• by Wendy Davis  @wendyndavis, October 3, 2023

Congress shouldn't extend the federal health privacy law, which restricts health care professionals from disclosing consumers' data, to health apps or fitness trackers, the self-regulatory privacy group Network Advertising Initiative says.

Instead, the organization is urging lawmakers to pass legislation that will “create a uniform national framework to protect consumers’ personal information.”

“This approach is the best way to provide greater protections for all Americans and can protect health information not currently covered by HIPAA (the Health Insurance Portability and Accountability Act),” the group writes.

NAI's comments come in response to a request by U.S. Senator Bill Cassidy (R-Louisiana) for input into potential updates to HIPAA, which protects medical patients' privacy.

That law currently restricts health care professionals and hospitals from disclosing patients' data, but doesn't generally apply to other businesses -- even when they collect health-related data.

Cassidy wrote in his request for comments that since HIPAA was passed in 1996, new technologies including wearables and apps “have expanded the creation and collection of health data.”

“While these technologies have enabled better care and greater patient access to health information, much of this data is not protected by the HIPAA framework,” he wrote.

He sought comments on a broad array of questions, including whether Congress should expand HIPAA's scope.

NAI argues lawmakers should pass a law that would “focus on preventing harmful outcomes, rather than creating broad limitations on access or uses of health information.”

“We agree that a lot of that data is sensitive,” David LeDuc, vice president for public policy at NAI, says, referring to information collected by wearables and other technology.

"But we don't think the best approach is to deal with that under an expanded HIPAA," he adds.

The organization also writes that Congress should promote “data-driven health advertising,” arguing it benefits consumers and health care professionals.

“Data-driven health advertising helps consumers by connecting them with health information that is more relevant to them,” NAI writes. “Health-related advertising can drive early awareness of health conditions and treatments -- and the earlier a person is made aware of a relevant condition or treatment, the greater their opportunity to secure a positive health outcome.” 

The group's code of conduct requires members to obtain consumers' explicit consent before collecting health data it defines as “sensitive” -- including information from medical records or pharmacies about medical conditions, as well as any information or inferences about certain conditions like cancer or mental health conditions.

Others are calling for more expansive health privacy laws. The advocacy group Electronic Privacy Information Center said in its response that Congress should require companies to limit their collection and processing of health information “to what is strictly necessary.”

“Placing this obligation on businesses and health care providers -- rather than on overwhelmed consumers -- would provide meaningful, systemic privacy protection,” EPIC writes.