Data Privacy and Security Considerations for Mobile Health App Developers and Their Counsel

In the wake of the Supreme Court's landmark decision in Dobbs v. Jackson Women's Health Organization, issues surrounding the privacy and security of health information have been top of mind for health care providers, consumers, and legislators. The Department of Health and Human Services Office for Civil Rights (OCR), the Federal Trade Commission (FTC), and the California Attorney General have all released guidance addressing the collection, storage, and use of sensitive information concerning reproductive health, signaling increased enforcement in this area. Proposed federal legislation would impose additional obligations on providers of apps and devices that store health and location data. In light of the evolving legal and regulatory landscape, app developers and their counsel should examine developers' privacy and security practices and take steps to safeguard sensitive data related to reproductive health.

OCR Guidance

OCR recently released guidance aimed at health care providers covered by the HIPAA Privacy Rule and their business associates. It clarifies that while the Privacy Rule permits certain disclosures of protected health information (PHI) without an individual's authorization that are not directly related to health care, these disclosures are subject to certain limitations. In particular, a disclosure of PHI that is required by another law is limited to "a mandate contained in law that compels an entity to make a use or disclosure of PHI and that is enforceable in a court of law," and the entity can only disclose the information that is required to be disclosed under that law. The guidance also addresses disclosures for law enforcement purposes (generally such a disclosure would be a breach of unsecured PHI unless it is made pursuant to "a court order or other mandate enforceable in a court of law"), as well as permitted disclosures made to avert a serious threat to health or safety (generally, these would not include disclosures concerning an individual's interest in or attempt to receive an abortion or other reproductive health care).

FTC Commitments Related to Health and Location Data

On July 11, 2022, the FTC published a blog post by Kristin Cohen, Acting Associate Director, FTC Division of Privacy & Identity Protection, which reaffirms the FTC's commitment to enforcing the law against illegal use and sharing of highly sensitive data. The post discusses automatically-generated location information, as well as sensitive health information generated by individuals as they use their electronic devices. The post states that the combination of location data and user-generated health information "creates a new frontier of potential harms to consumers." It goes on to describe the "shadowy" ad tech and data broker ecosystem, where "staggering" amounts of information are collected and shared in ways consumers might not expect.