Which federal rules govern health data in advertising?
Part of US and Canada targeting
The short answer
Two federal regimes set the rules. HIPAA, enforced by the HHS Office for Civil Rights, bars covered entities and business associates from disclosing protected health information to tracking vendors for marketing without authorization. The FTC's Health Breach Notification Rule treats an unauthorized disclosure of identifiable health data by apps and other non-HIPAA services as a breach that requires notice.
Key takeaways
- The FTC finalized amendments to the Health Breach Notification Rule on April 26, 2024, confirming that it covers health apps and that a breach includes an unauthorized disclosure, not only a hack.
- HHS says disclosures of protected health information to tracking technology vendors for marketing, without HIPAA compliant authorizations, are impermissible disclosures.
- A federal court in Texas vacated part of the HHS guidance on June 20, 2024: the part about an IP address combined with a visit to an unauthenticated public page on health conditions.
What US federal rules apply to health data in advertising?
Federal health privacy splits by who holds the data. Hospitals, clinics, health plans and their business associates fall under HIPAA, enforced by the HHS Office for Civil Rights. Health apps, connected devices and websites outside HIPAA fall under the Federal Trade Commission, through Section 5 of the FTC Act and the Health Breach Notification Rule (opens in a new tab) at 16 CFR part 318. The FTC's guide states the boundary: "You're not a vendor of personal health records if you're covered by HIPAA."
| Question | HIPAA (HHS Office for Civil Rights) | Health Breach Notification Rule (FTC) |
|---|---|---|
| Who it covers | Covered entities such as hospitals, doctors and health plans, and their business associates | Vendors of personal health records, PHR related entities and third party service providers not covered by HIPAA |
| Protected data | Protected health information, which starts with individually identifiable health information | PHR identifiable health information in a personal health record |
| Advertising rule | Disclosing PHI to a tracking vendor for marketing needs a HIPAA compliant authorization | Sharing covered data without the person's authorization is a breach of security |
State law sits on top of both. Washington's consumer health data statute has its own page, My Health My Data Act and advertising, and prescription drug promotion has a separate FDA regime, explained in direct to consumer pharmaceutical advertising.
What does the FTC Health Breach Notification Rule cover?
The rule dates from 2009. On April 26, 2024 the FTC announced final amendments (opens in a new tab) that underscore its "application to health apps and similar technologies not covered by HIPAA," and that state a breach includes "a data security breach or an unauthorized disclosure." The rule took effect 60 days after Federal Register publication, which the FTC's rule page lists as May 30, 2024.
Definition
- Personal health record (PHR)
- Under 16 CFR 318.2 (opens in a new tab), "an electronic record of PHR identifiable health information on an individual that has the technical capacity to draw information from multiple sources and that is managed, shared, and controlled by or primarily for the individual."
The amended definitions reach far into consumer tech. Health care services or supplies now means "any online service such as a website, mobile application, or internet-connected device that provides mechanisms to track diseases, health conditions, diagnoses or diagnostic testing, treatment, medications, vital signs, symptoms, bodily functions, fitness, fertility, sexual health, sleep, mental health, genetic information, diet," or other health tools. The FTC's guide says a diet app that takes user entered weights and pulls calorie counts from restaurant menus likely has a covered PHR.
| Who must be told | Trigger | Deadline |
|---|---|---|
| Affected individuals | Any breach of security of unsecured PHR identifiable health information | Without unreasonable delay and within 60 calendar days after discovery |
| The FTC, larger breach | 500 or more people affected | At the same time as individuals, no later than 60 calendar days after discovery |
| The FTC, smaller breach | Fewer than 500 people affected | Within 60 calendar days after the end of the calendar year |
| Prominent media outlets | At least 500 residents of one state, the District of Columbia or a US territory | Within 60 calendar days, in addition to individual notice |
What did HHS say about tracking technologies?
The HHS Office for Civil Rights bulletin, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (opens in a new tab), last reviewed June 26, 2024, defines a tracking technology as "a script or code on a website or mobile app used to gather information about users or their actions as they interact with a website or mobile app." It names cookies, pixels, session replay and fingerprinting scripts, and app device or advertising IDs.
For example, disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures.
| Location | What the bulletin says | Example it gives |
|---|---|---|
| User authenticated pages, such as a patient portal | Tracking technologies there generally have access to PHI | Appointment details and an IP address sent to a vendor when a patient books through a clinic website |
| Unauthenticated pages | Not regulated by the HIPAA Rules when the tag has no access to PHI; regulated when it does | A symptom checker or appointment form that collects an email address or the reason for a visit |
| A regulated entity's mobile app | Information collected by the app generally is PHI | A clinic's diabetes app tracking glucose levels and insulin doses |
What has federal enforcement looked like?
Two FTC cases set the pattern for advertising. On February 1, 2023 the FTC said it had taken enforcement action for the first time (opens in a new tab) under the Health Breach Notification Rule, against the prescription discount company GoodRx, which agreed to a $1.5 million civil penalty. The proposed order would permanently bar it from "disclosing user health information with applicable third parties for advertising purposes."
On July 14, 2023 the FTC gave final approval (opens in a new tab) to an order against the online counseling service BetterHelp, which it alleged disclosed "email addresses, IP addresses, and health questionnaire information" to advertising platforms despite promising limited use. BetterHelp paid $7.8 million for partial refunds, and the order bans disclosing health data for advertising and sharing personal information for re-targeting, and requires a privacy program and a data retention schedule.
Do health rules apply to contextual placements?
Neither regime mentions contextual placement. HIPAA turns on protected health information held by a regulated entity, and the FTC rule turns on PHR identifiable health information, information about an individual's health that identifies them or could reasonably be used to. Choosing an article about blood pressure for an ad is a decision about a page. The open question is what data about people moves alongside it.
The HHS bulletin draws that line with its own examples. A student researching oncology services for a term paper who visits a hospital page does not trigger a PHI disclosure, while a person seeking a second opinion on a brain tumor on the same page does, to the extent the information is identifiable and related to their health. The June 2024 order vacated the IP address plus public page theory, which leaves portals, forms and apps in scope.
Data points in a health campaign that the federal rules reach
- Tags and pixels on the advertiser's own pages that pass appointment, symptom or condition details to a third party.
- Software development kits inside a health app that send events tied to a device ID or advertising ID.
- Customer lists or audience uploads built from health app users, patients or plan members.
- Conversion events that name a condition, a medication or a test in the event label.
A site list chosen from the meaning of public articles, with no identifiers attached, sits apart from those points. IP address treatment under other laws is covered in IP addresses as personal information, and the cross-border picture on the US and Canada audience targeting hub.
What should health advertisers document?
The federal texts point to specific records: business associate agreements and authorizations under the HHS bulletin, reliable evidence to rebut a presumed breach under the FTC rule, and the data retention schedule the BetterHelp order imposed.
Records the federal rules and orders refer to
- Map the tags. List each tracking technology on authenticated pages, unauthenticated forms and apps, since the HHS bulletin treats each location differently.
- Keep the agreements. File each business associate agreement and the Privacy Rule permission behind each disclosure of PHI to a vendor.
- Keep the authorizations. Hold the HIPAA compliant authorizations behind any marketing disclosure, apart from cookie banner choices.
- Record app data flows. For a health app outside HIPAA, record which third parties receive identifiable health information and on what authorization from the user.
- Date the retention rules. Write down how long personal and health information is kept, the duty the BetterHelp order imposed.
Fictional example
A blood pressure tracking app advertising in Nevada
An unnamed app that pairs with home blood pressure cuffs and imports step counts from a fitness wearable plans display and video ads in Las Vegas and Reno, Nevada. The app draws data from more than one source and sits outside HIPAA, so its planner reads the Health Breach Notification Rule's definitions first.
The media plan uses a site list of heart health, home cooking and walking club pages chosen by page content. The app team separately removes a condition name from the conversion event its software kit sends to an ad platform and records which partners receive in app events.
How does PlacementGraph plan health placements without personal data?
Frequently asked questions
Is a fitness or sleep tracking app covered by the Health Breach Notification Rule?
It can be. The amended definition of health care services or supplies names online services that track fitness, sleep, diet, fertility, vital signs and mental health. Coverage also needs a personal health record that can draw information from multiple sources, held by an entity not covered by HIPAA.
Does a cookie consent banner count as a HIPAA authorization?
The HHS bulletin says website banners that ask users to accept or reject tracking technologies such as cookies do not constitute a valid HIPAA authorization, and that a privacy policy announcing planned disclosures does not by itself permit disclosing PHI to a tracking vendor.
Does the Health Breach Notification Rule apply to hospitals?
The FTC's guide says the rule does not apply to HIPAA covered entities such as a hospital, doctor's office or health insurance company. A business acting solely as a HIPAA business associate falls under the HHS Breach Notification Rule instead, and HIPAA's own tracking rules still apply to it.
Can a tracking vendor fix the problem by de-identifying data after it arrives?
The HHS bulletin says it is insufficient for a tracking technology vendor to agree to remove PHI or de-identify it before saving it. A disclosure without authorization needs a signed business associate agreement and an applicable Privacy Rule permission.
Sources
- Complying with FTC's Health Breach Notification Rule (opens in a new tab)Federal Trade Commission
- FTC Finalizes Changes to the Health Breach Notification Rule (opens in a new tab)Federal Trade Commission
- 16 CFR 318.2, Definitions (Health Breach Notification Rule) (opens in a new tab)Legal Information Institute, Cornell Law School
- Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (opens in a new tab)US Department of Health and Human Services, Office for Civil Rights
- FTC Enforcement Action to Bar GoodRx from Sharing Consumers' Sensitive Health Info for Advertising (opens in a new tab)Federal Trade Commission
- FTC Gives Final Approval to Order Banning BetterHelp from Sharing Sensitive Health Data for Advertising (opens in a new tab)Federal Trade Commission
- Health Breach Notification Rule (opens in a new tab)Federal Trade Commission
Researched and written by PlacementGraph Research. Read how we research, source and update these pages. Corrections: diana@placementgraph.com.