"The FTC's policy statement serves two purposes. First, to provide notice to connected medical device and health app providers who collect or use electronic personal health records (PHR), that the FTC will start enforcing the Rule. Second, to clarify who is subject to the Rule."