FTC Health Breach Notification Rule 2024 Update

Effective July 2024. Extends breach notification to health apps and wearables not covered by HIPAA. Notification to FTC, consumers, and media required within 60 days of discovering a breach.

Analysis

The FTC Health Breach Notification Rule (HBNR) 2024 update is a federal breach-notification regime that now explicitly covers health apps, connected devices, and similar technologies that are not subject to HIPAA, and requires notice to affected individuals, the FTC, and in some cases the media, generally within 60 days of discovering a breach of unsecured PHR identifiable health information.FTC HBNR Rule page FTC business guidance – Complying with the HBNR FTC press release on finalized changes Hogan Lovells summary of July 2024 effective date

Key Requirements

• Scope of entities covered

• The Rule applies to vendors of personal health records (PHRs), PHR-related entities, and their third‑party service providers that are not covered by HIPAA, but handle unsecured individually identifiable health information about U.S. consumers.FTC HBNR Rule page FTC business guidance – Complying with the HBNR
• The 2024 amendments explicitly include health apps, connected devices, and direct‑to‑consumer health and wellness technologies, such as apps tracking vital signs, fertility, sexual health, sleep, mental health, fitness, and diet.FTC business guidance – Complying with the HBNR Hogan Lovells summary of expanded scope

• Triggering event – what counts as a “breach of security”

• A breach of security is defined as “the acquisition of unsecured PHR identifiable health information of an individual in a personal health record without the authorization of the individual”, and the 2024 update clarifies that this includes both data security incidents and unauthorized disclosures (including sharing with advertisers or analytics providers without authorization).FTC HBNR Rule text FTC business guidance – definition of breach Berkeley Tech Law Journal analysis
• The FTC emphasizes that “breach” is not limited to hacking, but also covers unauthorized access or disclosure by the company or its partners.FTC business guidance – Complying with the HBNR

• Notification obligations to individuals, FTC, and media

• Covered entities must notify each affected individual when there is a breach involving unsecured PHR identifiable health information in a personal health record.FTC HBNR Rule page FTC business guidance – Complying with the HBNR
• They must also notify the FTC, and for breaches involving 500 or more individuals in a state or jurisdiction, they must notify prominent media outlets in that state or jurisdiction.FTC HBNR Rule page FTC press release – media notice requirement Orrick summary – 500+ media notice

• Timing requirements (60-day standard and log for small breaches)

• For breaches involving 500 or more individuals, entities must notify the FTC at the same time they notify individuals, “without unreasonable delay and in no case later than 60 calendar days after the discovery of a breach of security.”FTC press release – timing change FTC business guidance – 60-day timing Orrick summary – contemporaneous 60‑day notice
• For breaches affecting fewer than 500 individuals, entities may maintain a log and submit it to the FTC annually, rather than immediately.FTC HBNR Rule page Orrick summary – annual log for <500

• Content and method of notifications

• Notices to individuals must include a description of what happened (date of breach and discovery), the types of information involved, steps individuals can take, what the entity is doing in response, and contact information, and now must identify any third parties that acquired the data (or a description where full identity would pose risk).FTC press release – expanded content requirements FTC business guidance – content of notice Orrick summary – notice content details
• The Rule allows electronic notices, including email, text messages, in‑app messaging, and electronic banners, provided these are reasonably calculated to reach the individual.FTC HBNR Rule page Hogan Lovells summary – new methods of notice

• Obligations of third‑party service providers

• Service providers to vendors of PHRs and PHR‑related entities that experience a breach of security must notify the vendor or related entity, which in turn must notify individuals, the FTC, and media as required.FTC HBNR Rule page FTC press release – service provider duties

• Unsecured vs. secured information

• The Rule applies to “unsecured” PHR identifiable health information, meaning data that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through technologies such as strong encryption.FTC HBNR Rule page FTC business guidance – unsecured information

Compliance Challenges

• Identifying whether an app or device is a “PHR” or “PHR‑related entity”

• Many health and wellness companies struggle to determine whether their products meet the PHR definition (drawn from multiple sources and managed for the individual) and thus fall under the Rule.FTC business guidance – PHR definition Berkeley Tech Law Journal analysis
• Legal analyses note that apps that sync data from wearables, manual user input, and third‑party sources may unexpectedly qualify as PHRs, creating uncertainty and compliance risk.Hogan Lovells summary – PHR definitional changes Orrick summary – applicability to apps and devices

• Distinguishing HBNR vs. HIPAA coverage

• Organizations frequently face challenges determining whether their activities are regulated by HIPAA (e.g., covered entities and business associates) or instead by the HBNR, particularly for hybrid models and partnerships.HHS HIPAA overview FTC HBNR Rule page – non‑HIPAA scope FTC business guidance – relationship to HIPAA

• Handling “unauthorized disclosures” to advertising and analytics partners

• The expanded breach definition to include unauthorized disclosures means that sharing health data with ad networks or analytics providers without proper authorization may trigger breach notifications, which many digital health companies previously treated as standard data use.FTC business guidance – unauthorized disclosure as breach Berkeley Tech Law Journal analysis of 2024 amendments
• The FTC’s enforcement against GoodRx, where the company shared users’ prescription and health information with advertising platforms without adequate consent, illustrates this challenge and led to heightened scrutiny of data‑sharing practices.FTC GoodRx enforcement press release GoodRx complaint and order

• Building incident response processes that meet 60‑day and media requirements

• Companies often lack mature incident response programs capable of assessing whether a breach involves PHR identifiable health information, counting impacted individuals by jurisdiction, and triggering timely FTC and media notices.FTC business guidance – incident response expectations Hogan Lovells summary – impact on incident response
• Industry commentaries highlight difficulties aligning HBNR 60‑day timelines with other regimes (HIPAA, state laws, GDPR) and coordinating multi‑jurisdictional notices.Orrick summary – alignment with HIPAA timelines Berkeley Tech Law Journal analysis – multi‑jurisdictional complexity

• Real‑world examples and enforcement trends

• The GoodRx case was the FTC’s first enforcement action invoking the HBNR, showing the Commission’s willingness to treat improper data‑sharing as a breach and enforce notification obligations.FTC GoodRx enforcement press release Berkeley Tech Law Journal analysis – GoodRx and HBNR enforcement
• Subsequent FTC statements emphasize that health apps and wearables that share user data contrary to their privacy promises may face both HBNR and Section 5 enforcement, increasing compliance pressure.FTC joint statement on HBNR update FTC business guidance – enforcement posture

Implementation Best Practices

• Perform a structured applicability assessment

• Conduct a data mapping and product assessment to determine whether your app, device, or service qualifies as a PHR or PHR‑related entity and whether it is outside HIPAA.FTC business guidance – PHR analysis Hogan Lovells guidance – assessing scope
• Use internal questionnaires or checklists based on the FTC’s definitions of “personal health record,” “PHR identifiable health information,” and “breach of security.”FTC HBNR Rule page Orrick summary – definitional framework

• Integrate HBNR into incident response plans

• Update incident response plans to explicitly address HBNR triggers, notification timelines, media criteria, and coordination with HIPAA and state breach laws.FTC business guidance – responding to breaches Hogan Lovells guidance – IR process changes
• Define roles and responsibilities for determining whether a breach involves PHR identifiable health information, calculating individual counts, and preparing FTC and consumer notices.FTC HBNR Rule page – notification mechanics Berkeley Tech Law Journal analysis – governance considerations

• Strengthen technical controls to avoid “unsecured” status

• Implement encryption and other security controls such that health data is “secured” under the Rule, reducing the likelihood that an incident triggers HBNR notification.FTC HBNR Rule page – secured vs unsecured FTC business guidance – security practices
• Align security controls with industry frameworks such as NIST Cybersecurity Framework and NIST SP 800‑53 to systematically manage risks to health data.NIST Cybersecurity Framework NIST SP 800-53 Rev. 5

• Control data sharing with third parties

• Establish contracts, DPA clauses, and technical controls to ensure that disclosures of health data to advertisers, analytics services, and cloud providers are consistent with user authorization and privacy notices, avoiding “unauthorized disclosures.”FTC business guidance – unauthorized disclosure as breach FTC GoodRx enforcement order – restrictions on sharing
• Regularly review and update privacy policies and consent flows so they accurately describe data sharing practices and comply with Section 5 and HBNR expectations.FTC business guidance on health apps FTC joint statement on HBNR

• Use implementation guides, tools, and resources

• Follow

Recent developments

• 2024-07-29 — The FTC’s revised Health Breach Notification Rule became effective July 29, 2024, expanding the scope to virtually any non‑HIPAA entity handling identifiable health information, including health apps, and revising definitions of “breach of security,” timing, and notice content requirements.[4] (source)
• 2024-07-24 — Orrick analyzes six key aspects of the updated Health Breach Notification Rule, highlighting expanded definitions for personal health records and PHR identifiable health information, contemporaneous notice to individuals and the FTC within 60 days, and enhanced content requirements for breach notifications.[8] (source)
• 2024-07-03 — Berkeley Technology Law Journal provides a detailed legal analysis of the FTC’s 2024 amendments to the Health Breach Notification Rule, noting clarified definitions for vendors drawing from multiple data sources, inclusion of unauthorized disclosures in the “breach of security” definition, and extended timelines for FTC notification that respond to extensive public comments.[6] (source)
• 2024-05-30 — Hogan Lovells reports on Federal Register publication of the amended Health Breach Notification Rule, emphasizing its explicit application to direct‑to‑consumer health and wellness technologies, expanded scope to a broad range of apps and connected devices, new notice content and design requirements, and alignment of FTC notification timelines with individual and media notices.[7] (source)
• 2024-05-30 — The FTC’s rule page for the Health Breach Notification Rule was updated to reflect July 2024 amendments, clarifying that makers of health apps, connected devices, and similar products not covered by HIPAA must provide breach notices to consumers, the FTC, and sometimes the media when there is an unauthorized acquisition of unsecured PHR identifiable health information.[2][5] (source)
• 2024-04-26 — An FTC press release announces finalized changes to the Health Breach Notification Rule, strengthening and modernizing it by clarifying applicability to health apps and similar technologies, expanding required consumer notice content (including identification of third parties acquiring data), and modifying the timing so that the FTC is notified at the same time as individuals for large breaches.[1] (source)
• 2024-04-26 — AHIMA publishes a FAQ on the finalized Health Breach Notification Rule, explaining key changes for health information professionals, including expanded coverage of digital health tools, new definitions, and practical implications for breach response and compliance programs in the healthcare and health‑tech sectors.[3] (source)
• 2024-04-26 — The FTC updates its business guidance “Complying with the FTC’s Health Breach Notification Rule” to reflect the July 2024 amendments, stressing that non‑HIPAA organizations like health apps must treat unauthorized disclosures as breaches, understand what qualifies as PHR identifiable health information, and follow the revised notice timing and content requirements.[5] (source)

Related regulations

• NIST AI Risk Management Framework (AI RMF 1.0) — United States, Active, effective 2023-01-26
• Blueprint for an AI Bill of Rights — United States, Active
• COPPA (Children's Online Privacy Protection Act) — United States, Active
• Cybersecurity Maturity Model Certification — United States, Phased, effective 2025-11-10
• SEC Cybersecurity Disclosure Rules — United States, Active, effective 2023-12-18
• Executive Order 14365 - Ensuring a National Policy Framework for Artificial Intelligence — United States, Active, effective 2025-12-11
• TAKE IT DOWN Act — United States, Active, effective 2026-05-19
• SEC Regulation S-P Amendments (Customer Data Incident Response) — United States, Active, effective 2026-06-03

Put it into practice

• Generate the policy: HIPAA policy generator (generatepolicy.com)
• Buy the policy pack: HIPAA Complete Bundle (cyberpolicy.shop)
• Build it yourself: HIPAA Readiness Accelerator (ciso.diy)

Browse all regulations · Compliance deadlines · Latest updates