Not wanting to be left out of the digital heath conversation, the Federal Trade Commission (FTC) has increased its level of activity. On January 27th, the FTC released its Internet of Things (IoT) report and last week the Commission entered into a consent agreement with a software developer who claimed its product treated ADHD. These actions serve notice to digital health software developers that the FTC is watching the space closely and will bring enforcement actions when they deem them appropriate.
With respect to the IoT Report, the FTC focused on wearables and connected devices. The Commission acknowledged the benefits of the growing digital health space, but pointed to several risks. For example, the report states that for diabetic patients who used connected glucose monitors that transmitted data to physicians, those physicians were “five times more likely to adjust medications resulting in better disease management and substantial financial savings for patients.” On the other hand, the report cited instances where two types of connected insulin pumps were able to be hacked so they stopped delivering medicine.
In the report, the FTC recognizes that if mobile apps are required to incorporate rigid opt-in security and privacy features it may make the devices less appealing. However, the report concludes that not having strong security and privacy protections may actually undermine consumer confidence and “may result in less widespread adoption.”
“[FTC] believes that consumers should have transparency and choices over their sensitive health information, regardless of who collects it,” the report states.
The FTC stopped short of calling for new legislation and did not mention developing any IoT-specific regulations. Until new regulatory authority is granted, they will use existing tools to govern digital health, such as the notification provision of the HITECH Act that requires health care providers that hold personal information to report breaches.
In addition to releasing the IoT report, on January 20th, the FTC issued an administrative complaint that serves as a clear reminder that health software developers are still subject to their supervision. In the complaint (which was settled by a consent agreement) the FTC ordered Texas-based Focus Education, manufacturer of computer game Jungle Rangers, to stop making “unsubstantiated” claims about the effects of the computer game, which is aimed at children with ADHD.
In a “blog post, the FTC’s director of the Bureau of Consumer Protection stated, “this case is the most recent example of the FTC’s efforts to ensure that advertisements for cognitive products, especially those marketed for children, are true and supported by evidence.” FTC’s consent order prohibits Focus Education from making claims unsupported by “competent and reliable” evidence.
It remains uncertain which agency will be the lead on regulating health IT. Digital health companies – in both hardware and software spaces – should be aware of a possible two-pronged regulatory approach, with the FDA regulating use and development of devices and the FTC stepping in on privacy and security.
[View source.]
