View Rule

On May 22, 2020, the Commission initiated periodic review of the Health Breach Notification Rule (Rule). 85 FR 31085 (May 22, 2020). The Commission requested comment on, among other things, whether changes should be made to the Rule in light of technological changes, such as the proliferation of apps and similar technologies. The comment period closed on August 20, 2020. The Commission received 26 public comments.

The Rule requires vendors of personal health records (PHR) and PHR-related entities to provide: (1) notice to consumers whose unsecured PHR identifiable health information was acquired by an unauthorized person as a result of a breach; (2) notice to the Commission; and (3) in some cases, the media. Under the Rule, PHR vendors and PHR- related entities must notify both the FTC and affected consumers "without unreasonable delay and in no case later than 60 calendar days" after discovery of the breach. The Rule also requires third party service providers to vendors of personal health records and PHR related entities to provide notification to such vendors and entities following the discovery of a breach.

The FTC's Rule applies only to health information that is not secured through technologies specified by the Department of Health and Human Services (HHS). Also, the FTC's Rule does not apply to businesses or organizations covered by the Health Insurance Portability and Accountability Act (HIPAA). Entities covered by HIPAA must comply with HHS’ breach notification rule in the event of a security breach.

On September 15, 2021, the Commission issued a Policy Statement underscoring that the Rule covers health apps and similar technologies. Since the issuance of the Policy Statement, the Commission has brought two enforcement actions alleging violations of the Rule.

Having considered the public comments from the May 2020 periodic review, the Policy Statement, and recent enforcement actions brought under the Rule, the Commission proposed on June 9, 2023, to amend the Rule, in seven ways and requested comment on the proposed changes. 88 FR 37819 (June 9, 2023). The comment period closed on August 8, 2023, and staff is reviewing the comments.