Practice Fusion and Purdue Pharma case: The article describes how a federal prosecutor in Vermont uncovered a kickback scheme between an electronic health record vendor (Practice Fusion) and a pharmaceutical company (Purdue Pharma) that used AI to prompt doctors to prescribe addictive painkillers. This case resulted in criminal and civil settlements for both companies in 2020.
DOJ’s probes of AI tools: The article reports that DOJ investigators are now subpoenaing other pharmaceuticals and digital health companies to learn more about their use of AI tools that match patients with certain drugs and devices. The article cites sources who say that the probes are still in early stages and may be part of the Biden administration’s initiative to regulate healthcare AI.
Challenges and risks of AI tools: The article explains that the use of AI tools in patient records can have both benefits and harms, depending on how they are designed and implemented. The article quotes former prosecutors and industry lawyers who say that the AI tools can be difficult to trace and monitor, and can potentially lead to anti-kickback and false claims violations if they are manipulated or influenced by financial incentives.
Future of AI enforcement: The article speculates that the DOJ’s enforcement of AI tools will likely increase in the coming years, as the technology becomes more sophisticated and widespread. The article also suggests that healthcare companies should be careful about how they structure their AI tools and their relationships with business partners to avoid becoming targets of prosecutors.
From KI – October 26th 10am – The courts find for ACB in suit against Quest. The case involved injunctive relief. So, that means an order telling quest to fix it and attorney fees for the plaintiff. We are checking with ACB to make sure we are identifying the correct unit (aka unit violating ADA). As for an appeal, it would go to the Ninth Circuit, which tends to be more on the side of persons with disabilities than not. We imagine there could be post verdict motions. As far as cost goes, plaintiffs would be entitled to their attorney fees and the defendant would of course have to pay their own attorney fees as well. A relevant blog entry is here. Just What Is a Sales Establishment Anyway per Title III of the ADA?
Thanks to Bill for alerting us. He is a great and recommended resource. William D. Goren, Esq., J.D., LL.M., Attorney and Consultant, Americans with Disabilities Act (ADA), https://www.understandingtheada.com/
ALEXANDRIA, Va., Oct. 25, 2023 /PRNewswire/ — Following a week-long bench trial in Los Angeles, a federal court in California found Quest Diagnostics in violation of the Americans with Disabilities Act and permanently enjoined Quest from continuing to violate the ADA.
Beginning in 2016, Quest Diagnostics began to install self-service kiosks at its Patient Service Centers, which allow patients to, among other things, check in for phlebotomy appointments in a private and independent manner. Following complaints from ACB’s members that these kiosks as designed prevent people who are blind from accessing their services, ACB joined a civil rights complaint in federal court alleging that Quest’s kiosks deprived members of the blind community full and equal enjoyment of Quest’s services and failed to provide effective communication.
quest kiosk
The Court ruled in favor of ACB and a nationwide class of blind and low-vision Quest patients. The court found that Quest violated Title III of the ADA in that Quest failed to provide people who are blind with full and equal enjoyment of Quest’s services and facilities because of their disability.
“Self-service kiosks are being used more and more in many aspects of daily public life,” said Dan Spoone, Executive Director for the American Council of the Blind. “The Court’s decision that Quest violated the ADA and that the check-in services of these kiosks must be accessible to people who are blind is a significant step towards ensuring that the rights to full and equal enjoyment and effective communication are protected.”
Deb Cook Lewis, ACB’s president, added, “Although the ADA is more than 30 years old, people who are blind are still forced to fight for full and equal access to healthcare. This judgment sends a clear message that full and equal enjoyment is required by law, and health care providers must ensure access for people with disabilities.”
This litigation has been led by ACB’s counsel at Nye Sterling Hale Miller and Sweet and at Handley Farah & Anderson.
Matthew Handley, one of ACB’s attorneys in the litigation, added, “Touchscreen kiosks are an ever-increasing aspect of our daily lives – this decision ensures that accessibility of those kiosks will need to be front and center in the minds of every company wishing to make use of self-service technology.”
About the American Council of the Blind
The American Council of the Blind is a national member-driven consumer organization representing Americans who are blind and visually impaired. During the organization’s 60-year history, ACB has become a leader in national, state, local, and even international advocacy efforts. With 66 affiliates, ACB strives to increase independence, security, equality of opportunity, and to improve the quality of life for all people who are blind and visually impaired. For more information, visit ACB’s website.
About Handley Farah & Anderson
Handley Farah & Anderson are lawyers who seek to improve the world. Based in Washington, D.C., they fight for: workers deprived of wages, consumers deceived about products, tenants denied access to housing, parents deprived of adequate parental leave, persons with disabilities denied access, and women and communities of color subject to discrimination.
SOURCE American Council of the Blind
More Background
ID Card Scanning
Always a pain here is a video on how Acuant used in Quest kiosk
Quest Diagnostics Streamlines Patient Check-in with Aila’s Interactive Kiosk
Quest Diagnostics selected Aila’s Interactive Kiosk as a rugged, adaptable self-service platform to create its next-generation patient check-in experience. Aila’s expertise in patient check-in for enterprise healthcare providers gave Quest the confidence that Aila could provide the technology and support to deploy a major new experience in its patient service centers. “Aila was a known solution that would work for us,” said Congersky, “this helped us avoid a lengthy product exploration process.”
The Interactive Kiosk was able to save phlebotomists’ time by automating a range of customer experiences that previously required face-to-face interaction:
ID and insurance card scanning
Smartphone scanning for pre-registered patients
Digital check-in and wait list queuing
The Interactive Kiosk also provided a platform that was adaptable for Quest’s evolving check-in experience. This includes, a way for patients to check in for someone else, such as a child or parent, schedule service times on-site, and give patients the option to wait in their vehicle after checking in where they’ll receive a text message when it’s their turn.
In combination with Aila’s Interactive Kiosk and floor stand, Quest further improved the check-in experience by developing a welcome center that also included wall-mounted Interactive Kiosks. This helps guide patients to the self-service center and provides a welcoming environment to check in. Having a range of mounting options to choose from further illustrates Aila’s ability to enable ideal solutions across thousands of locations with differing layouts.
Protecting Health Data Privacy: CTA’s Stance on FTC’s Proposed Changes
Editors Note: nice article by Rachel Nemeth explaining the CTA opposition or comments on the FTC NPRM
Rachel Nemeth
Senior Director Regulatory Affairs at Consumer Technology Association
In mid-May, the Federal Trade Commission (FTC) proposed modifications to the Health Breach Notification Rule, sparking an important discussion on health data privacy. As North America’s largest technology trade association, the Consumer Technology Association (CTA) stands committed to protecting personal health data while supporting innovation. However, certain aspects of the proposed rule have raised concerns.
Some background first.
The Health Breach Notification Rule requires certain entities (like businesses and non-profits) that are not covered by HIPAA (which covers most hospitals, doctors’ offices and insurance companies) to notify customers and the FTC if there’s a breach of health data information.
Congress directed the FTC to implement this Rule via the Health Information Technology for Economic and Clinical Health Act (HITECH Act), but the recent proposed changes extend beyond Congress’ originally intended scope. The fundamental purpose of the Rule is to facilitate timely notification of significant health data breaches – not broadly regulate health data.
CTA responded to the FTC.
While CTA shares the FTC’s priority of protecting personal health data privacy and security, we find certain proposals impractical, unhelpful for consumers, and unduly burdensome. This week, CTA officially responded to the FTC on these unnecessary proposals.
Our full comments are available here, but below is a summary of what we said:
Scope of Covered Parties should be limited.
The scope of the entities covered by the Rule should be limited, consistent with the original intent of the HITECH Act. This means excluding merchants who sell diverse products, but including apps that collect health data from various sources. Additionally, exclude service providers like cloud computing, analytics, and advertising, especially if they are not intentionally handling covered health data.
Scope of a “Breach of Security” should be narrowed.
The Rule should focus on unauthorized “acquisition” of covered health data, excluding accidental or well-intentioned unauthorized access or sharing where the information isn’t actually taken by a third party. This avoids reporting minor incidents and wasting resources. CTA supports not defining “authorization” as it goes beyond the Rule’s purpose. CTA also recommends adding exceptions for “unauthorized” data taking, similar to HIPAA and state privacy laws, to enhance regulatory clarity.
Arbitrary reporting timelines and triggers should be avoided.
The Commission should replace fixed timelines for reporting breaches based on when a company finds a potential security issue. Instead, reporting should happen when a company reasonably confirms an actual security breach and should offer more time for certain incidents. This approach decreases unnecessary reports, lets companies focus on investigating possible issues, and aligns better with state data breach reporting laws.
Notice procedures should be simplified.
Simplifying the consumer notice form and content ensures actionable information reaches consumers efficiently. Streamlining email notifications and avoiding speculative breach risk requirements improves communication clarity.
In conclusion, CTA remains committed to working with the FTC in creating a balanced, practical, and consumer-focused Health Breach Notification Rule. One of our goals is to safeguard personal health data privacy and security while fostering innovation and economic growth. Considering industry feedback and recommendations will ensure a Rule that enhances consumer trust, protects data, and supports the continued growth of the technology industry.
Together, we can build a secure and innovative digital future for all.
Senior Director Regulatory Affairs at Consumer Technology Association
1 CommentComments on Rachel Nemeth’s article
Craig Allen Keefner(Kiosk Industry)YouSelf Service Just Works
(edited)
Advertising and analytics should be removed from consideration? Data exposure should also be removed? Would be helpful to have practical examples of how the FCC is going to far. Whose interests are better served? On first read it would seem your opposition is less about being more helpful for consumers and more about reducing scope and communication. And even when you get notified of a breach (e.g. MOVEit and Colorado Health) they simply give you a coupon for 2 years on Experion and consider it fixed. Right now too we have VISA and MC telling us all of our credit card loyalty programs are going away if the Congress passes the “competition is good” law.
FTC Abstract
FTC Proposes Amendments to Strengthen and Modernize the Health Breach Notification Rule
The Federal Trade Commission is seeking comment on proposed changes to the Health Breach Notification Rule (HBNR) that include clarifying the rule’s applicability to health apps and other similar t
The Federal Trade Commission is seeking comment on proposed changes to the Health Breach Notification Rule (HBNR) that include clarifying the rule’s applicability to health apps and other similar technologies.
Since the rule’s issuance, health apps and other direct-to-consumer health technologies, such as fitness trackers, have become commonplace. The proposed changes to the rule come as business practices and technological developments increase both the amount of health data collected from consumers, and the incentive for companies to use or disclose that sensitive data for marketing and other purposes.
“We are witnessing an explosion of health apps and connected devices, many of which aren’t covered by HIPAA, collecting vast amounts of sensitive consumer health information. When this information is breached, it is more vital than ever that mobile health app developers and others covered by the Health Breach Notification Rule provide consumers and the FTC with timely notice about what happened,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “The proposed amendments to the rule will allow it to keep up with marketplace trends, and respond to developments and changes in technology.”
The rule requires vendors of personal health records (PHR) and related entities that are not covered by the Health Insurance Portability and Accountability Act (HIPAA) to notify individuals, the FTC, and, in some cases, the media of a breach of unsecured personally identifiable health data. It also requires third party service providers to vendors of PHRs and PHR-related entities to provide notification to such vendors and PHR-related entities following the discovery of a breach.
Protecting the privacy and security of personal health data is a high priority for the FTC, which has brought several cases in recent years involving the misuse of consumers personal health data, including two enforcement actions that alleged HBNR violations.
Earlier this week, the FTC announced a proposed order settling allegations that fertility app Premom violated the HBNR. In February 2023, the FTC announced its first enforcement action under the HBNR against telehealth and prescription drug discount provider GoodRx Holdings Inc. The FTC says GoodRx and Premom each violated the rule by failing to notify users about the companies’ unauthorized disclosure of users’ personally identifiable health information to third parties.
As part of a regular review of Commission rules, the FTC in 2020 sought comment on whether changes were needed to the HBNR. In September 2021, the FTC issued a policy statement affirming that health apps and connected devices that collect or use consumers’ health information must comply with the Health Breach Notification Rule.
After reviewing the public comments and consistent with the policy statement, the Commission has proposed the following changes to the HBNR:
Revising several definitions to clarify the rule’s application to health apps and similar technologies not covered by HIPAA. This includes modifying the definition of “PHR identifiable health information” and adding two new definitions for “health care provider” and “health care services or supplies”;
Clarifying that a “breach of security” under the rule includes an unauthorized acquisition of identifiable health information that occurs as a result of a data security breach or an unauthorized disclosure;
Revising the definition of “PHR related entity” in two ways that pertain to the rule’s scope. For example, it makes clear that only entities that access or send unsecured PHR identifiable health information to a personal health record — rather than entities that access or send any information to a personal health record — qualify as PHR related entities;
Clarifying what it means for a personal health record to draw PHR identifiable health information from multiple sources;
Authorizing the expanded use of email and other electronic means of providing clear and effective notice of a breach to consumers;
Expanding the required content that should be provided in the notice to consumers. For example, the notice would be required to include information about the potential harm stemming from the breach and the names of any third parties who might have acquired any unsecured personally identifiable health information; and
Adding changes to improve the rule’s readability and promote compliance.
The public will have 60 days after the notice is published in the Federal Register to submit comments on the proposed changes to the rule. Information on how to submit a comment can be found in the notice. Once processed, the comments will be posted to Regulations.gov.
The Commission voted 3-0 at an open Commission meeting to publish the proposed changes to the HBNR in the Federal Register.
The lead staff attorneys on this matter are Ryan Mehm, Ronnie Solomon, and Elisa Jillson of the FTC’s Bureau of Consumer Protection.
June 15, 2023 — New updated dates for US Access Board NPRMs for EV and POS. Also, ANSI has just released their new EV standards, which include ADA considerations. Thanks to Steve Taylor with TaylorPOS for reminding us of the NPRM dates.
Accessibility Guidelines for Self-Service Transaction Machines
This rulemaking would amend the Architectural and Transportation Compliance Board’s existing accessibility guidelines for buildings and facilities under the Americans with Disabilities Act (ADA) and the Architectural Barriers Act (ABA), located at 36 CFR part 1191, to include guidelines for the accessibility of fixed self-service transaction machines, self-service kiosks, information transaction machines, and point-of-sale devices. The U.S. Department of Transportation and U.S. Department of Justice are expected, via separate rulemakings, to adopt these amended guidelines as enforceable standards for devices and equipment covered by the ADA. RIN: 3014-AA44
Accessibility Guidelines for Electric Vehicle Charging Stations
Electric vehicle (EV) charging stations are becoming commonplace with the rising production and use of electric and plug-in hybrid vehicles. According to the U.S. Department of Energy, there are nearly 50,000 public EV charging stations with almost 127,000 charging ports across the country. The Infrastructure Investment and Jobs Act, signed into law in November 2021, allocates $7.5 billion to construct a national network of 500,000 EV charging stations to accelerate the adoption of EVs. It is expected that the installation and use of EV charging stations will continue to expand; however, at present, there are no federal regulations specifying accessibility requirements for EV charging stations to ensure that they are accessible to and useable by persons with disabilities. The Access Board thus intends to publish a notice of proposed rulemaking to supplement its Accessibility Guidelines under the Americans with Disabilities Act (ADA) and Architectural Barriers Act (ABA) with scoping and technical requirements for electric vehicle charging stations. RIN: 3014-AA48
Timetable:
ACTION
DATE
FR CITE
NPRM
07/00/2023
ANSI Publishes Roadmap of Standards and Codes for Electric Vehicles at Scale
New York, June 14, 2023: The American National Standards Institute (ANSI) announced today the publication of the Roadmap of Standards and Codes for Electric Vehicles at Scaledeveloped by the Institute’s Electric Vehicles Standards Panel (EVSP). The roadmap’s primary focus is on light-duty, on-road plug-in electric vehicles (EVs) that are recharged via a connection to the electrical grid, as well as the supporting charging infrastructure needed to power them. Medium and heavy-duty EVs are also covered, as is wireless charging. A total of 37 standardization gaps are identified with corresponding recommendations across the topical areas of vehicle systems, charging infrastructure, grid integration, and cybersecurity. It is hoped that the roadmap will see broad adoption by the user community and will facilitate a more coherent and coordinated approach to the future development of standards for EVs.
The Kiosk Manufacturer Association (KMA) is an Associate Sponsor. (UL is the premier sponsor)
ADA Excerpt:
(c) The American with Disabilities Act of 1990 (ADA), and implementing regulations, apply to EV charging stations by prohibiting discrimination on the basis of disability by public and private entities. EV charging stations must comply with applicable accessibility standards adopted by the Department of Transportation into its ADA regulations (49 CFR part 37) in 2006, and adopted by the Department of Justice into its ADA regulations (28 CFR parts 35 and 36) in 2010. 45 The U.S. Access Board, an independent federal agency that issues accessibility guidelines under the Americans with Disabilities Act(ADA), Architectural Barriers Act(ABA), Rehabilitation Act of 1973, and other laws, has provided a technical assistance document “Design Recommendations for Accessible Electric Vehicle Charging Stations” 46 to assist in the design and construction of electric vehicle (EV)
charging stations that are accessible to and usable by people with disabilities. In the Fall 2022 Unified Agenda and at recent Board Meetings, the Access Board announced that it anticipates a Notice of Proposed Rulemaking (NPRM) for EVSE towards the end of the summer of 2023. Noting the expected continuing expansion and use of EV charging stations, the Board noted in relevant part that: [T]here are no federal regulations specifying accessibility requirements for EV charging stations to ensure that they are accessible to and useable by persons with disabilities. The Access Board thus intends to publish a notice of proposed rulemaking to supplement its Accessibility Guidelines under the Americans with Disabilities Act (ADA) and Architectural Barriers Act (ABA) with scoping and technical requirements for electric vehicle charging stations.
47 44 https://www.federalregister.gov/d/2023-03500/p-385 45 https://www.federalregister.gov/d/2023-03500/p-465 46 The Access Board, “Design Recommendations for Accessible Electric Vehicle Charging Stations” last updated 7/21/2022, Accessed 3/13/2023 https://www.access-board.gov/tad/ev/ 47 The Access Board, “Accessibility Guidelines for Electric Vehicle Charging Stations,” RIN: 3014-AA48, Fall 2022,Accessed 2/13/2023 https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202210&RIN=3014-AA48
ANSI EVSP Roadmap of Standards and Codes for Electric Vehicles at Scale Page 101 of 170
The DOE Clean Cities Coalition Network provides best practices for installing ADA-compliant EV charging stations. 48
In addition, the California Division of the State Architect has developed accessibility requirements for EV charging, which are part of the California Building Code. 49
The 2021 International Building Code® (IBC®), section 1107, provides that no less than 5% of vehicle spaces at an EV charging site, and not fewer than one space for each type of EV charging system, shall be accessible. 50 This is not required for R-2, R-3, and R-4 occupancies. In terms of standards activity, ICC A117.1—2017 Accessible And Usable Buildings And Facilities, section 502.11, provides requirements that EV charging stations comply with requirements for operable parts (card readers) and are free of obstructions between the charging station and the adjacent parking space. 51 As noted, there is some policy activity anticipated. At this time, no codes and standards gap has been identified.
Vispero/TPGi Listed in AWS Marketplace for the U.S. Intelligence Community
Couple of news items for screen reader news, both from Vispero, the leader with JAWS Kiosk software. From PRnewswire — Vispero/TPGi Software now available to 18 U.S. Intelligence Agencies in AWS Marketplace
JAWS Kiosk AWS Marketplace
CLEARWATER, Fla., June 7, 2023 /PRNewswire/ — Vispero® and TPGi®, global leaders in accessibility software and services, today announced the availability of their offerings in the AWS Marketplace for the U.S. Intelligence Community (IC). The AWS Marketplace for the U.S. IC offerings includes a broad array of common software infrastructure, developer tools, and business software products that support the unique needs of the U.S. IC through improved security, increased mission impact, and cost savings. TPGi’s Accessibility Resource Center (ARC) software allows companies of all sizes to manage accessibility programs via one powerful integrated dashboard and to access a central repository of over 600 KnowledgeBase articles from worldwide experts in accessibility.
“We are pleased to offer our software in the AWS Marketplace for the U.S. IC to help government agencies assure their digital assets are usable by all employees and citizens while complying with Section 508 and accessibility standards,” said Matt Ater, Vice President of Vispero.AWS Marketplace for the U.S. IC provides the same purchasing convenience, open and transparent license terms and conditions, and a variety of pricing models, including hourly usage and annual subscription, as the commercial AWS Marketplace. It also supports Bring-Your-Own-License (BYOL) so that agencies can more easily migrate existing software licenses and applications to the cloud. For more information on AWS Marketplace for the U.S. IC, contact [email protected].
About Vispero
Vispero is a global leader in assistive technology products for those with vision impairments. Freedom Scientific, TPGi, Enhanced Vision, and Optelec, all Vispero brands, have a long history of innovation for customers with accessibility needs. Today our product portfolio is considered one of the most diverse and reliable on the market.
About TPGi
TPGi provides digital accessibility software and services to help businesses reduce risk, grow revenue, and improve user experience. With over 20 years of experience and 21 employees actively influencing accessibility standards on the World Wide Web Consortium (W3C), TPGi offers the most robust knowledge base and accessibility expertise in the industry as well as award-winning self-service kiosk software. Our tailored approach has enabled 1000+ customers to achieve the best outcomes for their businesses, their employees, and their consumers.
SOURCE TPGi LLC
Disability:IN show in Orlando in July
jaws kiosk
Join Vispero® and TPGi at the #DisabilityInclusion event of the year. You can stop by our booth and check out Matt Ater speak during “Creating A Culture Beat: Drumming Up Support for Digital Accessibility.”
One of the most interesting opportunities at the HIMSS annual conference is the chance to see demos of a wide variety of health IT solutions. At this year’s event, we decided to film a number of demos of interesting health IT products that we thought readers of Healthcare IT Today would find useful. If you want to see all of these demos as we share them, be sure to subscribe to the Healthcare IT Today YouTube channel.
The first demo I’m excited to share is by Nicky Shaw, US Operations Manager at Storm Interface. Shaw demonstrates how you can take a healthcare kiosk and make it accessible for those who may have visual or other impairments.
Health centers in the Oklahoma City area will be approximately 5,750 square feet, located beside Walmart Supercenters, and will feature Walmart Health’s full suite of health services. Noted on FierceHealthcare
In Brief Summary
2024 is target
Oklahoma City will get a couple
Other states expanding include Missouri, Arizona and Texas
Walmart and United Healthcare partnering
Excerpt
The health centers in the Oklahoma City area will be approximately 5,750 square feet, located beside Walmart Supercenters, and will feature Walmart Health’s full suite of health services. These services may vary by location but include primary care, labs, X-ray and EKG, behavioral health, dental, hearing, select specialty services, community health and telehealth.
Walmart inked a partnership with health IT behemoth Epic back in 2021 to use its electronic health records system to connect records across all of its healthcare services, including virtual care. Epic’s technology will eventually support all of Walmart’s health and wellness lines of business.
1 CommentComments on Rachel Nemeth’s article
Craig Allen Keefner(Kiosk Industry)YouSelf Service Just Works
FTC Proposes Amendments to Strengthen and Modernize the Health Breach Notification Rule
The Federal Trade Commission is seeking comment on proposed changes to the Health Breach Notification Rule (HBNR) that include clarifying the rule’s applicability to health apps and other similar t
The Federal Trade Commission is seeking comment on proposed changes to the Health Breach Notification Rule (HBNR) that include clarifying the rule’s applicability to health apps and other similar technologies.
Since the rule’s issuance, health apps and other direct-to-consumer health technologies, such as fitness trackers, have become commonplace. The proposed changes to the rule come as business practices and technological developments increase both the amount of health data collected from consumers, and the incentive for companies to use or disclose that sensitive data for marketing and other purposes.
“We are witnessing an explosion of health apps and connected devices, many of which aren’t covered by HIPAA, collecting vast amounts of sensitive consumer health information. When this information is breached, it is more vital than ever that mobile health app developers and others covered by the Health Breach Notification Rule provide consumers and the FTC with timely notice about what happened,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “The proposed amendments to the rule will allow it to keep up with marketplace trends, and respond to developments and changes in technology.”
The rule requires vendors of personal health records (PHR) and related entities that are not covered by the Health Insurance Portability and Accountability Act (HIPAA) to notify individuals, the FTC, and, in some cases, the media of a breach of unsecured personally identifiable health data. It also requires third party service providers to vendors of PHRs and PHR-related entities to provide notification to such vendors and PHR-related entities following the discovery of a breach.
Protecting the privacy and security of personal health data is a high priority for the FTC, which has brought several cases in recent years involving the misuse of consumers personal health data, including two enforcement actions that alleged HBNR violations.
Earlier this week, the FTC announced a proposed order settling allegations that fertility app Premom violated the HBNR. In February 2023, the FTC announced its first enforcement action under the HBNR against telehealth and prescription drug discount provider GoodRx Holdings Inc. The FTC says GoodRx and Premom each violated the rule by failing to notify users about the companies’ unauthorized disclosure of users’ personally identifiable health information to third parties.
As part of a regular review of Commission rules, the FTC in 2020 sought comment on whether changes were needed to the HBNR. In September 2021, the FTC issued a policy statement affirming that health apps and connected devices that collect or use consumers’ health information must comply with the Health Breach Notification Rule.
After reviewing the public comments and consistent with the policy statement, the Commission has proposed the following changes to the HBNR:
The public will have 60 days after the notice is published in the Federal Register to submit comments on the proposed changes to the rule. Information on how to submit a comment can be found in the notice. Once processed, the comments will be posted to Regulations.gov.
The Commission voted 3-0 at an open Commission meeting to publish the proposed changes to the HBNR in the Federal Register.
The lead staff attorneys on this matter are Ryan Mehm, Ronnie Solomon, and Elisa Jillson of the FTC’s Bureau of Consumer Protection.