This article was originally published in Venable's All About Advertising Law Blog on April 6, 2016.
The Federal Trade Commission (FTC or the Commission) announced yesterday that it has created a web-based guidance tool for developers of health-related mobile applications (health apps). FTC did not take this action alone, but rather developed the tool in conjunction with the Department of Health and Human Services’s (HHS) Office of the National Coordinator for Health Information Technology (ONC), Office for Civil Rights (OCR), and the U.S. Food and Drug Administration (FDA). As some readers will recall, FDA is not new to this space, having released a seminal guidance document on mobile medical apps early last year. In its guidance document, FDA addresses, among other things, those apps that FDA intends to regulate as medical devices under the Federal Food, Drug, and Cosmetic Act (FD&C Act) and those for which the agency intends to exercise its enforcement discretion. OCR has also recently issued guidance in this area, providing examples of scenarios where the Health Insurance Portability and Accountability Act (HIPAA) regulations might apply to health information created, managed, or organized through the use of health apps.
The FTC's new health apps tool asks developers a series of high-level questions about the nature of the app, including questions about its function, the data it collects, and the services it provides to users. These questions include the following:
- Do you create, receive, maintain, or transmit identifiable health information?
- Are you a health care provider or health plan?
- Do consumers need a prescription to access your app?
- Are you developing this app on behalf of a HIPAA-covered entity?
- Is your app intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment or prevention of disease?
- Does your app pose "minimal risk" to a user?
- Is your app a "mobile medical app"?
- Are you a nonprofit organization?
- Do you offer health records directly to consumers (or do you interact with or offer services to someone who does)?
Based on the answers to these questions, the tool will point the app developer toward detailed information about certain federal laws that might apply to the app, including the FTC Act, the FTC’s Health Breach Notification Rule, HIPAA, and the FD&C Act.
Simultaneous with the release of the guidance tool, the Commission also issued a business guidance aimed at helping health app developers comply with the FTC Act, by building privacy and security into their apps. Beyond the laws identified above, FTC notes in its business guidance that health apps could be subject to, among other things, the Children’s Online Privacy Protection Rule; the Gramm-Leach-Bliley Act’s Safeguards Rule and Privacy Rule; myriad state laws; and basic truth-in-advertising and privacy principles.
Given the proliferation of health apps, developers can expect increasing federal and state scrutiny over these products. The veritable alphabet soup of potentially-applicable laws require that developers maintain a sophisticated understanding of both existing requirements and new requirements that are sure to come online over the coming months and years.