Mobile Research Applications and State Data Protection Statutes

• Published in: The Journal of law, medicine & ethics Vol. 48; no. 1_suppl; pp. 87 - 93
• Main Author: Tovino, Stacey A.
• Format: Journal Article
• Language: English
• Published: Los Angeles, CA SAGE Publications 01.03.2020; Cambridge University Press
• Subjects: Amendments; Citizen participation; Citizen Science - methods; Computer Security - legislation & jurisprudence; Confidentiality - legislation & jurisprudence; Data; Data integrity; Government agencies; Government Regulation; Health research; Humans; Mandatory Reporting; Medical research; Mobile Applications - legislation & jurisprudence; Privacy; Regulation; Research - legislation & jurisprudence; Research applications; Research Personnel - classification; Rules; Security; State Government; Statutes; United States; United States; Montana; Alabama; United States > US; Texas; New Hampshire
• ISSN: 1073-1105; 1748-720X; 1748-720X
• DOI: 10.1177/1073110520917033

This article focuses on state privacy, security, and data breach regulation of mobile-app mediated health research, concentrating in particular on research studies conducted or participated in by independent scientists, citizen scientists, and patient researchers. Prior scholarship addressing these issues tends to focus on the lack of application of the HIPAA Privacy and Security Rules and other sources of federal regulation. One article, however, mentions state law as a possible source of privacy and security protections for individuals in the particular context of mobile app-mediated health research. This Article builds on this prior scholarship by: (1) assessing state data protection statutes that are potentially applicable to mobile app-mediated health researchers; and (2) suggesting statutory amendments that could better protect the privacy and security of mobile health research data. As discussed in more detail below, all fifty states and the District of Columbia have potentially applicable data breach notification statutes that require the notification of data subjects of certain informational breaches in certain contexts. In addition, more than two-thirds of jurisdictions have potentially applicable data security statutes and almost one-third of jurisdictions have potentially applicable data privacy statutes. Because all jurisdictions have data breach notification statutes, these statutes will be assessed first.