How Do These Privacy Rules Apply to Wellness Apps and Wearable Devices Recommended by My Employer?

Fundamentals

The privacy of your health information is paramount, especially when wellness apps and wearable devices are recommended by your employer. The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that protects your sensitive health information. However, HIPAA’s protections are not all-encompassing. They primarily apply to “covered entities,” which are healthcare providers, health plans, and healthcare clearinghouses.

When your employer recommends a wellness app, the data you share may not be protected by HIPAA. This is because most app developers are not considered covered entities. The data they collect, such as your step count, heart rate, or sleep patterns, is often not considered Protected Health Information (PHI) under HIPAA’s strict definition. This creates a “gray area” where your health data may not have the same level of protection as the information in your official medical records.

HIPAA and Employer Wellness Programs

If your employer’s wellness program is part of a group health plan, the information collected may be considered PHI and protected by HIPAA. In such cases, the wellness program vendor may be a “business associate” of the health plan, which means they are also required to comply with HIPAA’s privacy and security rules. This is a critical distinction, as it determines the level of protection your data receives.

The applicability of HIPAA to a wellness app often depends on whether the app is part of a group health plan.

It’s important to understand that even when a wellness program is part of a group health plan, your employer’s access to your PHI is restricted. They can only receive aggregated data that doesn’t identify individual employees, unless it’s necessary for the administration of the plan. This is to prevent discrimination based on health status.

Beyond HIPAA Other Regulations

Even if HIPAA doesn’t apply, other federal and state laws can offer protection. The Federal Trade Commission (FTC) has a Health Breach Notification Rule that requires vendors of personal health records, including some health apps, to notify consumers of a data breach. This rule has been expanded to cover a wider range of health and wellness apps, providing an additional layer of protection.

State laws, such as the California Consumer Privacy Act (CCPA), also play a role. The CCPA gives California residents more control over their personal information, including the right to know what data is being collected about them and to request its deletion. As of January 1, 2023, the CCPA’s protections extend to employee data, meaning that employers in California have new obligations regarding the privacy of their employees’ health information.

Intermediate

Understanding the nuances of data privacy with employer-recommended wellness apps requires a deeper look at the legal frameworks in place. While HIPAA is the most well-known, its application is very specific, and other regulations often fill the gaps. The key is to understand how these different rules interact and what they mean for you as an employee.

When Does HIPAA Apply to Wellness Apps?

HIPAA’s protections are triggered when a “covered entity” or its “business associate” handles Protected Health Information (PHI). Here’s a breakdown of how this applies to wellness apps:

• Directly from a Covered Entity If your doctor or hospital provides you with a wellness app as part of your treatment, the data collected is likely considered PHI and is protected by HIPAA.
• As Part of a Group Health Plan If your employer’s wellness program is offered as a benefit through your group health plan, the data collected is also likely PHI. The wellness app vendor would be considered a “business associate” and would be required to sign a Business Associate Agreement (BAA) with the health plan, obligating them to protect your data.
• Independent of a Group Health Plan If your employer offers a wellness program directly, and not as part of a group health plan, the data collected is generally not considered PHI and is not protected by HIPAA.

The FTC’s Role in Protecting Health Data

The Federal Trade Commission (FTC) has become a major player in protecting consumer health data, especially in areas where HIPAA does not apply. The FTC’s Health Breach Notification Rule (HBNR) is a key tool in this effort. The HBNR requires vendors of personal health records (PHRs) and related entities to notify individuals, the FTC, and sometimes the media of a breach of unsecured identifiable health information.

The FTC’s Health Breach Notification Rule has been expanded to cover a wide range of health and wellness apps, not just those that are part of a formal medical record.

The FTC has clarified that the HBNR applies to most health and wellness apps, especially those that can draw information from multiple sources, such as user input and data from a wearable device. This means that even if an app is not covered by HIPAA, it may still be subject to the HBNR’s breach notification requirements. The FTC has also taken enforcement action against companies for sharing user health data without authorization, demonstrating its commitment to protecting this sensitive information.

State-Level Protections

In addition to federal regulations, many states have their own data privacy laws that can apply to wellness apps. The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), is one of the most comprehensive. The CCPA gives California residents several important rights, including:

• The right to know what personal information is being collected about them.
• The right to delete their personal information.
• The right to opt-out of the sale or sharing of their personal information.

As of January 1, 2023, the CCPA’s protections were extended to include employee data. This means that employers in California must now comply with the CCPA’s requirements when they collect and use their employees’ personal information, including data from wellness apps. This is a significant development that gives employees in California more control over their health data.

The following table provides a simplified overview of the different regulations that may apply to wellness apps:

Academic

The intersection of employer-sponsored wellness initiatives, wearable technology, and data privacy law presents a complex regulatory landscape. While the Health Insurance Portability and Accountability Act (HIPAA) provides a baseline for protecting health information, its applicability is often limited in the context of wellness apps and devices. This has led to a multi-layered regulatory environment, with the Federal Trade Commission (FTC) and state laws playing an increasingly important role.

The Limits of HIPAA in the Wellness Sphere

HIPAA’s privacy and security rules apply to “covered entities” and their “business associates.” A wellness app or wearable device only falls under HIPAA’s purview if it is provided by a covered entity (such as a health plan or healthcare provider) or a business associate acting on behalf of a covered entity.

If an employer offers a wellness program directly to its employees, without involving a group health plan, the data collected is generally not considered Protected Health Information (PHI) and is therefore not protected by HIPAA.

This creates a significant gap in protection, as a large amount of health and wellness data is collected outside of the traditional healthcare system. This data can be just as sensitive as the information in a patient’s medical record, yet it may not be subject to the same stringent privacy and security requirements.

The FTC’s Expanded Role in Health Data Privacy

The FTC has taken a more active role in policing the privacy practices of wellness app developers and other companies that are not covered by HIPAA. The FTC’s authority stems from Section 5 of the FTC Act, which prohibits unfair and deceptive trade practices, and the Health Breach Notification Rule (HBNR).

The FTC has expanded its interpretation of the HBNR to cover a broad range of health and wellness apps. The agency has clarified that an app is covered by the rule if it can draw information from multiple sources, such as user input and data from a connected device. This means that many popular fitness and wellness apps are now subject to the HBNR’s breach notification requirements.

The FTC’s enforcement actions have sent a clear message to the wellness industry that the unauthorized sharing of user health data will not be tolerated.

The FTC has also brought enforcement actions against companies for sharing user health data with third parties, such as advertising platforms, without the users’ consent. These actions have resulted in significant financial penalties and have required the companies to change their data-sharing practices.

The Impact of State Privacy Laws

State laws, particularly the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), have added another layer of complexity to the regulation of wellness data. The CCPA gives California residents a number of rights over their personal information, including the right to access, delete, and opt-out of the sale of their data.

The extension of the CCPA to employee data has significant implications for employer-sponsored wellness programs. Employers in California must now provide their employees with a privacy notice that explains what data is being collected and how it will be used. They must also be prepared to respond to employee requests to access or delete their data.

The following table provides a more detailed comparison of the different regulatory frameworks:

Reflection

The evolving landscape of digital health and data privacy presents both opportunities and challenges. As you continue on your wellness journey, it is important to be an informed and empowered participant. The knowledge you have gained about the regulations governing wellness apps and wearable devices is a critical first step. It allows you to ask the right questions and make conscious decisions about how your personal information is used.

Your health is your most valuable asset, and the data that reflects your health is equally precious. By understanding the rules of the road, you can navigate the world of digital wellness with confidence, ensuring that your privacy is protected as you strive to achieve your health and wellness goals.