Covered entities using medical health apps that intend to process or
store protected health information (PHI) are subject to the federal
Health Insurance Portability Accountability Act (HIPAA) and the Heath
Information Technology for Economic and Clinical Health (HITECH)
Act. Under these regulations, security breaches require notification
and could result in penalties up to $50,000 per incident. There are also
concerns that hackers could use these apps to obtain PHI and/or steal
the devices to commit crimes. However, Terry [130] argue that HIPAA
rules may not apply to health data collected thru modern electronic
technology.
Additionally, the FDA has provided guidance on using electronic
source data (i.e., EHR) in clinical trials. (http://www.fda.
gov/downloads/Drugs/GuidanceComplianceRegulatoryInformation/
Guidances/UCM328691.pdf).