From Perkins Coie, by Stephanie Duchesneau, Susan Fahringer, Meredith Halama, Janis Kestenbaum:
- The legal landscape around health privacy has become much more complex in recent years, with more entities and types of data now subject to regulation and enforcement.
- The FTC has taken a broader view of what constitutes sensitive health data and has pursued more enforcement actions around the sharing of such data with third parties like ad tech companies.
- Several states like Washington, New York, Nevada, and Connecticut have passed new consumer health privacy laws restricting certain uses of geofencing and health data.
- HHS and the FTC have also issued new guidance clarifying that certain data sharing practices of HIPAA-covered entities may violate privacy rules.
- All entities should review their health privacy practices given this changing legal landscape to ensure compliance and avoid litigation and enforcement risks.