Fast Facts: What protections are applicable to patient-generated health data that is not maintained by a covered entity?

Health-related data that is created or gathered by the patient is known as “patient-generated health data” (PGHD).  Patients are increasingly collecting and sharing PGHD with their providers, health plans, and patient support networks, through various e-health tools, such as mobile apps, personal health record (PHR) systems, and online patient-powered research networks (e.g., PatientsLikeMe) and registries (BioBank). While ripe with potential to improve patients’ health, generating and/or communicating health information using sources other than those operating in the traditional healthcare domain  (e.g., health care providers, insurers, researchers, etc.) subjects this potentially sensitive information to privacy and security risks. To learn more about PGHD, including the way it differs from other types of healthcare data and applicable protections, please read our Fast Facts below.