Consumer Privacy Laws and Healthcare Entities: Regulatory Updates, Covered Entities, Scope of HIPAA Exemptions

Description

With a number of states already having comprehensive privacy laws in effect, a few states with comprehensive privacy laws enacted and soon to be in effect, many states with consumer privacy laws soon-to-be-enacted, and additional states considering similar types of legislation, companies and counsel should be aware of how these laws will affect their businesses and the management of collected consumer data.

Companies that process health data should pay special attention because these laws contain nuanced exemptions for entities covered by HIPAA, often apply to entities that fall outside the purview of HIPAA, and create special obligations for entities that process “sensitive” data (which often includes various categories of health information). Such health data companies should also be aware of new laws specifically focused on regulating consumer health data (such as Washington’s My Health My Data Act) and increased focus and attention by the Federal Trade Commission on this issue.

The state laws in question have varying threshold requirements determining coverage. For example, some state laws only provide information-level exemptions for entities that process protected health information regulated under HIPAA (such as the California Consumer Privacy Act and the My Health My Data Act), while others provide entity-level exemptions for covered entities and business associates. Others only regulate certain categories of health information (such as diagnosis information), while others are much broader in scope.

It is important for companies that process health data to be aware of these differences as they develop their compliance programs. Companies that process health data that may fall outside of HIPAA, such as pharmaceutical manufacturers, medical device companies, and consumer-directed digital health companies, should pay particular attention to these issues.

Listen as our expert panel guides practitioners through the maze of current and upcoming consumer privacy laws and their impact on healthcare entities. The panel will provide an overview of the laws, including similarities, key differences, how and when relevant exemptions may apply, and best practices for compliance.