On December 7, 2022, the Federal Trade Commission (“FTC”), in collaboration with the Department of Health & Human Services (“HHS”) and the Federal Drug Administration (“FDA”), updated the Mobile Health App Interactive Tool (the “Tool”) to help mobile health app developers determine what federal laws and regulations might apply to their apps. The Tool, originally published in 2016, is specifically intended to be used by mobile health app developers that will access, collect, share, use, or maintain information related to an individual consumer’s health. The updated Tool includes new questions, more specific examples than before, and new use cases, all meant to help companies learn more about the variety of laws and regulations that may apply to them, and to navigate this evolving legal and regulatory environment.

The updated Tool summarizes the various laws and regulatory provisions that may apply to mobile health apps depending on the app’s specific functions and services. For instance, an app may help patients manage their specific health conditions or illnesses and view their medical records, which they can then share with their health care providers. If this app is provided by a HIPAA covered entity such as a covered health care provider or one or more of its business associates, for example, then it would be covered by HIPAA, which protects individually identifiable health information collected by health care providers, health plans, health care clearinghouses and their business associates.

Many mobile health apps are not governed by HIPAA but rather by other laws and regulations depending on, for instance, what type of entity is providing the app, what the app is intended to do, and who the intended end user is. The Tool serves as a good starting point for developers to survey the regulatory landscape for mobile health apps, and become familiar at a high level with the applicability of the following laws and regulations:

• The Health Insurance Portability and Accountability Act (HIPAA) Rules
• The Federal Food, Drug, and Cosmetic Act
• The 21st Century Cures Act and ONC Information Blocking Regulations
• The FTC Act
• FTC’s Health Breach Notification Rule
• The Children’s Online Privacy Protection Act

Following the summary section, the Tool includes a Q&A section to further assist developers in determining which laws and regulations apply to their mobile health apps. It poses questions on issues including what type of personal information the app collects, who the developers are, how consumers may access and use the app, and who or what the app is intended for. For example, a mobile health app that is not provided by a HIPAA-covered entity or its business associate and that is intended to be used by consumers would be governed by the FTC under the FTC Act and its corresponding regulations and guidance. If mobile health app developers learn from the Tool that their apps are subject to the FTC Act, reviewing the Tool in combination with the FTC’s other guidance materials such as the Mobile Health App Developers: FTC Best Practices will be helpful in informing developers of FTC’s thinking in this area. If an app’s intended use fits within certain criteria, it may be considered a medical device, and therefore be regulated by the FDA.  The Tool contains broad information outlining when a health app may or may not fit within the medical device designation.

Notably, the Tool is not offered as legal advice and therefore mobile health app developers should consider it a snapshot of the regulatory landscape they need to navigate prior to seeking legal advice.