FTC Issues Tool Intended to Assess Laws Governing Mobile Health Apps

By Jennifer D. Newberger –

The Federal Trade Commission (FTC) recently released a guidance titled “Mobile Health App Developers: FTC Best Practices,” intended to provide tips to developers about data security. FTC also released an accompanying on-line tool to assist developers in determining the federal laws that apply to their mobile apps. The guidance and interactive tool were developed in collaboration with FDA, the Department of Health and Human Services Office for Civil Rights, and the Office of the National Coordinator for Health Information Technology.

The tool consists of a series of high-level “yes” or “no” questions to be answered by the app developer. The answer to any individual question directs the user to a subsequent question, and ultimately informs the user as to the applicability of HIPAA, the FTC Act, and/or the Federal Food, Drug, and Cosmetic Act (FDC Act).

The tool is fairly straightforward and provides basic information to a novice developer. What it fails to do is explain in more detail how an app should comply with the law, should it potentially apply to a particular app, and what the relationship is between the laws. For example, Questions 5, 6, and 7 help the user determine whether the app is a mobile medical app and, if so, whether it is the type of app over which FDA intends to exercise its regulatory authority. Regardless of the applicability of the FDC Act to the app, the tool then asks whether the app developer is a non-profit organization. If the answer is “no,” the tool states that the FTC Act likely applies, and that the FTC Act “prohibits deceptive or unfair acts or practices,” meaning that the developer “cannot make deceptive or misleading claims to consumers about things that are important to them,” and “cannot engage in acts or practices that cause, or are likely to cause, substantial injury to consumers that they cannot avoid, and that do more harm than good.”

Stating that the FTC Act “may apply” even to regulated medical devices is an interesting perspective, given the broad regulatory authority of the FDA over regulated medical devices with respect to claims made about the product. Although FDA technically has authority only over the “labeling” of a medical device, and FTC over the advertising (with certain exceptions), courts and FDA have broadly interpreted the meaning of labeling such that it includes nearly all promotional activity of a manufacturer. Therefore, even if the FTC Act were to apply to a regulated mobile app, it is far more likely that FDA, rather than FTC, would take action against a company for false or misleading claims. Neither the tool nor the guidance provides insight regarding precisely how, if at all, the FTC Act, rather than the FDC Act, would govern misleading promotional claims about a mobile app. Developers of mobile medical apps over which FDA will exercise its regulatory authority should assume that their promotional claims will be subject to oversight by FDA, rather than FTC.