However, the Federal Trade Commission seems ready to lock down PHRs a bit more. The agency has issued a new proposed rule that would require PHR vendors and related entities to let consumers know when their identifiable health information has been breached. The FTC is asking for public comment on this rule through June 1.

The rule stems from the big stimulus package, which requires HHS and the FTC to study privacy, security and breach notification for PHR vendors and related entities.