Federal Efforts Introduced To Protect Non-HIPAA Health Data

Privacy In Focus®

Under federal law, much of the health data recorded from wearable devices, health care applications, and health IoT devices is beyond the reach of the Health Insurance Portability and Accountability Act (HIPAA), which protects only interactions between a "covered entity" in connection with the provision of medical services. On February 9, 2022, Sens. Tammy Baldwin (D-WI) and Bill Cassidy, M.D. (R-LA) introduced bipartisan legislation, S.3620, the Health Data Use and Privacy Commission Act, to establish a Commission to analyze potential threats to health care privacy.

State Attorneys General (AG) and the Federal Trade Commission (FTC or Commission) have historically used their respective authorities – under unfair, deceptive, or abusive acts and practices (UDAAP/UDAP) statutes – to ensure that health data that isn't covered by HIPAA is nonetheless protected. For example, in early 2017, the New York Attorney General investigated the privacy