FTC Health Breach Notification Rule: health apps and their service providers must give notice within 60 days

The FTC’s Health Breach Notification Rule covers non-HIPAA vendors of personal health records, related entities and their service providers, and treats unauthorized disclosure as a breach. Affected people must be told within 60 days, the FTC at the same time when 500 or more are affected, and service providers must notify their client within 60 days.

Source facts

The FTC’s guide Complying with FTC’s Health Breach Notification Rule says the rule requires certain organizations not covered by HIPAA to notify customers, the FTC and in some cases the media of a breach of unsecured, individually identifiable health information, and that July 2024 amendments make clear makers of health apps, connected devices and similar products must comply. It covers vendors of personal health records, PHR related entities and third party service providers to them, such as firms hired for billing, debt collection or data storage related to health information, but not HIPAA-covered entities or businesses acting solely as HIPAA business associates.

The guide says a breach is not limited to cybersecurity intrusions, since disclosing covered information without a person’s authorization also triggers notice, and that only unsecured information, meaning information not encrypted or destroyed, is covered. Affected people must be notified without unreasonable delay and within 60 calendar days of discovery, the FTC at the same time when 500 or more people are affected or within 60 days after the end of the calendar year for smaller breaches, and prominent media outlets when 500 or more residents of a state are affected.

Service providers must notify an official designated in their client contract within 60 calendar days and get an acknowledgment, and the guide says violations may bring civil penalties of up to $53,088 per violation.

Applicability

Use this for health and wellness apps, connected health devices and the providers that serve them. HIPAA-covered entities and business associates follow the HHS breach notification rule instead.

DSE recommendation

DSE recommends that health app makers and their IT and cloud providers confirm in writing whether the FTC rule applies and who notifies whom, then build the 60-day clock into incident response. Encrypt health data at rest and in transit, review analytics and advertising integrations for unauthorized sharing, and keep notice templates ready.

Verification

Check contracts for a designated breach contact and acknowledgment step, run the notice workflow in a tabletop exercise, and audit third-party code in apps and sites for health data sharing.

Official reference

Federal Trade Commission — Complying with FTC’s Health Breach Notification Rule. Reviewed October 19, 2026.