Lisa Pierce Reisz, Member of the Firm in the Health Care & Life Sciences practice, in the firm’s Columbus office, was quoted in Renal+Urology News, in “New Health Apps May Pose Challenges to Patient Privacy,” by John Schieszer, MA.
Following is an excerpt:
The popularity of health apps raises significant issues in terms of patient privacy. HIPAA rules apply when protected health information (PHI) is created, received, maintained, or transmitted by covered entities (such as health plans and most healthcare providers) and business associates (such as individuals and companies that provide certain services for covered entities). HIPAA rules, however, generally do not protect the privacy or security of a patient’s health information when it is created through or stored on personal cell phones or tablets, or fitness trackers. The rules do not protect the privacy of an individual’s internet search history, information an individual voluntarily shares online, or an individual’s geographic location information. …
A Valuable Cybercriminal Target
According to data analyzed by the cybersecurity company NordLayer, more than 45 million patients had their information exposed in the first half of 2024 because healthcare organizations have become one of the most targeted industries by cybercriminals. The sensitive data stored at these institutions is valuable to hackers because it includes such information as social security numbers, names, home addresses, and health history. Cybercriminals can use this information to create believable phishing emails or sell it online to steal your identity, according to NordLayer, which provides network security for businesses of all sizes.
Lisa Pierce Reisz, a member of the law firm Epstein Becker Green in Columbus, Ohio, said healthcare providers or health plans that create or offer health apps to their patients or members must be aware of how these apps are collecting, using, storing, and guarding PHI. Similarly, developers who are creating health apps for a covered entity are likely to be that entity’s business associate and will have their own HIPAA obligations.
“Further, these particular health app developers should be building privacy and security protections into their apps that meet the standards required by HIPAA,” Reisz said. “Ongoing vigilance regarding uses and disclosures of PHI, especially with respect to innovative technology such as health apps, should be a hallmark of each provider or health plan’s HIPAA compliance program.”
Ensuring that health apps created or offered by a HIPAA-covered entity are actually baked into the covered entity’s HIPAA compliance plan can be challenging, she noted. “It requires that the practice identify which technologies have been adopted, ensure that the practice has done some due diligence to ensure that the health app has been developed in a HIPAA-compliant manner, and understands how the health app collects, uses, and discloses PHI,” Reisz said.
