HEALTH DATA PRIVACY AND SECURITY IN THE AGE OF WEARABLE TECH: PRIVACY AND SECURITY CONCERNS FOR THE NFLPA AND WHOOP.

• Date: 01 January 2019
• Author: Durkin, Terence M.

1. Introduction

   As the proliferation of new technologies allows for increased amounts of personal data to be collected and stored, increased attention is required for the privacy and security of such data. (1) Perhaps the most significant privacy risks arise from the digitization of medical and personal health information (hereinafter "PHI"), since such data can reveal an individual's most personal and private information. (2) Privacy and security protections already exist for institutions and industries that traditionally handle medical and personal health information, (3) but gaps in those protections can emerge with the introduction of new technologies. (4)

   For instance, wearable technology is one area where gaps in the protection of medical and personal health information have emerged due to technological progress. (5) Despite the modest origins of wearable technology in the form of devices such as pedometers (which track an individual's step count), (6) wearable watches, bands and clothing are now capable of reading, collecting, storing and analyzing data based on an individual's steps, heart rate, calories burned and much more. (7) The increasing capabilities of wearable technology present the public with the question of how to better protect the individual user's privacy. (8) Moreover, lawmakers will have to decide whether the data collected by these devices will be protected under current legislation or if new legislation will be needed. (9)

   One unique area where this issue appears is professional sports. (10) In April 2017, the National Football League Players Association (hereinafter "NFLPA") entered into an agreement with a Boston-based wearable technology company, Whoop. (11) Under the agreement, the officially licensed NFLPA wearable band will be provided to each NFL player with the goal of studying the effects of travel, sleep, scheduling, and injuries on players' recovery. (12) According to Whoop, the data will provide players, trainers, and coaches with a detailed analysis of the player's body preparedness, while ensuring that each player owns and controls his own data. (13) The more advanced wearable technology becomes, the more personal the data will be that is collected. (14)

   This note analyzes how privacy and security issues affect wearable technology companies and their users. As a case study, this Note will analyze the agreement between the NFLPA and Whoop: Section II discusses the history of health data protection legislation, (15) Section III discusses the history of wearable technology and health data, (16) Section IV analyzes how current law applies to the agreement between the NFLPA and Whoop, (17) and Section V proposes modifications and additions to current law that may address privacy and security concerns. (18)

2. History of Health Data Protection Legislation

   This section examines the laws that may be implicated by the development of new wearable technologies, including The Food, Drug, and Cosmetic Act; (19) the Stored Communications Act; (20) and the Health Insurance Portability and Accountability Act and the Health Information Technology for Economic and Clinical Health Act. (21)

   1. FDA & Medical Devices

      The Food and Drug Administration ("FDA") has broad authority to regulate products marketed to the public. (22) Recently, however, the Administration has taken a "hands-off approach" to the technology industry to foster the development of new products without oppressive regulation. (23) The FDA is limited to the regulation of "medical devices," due to the Food, Drug and Cosmetic Act ("FDCA"). (24) The statute defines medical devices as "any product intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, or intended to affect the structure or any function of the body." (25) Accordingly, the FDA can only regulate consumer wearables if they meet the statutory definition of medical devices. (26)

      In response to the rapid expansion and broad use of mobile phone applications, the FDA has been forced to clarify its regulation of certain mobile devices. (27) While an overarching software policy has not been issued, the FDA has classified some software applications that meet the definition of a device and therefore fall under certain regulatory requirements of the FDA. (28) Mobile phone applications will be regulated if they are intended to 1) be used as an accessory to a regulated medical device; or 2) transform a mobile platform into a regulated medical device. (29)

      The extension of FDA regulatory power, however, will not extend to applications that are considered "low risk." (30) Whether these devices and associated apps will be considered medical devices, depends on the "intended use" of the product. (31) The FDA defines "intended use" as the "objective intent of the persons legally responsible for the labeling of devices" that is shown through "labeling claims, advertising matter, or oral or written statements." (32) Still, the distinction between medical devices and general health and wellness products is not always clear. (33) Ultimately, the primary purpose of the FDA is not to safeguard individual privacy, but to protect public health. (34) In the end, it is unlikely that the FDA will treat consumer wearables as medical devices as most are advertised to promote health and not to treat medical conditions. (35)

   2. The Stored Communications Act (SCA)

      In 1986, Congress enacted the Electronic Communications Privacy Act ("ECPA"). (36) One of the sections of the ECPA was the Stored Communications Act ("SCA"), which created protections for electronic communications, extended privacy protections to e-mails and information stored by third parties, and established rules about when entities may disclose their customers' communications records. (37) Section 2702 of the SCA governs when providers can and cannot disclose information to commercial third parties, applying only to persons or entities that provide electronic communication service or remote computing service. (38)

      Two determinations govern whether the SCA applies to consumer wearables: 1) if the health apps provide either electronic communication service or a remote computing service; and 2) if so, whether the communications are considered content or non-content. (39) "Electronic communications" are defined by the SCA as "any service which provides to users thereof the ability to send or receive wire or electronic communications." (40) "Remote computing service," on the other hand, is defined by the SCA as "the provision to the public of computer storage or processing services by means of an electronic communications system." (41)

      Under section 2702(c) of the SCA, providers "may divulge a record or other information pertaining to a subscriber to or customer of such service.... to any person other than a government entity" with no restriction. (42) Additionally, providers can sell the data without notifying the individual or obtaining the individual's consent if the data are considered "non-content." (43) The data will be protected only if it is considered "content," and the definition of "content" appears to hinge on whether the user intended the communication. (44) it is very unlikely that data collected and stored by wearable technology would be considered content, or that the wearer of that device would consider such content to be communication.

   3. The Health Insurance Portability and Accountability Act (HIPAA) & the Health Information Technology for Economic and Clinical Health ("HITECH") Act

      Most recently, in 1996, Congress responded to the increased digitization of data in the healthcare industry by passing the Health Insurance Portability and Accountability Act ("HIPAA"). (45) This Act essentially codified the Hippocratic Oath, (46) intending to ease the growing concern among patients regarding the confidentiality of personal health information in an outdated paper record system. (47) Accordingly, HIPAA mandated nationwide security standards and safeguards for the use of electronic health care information and the creation of privacy standards for protected health information. (48)

      Decades later, to promote the adoption and meaningful use of health information technology, Congress reinforced HIPAA when it passed the Health Information Technology for Economic and Clinical Health ("HITECH") Act of 2009. (49) Additionally, the HIPAA Omnibus Rules enacted after the HITECH Act added and expanded security procedures focusing on electronic data. (50) Most notably, the new laws and regulations expanded the application of HIPAA to cover "business associates" of covered entities and strengthened the civil and criminal enforcement of HIPAA rules. (51)

      Pursuant to HIPAA, the U.S. Department of Health and Human Services ("HHS") promulgated regulations that can be separated into the "Privacy Rule" (52) and the "Security Rule." (53) Both Rules aim to protect the privacy of the individual's personal health information by limiting disclosure of such information. (54) The reach of the regulations, however, extends only to individuals, organizations, and agencies that meet the definition of "covered entity" or "business associate." (55) The regulations only apply to these individuals, organizations, or agencies if they maintain or transmit personal health information PHI, which includes any individually identifiable information that relates to an individual's physical or mental health or has provision of or payments for healthcare. (56)

      Under the HHS regulations, a "covered entity" is defined as 1) a health plan; 2) a health care clearinghouse; or 3) a health care provider that transmits any health information in electronic form. (57) A "business associate" is defined as any person or entity that creates, receives, maintains or transmits PHI on behalf of a covered entity. (58) Further, covered entities that work with business associates must create a written...