaches. The commission asked for advice on whether it should change its Health Breach Notification Rule in light of “legal, economic, and technological changes,” including “developments in health care products or services related to COVID-19.”
The FTC noted at the time that more companies may soon be covered by its rule as patients increasingly turn to technologies such as virtual assistants and mobile health apps that might not be subject to HIPAA. Those companies are instead struggling to navigate a slew of differing state laws addressing how health data should be protected and how to handle a potential data breach. “We think health care and HIPAA go together in this country, and that’s true most of the time, but not always,” Hennessy said.
People
Related News
24 April 2024
In the News
Judith Waltz Discusses Nursing Home Staffing Mandate, Potential Legal Challenges
Foley & Lardner LLP partner Judith Waltz offers insight on a new nursing home staffing rule from the U.S. Department of Health and Human Services and its impact on the industry in the Bloomberg Law article, “Nursing Homes, HHS on Collision Path Over Staffing Mandate.”
23 April 2024
In the News
David Sanders Discusses Lessons Learned from General Counsel Leadership Program
Foley & Lardner LLP partner David Sanders recently joined a panel discussion with members of The Vanguard Network’s General Counsels Advisory Group to discuss the evolving role of the general counsel.
23 April 2024
In the News
Claire Marblestone Discusses HHS Final Rule on Protected Health Information Disclosure
Foley & Lardner LLP Claire Marblestone assessed the U.S. Department of Health and Human Services’ final rule that bars providers, health plans, and other entities covered by the Health Insurance Portability and Accountability Act from disclosing protected health information in a Healthcare Dive article.