| Donate $25 for two DVDs of the Cryptome collection of files from June 1996 to the present |
|
25 August 2009
[Federal Register: August 25, 2009 (Volume 74, Number 163)]
[Rules and Regulations]
[Page 42961-42985]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr25au09-12]
[[Page 42961]]
-----------------------------------------------------------------------
Part II
Federal Trade Commission
-----------------------------------------------------------------------
16 CFR Part 318
Health Breach Notification Rule; Final Rule
[[Page 42962]]
-----------------------------------------------------------------------
FEDERAL TRADE COMMISSION
16 CFR Part 318
[RIN 3084-AB17]
Health Breach Notification Rule
AGENCY: Federal Trade Commission (FTC).
ACTION: Final Rule.
-----------------------------------------------------------------------
SUMMARY: The Federal Trade Commission (``FTC'' or ``Commission'') is
issuing this final rule, as required by the American Recovery and
Reinvestment Act of 2009 (the ``Recovery Act'' or ``the Act''). The
rule requires vendors of personal health records and related entities
to notify consumers when the security of their individually
identifiable health information has been breached.
DATES: This rule is effective September 24, 2009. Full compliance is
required by February 22, 2010.
ADDRESSES: Requests for copies of the Final Rule and this Notice should
be sent to: Public Records Branch, Room 130, Federal Trade Commission,
600 Pennsylvania Avenue, N.W., Washington, DC 20580. The public record
of this proceeding is also available at that address. Relevant portions
of the proceeding, including the Final Rule and this Notice, are
available at http//www.ftc.gov.
FOR FURTHER INFORMATION CONTACT: Cora Tung Han or Maneesha Mithal,
Attorneys, Division of Privacy and Identity Protection, Bureau of
Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue,
NW., Washington, DC 20580, (202) 326-2252.
SUPPLEMENTARY INFORMATION:
Table of Contents
I. Background
II. Overview of the Recovery Act, Proposed Rule, and Comments
Received
III. Section-By-Section Analysis of the Rule
IV. Paperwork Reduction Act
V. Regulatory Flexibility Act
VI. Final Rule
I. Background
On February 17, 2009, President Obama signed the American Recovery
and Reinvestment Act of 2009 (the ``Recovery Act'' or ``the Act'') into
law.\1\ The Act includes provisions to advance the use of health
information technology and, at the same time, strengthen privacy and
security protections for health information.
---------------------------------------------------------------------------
\1\ American Recovery & Reinvestment Act of 2009, Pub. L. No.
111-5, 123 Stat. 115 (2009).
---------------------------------------------------------------------------
Among other things, the Recovery Act recognizes that there are new
types of web-based entities that collect consumers' health information.
These entities include vendors of personal health records and online
applications that interact with such personal health records
(``PHRs'').\2\ Some of these entities are not subject to the existing
privacy and security requirements of the Health Insurance Portability
and Accountability Act (``HIPAA'').\3\ For such entities, the Recovery
Act requires the Department of Health and Human Services (``HHS'') to
study, in consultation with the FTC, potential privacy, security, and
breach notification requirements and to submit a report to Congress
containing recommendations within one year of enactment of the Recovery
Act (the ``HHS report''). Until Congress enacts new legislation
implementing such recommendations, the Recovery Act contains temporary
requirements, to be enforced by the FTC, that such entities notify
individuals in the event of a security breach. The final rule
implements these requirements.
---------------------------------------------------------------------------
\2\ In general, personal health records are online repositories
of health information that individuals can create to track their
medical visits, prescription information, etc. The terms ``vendor of
personal health records'' and ``personal health records'' are
defined terms in the FTC's rule; thus, in some instances, the term
``personal health record'' is not abbreviated.
\3\ Health Insurance Portability & Accountability Act, Pub. L.
No. 104-191, 110 Stat. 1936 (1996).
---------------------------------------------------------------------------
The Recovery Act also directs HHS to promulgate a rule requiring
(1) HIPAA-covered entities, such as hospitals, doctors' offices, and
health insurance plans, to notify individuals in the event of a
security breach and (2) business associates of HIPAA-covered entities
to notify such HIPAA-covered entities in the event of a security
breach.\4\ HIPAA-covered entities and entities that engage in
activities as business associates of HIPAA-covered entities will be
subject only to HHS' rule and not the FTC's rule, as explained further
below.
---------------------------------------------------------------------------
\4\ The Recovery Act requires HHS to issue its rule within 180
days of enactment of the Recovery Act. Sec. 13402(j).
---------------------------------------------------------------------------
II. Overview of the Recovery Act, Proposed Rule, and Comments Received
The Recovery Act requires ``vendors of personal health records''
and ``PHR related entities,'' as defined below, to notify their
customers of any breach of unsecured, individually identifiable health
information. Further, a third party service provider of such vendors or
entities that experiences a breach must notify such vendors or entities
of the breach, so that they can in turn notify their customers. The Act
contains specific requirements governing the timing, method, and
contents of the breach notice to consumers. For example, it requires
entities to provide breach notices ``without unreasonable delay,'' and
in no case later than 60 calendar days after discovering a breach; it
requires notice to consumers by first-class mail or, if specified as a
preference by the individual, by email; and it requires substitute
notice, through the media or a web posting, if there is insufficient
contact information for ten or more individuals. In addition, the Act
requires the FTC to adopt a rule implementing the breach notification
requirements applicable to vendors of personal health records, PHR
related entities, and third party service providers within 180 days of
enactment of the Act. It also authorizes the FTC to seek civil
penalties for violations.
The Recovery Act contains a similar scheme for HIPAA-covered
entities, to be enforced by HHS. HIPAA-covered entities must notify
individuals whose ``unsecured protected health information'' is
breached. If a business associate of a HIPAA-covered entity experiences
a security breach, it must notify the HIPAA-covered entity, which must
in turn notify individuals.
To fulfill the Recovery Act requirements, on April 20, 2009, the
Commission issued a Notice of Proposed Rulemaking (``NPRM''). The
proposed rule contained in the NPRM adhered closely to the requirements
of the Recovery Act.\5\ The Commission received approximately 130
comments.\6\ Some general comments are summarized below, and an
analysis of comments addressing particular sections of the proposed
rule follows.
---------------------------------------------------------------------------
\5\ 74 FR 17,914.
\6\ Comments are available at (http://www.ftc.gov/os/comments/
healthinfobreach/index.shtm). The Commission also reviewed the
comments HHS received in response to its Request for Information on
its forthcoming breach notification rule. 74 FR 19,006. However, the
specific comments addressed in this Notice are those that were filed
in response to the FTC's NPRM.
---------------------------------------------------------------------------
First, commenters that addressed the issue generally agreed that
FTC and HHS should work together to ensure that their respective breach
notification rules are harmonized and that stakeholders know which rule
applies to which entity.\7\ Some of these commenters recognized that
some entities that operate in different roles may be subject to both
rules, and that
[[Page 42963]]
it is therefore important for the rules to be similar.\8\ The
Commission agrees and has consulted with HHS to harmonize the two
rules, within the constraints of the statutory language. Further, as
explained below, for some entities subject to both the HHS and FTC
rules, compliance with certain HHS rule requirements shall be deemed
compliance with the corresponding provisions of the FTC's rule.
---------------------------------------------------------------------------
\7\ See, e.g., American Council of Life Insurers (``ACLI'') at
1; American Benefits Council (``ABC'') at 2; American Insurance
Association (``AIA'') at 1; Center for Democracy & Technology,
Markle Foundation, Childbirth Connection, Health Care for All,
National Partnership for Women & Families, SEIU (hereinafter ``CDT/
Markle'') at 4-5; Dossia at 5; HealthITNow.org at 1-2; National
Association of Chain Drug Stores (``NACDS'') at 4; WebMD at 3.
\8\ See, e.g., HealthITNow.org at 2; WebMD at 3.
---------------------------------------------------------------------------
A second and related point that many commenters raised was that, to
the extent possible, consumers should receive a single notice for a
single breach.\9\ These commenters pointed out that receiving multiple
notices for the same breach would confuse consumers and convey an
exaggerated sense of risk.\10\ Receiving a barrage of notices also
could cause consumers to become numb to such notices, so that they may
fail to spot or mitigate the risks being communicated to them.\11\ Some
commenters noted that consumers could receive multiple notices because
of inadvertently overlapping requirements between HHS and FTC
rules.\12\ As described below, the Commission has taken steps to ensure
that its rule does not overlap with HHS' and that consumers do not
receive multiple notifications.
---------------------------------------------------------------------------
\9\ See, e.g., American Legislative Exchange Council (``ALEC'')
at 6; HealthITNow.org at 2; Software Information Industry
Association (``SIIA'') at 3; Statewide Parent Advocacy Network, Inc.
at 1; United Health Group (``UHG'') at 2.
\10\ See, e.g., ALEC at 7; HealthITNow.org at 2.
\11\ See, e.g., Blue Cross/Blue Shield at 4; SIIA at 6-7.
\12\ See, e.g., American Health Information Management
Association (``AHIMA'') at 2; American Medical Association (``AMA'')
at 2.
---------------------------------------------------------------------------
Third, several commenters raised privacy and security concerns
about PHRs generally.\13\ For example, one commenter asked the FTC to
establish comprehensive privacy and security standards, and supported
the creation of a private right of action for a violation of these
standards.\14\ The Commission notes that, although general privacy and
security issues are beyond the scope of the current rulemaking, the
Commission will take these comments into account when it provides input
on the HHS report described above.
---------------------------------------------------------------------------
\13\ See, e.g., Electronic Privacy Information Center (``EPIC'')
at 11; Flagler, Hoerl, Hosler.
\14\ EPIC at 11.
---------------------------------------------------------------------------
Fourth, several individual commenters expressed concerns about
electronic health records in general.\15\ Some of these commenters
questioned the cost-savings that would result;\16\ others strongly
supported patients' right to opt out of such records.\17\ In response,
the Commission notes that this rule addresses only breach notification
with respect to PHRs voluntarily created by individuals; it does not
address electronic health records more generally, such as those created
for patients by hospitals or doctors' offices.\18\
---------------------------------------------------------------------------
\15\ See, e.g., Blair, Coon, Flagler.
\16\ See, e.g., Jones-Ford, Rogalski, Serich,
\17\ See, e.g., Amidei, Baxter, Blair, Coon.
\18\ Section 13400(5) of the Recovery Act defines ``electronic
health record'' as an electronic record of health-related
information on an individual that is ``created, gathered, managed,
and consulted by authorized health care clinicians and staff.'' In
contrast, section 13400(11) defines ``personal health record'' as an
electronic record ``on an individual that can be drawn from multiple
sources and that is managed, shared, and controlled by or primarily
for the individual.''
---------------------------------------------------------------------------
Finally, many commenters expressed concerns about particular
statutory requirements governing breach notification. For example, some
commenters stated that entities should be required to provide breach
notification for paper, as well as electronic, information;\19\ others
expressed concerns about requiring media notice.\20\ Because these
requirements come directly from the language of the Recovery Act, the
Commission cannot change its final rule in response to these comments.
Nevertheless, the Commission will take these comments into account when
it provides input on the HHS report.
---------------------------------------------------------------------------
\19\ See, e.g., IDExperts at 1-2; National Association for
Information Destruction (``NAID'') at 3-4, Ohio State University
Medical Center at 1, Statewide Parent Advocacy Network, Inc. at 2.
\20\ See, e.g., IDExperts at 2-3; Identity Theft 911 at 3.
---------------------------------------------------------------------------
III. Section-by-Section Analysis
Section 318.1: Purpose and Scope
Proposed section 318.1 set forth the relevant statutory authority
for the proposed rule; stated that the proposed rule would apply to
vendors of personal health records, PHR related entities, and third
party service providers; and clarified that the proposed rule would not
apply to HIPAA-covered entities or to an entity's activities as a
business associate of a HIPAA-covered entity. The Commission received
several comments on this section as follows.
A. Application of Rule to Non-Profits and Other Entities Beyond the
FTC's Traditional Jurisdiction
In its NPRM, the Commission noted that the proposed rule applied to
entities beyond the FTC's traditional jurisdiction under section 5 of
the FTC Act, such as non-profits (e.g., educational institutions,
charities, and 501(c)(3) organizations), because the Recovery Act does
not limit the FTC's enforcement authority to its enforcement
jurisdiction under section 5. Indeed, section 13407 of the Recovery Act
expressly applies to ``vendors of personal health records and other
non-HIPAA covered entities,'' without regard to whether such entities
fall within the FTC's jurisdiction under section 5.
The Commission received several comments in support of this
requirement. One commenter stated that it was reasonable for the FTC's
rule to apply to non-profits.\21\ Another commenter suggested applying
the rule to as broad a range of entities as possible.\22\ Yet another
commenter stated that the rule should apply to all entities that handle
PHRs.\23\ Thus, the Commission retains its interpretation and modifies
the proposed rule to clarify that it applies to vendors of personal
health records and PHR related entities, ``irrespective of any
jurisdictional tests in the Federal Trade Commission Act.''\24\
---------------------------------------------------------------------------
\21\ CDT/Markle at 14-15.
\22\ IDExperts at 1.
\23\ See, e.g., EPIC at 3.
\24\ The rule will not apply to federal agencies. The Commission
notes that federal agencies already follow breach reporting
requirements established by the Office of Management and Budget
(``OMB''). See OMB Memorandum for the Heads of Executive Departments
and Agencies re Safeguarding Against and Responding to the Breach of
Personally Identifiable Information, May 22, 2007, available at
(http://www.whitehouse.gov/OMB/memoranda/fy2007/m07-16.pdf).
---------------------------------------------------------------------------
B. Application of the FTC's Rule to HIPAA-Covered Entities and Business
Associates of HIPAA-Covered Entities
As noted above, the Commission received many comments about the
need to harmonize the HHS and FTC rules to simplify compliance burdens
and create a level-playing field for HIPAA and non-HIPAA covered
entities.\25\ Several commenters agreed with the statements in the
FTC's NPRM that (1) HIPAA-covered entities should be subject to HHS'
breach notification rule and not the FTC's rule; and (2) business
associates of HIPAA-covered entities should be subject to HHS' breach
notification rule, but only to the extent they are acting as business
associates.\26\ Accordingly, the FTC adopts as final the provision that
the rule ``does not apply to HIPAA-covered entities, or to any other
entity to the extent that it engages in activities as a business
associate of a HIPAA-covered entity,'' but provides further guidance in
response to specific comments received on the issue.
---------------------------------------------------------------------------
\25\ See supra note 7.
\26\ See, e.g., Dossia at 5; UHG at 2; WebMD at 2.
---------------------------------------------------------------------------
[[Page 42964]]
1. Application of the FTC's Rule to HIPAA-Covered Entities
Although the FTC's proposed rule made clear that it did not apply
to HIPAA-covered entities, one medical association urged the Commission
to exclude doctors explicitly from the FTC rule, even if they are
involved with PHRs.\27\ The Commission agrees that, because health care
providers such as doctors are generally HIPAA-covered entities, the
FTC's rule does not apply to them in such capacity. Thus, if a doctor's
medical practice offers PHRs to its patients, neither the doctor nor
the medical practice is subject to the FTC's rule.\28\ However, if the
doctor creates a PHR in a personal capacity, there may be circumstances
under which the FTC's rule would apply. For example, a non-practicing
doctor may create and offer PHRs to the public as part of a start-up
business venture. In this circumstance, the doctor is not acting in his
or her capacity as a HIPAA-covered entity, and thus, the FTC's rule
would regulate the PHRs.
---------------------------------------------------------------------------
\27\ American Medical Association at 1-2.
\28\ Some doctors or other health care providers, however, may
not be HIPAA-covered entities because they do not participate in
``covered transactions'' under HIPAA regulations, such as submitting
health care claims to a health plan. See 45 CFR 160.103. In such
cases, these doctors or health care providers are subject to the
FTC's rule if they offer PHRs or related services. Similarly, some
commenters asked whether the FTC's rule applies to education records
covered by the Family Educational Rights and Privacy Act
(``FERPA''), 20 U.S.C. 1232g (i.e., records of educational
institutions such as public schools and universities). See Ohio
State University Medical Center at 1; Statewide Parent Advocacy
Network at 3-4. If school nurses or physicians' offices within these
institutions are not HIPAA-covered entities, they are subject to the
FTC's rule if they offer PHRs or related services.
---------------------------------------------------------------------------
In addition, one commenter asked whether the FTC's rule would cover
PHRs that a HIPAA-covered entity offers to its employees.\29\ Because
the FTC's rule does not apply to HIPAA-covered entities, it does not
apply to PHRs that such entities offer their employees. However, if a
HIPAA-covered health care provider or group health plan offers PHRs to
employees because they also are patients of such health care provider
or enrollees of such group health plan, then HHS' rule would apply to
the PHRs.
---------------------------------------------------------------------------
\29\ Ohio State University Medical Center at 1.
---------------------------------------------------------------------------
2. Application of the FTC's Rule to Business Associates of HIPAA-
Covered Entities
In its NPRM, the Commission recognized that, in many cases,
business associates of HIPAA-covered entities that also offer PHRs to
the public could be subject to both the HHS and FTC breach notification
rules. If they experience a breach, they could be required to provide
direct breach notification to their individual customers under the
FTC's rule. At the same time, under HHS' rule, they could be required
to notify HIPAA-covered entities to whom they provide services, so that
the HIPAA-covered entities could in turn notify individuals. In some
cases, as discussed further below, this potential overlap could lead to
consumers' receiving multiple notices for the same breach.
The Commission asked for examples of vendors of personal health
records that may have a dual role as a business associate of a HIPAA-
covered entity and as a direct provider of PHRs to the public, and how
the rule should address such a dual role. Commenters provided several
useful examples,\30\ all of which the Commission believes can be
addressed within the framework provided in the rule. Most commenters
that addressed the issue stated, and the Commission agrees, that
regardless of the circumstances, consumers should receive a single
breach notice for a single breach.\31\ In addition, the Commission
agrees with the commenters that stated that the breach notice should
come from the entity with whom the consumer has a direct
relationship.\32\ Indeed, the Commission believes that consumers are
more likely to pay attention to a notice provided by an entity known to
the consumer, and that consumers may ignore or discard notices provided
by unknown entities.\33\
---------------------------------------------------------------------------
\30\ See, e.g., Dossia at 2-3; UHG at 3; WebMD at 3.
\31\ See supra note 9.
\32\ See, e.g., CDT/Markle at 12; Dossia at 5.
\33\ See, e.g., Statement of Basis and Purpose, Affiliate
Marketing Rule, 72 FR 62910 (Nov. 7, 2007) (requiring that opt-out
notices come from entity with whom the consumer has a relationship).
---------------------------------------------------------------------------
For these reasons, it may be desirable in some circumstances for a
vendor of personal health records to provide notice directly to
consumers even when the vendor is serving as a business associate of a
HIPAA-covered entity. For example, a consumer that obtained a PHR
through a HIPAA-covered entity may nevertheless deal directly with the
PHR vendor in managing his or her PHR account, and would expect any
breach notice to come from the PHR vendor. Similarly, where a vendor of
personal health records has direct customers and thus is subject to the
FTC's rule, and also provides PHRs to customers of a HIPAA-covered
entity through a business associate arrangement, it may be appropriate
for the vendor to provide the same notice to all such customers. In the
latter situation, the Commission believes that the vendor of personal
health records should be able to comply with one set of rule
requirements--those promulgated by HHS--governing the timing, method,
and content of notice to consumers. Thus, in those limited
circumstances where a vendor of personal health records (1) provides
notice to individuals on behalf of a HIPAA-covered entity, (2) has
dealt directly with these individuals in managing the PHR account, and
(3) provides such notice at the same time that it provides an FTC-
mandated notice to its direct customers for the same breach, the FTC
will deem compliance with HHS requirements governing the timing,
method, and content of notice to be compliance with the corresponding
FTC rule provisions.\34\
---------------------------------------------------------------------------
\34\ For direct customers, the vendor of personal health records
still must comply with all other FTC rule requirements, including
the requirement to notify the FTC within ten business days after
discovering the breach. The Commission notes also that the above
analysis would apply equally to a PHR related entity, as defined
below, that deals directly with the public and acts as a business
associate in providing services.
---------------------------------------------------------------------------
Based on the comments received, the Commission has developed the
following examples to illustrate situations of dual or overlapping
coverage under the FTC and HHS rules.
a. Example 1: Vendor with a Dual Role as Business Associate and
Provider of PHRs to the Public
PHR Vendor provides PHRs to the public through its own Web site.
PHR Vendor also signs a business associate agreement with ABC Insurance
(a HIPAA-covered entity) to offer PHRs to customers of ABC Insurance.
ABC Insurance sends a message to its customers offering free PHRs
through PHR Vendor and provides a link to PHR Vendor's Web site.
Several patients of ABC Insurance choose to create PHRs through PHR
Vendor. A hacker remotely copies the PHRs of all of PHR Vendor's users.
Under the FTC's rule, PHR Vendor is a vendor of personal health
records that must provide breach notice to members of the public to
whom it offers PHRs directly. It is not acting as a business associate
to anyone in providing these PHRs. However, because it is acting as a
business associate to ABC Insurance by providing PHRs for ABC
Insurance's patients, it is not required to provide direct notice to
ABC Insurance's customers under the FTC's rule. Rather, under the
Recovery Act, in its capacity as a business associate, it must notify
ABC Insurance so that ABC Insurance can in turn notify its customers.
PHR Vendor therefore must maintain a list of its own customers and
a
[[Page 42965]]
separate list of ABC Insurance's customers so that it can fulfill its
obligations under the Recovery Act to provide notice to its own
customers, as well as a separate notice to ABC Insurance. If PHR Vendor
has similar business associate agreements with other entities, it must
maintain separate customer lists for each such entity.
In this example, however, because PHR Vendor has a direct
relationship with all of the individuals affected by the breach
(including the patients of ABC Insurance), PHR Vendor may contract with
ABC Insurance to notify individuals on ABC Insurance's behalf.\35\ The
Commission encourages such contractual arrangements because they would
(1) satisfy both PHR Vendor's and ABC Insurance's obligation to notify
individuals; (2) ensure that consumers receive a single notice from an
entity with whom they have a direct relationship; and (3) simplify the
notification process so that PHR Vendor can provide direct notice to
those affected at the same time.\36\
---------------------------------------------------------------------------
\35\ PHR Vendor still must comply with the Recovery Act
requirement to notify ABC Insurance of the breach.
\36\ As explained above, if PHR Vendor were to send individual
notices on behalf of ABC Insurance, it could send all of its breach
notices, including notices to its direct customers, in accordance
with HHS rules requirements governing the timing, method, and
content of notice.
---------------------------------------------------------------------------
b. Example 2: Addressing Portable PHRs
As in Example 1, PHR Vendor offers PHRs directly to the public. It
also offers PHRs to enrollees of various health insurance companies,
including ABC Insurance and XYZ Insurance, through business associate
agreements with those companies. Sally is a patient of ABC Insurance.
ABC Insurance offers Sally the use of PHR Vendor's product, and Sally
creates her PHR. Years later, Sally moves, changes jobs, switches to
XYZ Insurance, and keeps her PHR with PHR Vendor. If PHR Vendor's
records are breached at this point, under HHS' rule, PHR Vendor, as a
business associate of XYZ Insurance, must notify XYZ Insurance that
Sally's record has been breached, and XYZ Insurance must provide Sally
with a breach notice. Alternatively, if Sally had moved to an insurance
company with whom PHR Vendor did not have a business associate
agreement, PHR Vendor would not be subject to HHS' rule with respect to
Sally; it must treat her as its own customer and provide Sally with
breach notice directly.
In this scenario, PHR Vendor has an additional obligation to
address the potential portability of PHRs. To fulfill such obligation,
PHR Vendor must maintain lists tracking which customers belong to which
HIPAA-covered entity, and must update such information regularly.
Without such an updating system, PHR Vendor might keep Sally on its
list of ABC Insurance's customers, but when Sally leaves ABC Insurance,
that company may no longer have an obligation to notify her of a
breach, and she may never receive a notice.\37\ Alternatively, if PHR
Vendor does not properly update its customer lists, Sally potentially
could receive up to three notices--one from PHR Vendor, one from ABC
Insurance, and one from XYZ Insurance.
---------------------------------------------------------------------------
\37\ PHR Vendor's failure to send Sally a notice in this
situation would constitute a violation of the FTC's rule.
---------------------------------------------------------------------------
As in Example 1, the Commission encourages vendors like PHR Vendor
to include provisions in their business associate agreements stating
that they will send breach notices on behalf of the entities to whom
they are providing business associate services. In Example 2, such a
contractual provision would simplify the notification process; it also
may help avoid a situation in which consumers like Sally, who may move
around frequently, receive multiple notices, or even worse, no notice.
c. Example 3: PHRs Offered to Families
Sally is employed by ABC Widgets, which has a HIPAA-covered group
health plan. ABC Widgets' group health plan offers PHRs to employees
and employees' spouses through PHR Vending, a business associate of ABC
Widgets' group health plan. Sally gets a PHR; her husband John is
separately insured, but he decides to get a PHR through PHR Vending as
well. If PHR Vending experiences a breach, Sally may get a notice from
ABC Widgets' group health plan under HHS' rule, and John must get a
notice from PHR Vending under the FTC's rule. Alternatively, ABC
Widgets and PHR Vending may, through their business associate
agreement, choose to have PHR Vending send breach notices to all
customers, as explained above.
C. Application of the FTC's Rule to Entities Outside the United States
One commenter suggested that the Commission clarify whether its
rule applies to foreign businesses that have U.S. customers.\38\ The
Commission agrees and has determined that foreign entities with U.S.
customers must provide breach notification under U.S. laws.
Accordingly, it adds language to the final rule stating that it
``applies to foreign and domestic vendors of personal health records,
PHR related entities, and third party service providers . . . that
maintain information of U.S. citizens or residents.''
---------------------------------------------------------------------------
\38\ World Privacy Forum at 1-2.
---------------------------------------------------------------------------
The Recovery Act supports this interpretation. Section 13407(e) of
the Act states that a violation of the FTC's breach notification
provisions ``shall be treated as an unfair and deceptive act or
practice in violation of a regulation under section 18(a)(1)(B) of the
Federal Trade Commission Act. . .'' Section 18(a)(1)(B) allows the
Commission to issue regulations that define ``with specificity acts or
practices which are unfair or deceptive acts or practices'' under the
FTC Act.\39\ The term ``unfair or deceptive acts or practices'' is in
turn defined to include those acts or practices ``in foreign commerce''
that ``cause or are likely to cause reasonably foreseeable injury
within the United States'' or ``involve material conduct occurring
within the United States.''\40\ Thus, the Recovery Act's references to
the ``unfair or deceptive acts or practices'' section of the FTC Act,
which has extraterritorial reach, supports the interpretation that the
FTC's rule applies to foreign vendors of personal health records,
related entities, as well as third party service providers, to the
extent that they deal with U.S. consumers.
---------------------------------------------------------------------------
\39\ 15 U.S.C. 57a.
\40\ 15 U.S.C. 45.
---------------------------------------------------------------------------
D. Preemption of State Law
Several commenters discussed state breach notification requirements
that could potentially conflict with the FTC's rule requirements.\41\
Several of these commenters raised concerns that such conflicting
requirements could increase compliance burdens on businesses.\42\ Some
also raised concerns that entities would be required to send consumers
multiple notices to comply with both state laws and the FTC's rule.\43\
---------------------------------------------------------------------------
\41\ See, e.g., America's Health Insurance Plans (``AHIP'') at
7; AIA at 1; Dossia at 10-11; Molina Healthcare at 5-6; NACDS at 3-
4; National Association of Mutual Insurance Companies (``NAMIC'') at
7-8; SIIA at 2-3; Sonnenschein at 1-2; UHG at 9-12; WebMD at 5-7.
\42\ See, e.g., AIA at 1; Dossia at 10; Molina Healthcare at 5-
6.
\43\ See, e.g., AHIP at 8; AIA at 2.
---------------------------------------------------------------------------
The Commission notes that, under section 13421 of the Recovery Act,
the preemption standard set forth in section 1178 of the Social
Security Act, 42 U.S.C. 1320d-7 applies also to the FTC's rule. That
section, which contains the preemption standard for HIPAA and its
implementing regulations, states that federal requirements supersede
any
[[Page 42966]]
contrary provision of State law.\44\ To clarify that the same standard
applies here, the Commission has added language to the final rule
stating that, ``[t]his Part preempts state law as set forth in section
13421 of the American Recovery and Reinvestment Act of 2009.''
---------------------------------------------------------------------------
\44\ Section 1178 also sets forth some exceptions to this
standard, none of which applies here. Of most relevance, one
exception states that federal requirements will not necessarily
preempt contrary state laws that, ``subject to section 264(c)(2)''
of HIPAA, relate to the ``privacy of individually identifiable
health information.'' Although the FTC's rule relates to ``privacy
of individually identifiable health information,'' HHS interprets
this exception as applying only to the HIPAA Privacy Rule, because
it is the sole regulation promulgated under section 264(c)(2) of
HIPAA.
---------------------------------------------------------------------------
The Commission notes that the final rule preempts only contrary
state laws. Under HHS regulations implementing the preemption standard
of section 1178 of the Social Security Act, a state law is contrary to
federal requirements (1) if it would be impossible to comply with both
state and federal requirements or (2) if state law ``stands as an
obstacle to the accomplishment and execution of the full purposes and
objectives'' of the federal requirements.\45\ Under this standard, the
Commission's rule does not preempt state laws imposing additional, as
opposed to contradictory, breach notification requirements. For
example, some State laws require breach notices to include advice on
monitoring credit reports; others require contact information for
consumer reporting agencies; yet others require the notice to include
advice on reporting incidents to law enforcement agencies. Even though
these content requirements are different from those contained in the
FTC's rule, entities may comply with both state laws and the FTC rule
by setting forth all of the information required in a single breach
notice.\46\ In these circumstances, because it is possible to comply
with both laws, and the state laws do not thwart the objectives of the
federal law,\47\ there is no conflict between state and federal law.
---------------------------------------------------------------------------
\45\ See 45 CFR 160.202.
\46\ The rule does not require entities to send multiple notices
to comply with state and federal law.
\47\ For a discussion of the issue of federal preemption when
state laws frustrate federal objectives, see Wyeth v. Levine, 129 S.
Ct. 1187 (2009).
---------------------------------------------------------------------------
Section 318.2: Definitions
(a) Breach of security
The proposed rule defined ``breach of security'' as the acquisition
of unsecured PHR identifiable health information\48\ of an individual
in a personal health record without the authorization of the
individual.\49\ The Commission adopts this portion of the definition of
breach of security without modification. Examples of unauthorized
acquisition include the theft of a laptop containing unsecured PHRs;
the unauthorized downloading or transfer of such records by an
employee; and the electronic break-in and remote copying of such
records by a hacker.
---------------------------------------------------------------------------
\48\ The phrase ``PHR identifiable health information'' is
defined below.
\49\ Several of the rule provisions refer to information ``in a
personal health record.'' Because a personal health record often
includes information in transit, as well as stored information, the
Commission interprets the phrase ``in a personal health record'' to
include data in motion and data at rest.
---------------------------------------------------------------------------
The proposed rule also contained a rebuttable presumption for
unauthorized access to an individual's data: It stated that, when there
is unauthorized access to data, unauthorized acquisition will be
presumed unless the entity that experienced the breach ``has reliable
evidence showing that there has not been, or could not reasonably have
been, unauthorized acquisition of such information.'' The presumption
was intended to address the difficulty of determining whether access to
data (i.e., the opportunity to view the data) did or did not lead to
acquisition (i.e., the actual viewing or reading of the data). In these
situations, the Commission stated that the entity that experienced the
breach is in the best position to determine whether unauthorized
acquisition has taken place.
In describing the rebuttable presumption, the Commission provided
several examples. It noted that no breach of security has occurred if
an unauthorized employee inadvertently accesses an individual's PHR and
logs off without reading, using, or disclosing anything. If the
unauthorized employee read the data and/or shared it, however, he or
she ``acquired'' the information, thus triggering the notification
obligation in the rule.
Similarly, the Commission provided an example of a lost laptop: If
an entity's employee loses a laptop in a public place, the information
would be accessible to unauthorized persons, giving rise to a
presumption that unauthorized acquisition has occurred. The entity can
rebut this presumption by showing, for example, that the laptop was
recovered, and that forensic analysis revealed that files were never
opened, altered, transferred, or otherwise compromised.
The Commission received numerous comments on the rebuttable
presumption. Several commenters supported it.\50\ Others stated that
the standard articulated by the Commission is too broad and instead
should require breach notification only when there is a risk of
harm.\51\ Several of these commenters stated that the Commission's
proposed standard would result in consumers' being inundated with
breach notices.\52\ In contrast, consumer groups expressed concern that
the Commission was giving too much discretion to companies, which could
easily claim that unauthorized access did not give rise to unauthorized
acquisition.\53\ Several commenters also requested further guidance on
how the rebuttable presumption would work in specific instances.\54\
---------------------------------------------------------------------------
\50\ See, e.g., AHIMA at 3; IDExperts at 1; NAID at 2; NAMIC at
3; Statewide Parent Advocacy Network, Inc., at 2, World Privacy
Forum at 6-7.
\51\ See, e.g., AIA at 2, Blue Cross/Blue Shield at 3; National
Community Pharmacists Association at 2; SIIA at 4-7; UHG at 3-5;
WebMD at 4.
\52\ See, e.g., Blue Cross/Blue Shield at 4; SIIA at 6-7.
\53\ See, e.g., CDT/Markle at 8-9; EPIC at 5.
\54\ See, e.g., AHIP at 2; IDExperts at 1; Intuit at 2; Molina
Healthcare at 2.
---------------------------------------------------------------------------
After considering the comments received, the Commission has decided
to adopt the rebuttable presumption as part of the definition of breach
of security, without modification. In response to the comments
suggesting that the Commission require notification only if there is a
risk of harm, the Commission notes that its standard does take harm
into account. Indeed, notification would not be required in a case
where an entity can show that although an unauthorized employee
accidentally opened a file, it was not viewed, and therefore there has
been no harm to the consumer.
The Commission notes that harm in the context of health information
may be different from harm in the context of financial information. As
one commenter stated, ``[w]ith a breach of financial records, a
consumer faces a significant headache, but ultimately can have their
credit and funds restored; this is not the case with health records. A
stigmatizing diagnosis, condition or prescription in the wrong hands
can cause irreversible damage and discrimination.''\55\ Because health
information is so sensitive, the Commission believes the standard for
notification must give companies the appropriate incentive to implement
policies to safeguard such highly-sensitive information.
---------------------------------------------------------------------------
\55\ See Patient Privacy Rights at 6.
---------------------------------------------------------------------------
With respect to commenters' concerns about the possibility of
consumers' being inundated with breach notifications, the Commission
believes
[[Page 42967]]
that its standard strikes the right balance. Given the highly personal
nature of health information, the Commission believes that consumers
would want to know if such information was read or shared without
authorization. In addition, the danger of overnotification may be
overstated. For example, where there has been unauthorized access to a
database leading to the acquisition of specific consumers' data, a
vendor or entity need not notify all consumers whose information
appears in that database; it only needs to notify those specific
consumers whose data was acquired.
Nevertheless, the Commission agrees that further guidance would be
useful to entities in assessing whether unauthorized acquisition has
taken place as a result of unauthorized access. This further guidance
should also allay consumer groups' concerns that businesses have too
much discretion in making this determination. Commenters posed several
scenarios, which the Commission addresses here.
First, one commenter noted that companies should not have to delve
into the state of mind of employees who accessed data to determine
whether they viewed, read, memorized, or shared such data.\56\ The
Commission agrees and notes that, in a case of inadvertent access by an
employee, no breach notification is required if (1) the employee
follows company policies by reporting such access to his or her
supervisor and affirming that he or she did not read or share the data,
and (2) the company conducts a reasonable investigation to corroborate
the employee's version of events.
---------------------------------------------------------------------------
\56\ See, e.g., SIIA at 5.
---------------------------------------------------------------------------
Second, some commenters asked if unauthorized acquisition has taken
place when a PHR is accessible on the Internet through an obscure Web
site.\57\ The Commission believes that it would be very difficult to
overcome the presumption that unauthorized acquisition has taken place
in this scenario. In fact, because the Internet is accessible to
hundreds of millions of people around the world, it is not generally
reasonable to assume that the information available on the Internet was
not acquired. The presumption of unauthorized acquisition could likely
only be overcome if there was forensic evidence showing that the page
was not viewed.
---------------------------------------------------------------------------
\57\ See NAID at 2; Patient Privacy Rights at 4-5.
---------------------------------------------------------------------------
Third, and similar to the example above, if an employee sends a
mass email containing an individual's unsecured PHR identifiable health
information accidentally, and the employee immediately recalls the
message, the Commission believes that it is highly unlikely that the
presumption can be overcome. In contrast to a situation in which an
employee sends a single email and immediately asks the recipient to
delete it, once hundreds of people have received an email, the
Commission does not believe that there can be a reasonable expectation
that no one ``acquired'' the information.\58\
---------------------------------------------------------------------------
\58\ See In the Matter of Eli Lilly & Co., Docket No. C-4047
(May 8, 2002) (settlement of action in which FTC alleged that
company failed to maintain reasonable security; employee
inadvertently had sent mass email revealing customers' sensitive
health information).
---------------------------------------------------------------------------
On a related issue, the final rule provides that a breach of
security means acquisition of information without the authorization
``of the individual.'' Some commenters raised questions about how the
extent of individual authorization should be determined.\59\ For
example, if a privacy policy contains buried disclosures describing
extensive dissemination of consumers' data, could consumers be said to
have authorized such dissemination?
---------------------------------------------------------------------------
\59\ See, e.g., CDT/Markle at 10; International Pharmaceutical
Privacy Consortium at 2; SIIA at 6.
---------------------------------------------------------------------------
The Commission believes that an entity's use of information to
enhance individuals' experience with their PHR would be within the
scope of the individuals' authorization, as long as such use is
consistent with the entity's disclosures and individuals' reasonable
expectations. Such authorized uses could include communication of
information to the consumer, data processing, or Web design, either in-
house or through the use of service providers. Beyond such uses, the
Commission expects that vendors of personal health records and PHR
related entities would limit the sharing of consumers' information,
unless the consumers exercise meaningful choice in consenting to such
sharing. Buried disclosures in lengthy privacy policies do not satisfy
the standard of ``meaningful choice.''\60\ The Commission will examine
this issue further when providing input on the HHS report.
---------------------------------------------------------------------------
\60\ See, e.g., In the Matter of Sears Management Holding Co.,
File No. 082 3099 (June 4, 2009) (accepted for public comment)
(alleging that Sears' failure to adequately disclose its tracking
activities violated the FTC Act, given that Sears only disclosed
such tracking in a lengthy user license agreement, available to
consumers at the end of a multi-step registration process); FTC
Staff Report, ``Self-Regulatory Principles for Online Behavioral
Advertising,'' Feb. 2009, (http://www2.ftc.gov/os/2009/02/
P085400behavadreport.pdf.); FTC Publication, Dot Com Disclosures:
Information About Online Advertising at 5 (May 2000), available at
(http://www.ftc.gov/bcp/edu/pubs/business/ecommerce/bus41.pdf)
(``Making [a] disclosure available. . . so that consumers who are
looking for the information might find it doesn't meet the clear and
conspicuous standard. . . [D]isclosures must be communicated
effectively so that consumers are likely to notice and understand
them.'') (emphasis in original); see also FTC Policy Statement on
Deception, appended to In the Matter of Cliffdale Assocs., Inc., 103
F.T.C. 110, 174 (1984), available at (http://www.ftc.gov/bcp/
policystmt/ad-decept.htm) (fine print disclosures not adequate to
cure deception).
---------------------------------------------------------------------------
(b) Business associates and (c) HIPAA-covered entities
Proposed paragraph (b) defined ``business associate'' to mean a
business associate under HIPAA, as defined in 45 CFR 160.103. That
regulation, in relevant part, defines a business associate as an entity
that handles the protected health information of a HIPAA-covered entity
and (1) provides certain functions or activities on behalf of the
HIPAA-covered entity or (2) provides ``legal, actuarial, accounting,
consulting, data aggregation, management, administrative,
accreditation, or financial services to or for'' the HIPAA-covered
entity. Proposed paragraph (c) defined ``HIPAA-covered entity'' to mean
a covered entity under HIPAA, as defined in 45 CFR 160.103. That
regulation provides that a HIPAA-covered entity is a health care
provider that conducts certain transactions in electronic form, a
health care clearinghouse (which provides certain data processing
services for health information), or a health plan. The Commission
adopts these definitions without modification.
(d) Personal health record
Proposed paragraph (d) defined a ``personal health record'' as an
``electronic record of PHR identifiable health information on an
individual that can be drawn from multiple sources and that is managed,
shared, and controlled by or primarily for the individual.'' The FTC
adopts this definition without modification.\61\
---------------------------------------------------------------------------
\61\ In response to comments received, the Commission emphasizes
that PHRs are managed, shared, and controlled ``by or primarily for
the individual.'' See, e.g., AIA at 2; ACLI; Molina Healthcare at 2-
3; National Association of Mutual Insurance Companies (``NAMIC'') at
3-4. Thus, they do not include the kinds of records managed by or
primarily for commercial enterprises, such as life insurance
companies that maintain such records for their own business
purposes.
---------------------------------------------------------------------------
Several commenters urged the FTC to cover paper records, as well as
electronic records.\62\ Although the Commission agrees that breaches of
data in paper form can be as harmful as breaches of such data in
electronic form, the plain language of the Recovery Act compels the
Commission to issue a rule
[[Page 42968]]
covering only electronic data.\63\ The Commission will examine this
issue further when providing input on the HHS report to Congress.
---------------------------------------------------------------------------
\62\ See supra note 19.
\63\ See Pinero v. Jackson Hewitt Tax Service, Inc., 594 F.
Supp. 2d 710, 716-17 (E.D. La. 2009) (dismissing plaintiff's claim
alleging breach of paper records under Louisiana data breach
notification law because that law covers only a breach of
``computerized'' data).
---------------------------------------------------------------------------
(e) PHR identifiable health information
Proposed paragraph (e) defined ``PHR identifiable health
information'' as ```individually identifiable health information,' as
defined in section 1171(6) of the Social Security Act (42 U.S.C.
1320d(6)),\64\ and with respect to an individual, information (1) that
is provided by or on behalf of the individual; and (2) that identifies
the individual or with respect to which there is a reasonable basis to
believe that the information can be used to identify the individual.''
The Commission adopts this definition without change.
---------------------------------------------------------------------------
\64\ This provision defines ``individually identifiable health
information'' as information that ``(1) is created or received by a
health care provider, health plan, employer, or health care
clearinghouse; and (2) relates to the past, present, or future
physical or mental health or condition of an individual, the
provision of health care to an individual, or the past, present, or
future payment for the provision of health care to an individual.''
---------------------------------------------------------------------------
In its NPRM, the Commission noted three points with respect to this
definition. First, it stated that the definition of ``PHR identifiable
health information'' includes the fact of having an account with a
vendor of personal health records or related entity, where the products
or services offered by such vendor or related entity relate to
particular health conditions.\65\ The Commission retains this
interpretation.
---------------------------------------------------------------------------
\65\ For example, the theft of an unsecured customer list of a
vendor of personal health records or related entity directed to AIDS
patients or people with mental illness would require breach
notification, even if no specific health information is contained in
that list.
---------------------------------------------------------------------------
Second, the Commission noted that the proposed rule would cover a
security breach of a database containing names and credit card
information, even if no other information was included. Several
commenters pointed out that this approach was not supported by the
statutory language of the Recovery Act, which defines ``PHR
identifiable health information'' to include information that relates
to payment only ``for the provision of health care to an individual.''
These commenters noted that providing PHRs to consumers does not
constitute the ``provision of health care to an individual.''\66\ The
Commission is persuaded that name and credit card information alone is
not PHR identifiable health information. However, as noted above, if
the disclosure of credit card information identifies an individual as a
customer of a vendor of personal health records or related entity
associated with a particular health condition, that information would
constitute ``PHR identifiable health information.''\67\
---------------------------------------------------------------------------
\66\ See, e.g., Intuit at 2; MasterCard at 1-3; SIIA at 10,
Dossia at 6-7.
\67\ The Commission also notes that, depending on the
circumstances, the failure to secure name and credit card
information could constitute a violation of section 5 of the FTC
Act. See (http://www.ftc.gov/privacy/privacyinitiatives/promises_
enf.html.)
---------------------------------------------------------------------------
Third, the Commission stated that, if there is no reasonable basis
to believe that information can be used to identify an individual, the
information is not ``PHR identifiable health information,'' and breach
notification need not be provided. The Commission also stated that, if
a breach involves information that has been ``de-identified'' under 45
CFR 164.514(b),\68\ the Commission will deem that information to fall
outside the scope of ``PHR identifiable health information'' and
therefore not covered by the rule. 45 CFR 164.514(b) states that data
is ``de-identified'' (1) if there has been a formal, documented
analysis by a qualified statistician that the risk of re-identifying
the individual associated with such data is ``very small,'' or (2) if
specific identifiers about the individual, the individual's relatives,
household members, and employers (including names, contact information,
birth date, and zip code) are removed, and the covered entity has no
actual knowledge that the remaining data could be used to identify the
individual. The Commission also requested examples of other instances
where, even though the standard for de-identification under 45 CFR
164.514(b) is not met, there is no reasonable basis to believe that
information is individually identifiable.
---------------------------------------------------------------------------
\68\ This standard, which appears in the HIPAA Privacy Rule,
creates an exemption to that Rule.
---------------------------------------------------------------------------
The Commission received numerous comments on this issue. Some
commenters supported the Commission's proposal that ``de-identified''
data not be deemed ``PHR identifiable health information.''\69\ Others
rejected this standard as not sufficiently protective of consumers
because, in some instances, even ``de-identified'' data can be tracked
back to an individual.\70\
---------------------------------------------------------------------------
\69\ See, e.g., Columbia University at 2; NACDS at 2.
\70\ CDT/Markle at 7-8; EPIC at 6-8; Patient Privacy Rights at
5-6.
---------------------------------------------------------------------------
One commenter requested that the FTC similarly state that ``limited
data sets'' under HIPAA are not ``PHR identifiable health
information.''\71\ Under HIPAA's Privacy Rule, HIPAA-covered entities
may use ``limited data sets'' for research, public health, or health
care operations without individual authorization, as long as contracts
govern the use of such data. ``Limited data sets'' do not include
names, addresses, or account numbers; they can, however, include an
individual's city, town, five-digit zip code, and date of birth.\72\
Another commenter urged the FTC to state that, if information has been
``redacted, truncated, obfuscated, or otherwise pseudonymized,'' there
is no reasonable basis to believe that the information can be used to
identify the individual.\73\ Indeed, several commenters noted that
mandating notification for breaches of data that does not include
individual identifiers would require re-identification of individuals
associated with such data, the process of which would expose their
information to new security risks.\74\
---------------------------------------------------------------------------
\71\ Minnesota Department of Health at 3.
\72\ 45 CFR 164.514(e). De-identified data sets cannot contain
even this information, unless a qualified statistician determines
that such information, when combined with other data, would present
a ``very small'' risk of re-identification.
\73\ SIIA at 9-10.
\74\ See, e.g., iGuard at 2; Quintiles at 2-3.
---------------------------------------------------------------------------
With respect to ``de-identified'' data and ``limited data sets,''
commenters provided empirical evidence on the likelihood that such data
could be combined with other data to identify individuals. For example,
several commenters cited to the research of Dr. LaTanya Sweeney of
Carnegie Mellon University, which showed that .04% of the population
could be re-identified by combining a ``de-identified'' data set with
other public data.\75\ In addition, Dr. Bradley Malin, Director of the
Health Information Privacy Laboratory of Vanderbilt University,
estimated that, using a ``limited data set,'' 68.4% of the population
was re-identifiable.\76\ Thus, it appears that the risk of re-
identification of a ``limited data set'' is exponentially greater than
the risk of re-identification of ``de-identified'' data.
---------------------------------------------------------------------------
\75\ CDT/Markle at 7; Columbia University at n. 6; World Privacy
Forum at 8.
\76\ Health Information Privacy Laboratory at Vanderbilt
University at 1.
---------------------------------------------------------------------------
Based on the comments received, the Commission affirms that ``de-
identified'' data will not be deemed to be ``PHR identifiable health
information.'' Given the small risk that such data will be re-
identified by unauthorized third parties, the Commission believes that
the data would be more vulnerable if entities were required to re-
identify these consumers solely to provide breach notification. Thus,
de-identified data under HHS rules will not constitute ``PHR
identifiable health information,''
[[Page 42969]]
and therefore, if such data is breached, no notification needs to be
provided. On the other hand, the Commission declines to adopt a blanket
statement that ``limited data sets'' are not ``PHR identifiable health
information'' because the risk of re-identification is too high. The
Commission similarly declines to state that ``redacted, truncated,
obfuscated, or otherwise pseudonymized data'' does not constitute ``PHR
identifiable health information'' because the risk of re-identification
will depend on the context.
Even if a particular data set is not ``de-identified,'' however,
entities still may be able to show, in specific instances, that there
is no reasonable basis to identify individuals whose data has been
breached, and thus, no need to send breach notices. For example,
consider a Web site that helps consumers manage their medications. The
Web site collects only email addresses, city, and medication
information from consumers, but it keeps email addresses secured in
accordance with HHS standards\77\ and on a separate server. It
experiences a breach of the server containing the city and medication
information (but no email addresses). A hacker obtains medication
information associated with ten anonymous individuals, who live in New
York City. In this situation, the Web site could show that, even though
a city is revealed, thus preventing the data from being categorized as
``de-identified,'' there is no reasonable basis for identifying the
individuals, and no breach notification needs to be provided.
---------------------------------------------------------------------------
\77\ As noted below, the Recovery Act requires notification only
if ``unsecured'' data has been breached, with the term ``unsecured''
to be defined by HHS. HHS issued guidance on the term ``unsecured''
on April 17, 2009. See 74 FR 19,006. The above example assumes the
email addresses are secured in accordance with such guidance.
---------------------------------------------------------------------------
(f) PHR related entity
Proposed paragraph (f) defined the term ``PHR related entity'' as
an entity that (1) offers products or services through the Web site of
a vendor of personal health records; (2) offers products or services
through the Web sites of HIPAA-covered entities that offer individuals
PHRs; or (3) ``accesses information in a personal health record or
sends information to a personal health record.''\78\ The definition did
not include HIPAA-covered entities or other entities acting as business
associates of HIPAA-covered entities. The Commission adopts this
definition without modification.
---------------------------------------------------------------------------
\78\ An entity that ``accesses information in a personal health
record or sends information to a personal health record'' includes
online applications through which individuals connect their blood
pressure cuffs, blood glucose monitors, or other devices so that
they can track the results through their PHRs. It also includes
online medication or weight tracking programs that pull information
from PHRs.
---------------------------------------------------------------------------
Several commenters raised questions about the first two categories.
In particular, these commenters raised the question of whether the
phrase ``offers products or services through'' a PHR Web site includes
advertisers.\79\ In its NPRM, the Commission had stated that PHR
related entities would include ``a web-based application that helps
consumers manage medications; a Web site offering an online
personalized health checklist; and a brick-and-mortar company
advertising dietary supplements online.'' The Commission affirms that
such entities are PHR related entities, but notes that they are only
subject to the rule's breach notification requirements if they
experience a breach of ``unsecured PHR identifiable health
information'' in a ``personal health record.''\80\ Thus, if they do not
collect unsecured PHR identifiable health information at the Web site
offering PHRs, they will not be subject to the rule's breach
notification requirements.\81\
---------------------------------------------------------------------------
\79\ See, e.g., SIIA at 10; World Privacy Forum at 5.
\80\ See Recovery Act, 13407(f)(1).
\81\ A consumer who clicks on an advertisement on the PHR Web
site may be taken to the advertiser's own site, where the advertiser
may collect the consumer's data. To avoid consumer confusion, and
potentially deception, the advertiser should provide clear and
conspicuous notice that the consumer is leaving the PHR Web site and
that the advertiser's privacy policy will now govern the collection
of the consumer's data.
---------------------------------------------------------------------------
One commenter stated that search engines appearing on PHR Web sites
should be considered PHR related entities. This commenter noted that
including such search engines within the rule's scope is important
because consumers may search for particular health conditions, and many
search engines track individually identifiable information, such as the
contents of previous searches, IP addresses, and cookies.\82\ In
response, the Commission notes that search engines are PHR related
entities if they appear on PHR Web sites, and are subject to the rule's
breach notification requirements if they collect unsecured PHR
identifiable information at those Web sites.\83\
---------------------------------------------------------------------------
\82\ World Privacy Forum at 4. For further discussion of privacy
issues raised in this context, see FTC Staff Report, ``Self-
Regulatory Principles for Online Behavioral Advertising,'' Feb.
2009, (http://www2.ftc.gov/os/2009/02/P085400behavadreport.pdf).
\83\ Several commenters asked the Commission to clarify that an
individual, such as a family member that accesses information in a
relative's PHR, is not a PHR related entity. See, e.g., CDT/Markle
at 6; UHG at 5. The Commission agrees that a family member who
accesses information in a consumer's PHR with the consumer's
authorization is not a PHR related entity.
---------------------------------------------------------------------------
(g) State
New paragraph (g) defines the term ``State'' as ``any of the
several States, the District of Columbia, Puerto Rico, the Virgin
Islands, Guam, American Samoa and the Northern Mariana Islands.'' This
paragraph is identical to section 13400(15) of the Recovery Act and was
added for reasons explained below, in the discussion of notice to the
media.
(h) Third party service provider
Paragraph (g) of the proposed rule defined the term ``third party
service provider'' as ``an entity that (1) provides services to a
vendor of personal health records in connection with the offering or
maintenance of a personal health record or to a PHR related entity in
connection with a product or service offered by that entity; and (2)
accesses, maintains, retains, modifies, records, stores, destroys, or
otherwise holds, uses, or discloses unsecured PHR identifiable health
information as a result of such services.'' The Commission retains the
definition of ``third party service provider'' without modification in
the final rule and re-designates this paragraph as paragraph (h). Third
party service providers include, for example, entities that provide
billing, debt collection, or data storage services to vendors of
personal health records or PHR related entities.
(i) Unsecured
Paragraph (h) of the proposed rule defined the term ``unsecured''
as ``not protected through the use of a technology or methodology
specified by the Secretary of Health and Human Services in the guidance
issued under section 13402(h)(2) of the American Recovery and
Reinvestment Act of 2009.'' It further provided that, if such guidance
is not issued by the date specified in such section, the term unsecured
``shall mean not secured by a technology standard that renders PHR
identifiable health information unusable, unreadable, or indecipherable
to unauthorized individuals and that is developed or endorsed by a
standards developing organization that is accredited by the American
National Standards Institute.'' The Commission has removed the
alternative definition from the final rule because HHS has already
issued the required guidance under the Recovery Act.\84\ The
[[Page 42970]]
Commission also has re-designated this paragraph as paragraph (i).
---------------------------------------------------------------------------
\84\ See supra note 77.
---------------------------------------------------------------------------
(j) Vendor of personal health records
Paragraph (i) of the proposed rule defined the term ``vendor of
personal health records'' to mean ``an entity, other than a HIPAA-
covered entity or an entity to the extent that it engages in activities
as a business associate of a HIPAA-covered entity, that offers or
maintains a personal health record.'' The Commission retains this
definition as proposed and re-designates it as paragraph (j).
Proposed section 318.3: Breach notification requirement
Paragraph 318.3(a) of the proposed rule required vendors of
personal health records and PHR related entities, upon discovery of a
breach of security, to notify U.S. citizens and residents whose
information was acquired in the breach and to notify the FTC. The
Commission retains this paragraph in the final rule without
modification.
Paragraph 318.3(b) of the proposed rule required third party
service providers of vendors of personal health records and PHR related
entities to provide notification to such vendors and entities following
the discovery of a breach. The purpose of this requirement is to ensure
that the vendor or entity receiving the breach notification is aware of
the breach, so that it can in turn provide its customers with a breach
notice. To further this purpose, proposed paragraph 318.3(b) required
that the third party service provider's notification include ``the
identification of each individual'' whose information ``has been, or is
reasonably believed to have been acquired during such breach.'' The
proposed paragraph also required third party service providers to
provide notice to a senior official of the vendor or PHR related entity
and to obtain acknowledgment from such official that he or she has
received the notice. The Commission received several comments on
paragraph 318.3(b), in response to which the Commission is making some
changes to the final rule provision.
First, one commenter noted that a third party service provider may
be unaware that it is dealing with a vendor of personal health records.
For example, a cloud computing service provider\85\ may offer computing
power and storage without knowing whether customers use them to offer
PHRs.\86\ The Commission agrees with this comment and, accordingly,
adds the following sentence to paragraph 318.3(b): ``For purposes of
ensuring implementation of this requirement, vendors of personal health
records and PHR related entities shall notify third party service
providers of their status as vendors of personal health records or PHR
related entities subject to this Part.''
---------------------------------------------------------------------------
\85\ Cloud computing is the provision of Internet-based computer
services. Cloud computing provides businesses and consumers with
access to software, data storage, and infrastructure services that
are hosted remotely.
\86\ Microsoft at 3.
---------------------------------------------------------------------------
Second, one commenter noted that some third party service providers
may have multiple vendors of personal health records as clients.\87\ If
the third party service provider experiences a breach, it should not be
required to identify every individual whose information was breached to
each of its clients, regardless of whether the individual is a customer
of the client. This could result in the third party service providers'
sharing customer lists with competing vendors of PHRs, and could
undermine the privacy of such customers. The Commission agrees. Thus,
instead of requiring the third party service provider to identify each
``individual'' whose information was breached, the Commission's final
rule requires the service provider to identify each ``customer of the
vendor of personal health records or PHR related entity'' whose
information was breached.\88\
---------------------------------------------------------------------------
\87\ SIIA at 9.
\88\ Some commenters raised the question of what would happen if
a third party service provider did not have enough information to
identify the individuals affected by the breach. See, e.g., iGuard
at 2; Quintiles at 2-3, SIIA at 8-9. In such case, the Commission
expects that the third party service provider would provide the
vendor or related entity with as much information as it has, after a
thorough search of its records. Because the vendor or related entity
has ultimate responsibility to provide individuals with notice, and
likely possesses more comprehensive information regarding such
individuals, the vendor or related entity must then take the data
provided by the third party service provider and identify those
individuals to whom notice must be provided.
---------------------------------------------------------------------------
Third, several commenters supported the idea of having a specified
official to whom the third party service provider would provide a
breach notice.\89\ However, some commenters stated that businesses
should themselves agree upon these contact persons through their
contractual arrangements.\90\ The Commission agrees and amends the
proposed rule to allow third party service providers to provide notice
to ``an official designated in a written contract by the vendor of
personal health records or the PHR related entity to receive such
notices, or, if such a designation is not made, to a senior official. .
.'' Because the purpose of this provision is to provide an efficient
process for notifying consumers, the contact points designated by
contract should be appropriate decisionmakers with sufficient
responsibility and authority to oversee the process of notifying
consumers. In designating an official, the parties also must consider
that particular officials may move within the organization or leave
altogether. Thus, it is important to establish a reliable mechanism for
updating the designation when any such change occurs.
---------------------------------------------------------------------------
\89\ See, e.g., AHIMA at 3, Statewide Parent Advocacy Network at
3.
\90\ See, e.g., NACDS at 2; SIIA at 9.
---------------------------------------------------------------------------
Fourth, the Commission received comments on the proposed rule's
requirement that the third party service provider obtain an
acknowledgment of receipt of notice. Some commenters suggested that the
third party service provider should merely retain evidence that notice
was sent and that such evidence could be an email successfully sent or
a certified mail receipt. These commenters expressed concern that
requiring acknowledgment could delay sending of prompt notification to
consumers.\91\ The Commission has not adopted this change. Even if the
third party service provider retains evidence that someone signed for a
package or opened an email, the communication may not have reached the
intended recipient, particularly in a large, busy office. For example,
in the case of a senior official, an assistant may open his or her
email or a receptionist may sign for a package, but the senior official
may never receive the communication. Moreover, the Commission does not
believe that the requirement to acknowledge receipt will delay notice;
the acknowledgment merely adds a check to ensure that the right person
will learn of the breach, and could be provided in the form of a simple
return email.
---------------------------------------------------------------------------
\91\ AHIP at 5-6; Molina Healthcare at 4; UHG at 5.
---------------------------------------------------------------------------
Finally, paragraph 318.3(c) of the proposed rule provided that a
breach ``shall be treated as discovered as of the first day on which
such breach is known to a vendor of personal health records, PHR
related entity, or third party service provider, respectively
(including any person, other than the individual committing the breach,
that is an employee, officer, or other agent of such vendor of personal
health records, PHR related entity, or third party service provider,
respectively) or should reasonably have been known to such vendor of
personal health records, PHR related entity, or third party service
provider (or person) to have occurred.''
[[Page 42971]]
Some commenters expressed confusion about this standard and asked
for clarification about when an employee's knowledge should be imputed
to an employer.\92\ The Commission interprets the Recovery Act as
requiring that an employee's knowledge be imputed to the employer. To
clarify this point, the Commission modifies this provision to state
that a breach ``shall be treated as discovered as of the first day on
which such breach is known or reasonably should have been known to the
vendor of personal health records, PHR related entity, or third party
service provider, respectively. Such vendor, entity, or third party
service provider shall be deemed to have knowledge of a breach if such
breach is known, or reasonably should have been known, to any person,
other than the person committing the breach, who is an employee,
officer, or other agent of such vendor of personal health records, PHR
related entity, or third party service provider.'' The Commission notes
that a third party service provider may, in some cases, be an agent of
a vendor of personal health records or PHR related entity; thus, when
such a third party service provider discovers a breach, that knowledge
would be imputed to the vendor or entity.\93\
---------------------------------------------------------------------------
\92\ See, e.g., Intuit at 3; Minnesota Department of Health at
4.
\93\ In addition, as noted in the NPRM, the Commission expects
entities that collect and store unsecured PHR identifiable health
information to maintain reasonable security measures, including
breach detection measures, which should assist them in discovering
breaches in a timely manner. If an entity fails to maintain such
measures, and thus fails to discover a breach, the resulting failure
to provide the appropriate breach notification could constitute a
violation of the proposed rule because the entity ``reasonably''
should have known about the breach. The Commission recognizes,
however, that certain breaches may be very difficult to detect, and
that an entity with strong breach detection measures may
nevertheless fail to discover a breach. In such circumstances, the
failure to discover the breach would not constitute a violation of
the proposed rule.
---------------------------------------------------------------------------
Section 318.4 Timeliness of Notification
Paragraph 318.4(a) of the proposed rule required that breach
notifications to individuals and the media be ``sent without
unreasonable delay and in no case later than 60 calendar days after the
discovery of a breach of security.'' The Commission has modified this
provision to clarify that the timeliness requirements apply to all
notifications required to be provided under the rule, other than
notification to the FTC.\94\ Thus, the provision now states that all
notifications required ``under Sec. Sec. 318.3(a)(1), 318.3(b), and
318.5(b)'' shall be sent without unreasonable delay.
---------------------------------------------------------------------------
\94\ As noted in the NPRM, the standard for timely notification
is ``without unreasonable delay,'' with the 60 day time period
serving as an outer limit. Thus, in some cases, it may be an
``unreasonable delay'' to wait until the 60\th\ day to provide
notification. For example, if a vendor of personal health records or
PHR related entity learns of a breach, gathers all necessary
information, and has systems in place to provide notification within
30 days, it would be unreasonable to wait until the 60\th\ day to
send the notice. Similarly, there may be circumstances where a
vendor of personal health records discovers that its third party
service provider has suffered a breach before the service provider
notifies the vendor that the breach has occurred. Indeed, as noted
in the text, if the third party service provider is an agent of a
vendor of personal health records or PHR related entity, that
service provider's knowledge of the breach will be imputed to the
vendor of personal health records or PHR related entity. In such
circumstances, the vendor should begin taking steps to address the
breach immediately, and should not wait until receiving notice from
the service provider.
---------------------------------------------------------------------------
Paragraphs 318.3(c) and 318.4(a) must be read together, with
paragraph 318.3(c) establishing the time of ``discovery'' of the breach
as the starting point for calculating the 60 day time period set forth
in paragraph 318.4(a). The Commission received several comments with
respect to the timing of notification. For example, one commenter asked
whether an entity must establish that a breach involves ``PHR
identifiable health information'' before the 60 day time period
starts.\95\ Another commenter requested guidance on the timing
requirements if an entity determines that a breach affected a certain
number of individuals and then later, perhaps close to the date it
planned to send notices, realizes that the breach has affected more
individuals.\96\
---------------------------------------------------------------------------
\95\ Columbia University at 2-3.
\96\ UHG at 6.
---------------------------------------------------------------------------
In response to these comments, the Commission notes two points.
First, an entity need not establish all the pre-requisites for
triggering breach notification before the 60 day time period starts.
Thus, for example, once an entity learns of possible unauthorized
access to data, it cannot wait to conduct further investigation to
determine whether unauthorized acquisition has occurred, whether PHR
identifiable health information has been breached, or whether the
information breached was unsecured. The purpose for the 60 day period
is to give entities time to conduct such an investigation--the time
period does not start when the investigation is complete.
Second, the standard for determining timeliness is reasonableness.
The breach has been ``discovered'' at the point when an entity
reasonably should have known about it. The ``reasonableness'' standard
applies equally with respect to the number of individuals affected. For
example, if a breach affects 1,000 individuals, and the entity
reasonably should have known that the breach affected all of these
individuals on day 1, then the 60 day time period expires on calendar
day 60. If, however, the entity undertook reasonable efforts to
identify those affected by the breach and, despite such efforts,
identified only 400 individuals on day 1 and the remaining 600
individuals on day 50, it is reasonable to take some additional time to
send notices to the second round of 600 individuals. Because the entity
already has information about the breach, however, it is probably not
reasonable for the entity to wait an additional 60 days from the date
it learned of these additional affected individuals to provide the
notification.\97\
---------------------------------------------------------------------------
\97\ As described below, the entity must provide notice to the
FTC within ten business days of learning that the breach affected
500 people.
---------------------------------------------------------------------------
Paragraph 318.4(b) of the proposed rule stated that vendors of
personal health records, PHR related entities, and third party service
providers have the burden of proving that they provided the appropriate
breach notifications. The Commission adopts the proposed paragraph
without change.
Paragraph 318.4(c) of the proposed rule provided that ``[i]f a law
enforcement official determines that a notification, notice, or posting
required under this Part would impede a criminal investigation or cause
damage to national security, such notification, notice, or posting
shall be delayed'' in the same manner as ``45 CFR 164.528(a)(2). . .''
The Commission adopts this proposed paragraph without modification.
Section 318.5 Methods of Notice
Section 318.5 of the proposed rule addressed the methods of notice
to individuals, the Commission, and the media in the event of a breach
of security of unsecured PHR identifiable health information.
Individual Notice
Proposed paragraph (a)(1) stated that an individual must be given
notice by first-class mail or, if the individual provides express
affirmative consent, by email. The paragraph also provided for
notification to next of kin if the individual is deceased. Several
commenters expressed concerns about the proposed paragraph.
First, although a few commenters supported requiring express
affirmative consent for email notification,\98\ the majority of
commenters that addressed
[[Page 42972]]
the issue opposed it.\99\ Several of these commenters noted, as the
Commission did in its NPRM, that email notice is particularly well-
suited to the online relationship between consumers and vendors of
personal health records and PHR related entities.\100\ They also noted
that entities may not wish to collect--and consumers may not wish to
provide--mailing addresses.\101\ Indeed, several business commenters
noted that they do not collect consumers' mail addresses, and that, if
the Commission's proposed requirement became final, they would need to
request additional personal information from consumers that these
consumers might not choose to share. These businesses also expressed
uncertainty on how to proceed if existing consumers did not respond to
such a request.\102\
---------------------------------------------------------------------------
\98\ See, e.g., IDExperts at 3; AHIMA at 4.
\99\ See, e.g., ABC at 4; ACLI at 4-5; Association of Clinical
Research Organizations (``ACRO'') at 5; Dossia at 9; HealthITNow.org
at 2; iGuard at 2-3; Microsoft at 2; Quintiles at 3; SIIA at 11.
\100\ See, e.g., ABC at 4; ACRO at 5; Quintiles at 3; SIIA at
11.
\101\ See, e.g., HealthITNow.org at 2; Microsoft at 2.
\102\ See, e.g., iGuard at 2-3; Microsoft at 3.
---------------------------------------------------------------------------
The Commission is persuaded that, because the relationships
contemplated among vendors of personal health records, PHR related
entities, and consumers take place entirely online, email notice is an
appropriate default option. The Commission agrees with the commenters
that stated that requiring express affirmative consent for email would
result in entities' collecting additional personal information they
otherwise would not collect, and that consumers may not want to
provide.
However, the rule must still follow the Recovery Act, which
requires that entities can only send notice by email ``if specified as
a preference by the individual.'' The Commission interprets this phrase
as requiring entities to provide consumers with a meaningful choice to
receive email notice. For a choice to be meaningful, the entity must
provide clear and conspicuous notice to consumers that they have such a
choice. Thus, entities may not merely state in their terms and
conditions that they will send relevant notices by email unless an
individual objects.
Entities can, however, provide meaningful choice by sending their
customers an email or posting an alert that appears when they access
their account, which (1) informs them that they will receive breach
notices by email, and (2) provides them with a reasonable opportunity
to express a preference to receive such notices by first-class mail.
The entity could provide such a ``reasonable opportunity'' by including
a toll-free number, a return email address, or a link in the notice or
alert allowing consumers to opt out of email notification and select
first-class mail instead. The Commission would not consider requiring
the consumer to write a letter as offering a reasonable opportunity to
express such a preference. Entities choosing this approach also must
inform consumers that, if they do not affirmatively make a choice, they
will receive breach notices by email.
Accordingly, the Commission has adopted the following language into
final paragraph 318.5(a)(1): ``Written notice, by first-class mail to
the individual at the last known address of the individual, or by
email, if the individual is given a clear, conspicuous, and reasonable
opportunity to receive notification by first-class mail and the
individual does not exercise that choice.''
Second, the Commission requested information on how to address the
problem posed by some email notifications being screened by consumers'
spam filters. One commenter suggested that the Commission require
entities to verify receipt of breach notifications.\103\ The Commission
declines to adopt this suggestion because entities may be unable to
verify receipt, particularly if verification requires some action by
the consumer (such as a return email confirming receipt). This could
leave entities no choice but to provide alternative notice, which could
in turn result in consumers' receiving multiple notices for the same
breach. Another commenter suggested that vendors of personal health
records and PHR related entities should (1) notify individuals that
breach notices may be blocked by spam filters and (2) provide them with
guidance on how to set spam filter preferences to ensure they receive
these notices.\104\ The Commission agrees that entities who send breach
notices by email should provide guidance to consumers regarding how
properly to set up spam filters so that they will receive such notices.
---------------------------------------------------------------------------
\103\ EPIC at 10.
\104\ Identity Theft 911 at 3.
---------------------------------------------------------------------------
Third, some commenters expressed concern about the requirement that
breach notices be sent to an individual's next of kin if the individual
is deceased.\105\ One such commenter pointed out that consumers may not
want their next of kin to know about their PHRs.\106\ The Commission
agrees, and accordingly modifies paragraph 318.5(a)(1) to read as
follows: ``If the individual is deceased, the vendor of personal health
records or PHR related entity that discovered the breach must provide
such notice to the next of kin of the individual if the individual had
provided contact information for his or her next of kin, along with
authorization to contact them.''
---------------------------------------------------------------------------
\105\ See, e.g., ACLI at 5; Minnesota Department of Health at 5.
\106\ Minnesota Department of Health at 5.
---------------------------------------------------------------------------
Finally, the Commission received comments suggesting other forms of
direct notice to individuals. One commenter suggested that breach
notices be available in formats such as large font, Braille and
audiotape.\107\ Another commenter advocated the use of text messaging
and social networking to notify individuals.\108\ Some commenters
suggested that entities provide consumers with non-avoidable notices
directly into their accounts.\109\ Section 13402(e)(1) of the Recovery
Act requires that notification be provided via ``written notification
by first-class mail'' or ``electronic mail.'' Because the rule must
follow this mandate, none of the suggested alternative methods can
replace mail or email. The Commission notes, however, that the rule
does not preclude any of these forms of notice, and supports their use
in appropriate circumstances, in addition to the forms of notice
prescribed in the rule.
---------------------------------------------------------------------------
\107\ American Association of People with Disabilities at 2.
\108\ EPIC at 9.
\109\ See, e.g., Healthcare Information and Management Systems
Society at 2; World Privacy Forum at 6.
---------------------------------------------------------------------------
The Commission has changed the remainder of proposed paragraph (a).
It has combined proposed paragraphs (a)(3) and (a)(4), addressing
substitute notice to individuals, into a new paragraph (a)(2), to
immediately follow the rule provision addressing direct notice to
individuals. Proposed paragraph (a)(3) stated that if, after making
reasonable efforts to contact an individual through his or her
preferred method of communication, the vendor of personal health
records or PHR related entity learns that such method is insufficient
or out-of-date, the vendor or related entity shall attempt to provide
the individual with a substitute form of actual notice, which may
include written notice through the individual's less-preferred method,
a telephone call, or other appropriate means. Proposed paragraph (a)(4)
stated that if ten or more individuals cannot be reached, the vendor of
personal health records or PHR related entity must provide substitute
notice through its Web site home page or through the media.
[[Page 42973]]
These proposed rule paragraphs prescribed a two step process for
substitute notice: First, they required entities to provide a
substitute form of actual notice (e.g., the individual's less preferred
method of actual notice, telephone, or other means) for all individuals
for whom there was insufficient contact information. Second, if, after
making this attempt to provide substitute actual notice, ``ten or more
individuals [could] not be reached,'' the entity was required to
provide notice through the home page of its Web site or through the
media.
The final paragraph (a)(2) combines these paragraphs into one
paragraph that prescribes substitute notice through media or web
posting, if ``after making reasonable efforts to contact all
individuals. . .the vendor of personal health records or PHR related
entity finds that contact information for ten or more individuals is
insufficient or out-of-date.'' The Commission has made this change for
several reasons.
First, the proposed rule paragraphs had required that all entities
attempt to provide substitute notice through the individual's less-
preferred method of communication, a telephone call, or other
appropriate means before providing substitute notice through media or
web posting. Some commenters expressed concern about references to
``preferred'' and ``less preferred'' methods, suggesting that such
language would require entities to track lists of consumers'
preferences with respect to notice.\110\ Other commenters stated that
entities may collect only one form of contact information, usually
email.\111\ The Commission agrees that the rule should not refer to
``preferred'' or ``less-preferred'' or other methods of direct notice,
particularly given that vendors of personal health records and PHR
related entities may only collect email addresses and no other contact
information from consumers. Because the Commission does not want to
encourage entities to collect more contact information than is
necessary, the rule no longer requires entities to contact individuals
through another form of direct notice in every case.
---------------------------------------------------------------------------
\110\ See, e.g., ACLI at 5; NAMIC at 5.
\111\ See, e.g., iGuard at 2-3; Quintiles at 3.
---------------------------------------------------------------------------
Second, the proposed rule had required substitute notice ``if ten
or more individuals cannot be reached.'' One commenter expressed
concerns that the ``cannot be reached'' language requires confirmation
of receipt.\112\ The new paragraph makes clear that no such
confirmation is required; rather, the rule requires ``reasonable
efforts to contact all individuals.'' For example, in the case of
incomplete contact information, reasonable efforts would include
searching internal records and, if needed, undertaking additional
reasonable efforts to obtain complete and accurate contact information
from other sources. In addition, the standard, while not requiring
confirmation, requires an entity to take reasonable steps to contact
consumers by other practical, available means when it knows that the
initial contact method has been unsuccessful. If the entity knows that
an individual has not received such notice (e.g., an email is returned
as undeliverable), reasonable efforts would include (1) if the entity
has the individual's mailing address, sending written notice to that
address; or (2) if the entity has the individual's telephone number,
calling the individual to obtain updated contact information for
purposes of providing direct notice.\113\
---------------------------------------------------------------------------
\112\ UHG at 6-7.
\113\ Cf. Jones v. Flowers, 547 U.S. 220 (2006) (stating that
the government's obligation to provide direct notice of foreclosure
to taxpayer was not satisfied by sending a letter by certified mail,
having it returned as unclaimed, and then posting the notice in the
newspaper; another form of direct notice was required where possible
and practicable).
---------------------------------------------------------------------------
Turning to the requirements for substitute notice through home page
or media notice, the proposed rule allowed for (1) a conspicuous notice
on the home page of the entity's Web site for a period of 6 months; or
(2) notice in major print or broadcast media, including major media in
geographic areas where the individuals affected by the breach reside.
Such home page or media notice was required to include a toll-free
phone number where an individual could learn whether the individual's
information was included in the breach. The Commission received several
comments on this paragraph.
First, one commenter expressed concern about the rule's requiring a
toll-free number for individuals to determine whether their information
was breached. This commenter noted the difficulties associated with
authenticating callers over the telephone and recommended alternate
approaches to letting consumers know if their information was
breached.\114\ Because the Recovery Act mandates the provision of a
toll-free telephone number, the Commission declines to remove this
requirement from the final rule. The Commission does, however, share
the concerns expressed by commenters about how entities would
authenticate callers to the toll-free line for the purposes of
providing information specific to the caller. In particular, entities
should not ask consumers who call the toll-free line for Social
Security numbers or financial account numbers because requesting such
information may raise concerns about ``phishing,'' or may even increase
the risks of ``phishing.''\115\ Entities also may choose to provide
only general information to consumers who call the toll-free line and
inform those consumers that they will send more specific information to
the consumer's PHR or related account, or the email address they
provided to set up their account.\116\
---------------------------------------------------------------------------
\114\ Microsoft at 5.
\115\ For example, if such requests for information become
customary and accepted, consumers may not be sufficiently cautious
in responding to them.
\116\ The final rule clarifies that the toll-free number must
remain active for at least 90 days.
---------------------------------------------------------------------------
Second, with respect to posting on the home page,\117\ most
commenters that addressed the issue stated that the six month required
posting period in the proposed rule was too long. These commenters
generally suggested a shorter posting period, anywhere from 30 to 90
days.\118\ Several of these commenters stated that a six month posting
period could confuse or unduly alarm consumers every time they accessed
the entity's web page.\119\ Other commenters suggested that a
requirement for a six month posting placed a burden on businesses that
was not commensurate with the potential advantages to individuals.\120\
---------------------------------------------------------------------------
\117\ As stated in the NPRM, individuals who already have
accounts with vendors of personal health records may be directed to
a first or ``landing'' page that is different from the home page to
which non-account holders are directed. The Commission thus
construes ``home page'' to include both the home page for new
visitors and the landing page for existing account holders. In
general, the Commission anticipates that, because PHRs generally
involve an online relationship, web posting would be a particularly
well-suited method of substitute notice to individuals.
\118\ See, e.g., ACLI at 5; ACRO at 5; Dossia at 10; iGuard at
3; NACDS at 3; NAMIC at 6; Minnesota Department of Health at 5; Ohio
State University Medical Center at 2; Quintiles at 3-4; Sonnenschein
at 3.
\119\ See, e.g., NACDS at 3; Ohio State University Medical
Center at 2.
\120\ See, e.g., NAMIC at 6; Sonnenschein at 3.
---------------------------------------------------------------------------
After reviewing the comments, the Commission has decided to change
the time period for posting of the Web site notice in the final rule to
ninety days.\121\ The Commission believes that this time period is long
enough to provide an effective form of substitute notice, while
[[Page 42974]]
also avoiding unnecessary consumer confusion and alarm.\122\
---------------------------------------------------------------------------
\121\ This 90 day period for web posting begins after entities
have satisfied their notice obligation specified in paragraph
(a)(1).
\122\ As stated in the NPRM, if an entity intends to use a
hyperlink on the home page to convey the breach notice, the
hyperlink should be (1) prominent so that it is noticeable to
consumers, given the size, color and graphic treatment of the
hyperlink in relation to other parts of the page; and (2) worded to
convey the nature and importance of the information to which it
leads. For example, ``click here'' would not be an appropriate
hyperlink; a prominent ``click here for an important notice about a
security breach that may affect you'' would be.
One commenter recommended that the Commission incorporate this
guidance into the text of the final rule. AHIMA at 4. Given that new
technologies may provide new ways to satisfy a requirement of
``conspicuousness'' and render old ways potentially obsolete, the
Commission declines to incorporate its specific guidance regarding
conspicuousness into the final text of paragraph 318.5(a)(4).
---------------------------------------------------------------------------
Third, some commenters urged the Commission to interpret the
requirement to provide media notice ``in major print or broadcast
media'' to allow such notice through new technology, such as notice in
major Internet media and news outlets.\123\ One commenter argued that
the Recovery Act requirement to provide notice in ``print or
broadcast'' media should not be limited to print, radio, and television
outlets because the term ``broadcast'' means making information known
over a wide area.\124\ Although the Commission recognizes the
importance of the Internet as a medium, the Commission believes that
the term ``broadcast media'' in the Recovery Act is limited to
traditional radio and television news outlets. Indeed, if the
Commission were to construe the term more broadly to include making
information known over a wide area, the Recovery Act's reference to
``print'' media would be superfluous. Accordingly the Commission does
not read the phrase ``print or broadcast media'' to include Internet
media and news outlets.\125\ However, the Commission encourages
entities to provide notice through major Internet media, in addition to
providing notice through print or broadcast media, if such additional
notice would increase the likelihood of reaching affected consumers.
---------------------------------------------------------------------------
\123\ CDT/Markle at 12-13; EPIC at 9-10.
\124\ CDT/Markle at 13.
\125\ As stated in the NPRM, the appropriate scope of substitute
media notice will depend on several factors, including the number of
individuals for whom no contact information can be obtained, the
location of those individuals, if known, and the reach of the
particular media used. For example, if a vendor of personal health
records experiences a breach in which a hacker obtains the health
records of millions of individuals nationwide, and the vendor has no
contact information for these individuals, the notice should run
multiple times in national print publications or on national network
and cable television. In contrast, if an online weight management
application loses a customer list and can reach all but 20
individuals in a particular city, it could run a more limited number
of advertisements in appropriate local media. Further, a notice can
only be ``reasonably calculated to reach the individuals affected''
under the rule if it is clear and conspicuous. Thus, the notices
should be stated in plain language, be prominent, and run multiple
times.
---------------------------------------------------------------------------
Fourth, some commenters asked how they could satisfy the
requirement to provide media notice ``in geographic areas where the
individuals affected by the breach likely reside'' if they do not
collect address information.\126\ The Commission believes that, if
entities do know where individuals affected by the breach reside, they
should target substitute media notice to those areas. If they do not
know where individuals reside, they should notify media on a nationwide
basis.\127\ The Commission does not interpret the reference to where
individuals ``likely reside'' as a requirement to collect address
information from customers.\128\
---------------------------------------------------------------------------
\126\ AHIP at 5; Molina Healthcare at 3.
\127\ The Commission notes that entities are never required to
provide substitute notice to individuals through the media under
this provision; they also have the option of providing notice
through a home page posting.
\128\ The proposed rule had required that media notice be
``reasonably calculated to reach the individuals affected by the
breach.'' The Commission has moved this language to clarify that any
form of substitute notice, including media notice and web page
posting, must be ``reasonably calculated to reach the individuals
affected by the breach.''
---------------------------------------------------------------------------
Finally, proposed paragraph (a)(2) allowed a vendor of personal
health records or PHR related entity to provide notice by telephone or
other appropriate means, in addition to notice by first-class mail or
email, if there is possible imminent misuse of unsecured PHR
identifiable health information. The Commission adopts this language
without change and has redesignated it as paragraph (a)(3) in the final
rule.
Notice to Media if the Breach Affects 500 or More Individuals
Proposed paragraph 318.5(b) required media notice ``to prominent
media outlets serving a State or jurisdiction'' if there has been a
breach of security of ``unsecured PHR identifiable health information
of 500 or more residents of such State or jurisdiction.'' This media
notice differs from the substitute media notice described in paragraph
318.5(a)(4) in that it is directed ``to'' the media and is intended to
supplement, but not substitute for, individual notice. The Commission
has not made any substantive changes to this paragraph,\129\ but
clarifies two issues in response to comments received.
---------------------------------------------------------------------------
\129\ However, the Commission has deleted the second sentence of
the rule setting forth the content requirements for such notice as
redundant.
---------------------------------------------------------------------------
First, some commenters expressed confusion about the meaning of the
phrase ``State or jurisdiction'' in this paragraph.\130\ To clarify the
phrase, and to track section 13400(15) of the Recovery Act, the
Commission has added a definition of the word ``State'' to include
``any of the several States, the District of Columbia, Puerto Rico, the
Virgin Islands, Guam, American Samoa, and the Northern Marinara
Islands.'' In addition, the Commission interprets the term
``jurisdiction'' to mean a geographic area smaller than a state, such
as a county, city, or town. This interpretation ensures that, if a
breach affects such a specific area, the media notice will be targeted
to that area. Accordingly, notice to media is required if a breach
affects more than 500 individuals in a particular state, the District
of Columbia, a territory or possession of the United States, or a
smaller geographic subdivision.\131\ If no single state has more than
500 people affected, notice to media is not required.
---------------------------------------------------------------------------
\130\ See, e.g., Molina Healthcare at 4; NAMIC at 6.
\131\ If an entity experiences a breach that affects more than
500 people in a city such as New York City, as well as more than 500
people elsewhere in the state, the entity has an obligation to
provide notice to prominent media outlets both in New York City and
New York state.
---------------------------------------------------------------------------
Second, as with substitute media notice, some commenters urged the
Commission to interpret this paragraph to allow notification to
prominent Internet-based media outlets.\132\ Unlike the requirement to
provide substitute notice in ``print or broadcast'' media described
above, the Recovery Act does not limit this notice to particular types
of media. Thus, an entity can satisfy the requirement to notify
``prominent media outlets'' under this paragraph by disseminating press
releases to a number of media outlets, including Internet media in
appropriate circumstances, where most of the residents of the relevant
state or jurisdiction get their news. This will be a fact-specific
inquiry that will depend upon what media outlets are ``prominent'' in
the relevant jurisdiction.\133\
---------------------------------------------------------------------------
\132\ CDT/Markle at 12-13; EPIC at 9-10.
\133\ For example, an entity could satisfy this requirement by
sending a press release to the relevant division or department
(e.g., health, technology, or business) of a number of prominent
print publications, cable news shows, radio stations, and Internet
news media outlets. The number of outlets and combination of media
will vary, depending on the circumstances of the breach.
---------------------------------------------------------------------------
Notice to the Commission
Proposed paragraph 318.5(c) required vendors of personal health
records and PHR related entities to notify the Commission as soon as
possible and in
[[Page 42975]]
no case later than five business days if the breach involves the
unsecured PHR identifiable health information of 500 or more
individuals. If the breach involves the unsecured PHR identifiable
health information of fewer than 500 individuals, the proposed
paragraph allowed vendors of personal health records and PHR related
entities, in lieu of immediate notice, to maintain a breach log and
submit this log annually to the Commission. The proposed rule stated
that the ``annual log'' would be due one year from the date of the
entity's first breach. As described below, the Commission received a
number of comments on this proposed paragraph and has made some
modifications to the final rule in response.
First, the Commission received many comments objecting to the
proposed paragraph's requirement that entities provide notice to the
Commission no later than five business days after discovery of a breach
affecting 500 or more individuals. These commenters argued that five
business days did not allow sufficient time to conduct an investigation
and might lead entities to report information to the Commission that
later turns out to be incorrect.\134\ The Commission agrees that a five
day notice requirement could create burdens for companies without
corresponding benefits, particularly if the shorter notice period
results in false reporting of breaches. Thus, the Commission has
decided to expand the time period for notice to the FTC from five
business days to ten business days. The Commission believes that this
time period still satisfies the Recovery Act's mandate that notice to
the Commission be ``immediate,'' while allowing entities additional
time to investigate the circumstances surrounding the breach before
notifying the FTC.\135\
---------------------------------------------------------------------------
\134\ See, e.g., AHIMA at 4-5; AHIP at 6; Dossia at 9; Microsoft
at 4-5; Molina at 5; NACDS at 3; Sonnenschein at 2-3; UHG at 7-8;
WebMD at 5.
\135\ The Commission recognizes that entities may need more than
ten business days to fully investigate the breach, and that the
initial information provided to it in that time period may not be
complete.
---------------------------------------------------------------------------
Second, several commenters recommended that the annual log to the
Commission for breaches involving fewer than 500 individuals be
submitted each calendar year, instead of one year from the date of the
entity's first breach.\136\ As a few commenters stated, calendar year
reporting would allow the Commission to aggregate the number of
breaches reported by all entities in a given year.\137\ It also would
simplify the process of reporting breaches by allowing organizations to
prepare their logs systematically, with a fixed deadline.\138\ The
Commission agrees with these comments and has modified the final rule
to allow for calendar year reporting as follows: ``If the breach
involves the unsecured PHR identifiable health information of fewer
than 500 individuals, the vendor of personal health records or PHR
related entity may maintain a log of any such breach and submit such a
log annually to the Federal Trade Commission within 60 calendar days
following the end of the calendar year, documenting breaches from the
preceding calendar year.'' \139\
---------------------------------------------------------------------------
\136\ See, e.g., ACRO at 5; AHIP at 6-7; iGuard at 3-4;
Minnesota Department of Health at 5; Molina Healthcare at 5; NAMIC
at 7; Quintiles at 4; UHG at 8-9.
\137\ See, e.g., ACRO at 5; iGuard at 3-4; Quintiles at 4.
\138\ See, e.g., Minnesota Department of Health at 5; NAMIC at
7; UHG at 8-9.
\139\ No annual log needs to be provided for years in which no
breaches occur. In addition, for calendar year 2009, the regulated
entity is only required to submit information to the FTC for
breaches occurring after the effective date of this regulation.
---------------------------------------------------------------------------
Third, a few commenters made suggestions on how the Commission
should collect and organize the notices it receives. One commenter
recommended that the Commission create a comprehensive repository of
information concerning data breaches.\140\ Raising security concerns,
one industry commenter recommended that the Commission designate a
point person or office to receive notices by registered or express
mail, and treat all such information as business confidential, not
subject to release under the Freedom of Information Act
(``FOIA'').\141\ Other commenters encouraged the FTC to require
entities not to report individually identifiable information.\142\
---------------------------------------------------------------------------
\140\ EPIC at 10.
\141\ SIIA at 12.
\142\ See, e.g., AHIP at 7; Molina Healthcare at 5.
---------------------------------------------------------------------------
Consistent with these comments, the Commission has developed the
attached form, which it will post at (http://www.ftc.gov/healthbreach),
for vendors of personal health records or PHR related entities subject
to the rule to complete for purposes of notifying the FTC when they
discover a breach. The form's instructions require entities to print
and send the form to a designated FTC official by courier or overnight
mail. Due to security concerns associated with email transmission, the
Commission will not accept emailed forms at this time. Also, the form
instructs entities not to include consumers' personally identifiable
information in their notice to the FTC.\143\
---------------------------------------------------------------------------
\143\ Entities should begin using this form to provide notice to
the Commission beginning on the effective date of this rule.
However, pursuant to regulations of the Office of Management and
Budget (``OMB''), the Commission will issue a separate Federal
Register notice seeking comments on the form; based on comments
received, the Commission may modify the form in the future.
---------------------------------------------------------------------------
Until an entity sends a breach notice to consumers, the FTC will
not routinely make public any information the entity provides to it on
the breach notification form.\144\ Once an entity sends a breach notice
to consumers, however, the FTC will input the information it receives
from the entity into a database that it will update periodically and
make available to the public.
---------------------------------------------------------------------------
\144\ In response to a request under the Freedom of Information
Act, however, the FTC may be required to disclose information
provided on the form in response to a request from the public,
unless the information contains confidential business information or
other information exempt from public disclosure under that Act. 5
U.S.C. 552.
---------------------------------------------------------------------------
Section 318.6 Content of Notice
Proposed section 318.6 required that the breach notice to
individuals include a brief description of how the breach occurred,
including the date of the breach and the date of the discovery of the
breach, if known; a description of the types of unsecured PHR
identifiable health information that were involved in the breach; the
steps individuals should take to protect themselves from potential
harm; \145\ a brief description of
[[Page 42976]]
what the vendor of personal health records or PHR related entity
involved is doing to investigate the breach, to mitigate any harm, and
to protect against any further breaches; and contact procedures for
individuals to ask questions or learn additional information.\146\ In
response to comments received, the Commission has made three changes to
this section.
---------------------------------------------------------------------------
\145\ As stated in the NPRM, the steps individuals should take
to protect themselves from potential harm will differ depending on
the circumstances of the breach and the type of PHR identifiable
information involved. For example, if health insurance account
information is compromised, the entity could suggest steps
including, but not limited to, requesting and reviewing copies of
medical files for potential errors; monitoring explanation of
benefit forms for potential errors; contacting insurers to notify
them of possible medical identity theft; following up with providers
if medical bills do not arrive on time to ensure that an identity
thief has not changed the billing address; and, in appropriate
cases, trying to change health insurance account numbers.
If the breach also involves Social Security numbers, the entity
should suggest additional steps such as placing a fraud alert on
credit reports; obtaining and reviewing copies of credit reports for
signs of identity theft; calling the local police or sheriff's
office in the event suspicious activity is detected; and if
appropriate, obtaining a credit freeze. In the case of a breach
involving financial account numbers, the entity also should direct
consumers to monitor their accounts for suspicious activity and
contact their financial institution about closing any compromised
accounts. In appropriate cases, the entity also could refer
consumers to the FTC's identity theft Web site, (http://www.ftc.gov/
idtheft).
In other instances, the likely harm will be personal
embarrassment. In such cases, any steps that an individual may
choose to take will likely be personal to that individual, and the
entity may not be in a position to advise the consumer.
One commenter recommended that the Commission incorporate this
guidance into the text of the final rule. AHIMA at 5. Because these
steps will differ depending on the circumstances of the breach and
in light of the variety of factual situations that may be involved,
the Commission has not incorporated its specific guidance into the
final text of section 318.6.
\146\ In its NPRM, the Commission stated also that the breach
notice should not include any requests for personal or financial
information, which could raise concerns about phishing.
---------------------------------------------------------------------------
First, it has replaced references to mitigating ``losses'' from a
breach with the term ``harm,'' to more precisely reflect that injury
from a health-related breach is not restricted to economic loss.
Second, some commenters noted that the requirement that the notice
contain ``a brief description of how the breach occurred'' might create
unnecessary security risks by inadvertently providing a roadmap for
future breaches. These commenters urged the Commission to track the
language of the Recovery Act which requires ``a brief description of
what happened.'' \147\ The Commission is persuaded by these comments
and modifies the language of 318.6(a) so that it reads as follows: ``a
brief description of what happened, including the date of the breach
and the date of the discovery of the breach, if known.''
---------------------------------------------------------------------------
\147\ See, e.g., CDT/Markle at 11; SIIA at 13.
---------------------------------------------------------------------------
Finally, to ensure that notice be simple and non-technical so that
individuals easily can understand the information being conveyed, the
Commission has added language to this section mandating that the notice
``be written in plain language.'' In order to satisfy this requirement,
entities should use clear language and syntax in their notices, and not
include any extraneous material that might diminish the message they
are trying to convey. In addition, entities should not include content
beyond that required by law (including state law if the notice is
designed to comply with both federal and state requirements), if such
additional content could cause consumer confusion.
Sections 318.7, 318.8, 318.9: Enforcement, Effective Date, and Sunset
The Commission retains sections 318.7, 318.8, and 318.9 as
proposed. With respect to the effective date of 30 days from
publication of the final rule, however, at least one commenter
expressed concern that such an effective date does not allow enough
time to implement the processes and procedures necessary to comply with
the FTC's rule.\148\ Although the Commission does not have discretion
to change the effective date of the rule because the Recovery Act
establishes the effective date, which is mandated by the Recovery Act,
it recognizes that entities may need to develop new procedures to
comply with it. Therefore, the Commission will use its enforcement
discretion to refrain from bringing an enforcement action for failure
to provide the required notifications for breaches that are discovered
before February 22, 2010. During this initial time period--after this
rule has taken effect but before an entity is subject to an enforcement
action--the Commission expects regulated entities to come into full
compliance with the final rule.
---------------------------------------------------------------------------
\148\ Intuit at 3.
---------------------------------------------------------------------------
IV. Paperwork Reduction Act
In conjunction with the NPRM, the FTC submitted the proposed rule
and a Supporting Statement to the Office of Management and Budget
(``OMB'') for review under the Paperwork Reduction Act (``PRA''). The
breach notification requirements contained in the proposed rule
constituted ``collections of information,'' which triggered the
requirements of the PRA. In response, OMB filed a comment in accordance
with 5 CFR Sec. 1320.11(c). The comment indicated that OMB was
withholding approval pending (1) the FTC's examination of the public
comments in response to the NPRM, and (2) inclusion of a description in
the preamble to the final rule of how it has maximized the practical
utility of the collection of information and minimized the burden. In
this section, the Commission (1) describes how it has maximized the
practical utility of the final rule, and (2) sets forth a revised PRA
analysis, taking into account both changes made to the proposed rule
and comments received in response to its initial PRA analysis.
A. Practical Utility
According to OMB regulations, practical utility means the
usefulness of information to or for an agency.\149\ In determining
whether information will have ``practical utility,'' OMB will consider
``whether the agency demonstrates actual timely use for the information
either to carry out its functions or make it available to third-parties
or the public, either directly or by means of a third-party or public
posting, notification, labeling, or similar disclosure requirement, for
the use of persons who have an interest in entities or transactions
over which the agency has jurisdiction.'' \150\
---------------------------------------------------------------------------
\149\ 5 CFR 1320.3(l).
\150\ Id.
---------------------------------------------------------------------------
The Commission has maximized the practical utility of the breach
notification requirements contained in the final rule, consistent with
the requirements of the Recovery Act. Under the final rule, consumers
whose information has been affected by a breach of security will
receive notice of it ``without unreasonable delay and in no case later
than 60 calendar days'' after discovery of the breach.\151\ Among other
information, the notices must provide consumers with steps they can
take to protect themselves from harm. Moreover, the breach notice
requirements will encourage entities to safeguard the information of
their customers, thereby potentially reducing the incidence of harm.
---------------------------------------------------------------------------
\151\ 16 CFR 318.4(a).
---------------------------------------------------------------------------
As provided by the Recovery Act, the final rule also requires
entities to notify the Commission in the event of a security breach.
The Commission has developed a form, which it will post at (http://
www.ftc.gov/healthbreach), for entities subject to the rule to complete
for this purpose. The form requests minimal information, mostly in the
form of replies to check boxes; thus, entities will not require
extensive time to complete it. At the same time, the form will provide
a significant source of enforcement leads for the Commission. The
Commission also will input the information it receives from entities
into a database that it will update periodically and make available to
the public. The publicly-available database will help businesses, the
public, and policymakers. It will provide businesses with information
about potential sources of data breaches, which will be particularly
helpful to those setting up data security procedures. It will provide
the public with information about the extent of data breaches. And it
will help policymakers in developing breach notification requirements
in non-health-related areas.
Thus, the final rule will have significant practical utility.
B. Explanation of Burden Estimates Under the Final Rule
The PRA burden of the final rule's requirements will depend on a
variety of factors, including the number of covered firms; the
percentage of such
[[Page 42977]]
firms that will experience a breach requiring further investigation
and, if necessary, the sending of breach notices; and the number of
consumers notified.
In its initial PRA analysis, staff estimated that approximately 200
vendors of personal health records and 500 PHR related entities will be
covered by the Commission's final rule. Thus, it estimated that a total
of 700 entities will be required to notify consumers and the Commission
in the event that they discover a breach. It also estimated that
approximately 200 third party service providers will also be subject to
the rule, and thus required to notify vendors of personal health
records or PHR related entities in the event of a breach. Thus, staff
estimated that a total of approximately 900 entities will be subject to
the final rule's breach notification requirements. The staff retains
these estimates without modification.
Staff estimated that these entities, cumulatively, will experience
11 breaches per year for which notification may be required. Because
there is insufficient data at this time about the number and incidence
of breaches in the PHR industry, staff used available data relating to
breaches incurred by private sector businesses in order to calculate a
breach incidence rate. Staff then applied this rate to the estimated
total number of entities that will be subject to the final rule.
According to one recent research paper, private sector businesses
across multiple industries experienced a total of approximately 50
breaches per year during the years 2002 through 2007.\152\ Dividing 50
breaches by the estimated number of firms that would be subject to a
breach (4,187) \153\ yields an estimated breach incidence rate of 1.2%
per year. Applying this incidence rate to the estimated 900 vendors of
personal health records, PHR related entities, and third party service
providers yields an estimate of 11 breaches per year that may require
notification of consumers and the Commission. The staff retains this
estimate without modification.
---------------------------------------------------------------------------
\152\ Sasha Romanosky, Rahul Telang & Alessandro Acquisti, ``Do
Data Breach Disclosure Laws Reduce Identity Theft?'' Seventh
Workshop on the Economics of Information Security, June 2008. The
authors tallied the breaches reported to the Web site Attrition.org
during the time period 2002 to 2007 and counted a total of 773
breaches for a range of entities, including businesses, governments,
health providers, and educational institutions. Staff used the
volume of breaches reported for businesses (246 over a 5 year
period, or approximately 50 per year) because that class of data is
most compatible with other data staff used to calculate the
incidence of breaches.
\153\ Staff focused on firms that routinely collect information
on a sizeable number of consumers, thereby rendering them attractive
targets for data thieves. To do so, staff focused first on retail
businesses and eliminated retailers with annual revenue under
$1,000,000. The 2002 Economic Census reports that, in that year,
there were 418,713 retailers with revenue of $1,000,000 or more. To
apply 50 breaches to such a large population, however, would yield a
very small incidence rate. In an abundance of caution, to estimate
more conservatively the incidence of breach, staff then assumed that
only one percent of these firms had security vulnerabilities that
would render them breach targets, thus yielding the total of 4,187.
---------------------------------------------------------------------------
To determine the annual PRA burden, staff developed estimates for
three categories of potential costs: (1) the costs of determining what
information has been breached, identifying the affected customers,
preparing the breach notice, and making the required report to the
Commission; (2) the cost of notifying consumers; and (3) the cost of
setting up a toll-free number, if needed.
First, in order to determine what information has been breached,
identify the affected customers, prepare the breach notice, and make
the required report to the Commission, staff estimated that covered
firms will require per breach, on average, 100 hours of employee labor
at a cost of $4,652,\154\ and the services of a forensic expert at an
estimated cost of $2,930.\155\ Thus, the cost estimate for each breach
was $7,582. This estimate did not include the cost of equipment or
other tangible assets of the breached firms, because they likely will
use the equipment and other assets they have for ordinary business
purposes. Based on the estimate that there will be 11 breaches per
year, the annual cost burden for affected entities to perform these
tasks was estimated to be $83,402 (11 breaches x $7,582 each).
---------------------------------------------------------------------------
\154\ Hourly wages throughout this notice are based on (http://
www.bls.gov/ncs/ncswage2007.htm) (National Compensation Survey:
Occupational Earnings in the United States 2007, U.S. Department of
Labor released August 2008, Bulletin 2704, Table 3 (``Full-time
civilian workers,'' mean and median hourly wages).
The breakdown of labor hours and costs is as follows: 50 hours
of computer and information systems managerial time at $52.56 per
hour; 12 hours of marketing managerial time at $53.00 per hour; 33
hours of computer programmer time at $33.77 per hour; and 5 hours of
legal staff time at 54.69 per hour.
\155\ Staff estimates that breached entities will use 30 hours
of a forensic expert's time. Staff applied the wages of a network
systems and data communications analyst ($32.56), tripled it to
reflect profits and overhead for an outside consultant ($97.68), and
multiplied it by 30 hours to yield $2,930.
---------------------------------------------------------------------------
The Commission received one comment suggesting that the staff's
estimate of 100 hours of employee labor to determine what information
has been breached, identify the affected customers, prepare the breach
notice, and make the required notice to the Commission might be too
low. This commenter noted that the analysis did not take into account
the burden caused by compliance with potentially duplicative and
conflicting state requirements.\156\
---------------------------------------------------------------------------
\156\ SIIA at 14.
---------------------------------------------------------------------------
Staff has not altered its PRA burden analysis based on this
comment. First, as discussed above, the final rule preempts any
conflicting state law. Second, several of the potential costs or time
burdens raised by the commenter, including those incurred to comply
with preexisting, albeit duplicative state laws, or those associated
with public relations and marketing, are not functions constituting a
PRA ``collection of information.'' \157\ Finally, although the
Commission recognizes that certain entities may spend more than 100
hours regarding the above-noted tasks, staff's hours estimate is an
average of the burden that would be incurred across small and large
businesses experiencing various types of breaches.
---------------------------------------------------------------------------
\157\ The PRA burden analyzed here includes the time, effort and
financial resources expended by covered entities to generate,
maintain, or provide information to or for the Commission on account
of the rule. See 5 CFR 1320.3(b)(1). ``Collection of information
means . . . requiring the disclosure to an agency, third parties or
the public of information by or for an agency by means of identical
questions posed to, or identical reporting, recordkeeping, or
disclosure requirements imposed on, ten or more persons . . . .'' 5
CFR1320.3(c).
---------------------------------------------------------------------------
The cost of breach notifications also will depend on the number of
consumers contacted. Based on a recent survey, 11.6 percent of adults
reported receiving a breach notification during a one-year period.\158\
Staff estimated that for the prospective 3-year PRA clearance, the
average customer base of all vendors of personal health records and PHR
related entities will be approximately two million per year.
Accordingly, staff estimated that an average of 232,000 consumers per
year will receive a breach notification. Staff retains this estimate
without modification.
---------------------------------------------------------------------------
\158\ Ponemon Institute, ``National Survey on Data Security
Breach Notification,'' 2005. Staff believes that this estimate is
likely high given the importance of data security to the PHR
industry and the likelihood that data encryption will be a strong
selling point to consumers.
---------------------------------------------------------------------------
Given the online relationship between consumers and vendors of
personal health records and PHR related entities, staff stated that
most notifications will be made by email and the cost of such
notifications will be de minimis.\159\
---------------------------------------------------------------------------
\159\ See Federal Trade Commission, National Do Not Email
Registry, A Report to Congress, June 2004, n.93, available at
(http://www.ftc.gov/reports/dneregistry/report.pdf).
---------------------------------------------------------------------------
In some cases, however, staff noted that vendors of personal health
records and PHR related entities will need to notify individuals by
postal mail, either because these individuals have asked
[[Page 42978]]
for such notification, or because the email addresses of these
individuals are not current or not working. Staff estimated that the
cost of notifying an individual by postal mail will be approximately
$2.30 per letter.\160\ Assuming that vendors of personal health records
and PHR related entities will need to notify by postal mail 10 percent
of their customers whose information is breached, the estimated cost of
this notification will be $53,360 per year. Staff retains this
estimate.
---------------------------------------------------------------------------
\160\ Robin Sidel and Mitchell Pacelle, ``Credit-Card Breach
Tests Banking Industry's Defenses,'' Wall Street Journal, June 21,
2005, p.C1. Sidel and Pacelle reported that industry sources
estimated the cost per letter to be about $2.00 in 2005. Allowing
for inflation, staff estimates the cost to average about $2.30 per
letter over the next three years of prospective PRA clearance sought
from OMB.
---------------------------------------------------------------------------
In addition, staff recognized that vendors of personal health
records and PHR related entities sometimes may need to notify consumers
by posting a message on their home page, or by providing media notice.
Based on a recent study on data breach costs, staff estimated the cost
of providing notice via Web site posting to be 6 cents per breached
record, and the cost of providing notice via published media to be 3
cents per breached record.\161\ Applied to the above-stated estimate of
232,000 consumers per year receiving breach notification, the estimated
total annual cost of Web site notice will be $13,920, and the estimated
total annual cost of media notice will be $6,960, yielding an estimated
total annual cost for all forms of notice to consumers of $74,240.
Staff retains this estimate without modification.
---------------------------------------------------------------------------
\161\ Ponemon Institute, 2006 Annual Study: Cost of a Data
Breach, Understanding Financial Impact, Customer Turnover, and
Preventative Solutions, Table 2.
---------------------------------------------------------------------------
Finally, staff assessed that the cost of a toll-free number will
depend on the cost associated with T1 lines \162\ sufficient to handle
the projected call volume, the cost of obtaining a toll-free telephone
number and queue messaging (a service that provides rudimentary call
routing), the cost of processing each call, and the telecommunication
charges associated with each call. In the NPRM, staff estimated the
cost of a toll-free line for a six-month period, because the proposed
rule provided that entities choosing to post a message on their
homepage do so for a period of six months. Because the Commission has
changed this homepage posting requirement to ninety days in response to
comments, staff now estimates the cost of a toll-free line for a
ninety-day period. Based on industry research, staff projects that in
order to accommodate a sufficient number of incoming calls for that
period, affected entities may need two T1 lines at a cost of
$9,000.\163\ Staff further estimates that the cost of obtaining a
dedicated toll-free line and queue messaging will be $3,017,\164\ and
that processing an estimated 5,000 calls for the first month per breach
will require an average of 1,917 hours of employee labor at a cost of
$27,468.\165\ Affected entities will need to offer the toll-free number
for an additional two months, during which time staff projects that
entities will each cumulatively receive an additional 3,000 calls per
breach,\166\ yielding an estimated total processing cost of $43,946
($27,468 + $16,478). In addition, according to industry research, the
telecommunication charges associated with the toll-free line will be
approximately $2,000.\167\ Adding these costs together, staff estimates
that the cost per breach for the toll-free line will be $57,963. Based
on the above rate of 11 breaches per year, the annual cost burden for
affected entities will be $637,593 (11 x $57,963).
---------------------------------------------------------------------------
\162\ A T1 line is a specific type of telephone line that can
carry more data than traditional telephone lines.
\163\ According to industry research, the cost of a single T1
line is $1,500 per month.
\164\ Staff estimates that installation of a toll-free number
and queue messaging will require 40 hours of a technician's time.
Staff applied the wages of a telecommunications technician ($25.14),
tripled it to reflect profits and overhead of a telecommunications
firm ($75.42), and multiplied it by 40 hours to yield $3,017.
\165\ The breakdown of labor hours and costs is as follows: 667
hours of telephone operator time (8 minutes per call x 5,000 calls)
at $14.87 per hour and 1,250 hours of information processor time (15
minutes per call x 5,000 calls) at $14.04 per hour. This totals
$27,468.
\166\ Staff anticipates that the greatest influx of calls will
be in the first month, and that the volume of calls will be less for
the next two months. The breakdown of labor hours and costs for this
two-month period is as follows: 400 hours of telephone operator time
(8 minutes per call x 3,000 calls) at $14.87 per hour and 750 hours
of information processor time (15 minutes per call x 3,000 calls) at
$14.04 per hour. This totals $16,478.
\167\ Staff estimates a cost per call of 25[cent] (5[cent] per
minute/per call x 5 minutes per call). Assuming 8,000 calls for each
breach, the total estimated telecommunications charges are $2,000.
---------------------------------------------------------------------------
In sum, the estimated annual cost burden associated with the breach
notification requirements of the final rule is $795,235: $83,402 (costs
associated with investigating breaches, drafting notifications of
breaches, and notifying the Commission) + $74,240 (costs associated
with notifying consumers) + $637,593 (costs associated with
establishing toll-free numbers). Staff notes that this estimate likely
overstates the costs imposed by the final rule because: (1) it assumes
that all breaches will require notification, whereas many breaches
(e.g., those involving data that is ``not unsecured'') will not require
notification; (2) it assumes that all covered entities will be required
to take all of the steps required above; and (3) staff made
conservative assumptions in developing many of the underlying
estimates.
V. Final Regulatory Flexibility Analysis
The Regulatory Flexibility Act (``RFA''), 5 U.S.C. 604(a), requires
an agency either to provide a Final Regulatory Flexibility Analysis
(``FRFA'') with the final rule, or certify that the final rule will not
have a significant economic impact on a substantial number of small
entities. The Commission does not expect that this final rule will have
a significant economic impact on a substantial number of small
entities. First, most of the burdens flow from the mandates of the Act,
not from the specific provisions of the final rule. Second, the rule
will apply to entities that, in many instances, already have
obligations to provide notification of data breaches under certain
state laws covering medical breaches.\168\ Third, once a notice is
created, the costs of sending it should be minimal because the
Commission anticipates that most consumers will elect to receive
notification by email. Based on available information, therefore, the
Commission certifies that the final rule will not have significant
economic impact on a substantial number of small entities.
---------------------------------------------------------------------------
\168\ See, e.g., Ark. Code 4-110-103(5); Ca. Civil Code
1798.81.5; Md. Code, Com. Law Sec. 14-3501(D)(1).
---------------------------------------------------------------------------
Nonetheless, to ensure that no such impact, if any, has been
overlooked, the Commission has conducted the following final regulatory
flexibility analysis, as summarized below.
A. Need for and Objectives of the Rule
Section 13407 of the American Recovery and Reinvestment Act
requires the Commission to promulgate this rule not later than six
months after the date of enactment of the Act, or August 17, 2009. The
Commission is issuing this rule to implement the Recovery Act's
requirement that certain entities that handle health information
provide notice to individuals whose individually identifiable health
information has been breached.
B. Significant Issues Raised by Public Comment, Summary of the Agency's
Assessment of These Issues, and Changes, if any, Made in Response to
Such Comments
The Commission did not receive any substantive comments on its
proposed
[[Page 42979]]
Regulatory Flexibility Act analysis. Nonetheless, the Commission
provides an overview here of the significant comments it received that
would affect the costs of complying with the rule for all entities,
small and large, and its response.
First, several commenters stressed that FTC and HHS should work
together to ensure that their respective breach notification rules are
harmonized and that stakeholders know which rule applies to which
entity.\169\ These commenters recognized that some entities may be
subject to both rules, and that it is therefore important for the rules
to be similar.\170\ The Commission agrees with these comments and has
consulted with HHS to harmonize the two rules, within the constraints
of the statutory language.
---------------------------------------------------------------------------
\169\ See supra note 7.
\170\ See supra note 8.
---------------------------------------------------------------------------
Second, commenters raised several concerns about the timing and
method of breach notification that would affect businesses of all
sizes. For example, commenters that addressed the issue generally
opposed requiring an entity to secure a consumer's ``express
affirmative consent'' before sending breach notices by email.\171\ For
the requirement to provide substitute notice to individuals on the home
page of an entity's Web site, many commenters opposed the six month
required posting period and suggested that a shorter period would be
less burdensome for businesses and less confusing for consumers.\172\
Finally, many commenters objected to the proposed rule's requirement
that entities provide notice to the Commission no later than five
business days after discovery of a breach affecting more than 500
individuals.\173\
---------------------------------------------------------------------------
\171\ See supra note 99.
\172\ See supra note 118.
\173\ See supra note 134.
---------------------------------------------------------------------------
As discussed in more detail above, in response to these concerns,
the Commission made several changes to the rule, all of which will
reduce the burden on entities of all sizes while also ensuring
meaningful breach notification to consumers. Specifically, rather than
require express affirmative consent for email notice, the final rule
allows entities to have their customers opt out of receiving email
notice. The final rule also reduces the home page posting period from
six months to ninety days, and extends the time period for providing
the Commission with notice of large breaches, from five to ten business
days.
Finally, other commenters expressed concerns about particular
statutory requirements governing breach notification that come directly
from the Recovery Act (for example, whether media notice may be too
burdensome).\174\ Because these requirements come directly from the
Recovery Act, the Commission cannot change its final rule in response
to these comments. Nevertheless, as discussed above, the Commission
will take these comments into account when providing input on the HHS
report.
---------------------------------------------------------------------------
\174\ See supra notes 19-20.
---------------------------------------------------------------------------
C. Description and Estimate of the Number of Small Entities Subject to
the Final Rule or Explanation Why No Estimate Is Available
The final rule will apply to vendors of personal health records,
PHR related entities, and third party service providers. As discussed
in the section on PRA above, FTC staff estimates that the rule will
apply to approximately 900 entities. Staff continues to believe that
the available data about the relatively new PHR industry is not
sufficient for staff to estimate realistically the number of entities
subject to the FTC's final rule that are small as defined by the Small
Business Administration.\175\
---------------------------------------------------------------------------
\175\ For a majority of the entities subject to the rule to be
considered small businesses, they must have average annual receipts
that are $7 million or less. A list of the SBA's size standards for
all industries can be found at (http://www.sba.gov/idc/groups/
public/documents/sba_homepage/serv_sstd_tablepdf.pdf) (last
visited July 24, 2009).
---------------------------------------------------------------------------
D. Description of the Projected Reporting, Disclosure and Other
Compliance Requirements of the Rule, Including an Estimate of the
Classes of Small Entities That Will be Subject to the Rule and the Type
of Professional Skills That Will be Necessary to Comply
The Recovery Act and final rule impose certain reporting and
disclosure requirements within the meaning of the PRA. The Commission
is seeking clearance from OMB for these requirements, and the
Commission's Supporting Statement submitted as part of that process is
being made available on the public record of this rulemaking.
Specifically, the Act and final rule require vendors of personal
health records and PHR related entities to provide notice to consumers
and the Commission in the event of a breach of unsecured PHR
identifiable health information. The Act and final rule also require
third party service providers to provide notice to vendors of personal
health records and PHR related entities in the event of such a breach.
As discussed in the section on PRA above, if a breach occurs, each
entity covered by the final rule will expend costs to determine the
extent of the breach and the individuals affected. If the entity is a
vendor of personal health records or PHR related entity, additional
costs will include the costs of preparing a breach notice, notifying
the Commission, compiling a list of consumers to whom a breach notice
must be sent, and sending a breach notice. Such entities may incur
additional costs in locating consumers who cannot be reached, and in
certain cases, posting a breach notice on a Web site, notifying
consumers through media notices, setting up a toll-free number, and
sending breach notices through press releases to media outlets.
In-house costs may include technical costs to determine the extent
of breaches; investigative costs of conducting interviews and gathering
information; administrative costs of compiling address lists;
professional/legal costs of drafting the notice; and potentially, costs
for postage, and/or web posting. Costs may also include the purchase of
services of a forensic expert.
As noted in the final PRA analysis, the estimated annual cost
burden for all entities subject to the final rule will be approximately
$795,235.
E. Steps the Agency Has Taken to Minimize Any Significant Economic
Impact on Small Entities, Consistent With the Stated Objectives of the
Applicable Statutes, Including the Factual, Policy, and Legal Reasons
for Selecting the Alternative(s) Finally Adopted, and Why Each of the
Significant Alternatives, if any, Was Rejected
In drafting the final rule, the Commission has made every effort to
avoid unduly burdensome requirements for small entities. In particular,
the Commission believes that the alternative of providing notice to
consumers electronically will assist small entities by significantly
reducing the costs of sending breach notices. Moreover, as discussed
above, the Commission has modified the final rule's requirements for
timing and method of notice in several ways that will also reduce the
burden on small entities.
Two commenters expressed concern that the effective compliance date
of 30 calendar days from the date of publication of this final rule
would not allow covered entities sufficient time to come into
compliance. In response, the Commission notes that the effective
compliance date is mandated by the Recovery Act. Moreover, as discussed
above, the Commission believes that in many instances the rule will
apply to entities that already have obligations to provide notification
of data breaches
[[Page 42980]]
under certain state laws covering medical breaches. As a result, these
entities can build upon their existing programs in order to come into
compliance with this final rule. Nevertheless, the Commission has
determined that it will use its enforcement discretion to refrain from
imposing sanctions for failure to provide the required notifications
for breaches that are discovered before February 22, 2010.
The Commission is not aware of additional methods of compliance
that will reduce the impact of the final rule on small entities, while
also comporting with the Recovery Act.
VI. Final Rule
List of Subjects in 16 CFR Part 318
Consumer protection, Data protection, Health records, Privacy,
Trade practices.
0
Accordingly, for the reasons set forth in the preamble, the Commission
adds a new Part 318 to title 16 of the Code of Federal Regulations, to
read as follows:
PART 318--HEALTH BREACH NOTIFICATION RULE
Sec.
318.1 Purpose and scope.
318.2 Definitions.
318.3 Breach notification requirement.
318.4 Timeliness of notification.
318.5 Method of notice.
318.6 Content of notice.
318.7 Enforcement.
318.8 Effective date.
318.9 Sunset.
Authority: Public Law 111-5, 123 Stat. 115 (2009).
Sec. 318.1 Purpose and scope.
(a) This Part, which shall be called the ``Health Breach
Notification Rule,'' implements section 13407 of the American Recovery
and Reinvestment Act of 2009. It applies to foreign and domestic
vendors of personal health records, PHR related entities, and third
party service providers, irrespective of any jurisdictional tests in
the Federal Trade Commission (FTC) Act, that maintain information of
U.S. citizens or residents. It does not apply to HIPAA-covered
entities, or to any other entity to the extent that it engages in
activities as a business associate of a HIPAA-covered entity.
(b) This Part preempts state law as set forth in section 13421 of
the American Recovery and Reinvestment Act of 2009.
Sec. 318.2 Definitions.
(a) Breach of security means, with respect to unsecured PHR
identifiable health information of an individual in a personal health
record, acquisition of such information without the authorization of
the individual. Unauthorized acquisition will be presumed to include
unauthorized access to unsecured PHR identifiable health information
unless the vendor of personal health records, PHR related entity, or
third party service provider that experienced the breach has reliable
evidence showing that there has not been, or could not reasonably have
been, unauthorized acquisition of such information.
(b) Business associate means a business associate under the Health
Insurance Portability and Accountability Act, Public Law 104-191, 110
Stat. 1936, as defined in 45 CFR 160.103.
(c) HIPAA-covered entity means a covered entity under the Health
Insurance Portability and Accountability Act, Public Law 104-191, 110
Stat. 1936, as defined in 45 CFR 160.103.
(d) Personal health record means an electronic record of PHR
identifiable health information on an individual that can be drawn from
multiple sources and that is managed, shared, and controlled by or
primarily for the individual.
(e) PHR identifiable health information means ``individually
identifiable health information,'' as defined in section 1171(6) of the
Social Security Act (42 U.S.C. 1320d(6)), and, with respect to an
individual, information:
(1) That is provided by or on behalf of the individual; and
(2) That identifies the individual or with respect to which there
is a reasonable basis to believe that the information can be used to
identify the individual.
(f) PHR related entity means an entity, other than a HIPAA-covered
entity or an entity to the extent that it engages in activities as a
business associate of a HIPAA-covered entity, that:
(1) Offers products or services through the Web site of a vendor of
personal health records;
(2) Offers products or services through the Web sites of HIPAA-
covered entities that offer individuals personal health records; or
(3) Accesses information in a personal health record or sends
information to a personal health record.
(g) State means any of the several States, the District of
Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa and the
Northern Mariana Islands.
(h) Third party service provider means an entity that:
(1) Provides services to a vendor of personal health records in
connection with the offering or maintenance of a personal health record
or to a PHR related entity in connection with a product or service
offered by that entity; and
(2) Accesses, maintains, retains, modifies, records, stores,
destroys, or otherwise holds, uses, or discloses unsecured PHR
identifiable health information as a result of such services.
(i) Unsecured means PHR identifiable information that is not
protected through the use of a technology or methodology specified by
the Secretary of Health and Human Services in the guidance issued under
section 13402(h)(2) of the American Reinvestment and Recovery Act of
2009.
(j) Vendor of personal health records means an entity, other than a
HIPAA-covered entity or an entity to the extent that it engages in
activities as a business associate of a HIPAA-covered entity, that
offers or maintains a personal health record.
Sec. 318.3 Breach notification requirement.
(a) In general. In accordance with Sec. Sec. 318.4, 318.5, and
318.6, each vendor of personal health records, following the discovery
of a breach of security of unsecured PHR identifiable health
information that is in a personal health record maintained or offered
by such vendor, and each PHR related entity, following the discovery of
a breach of security of such information that is obtained through a
product or service provided by such entity, shall:
(1) Notify each individual who is a citizen or resident of the
United States whose unsecured PHR identifiable health information was
acquired by an unauthorized person as a result of such breach of
security; and
(2) Notify the Federal Trade Commission.
(b) Third party service providers. A third party service provider
shall, following the discovery of a breach of security, provide notice
of the breach to an official designated in a written contract by the
vendor of personal health records or the PHR related entity to receive
such notices or, if such a designation is not made, to a senior
official at the vendor of personal health records or PHR related entity
to which it provides services, and obtain acknowledgment from such
official that such notice was received. Such notification shall include
the identification of each customer of the vendor of personal health
records or PHR related entity whose unsecured PHR identifiable health
information has been, or is reasonably believed to have been, acquired
during such breach. For purposes of ensuring implementation of
[[Page 42981]]
this requirement, vendors of personal health records and PHR related
entities shall notify third party service providers of their status as
vendors of personal health records or PHR related entities subject to
this Part.
(c) Breaches treated as discovered. A breach of security shall be
treated as discovered as of the first day on which such breach is known
or reasonably should have been known to the vendor of personal health
records, PHR related entity, or third party service provider,
respectively. Such vendor, entity, or third party service provider
shall be deemed to have knowledge of a breach if such breach is known,
or reasonably should have been known, to any person, other than the
person committing the breach, who is an employee, officer, or other
agent of such vendor of personal health records, PHR related entity, or
third party service provider.
Sec. 318.4 Timeliness of notification.
(a) In general. Except as provided in paragraph (c) of this section
and Sec. 318.5(c), all notifications required under Sec. Sec.
318.3(a)(1), 318.3(b), and 318.5(b) shall be sent without unreasonable
delay and in no case later than 60 calendar days after the discovery of
a breach of security.
(b) Burden of proof. The vendor of personal health records, PHR
related entity, and third party service provider involved shall have
the burden of demonstrating that all notifications were made as
required under this Part, including evidence demonstrating the
necessity of any delay.
(c) Law enforcement exception. If a law enforcement official
determines that a notification, notice, or posting required under this
Part would impede a criminal investigation or cause damage to national
security, such notification, notice, or posting shall be delayed. This
paragraph shall be implemented in the same manner as provided under 45
CFR 164.528(a)(2), in the case of a disclosure covered under such
section.
Sec. 318.5 Methods of notice.
(a) Individual notice. A vendor of personal health records or PHR
related entity that discovers a breach of security shall provide notice
of such breach to an individual promptly, as described in Sec. 318.4,
and in the following form:
(1) Written notice, by first-class mail to the individual at the
last known address of the individual, or by email, if the individual is
given a clear, conspicuous, and reasonable opportunity to receive
notification by first-class mail, and the individual does not exercise
that choice. If the individual is deceased, the vendor of personal
health records or PHR related entity that discovered the breach must
provide such notice to the next of kin of the individual if the
individual had provided contact information for his or her next of kin,
along with authorization to contact them. The notice may be provided in
one or more mailings as information is available.
(2) If, after making reasonable efforts to contact all individuals
to whom notice is required under Sec. 318.3(a), through the means
provided in paragraph (a)(1) of this section, the vendor of personal
health records or PHR related entity finds that contact information for
ten or more individuals is insufficient or out-of-date, the vendor of
personal health records or PHR related entity shall provide substitute
notice, which shall be reasonably calculated to reach the individuals
affected by the breach, in the following form:
(i) Through a conspicuous posting for a period of 90 days on the
home page of its Web site; or
(ii) In major print or broadcast media, including major media in
geographic areas where the individuals affected by the breach likely
reside. Such a notice in media or web posting shall include a toll-free
phone number, which shall remain active for at least 90 days, where an
individual can learn whether or not the individual's unsecured PHR
identifiable health information may be included in the breach.
(3) In any case deemed by the vendor of personal health records or
PHR related entity to require urgency because of possible imminent
misuse of unsecured PHR identifiable health information, that entity
may provide information to individuals by telephone or other means, as
appropriate, in addition to notice provided under paragraph (a)(1) of
this section.
(b) Notice to media. A vendor of personal health records or PHR
related entity shall provide notice to prominent media outlets serving
a State or jurisdiction, following the discovery of a breach of
security, if the unsecured PHR identifiable health information of 500
or more residents of such State or jurisdiction is, or is reasonably
believed to have been, acquired during such breach.
(c) Notice to FTC. Vendors of personal health records and PHR
related entities shall provide notice to the Federal Trade Commission
following the discovery of a breach of security. If the breach involves
the unsecured PHR identifiable health information of 500 or more
individuals, then such notice shall be provided as soon as possible and
in no case later than ten business days following the date of discovery
of the breach. If the breach involves the unsecured PHR identifiable
health information of fewer than 500 individuals, the vendor of
personal health records or PHR related entity may maintain a log of any
such breach, and submit such a log annually to the Federal Trade
Commission no later than 60 calendar days following the end of the
calendar year, documenting breaches from the preceding calendar year.
All notices pursuant to this paragraph shall be provided according to
instructions at the Federal Trade Commission's Web site.
Sec. 318.6 Content of notice.
Regardless of the method by which notice is provided to individuals
under Sec. 318.5 of this Part, notice of a breach of security shall be
in plain language and include, to the extent possible, the following:
(a) A brief description of what happened, including the date of the
breach and the date of the discovery of the breach, if known;
(b) A description of the types of unsecured PHR identifiable health
information that were involved in the breach (such as full name, Social
Security number, date of birth, home address, account number, or
disability code);
(c) Steps individuals should take to protect themselves from
potential harm resulting from the breach;
(d) A brief description of what the entity that suffered the breach
is doing to investigate the breach, to mitigate harm, and to protect
against any further breaches; and
(e) Contact procedures for individuals to ask questions or learn
additional information, which shall include a toll-free telephone
number, an email address, Web site, or postal address.
Sec. 318.7 Enforcement.
A violation of this Part shall be treated as an unfair or deceptive
act or practice in violation of a regulation under Sec. 18(a)(1)(B) of
the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding
unfair or deceptive acts or practices.
Sec. 318.8 Effective date.
This Part shall apply to breaches of security that are discovered
on or after September 24, 2009.
Sec. 318.9 Sunset.
If new legislation is enacted establishing requirements for
notification in the case of a breach of security that apply to entities
covered
[[Page 42982]]
by this Part, the provisions of this Part shall not apply to breaches
of security discovered on or after the effective date of regulations
implementing such legislation.
By direction of the Commission.
Donald S. Clark,
Secretary.
Note: The following attachment will not appear in the Code of
Federal Regulations.
BILLING CODE 6750-01-S
[[Page 42983]]
[GRAPHIC] [TIFF OMITTED] TR25AU09.000
[[Page 42984]]
[GRAPHIC] [TIFF OMITTED] TR25AU09.001
[[Page 42985]]
[GRAPHIC] [TIFF OMITTED] TR25AU09.002
[FR Doc. E9-20142 Filed 8-24[dash]
BILLING CODE 6750-01-C