FTC Seeks Changes to Protect Consumer Health Information
The Federal Trade Commission (“FTC”) is urging Congress to ensure the data brokerage industry becomes more transparent and accountable, which could change the way consumers’ personal, health-related information is gathered and shared. These recommendations may change the landscape of the HIPAA regulations to better ensure protection of sensitive health information.
On May 27, 2014, the FTC released a report based upon its comprehensive study of nine data brokers, ranging in size and prominence in the community. Data brokers make millions of dollars each year collecting and disseminating massive amounts of personal, sensitive information they have obtained from consumers. This affects nearly every consumer in the United States, and the current laws in place do not effectively regulate data brokers or their access to consumer information, especially when it comes to individuals’ health-related information.
The FTC report references sensitive issues that could affect health law down the road. Even though Congress has previously placed stringent privacy protections on health-related data, there are some clear gaps in the laws, especially since data brokers are not covered entities under HIPAA. This has allowed data brokers to obtain private health-related information, concerning a variety of conditions and diseases, including AIDS, addiction, and mental health diagnoses. The information is then shared with the data brokers’ clients who could potentially use this information negatively against the consumer.
In examining the practices and procedures of nine sample data brokers, the FTC found that data brokers easily obtain large amounts of personal information from a wide variety of sources, including government agencies, social media sites, retailers, registration websites, and especially other data brokers, which is then all compiled and shared with or sold to other companies.
Most consumers are unaware that data brokers have obtained and sold their personal information. Even if a consumer had some knowledge, the intricate and multiple layers of information-sharing make it nearly impossible for the consumer to figure out how the information was obtained in the first place, correct any mistakes, or prevent the information from being shared. Additionally, these companies obtain raw data involving both sensitive and non-sensitive information, and then use this information to predict consumer behavior.
The FTC’s recommendations would give consumers better access to their personal data, and allow them to either correct any erroneous information obtained by data brokers or keep this information from being shared with others. The FTC urges data brokers to assess their own practices and incorporate the recommendations of the FTC on their own.
The FTC report may be viewed here.
Lindsay Zanello contributed this post. For more information about HIPAA and related issues, please contact Caitlin Monjeau.