If your app relates to health information in these (or other) ways, you\u2019re in the right place. This tool is meant to help you figure out the federal regulatory, privacy, and security laws and regulations that may apply. (Hint: More than one may apply.)<\/p>\n\n\n\n
An important caveat: This tool is not offering legal advice and is provided for informational purposes only. Using this tool isn\u2019t required by federal law and can\u2019t guarantee compliance with applicable federal requirements. Instead, it\u2019s meant to give you a snapshot of potential compliance obligations and point you to educational materials and best practices for delivering safe, accurate services while safeguarding the privacy and security of consumer information.<\/p>\n\n\n\n
<\/a>What Are the Relevant Federal Laws and Regulations?<\/h2>\n\n\n\nHealth Insurance Portability and Accountability Act (HIPAA<\/a>) Rules<\/h2>\n\n\n\nThe HIPAA Privacy, Security, and Breach Notification Rules (HIPAA Rules) protect the privacy and security of most individually identifiable health information held by health plans<\/a>, most health care providers<\/a>, and health care clearinghouses<\/a> (these groups are called \u201ccovered entities\u201d). Such information is referred to as protected health information, or PHI. In addition, the HIPAA Rules apply to people or companies who create, receive, maintain, or transmit health information for, or provide certain services to a covered entity (those groups are called \u201cbusiness associates<\/a>\u201d). The HIPAA Rules also require these entities to provide notifications of any breaches of health information. The Office for Civil Rights (OCR) within the U.S. Department of Health & Human Services (HHS) enforces the HIPAA Rules. Importantly, the HIPAA Rules do notapply to health information maintained by anyone who isn\u2019t a covered entity or business associate. For example, the HIPAA Rules likely wouldn\u2019t apply to consumer health information maintained in an app that isn\u2019t offered by a HIPAA covered entity or its business associate, even if the health information originated from a covered entity or business associate.<\/p>\n\n\n\nIf health information is not protected by the HIPAA Rules, does this mean that there are no federally required protections for the information? No! Other federal laws likely apply. For example, the Federal Trade Commission (\u201cFTC\u201d) Act applies to most app developers. So, there\u2019s a good chance the FTC Act will require you, among other things, to have reasonable privacy and security practices in place. More on that later.<\/p>\n\n\n\n
For additional information and helpful resources about the HIPAA Rules, please visit OCR\u2019s health information privacy page at https:\/\/www.hhs.gov\/hipaa\/index.html<\/a>.<\/p>\n\n\n\n<\/a><\/a><\/a>Federal Food, Drug, and Cosmetic Act (FD&C Act)<\/h2>\n\n\n\nThe Food and Drug Administration (FDA) enforces the FD&C Act, which among other things regulates the safety and effectiveness of medical devices, including certain mobile medical apps. The FDA focuses its regulatory oversight of digital health devices on a subset of mobile health apps that could pose a risk to consumers if they don\u2019t work as intended. The FDA considers a software function to be a medical device, and subject to FDA device regulation, if it meets the definition of device in section 201(h) of the FD&C Act. When a software function is intended for use in the diagnosis of disease or other conditions, or the cure, mitigation, treatment, or prevention of disease, or is intended to affect the structure or any function of the human body, the software function is a device under section 201(h) of the FD&C Act, if it is not a software function excluded from the device definition by the 21st Century Cures Act. FDA\u2019s Digital Health Policy Navigator<\/a> may be referenced to help in determining whether your product\u2019s software functions are potentially the focus of the FDA\u2019s oversight.<\/p>\n\n\n\n21st Century Cures Act & ONC Information Blocking Regulations<\/h2>\n\n\n\n
The HHS Office of the National Coordinator for Health Information Technology (ONC) issued regulations in response to the 21st Century Cures Act\u2019s<\/a> prohibition of \u201cinformation blocking<\/a>.\u201d ONC also maintains a program for the voluntary certification of health IT<\/a> that meets certain technical requirements to support health care providers\u2019 needs for interoperable health IT.<\/p>\n\n\n\nONC\u2019s Information Blocking<\/a> regulations<\/a> apply to practices likely to interfere with access, exchange, or use of electronic health information (EHI) and define certain exceptions to the definition of information blocking. When a health care provider, health IT developer of certified health IT, or health information network or health information exchange<\/a> engages in any practice that is not required by law or covered by a regulatory exception, has the requisite knowledge about that practice<\/a>, and that practice is likely to interfere with access, exchange, or use of EHI, that practice could be information blocking.<\/p>\n\n\n\nImportantly, the Information Blocking regulations<\/a> function in complement with other laws, such as HIPAA and state laws, that protect the privacy and security of patients\u2019 health information. The Information Blocking regulations do not require or excuse violation of other laws.<\/p>\n\n\n\nThe Information Blocking regulations include specific exceptions<\/a> for reasonable and necessary practices that protect the privacy and security of patients\u2019 EHI. Privacy- and security-protective practices that meet these exceptions\u2019 conditions will not be considered information blocking.<\/p>\n\n\n\nIf a developer chooses to certify health IT through the voluntary ONC Health IT Certification Program, that health IT must meet specific privacy and security requirements<\/a>. These requirements include implementing appropriate privacy and security safeguards<\/a> (certification criteria) and making certain publicly available statements (\u201cattestations\u201d) that ensure transparency about certain privacy and security features<\/a> of the certified technology.<\/p>\n\n\n\nFor additional information and helpful resources about the Information Blocking regulations<\/a> or the voluntary certification of health IT<\/a>, please visit ONC\u2019s HealthIT.gov<\/a> website.<\/p>\n\n\n\nFederal Trade Commission Act (FTC Act)<\/h2>\n\n\n\n
The FTC enforces Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices in or affecting commerce, including those relating to the privacy and security of personal information that apps collect, use, maintain, or share, as well as the safety or performance that apps provide. Section 12 of the FTC Act prohibits false advertisements for food, drugs, devices, cosmetics, or services in or affecting commerce.<\/p>\n\n\n\n
The FTC Act applies to most app developers \u2013 including developers of health apps. For example, if you develop an app and share consumers\u2019 health information with third parties after telling or implying to consumers that their information will be kept private, you could be violating the FTC Act. Also, if you certify through the voluntary ONC Health IT Certification Program and make certain transparency attestations about your app\u2019s privacy or security features and then don\u2019t live up to those promises, the FTC could bring an enforcement action against you.<\/p>\n\n\n\n
FTC\u2019s Health Breach Notification Rule<\/h2>\n\n\n\n
<\/a>The FTC\u2019s Health Breach Notification Rule requires entities covered by the Rule to provide notifications to consumers, the FTC, and, in some cases, the media, following certain breaches of personal health record information. The FTC\u2019s Health Breach Notification Rule<\/a> applies to most health apps that aren\u2019t covered by HIPAA because most developers of health apps are acting as \u201chealth care providers\u201d by furnishing health care services or supplies \u2013 in this case, apps \u2013 to consumers. (That definition of \u201chealth care provider\u201d comes from 42 U.S.C. \u00a7 1320d, which is referenced in Section 318.2(e) of the FTC\u2019s Rule.) If your app experiences a breach\u2014that is, any incidents of unauthorized access, including sharing of identifying health information, without consumers\u2019 authorization\u2014you are likely required to notify consumers, the FTC, and, in some cases, the media. If you don\u2019t provide that notice, you could face an FTC enforcement action seeking hefty civil penalties.<\/p>\n\n\n\nChildren\u2019s Online Privacy Protection Act (COPPA)<\/h2>\n\n\n\n
<\/a><\/a>The FTC enforces the Children\u2019s Online Privacy Protection Act (COPPA)<\/a> and the COPPA Rule, which give parents control over the information that operators of websites and online services can collect from children. COPPA applies to the operator of any commercial website or online service (including a mobile app) that is directed to children under 13 or where the operator has actual knowledge that it collects, uses, or discloses personal information from children under 13. Before collecting children\u2019s personal information \u2013 that includes online contact information, persistent identifiers, photos, video, audio, and geolocation information \u2013 COPPA requires the operator to (among other things) give parents notice of what personal information the operator is collecting from children and to get the parent\u2019s verifiable consent. COPPA also requires that operators establish and maintain reasonable procedures for protecting the confidentiality, security, and integrity of children\u2019s personal information. <\/p>\n\n\n\n<\/a>Which Federal Laws and Regulations May Apply?<\/h2>\n\n\n\nCheck out the interactive tool to help you navigate laws and rules that may apply to you or your app. Please find the interactive tool here<\/strong><\/a>.<\/p>\n\n\n\nTopics<\/strong>: #healthcare #lifeSciences #medicaldevices #medtech #medicaltechnology #MedSysCon #FDA # MobileHealthApps #FederalLaws # COPPA #FTCAct #HIPAA<\/p>\n\n\n\nFor further information please get in touch with us:<\/p>\n\n\n\n
The HIPAA Privacy, Security, and Breach Notification Rules (HIPAA Rules) protect the privacy and security of most individually identifiable health information held by health plans<\/a>, most health care providers<\/a>, and health care clearinghouses<\/a> (these groups are called \u201ccovered entities\u201d). Such information is referred to as protected health information, or PHI. In addition, the HIPAA Rules apply to people or companies who create, receive, maintain, or transmit health information for, or provide certain services to a covered entity (those groups are called \u201cbusiness associates<\/a>\u201d). The HIPAA Rules also require these entities to provide notifications of any breaches of health information. The Office for Civil Rights (OCR) within the U.S. Department of Health & Human Services (HHS) enforces the HIPAA Rules. Importantly, the HIPAA Rules do notapply to health information maintained by anyone who isn\u2019t a covered entity or business associate. For example, the HIPAA Rules likely wouldn\u2019t apply to consumer health information maintained in an app that isn\u2019t offered by a HIPAA covered entity or its business associate, even if the health information originated from a covered entity or business associate.<\/p>\n\n\n\n If health information is not protected by the HIPAA Rules, does this mean that there are no federally required protections for the information? No! Other federal laws likely apply. For example, the Federal Trade Commission (\u201cFTC\u201d) Act applies to most app developers. So, there\u2019s a good chance the FTC Act will require you, among other things, to have reasonable privacy and security practices in place. More on that later.<\/p>\n\n\n\n For additional information and helpful resources about the HIPAA Rules, please visit OCR\u2019s health information privacy page at https:\/\/www.hhs.gov\/hipaa\/index.html<\/a>.<\/p>\n\n\n\n The Food and Drug Administration (FDA) enforces the FD&C Act, which among other things regulates the safety and effectiveness of medical devices, including certain mobile medical apps. The FDA focuses its regulatory oversight of digital health devices on a subset of mobile health apps that could pose a risk to consumers if they don\u2019t work as intended. The FDA considers a software function to be a medical device, and subject to FDA device regulation, if it meets the definition of device in section 201(h) of the FD&C Act. When a software function is intended for use in the diagnosis of disease or other conditions, or the cure, mitigation, treatment, or prevention of disease, or is intended to affect the structure or any function of the human body, the software function is a device under section 201(h) of the FD&C Act, if it is not a software function excluded from the device definition by the 21st Century Cures Act. FDA\u2019s Digital Health Policy Navigator<\/a> may be referenced to help in determining whether your product\u2019s software functions are potentially the focus of the FDA\u2019s oversight.<\/p>\n\n\n\n The HHS Office of the National Coordinator for Health Information Technology (ONC) issued regulations in response to the 21st Century Cures Act\u2019s<\/a> prohibition of \u201cinformation blocking<\/a>.\u201d ONC also maintains a program for the voluntary certification of health IT<\/a> that meets certain technical requirements to support health care providers\u2019 needs for interoperable health IT.<\/p>\n\n\n\n ONC\u2019s Information Blocking<\/a> regulations<\/a> apply to practices likely to interfere with access, exchange, or use of electronic health information (EHI) and define certain exceptions to the definition of information blocking. When a health care provider, health IT developer of certified health IT, or health information network or health information exchange<\/a> engages in any practice that is not required by law or covered by a regulatory exception, has the requisite knowledge about that practice<\/a>, and that practice is likely to interfere with access, exchange, or use of EHI, that practice could be information blocking.<\/p>\n\n\n\n Importantly, the Information Blocking regulations<\/a> function in complement with other laws, such as HIPAA and state laws, that protect the privacy and security of patients\u2019 health information. The Information Blocking regulations do not require or excuse violation of other laws.<\/p>\n\n\n\n The Information Blocking regulations include specific exceptions<\/a> for reasonable and necessary practices that protect the privacy and security of patients\u2019 EHI. Privacy- and security-protective practices that meet these exceptions\u2019 conditions will not be considered information blocking.<\/p>\n\n\n\n If a developer chooses to certify health IT through the voluntary ONC Health IT Certification Program, that health IT must meet specific privacy and security requirements<\/a>. These requirements include implementing appropriate privacy and security safeguards<\/a> (certification criteria) and making certain publicly available statements (\u201cattestations\u201d) that ensure transparency about certain privacy and security features<\/a> of the certified technology.<\/p>\n\n\n\n For additional information and helpful resources about the Information Blocking regulations<\/a> or the voluntary certification of health IT<\/a>, please visit ONC\u2019s HealthIT.gov<\/a> website.<\/p>\n\n\n\n The FTC enforces Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices in or affecting commerce, including those relating to the privacy and security of personal information that apps collect, use, maintain, or share, as well as the safety or performance that apps provide. Section 12 of the FTC Act prohibits false advertisements for food, drugs, devices, cosmetics, or services in or affecting commerce.<\/p>\n\n\n\n The FTC Act applies to most app developers \u2013 including developers of health apps. For example, if you develop an app and share consumers\u2019 health information with third parties after telling or implying to consumers that their information will be kept private, you could be violating the FTC Act. Also, if you certify through the voluntary ONC Health IT Certification Program and make certain transparency attestations about your app\u2019s privacy or security features and then don\u2019t live up to those promises, the FTC could bring an enforcement action against you.<\/p>\n\n\n\n <\/a>The FTC\u2019s Health Breach Notification Rule requires entities covered by the Rule to provide notifications to consumers, the FTC, and, in some cases, the media, following certain breaches of personal health record information. The FTC\u2019s Health Breach Notification Rule<\/a> applies to most health apps that aren\u2019t covered by HIPAA because most developers of health apps are acting as \u201chealth care providers\u201d by furnishing health care services or supplies \u2013 in this case, apps \u2013 to consumers. (That definition of \u201chealth care provider\u201d comes from 42 U.S.C. \u00a7 1320d, which is referenced in Section 318.2(e) of the FTC\u2019s Rule.) If your app experiences a breach\u2014that is, any incidents of unauthorized access, including sharing of identifying health information, without consumers\u2019 authorization\u2014you are likely required to notify consumers, the FTC, and, in some cases, the media. If you don\u2019t provide that notice, you could face an FTC enforcement action seeking hefty civil penalties.<\/p>\n\n\n\n <\/a><\/a>The FTC enforces the Children\u2019s Online Privacy Protection Act (COPPA)<\/a> and the COPPA Rule, which give parents control over the information that operators of websites and online services can collect from children. COPPA applies to the operator of any commercial website or online service (including a mobile app) that is directed to children under 13 or where the operator has actual knowledge that it collects, uses, or discloses personal information from children under 13. Before collecting children\u2019s personal information \u2013 that includes online contact information, persistent identifiers, photos, video, audio, and geolocation information \u2013 COPPA requires the operator to (among other things) give parents notice of what personal information the operator is collecting from children and to get the parent\u2019s verifiable consent. COPPA also requires that operators establish and maintain reasonable procedures for protecting the confidentiality, security, and integrity of children\u2019s personal information. <\/p>\n\n\n\n Check out the interactive tool to help you navigate laws and rules that may apply to you or your app. Please find the interactive tool here<\/strong><\/a>.<\/p>\n\n\n\n Topics<\/strong>: #healthcare #lifeSciences #medicaldevices #medtech #medicaltechnology #MedSysCon #FDA # MobileHealthApps #FederalLaws # COPPA #FTCAct #HIPAA<\/p>\n\n\n\n For further information please get in touch with us:<\/p>\n\n\n\n<\/a><\/a><\/a>Federal Food, Drug, and Cosmetic Act (FD&C Act)<\/h2>\n\n\n\n
21st Century Cures Act & ONC Information Blocking Regulations<\/h2>\n\n\n\n
Federal Trade Commission Act (FTC Act)<\/h2>\n\n\n\n
FTC\u2019s Health Breach Notification Rule<\/h2>\n\n\n\n
Children\u2019s Online Privacy Protection Act (COPPA)<\/h2>\n\n\n\n
<\/a>Which Federal Laws and Regulations May Apply?<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.medsyscon.com\/wp-content\/uploads\/2020\/02\/Logo_MedSysCon_Medizintechnik_4C-1024x254.jpg\"){kind=logo}
<\/figure>\n","protected":false},"excerpt":{"rendered":"