Data brokers typically aggregate and sell health-related data obtained from various sources like public records and health apps. A journal article published in Current Psychiatry Reports expands on this role, “Data brokers also combine health data with data from consumer habits, assets, and demographics to use in consumer health scores, profiling, and predictive modeling.”
The distinction in their role means that data brokers do not fall directly under HIPAA unless they process protected health information (PHI) on behalf of a healthcare provider or health plan, they must enter into a business associate agreement that outlines their responsibilities regarding the handling of PHI.
HIPAA preempts state laws that provide less stringent protections for PHI while allowing states to enact more rigorous privacy laws. As states continue to develop their privacy laws in response to public demand for greater data protection there is room for the expansion of HIPAA to include data brokers explicitly.
State laws, like California's Delete Act and similar regulations in other states, have begun to impose specific requirements on data brokers. These state laws aim to improve consumer protection by requiring data brokers to disclose their practices regarding the collection and sale of personal information.
Related: HIPAA Compliant Email: The Definitive Guide
Entities that engage in activities involving PHI, such as billing companies, IT service providers, medical transcriptionists, cloud storage providers, and data analytics companies, qualify as business associates.
Business associates are responsible for safeguarding PHI and must implement appropriate physical, administrative, and technical safeguards to protect this information.