§17937 Temporary Breach Notification Requirement for Vendors of Personal Health Records and Other Non-hipaa Covered Entities

Summary

Vendors who run personal health record systems must tell each U.S. citizen or resident whose unsecured personal health record (PHR) data was taken without permission. They must also tell the Federal Trade Commission (FTC). Companies that provide products or services tied to those PHRs and that discover a breach must do the same. If a third‑party contractor who works on a PHR finds a breach, that contractor must tell the vendor or other responsible company and must say who was affected. Not telling people or the vendor is treated as an unfair or deceptive practice under section 57a(a)(1)(B) of title 15. When the FTC gets a breach notice, it will tell the Secretary. A "breach" means someone got the PHR data without permission. "PHR identifiable health information" means health data that identifies a person or could reasonably be used to identify them, including data the person or someone else gave. "Unsecured" means the data is not protected by the technology the Secretary requires, or if the Secretary has not issued guidance by the required date, not protected by an ANSI‑accredited standard that makes the data unreadable to others. The FTC had to issue interim final rules by 180 days after February 17, 2009, and the rule applies to breaches found 30 days after those rules are published. If Congress later creates a new law covering non‑covered entities, those new rules replace these rules from their effective date.