By Camil Miki Zaganjor, JHBL Staff Member
Roughly 130 million adults in the United States, about 39% of the population, use wearable devices that track the user’s heart rate.[1] In addition, the vast majority of people at risk for cardiovascular disease approve of sharing their health data to improve their healthcare, but some users worry about their data privacy.[2] Individuals over 65, who comprise over half of those with cardiovascular disease, have a mere 12% usage rate of wearable devices.[3] In general, the younger someone with cardiovascular disease is, the more likely they are to use a wearable device.[4] With wearable devices in high demand and a consumer willingness to share health data, Apple holds significant power in the market as one of its largest players.[5] The word “wearable device” has become synonymous with Apple Inc. [hereinafter Apple], as the company commands a substantial share of the wearable market.[6] This prevalence of Apple devices underscores their influence in the wearable device market, where they face legal challenges over anticompetitive practices and patent infringement, including over the Apple Watch and its hardware features.[7] Amidst these legal disputes, Washington State passed a law seeking to protect consumer health data and restrict companies that wish to sell such data.[8] The law is broad, and could affect the business practices of companies, like Apple, which make wearable devices that collect consumer health data.[9]
In 2021, medical technology startup AliveCor, Inc. [hereinafter AliveCor] filed an antitrust lawsuit against Apple regarding the heart rate monitoring technology used in the Apple Watch.[10] Specifically, AliveCor claimed that Apple created an unlawful monopoly when it developed its the electrocardiogram (hereinafter ECG) technology, an addition to recent Apple Watch models which allows users to take ECG measurements from their wrist.[11] The claim cited alleged violations of the Sherman Antitrust Act and California unfair competition law.[12]
Apple also faced numerous lawsuits related to its alleged misuse—monopolization and ECG-related patent disputes—of the technology developed by AliveCor and California-based health technologies companies Masimo Corporation [hereinafter Masimo] and its subsidiary, Cercacor Technologies, Inc. [hereinafter Cercacor].[13] In response to the several patent infringement lawsuits since 2021, the International Trade Commission [hereinafter ITC] issued a ban on Apple Watch sales in the United States starting in October 2023.[14] During this ban, users who owned the newer Apple Watch models with the disputed technology could continue using their devices.[15] However, after Apple appealed the ITC order, citing that the ban would detrimentally effect Apple Watch users, the ITC maintained the necessity of the ban to protect the intellectually property rights of the two companies alleging patent infringement.[16]
Legislation like Washington’s My Health My Data Act [hereinafter MHMD], signed into law in April 2023, may significantly impact the practices of a wide range of digital health businesses, including wearable technology companies like Apple.[17] MHMD seeks to protect consumer health data not otherwise protected by other state and federal regulations.[18] MHMD applies to any legal entity that conducts business in Washington or produces or provides products or services targeted to consumers in Washington, and determines the purpose and means of collecting, processing, sharing, or selling consumer health data.[19] This includes companies that handle health information not regulated by HIPAA, such as wearable device manufacturers.[20] The Act restricts how entities collect, use, and process “consumer health data,” which is defined as personal information linked or reasonably linkable to a consumer that identifies the consumer’s past, present, or future physical or mental health status.[21] Therefore, wearable tech companies like Apple, which collect health data through devices like the Apple Watch, may need to revise their data collection and privacy practices to comply with this Act.[22]
The intersection of MHMD and the antitrust allegations against Apple presents a complex scenario for many wearable device manufactures, and the pairing is poised to reshape the landscape of the wearable technology industry.[23] As wearable technology matures, devices are expected to offer medical-grade insights at users’ fingertips outside of the doctor’s office.[24] To fulfill these expectations, however, pursuant to legislation like MHMD, companies must provide users an option to “opt-in” to the data collection process.[25] And as a result of legislation like MHMD, wearable device application creators, not just manufacturers, are prohibited from selling such data if a user does not “opt-in” to the data collection process.[26]
Often when using a wearable device, including the Apple Watch, a user interacts with applications not made by the device’s manufacturer, known as third-party applications.[27] Wearable device manufacturers, who control the availability of third-party applications to users, bear a responsibility to ensure those third-party developers do not sell data collected from the devices.[28] The importance of anticompetition claims against Apple becomes evident in this context, as they allege that the company restricts certain features and data access in third-party-developed Apple Watch applications to ensure only Apply can use any collected data.[29] Therefore, who “owns” user health data and how stringently the use of this data adheres to legislation like MHMD will likely be the subject matter of future lawsuits.[30] And under the private right of action contained in the MHMD, consumers can pursue claims against regulated entities for noncompliance.[31]
The widespread adoption of wearable devices has brought both convenience and concern.[32] Many individuals rely on these devices to track their health and fitness, from personal-wellness-oriented step counts to life-saving mobile ECG readings.[33] However, the surge in health data collection raises privacy and security questions.[34] While some wearable companies have surely made strides to data accuracy and safety, the lack of consistency across regulations compounds the issue for the large, and growing, number of wearable device users.[35] HIPAA, designed to safeguard patient data, does not directly cover wearable devices and their data.[36] Simultaneously, other regulations, such as the Health Breach Notification Rule, applies to certain data breaches but does not encompass all wearable device scenarios.[37] Regulating wearable device commerce is a complex endeavor, requiring collaboration between the FTC and ITC while analyzing the interplay between new regulations and the laws of different jurisdictions.[38] Legislation such as MHMD aims to empower individuals by granting them greater control over their health information and by imposing limits on corporate actions related to such data.[39] Legislative bodies are expected to be influenced by Washington State’s MHMD, passing laws that limit corporate actions concerning health data rights, while regulatory bodies and courts will aim to uphold the privacy rights of wearable device users.[40] While acknowledging the risks of consenting to wearable device data sharing, it remains imperative to recognize the potential benefits of data sharing to tomorrow’s healthcare landscape, so long as it is executed safely and ethically.[41]
Disclaimer: The views expressed in this blog are the views of the author alone and do not represent the views of JHBL or Suffolk University Law School.
Camil Miki Zaganjor is a second-year law student at Suffolk University Law School, where he focuses on corporate law, with a particular interest in its application to emerging companies and finance. He earned Bachelor of Arts degrees in Economics and International Relations (c. International Finance) from Tufts University in 2019.
[1] See Chris Arkenberg, Why consumers—and doctors—are wary about wearable data, Deloitte Insights (July 30, 2021), https://www2.deloitte.com/us/en/insights/industry/technology/wearable-technology-healthcare-data.html [https://perma.cc/J9FL-SVWD]; see also Study finds people who need wearable health devices the most use them the least, Am. Heart Ass’n (Oct. 31, 2022), https://newsroom.heart.org/news/study-finds-people-who-need-wearable-health-devices-the-most-use-them-the-least [https://perma.cc/53MZ-L7AZ].
[2] See Am. Heart Ass’n, supra note 1. According to a 2020 nationally representative survey, 80% of people at risk for cardiovascular disease indicated that they would be willing to share their health data to improve their health care. Id. But see Arkenberg, supra note 1. Four in ten wearable device users are concerned about their data privacy. Id.
[3] Am. Heart Ass’n, supra note 1.
[4] See id. 17% of 50-64-year-olds with cardiovascular disease used wearables, compared to 33% of 18-49-year-olds with the condition. Id.
[5] See Market share of wearables unit shipments worldwide from 1st quarter 2014 to 3rd quarter 2023, by vendor, Statista (Dec. 8, 2023), https://www.statista.com/statistics/435944/quarterly-wearables-shipments-worldwide-market-share-by-vendor/ [https://perma.cc/VT99-MVVA].
[6] See id. As of the third quarter of 2023, Apple’s Apple Watch accounted for 20.2% of global wearable device unit shipments. Id.
[7] See Koh Ewe, What to Know About the Various Legal Disputes Over the Apple Watch, Time (Feb. 8, 2024), https://time.com/6692718/apple-watch-masimo-alivecor-patent-antitrust-legal-explainer/ [https://perma.cc/552W-6Q3D] (describing procedural history of various lawsuits surrounding Apple). AliveCor, which created heart-monitoring device KardiaBand and met with Apple executives, filed an antitrust lawsuit against Apple in 2021, accusing Apple of monopolistic practices in the ECF technology market, claiming Apple’s actions reduced competition and consumer choice. Id. Masimo has engaged in a patent and trade secrets dispute with Apple over blood-oxygen measurement technology used in the newer Apple Watch models, with both sides filing infringement lawsuits against the other. Id. See also Office of Public Affairs, Justice Department Sues Apple for Monopolizing Smartphone Markets, U.S. Dep’t Just. (Mar. 21, 2024), https://www.justice.gov/opa/pr/justice-department-sues-apple-monopolizing-smartphone-markets [https://perma.cc/8WPY-EH7P] (describing Apple’s business tactics surrounding App Store as monopolistic). Apple’s practices in the app ecosystem involve blocking innovative super apps, excluding cross-platform messaging apps, diminishing the functionality of non-Apple smartwatches, and limiting third-party digital wallets linked to wearable devices. Id.
[8] Wash. My Health My Data Act, Wash. Rev. Code § 19.373.100 (2024); H.B. 1155, 68th Leg., 2023 Sess. (Wa. 2024).
[9] See Wash. My Health My Data Act, Wash. Rev. Code § 19.373.010 (2024). Where “consumer health data” is defined as “means personal information that is 28 linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status.” Id.; see also H.B. 1155, 68th Leg., 2023 Sess. (Wa. 2024).
[10] See Wash. My Health My Data Act, Wash. Rev. Code § 19.373.100 (2024); H.B. 1155, 68th Leg., 2023 Sess. (Wa. 2024).
[11] See Ewe, supra note 7; see also Complaint at ¶ 16, AliveCor, Inc. v. Apple Inc., No. 21-03958, (N.D. Cal. May 25, 2021), ECF. No. 1.
[12] See Complaint at ¶ 25-26, AliveCor, Inc. v. Apple Inc., No. 21-03958, (N.D. Cal. May 25, 2021), ECF. No. 1.
[13] See Ewe, supra note 7; see also Kinsey Crowley & Bailey Schulz, White House upholds trade ban on Apple Watches after accusations of patent infringement, USA TODAY (Dec. 26, 2023), https://www.usatoday.com/story/tech/news/2023/12/26/new-apple-watch-banned-in-us/72032095007/#:~:text=White%20House%20upholds%20trade%20ban%20on%20Apple%20Watches%20after%20accusations%20of%20patent%20infringement&text=The%20Biden%20administration%20announced%20Tuesday,sale%20of%20certain%20Apple%20Watches [https://perma.cc/LF54-3YY4].
[14] See Crowley & Schulz, supra note 13; see also Certain Light-Based Physiological Measurement Devices and Components Thereof, Inv. No. 337-TA-1276, EDIS Doc. ID 2011470 (Oct. 26, 2023) (Final Determination) (describing limited execution order prohibiting unlicensed entry of infringing technology, Apple’s products containing ECG technology) [hereinafter ITC Order].
[15] See Emma Roth, Apple Watch ban: everything you need to know, Vox Media (Mar. 19, 2024), https://www.theverge.com/24009254/apple-watch-itc-ban-patent-dispute [https://perma.cc/6T4F-ZQMW].
[16] Id.
[17] See Amy M. Magnano & Michael J. Madderra, The Broad Reach of Washington State’s My Health My Data Act, Morgan, Lewis (July 7, 2023), https://www.morganlewis.com/pubs/2023/07/the-broad-reach-of-washington-states-my-health-my-data-act [https://perma.cc/9C4K-2YG5]; see also James Sullivan, Washington state passes My Health My Data Act, DLA Piper (Apr. 19, 2023), https://www.dlapiper.com/en/insights/publications/2023/04/washington-state-passes-my-health-my-data-act [https://perma.cc/MX44-F8W9].
[18] See Magnano & Madderra, supra note 17.
[19] See Sullivan, supra note 17; Yana Komsitsky & Neeka Hodaie, Washington’s “My Health My Data” Act, Seyfarth (Apr. 25, 2023), https://www.seyfarth.com/news-insights/washingtons-my-health-my-data-act.html [https://perma.cc/Q84M-D3AG]; David P. Saunders et al., Washington Legislature Passes My Health My Data Act, Nat’l L. Rev. (Apr. 14, 2023), https://www.natlawreview.com/article/washington-legislature-passes-my-health-my-data-act [https://perma.cc/E3TD-92XG].
[20] See Sullivan, supra note 17; Komsitsky & Hodaie, supra note 19; Saunders et al., supra note 19; Wash. My Health My Data Act, Wash. Rev. Code § 19.373.100 (2024); H.B. 1155, 68th Leg., 2023 Sess. (Wa. 2024).
[21] See Sullivan, supra note 17.
[22] See Sullivan, supra note 17; Komsitsky & Hodaie, supra note 19; Saunders et al., supra note 19.
[23] See James Stables, Wearable tech trends 2023 – as told by the big brands, Wareable (Jan. 18, 2023) https://www.wareable.com/wearable-tech/wearable-tech-trends-2023-as-told-by-the-big-brands [https://perma.cc/ART9-HUX8]; Abdullah, The Future of Wearable Tech: What to Expect in 2024, Gizchina (Jan. 31, 2024) https://www.gizchina.com/2024/01/31/wearable-tech-evolution-2024/ [https://perma.cc/Z9U8-JD73].
[24] See Stables, supra note 23.
[25] See Magnano & Madderra, supra note 17; Wash. My Health My Data Act, Wash. Rev. Code § 19.373.100 (2024); H.B. 1155, 68th Leg., 2023 Sess. (Wa. 2024).
[26] See Wash. My Health My Data Act, Wash. Rev. Code § 19.373.100 (2024); H.B. 1155, 68th Leg., 2023 Sess. (Wa. 2024).
[27] See Ewe, supra note 7; Apple Support, Apple Watch User Guide: Get more apps on Apple Watch, Apple, https://support.apple.com/guide/watch/get-more-apps-apd99e3c6a68/watchos [https://perma.cc/9Y3D-DDEM].
[28] See Ewe, supra note 7.
[29] See id.; ITC Order, supra note 14.
[30] See Ewe, supra note 7; ITC Order, supra note 14; Sullivan, supra note 17; Komsitsky & Hodaie, supra note 19; Saunders et al., supra note 19.
[31] See Anna C. Westfelt, et al., Data Privacy Insight: Broad-sweeping Privacy Law Takes Effect in Washington, Gunderson Dettmer (Apr. 3, 2024), https://www.gunder.com/news/data-privacy-insight-broad-sweeping-privacy-law-takes-effect-in-washington/ [https://perma.cc/R3VZ-WER5]. Consumers will be able to file action against regulated entities by way of class action lawsuit and will need not rely on Washington’s Office of the Attorney General to file suit. Id.
[32] See Am. Heart Ass’n, supra note 2; Arkenberg, supra note 2.
[33] See Ewe, supra note 7; Complaint at ¶ 16-26, AliveCor, Inc. v. Apple Inc., No. 21-03958, (N.D. Cal. May 25, 2021), ECF. No. 1.
[34] See Arkenberg, supra note 1.
[35] See FTC Warns Health Apps and Connected Device Companies to Comply With Health Breach Notification Rule, Fed. Trade Comm’n (Sep. 15, 2021), https://www.ftc.gov/news-events/news/press-releases/2021/09/ftc-warns-health-apps-connected-device-companies-comply-health-breach-notification-rule [https://perma.cc/LD3E-VBC2] [hereinafter FTC Warning on Health Breach Notification Rule].
[36] See Sullivan, supra note 17; Komsitsky & Hodaie, supra note 19; Saunders et al., supra note 19; Wash. My Health My Data Act, Wash. Rev. Code § 19.373.100 (2024); H.B. 1155, 68th Leg., 2023 Sess. (Wa. 2024).
[37] FTC Warning on Health Breach Notification Rule, supra note 35. Applications and connected devices, like wearable fitness trackers, fall under the Health Breach Notification Rule if they gather health data from various sources and are not governed by a similar rule from the Department of Health and Human Services. Id.
[38] See FTC Warning on Health Breach Notification Rule, supra note 35; ITC Order, supra note 14.
[39] See Sullivan, supra note 17; Magnano & Madderra, supra note 17; Komsitsky & Hodaie, supra note 19; Saunders et al., supra note 19; Westfelt et al., supra note 31; Wash. My Health My Data Act, Wash. Rev. Code § 19.373.100 (2024); H.B. 1155, 68th Leg., 2023 Sess. (Wa. 2024).
[40] See Wash. My Health My Data Act, Wash. Rev. Code § 19.373.100 (2024); H.B. 1155, 68th Leg., 2023 Sess. (Wa. 2024); FTC Warning on Health Breach Notification Rule, supra note 35; ITC Order, supra note 14.
[41] See Arkenberg, supra note 1; see also FTC Warning on Health Breach Notification Rule, supra note 35; ITC Order, supra note 14.