The FTC Health Breach Notification Rule for Non-HIPAA Health Apps

The FTC Health Breach Notification Rule (16 CFR part 318) requires vendors of personal health records and related entities that are not covered by HIPAA to notify affected individuals, the FTC and sometimes the media after a breach of unsecured identifiable health information. Since amendments took effect July 29, 2024 (89 FR 47028), the FTC has made explicit that a breach includes an unauthorized disclosure, such as a company sharing health data with third parties contrary to what it told users, not only a hack. Telehealth-adjacent apps, symptom checkers, and some cash-pay telehealth models can fall under it.

Who does the rule cover?

• Vendors of personal health records: entities, other than HIPAA-covered entities and their business associates acting as such, that offer or maintain a personal health record.
• PHR related entities: companies that offer products or services through a PHR vendor's website or online service, or that access or send information to a personal health record.
• Third party service providers to those entities, which must notify the vendor of a breach.

A personal health record is "an electronic record of PHR identifiable health information on an individual that has the technical capacity to draw information from multiple sources and that is managed, shared, and controlled by or primarily for the individual." The 2024 amendments defined "health care provider" and "health care services or supplies" broadly, to include any online service such as a website, app or connected device that tracks conditions, medications, vital signs, symptoms, fitness, fertility, sexual health, sleep, mental health, diet and more.

Under § 318.1, the rule does not apply to HIPAA-covered entities or to entities acting as their business associates.

Could it apply to a telehealth company?

It can, in two common situations:

• The consumer product around the practice. A telehealth company's app or website features, such as a weight or symptom tracker that pulls data from a wearable, may be offered by the non-clinical company rather than the HIPAA-covered practice.
• Cash-pay models. HIPAA covers health care providers that conduct certain standard transactions electronically, such as insurance claims. A provider that only takes cash and never conducts those transactions may not be a HIPAA-covered entity at all, which shifts the question to the FTC rule, the FTC Act and state law. Counsel should confirm your status rather than assume it.

What counts as a breach?

A breach of security is the acquisition of unsecured PHR identifiable health information without the individual's authorization, and unauthorized access is presumed to be acquisition unless the company has reliable evidence otherwise. In its 2024 rulemaking, the FTC said this "is not limited to data exfiltration, and includes unauthorized disclosures (such as, but not limited to, a company's unauthorized sharing or selling of consumers' information to third parties that is inconsistent with the company's representations to consumers)."

Information is "unsecured" unless protected by the encryption or destruction methods HHS specifies under the HITECH Act.

How fast must notice go out?

• Individuals: without unreasonable delay and no later than 60 calendar days after discovery (§ 318.4(a)). Notice goes by first-class mail, or by electronic mail if the individual chose email as the primary contact method; the rule defines electronic mail as email combined with a text message, in-app message or electronic banner (§§ 318.2, 318.5).
• FTC: for breaches involving 500 or more individuals, at the same time as notice to individuals. Smaller breaches may be logged and reported annually, within 60 days after the end of the calendar year (§ 318.4(b)).
• Media: for breaches involving 500 or more residents of a state, prominent media outlets serving that state (§ 318.3).
• Third party service providers notify the vendor or related entity, which then notifies individuals.

The company bears the burden of showing all required notices were made.

Has the FTC enforced the rule?

• GoodRx (2023): the FTC's first action under the rule, alleging disclosure of users' medications and health conditions to advertising platforms including Facebook and Google, contrary to privacy promises, and failure to notify. $1.5 million civil penalty.
• Easy Healthcare (Premom, 2023): an ovulation-tracking app that shared health data with third parties including Google and AppsFlyer. $100,000 civil penalty.

Violations are treated as violations of an FTC trade regulation rule, so civil penalties are available per violation (§ 318.7).

Steps for a company that may be covered

1. Decide, with counsel, whether each product is HIPAA-covered, a business associate function, or neither.
2. For anything that is neither, map what health information it collects and every third party that receives it, including through SDKs and pixels. See tracking pixels on telehealth sites.
3. Make the privacy policy match the data flows, and get affirmative authorization before any sharing the policy does not plainly describe.
4. Write an incident procedure that treats an unauthorized disclosure as a potential breach, with the 60-day clock.
5. Check state laws too, including Washington's My Health My Data Act.

Breach response procedures are part of our Telehealth Policies & Consent Kit ($1,950). See pricing.