The Telehealth App That Promised More Than HIPAA Requires
Fernwell is a 40-person telehealth startup selling a mood-tracking app. Its privacy policy, written by a contractor, states: 'We are HIPAA compliant and never share your data with advertisers.' In fact, an analytics SDK embedded in the app transmits device identifiers and mood-journal free text to three ad networks, which use it for lookalike targeting. Only 12% of users are patients of Fernwell's affiliated clinics; the rest downloaded the app from an app store. After a journalist's inquiry, the CEO asks whether the company is 'covered by HIPAA' and, if not, whether anything else applies. Fernwell has no formal compliance program, no designated privacy officer, and no record of the SDK's data flows beyond the vendor's marketing page.
1. Is HIPAA the operative legal constraint here? Explain how HIPAA's scope and FTC Act Section 5 jurisdiction interact for the 88% of users who are not patients.
Read the worked answer
HIPAA governs only covered entities and their business associates. Fernwell's affiliated clinics are covered entities, so if Fernwell creates, receives, maintains, or transmits protected health information on their behalf, it is a business associate and HIPAA (plus the BAA) governs that data. That is a narrow slice.
For app-store users who never touch a covered entity, no PHI exists and HIPAA simply does not reach the data - a self-applied 'HIPAA compliant' label creates no obligation and, worse, is itself a representation to regulators.
Section 5 fills the gap. Deception: the 'HIPAA compliant' and 'never share' statements are material representations likely to mislead a reasonable consumer, and actual sharing contradicts them. Unfairness: sending free-text mood journals to ad networks causes substantial injury that consumers cannot reasonably avoid and that no countervailing benefit justifies. The FTC's Health Breach Notification Rule also reaches health apps that are not HIPAA-covered, and state UDAP statutes give attorneys general parallel authority with civil penalties.
The lesson: HIPAA is a floor and a scope test, not the answer to the question.
2. A plaintiffs' firm demands damages for the 900,000 affected users. Assess the realistic litigation and regulatory exposure.
Read the worked answer
Neither HIPAA nor the FTC Act provides a private right of action, so plaintiffs must plead state theories: UDAP, intrusion upon seclusion, breach of contract, unjust enrichment. Standing is the first battleground - under TransUnion v. Ramirez, a risk of future harm alone generally will not support damages in federal court; plaintiffs do better where the disclosed data is sensitive (mental-health journal text) or where a state statute supplies a close common-law analogue.
Regulatory exposure is the real threat: an FTC investigation producing a consent order with 20 years of biennial third-party assessments and mandated deletion of models trained on the ill-gotten data, state AG actions under UDAP, and Health Breach Notification Rule reporting.
Practical mitigations now: terminate the SDK data flow, preserve logs (spoliation risk), issue a litigation hold, correct the policy immediately, and evaluate whether the 12% patient cohort triggers a HIPAA breach analysis with its own 60-day notification clock.