As the Federal Trade Commission (FTC) jumps wholeheartedly into the health care privacy enforcement space with two major actions so far in 2023, policymakers need to address what is currently a bifurcated privacy regulatory scheme between the FTC and the HHS Office for Civil Rights (OCR), an attorney said.

HIPAA, which is enforced by OCR, may not be the correct tool to cover digital health companies that offer products directly to consumers, said Daniel Solove, John Marshall Harlan Research Professor of Law at George Washington University Law School. However, it’s problematic for certain types of data to be inadequately protected, Solove said at the 40th annual HIPAA Summit on March 8.^[1]

“I definitely think [digital health care privacy] needs to be rethought and addressed,” Solove said. “Whether or not it should fall under HIPAA is a really challenging question. HIPAA is limited in its coverage, and I think that to a layperson, they would be quite surprised to find out that HIPAA really doesn’t cover their health information—writ large, it just covers a certain subset of their health information.”

Meanwhile, so far this year the FTC has made two moves in the health care data space. In February, it hit prescription drug discount provider GoodRx for unauthorized disclosures of consumers’ personal health information to technology companies—the first action under the FTC’s 2009 Health Breach Notification Rule. GoodRx will be barred from sharing user health data with applicable third parties for advertising purposes and has agreed to pay a $1.5 million civil penalty.^[2]