§17937 Temporary Breach Notification Requirement for Vendors of Personal Health Records and Other Non-hipaa Covered Entities

Summary

Vendors who run personal health record systems must tell each U.S. citizen or resident whose unsecured PHR identifiable health information was accessed by someone without permission. They must also tell the Federal Trade Commission. Other entities listed in section 17953(b)(1)(A)(ii)–(iv) must do the same when the breach involves information they got through a product or service. A third-party service provider who handles or sees PHR information while helping a vendor must tell that vendor if a breach happens and must identify the people affected. The FTC will tell the Department of Health and Human Services (the Secretary) when it gets a breach notice. Failing to follow these duties is treated as an unfair or deceptive act under section 57a(a)(1)(B) of title 15. The FTC had to issue interim final rules by not later than 180 days after February 17, 2009, and the rules apply to breaches found 30 days after those rules are published. If Congress later creates new notification rules for non‑HIPAA entities, those new rules replace this section for breaches found on or after the new rules’ effective date. Definitions (one line each): Breach of security — someone gets PHR identifiable health information without the person’s permission. PHR identifiable health information — individually identifiable health information, including information given by or for the person that identifies them or could reasonably be used to identify them. Unsecured PHR identifiable health information — PHR information not protected by the technology or standards the Secretary specifies under section 17932(h)(2); if the Secretary hasn’t issued that guidance by the date in 17932(h)(2), it means information not protected by an ANSI‑accredited standard that makes the data unreadable, unusable, or indecipherable to unauthorized people.