"Maybe" is the take-away from recent guidance posted on OCR's mHealth Developer Portal, making me wonder whether the typical health app user will know when her health information is or is not subject to HIPAA protection.
The guidance is clear and straightforward and contains no real surprises to those of us familiar with HIPAA, but it highlights the reality that HIPAA, originally enacted close to 20 years ago, often becomes murky in the context of today's constantly developing technology. Here's an excerpt from the guidance that illustrates this point:
Consumer downloads to her smart phone a mobile PHR app offered by her health plan that offers users in its network the ability to request, download and store health plan records. The app also contains the plan's wellness tools for members, so they can track their progress in improving their health. Health plan analyzes health information and data about app usage to understand the effectiveness of its health and wellness offerings. App developer also offers a separate, direct-to-consumer version of the app that consumers can use to store, manage, and organize their health records, to improve their health habits and to send health information to providers.
Is the app developer a business associate under HIPAA, such that the app user's information is subject to HIPAA protection?
Yes, with respect to the app offered by the health plan, and no, when offering the direct-to-consumer app. Developer is a business associate of the health plan, because it is creating, receiving, maintaining, or transmitting protected health information (PHI) on behalf of a covered entity. Developer must comply with applicable HIPAA Rules requirements with respect to the PHI involved in its work on behalf of the health plan. But its "direct-to-consumer" product is not provided on behalf of a covered entity or other business associate, and developer activities with respect to that product are not subject to the HIPAA Rules. Therefore, as long as the developer keeps the health information attached to these two versions of the app separate, so that information from the direct-to-consumer version is not part of the product offering to the covered entity health plan, the developer does not need to apply HIPAA protections to the consumer information obtained through the "direct-to-consumer" app.
So if I download this app because my health plan offers it, my PHI should be HIPAA-protected, but what if I inadvertently download the "direct-to-consumer" version? Will it look different or warn me that my information is not protected by HIPAA? Will the app developer have different security controls for the health plan-purchased app versus the direct-to-consumer app?
HIPAA only applies to (and protects) individually identifiable health information created, received, maintained or transmitted by a covered entity or business associate, so perhaps health app users should be given a "Notice of Non-(HIPAA) Privacy Practices" before inputting health information into an app that exists outside the realm of HIPAA protection.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
