Increased Regulatory Scrutiny on Health Technology Companies’ Use of Advertising Technologies | Fenwick & West LLP

The proliferation of wellbeing apps and connected units that allow for people to monitor their wellbeing situations, therapy, prescription drugs, health, fertility, rest, mental wellness, diet regime and other very important parts has led to elevated regulatory scrutiny. Recent regulatory advice and enforcement steps with multimillion-dollar therapies are clarion phone calls for health engineering companies to ensure that they are correctly working with internet monitoring systems on their electronic houses.

OCR Steerage on Use of Monitoring Technologies

The Office of Health and Human Services’ Office for Civil Rights (OCR), which enforces the Health and fitness Insurance plan Portability and Accountability Act (HIPAA), recently introduced advice warning that a HIPAA-regulated entity’s use of online tracking systems on its internet websites and applications is subject matter to HIPAA’s Privateness Rule. These monitoring technologies incorporate commonly employed analytics and promoting equipment, this kind of as tracking pixels used for remarketing, web beacons and session replay scripts. OCR advises that these technologies fall within just HIPAA guidelines mainly because the sorts of info they collect, like IP tackle, geographic locale, product ID, marketing ID or other one of a kind identifiers, can tie an individual website or application user to a HIPAA-controlled entity even in the absence of a individual romance. Appropriately, this data “relates to the individual’s past, existing, or future health and fitness or well being treatment or payment for treatment.” For instance, when a covered entity (such as a clinic or health care supplier) locations a monitoring pixel on its appointment scheduling web site, the pixel shares the patient’s IP handle with the pixel company. In accordance to the OCR direction, the covered entity should guarantee that it shares the IP deal with with the pixel supplier in a HIPAA-compliant method.

FTC Enforcement of Its Well being Breach Notification Rule

OCR is not the only regulator focused on the use of monitoring technologies on wellness sites and applications. On February 1, 2023, the Federal Trade Commission (FTC) settled an enforcement motion against a electronic healthcare platform for violating Area 5 of the FTC Act and the FTC’s Health Breach Notification Rule, 16 C.F.R. Component 318 (the FTC Rule). The FTC Rule applies to enterprises that are not matter to HIPAA, but that collect or manage identifiable overall health information of buyers in the type of personal health and fitness records. The FTC Rule requires firms to notify men and women inside of at minimum 60 calendar times of the unauthorized accessibility to their private overall health documents. In 2021, the FTC issued a Policy Statement advising that any sharing of particular overall health information—including intentional disclosures—without the authorization of the personal to whom it associated violated the FTC Rule. The FTC also warned that violations of the FTC Rule could end result in civil penalties of up to $43,792 per violation for each day.

This situation was the FTC’s first enforcement of the FTC Rule. The FTC alleged that the company violated the FTC Rule and Area 5 of the FTC Act by sharing own and health and fitness facts of its people with (1) promoting platforms, this kind of as Facebook, Google and Criteo and (2) other third parties like Branch and Twilio, with out notifying or obtaining the consent of its consumers. The FTC also observed the practices were opposite to guarantees the organization produced in its privateness insurance policies that it would not share its users’ wellness information and facts. Under the conditions of the settlement, the FTC levied a $1.5 million civil penalty and completely banned the company from disclosing health and fitness information to 3rd parties for advertising and marketing functions.

BetterHelp, Inc. FTC Enforcement

Just a month afterwards, in March 2023 the FTC brought an enforcement motion alleging that BetterHelp, an on the net mental health counseling service, shared info identifying its users with advertisers opposite to its privacy guarantees on its website and intake questionnaire. The criticism alleges that BetterHelp permitted advertisers to use info about its consumers to produce look-alike pools of men and women for advertising. A consent buy, if authorized, will demanded BetterHelp to refund up to $7.8 million to people who paid out for BetterHelp subscriptions. The proposed FTC get calls for BetterHelp to (1) attain affirmative categorical consent in advance of disclosing own information to specified 3rd events for any goal (2) carry out a complete privateness application (3) immediate third parties to delete consumer wellness and other individual details and (4) carry out a knowledge retention schedule for client wellness and individual information and facts.

Practical Takeaways for Digital Well being Consumers

All digital wellbeing clientele who use targeted promoting and on-line monitoring technologies on their sites and mobile applications need to have to evaluate and be crystal clear about what legal guidelines they may perhaps be subject matter to: HIPAA, Part 5 of the FTC Act (prohibiting unfair or deceptive functions or methods in or influencing commerce) and/or the FTC Rule. The FTC has produced obtainable an interactive instrument to assist developers of cell apps that in any way relate to overall health facts establish which rules and rules may apply.

Are you a protected entity or business enterprise affiliate topic to HIPAA? If so, you will will need to:

1. Assess what online advertising tools (cookies, pixels, world-wide-web beacons) you are applying on your electronic houses, this sort of as your web sites or cell applications.
2. Identify where these on the net promoting resources are positioned on your electronic attributes, noting elevated scrutiny on web internet pages where by sensitive well being information and facts may be collected (for instance, on an appointment scheduling web site where disorders or indicators could be entered).
3. Assess what data is shared with third-occasion suppliers of these equipment, noting that even IP addresses are considered safeguarded well being info (PHI) below the OCR’s new advice.
4. Establish no matter if you have the important agreements in position with the device providers, these as a business associate arrangement or subcontractor arrangement.
5. Weigh the added benefits of using these on-line promoting instruments from the additional price of complying with OCR’s new steerage. Ongoing compliant use of these applications will probable call for corporations to receive prior authorization or consent from consumers (which includes web-site people, even if no client romance is formed) for disclosure of their PHI to vendors of these on line promotion equipment.
6. Revise your privateness policy and detect of privacy techniques to correctly reflect your on the internet marketing practices. Portion 5 of the FTC Act requires that disclosures about well being facts privateness methods should not be deceptive or misleading.

If you accumulate individual health and fitness info, but are not a HIPAA protected entity or business enterprise affiliate:

1. If your internet site or application collects identifiable well being details on an personal from numerous resources, this kind of as by a mix of buyer inputs and APIs, you are matter to the FTC Rule. And like HIPAA controlled enterprises, Area 5 of the FTC Act necessitates statements to individuals about how you use and share their wellbeing facts ought to not be deceptive.
2. Assess what third-bash promoting companies you are employing, if any.
3. Perform an inside audit to decide what personalized information you share with 3rd-party promotion providers, if any.
4. Evaluate all your web sites and other electronic attributes to ensure that your privateness policy is prominently shown and is simply accessible to buyers on each and every. Consumers should really be needed to accept your privateness coverage prior to filling out any consumption questionnaires.
5. Evaluation all statements and claims that you have designed about the use and disclosure of personalized and wellness data in the shopper intake questionnaires, in your privateness policies, on your internet sites and cell applications, and in other general public boards and platforms (e.g., Twitter), and get rid of any privacy assures or representations that do not correctly replicate the Company’s methods.
6. Get hold of Affirmative Categorical Consent before disclosing wellbeing info to third-party vendors of marketing technologies. Affirmative Express Consent need to be distinct and independent from the business’s typical conditions.
7. Teach staff members on privacy and safety ideal techniques for dealing with or producing conclusions about sharing own or health data.
8. Contractually limit advertisers’ use of personal info for their personal unbiased business enterprise functions, including their have investigation and advancement and advertisement optimization.
9. Look at creating and implementing inside insurance policies governing personalized and health information sharing, including requiring prior legal evaluation and acceptance of any details sharing with third-occasion suppliers of on the web promoting instruments.