Fundamentals
Your journey toward hormonal balance and metabolic well being is an intimate one, built on a foundation of personal data. You track your cycles, monitor your sleep, and note the subtle shifts in your energy and mood. This information is more than a collection of data points; it is the language of your body.
When you entrust this language to a wellness program, you expect a certain level of sanctity. You assume a protective shield similar to the one that guards the conversations you have with your physician. It is a reasonable assumption. It is also a dangerously inaccurate one.
The architecture of health data protection in the United States is built upon a specific piece of legislation The Health Insurance Portability and Accountability Act of 1996, or HIPAA. This law creates a formidable barrier around what is known as Protected Health Information or PHI.
This is the information held by your doctors, your hospital, and your health insurance company. These entities are bound by law to safeguard your data, and the penalties for failing to do so are severe. A crucial distinction exists, one that is rarely explained with the clarity it deserves. HIPAA’s jurisdiction is not universal. It is specific. It applies to covered entities and their business associates.
Many wellness programs, particularly those offered directly by an employer as a perk, exist outside of this protected space. The data you share with them, from your daily caloric intake to your stress levels, is not considered PHI. It occupies a different category altogether consumer health data.
This classification is the source of a profound vulnerability. The stringent protections of HIPAA do not apply. The landscape of data privacy shifts from a fortress to a patchwork of state and federal regulations, many of which are not as comprehensive or as stringent as HIPAA. Your health data, in this context, is a commodity, and its value is determined by a market you may not even know exists.
What Is the Distinction between PHI and Consumer Health Data?
The distinction between Protected Health Information and consumer health data is not a matter of semantics. It is a matter of legal protection. PHI is a specific legal term defined by HIPAA. It is individually identifiable health information that is created or received by a HIPAA covered entity.
Consumer health data, on the other hand, is a broad category that includes any health information that is not covered by HIPAA. This can include data from fitness trackers, diet apps, and many workplace wellness programs. The legal frameworks governing the two are vastly different, and understanding this difference is the first step toward reclaiming control over your personal health narrative.
Your relationship with your physician is governed by a set of ethical and legal principles that have been refined over centuries. The Hippocratic Oath, in its modern form, is a promise of confidentiality. HIPAA is the legal codification of that promise in the digital age.
Your relationship with a wellness app is governed by a terms of service agreement, a document that is often dense, difficult to understand, and designed to protect the company, not the consumer. The language of medicine is one of healing. The language of commerce is one of transaction. When your health data crosses the line from PHI to consumer health data, it enters the world of commerce, and the rules of engagement change entirely.
The protections you assume for your health data do not automatically extend to every program or application you use.
The journey to optimal health is a data-driven one. It requires a deep understanding of your own biological systems, and that understanding is built on the information you collect about yourself. This information is precious. It is the raw material of your health journey.
It is also a valuable asset to companies that want to sell you products and services. When you share your data with a wellness program that is not covered by HIPAA, you are taking a calculated risk. The purpose of this discussion is to help you understand the nature of that risk, so you can make informed decisions about who you trust with the language of your body.
Intermediate
When your health data resides outside the fortress of HIPAA, it is not left entirely without defense. A different set of regulations, enforced by a different federal agency, comes into play. The Federal Trade Commission, or FTC, is the primary federal agency responsible for consumer protection.
Its mandate is broad, covering everything from deceptive advertising to unfair business practices. In recent years, the FTC has turned its attention to the burgeoning world of digital health, and its primary tool for regulating this space is a little-known but increasingly important regulation called the Health Breach Notification Rule, or HBNR.
The HBNR was first introduced in 2009, in the early days of the digital health revolution. Its original intent was to cover a specific type of entity vendors of personal health records, or PHRs. These were companies that offered to store your medical records on your behalf, creating a centralized repository of your health information.
The digital health landscape has evolved considerably since then. Today, we have a vast ecosystem of health and wellness apps, wearable devices, and other technologies that collect, analyze, and store a wealth of health-related data. The original HBNR was not designed for this world. It was a regulation for a different era.
In recognition of this new reality, the FTC has recently finalized a new rule that dramatically expands the scope of the HBNR. The updated rule redefines what it means to be a vendor of a personal health record, and in doing so, it brings a vast number of health and wellness apps under its jurisdiction.
The new rule also clarifies what constitutes a “breach” of health data. This is a critical point. A breach is not just a data hack, a malicious intrusion by a third party. A breach, under the expanded HBNR, can also be an unauthorized disclosure of data.
This means that if a wellness app shares your data with a third party, such as an advertising company, without your explicit consent and in a manner that is inconsistent with its privacy policy, that is a breach.
How Does the FTC Enforce the HBNR?
The FTC’s enforcement of the HBNR is not a theoretical exercise. The agency has already taken action against several well-known digital health companies for violating the rule. These enforcement actions provide a clear window into the FTC’s priorities and its interpretation of the HBNR.
They also serve as a powerful reminder that the agency is willing to use its authority to protect consumers from the misuse of their health data. Three cases in particular stand out as instructive examples of the FTC’s approach.
The case against GoodRx, a popular prescription drug discount app, centered on the company’s practice of sharing user data with third-party advertising platforms like Facebook and Google. The FTC alleged that GoodRx had failed to notify users of these unauthorized disclosures, a clear violation of the HBNR.
The settlement with the FTC required GoodRx to pay a civil penalty and to implement a comprehensive privacy program. The case against BetterHelp, an online therapy provider, involved similar allegations of unauthorized data sharing. The FTC alleged that BetterHelp had shared sensitive mental health information with third parties for advertising purposes, despite promising users that their data would be kept private.
The settlement in that case also included a significant financial penalty and a requirement to overhaul the company’s privacy practices.
Federal regulations now define a data breach to include the unauthorized sharing of your health information for marketing.
The case against Premom, a fertility-tracking app, further illustrates the FTC’s expansive view of the HBNR. The FTC alleged that Premom had shared users’ sensitive health data, including information about their menstrual cycles and pregnancies, with third-party analytics and advertising companies.
The settlement in that case, like the others, included a financial penalty and a prohibition on the sharing of health data for advertising purposes. These cases, taken together, send a clear message to the digital health industry. The FTC is watching. The agency is willing to take action to protect consumers. And it has a broad interpretation of its authority under the HBNR.
The expanded HBNR is a significant development in the regulation of digital health. It is a clear signal that the FTC is taking the issue of health data privacy seriously. It is also a powerful new tool for holding companies accountable for their use of consumer health data.
The HBNR is not a panacea. It does not provide the same level of protection as HIPAA. It does, however, represent a meaningful step forward in the effort to ensure that all health data, regardless of where it is stored, is treated with the respect and the confidentiality it deserves.
| Regulator | Primary Legislation | Entities Covered | Key Protections |
|---|---|---|---|
| U.S. Department of Health and Human Services | HIPAA | Healthcare providers, health plans, healthcare clearinghouses | Strict limits on the use and disclosure of PHI |
| Federal Trade Commission | Health Breach Notification Rule | Vendors of personal health records, health and wellness apps | Notification of data breaches, including unauthorized disclosures |
- HIPAA This law provides a high level of protection for your health data, but its reach is limited to specific entities.
- HBNR This rule provides a lower level of protection than HIPAA, but its reach is expanding to cover a wider range of digital health products and services.
- State Laws A growing number of states are enacting their own privacy laws, some of which provide additional protections for health data.
Academic
The discourse surrounding health data privacy often centers on the legal and regulatory frameworks that govern the collection, use, and disclosure of this sensitive information. While these frameworks are undoubtedly important, they represent only one dimension of a far more complex issue.
A deeper, more systemic analysis reveals a host of risks that are not always addressed by the letter of the law. These risks are rooted in the very nature of data itself, in the economic incentives that drive the digital health industry, and in the subtle but powerful ways that data can be used to influence our behavior and shape our lives.
One of the most significant of these systemic risks is the phenomenon of data re-identification. Wellness programs often claim that they de-identify data before sharing it with third parties. This process involves removing direct identifiers, such as your name and address, from the data.
The assumption is that once this is done, the data is anonymous and can no longer be linked to you. This assumption is increasingly being challenged by researchers who have demonstrated that de-identified data can, in fact, be re-identified with a surprisingly high degree of accuracy.
By cross-referencing de-identified health data with other publicly available datasets, such as voter registration rolls or social media profiles, researchers have been able to re-associate anonymous data with specific individuals.
The implications of this are profound. It means that even when a wellness program claims to be protecting your privacy by de-identifying your data, there is no guarantee that your data will remain anonymous. It also means that your health data could be used in ways that you never intended or imagined.
It could be sold to data brokers, who could then sell it to insurance companies, lenders, or employers. It could be used to build a detailed profile of you, a profile that could be used to make decisions about your eligibility for insurance, your creditworthiness, or even your employment.
What Are the Ethical Dimensions of Algorithmic Bias?
Another systemic risk that is often overlooked is the problem of algorithmic bias. Many wellness apps use algorithms to analyze your data and provide you with personalized health recommendations. These algorithms are not neutral. They are designed by humans, and they are trained on data that is collected from a specific population.
If the data that is used to train an algorithm is not representative of the broader population, the algorithm can perpetuate and even amplify existing biases. For example, if a heart rate variability algorithm is trained primarily on data from a single demographic group, it may be less accurate for individuals from other demographic groups. This could lead to flawed health insights and recommendations.
The ethical dimensions of algorithmic bias are complex and far-reaching. At a minimum, they raise questions about the fairness and equity of digital health technologies. They also raise questions about the potential for these technologies to exacerbate existing health disparities.
If a wellness app is less accurate for certain populations, it could lead to those populations receiving substandard care. It could also lead to them being unfairly penalized by wellness programs that use algorithmic assessments to determine eligibility for rewards or incentives.
The very algorithms designed to guide your wellness journey may be operating on incomplete or biased data sets.
The issue of algorithmic bias is further complicated by the fact that the algorithms used by many wellness apps are proprietary. They are black boxes. We do not know how they work. We do not know what data they are trained on. And we do not know what biases they may contain.
This lack of transparency makes it difficult to assess the fairness and accuracy of these algorithms. It also makes it difficult to hold companies accountable for the biases that their algorithms may contain.
The risks of data re-identification and algorithmic bias are not hypothetical. They are real. And they are growing. As the digital health industry continues to expand, and as more and more of our health data is collected, analyzed, and stored by non-HIPAA-covered entities, these risks will only become more acute.
Addressing these risks will require a multi-faceted approach. It will require stronger regulations. It will require greater transparency from the digital health industry. And it will require a more critical and informed approach to the use of these technologies from consumers.
| Risk | Description | Potential Impact |
|---|---|---|
| Data Re-identification | The process of re-associating de-identified data with a specific individual. | Discrimination in insurance, lending, and employment. |
| Algorithmic Bias | Systematic errors in an algorithm that result in unfair or inaccurate outcomes. | Exacerbation of health disparities and inequitable access to care. |
- Data Brokers These companies specialize in the collection and sale of personal data, including health data.
- Targeted Advertising Your health data can be used to create detailed profiles of you for the purpose of targeted advertising.
- Scoring and Profiling Your health data can be used to generate scores and profiles that can be used to make decisions about you.
References
- Gellman, Robert. “Privacy and Security of Electronic Health Information.” Journal of the American Medical Association 312.16 (2014) ∞ 1627-1628.
- Price, W. Nicholson, and I. Glenn Cohen. “Privacy in the Age of Medical Big Data.” Nature Medicine 25.1 (2019) ∞ 37-43.
- Tene, Omer, and Jules Polonetsky. “Big Data for All ∞ Privacy and User Control in the Age of Analytics.” Northwestern Journal of Technology and Intellectual Property 11 (2013) ∞ 239.
- Angrist, Misha. “The Dangers of Oversharing ∞ Health, Privacy, and the Internet.” The American Journal of Bioethics 13.10 (2013) ∞ 1-2.
- Rothstein, Mark A. “The Employer’s Use of Health Information After the Americans with Disabilities Act.” Loyola University Chicago Law Journal 25 (1993) ∞ 455.
- U.S. Federal Trade Commission. “Complying with the FTC’s Health Breach Notification Rule.” Federal Trade Commission, 2021.
- U.S. Department of Health & Human Services. “Health Information Privacy.” HHS.gov.
Reflection
The information presented here is not intended to induce fear or to discourage you from engaging with the technologies that can support your health journey. The goal is to foster a deeper level of awareness. Your health data is a digital extension of your physical self. It carries with it an intrinsic vulnerability.
Understanding the legal and technological landscape in which this data exists is the first step toward becoming a more conscious and empowered participant in your own wellness. The path forward is one of informed consent, of asking critical questions, and of demanding a higher standard of care for the information you choose to share. Your vitality is your own. The data that describes it should be as well.
