Data Privacy and Security Considerations for Mobile Health App Developers and Their Counsel

OCR Guidance

OCR recently released guidance aimed at health care providers covered by the HIPAA Privacy Rule and their business associates. It clarifies that while the Privacy Rule permits certain disclosures of protected health information (PHI) without an individual's authorization that are not directly related to health care, these disclosures are subject to certain limitations. In particular, a disclosure of PHI that is required by another law is limited to "a mandate contained in law that compels an entity to make a use or disclosure of PHI and that is enforceable in a court of law," and the entity can only disclose the information that is required to be disclosed under that law. The guidance also addresses disclosures for law enforcement purposes (generally such a disclosure would be a breach of unsecured PHI unless it is made pursuant to "a court order or other mandate enforceable in a court of law"), as well as permitted disclosures made to avert a serious threat to health or safety (generally, these would not include disclosures concerning an individual's interest in or attempt to receive an abortion or other reproductive health care).