FTC Health Breach Notification Rule: Apps On the Clock

Three categories, none HIPAA-covered: (1) vendors of personal health records, businesses offering or maintaining records of identifiable health information drawn from multiple sources that individuals manage (the 2024 amendments confirm a health app qualifies when it draws information from multiple sources, including a device sensor plus user input, or health and non-health inputs combined); (2) PHR-related entities, those offering products or services through a PHR vendor's site or app, or accessing/sending information to a PHR; (3) third-party service providers to either. Practical translation: fitness and sleep trackers, fertility and period apps, mental-health and telecoverage apps outside HIPAA, glucose and blood-pressure apps, and wellness platforms. If your health product's data layer would be a business associate's problem inside HIPAA, outside HIPAA it is probably your HBNR problem.

Because the rule defines breach of security as acquisition of unsecured PHR identifiable health information without the authorization of the individual, and the FTC reads intentional, unauthorized disclosures as squarely within it. GoodRx (February 2023) established the position: the company shared users' prescription and health-condition data with Facebook, Google, and other platforms for advertising, contrary to its promises and without authorization, the FTC charged an HBNR violation (plus Section 5), and GoodRx paid $1.5 million with a permanent ban on sharing health data for ads. Premom (May 2023) followed the same theory for a fertility app's SDK data flows. The 2024 amendments wrote the interpretation into the rule text, closing the 'it was a disclosure, not a hack' argument for good. A misconfigured ad pixel on a covered app is a notifiable breach, full stop.

Individuals: without unreasonable delay, no later than 60 calendar days after discovery, by written notice, or, since the 2024 amendments, email paired with in-app or portal messaging, containing what happened, the data involved, what recipients should do, contact information, and (new in 2024) the identity or description of third parties that acquired the data. FTC: through its portal, contemporaneously with individual notice for breaches involving 500 or more individuals, or within 60 days after calendar year-end for smaller ones. Media: prominent outlets in a state or jurisdiction where 500+ residents are affected. Third-party service providers notify the vendor/entity they serve, which then owns the outward notifications. Discovery is the first day the breach is known or reasonably should have been known to any employee, officer, or agent other than the breaching person.

They are mutually exclusive by design: HIPAA-covered entities and business associates handling PHI follow OCR's Breach Notification Rule, not the HBNR; the HBNR covers the consumer-health world HIPAA cannot reach. Dual-track companies exist, a firm can run a HIPAA-covered telehealth service and a direct-to-consumer wellness app, and each product line follows its own rule. The rules rhyme deliberately (60-day clocks, 500-person media and regulator triggers, 'unsecured' meaning unencrypted per HHS guidance), so a unified incident-response playbook with a routing decision, PHI or PHR?, at the top handles both. What differs is the enforcement flavor: the FTC brings penalty authority from the first violation plus Section 5 companions, and its orders ban business practices (ad-sharing bans) rather than imposing OCR-style corrective action plans.

Five moves. Map data flows, especially SDKs, pixels, and analytics: every third party receiving identifiable health information without user authorization is a breach already in progress under the FTC's reading. Fix authorization: affirmative, specific consent for any health-data sharing, buried policy language is not authorization, and dark-pattern consent invites a Section 5 count. Encrypt: the rule reaches only unsecured data, so encryption to HHS standards is the same safe harbor HIPAA offers. Pre-build notification: templates, the FTC portal path, and the 60-day clock in the IR plan, with the 2024 electronic-notice options wired in. Contract the chain: third-party service providers owe you breach notice; make the timing contractual and short. The GoodRx order's practical lesson is that the cheapest time to discover your ad stack shares health data is before the FTC does.