Navigating Compliance Requirements for Businesses Collecting Consumer Health Information

By: Julie Mungai

The Federal Trade Commission (FTC) and the U.S. Department of Health and Human Services (HHS) recently released an updated joint publication for organizations that collect consumer health information. The publication provides businesses guidance for complying with various federal regulatory, privacy, and security laws that may apply to them.

For developers that are unsure of what regulations they are subject to, the FTC also provides an interactive tool to use as a starting point.

Let’s take a look at a summary of the publication.

HIPAA Privacy Rule 

The HIPAA Privacy Rule sets limits and conditions on the uses and disclosures of protected health information (PHI) that covered entities and business associates may make without an individual’s authorization and provides individuals with rights for their health information. Here are crucial points outlined regarding the HIPAA Privacy Rule requirements:

Get individual’s authorization.

Obtain clear authorization before using or disclosing an individual’s PHI for purposes outside the HIPAA Privacy Rule. This includes anything other than treatment, payment, and other healthcare operations. Authorization should be freely given and not coerced through denial of services.

Put it in plain language.

Authorization should be easy to understand. If the language is confusing, it’s ineffective for individuals to understand and control the uses and disclosures of their health information.

Be specific.

Be clear and specific about the use or disclosure of the health information. For example, who are you disclosing the information to? What is the purpose of the disclosure (e.g., for marketing, employee screening, etc.)?

State if and when you will gain financially from a disclosure.

The HIPAA Privacy Rule prohibits you from selling PHI unless you obtain an authorization. This includes non-monetary gains.

HIPAA Security Rule

The HIPAA Security Rule requires HIPAA-covered entities and their business associates to implement safeguards to protect the confidentiality, integrity, and availability of all electronic PHI (ePHI) the covered entity or business associate creates, receives, maintains, or transmits. Examples of these safeguards include:

Risk assessments: Perform a risk assessment to identify potential risks and vulnerabilities to ePHI and implement controls to reduce those risks.

Workforce compliance: Provide all employees with HIPAA training.

Ensure confidentiality, integrity, and availability of PHI/ePHI: This includes technical, physical, or administrative safeguards.

Establish contingency plans: Identify and respond to security incidents and breaches.

HIPAA Breach Notification Rule

The HIPAA Breach Notification Rule requires covered entities and business associates to do the following after an identified breach:  

• Covered entities—Notify all affected persons, the Secretary of HHS, and, in some cases, the media.
• Business associates—Notify covered entities.

FTC Act

The FTC Act prohibits companies from engaging in deceptive or unfair acts or practices in or affecting commerce. Here’s what you can do to comply: 

Review your policies, procedures, and practices.

Ask these questions to understand your data flow:

• Do we know our collection, use, retention, and disclosure processes? 
• Are our processes documented? 
• Are our processes an accurate representation of what is in practice? 

Review your user interface.

Ditch the deceptive designs and practices. Don’t make false claims or try to manipulate users into making choices they would not otherwise make.

FTC Health Breach Notification Rule

The FTC’s Health Breach Notification Rule requires companies that experience a breach of security of consumer PHI to notify affected consumers, the FTC, and, in some cases, the media.

What can you do to comply with the FTC Health Breach Notification Rule? 

• Notify all necessary parties in the event of a breach.
• Understand your obligations under the Health Breach Notification Rule.
• Report breaches in a timely fashion. 

Contact BARR for more information on how to protect your organization’s data. 

About the Author:

As a manager in BARR’s attest services practice, Julie Mungai brings extensive experience in performing internal controls audits, including business process and technology audits, for domestic and international clients in manufacturing, technology and pharmaceutical industries as well as compliance activities including attestation of services (SOC 1, SOC 2). 

Before joining BARR, Julie gained five years of experience in risk assurance at PwC. Julie has a bachelor’s degree from Georgia State University, a master’s degree from New York University, and holds a CISA.