14. Beyond HIPAA: The Regulatory Overlay

Module 8: Synthesis · Runtime 39:18 · YouTube title: Beyond HIPAA: FTC and State Laws on De-identified Health Data

De-identified data exits HIPAA, but that is a boundary, not a shield. The FTC three-part test prong by prong, the GoodRx, BetterHelp, Premom, Kochava, and Outlogic actions, eight state statutes that codify the test, California AB 713, Washington My Health My Data, 42 CFR Part 2, the Common Rule, genomics, clinical trial transparency, the tracking-pixel litigation, and the 2024 rule that was vacated in 2025.

In this video

• The FTC three-part test: reasonable de-identification measures, a public commitment not to re-identify, contractual flow-down; no re-identification is needed to violate
• GoodRx, BetterHelp, and Premom: stripping a name is not "reasonable measures"; Kochava and Outlogic: location is an identifier
• The state table: Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Minnesota, and Utah codify the three-part test; Minnesota adds an inference standard
• California AB 713 (Civil Code §§1798.146 and 1798.148): contracts must bar re-identification and the privacy policy must name your method
• Washington My Health My Data: inferred health data is covered, a 2,000-foot geofencing ban, and a private right of action
• Nevada, Connecticut, and the California CMIA; 42 CFR Part 2, the Common Rule, genomic data, and GINA
• Clinical trial transparency (EMA), the tracking-pixel reckoning, and regulatory volatility: the April 2024 reproductive health privacy rule vacated June 2025
• What changed since 2012, and the contractual envelope you deliver

Authorities quoted on screen

FTC Act §5; FTC, Protecting Consumer Privacy in an Era of Rapid Change (2012); Health Breach Notification Rule as amended 2024; the eight state comprehensive privacy statutes; Cal. Civ. Code §§1798.146 and 1798.148; RCW 19.373.010 et seq.