Melissa Sobel Snyder – Duane Morris Health Law

February 8, 2023 by Duane Morris

FTC Wields Health Breach Notification Rule for First Time in Quest to Protect Consumer Health Information

By Samantha Dalmass and Melissa Sobel Snyder

The Federal Trade Commission (“FTC”) is seeking enforcement under the Health Breach Notification Rule for the first time since the rule was adopted in 2009. The Health Breach Notification Rule (16 C.F.R. Part 318) requires vendors of personal health records, PHR-related entities, and third party service providers that are not otherwise subject to the Health Insurance Portability and Accountability Act (“HIPAA”) to notify their customers and individuals whose personal health records are disclosed in the event of a breach or unauthorized disclosure. In its complaint filed against GoodRx on January 1, 2023, the FTC targets the digital health platform, alleging that it repeatedly violated the promises it has made to its customers regarding its protection of their personal health information, including that such information would be shared only with limited third parties and for limited purposes; that GoodRx would restrict such third parties’ use of customer information; and that it would never share personal health information with advertisers or other third parties. Continue reading “FTC Wields Health Breach Notification Rule for First Time in Quest to Protect Consumer Health Information”

December 29, 2020 by Melissa Sobel Snyder

HHS Issues Proposed Changes to the HIPAA Privacy Rule

On December 10, 2020, the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) issued a Notice of Proposed Rulemaking (“NPRM”) to modify the HIPAA Privacy Rule. HHS stated that the proposed modifications, which are being issued as part of HHS’s “Regulatory Sprint to Coordinated Care,” are aimed at removing barriers to coordinated care, strengthening individuals’ access to their own medical information, and reducing unnecessary administrative burdens. Proposed changes to the HIPAA Privacy Rule in the NPRM include: Continue reading “HHS Issues Proposed Changes to the HIPAA Privacy Rule”

March 31, 2020 by Melissa Sobel Snyder

The CARES Act Amends Federal Law Governing the Confidentiality of Substance Use Disorder Patient Records

The CARES Act (the “Act”), enacted on March 27, 2020, makes notable changes to federal law governing the disclosure of substance use disorder (“SUD”) records. The Act amends 42 U.S.C. 290dd-2, the governing statute of the regulations at 42 C.F.R. Part 2 (“Part 2”) to better align certain of its confidentiality requirements with HIPAA. The amendments do not change the basic premise that prior written consent of the patient is required for disclosure of SUD treatment records. However, once prior written consent of the patient is obtained, the amendments allow a covered entity, business associate, or Part 2 program to use or disclose SUD records for purposes of treatment, payment, and health care operations as permitted by HIPAA. Any information so disclosed may then be redisclosed in accordance with the HIPAA regulations. The amendments also allow a patient’s prior written consent to be given once for all such future uses or disclosures for purposes of treatment, payment, and health care operations, until the patient revokes his or her consent in writing. Continue reading “The CARES Act Amends Federal Law Governing the Confidentiality of Substance Use Disorder Patient Records”