Who Has to Act When Health Data Crosses a Boundary?

This chapter maps responsibility inside the non-HIPAA personal health record ecosystem covered by the Federal Trade Commission’s Health Breach Notification Rule. The focus is not a catalogue of company types; it is the difference between a company’s role in the data flow and the function it performs. That distinction helps a reader determine who must notify consumers, who must alert the vendor, and why a contract or familiar label such as “analytics provider” does not settle the question.

A consumer health app rarely operates alone. A person may enter health information into the app, connect a fitness tracker or blood-pressure monitor, and receive a service supported by cloud storage, payment processing, analytics, or advertising. Several companies may touch the same unsecured PHR identifiable health information. If the analysis follows only the app’s logo, it misses the way the rule allocates responsibility across the system.

The same data flow can contain multiple legal roles

The FTC rule recognizes three important positions. A vendor of personal health records is an entity that offers or maintains a personal health record. A PHR related entity is a non-HIPAA entity that offers products or services through the online service of a PHR vendor or through an online service of a HIPAA-covered entity that offers individuals personal health records, or that accesses unsecured PHR identifiable health information in a personal health record or sends such information to one. A third-party service provider is an entity that provides services connected to offering or maintaining the PHR or a related entity’s product and handles unsecured PHR identifiable health information as a result of those services.

These definitions overlap in the real world, but they are not interchangeable. The vendor or related entity usually has the direct relationship with the individual. A service provider may be invisible to the consumer even though it stores, modifies, records, or otherwise handles the data. The legal role depends on the service and the data handled, not simply on whether the company has access to a system.

A connected device shows why the distinction matters. The maker of a fitness tracker, glucose monitor, or remote blood-pressure cuff can be a PHR related entity when the device is synchronized with a health app and sends unsecured PHR identifiable health information to that record. The device maker may also be a vendor of personal health records if it offers an app that accepts the person’s own health inputs and maintains the resulting record. One company can therefore participate in more than one relationship, depending on which product and data path are being examined.

The rule also draws a line around service providers. A cloud company that supplies back-end storage for a health app may access unsecured information while providing the contracted service. That access does not, by itself, make the cloud company a PHR related entity.