FTC Pulls 2021 Health-App Guidance After New Breach Rule Takes Over
The Federal Trade Commission has withdrawn a controversial 2021 policy statement covering data breaches involving health apps and connected devices, saying the guidance has become unnecessary following a subsequent overhaul of the agency’s formal rules.
The decision does not remove the FTC’s Health Breach Notification Rule. Instead, the commission said the 2021 statement has been superseded by rulemaking completed in 2024.
Guidance Removed, Core Obligations Remain
The 2021 statement sought to make clear that health apps and connected devices could fall under the Health Breach Notification Rule even when they were outside HIPAA.
The FTC now says the statement provided limited benefit and was no longer needed after the rule itself was updated.
2024 Changes Broadened the Rule
The updated rule explicitly addresses health apps and similar technologies that handle identifiable health information outside the HIPAA framework.
It also clarified that a reportable breach can involve an unauthorized disclosure, not only a conventional hacking incident or security intrusion.
Health Apps Still Face Notification Duties
For covered organizations, the underlying requirements remain in place.
Breaches involving 500 or more individuals must generally be reported to the FTC when affected consumers are notified, with the rule requiring notification without unreasonable delay and no later than 60 days after discovery.
That leaves companies handling sensitive health information with continuing compliance responsibilities despite the withdrawal of the older policy statement.
FTC Keeps Health Privacy on Its Radar
The commission said protecting sensitive health information remains a priority and pointed to its continuing enforcement activity involving health-data privacy.
The practical takeaway is straightforward: the guidance changed, but the federal breach-notification framework did not disappear.