View Rule

The Commission plans to initiate periodic review of the Health Breach Notification Rule (Rule) by June 2020. This Rule requires vendors of personal health records (PHR) and PHR-related entities to provide: (1) Notice to consumers whose unsecured personally identifiable health information has been breached; and (2) Notice to the Commission. Under the Rule, vendors must notify both the FTC and affected consumers "without unreasonable delay and in no case later than 60 calendar days" after discovery of the breach. Among other information, the notices must provide consumers with steps they can take to protect themselves from harm.

The FTC's Rule applies only to health information that is not secured through technologies specified by the Department of Health and Human Services (HHS). Also, the FTC's Rule does not apply to businesses or organizations covered by the Health Insurance Portability and Accountability Act (HIPAA). In case of a security breach, entities covered by HIPAA must comply with HHS’ breach notification rule.