Policy statement affirms that covered companies that hold fertility, heart health, glucose levels and other health data must notify consumers in the event of a breach