E-Commerce Law Week, Issue 573

HHS and FTC Implement Breach Notification Requirements for Health Records

The Department of Health and Human Services (HHS) and the Federal Trade Commission (FTC) have both issued rules implementing notification requirements for breaches of electronic health records.  The HHS interim final rule goes into effect September 18, 2009, with a request for public comments, due by October 23, 2009.  HHS will not impose sanctions for failure to provide the required notification until February 22, 2010.  The FTC final rule goes into effect September 24, 2009, and full compliance is required by February 22, 2010.  As we previously reported, the HHS interim final rule applies to health care providers and other entities covered by the Health Insurance Portability and Accountability Act.  The FTC final rule applies to non-HIPAA entities that handle "protected health information" in an electronic format.  These two sets of breach notification requirements implement provisions of the American Recovery and Reinvestment Act of 2009, which was signed into law in February of this year.

Facebook Capitulates in Privacy Law Face-Off

Facebook, Inc. has reached agreement with the Office of the Privacy Commissioner of Canada regarding privacy controls on the social networking website.  As we previously reported, the Office found that several of Facebook's practices violated Canada's Personal Information Protection and Electronic Documents Act.  The Office gave Facebook 30 days to address the concerns or face court action.  Facebook has now consented to several significant changes, including a more forthcoming description of its Privacy Policy; more granular privacy settings; a permissions-based model for third-party applications (e.g., games and quizzes) that allows users to select the information they share with third parties; and the clear option to either "deactivate" or entirely "delete" an account.

Questions and comments about E-Commerce Law Week are always welcome.  Please send your feedback to Sally Albertazzie.