Fox News Flash top headlines are here. Check out what's clicking on FoxNews.com.
Every morning, you strap on the cuff, press the button and watch the number pop up on your phone. It feels private. It feels like it is just between you and your app. That sense of privacy can be misleading.
Depending on the app and your settings, that reading, along with your glucose numbers, weight and medication schedule, may be stored in the cloud or shared with service providers. FTC cases show that some health apps have also disclosed sensitive information to advertising and analytics companies. Separately, data brokers market health-related profiles that scammers could exploit.
Here's what may be happening behind the screen of your health app and how to limit the exposure.
CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist
Our free CyberGuy Live class, "Sick of Spam?" has ended, but you can still watch the full replay and download our spam-stopping checklist. Kurt "CyberGuy" Knutsson walks you step by step through simple ways to reduce robocalls, spam texts, junk email and unwanted messages. You’ll also learn how to curb political texts, clean up your inbox and spot messages that could put your personal information at risk.
Get the free replay and checklist now at CyberGuyLive.com.
A home blood pressure monitor can send sensitive health readings to a connected app, where privacy protections may vary. (Kurt "CyberGuy" Knutsson)
Here's the assumption almost everyone makes: "My health data is protected. Isn't that what HIPAA is for?" Often, no.
HIPAA generally protects health information held by covered healthcare providers, health plans and their business associates. A consumer app you choose independently often falls outside HIPAA. However, an app may come under HIPAA when it handles protected health information on behalf of a covered provider or health plan.
Apps outside HIPAA do not operate without any rules. Many may still fall under the FTC's Health Breach Notification Rule, state consumer health laws and general protections against unfair or deceptive business practices.
Sen. Bill Cassidy, R-La., introduced the Health Information Privacy Reform Act. The proposal would extend HIPAA-like privacy, security and breach-notification standards to some health information held outside the traditional HIPAA system. It would also require plain-language warnings before certain technologies begin generating wellness data that HIPAA does not protect.
As of today, the proposal remains introduced and has not become law. That means the same blood sugar reading can receive different legal protections depending on who holds it and why.
You would think a company that builds a blood pressure app would only use your numbers to track your blood pressure. Federal regulators have repeatedly found otherwise.
These were not obscure apps built by scammers. They were mainstream health services, and regulators alleged that the sharing happened through ordinary advertising and analytics tools running in the background.
