In compliance with the American Recovery and Reinvestment Act, the Federal Trade Commission has issued a proposed rule that would require personal health record vendors and related groups to notify customers if their identifiable health information is breached, Health Data Management reports.
FTC is seeking public comment on the proposed rule through June 1.
ARRA requires HHS and FTC to publish a study on potential privacy, security and breach notification requirements for PHR vendors and related entities by February 2010. In the meantime, the law requires FTC to issue an interim final rule by August.
FTC plans to develop the interim final rule following the conclusion of the public comment period on the proposed rule (Goedert, Health Data Management, 4/16).
Many states already have notification requirements for breaches of computerized personal data, including health care information. However, ARRA would establish a federal breach notification requirement, requiring PHR vendors to notify FTC and "each individual who is a citizen or resident of the United States whose unsecured PHR identifiable health information was acquired by an unauthorized person as a result of such a breach of security" (Conn, Modern Healthcare, 4/16).