§17937 Temporary breach notification requirement for vendors of personal health records and other non-HIPAA covered entities

Summary

Vendors that run personal health record (PHR) websites or services must tell each U.S. person whose unsecured PHR health information was taken without permission. They also must tell the Federal Trade Commission (FTC). If a company that provides services to a PHR vendor (a third‑party service provider) finds a breach, it must tell the vendor or other responsible entity and say which people’ information was involved. A breach means someone got the PHR health information without the person’s OK. PHR identifiable health information means health details tied to a person or given by the person. “Unsecured” means the information is not protected by the security method the Secretary of Health sets, or if the Secretary hasn’t issued that guidance, not protected by an ANSI‑accredited standard that makes the data unreadable to others. The FTC must make interim final rules to run this program no later than 180 days after February 17, 2009. The breach rules apply to breaches found 30 days after those rules are published. When the FTC gets a breach notice it must tell the Secretary of Health. Breaking these notice duties is treated as an unfair or deceptive practice under federal consumer‑protection law. If Congress later passes a new law with notification rules for non‑HIPAA entities, those new rules will replace these ones for breaches found after the new rules take effect.