The Federal Trade Commission has issued a draft rule that outlines how PHR providers must notify consumers in the event of security breaches (warning, PDF!). The rule includes platforms like HealthVault and Google Health along with individual PHR vendors like WebMD and ActiveHealth. Comments can be submitted here, and are due by June 1st. This does NOT affect HIPAA covered entities such as hospitals and insurance companies, although the Department of Health and Human Services will be issuing one soon, and the content is expected to be quite similar.
The Recovery Act contained temporary requirements, which will remain in effect until Congress passes new legislation based on a report currently in development by HHS and the FTC. The report is due in a year, and legislation takes a long time, so these “interim” requirements will almost certainly be in force until 2010, and possibly longer. Interim rules that hang around long enough tend to be the basis of permanent rules.
Here’s a summary of who is affected and under what circumstances:
- A “breach of security” is defined as the acquisition of identifiable health information of an individual, from a PHR, without authorization.
- The rule also contains the word “unsecured.” This means encryption – if a laptop containing appropriately encrypted data is stolen, that doesn’t count as a breach for notification purposes. HHS is responsible for issuing a guidance on acceptable security policies, to be updated annually.
- Access is not the same as acquisition. Employees looking up records about friends and celebrities is a breach. An employee inadvertently loading the wrong record in the EHR is not.
- The “fact of having an account with a vendor of personal health records” is itself considered sensitive information. The obvious example (used in the notice) would be releasing a list of names by a company that provides PHR services for AIDS patients.
- De-identified information, according to the existing HIPAA de-identification rules, fall outside the scope of the rule.
- “PHR related entities” are what the platform vendors call “Personal Health Applications”. It’s a broad net, and the examples include websites offering medication management applications and bricks-and-mortar companies advertising dietary supplements online, as long as the interaction with these companies is through a PHR or PHR platform. The definition also includes organizations that “access information in a personal health record or send information to a personal health record.”
The breach notification requirement itself has a few components:
- Third party service providers must notify their customers (vendors of PHRs and PHAs) following the discovery of a breach. The individuals affected must be explicitly identified.
- Notice must be received by a “senior official” of the PHR vendor or PHR related entity.
- There is a “reasonably should have known” clause that sets an expectation of reasonable security measures. You can be in violation of the rule if you didn’t detect the breach in time. But since some breaches are hard to detect, you’re not always in violation if you discover something belatedly.
- Notifications to individuals must be made “without unreasonable delay” and always within 60 days.
- Notice must be by first-class mail, or by email if the individual consents (which must be “affirmative” consent, not something buried in an end user license agreement). There is no obligation to provide notification by mail (although if the customer doesn’t consent to email notifications, you can’t provide them with service otherwise).
- If ten or more individuals can’t be reached, a substitute notice must be posted – a large link on the home page for six months, or through a media campaign.
- The FTC must be notified in five business days if 500 or more people are involved. If fewer than 500 people are involved, reports may be submitted annually.
That’s not all there is to it – the rule also describes the content of breach notices and the supporting document includes an economic impact assessment. I wrote some similar impact analysis documents when I was at CMS – it’s always a challenge to get it right.
My quick reaction: it’s not bad. We’ll see every PHR vendor race to add that “email notification” permission to their products. The cost of compliance shouldn’t be that burdensome, although it’s certainly non-zero, and that’s really the point – organizations need to take security seriously, and making breaches costly and embarrassing is a good way to do that.
