A health app does not need to be a hospital to fall under the FTC's Health Breach Notification Rule. The modern rule expressly covers certain health apps and connected technologies outside HIPAA.
"Not HIPAA" Does Not Mean "No Federal Health-Privacy Rule"
HIPAA applies to covered entities and business associates. The FTC's Health Breach Notification Rule (HBNR) is a different federal regime. The FTC amended the HBNR in 2024 to clarify its application to health apps and similar technologies that are not covered by HIPAA.
The rule can cover vendors of personal health records, certain PHR-related entities and service providers. A consumer app that can draw identifiable health information from multiple sources can potentially fall within the definition of a personal health record.
What Changed in the 2024 Amendments
The FTC clarified that a "breach of security" can include not only a conventional hacking incident but also certain unauthorized disclosures of identifiable health information. The amendments also modernized notice requirements and confirmed the relevance of health apps and connected devices.
For breaches involving 500 or more people, covered entities generally must notify the FTC at the same time they notify affected individuals, without unreasonable delay and no later than 60 calendar days after discovery. Smaller breaches have different reporting mechanics.
Health Data Can Include Information From More Than One Source
The FTC's rule materials use health and fitness apps connected to wearable trackers as an example. Information such as weight, height, age, heart rate and activity data can be part of a personal health record when the regulatory definition is met.
The scope is technical and fact-specific. A statement that every wearable or fitness app is automatically covered by the HBNR would be too broad.
What Counts as a Problem Worth Documenting?
- An app announces that health information was disclosed without authorization.
- A privacy policy says data is shared for purposes inconsistent with what you were told.
- You discover health information flowing to an unexpected third party.
- A company admits a breach involving unsecured health information.
- You receive a breach notice that does not explain what happened clearly.
Fertility and Mental-Health Data Can Be Especially Sensitive
The FTC has taken action in health-data matters involving fertility information. In its Premom case, the FTC alleged that a fertility-tracking app shared sensitive health information with third parties without appropriate disclosure and failed to notify consumers about unauthorized disclosures in violation of the HBNR.
The lesson is broader than fertility tracking: document exactly what the app promised, what third parties received, and what notice the company gave you.
What a Consumer Can Do
- Save the breach or privacy notice.
- Record the health information involved.
- Preserve screenshots of the relevant privacy settings.
- Ask the company what data was disclosed, to whom and when.
- Check whether the company provides a dedicated privacy or breach-response channel.
- Report suspected unlawful conduct to the FTC where appropriate.
Consumers generally do not personally file an HBNR breach notice on behalf of the company. The rule imposes notification obligations on covered businesses. A consumer can, however, report suspected violations to the FTC.
What This Means Practically
- Do not assume HIPAA is the only federal health-privacy protection.
- Check whether the service may qualify as a covered health-app/PHR entity.
- Preserve the company's own description of any disclosure or breach.
- Distinguish an unauthorized disclosure from a data-security breach, while recognizing the FTC rule can cover both in defined circumstances.
- Use factual evidence when reporting the issue.
Sources
- Federal Trade Commission — Final changes to the Health Breach Notification Rule, April 2024. ftc.gov
- Federal Trade Commission — Health Breach Notification Rule, 16 CFR Part 318. ftc.gov
- Federal Trade Commission — Complying with the Health Breach Notification Rule. ftc.gov
- Federal Trade Commission — Premom fertility app enforcement action. ftc.gov