The State of Health Data Privacy, and the Growth of Wearables and Wellness Apps

More than ever before, the capability for individuals to track and improve their own health is widely and publicly available. With wearable technology and wellness apps, a person can generate and study health data that before could only adequately be obtained by visiting a physician and undergoing tests. This technology also creates more ways for scientists, researchers, and health care providers to monitor and improve public health. Wearables and wellness apps however, despite their possible beneficial uses, are part of a growing trend in which more and more health information is being generated than can effectively be regulated. Many of the companies behind the technologies creating and capturing this data sit outside of HIPAA’s purview, which only applies to entities that are providing health care services, transmitting health information for those services, or helping an entity to do so. In this largely unregulated space, wearable and wellness app companies have little restriction on what they can or cannot do with consumer data. While the European Union, as well as a small handful of States, have taken steps to regulate data privacy, the United States currently does not have an effective legislative scheme to regulate and protect the wide range of health data and information that these wearables and wellness apps are generating. To provide individuals with control over their own personal and health related information, the United States needs to create a legislative and administrative background that can adequately ensure consumer protection, while still fostering innovation and scientific research. To do so, the United States should mirror the European Union, and adopt a federal data privacy and protection policy that creates a baseline standard that applies in every state. As part of this policy, individuals should be afforded more ownership and transparency with their own data, and privacy protections should be subject to the type of data itself, not the entity that is creating and/or processing it