FTC issues personal health record security rule

A new rule makes it mandatory for vendors to notify consumers if their personal health records online have been breached.

The new rule is based on a mandate from Congress requiring the Federal Trade Commission (FTC) to issue a final regulation requiring the notification. The rule applies to online systems that allow consumers to collect and store their medical records in a single location. Companies supplying such services include Microsoft HealthVault and Google Health.

The policy stems from a concern about privacy and the potential vulnerability of such systems. The rule is considered a stopgap measure.

Congress has said it wants the Department of Health and Human Services, in consultation with the FTC, to study the issue and recommend broader privacy, security and breach notification measures by February 2010. As electronic medical records (EMRs) become a reality in the medical system, the issue of protecting privacy is likely to remain a major issue.

For more on health records:
- see this Federal Computer Week article