The Federal Trade Commission has rescinded a Biden administration-era policy statement that covered health and fitness apps under federal data breach notification regulations.
In a half-page statement posted Wednesday, the FTC said it “has determined that the statement – contentious at the time of issuance – provided minimal benefit and has been superseded by rulemaking.” The commission said the statement’s withdrawal also aligns with guidance from the White House to pursue a deregulatory agenda and avoid “unnecessary use of subregulatory guidance.”
“Each of these reasons is independently sufficient to support the Commission’s decision to rescind this policy statement,” the FTC continued. “Parties understand that guidance generally creates neither substantive rights nor binding obligations.”
The initial policy, passed in a divided 3-2 vote during the Biden administration under then-FTC chair Lina Khan, added health apps, fitness trackers and other connected devices to an existing regulation requiring companies to disclose health-related data breaches to customers.
The changes would cover any “vendor of personal health records that contain individually identifiable health information created or received by health care providers.” Many health and fitness apps ask users to upload medical records and other health-related data in order to function effectively.
More recently, health and cybersecurity experts have pointed to similar regulatory gaps that exist for AI companies that make healthcare specific models that can answer questions, examine patient records and dispense medical advice to users.