FTC Takes on Digital Health Information Sharing
Three SheppardMullins attorneys say a recent Federal Trade Commission (FTC) settlement highlights the importance of accurately describing how information is collected, used, and shared in digital health apps. In an online FDA Law Update Blog post, the attorneys say FTC settled with Flo Health, Inc., a fertility-tracking app, based on promises the company made on how health data would be shared.
As part of the settlement, the attorneys write, Flo must notify affected users about the disclosure of their personal information and instruct any third party that received users’ health information to destroy the data. Also, separate from any privacy policy or terms of use, before sharing any health information with a third party in the future, Flo must disclose the categories of health information that will be shared, the identities of the third parties, the purpose of such disclosure and how any information will be used, and obtain users’ affirmative express consent.
The attorneys conclude that the settlement is a reminder that companies in the health and wellness space have privacy and security obligations even if HIPAA regulations do not apply to them.