View Information Collection Request (ICR) Package

OMB Control No: 3084-0150	ICR Reference No: 201208-3084-004
Status: Historical Active	Previous ICR Reference No: 200909-3084-002
Agency/Subagency: FTC	Agency Tracking No:
Title: Health Breach Notification Rule
Type of Information Collection: Extension without change of a currently approved collection	Common Form ICR: No
Type of Review Request: Regular
OIRA Conclusion Action: Approved without change	Conclusion Date: 09/24/2012
	Date Received in OIRA: 08/24/2012
Terms of Clearance:

	Inventory as of this Action	Requested	Previously Approved
Expiration Date	09/30/2015	36 Months From Approved	09/30/2012
Responses	2	0	22
Time Burden (Hours)	200	0	34,837
Cost Burden (Dollars)	7,918	0	260,657

Abstract: The Health Breach Notification Rule ("Rule"), 16 C.F.R. Part 318, requires vendors of personal health records and PHR related entities to provide: (1) notice to consumers whose unsecured personally identifiable health information has been breached; and (2) notice to the Commission. The Rule only applies to electronic health records and does not include recordkeeping requirements. The Rule requires third party service providers (i.e., those companies that provide services such as billing or data storage) to notify vendors of personal health records and PHR related entities following the discovery of a breach; those entities in turn must provide notification to consumers and the Commission. To notify the FTC of a breach, the Commission developed a form for entities subject to the Rule to complete and return to the agency.

Authorizing Statute(s): PL: Pub.L. 111 - 5 13407 Name of Law: American Recovery and Reinvestment Act of 2009

Citations for New Statutory Requirements: PL: Pub.L. 111 - 5 13407 Name of Law: American Recovery and Reinvestment Act of 2009

Associated Rulemaking Information
RIN:	Stage of Rulemaking:	Federal Register Citation:	Date:
	Not associated with rulemaking

Federal Register Notices & Comments
60-day Notice:	Federal Register Citation:	Citation Date:
	77 FR 31612	05/29/2012
30-day Notice:	Federal Register Citation:	Citation Date:
	77 FR 51535	08/24/2012
Did the Agency receive public comments on this ICR? No

Number of Information Collection (IC) in this ICR: 1

IC Title	Form No.	Form Name
Creating a toll-free line & related non-labor costs
Identifying breach, affected customers, notifying customers, etc.

ICR Summary of Burden

	Total Approved	Previously Approved	Change Due to Adjustment in Estimate
Annual Number of Responses	2	22	-20
Annual Time Burden (Hours)	200	34,837	-34,637
Annual Cost Burden (Dollars)	7,918	260,657	-252,739

Burden increases because of Program Change due to Agency Discretion: No

Burden Increase Due to:

Burden decreases because of Program Change due to Agency Discretion: No

Burden Reduction Due to:

Short Statement: At the time the Rule was issued, insufficient data was available about the incidence of breaches in the PHR industry. Accordingly, FTC staff based its burden estimate on data pertaining to private sector breaches across multiple industries. Staff estimated that there would be 11 breaches per year requiring notification of 232,000 consumers. Because the Rule has now been in effect for almost three years, staff is now able to base the burden estimate on the actual notifications received from covered entities, which include the number of consumers notified. As discussed above, the notifications received indicate that an average of 2,500 consumers per year received notifications over the years 2010 and 2011. This number is about one percent of the figure staff had previously projected would require notification. Staff has updated the burden estimate based on these new figures. Further, staff's previous burden estimate included in the cost of a toll-free number, the costs associated with obtaining a T1 line (a specific type of telephone line that can carry more data than traditional telephone lines) and services such as queue messaging that are necessary when handling large call volumes. Because staff's current estimate does not include large projected call volumes, staff believes that affected entities will not need these additional services and equipment and did not include those cost estimates here.

Annual Cost to Federal Government: $75,000

Does this IC contain surveys, censuses, or employ statistical methods? No

Is the Supporting Statement intended to be a Privacy Impact Assessment required by the E-Government Act of 2002? No

Is this ICR related to the Affordable Care Act [Pub. L. 111-148 & 111-152]? No

Is this ICR related to the Dodd-Frank Wall Street Reform and Consumer Protection Act, [Pub. L. 111-203]? No

Is this ICR related to the American Recovery and Reinvestment Act of 2009 (ARRA)? Yes

Is this ICR related to the Pandemic Response? Uncollected

Agency Contact: Amanda Koulousias 202 326-3334 akoulousias@ftc.gov

View ICR - OIRA Conclusion