FTC Health Breach Notification Rule: A Guide for Health Apps Outside HIPAA

Short answer: The FTC Health Breach Notification Rule (16 CFR Part 318) requires health apps and other personal health record businesses that HIPAA does not cover to notify users, the FTC and sometimes the media after a breach. Since the 2024 amendments, a breach includes unauthorized disclosures such as sharing health data with advertisers, not only hacks.

Related guides:

• What is the HIPAA Breach Notification Rule?
• Who does HIPAA apply to?
• Incident response plan template

Key takeaways

• It fills the HIPAA gap. It covers health apps and similar products that are not HIPAA covered entities or business associates.
• Sharing can be a breach. An unauthorized disclosure, such as sending health data to an ad platform without the user's authorization, counts the same as a hack.
• 60 calendar days is the outer limit. Individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery.
• The FTC is notified at the same time for larger breaches. At 500 or more affected people, the FTC hears from you when your users do.
• Penalties are per violation. As of October 2026, the FTC applies a maximum civil penalty of $53,088 per violation.

What is the FTC Health Breach Notification Rule?

It is a federal regulation, codified at 16 CFR Part 318, that makes non-HIPAA businesses holding consumers' identifying health information tell people when that information is compromised.

A direct-to-consumer period tracker or a fitness app that syncs with a wearable usually sits outside HIPAA. The FTC's business overview says the amendments underscore the rule's application to most health apps and similar technologies, and that businesses already covered by HIPAA follow the HHS breach rules instead.

The FTC finalized amendments in April 2024. They were published in the Federal Register on May 30, 2024 and took effect on July 29, 2024.

Who does the health breach notification rule cover?

Three kinds of business are covered: vendors of personal health records, PHR related entities, and third party service providers to either of them. The FTC's compliance guide describes each role:

Role	Who it is	Typical example
Vendor of personal health records	A business that offers or maintains a personal health record	A health app that can sync with a fitness tracker, which the FTC says is likely covered
PHR related entity	A business that offers products or services through a PHR vendor's website or app, or that accesses or sends unsecured identifiable health information to a PHR	An integration that writes data into a user's health app
Third party service provider	A business that provides services involving the use, maintenance, disclosure or disposal of health information to a vendor or PHR related entity	A hosting, analytics or data processing vendor serving a health app

The key concept is the personal health record. The FTC describes it as an electronic record that is drawn from multiple sources and is managed, shared and controlled by or primarily for the individual. The 2024 amendments, according to the Federal Register notice, changed the wording so that a record qualifies if it has the technical capacity to draw information from multiple sources. An app that can pull from sensors, a connected device and user entries can meet that test.

The FTC guide also states that HIPAA covered entities are not PHR vendors, and that a business acting solely as a HIPAA business associate is outside the FTC rule and follows the HHS rule.

What counts as a breach of security?

A breach of security is the acquisition of unsecured PHR identifiable health information without the individual's authorization, and after the 2024 amendments that explicitly includes an unauthorized disclosure as well as a data security breach.

The FTC's compliance guide is direct that a breach is not limited to hacking. Its example is disclosing health data to advertisers without the consumer's authorization. For product teams, that means a tracking pixel or SDK sending health data to an ad or analytics partner without the user's authorization can trigger notice just like stolen credentials or a misconfigured storage bucket.

Three definitions shape the analysis:

1. Unsecured. Information that is encrypted or otherwise secured in line with HHS guidance is not "unsecured," so the FTC says its loss generally does not trigger notice.
2. Presumption. Where there has been unauthorized access, unauthorized acquisition is presumed unless you can show it did not occur or could not reasonably have occurred. Logs are what let you rebut it.
3. PHR identifiable health information. Per the Federal Register notice, the amended definition imports the statutory elements of individually identifiable health information, including information created or received by a covered health care provider. The renamed term "covered health care provider" includes any other entity furnishing health care services or supplies, which is how many wellness apps fall within scope.

HIPAA or the FTC rule: which one applies to you?

If you are a HIPAA covered entity, or you handle the data solely as a business associate, follow HIPAA; if you offer or maintain a personal health record for consumers outside that relationship, the FTC rule likely applies.

Work through these in order:

1. Health plan, clearinghouse or provider? You are a covered entity, so HIPAA applies (see who HIPAA applies to).
2. Handling the data solely as a business associate? HIPAA applies to that data.
3. Offer or maintain a consumer health record that can draw from multiple sources? You are likely a vendor of personal health records under the FTC rule.
4. Plug into such a product, or send health data to it? You may be a PHR related entity.
5. Host or analyze data for a company in steps 3 or 4? You may be a third party service provider.

A startup selling a clinic-facing product under business associate agreements and also running a consumer app may follow HIPAA for one data set and the FTC rule for the other, so map each data flow separately. Some states have also passed consumer health data laws, which are outside the scope of this guide.

Who must you notify, and by when?

You must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering the breach, and also notify the FTC and, for larger breaches, the media.

The FTC's compliance guide sets out the recipients and timing:

Recipient	When notice is required	Deadline
Affected individuals	Every breach of security	Without unreasonable delay, no later than 60 calendar days after discovery
FTC, 500 or more people affected	Breach affects 500 or more individuals	At the same time as individual notice, no later than 60 calendar days after discovery
FTC, fewer than 500 people affected	Breach affects fewer than 500 individuals	Within 60 days after the end of the calendar year
Prominent media outlets	At least 500 residents of a state, D.C. or U.S. territory affected	Same timing as individual notice, in addition to it
Vendor or PHR related entity (from a third party service provider)	Service provider discovers a breach	Within 60 days, to the designated official, with acknowledgment of receipt

Notice to the FTC is made through the online form the agency provides. The FTC's guidance also allows a delay where law enforcement determines that notice would impede a criminal investigation or damage national security.

One detail differs from HIPAA: the FTC rule's media trigger is "at least 500" residents, while HHS's breach notification page describes HIPAA's as more than 500.

What must a breach notice say and how is it delivered?

Notices must be clear, conspicuous and reasonably understandable, and must explain what happened, what data was involved, what users should do and how to reach you.

Based on the FTC's compliance guide and the April 2024 announcement, a notice should cover:

• What happened, including the date of the breach and the date of discovery
• The types of unsecured health information involved
• The names of third parties that acquired the information, or a description where naming them would create risk
• Steps individuals should take to protect themselves
• What your company is doing to investigate, mitigate harm and protect against future breaches
• Two or more ways to contact you

On delivery, the FTC says email notice must be paired with another electronic method such as a text message, in-app message or website or app banner, and customers must be offered first-class mail as an option. If you cannot reach 10 or more people, you need substitute notice: a website posting for 90 days or notice in major media, with a toll-free number active for at least 90 days.

What are the penalties, and has the FTC enforced the rule?

A violation is treated as an unfair or deceptive act or practice, and as of October 2026 the maximum civil penalty is $53,088 per violation.

That figure appears in the FTC's compliance guide and in the FTC's civil penalty table at 16 CFR 1.98 for Section 5(m)(1)(A) of the FTC Act. In a September 15, 2026 notice, the FTC said its penalty amounts will remain unchanged during 2026 and it will continue to apply the 2025 levels.

Two enforcement actions show how the FTC reads the rule:

• GoodRx (February 2023). In its first action under the rule, the FTC alleged that the telehealth and prescription discount provider shared users' health information with advertising companies and platforms despite promising not to, and failed to notify consumers, the FTC and the media. The proposed order filed by the Department of Justice included a $1.5 million civil penalty.
• Easy Healthcare, maker of Premom (May 2023). The FTC alleged that the ovulation tracking app sent sensitive health information through software development kits to third parties, including Google and two China-based firms, without notifying users. The proposed order included a $100,000 civil penalty for the rule violation.

Neither case involved an outside attacker.

How should a health app prepare before a breach?

Prepare by knowing where health data goes, securing it so it is not "unsecured," and rehearsing a response that can hit the 60-day limit. A practical sequence:

1. Classify each product. Record whether it falls under HIPAA, the FTC rule or both, and why.
2. Map data flows. Inventory every SDK, pixel and API that receives health data and check it against your privacy policy.
3. Encrypt and log. Encryption keeps data out of "unsecured," and logs help rebut the presumption of acquisition.
4. Brief service providers. Tell vendors they are covered and name a contact for breach notices.
5. Write the playbook. Add notice templates and the FTC form to your incident response plan.
6. Run a tabletop. Include an unauthorized disclosure scenario, not just a hack.

For related frameworks, see healthcare cybersecurity regulations and frameworks.

How SecureSlate helps

SecureSlate does not include a built-in FTC Health Breach Notification Rule framework. Teams can set it up as a custom framework with custom controls for product classification, data flow review, encryption, notice templates and the FTC reporting steps, then map those controls to built-in HIPAA, SOC 2, ISO 27001 and NIST CSF through multi-framework control mapping. Vendor risk management tracks the analytics and SDK vendors that receive health data and the service provider terms you set with them. Agentless read-only cloud integrations and the device agent help collect encryption and access control evidence, and audit management keeps it together.

Start your free SecureSlate trial

FAQ

Does the FTC Health Breach Notification Rule apply to HIPAA covered entities?

No. HIPAA covered entities, and businesses acting solely as HIPAA business associates, follow the HHS breach notification rule instead. A company can be subject to both laws for different products or data sets.

Is sharing health data with an advertiser a breach under the rule?

It can be. Since the 2024 amendments, a breach of security includes an unauthorized disclosure, and the FTC gives sharing health data with advertisers without the consumer's authorization as an example.

What is the deadline under the FTC HBNR?

Individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery. For 500 or more affected people, the FTC is notified at the same time. Smaller breaches are reported within 60 days after the end of the calendar year.

Disclaimer (legal note)

This article is for general information only and is not legal, regulatory or professional advice. Requirements vary by framework, industry and jurisdiction. Consult qualified advisors for your specific obligations.