Agency Information Collection Activities; Proposed Collection; Comment Request; Extension, 10792-10795 [2022-03958]

Download as PDF lotter on DSK11XQN23PROD with NOTICES1 10792 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Notices requirements in the Alternative Fuels Rule (‘‘Rule’’). That clearance expires on March 30, 2022. DATES: Comments must be submitted by March 28, 2022. ADDRESSES: Written comments and recommendations for the proposed information collection should be sent within 30 days of publication of this notice to www.reginfo.gov/public/do/ PRAMain. Find this particular information collection by selecting ‘‘Currently under Review—Open for Public Comments’’ or by using the search function. FOR FURTHER INFORMATION CONTACT: Hampton Newsome, Attorney, (202) 326–2889, Division of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. SUPPLEMENTARY INFORMATION: Title: Labeling Requirements for Alternative Fuels and Alternative Fueled Vehicles (‘‘Alternative Fuels Rule’’), 16 CFR part 309. OMB Control Number: 3084–0094. Type of Review: Extension without change of currently approved collection. Affected Public: Private Sector: Businesses and other for-profit entities. Estimated Annual Burden Hours: 6,000 hours. Estimated Annual Labor Costs: $175,298. Estimated Non-Labor Costs: $3,040. Abstract: The Energy Policy Act of 1992 established federal programs to encourage the development of alternative fuels and alternative fueled vehicles (‘‘AFVs’’). Section 406(a) of the Act directed the Commission to establish uniform labeling requirements for alternative fuels and AFVs. 42 U.S.C. 13232(a). Such labels must provide ‘‘appropriate information with respect to costs and benefits [of alternative fuels and AFVs], so as to reasonably enable the consumer to make choices and comparisons.’’ The required labels must be ‘‘simple and, where appropriate, consolidated with other labels providing information to the consumer.’’ Pursuant to the Act, the Commission published the Alternative Fuels Rule in 1995, and the Rule was later amended in 2013. The Rule requires disclosure of specific information on labels posted on fuel dispensers for non-liquid alternative fuels. To ensure the accuracy of these disclosures, the Rule also requires that sellers maintain records substantiating product-specific disclosures they include on these labels. In addition, the Rule requires that distributors of non-liquid alternative vehicle fuel provide certifications of the VerDate Sep<11>2014 16:44 Feb 24, 2022 Jkt 256001 fuel rating in each transfer to anyone who is not a consumer. Request for Comment: On October 6, 2021, the Commission sought comment on the information collection requirements associated with the Privacy Rule. 86 FR 55607 (Oct. 6, 2021). No relevant comments were received. Pursuant to the OMB regulations, 5 CFR part 1320, the FTC is providing this second opportunity for public comment while seeking OMB approval to renew clearance for the Rule’s information collection requirements. Your comment—including your name and your state—will be placed on the public record of this proceeding. Because your comment will be made public, you are solely responsible for making sure that your comment does not include any sensitive personal information, like anyone’s Social Security number, date of birth, driver’s license number or other state identification number or foreign country equivalent, passport number, financial account number, or credit or debit card number. You are also solely responsible for making sure that your comment does not include any sensitive health information, like medical records or other individually identifiable health information. In addition, do not include any ‘‘[t]rade secret or any commercial or financial information which is . . . privileged or confidential’’ as provided in Section 6(f) of the FTC Act 15 U.S.C. 46(f), and FTC Rule 4.10(a)(2), 16 CFR 4.10(a)(2). In particular, do not include competitively sensitive information such as costs, sales statistics, inventories, formulas, patterns devices, manufacturing processes, or customer names. Josephine Liu, Assistant General Counsel for Legal Counsel. [FR Doc. 2022–03956 Filed 2–24–22; 8:45 am] BILLING CODE 6750–01–P FEDERAL TRADE COMMISSION Agency Information Collection Activities; Proposed Collection; Comment Request; Extension Federal Trade Commission. Notice. AGENCY: ACTION: In accordance with the Paperwork Reduction Act of 1995 (PRA), the Federal Trade Commission (FTC or Commission) is seeking public comment on its proposal to extend for an additional three years the Office of Management and Budget (OMB) clearance for information collection requirements contained in the rules and SUMMARY: PO 00000 Frm 00029 Fmt 4703 Sfmt 4703 regulations under the Health Breach Notification Rule (or Rule). That clearance expires on June 30, 2022. DATES: Comments must be received on or before April 26, 2022. ADDRESSES: Interested parties may file a comment online or on paper by following the instructions in the Request for Comments part of the SUPPLEMENTARY INFORMATION section below. Write ‘‘Health Breach Notification Rule; PRA Comment: FTC File No. P072108’’ on your comment, and file your comment online at https:// www.regulations.gov by following the instructions on the web-based form. If you prefer to file your comment on paper, mail your comment to the following address: Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Suite CC–5610 (Annex J), Washington, DC 20580, or deliver your comment to the following address: Federal Trade Commission, Office of the Secretary, Constitution Center, 400 7th Street SW, 5th Floor, Suite 5610 (Annex J), Washington, DC 20024. FOR FURTHER INFORMATION CONTACT: Ryan Mehm, Attorney, Bureau of Consumer Protection, (202) 326–2918, Federal Trade Commission, 600 Pennsylvania Ave. NW, Washington, DC 20580. SUPPLEMENTARY INFORMATION: Title: Health Breach Notification Rule. OMB Control Number: 3084–0150. Type of Review: Extension of a currently approved collection. Abstract: The Health Breach Notification Rule (Rule), 16 CFR part 318, requires vendors of personal health records (PHR) and PHR related entities to provide notice to: (1) Consumers whose unsecured personally identifiable health information has been reached; (2) the Commission; and (3) in some cases, the media. The Rule only applies to electronic health records and does not include recordkeeping requirements. The Rule requires third party service providers (e.g., those companies that provide services such as billing or data storage) to vendors of personal health records and PHR related entities to provide notification to such vendors and PHR related entities following the discovery of a breach. To notify the FTC of a breach, the Commission developed a simple, two-page form, which is posted at https://www.ftc.gov/system/ files/documents/rules/health-breachnotification-rule/health_breach_ form.pdf Likely Respondents: Vendors of personal health records, PHR related entities and third party service providers. E:\FR\FM\25FEN1.SGM 25FEN1 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Notices Estimated Annual Hours Burden: 4,654. Estimated Frequency: 2,500 singleperson breaches per year and 0.33 major breaches per year. Total Annual Labor Cost: $90,741. Total Annual Capital or Other NonLabor Cost: $31,056. As required by section 3506(c)(2)(A) of the PRA, 44 U.S.C. 3506(c)(2)(A), the FTC is providing this opportunity for public comment before requesting that OMB extend the existing clearance for the information collection requirements contained in the Commission’s Health Breach Notification Rule. Burden Estimates lotter on DSK11XQN23PROD with NOTICES1 Brief Description of the Need for and Proposed Use of the Information The Health Breach Notification Rule (Rule), 16 CFR part 318 (OMB Control Number 3084–0150), requires vendors of personal health records and PHR related entities to provide notice to: (1) Consumers whose unsecured personally identifiable health information has been breached; (2) the Commission; and (3) in some cases, the media.1 Under the Rule, consumers whose unsecured, individually identifiable health information has been breached must receive notice ‘‘without unreasonable delay and in no case later than 60 calendar days’’ after discovery of the breach. Among other information, the notices must provide consumers with steps they can take to protect themselves from potential harm resulting from the breach. To notify the FTC of a breach, the Commission developed a simple, two-page form, which is posted at https://www.ftc.gov/ system/files/documents/rules/healthbreach-notification-rule/health_breach_ form.pdf. For breaches involving the health information of 500 or more individuals, entities must notify the Commission as soon as possible, and in any event no later than ten business days after discovering the breach. Entities may report all breaches involving the information of fewer than 500 individuals in an annual submission covering the prior calendar year. The Commission uses entities’ notifications to compile a list of 1 On September 15, 2021, the Commission, in light of changes in the marketplace, issued a Policy Statement that clarified that the Rule applies to most health apps and similar technologies that are not covered by the Health Insurance Portability and Accountability Act (‘‘HIPAA’’). Statement of the Commission on Breaches by Health Apps and Other Connected Devices, Fed. Trade Comm’n (Sept. 15, 2021), available at: https://www.ftc.gov/system/ files/documents/public_statements/1596364/ statement_of_the_commission_on_breaches_by_ health_apps_and_other_connected_devices.pdf (‘‘Policy Statement’’). VerDate Sep<11>2014 16:44 Feb 24, 2022 Jkt 256001 breaches affecting 500 or more individuals that is publicly available on the FTC’s website. The list provides businesses with information about potential sources of data breaches, which is helpful to those developing data security procedures. It also provides the public with information about the extent of data breaches. The Rule also requires third party service providers (e.g., those companies that provide services such as billing or data storage) to vendors of personal health records and PHR related entities to provide notification to such vendors and PHR related entities following the discovery of a breach. The Rule only applies to electronic health records and does not include recordkeeping requirements. As required by section 3506(c)(2)(A) of the PRA, 44 U.S.C. 3506(c)(2)(A), the FTC is providing this opportunity for public comment before requesting that OMB extend the existing clearance for the information collection requirements contained in the Rule. Burden Estimates The PRA burden of the Rule’s requirements depends on a variety of factors, including the number of covered firms; the percentage of such firms that will experience a breach requiring further investigation and, if necessary, the sending of breach notices; and the number of consumers notified. The annual hours and cost estimates below likely overstate the burden because, among other things, they assume, though it is not necessarily so, that all covered firms experiencing breaches subject to the Rule’s notification requirements will be required to take all of the steps described below. The analysis may also overstate the burden of the Rule’s requirements because it assumes that covered firms would not take any of the steps described were it not for the requirements of the Rule. For example, the analysis incorporates labor costs associated with understanding what information has been breached. It seems likely that some firms would incur such costs even in the absence of the Rule’s requirements because the firms are independently interested in identifying, understanding, and remediating security risks. A company that investigates, for its own purposes, what information has been breached is unlikely to fully duplicate the costs of that investigation in complying with the Rule. Therefore, it may not be correct in all cases that complying with the Rule results in added labor costs for this activity. Nevertheless, in order to allow for a complete understanding of all the PO 00000 Frm 00030 Fmt 4703 Sfmt 4703 10793 potential costs associated with compliance, these costs are included in this analysis. At the time the Rule was issued in 2009, insufficient data was available about the incidence of breaches in the PHR industry. Accordingly, staff based its burden estimate on data pertaining to private sector breaches across multiple industries. Staff estimated that there would be 11 breaches per year requiring notification of 232,000 consumers. In 2016, based on available data from the years 2010 through 2014, staff arrived at new estimates, projecting an average of two breaches per year affecting a total of 40,000 individual consumers. The Rule has now been in effect for over ten years, and new data regarding the number and scale of reported breaches from 2017 through 2021 allow staff to update its burden estimates. A review of the breach reports received by the FTC from 2010 through 2021 reveals that there are two primary categories of breaches reported: (1) ‘‘single-person breaches,’’ incidents in which a single individual’s information is potentially compromised; and (2) what are hereafter described as ‘‘major breaches,’’ in which multiple—and typically, many— individuals are affected. These two categories of breaches are addressed separately in this analysis because the frequency and costs of the categories differ significantly. Nearly all of the submissions received between 2010 and 2021—over 99% of them—reported single-person breaches related to an individual’s loss of control over his or her login credentials. The rate of such breaches has fluctuated significantly since the Rule went into effect. Whereas from 2011 to 2014 the average annual number of single-person breaches was 7,502, from 2014 to 2017 the average was almost 15,000. From 2018 to 2021, the rate dropped significantly to 2,500. Assuming that this rate continues, staff estimates that between 2022 and 2025 the agency will receive, on average, about 2,500 singleperson breach reports per year. By contrast, major breach reports are quite infrequent. On average, the FTC receives one major breach report approximately every two and a half years, with an average of approximately 200,000 persons affected. Given the low frequency at which major breaches occur, FTC staff are unable to identify any meaningful trends in the frequency of major breach reports. FTC staff has not identified any existing research allowing us to make specific projections about future variation in the frequency of major breaches. Consequently, FTC staff has assumed that the average frequency and scale of major breaches E:\FR\FM\25FEN1.SGM 25FEN1 lotter on DSK11XQN23PROD with NOTICES1 10794 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Notices will remain more or less static. Staff’s calculations are based on the estimate that a major breach will occur approximately every two and a half years and that 200,000 people will be affected by each major breach, for an annual average of 80,000 individuals affected per year. Estimated Annual Burden Hours: 4,654. As explained in more detail within the next section, FTC staff projects that the employee time required for each single-person breach is quite minimal because the processes for notifying consumers are largely automated and single-person breaches can be reported to the FTC in an aggregate annual notification using the FTC’s two-page form. On average, staff estimates that covered firms will require approximately 20 seconds of employee labor per single-person breach. With an estimated 2,500 single-person breaches per year, the total estimated burden hours for single-person breaches is approximately 14 hours. For each major breach, covered firms will require on average 100 hours of employee labor to determine what information has been breached, identify affected customers, prepare the breach notice, and submit the required report to the Commission. Based on staff’s estimate that one major breach occurs every two and a half years, the average annual burden of major breaches amounts to 40 hours per year. Additionally, covered firms will incur labor costs associated with processing calls they may receive in the event of a major breach. The Rule requires that covered firms that fail to contact 10 or more consumers because of insufficient or out-of-date contact information must provide substitute notice through either a clear and conspicuous posting on their website or media notice. Such substitute notice must include a toll-free number for the purpose of allowing a consumer to learn whether or not his/her information was affected by the breach. Individuals contacted directly will have already received this information. Staff estimates that no more than 10 percent of affected consumers will utilize the offered toll-free number. Thus, of the 200,000 consumers affected by a major breach, staff estimates that 20,000 may call the companies over the 90 days they are required to provide such access. Staff additionally projects that 10,000 additional consumers who are not affected by the breach will also call the companies during this period. Staff estimates that processing all 30,000 calls will require an average of 11,500 hours of employee labor resulting in an average annual burden of 4,600 labor VerDate Sep<11>2014 16:44 Feb 24, 2022 Jkt 256001 hours. Given the low frequency of major breaches, the annual average requirement for major breaches is 4,640 hours. The combined annual hours burden for both single-person and major breaches therefore is 4,654 (4,640 + 14). Estimated Annual Labor Costs: $90,741. For each single-person breach, FTC staff estimates that the average 20 seconds of employee labor to provide (likely automated) notification to affected individuals and produce an annual breach notification for submission to the FTC will cost approximately $0.27 per breach. With an estimated 2,500 single-person breaches per year, the annual labor costs associated with all single-person breaches come to $675. For major breaches, FTC staff projects that the average 100 hours of employee labor costs (excluding outside forensic services, discussed below as estimated non-labor costs) to determine what information has been breached, identify the affected customers, prepare the breach notice, and report to the Commission will cost an average of $66.66 per hour for a total of $6,666.2 Based on an estimated one breach every two and a half years, the annual employee labor cost burden for affected entities to perform these tasks is $2,666. Additionally, staff expects covered firms will require, for each major breach, 11,500 hours of labor associated with answering consumer telephone calls at a cost of $218,500.3 Since a major breach occurs approximately every two and a half years, the average annual burden of 4,600 labor hours results in annualized labor cost of approximately $87,400. Accordingly, estimated cumulative annual labor costs, excluding outside forensic services, for both single-person and major breaches, is $90,741 ($87,400 + $2,666 + $675). Estimated Annual Capital and Other Non-Labor Costs: $31,056. Commission staff estimates that capital and other non-labor costs 2 Hourly wages throughout this document are based on mean hourly wages found at http:// www.bls.gov/news.release/ocwage.htm (‘‘Occupational Employment and Wages—May 2020,’’ U.S. Department of Labor, released March 2021, Table 1 (‘‘National employment and wage data from the Occupational Employment Statistics survey by occupation, May 2020’’). The breakdown of labor hours and costs is as follows: 50 hours of computer and information systems managerial time at approximately $78 per hour; 12 hours of marketing manager time at $74 per hour; 33 hours of computer programmer time at $46 per hour; and 5 hours of legal staff time at $72 per hour. 3 The cost of telephone operators is estimated at $19/hour. PO 00000 Frm 00031 Fmt 4703 Sfmt 4703 associated with single-person breaches will be negligible. Companies generally use automated notification systems to notify consumers of single-person breaches. Automated notifications are typically delivered by email or other electronic methods. The costs of providing such electronic notifications are minimal. Commission staff anticipates that capital and other non-labor costs associated with major breaches will consist of the following: 1. Services of a forensic expert in investigating the breach; 2. notification of consumers via email, mail, web posting, or media; and 3. the cost of setting up a toll-free number, if needed. Staff estimates that, for each major breach, covered firms will require 240 hours of a forensic expert’s time, at a cumulative cost of $37,440 for each breach. This estimate is based on a projection that an average major breach will affect approximately 20 machines and that a forensic analyst will require about 12 hours per machine to conduct his or her analysis. The projected cost of retaining the forensic analyst consists of the hourly wages of an information security analyst ($52), tripled to reflect profits and overhead for an outside consultant ($156), and multiplied by 240 hours. Based on the estimate that there will be one major breach every two and a half years, the annual cost associated with the services of an outside forensic expert is $14,976. As explained above, staff estimates that an average of 200,000 consumers will be entitled to notification of each major breach. Given the online relationship between consumers and vendors of personal health records and PHR related entities, most notifications will be made by email and the cost of such notifications will be minimal. In some cases, however, vendors of personal health records and PHR related entities will need to notify individuals by postal mail, either because these individuals have asked for such notification, or because the email addresses of these individuals are not current or not working. Staff estimates that the cost of a mailed notice is $0.11 for the paper and envelope, and $0.58 for a first class stamp. Assuming that vendors of personal health records and PHR related entities will need to notify by postal mail 10 percent of the 200,000 customers whose information is breached, the estimated cost of this notification will be $13,800 per breach. The annual cost will be around $5,520. In addition, vendors of personal health records and PHR related entities may need to notify consumers by E:\FR\FM\25FEN1.SGM 25FEN1 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Notices lotter on DSK11XQN23PROD with NOTICES1 posting a message on their home page, or by providing media notice. Staff estimates the cost of providing notice via website posting to be $0.08 per breached record, and the cost of providing notice via published media to be $0.04 per breached record. Applied to the above-stated estimate of 200,000 affected consumers, the estimated total cost of website notice will be $16,000, and the estimated total cost of media notice will be $8,000, yielding an estimated total per-breach cost for both forms of notice to consumers of $24,000. Annualized, this number is approximately $9,600 per year. Finally, staff estimates that the cost of providing a toll-free number will depend on the costs associated with T1 lines sufficient to handle the projected call volume and the cost of obtaining a toll-free telephone number. Based on industry research, staff projects that affected entities may need two T1 lines at a cost of $1,800 for the 90-day period. In addition, staff estimates the cost of obtaining a dedicated toll-free line to be $100 per month. Accordingly, staff projects that the cost of obtaining two toll-free lines for 90 days will be $2,400. The total annualized cost for providing a toll-free number will be $960. In sum, the total annual estimate for non-labor costs associated with major breaches is $31,056: $14,976 (services of a forensic expert) + $5,520 (cost of mail notifications) + $9,600 (cost of website and media notice) + $960 (cost of providing a toll-free number). Negligible non-labor costs are associated with single-person breaches. The total estimated PRA annual cost burden is $90,741 for labor costs and $31,056 for non-labor costs, totaling approximately $121,797. Request for Comments Pursuant to Section 3506(c)(2)(A) of the PRA, the FTC invites comments on: (1) Whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information will have practical utility; (2) the accuracy of the agency’s estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions used; (3) ways to enhance the quality, utility, and clarity of the information to be collected; and (4) ways to minimize the burden of maintaining records and providing disclosures to consumers. All comments must be received on or before April 26, 2022. You can file a comment online or on paper. For the FTC to consider your comment, we must receive it on or before April 26, 2022. Write ‘‘Health VerDate Sep<11>2014 16:44 Feb 24, 2022 Jkt 256001 Breach Notification Rule; PRA Comment: FTC File No. P072108’’ on your comment. Your comment— including your name and your state— will be placed on the public record of this proceeding, including the https:// www.regulations.gov website. Due to the public health emergency in response to the COVID–19 outbreak and the agency’s heightened security screening, postal mail addressed to the Commission will be subject to delay. We encourage you to submit your comments online through the https:// www.regulations.gov website. If you prefer to file your comment on paper, write ‘‘Health Breach Notification Rule; PRA Comment: FTC File No. P072108’’ on your comment and on the envelope, and mail your comment to the following address: Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Suite CC–5610 (Annex J), Washington, DC 20580; or deliver your comment to the following address: Federal Trade Commission, Office of the Secretary, Constitution Center, 400 7th Street SW, 5th Floor, Suite 5610 (Annex J), Washington, DC 20024. If possible, submit your paper comment to the Commission by courier or overnight service. Because your comment will become publicly available at https:// www.regulations.gov, you are solely responsible for making sure that your comment does not include any sensitive or confidential information. In particular, your comment should not include any sensitive personal information, such as your or anyone else’s Social Security number; date of birth; driver’s license number or other state identification number, or foreign country equivalent; passport number; financial account number; or credit or debit card number. You are also solely responsible for making sure that your comment does not include any sensitive health information, such as medical records or other individually identifiable health information. In addition, your comment should not include any ‘‘trade secret or any commercial or financial information which . . . . is privileged or confidential’’—as provided by Section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule 4.10(a)(2), 16 CFR 4.10(a)(2)— including in particular competitively sensitive information such as costs, sales statistics, inventories, formulas, patterns, devices, manufacturing processes, or customer names. Comments containing material for which confidential treatment is requested must be filed in paper form, must be clearly labeled ‘‘Confidential,’’ PO 00000 Frm 00032 Fmt 4703 Sfmt 4703 10795 and must comply with FTC Rule 4.9(c). In particular, the written request for confidential treatment that accompanies the comment must include the factual and legal basis for the request, and must identify the specific portions of the comment to be withheld from the public record. See FTC Rule 4.9(c). Your comment will be kept confidential only if the General Counsel grants your request in accordance with the law and the public interest. Once your comment has been posted publicly at www.regulations.gov, we cannot redact or remove your comment unless you submit a confidentiality request that meets the requirements for such treatment under FTC Rule 4.9(c), and the General Counsel grants that request. The FTC Act and other laws that the Commission administers permit the collection of public comments to consider and use in this proceeding, as appropriate. The Commission will consider all timely and responsive public comments that it receives on or before April 26, 2022. For information on the Commission’s privacy policy, including routine uses permitted by the Privacy Act, see https://www.ftc.gov/ site-information/privacy-policy. Josephine Liu, Assistant General Counsel for Legal Counsel. [FR Doc. 2022–03958 Filed 2–24–22; 8:45 am] BILLING CODE 6750–01–P GENERAL SERVICES ADMINISTRATION [OMB Control No. 3090–0112; Docket No. 2021–0001; Sequence No. 13] Submission for OMB Review; Federal Management Regulation; State Agency Monthly Donation Report of Surplus Property, GSA Form 3040 Federal Acquisition Service, General Services Administration (GSA). ACTION: Notice of request for public comments regarding a renewal to an existing OMB clearance. AGENCY: Under the provisions of the Paperwork Reduction Act, the Regulatory Secretariat Division will be submitting to the Office of Management and Budget (OMB) a request to review and approve an extension of a previously approved information collection requirement regarding State Agency Monthly Donation Report of Surplus Property, GSA Form 3040. DATES: Submit comments on or before March 28, 2022. ADDRESSES: Written comments and recommendations for this information SUMMARY: E:\FR\FM\25FEN1.SGM 25FEN1

Agencies

[Federal Register Volume 87, Number 38 (Friday, February 25, 2022)]
[Notices]
[Pages 10792-10795]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-03958]


-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION


Agency Information Collection Activities; Proposed Collection; 
Comment Request; Extension

AGENCY: Federal Trade Commission.

ACTION: Notice.

-----------------------------------------------------------------------

SUMMARY: In accordance with the Paperwork Reduction Act of 1995 (PRA), 
the Federal Trade Commission (FTC or Commission) is seeking public 
comment on its proposal to extend for an additional three years the 
Office of Management and Budget (OMB) clearance for information 
collection requirements contained in the rules and regulations under 
the Health Breach Notification Rule (or Rule). That clearance expires 
on June 30, 2022.

DATES: Comments must be received on or before April 26, 2022.

ADDRESSES: Interested parties may file a comment online or on paper by 
following the instructions in the Request for Comments part of the 
SUPPLEMENTARY INFORMATION section below. Write ``Health Breach 
Notification Rule; PRA Comment: FTC File No. P072108'' on your comment, 
and file your comment online at https://www.regulations.gov by 
following the instructions on the web-based form. If you prefer to file 
your comment on paper, mail your comment to the following address: 
Federal Trade Commission, Office of the Secretary, 600 Pennsylvania 
Avenue NW, Suite CC-5610 (Annex J), Washington, DC 20580, or deliver 
your comment to the following address: Federal Trade Commission, Office 
of the Secretary, Constitution Center, 400 7th Street SW, 5th Floor, 
Suite 5610 (Annex J), Washington, DC 20024.

FOR FURTHER INFORMATION CONTACT: Ryan Mehm, Attorney, Bureau of 
Consumer Protection, (202) 326-2918, Federal Trade Commission, 600 
Pennsylvania Ave. NW, Washington, DC 20580.

SUPPLEMENTARY INFORMATION:
    Title: Health Breach Notification Rule.
    OMB Control Number: 3084-0150.
    Type of Review: Extension of a currently approved collection.
    Abstract: The Health Breach Notification Rule (Rule), 16 CFR part 
318, requires vendors of personal health records (PHR) and PHR related 
entities to provide notice to: (1) Consumers whose unsecured personally 
identifiable health information has been reached; (2) the Commission; 
and (3) in some cases, the media. The Rule only applies to electronic 
health records and does not include recordkeeping requirements. The 
Rule requires third party service providers (e.g., those companies that 
provide services such as billing or data storage) to vendors of 
personal health records and PHR related entities to provide 
notification to such vendors and PHR related entities following the 
discovery of a breach. To notify the FTC of a breach, the Commission 
developed a simple, two-page form, which is posted at https://www.ftc.gov/system/files/documents/rules/health-breach-notification-rule/health_breach_form.pdf
    Likely Respondents: Vendors of personal health records, PHR related 
entities and third party service providers.

[[Page 10793]]

    Estimated Annual Hours Burden: 4,654.
    Estimated Frequency: 2,500 single-person breaches per year and 0.33 
major breaches per year.
    Total Annual Labor Cost: $90,741.
    Total Annual Capital or Other Non-Labor Cost: $31,056.
    As required by section 3506(c)(2)(A) of the PRA, 44 U.S.C. 
3506(c)(2)(A), the FTC is providing this opportunity for public comment 
before requesting that OMB extend the existing clearance for the 
information collection requirements contained in the Commission's 
Health Breach Notification Rule.

Burden Estimates

Brief Description of the Need for and Proposed Use of the Information

    The Health Breach Notification Rule (Rule), 16 CFR part 318 (OMB 
Control Number 3084-0150), requires vendors of personal health records 
and PHR related entities to provide notice to: (1) Consumers whose 
unsecured personally identifiable health information has been breached; 
(2) the Commission; and (3) in some cases, the media.\1\ Under the 
Rule, consumers whose unsecured, individually identifiable health 
information has been breached must receive notice ``without 
unreasonable delay and in no case later than 60 calendar days'' after 
discovery of the breach. Among other information, the notices must 
provide consumers with steps they can take to protect themselves from 
potential harm resulting from the breach. To notify the FTC of a 
breach, the Commission developed a simple, two-page form, which is 
posted at https://www.ftc.gov/system/files/documents/rules/health-breach-notification-rule/health_breach_form.pdf. For breaches involving 
the health information of 500 or more individuals, entities must notify 
the Commission as soon as possible, and in any event no later than ten 
business days after discovering the breach. Entities may report all 
breaches involving the information of fewer than 500 individuals in an 
annual submission covering the prior calendar year. The Commission uses 
entities' notifications to compile a list of breaches affecting 500 or 
more individuals that is publicly available on the FTC's website. The 
list provides businesses with information about potential sources of 
data breaches, which is helpful to those developing data security 
procedures. It also provides the public with information about the 
extent of data breaches.
---------------------------------------------------------------------------

    \1\ On September 15, 2021, the Commission, in light of changes 
in the marketplace, issued a Policy Statement that clarified that 
the Rule applies to most health apps and similar technologies that 
are not covered by the Health Insurance Portability and 
Accountability Act (``HIPAA''). Statement of the Commission on 
Breaches by Health Apps and Other Connected Devices, Fed. Trade 
Comm'n (Sept. 15, 2021), available at: https://www.ftc.gov/system/files/documents/public_statements/1596364/statement_of_the_commission_on_breaches_by_health_apps_and_other_connected_devices.pdf (``Policy Statement'').
---------------------------------------------------------------------------

    The Rule also requires third party service providers (e.g., those 
companies that provide services such as billing or data storage) to 
vendors of personal health records and PHR related entities to provide 
notification to such vendors and PHR related entities following the 
discovery of a breach.
    The Rule only applies to electronic health records and does not 
include recordkeeping requirements.
    As required by section 3506(c)(2)(A) of the PRA, 44 U.S.C. 
3506(c)(2)(A), the FTC is providing this opportunity for public comment 
before requesting that OMB extend the existing clearance for the 
information collection requirements contained in the Rule.

Burden Estimates

    The PRA burden of the Rule's requirements depends on a variety of 
factors, including the number of covered firms; the percentage of such 
firms that will experience a breach requiring further investigation 
and, if necessary, the sending of breach notices; and the number of 
consumers notified. The annual hours and cost estimates below likely 
overstate the burden because, among other things, they assume, though 
it is not necessarily so, that all covered firms experiencing breaches 
subject to the Rule's notification requirements will be required to 
take all of the steps described below.
    The analysis may also overstate the burden of the Rule's 
requirements because it assumes that covered firms would not take any 
of the steps described were it not for the requirements of the Rule. 
For example, the analysis incorporates labor costs associated with 
understanding what information has been breached. It seems likely that 
some firms would incur such costs even in the absence of the Rule's 
requirements because the firms are independently interested in 
identifying, understanding, and remediating security risks. A company 
that investigates, for its own purposes, what information has been 
breached is unlikely to fully duplicate the costs of that investigation 
in complying with the Rule. Therefore, it may not be correct in all 
cases that complying with the Rule results in added labor costs for 
this activity. Nevertheless, in order to allow for a complete 
understanding of all the potential costs associated with compliance, 
these costs are included in this analysis.
    At the time the Rule was issued in 2009, insufficient data was 
available about the incidence of breaches in the PHR industry. 
Accordingly, staff based its burden estimate on data pertaining to 
private sector breaches across multiple industries. Staff estimated 
that there would be 11 breaches per year requiring notification of 
232,000 consumers. In 2016, based on available data from the years 2010 
through 2014, staff arrived at new estimates, projecting an average of 
two breaches per year affecting a total of 40,000 individual consumers.
    The Rule has now been in effect for over ten years, and new data 
regarding the number and scale of reported breaches from 2017 through 
2021 allow staff to update its burden estimates. A review of the breach 
reports received by the FTC from 2010 through 2021 reveals that there 
are two primary categories of breaches reported: (1) ``single-person 
breaches,'' incidents in which a single individual's information is 
potentially compromised; and (2) what are hereafter described as 
``major breaches,'' in which multiple--and typically, many--individuals 
are affected. These two categories of breaches are addressed separately 
in this analysis because the frequency and costs of the categories 
differ significantly.
    Nearly all of the submissions received between 2010 and 2021--over 
99% of them--reported single-person breaches related to an individual's 
loss of control over his or her login credentials. The rate of such 
breaches has fluctuated significantly since the Rule went into effect. 
Whereas from 2011 to 2014 the average annual number of single-person 
breaches was 7,502, from 2014 to 2017 the average was almost 15,000. 
From 2018 to 2021, the rate dropped significantly to 2,500. Assuming 
that this rate continues, staff estimates that between 2022 and 2025 
the agency will receive, on average, about 2,500 single-person breach 
reports per year.
    By contrast, major breach reports are quite infrequent. On average, 
the FTC receives one major breach report approximately every two and a 
half years, with an average of approximately 200,000 persons affected. 
Given the low frequency at which major breaches occur, FTC staff are 
unable to identify any meaningful trends in the frequency of major 
breach reports. FTC staff has not identified any existing research 
allowing us to make specific projections about future variation in the 
frequency of major breaches. Consequently, FTC staff has assumed that 
the average frequency and scale of major breaches

[[Page 10794]]

will remain more or less static. Staff's calculations are based on the 
estimate that a major breach will occur approximately every two and a 
half years and that 200,000 people will be affected by each major 
breach, for an annual average of 80,000 individuals affected per year.
    Estimated Annual Burden Hours: 4,654.
    As explained in more detail within the next section, FTC staff 
projects that the employee time required for each single-person breach 
is quite minimal because the processes for notifying consumers are 
largely automated and single-person breaches can be reported to the FTC 
in an aggregate annual notification using the FTC's two-page form. On 
average, staff estimates that covered firms will require approximately 
20 seconds of employee labor per single-person breach. With an 
estimated 2,500 single-person breaches per year, the total estimated 
burden hours for single-person breaches is approximately 14 hours.
    For each major breach, covered firms will require on average 100 
hours of employee labor to determine what information has been 
breached, identify affected customers, prepare the breach notice, and 
submit the required report to the Commission. Based on staff's estimate 
that one major breach occurs every two and a half years, the average 
annual burden of major breaches amounts to 40 hours per year.
    Additionally, covered firms will incur labor costs associated with 
processing calls they may receive in the event of a major breach. The 
Rule requires that covered firms that fail to contact 10 or more 
consumers because of insufficient or out-of-date contact information 
must provide substitute notice through either a clear and conspicuous 
posting on their website or media notice. Such substitute notice must 
include a toll-free number for the purpose of allowing a consumer to 
learn whether or not his/her information was affected by the breach.
    Individuals contacted directly will have already received this 
information. Staff estimates that no more than 10 percent of affected 
consumers will utilize the offered toll-free number. Thus, of the 
200,000 consumers affected by a major breach, staff estimates that 
20,000 may call the companies over the 90 days they are required to 
provide such access. Staff additionally projects that 10,000 additional 
consumers who are not affected by the breach will also call the 
companies during this period. Staff estimates that processing all 
30,000 calls will require an average of 11,500 hours of employee labor 
resulting in an average annual burden of 4,600 labor hours. Given the 
low frequency of major breaches, the annual average requirement for 
major breaches is 4,640 hours.
    The combined annual hours burden for both single-person and major 
breaches therefore is 4,654 (4,640 + 14).
    Estimated Annual Labor Costs: $90,741.
    For each single-person breach, FTC staff estimates that the average 
20 seconds of employee labor to provide (likely automated) notification 
to affected individuals and produce an annual breach notification for 
submission to the FTC will cost approximately $0.27 per breach. With an 
estimated 2,500 single-person breaches per year, the annual labor costs 
associated with all single-person breaches come to $675.
    For major breaches, FTC staff projects that the average 100 hours 
of employee labor costs (excluding outside forensic services, discussed 
below as estimated non-labor costs) to determine what information has 
been breached, identify the affected customers, prepare the breach 
notice, and report to the Commission will cost an average of $66.66 per 
hour for a total of $6,666.\2\ Based on an estimated one breach every 
two and a half years, the annual employee labor cost burden for 
affected entities to perform these tasks is $2,666.
---------------------------------------------------------------------------

    \2\ Hourly wages throughout this document are based on mean 
hourly wages found at http://www.bls.gov/news.release/ocwage.htm 
(``Occupational Employment and Wages--May 2020,'' U.S. Department of 
Labor, released March 2021, Table 1 (``National employment and wage 
data from the Occupational Employment Statistics survey by 
occupation, May 2020'').
    The breakdown of labor hours and costs is as follows: 50 hours 
of computer and information systems managerial time at approximately 
$78 per hour; 12 hours of marketing manager time at $74 per hour; 33 
hours of computer programmer time at $46 per hour; and 5 hours of 
legal staff time at $72 per hour.
---------------------------------------------------------------------------

    Additionally, staff expects covered firms will require, for each 
major breach, 11,500 hours of labor associated with answering consumer 
telephone calls at a cost of $218,500.\3\ Since a major breach occurs 
approximately every two and a half years, the average annual burden of 
4,600 labor hours results in annualized labor cost of approximately 
$87,400.
---------------------------------------------------------------------------

    \3\ The cost of telephone operators is estimated at $19/hour.
---------------------------------------------------------------------------

    Accordingly, estimated cumulative annual labor costs, excluding 
outside forensic services, for both single-person and major breaches, 
is $90,741 ($87,400 + $2,666 + $675).
    Estimated Annual Capital and Other Non-Labor Costs: $31,056.
    Commission staff estimates that capital and other non-labor costs 
associated with single-person breaches will be negligible. Companies 
generally use automated notification systems to notify consumers of 
single-person breaches. Automated notifications are typically delivered 
by email or other electronic methods. The costs of providing such 
electronic notifications are minimal.
    Commission staff anticipates that capital and other non-labor costs 
associated with major breaches will consist of the following:
    1. Services of a forensic expert in investigating the breach;
    2. notification of consumers via email, mail, web posting, or 
media; and
    3. the cost of setting up a toll-free number, if needed.
    Staff estimates that, for each major breach, covered firms will 
require 240 hours of a forensic expert's time, at a cumulative cost of 
$37,440 for each breach. This estimate is based on a projection that an 
average major breach will affect approximately 20 machines and that a 
forensic analyst will require about 12 hours per machine to conduct his 
or her analysis. The projected cost of retaining the forensic analyst 
consists of the hourly wages of an information security analyst ($52), 
tripled to reflect profits and overhead for an outside consultant 
($156), and multiplied by 240 hours. Based on the estimate that there 
will be one major breach every two and a half years, the annual cost 
associated with the services of an outside forensic expert is $14,976.
    As explained above, staff estimates that an average of 200,000 
consumers will be entitled to notification of each major breach. Given 
the online relationship between consumers and vendors of personal 
health records and PHR related entities, most notifications will be 
made by email and the cost of such notifications will be minimal.
    In some cases, however, vendors of personal health records and PHR 
related entities will need to notify individuals by postal mail, either 
because these individuals have asked for such notification, or because 
the email addresses of these individuals are not current or not 
working. Staff estimates that the cost of a mailed notice is $0.11 for 
the paper and envelope, and $0.58 for a first class stamp. Assuming 
that vendors of personal health records and PHR related entities will 
need to notify by postal mail 10 percent of the 200,000 customers whose 
information is breached, the estimated cost of this notification will 
be $13,800 per breach. The annual cost will be around $5,520.
    In addition, vendors of personal health records and PHR related 
entities may need to notify consumers by

[[Page 10795]]

posting a message on their home page, or by providing media notice. 
Staff estimates the cost of providing notice via website posting to be 
$0.08 per breached record, and the cost of providing notice via 
published media to be $0.04 per breached record. Applied to the above-
stated estimate of 200,000 affected consumers, the estimated total cost 
of website notice will be $16,000, and the estimated total cost of 
media notice will be $8,000, yielding an estimated total per-breach 
cost for both forms of notice to consumers of $24,000. Annualized, this 
number is approximately $9,600 per year.
    Finally, staff estimates that the cost of providing a toll-free 
number will depend on the costs associated with T1 lines sufficient to 
handle the projected call volume and the cost of obtaining a toll-free 
telephone number. Based on industry research, staff projects that 
affected entities may need two T1 lines at a cost of $1,800 for the 90-
day period. In addition, staff estimates the cost of obtaining a 
dedicated toll-free line to be $100 per month. Accordingly, staff 
projects that the cost of obtaining two toll-free lines for 90 days 
will be $2,400. The total annualized cost for providing a toll-free 
number will be $960.
    In sum, the total annual estimate for non-labor costs associated 
with major breaches is $31,056: $14,976 (services of a forensic expert) 
+ $5,520 (cost of mail notifications) + $9,600 (cost of website and 
media notice) + $960 (cost of providing a toll-free number). Negligible 
non-labor costs are associated with single-person breaches.
    The total estimated PRA annual cost burden is $90,741 for labor 
costs and $31,056 for non-labor costs, totaling approximately $121,797.

Request for Comments

    Pursuant to Section 3506(c)(2)(A) of the PRA, the FTC invites 
comments on: (1) Whether the proposed collection of information is 
necessary for the proper performance of the functions of the agency, 
including whether the information will have practical utility; (2) the 
accuracy of the agency's estimate of the burden of the proposed 
collection of information, including the validity of the methodology 
and assumptions used; (3) ways to enhance the quality, utility, and 
clarity of the information to be collected; and (4) ways to minimize 
the burden of maintaining records and providing disclosures to 
consumers. All comments must be received on or before April 26, 2022.
    You can file a comment online or on paper. For the FTC to consider 
your comment, we must receive it on or before April 26, 2022. Write 
``Health Breach Notification Rule; PRA Comment: FTC File No. P072108'' 
on your comment. Your comment--including your name and your state--will 
be placed on the public record of this proceeding, including the 
https://www.regulations.gov website.
    Due to the public health emergency in response to the COVID-19 
outbreak and the agency's heightened security screening, postal mail 
addressed to the Commission will be subject to delay. We encourage you 
to submit your comments online through the https://www.regulations.gov 
website.
    If you prefer to file your comment on paper, write ``Health Breach 
Notification Rule; PRA Comment: FTC File No. P072108'' on your comment 
and on the envelope, and mail your comment to the following address: 
Federal Trade Commission, Office of the Secretary, 600 Pennsylvania 
Avenue NW, Suite CC-5610 (Annex J), Washington, DC 20580; or deliver 
your comment to the following address: Federal Trade Commission, Office 
of the Secretary, Constitution Center, 400 7th Street SW, 5th Floor, 
Suite 5610 (Annex J), Washington, DC 20024. If possible, submit your 
paper comment to the Commission by courier or overnight service.
    Because your comment will become publicly available at https://www.regulations.gov, you are solely responsible for making sure that 
your comment does not include any sensitive or confidential 
information. In particular, your comment should not include any 
sensitive personal information, such as your or anyone else's Social 
Security number; date of birth; driver's license number or other state 
identification number, or foreign country equivalent; passport number; 
financial account number; or credit or debit card number. You are also 
solely responsible for making sure that your comment does not include 
any sensitive health information, such as medical records or other 
individually identifiable health information. In addition, your comment 
should not include any ``trade secret or any commercial or financial 
information which . . . . is privileged or confidential''--as provided 
by Section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule 
4.10(a)(2), 16 CFR 4.10(a)(2)--including in particular competitively 
sensitive information such as costs, sales statistics, inventories, 
formulas, patterns, devices, manufacturing processes, or customer 
names.
    Comments containing material for which confidential treatment is 
requested must be filed in paper form, must be clearly labeled 
``Confidential,'' and must comply with FTC Rule 4.9(c). In particular, 
the written request for confidential treatment that accompanies the 
comment must include the factual and legal basis for the request, and 
must identify the specific portions of the comment to be withheld from 
the public record. See FTC Rule 4.9(c). Your comment will be kept 
confidential only if the General Counsel grants your request in 
accordance with the law and the public interest. Once your comment has 
been posted publicly at www.regulations.gov, we cannot redact or remove 
your comment unless you submit a confidentiality request that meets the 
requirements for such treatment under FTC Rule 4.9(c), and the General 
Counsel grants that request.
    The FTC Act and other laws that the Commission administers permit 
the collection of public comments to consider and use in this 
proceeding, as appropriate. The Commission will consider all timely and 
responsive public comments that it receives on or before April 26, 
2022. For information on the Commission's privacy policy, including 
routine uses permitted by the Privacy Act, see https://www.ftc.gov/site-information/privacy-policy.

Josephine Liu,
Assistant General Counsel for Legal Counsel.
[FR Doc. 2022-03958 Filed 2-24-22; 8:45 am]
BILLING CODE 6750-01-P