1 The Health Insurance Portability and Accountability Act uses the acronym “PHI” to denote “protected health information”. We are using PHI more broadly to refer to all personal health information, whether privacy-protected or not. See discussion infra Part IV.B.

2 See Anthony W. Orlando & Arnold J. Rosoff, The Role of Transparency in Promoting Healthy Behaviors: Pros, Cons, and Perils of Information-Sharing to Foster Personal Responsibility in Health Care, in Transparency in Health and Health Care in the United States: Law and Ethics (I. Glenn Cohen et al. eds., 2019) (forthcoming) (on file with author).

3 Nolan D. McCaskill & Matthew Nussbaum, Trump Signs Executive Order Requiring that for Every One New Regulation, Two Must Be Revoked, Politico (Jan. 30, 2017), https://www.politico.com/story/2017/01/trump-signs-executive-order-requiring-that-for-every-one-new-regulation-two-must-be-revoked-234365 [https://perma.cc/WPL8-8GFX].

4 How Did the Federal Food, Drug, and Cosmetic Act Come About?, Food & Drug Admin., https://www.fda.gov/AboutFDA/Transparency/Basics/ucm214416.htm (last updated Jan. 23, 2018) [https://perma.cc/FQ9A-Z4GY]; About FDA, Food & Drug Admin. https://www.fda.gov/AboutFDA/WhatWeDo/History/default.htm (last updated Mar. 7, 2018) [https://perma.cc/9WY2-BYAH].

5 Carol Rados, Medical Device and Radiological Health Regulations Come of Age, 40 FDA Consumer Mag. no. 1, Jan.-Feb. 2006, at 59, 62.

6 Id.

7 Id.

8 Id.

9 See Eric Elenko, Austin Speier & Daphne Zohar, A Regulatory Framework Emerges for Digital Medicine, 33 Nature Biotechnology 697 (2015).

10 Is the Product a Medical Device?, Food & Drug Admin., https://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/Overview/ClassifyYourDevice/ucm051512.htm (last updated Jan. 26, 2018) [https://perma.cc/8ZKY-5ZNF].

11 See U.S. Food & Drug Admin., Classification of Products as Drugs and Devices and Additional Product Classification Issues (2017), https://www.fda.gov/downloads/RegulatoryInformation/Guidances/UCM258957.pdf.

12 For more details on what the FDA designates as “digital health,” see Digital Health, Food & Drug Admin., https://www.fda.gov/MedicalDevices/DigitalHealth/default.htm (last updated Feb. 15, 2018) [https://perma.cc/WL82-C975].

13 Orlando & Rosoff, supra note 2, at 7.

14 Twenty-First Century Technology for Twenty-First Century Cures: Joint Hearing Before the Subcomm. on Communications and Technology and the Subcomm. on Health of the H. Comm. on Energy and Commerce, 113th Cong. 2 (2015), https://www.gpo.gov/fdsys/pkg/CHRG-113hhrg95732/pdf/CHRG-113hhrg95732.pdf.

15 See id.

16 Representative Greg Walden (R-OR) praised the role of technology and innovation in the economy. Representative Frank Pallone, Jr. (D-NJ) praised technology for lowering health care costs, improving fiscal sustainability, and improving preventative care. Representative Joseph R. Pitts (R-PA) claimed that regulatory barriers prevented interoperability and integration of mobile medical apps and health records. Dave Vockell, CEO and founder of Lyfechannel, explained that his company built mobile programs that help patients follow their physicians' instructions. They integrated the patient with their EHR and a personal support team. Vockell emphasized the need for tech companies to be “integrated into the existing patient flow, whether it would be the physician or the provider or payer.” Id. at 13. Dan Riskin, founder of Health Fidelity, argued that current regulations did not allow analytics companies to see enough information about patients to innovate and improve care. Paul Misener, vice president of Global Public Policy at Amazon.com, explained how Amazon gives health care companies more computing power in the cloud. Misener proposed that the National Institutes of Health create cloud-based data management platforms where researchers could share more data. Misener also argued that the Health Insurance Portability and Accountability Act needed to be updated because its requirements were unreasonable for cloud computing. Robert Jarrin, senior director of government affairs for Qualcomm, described monitors, sensors, and mobile software that his firm produced for health. Jarrin complained that most of these devices were not reimbursed by Medicare and Medicaid, nor could they upload patient-generated data to their EHRs. Finally, Jonathan M. Niloff, doctor at Harvard Medical School and founder of a small health information technology company, criticized the lack of uniform standards and coordinated policies to “move patient data between care settings.” Id. at 56. Niloff asked Congress to clarify that “clinical and administrative software should not be regulated as medical devices.” Id. at 57.

17 See Scott Gottlieb & Coleen Klasmeier, Why Your Phone Isn't as Smart as It Could Be, Wall St. J. (Aug. 7, 2014), https://www.wsj.com/articles/scott-gottlieb-and-coleen-klasmeier-why-your-phone-isnt-as-smart-as-it-could-be-1407369163.

18 Id.

19 Id.

20 Id.

21 Id.

22 Id.

23 Id.

24 21st Century Cures Act, Pub. L. No. 114-255, § 3060, 130 Stat. 1130 (2016) (emphasis added).

25 Id.

26 See Twenty-First Century Technology for Twenty-First Century Cures, supra note 14.

27 21st Century Cures Act § 3060.

28 Regarding terminology, in that 2014 hearing, witnesses spoke of EHRs, whereas the Cures Act § 3060 speaks of EPRs. Elsewhere in the literature, either “electronic medical records” or “personal health records” is the term used. Although some recognize a significant distinction among these terms, we know of no consensus on terminology. For the most part, it seems like the terms are used interchangeably, generally without indication that the user of one term is aware of the alternatives. We do not take a position on what is the prevalent or correct terminology; however, in our personal lexicon, EHR is the broadest term and includes electronic systems that allow input of and access to PHI by both the patient or other end-user and health care providers. See Twenty-First Century Technology for Twenty-First Century Cures, supra note 14.

29 Section 3060 also exempts administrative software, such as that used for billing and claims-handling, from the definition of device, as Jonathan M. Niloff requested in the July 2014 hearing. See 21st Century Cures Act § 3060.

30 The FTC, in conjunction with the FDA, has paid considerable attention to the privacy issues around e-Health and mobile health apps. See, e.g., Mobile Health App Developers: FTC Best Practices, Fed. Trade Commission (Apr. 2016), https://www.ftc.gov/tips-advice/business-center/guidance/mobile-health-app-developers-ftc-best-practices [https://perma.cc/WB5X-85JD]; Mobile Health Apps Interactive Tool, Fed. Trade Commission (Apr. 2016), https://www.ftc.gov/tips-advice/business-center/guidance/mobile-health-apps-interactive-tool [https://perma.cc/E2AU-AY9D]; Tag: Consumer Privacy, Fed. Trade Commission, https://www.ftc.gov/consumer-protection/consumer-privacy [https://perma.cc/MD4C-VQK4].

31 21st Century Cures Act § 3060 (emphasis added). Although the law refers to action by the HHS Secretary, as a practical matter this determination could be made by the FDA Commissioner.

32 Id. (emphasis added).

33 Id. at § 3060.

34 See Katie Thomas, Senate Confirms Scott Gottlieb to Head F.D.A., N.Y. Times (May 9, 2017), https://www.nytimes.com/2017/05/09/health/scott-gottlieb-senate-fda-commissioner.html.

35 Orlando & Rosoff, supra note 2, at 1.

36 Thomas M. Burton, FDA Plans New Medical-Device Approval Process, Wall St. J. (Dec. 11, 2017), https://www.wsj.com/articles/fda-plans-new-medical-device-approval-processes-1513000850.

37 Id.

38 U.S. Food & Drug Admin., General Wellness: Policy for Low Risk Devices: Guidance for Industry and Food and Drug Administration Staff (2016), https://www.fda.gov/downloads/medicaldevices/deviceregulationandguidance/guidancedocuments/ucm429674.pdf (emphasis added).

39 See id.

40 See id.

41 Id. at 4.

42 Id.; see Medical Devices: Digital Health, Food & Drug Admin., https://www.fda.gov/MedicalDevices/DigitalHealth/default.htm (last updated Feb. 15, 2018) [https://perma.cc/PE4A-QQG8].

43 U.S. Food & Drug Admin., Proposed FDA Work Plan for 21^st Century Cures Act Innovation Account Activities (2017), https://www.fda.gov/downloads/AdvisoryCommittees/CommitteesMeetingMaterials/ScienceBoardtotheFoodandDrugAdministration/UCM556618.pdf (emphasis added).

44 See Cass R. Sunstein, Chevron Step Zero, 92 Va. L. Rev. 187, 187-91 (2006); see also Chevron, U.S.A., Inc. v. Nat. Res. Def. Council, Inc., 467 U.S. 837, 842-44 (1984).

45 Chevron, 467 U.S. at 865-66.

46 Sunstein, supra note 44, at 190.

47 Chevron, 467 U.S. at 842-43.

48 Id. at 843.

49 Sunstein, supra note 41, at 191.

50 Michigan v. Envtl. Prot. Agency., 135 S. Ct. 2699, 2711-12 (2015).

51 Regulatory Accountability Act, H.R. 5, 115th Cong. § 202 (2017) (passed by a vote of 238-183); see Lisa Lambert, House Republicans Pass Sweeping Regulatory Reform Bill, Ins. J. (Jan. 11, 2017), https://www.insurancejournal.com/news/national/2017/01/11/438665.htm [https://perma.cc/W9AR-89K7]; see also Lisa Lambert, Republicans Take Next Step in U.S. Deregulation with Senate Bill, U.S. News & World Rep. (Apr. 26, 2017, 6:34 PM), https://www.usnews.com/news/top-news/articles/2017-04-26/republicans-take-next-step-in-us-deregulation-with-senate-bill.

52 S. 951, 115th Cong. § 4 (2017); Republicans Take Next Step, supra note 51.

53 Steven Davidoff Solomon, Should Agencies Decide Law? Doctrine May Be Tested at Gorsuch Hearing, N.Y. Times (Mar. 14, 2017), https://www.nytimes.com/2017/03/14/business/dealbook/neil-gorsuchchevron-deference.html.

54 Republicans Take Next Step, supra note 51.

55 See Massimo Calabresi, Inside Donald Trump's War Against the State, Time (Mar. 8, 2017), http://time.com/4696428/donald-trump-war-state-government/ [https://perma.cc/DKZ4-M8SK]. See generally Tom Nichols, The Death of Expertise: The Campaign Against Established Knowledge and Why It Matters (2017).

56 See generally David Brooks, The Social Animal: The Hidden Sources of Love, Character, and Achievement (2011).

57 Patel, Mitesh S. et al., A Randomized Trial of Social Comparison Feedback and Financial Incentives to Increase Physical Activity, 30 Am. J. Health Promotion 416, 416 (2016)CrossRefGoogle ScholarPubMed.

58 Patel, Mitesh S. et al., Individual Versus Team-Based Financial Incentives to Increase Physical Activity: A Randomized, Controlled Trial, 31 J. Gen. Internal Med. 746, 746 (2016)CrossRefGoogle ScholarPubMed.

59 Id. at 746-54.

60 Tröster, Christian et al., Structuring for Team Success: The Interactive Effects of Network Structure and Cultural Diversity on Team Potency and Performance, 124 Org. Behav. Hum. Decision Process 245, 253 (2014)CrossRefGoogle Scholar (noting the “importance of social relationships in the formation and diffusion of shared beliefs and attitudes in teams” is well-established).

61 See Stavros Asimakopoulos et al., Motivation and User Engagement in Fitness Tracking: Heuristics for Mobile Healthcare Wearables, 4 Informatics 1, 8 (Jan. 22, 2017); Heather Kelly, Fitness Tools That Tap the Power of Your Friends, CNN (June 3, 2013), https://www.cnn.com/2013/06/03/tech/mobile/fitness-gadgets-motivation/index.html [https://perma.cc/Z52P-MA3M] (“People are connecting with friends on the apps and embracing … ways of swapping encouraging messages and trash talk, comparing workout stats, and using peer pressure and the need for approval to push each other to work out more and meet their goals.”).

62 Ciani, Oriana et al., Linking the Regulatory and Reimbursement Processes for Medical Devices: The Need for Integrated Assessments, 26 Health Econ. 13, 21 (2017)CrossRefGoogle ScholarPubMed.

63 Wilmoth, Daniel R., Reconciling Estimates of the Value to Firms of Reducing Regulatory Delay in the Marketing of Their New Drugs, 24 Health Econ. 1651, 1655 (2015)CrossRefGoogle Scholar.

64 See Peppet, Scott R., Regulating the Internet of Things: First Steps Toward Managing Discrimination, Privacy, Security, and Consent, 93 Tex. L. Rev. 85, 143 (2014)Google Scholar. See discussion infra Part IV.E.

65 Karen Turner, The Equifax Hacks Are a Case Study in Why We Need Better Data Breach Laws, Vox (Sept. 14, 2017), https://www.vox.com/policy-and-politics/2017/9/13/16292014/equifax-credit-breach-hack-report-security [https://perma.cc/SAK5-S7MT].

66 Peppet, supra note 64.

67 From this point through the end of this paragraph, PHI refers to the HIPAA definition, not the definition discussed in note 1.

68 Orlando & Rosoff, supra note 2.

69 Id.

70 Roberts, Jessica L., Healthism and the Law of Employment Discrimination, 99 >Iowa L. Rev. 571, 590-92 (2014)Google Scholar.

71 See Tom Costello, 100 Days Later, Nation Waits for FDA Overhaul, NBC News (Apr. 26, 2009), http://www.nbcnews.com/id/30388073/ [https://perma.cc/X3CD-DJEE]; see also Eric Lipton, F.D.A. Has 6 Inspectors for 3 Million Shipments of Cosmetics, N.Y. Times (Aug. 2, 2017), https://www.nytimes.com/2017/08/02/us/politics/fda-has-6-inspectors-for-3-million-shipments-of-cosmetics.html; Ron Nixon, Funding Gaps Hinders Law for Ensuring Food Safety, N.Y. Times (Apr. 7, 2015), https://www.nytimes.com/2015/04/08/us/food-safety-laws-funding-is-far-below-estimated-requirement.html.

72 See Parmy Olson, Wearable Tech Is Plugging into Health Insurance, Forbes (June 19, 2014), https://www.forbes.com/sites/parmyolson/2014/06/19/wearable-tech-health-insurance; see also Christina Farr, How Fitbit Became the Next Big Thing in Corporate Wellness, Fast Company (Apr. 18, 2016), https://www.fastcompany.com/3058462/how-fitbit-became-the-next-big-thing-in-corporate-wellness [https://perma.cc/748Y-7XZ4]; Elizabeth Gurdus, United HealthCare and Fitbit to Pay Users Up to $1,500 to Use Devices, Fitbit Co-Founder Says, CNBC (Jan. 5, 2017), https://www.cnbc.com/2017/01/05/unitedhealthcare-and-fitbit-to-pay-users-up-to-1500-to-use-devices.html [https://perma.cc/7BGJ-X2DZ].

73 See Valerie Wilson & William M. Rodgers III, Black-White Wage Gaps Expand with Rising Wage Inequality, Econ. Pol'y Inst. (Sept. 19, 2016), http://www.epi.org/files/pdf/101972.pdf; see also AFLCIO, The Elusive American Dream: Lower Wages, High Unemployment and an Uncertain Retirement for Latinos 3 (2013), http://www.aflcio.org/content/download/98601/2662151/file/LatinoReport.pdf.

74 See Michael Terasaki, Do End User License Agreements Bind Normal People?, 41 W. St. L. Rev. 467, 468-69 (2013).

75 Alex Hern, I Read All the Small Print on the Internet and It Made Me Want to Die, Guardian (June 15, 2015), https://www.theguardian.com/technology/2015/jun/15/i-read-all-the-small-print-on-the-internet [https://perma.cc/ZZ6X-YHUC] (delving into the complexities of EULAs); see, e.g., Annalee Newitz, Dangerous Terms: A User's Guide to EULAs, Elec. Frontier Found. (Feb. 17, 2005), https://www.eff.org/wp/dangerous-terms-users-guide-eulas [https://perma.cc/6CK8-SLEN].

76 Is the Product A Medical Device?, supra note 10.