On May 12, 2025, President Trump issued an Executive Order titled “Delivering Most-Favored-Nation Prescription Drug Pricing to American Patients” and an accompanying “Fact Sheet: President Donald J. Trump Announces Actions to Put American Patients First by Lowering Drug Prices and Stopping Foreign Free-riding on American Pharmaceutical Innovation
Continue Reading Trump Administration Issues Executive Order on “Most-Favored-Nation” Prescription Drug Pricing
HHS Modifies Privacy Rule to Support Reproductive Health Care Privacy
On April 26, 2024, the Office for Civil Rights (“OCR”) at the U.S. Department of Health & Human Services (“HHS”) published a final rule that modifies the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”) under the Health Insurance Portability and Accountability Act (“HIPAA”) regarding protected health information (“PHI”) concerning reproductive health. We previously covered the proposed rule (hereinafter, “the NPRM”), which was published on April 17, 2023. The final rule aligns closely with the NPRM.
OCR noted that the Supreme Court’s ruling in Dobbs v. Jackson Women’s Health Organization (holding that there is no constitutional right to abortion) created a legal landscape that “increase[s] the potential that use and disclosure of PHI about an individual’s reproductive health will undermine access to and the quality of health care generally.” According to OCR, the final rule aims to “continue to protect privacy in a manner that promotes trust between individuals and health care providers and advances access to, and improves the quality of, health care” by “limit[ing] the circumstances in which provisions of the Privacy Rule permit the use or disclosure of an individual’s PHI about reproductive health care for certain non-health care purposes.”
The final rule prohibits a regulated entity from using or disclosing an individual’s PHI:
- to conduct a criminal, civil, or administrative investigation into or impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care that is lawful under the circumstances in which it is provided; and
- to identify an individual, health care provider, or other person to initiate an investigation or proceeding against that person in connection with seeking, obtaining, providing, or facilitating reproductive health care that is lawful under the circumstances in which it is provided.
“Lawful under the circumstances in which it is provided” means that the reproductive health care is either:
- lawful under the circumstances in which the health care is provided and in the state in which it is provided; or
- protected, required, or authorized by Federal law, including the United States Constitution, regardless of the state in which such health care is provided.
Continue Reading HHS Modifies Privacy Rule to Support Reproductive Health Care Privacy
FTC Issues Final Rule to Expand Scope of the Health Breach Notification Rule
On Friday, April 26, 2024, the Federal Trade Commission (“FTC”) voted 3-2 to issue a final rule (the “final rule”) that expands the scope of the Health Breach Notification Rule (“HBNR”) to apply to health apps and similar technologies and broadens what constitutes a breach of security, among other updates. We previously covered the proposed rule, which was issued on May 18, 2023.
In the FTC’s announcement of the final rule, the FTC emphasized that “protecting consumers’ sensitive health data is a high priority for the FTC” and that the “updated HBNR will ensure [the HBNR] keeps pace with changes in the health marketplace.” Key provisions of the final rule include:
- Revised definitions: The final rule includes changes to current definitions in the HBNR that codify the FTC’s recent position on the expansiveness of the HBNR. Specifically, among other definition changes, the HBNR contains key updates to the definitions of:
- “Personal health records (‘PHR’) identifiable information.” In the final rule, the FTC adopts changes to the definition of PHR identifiable information that were included in the proposed rule to clarify that the HBNR applies to health apps and other similar technologies not covered by the Health Insurance Portability and Accountability Act, as amended, and its implementing regulations (collectively, “HIPAA”). In the final rule, the FTC discusses the scope of the definition, noting that “unique, persistent identifiers (such as unique device and mobile advertising identifiers), when combined with health information constitute ‘PHR identifiable health information’ if these identifiers can be used to identify or re-identify an individual.”
- “Covered health care provider.” In the proposed rule, the FTC proposed adding a definition of “health care provider” to include providers of medical or other health services, or any other entity furnishing “health care services or supplies” (i.e., websites, apps, and Internet-connected devices that provide mechanisms to track health conditions, medications, fitness, sleep, etc.). The final rule does not make substantive changes to this proposed definition but does contain a slight terminology change to “covered health care provider” to distinguish that term from the definition of “health care provider” in other regulations.
Continue Reading FTC Issues Final Rule to Expand Scope of the Health Breach Notification Rule
HHS Issues Notice of Expiration of COVID-19 HIPAA Enforcement Discretion
By Libbie Canter, Anna D. Kraus, Olivia Vega, Elizabeth Brim & Jorge Ortiz on April 14, 2023
On April 11, the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”) announced that four Notifications of Enforcement Discretion (“Notifications”) that were issued under the Health
Continue Reading HHS Issues Notice of Expiration of COVID-19 HIPAA Enforcement DiscretionFTC Announces First Enforcement Action Under Health Breach Notification Rule
On February 1, the Federal Trade Commission (“FTC”) announced its first-ever enforcement action under its Health Breach Notification Rule (“HBNR”) against digital health platform GoodRx Holdings Inc. (“GoodRx”) for failing to notify consumers and others of its unauthorized disclosures of consumers’ personal health information to third-party advertisers. According to the proposed order, GoodRx will pay a $1.5 million civil penalty and be prohibited from sharing users’ sensitive health data with third-party advertisers in order to resolve the FTC’s complaint.
This announcement marks the first instance in which the FTC has sought enforcement under the HBNR, which was promulgated in 2009 under the Health Information Technology for Economic and Clinical Health (“HITECH”) Act, and comes just sixteen months after the FTC published a policy statement expanding its interpretation of who is subject to the HBNR and what triggers the HBNR’s notification requirement. Below is a discussion of the complaint and proposed order, as well as key takeaways from the case.
The Complaint
As described in the complaint, GoodRx is a digital healthcare platform that advertises, distributes, and sells health-related products and services directly to consumers. As part of these services, GoodRx collects both personal and health information from its consumers. According to the complaint, GoodRx “promised its users that it would share their personal information, including their personal health information, with limited third parties and only for limited purposes; that it would restrict third parties’ use of such information; and that it would never share personal health information with advertisers or other third parties.” The complaint further alleged that GoodRx disclosed its consumers’ personal health information to various third parties, including advertisers, in violation of its own policies. This personal health information included users’ prescription medications and personal health conditions, personal contact information, and unique advertising and persistent identifiers.Continue Reading FTC Announces First Enforcement Action Under Health Breach Notification Rule
OCR Seeks Comments Related to Recognized Security Practices and Distribution of Civil Monetary Penalties under the HITECH Act
In a new post on the Covington Digital Health blog, our colleagues discuss the Office for Civil Rights’ (“OCR”) recently published request for information (“RFI”) seeking comment on implementing certain provisions of the Health Information Technology for Economic and Clinical Health (“HITECH”) Act. The RFI seeks input as to
Continue Reading OCR Seeks Comments Related to Recognized Security Practices and Distribution of Civil Monetary Penalties under the HITECH Act
Trump Administration Releases, Revokes, and Reissues “Most-Favored-Nation” Executive Order
The Trump Administration has released the much-anticipated executive order entitled “Lowering Drug Prices by Putting America First” (commonly referred to as the “Most-Favored-Nation” or “MFN” executive order). President Trump initially had announced the MFN executive order during his July 24, 2020 press conference highlighting four separate executive orders
Continue Reading Trump Administration Releases, Revokes, and Reissues “Most-Favored-Nation” Executive Order
HHS Relaxes Enforcement of Certain HIPAA Provisions Amidst COVID-19 Nationwide Public Health Emergency
Covered Health Care Providers
On March 17, 2020, the Department of Health and Human
Continue Reading HHS Relaxes Enforcement of Certain HIPAA Provisions Amidst COVID-19 Nationwide Public Health Emergency
Senators Introduce Legislation to Regulate Privacy and Security of Wearable Health Devices and Genetic Testing Kits
Last week, Senators Amy Klobuchar (D-MN) and Lisa Murkowski (R-AK) introduced the Protecting Personal Health Data Act (S. 1842), which would provide new privacy and security rules from the Department of Health and Human Services (“HHS”) for technologies that collect personal health data, such as wearable fitness trackers
Trump Order Relating to Affordable Care Act
On January 20, 2017, President Donald J. Trump signed an Executive Order instructing federal agencies to work to “minimize the unwarranted economic and regulatory burdens” of the Affordable Care Act (“ACA”), and to increase the flexibility provided to States to run healthcare programs. While the Executive Order itself does not
Continue Reading Trump Order Relating to Affordable Care Act