UNITED STATES OF AMERICA

Federal Trade Commission

WASHINGTON, D.C. 20580

Office of the Chair

STATEMENT OF THE COMMISSION

On Breaches by Health Apps and Other Connected Devices

September 15, 2021

In recognition of the proliferation of apps and connected devices that capture sensitive 

health data, the Federal Trade Commission is providing this Policy Statement to offer guidance 

on the scope of the FTC’s Health Breach Notification Rule, 16 C.F.R. Part 318 (“the Rule”).1

 

The FTC’s Health Breach Notification Rule helps to ensure that entities who are not 

covered by the Health Insurance Portability and Accountability Act (“HIPAA”) nevertheless face 

accountability when consumers’ sensitive health information is compromised. Under the Rule’s 

requirements, vendors of personal health records (“PHR”) and PHR-related entities must notify 

U.S. consumers and the FTC, and, in some cases, the media, if there has been a breach of 

unsecured identifiable health information, or face civil penalties for violations. The Rule also 

covers service providers to these entities. In practical terms, this means that entities covered by 

the Rule who have experienced breaches cannot conceal this fact from those who have entrusted 

them with sensitive health information. 

The Rule was issued more than a decade ago, but the explosion in health apps and 

connected devices makes its requirements with respect to them more important than ever. The 

FTC has advised mobile health apps to examine their obligations under the Rule,2 including 

through the use of an interactive tool.3 Yet the FTC has never enforced the Rule, and many 

appear to misunderstand its requirements. This Policy Statement serves to clarify the scope of the 

Rule, and place entities on notice of their ongoing obligation to come clean about breaches.

The Rule covers vendors of personal health records that contain individually identifiable 

health information created or received by health care providers. The Rule is triggered when such 

entities experience a “breach of security.”4 Under the definitions cross-referenced by the Rule, 

the developer of a health app or connected device is a “health care provider” because it 

“furnish[es] health care services or supplies.”5 When a health app, for example, discloses

1 The Rule implements the requirements of the American Recovery & Reinvestment Act of 2009, Pub. L. No. 111-5, 

123 Stat. 115, codified at 42 U.S.C. § 17937. 2 Mobile Health App Developers: FTC Best Practices, FED. TRADE COMM’N, https://www.ftc.gov/tipsadvice/business-center/guidance/mobile-health-app-developers-ftc-best-practices (last visited on Sept. 15, 2021). 3 Mobile Health Apps Interactive Tool, FED. TRADE COMM’N, https://www.ftc.gov/tips-advice/businesscenter/guidance/mobile-health-apps-interactive-tool (last visited on Sept. 15, 2021). 4 See 16 C.F.R. § 318.2(a) 5 See id. § 318.2; 42 U.S.C. § 1320d(6), d(3).
2

sensitive health information without users’ authorization, this is a “breach of security” under the 

Rule.

6

The statute directing the FTC to promulgate the Rule requires that a “personal health 

record” be an electronic record that can be drawn from multiple sources. The Commission 

considers apps covered by the Rule if they are capable of drawing information from multiple 

sources, such as through a combination of consumer inputs and application programming 

interfaces (“APIs”). For example, an app is covered if it collects information directly from 

consumers and has the technical capacity to draw information through an API that enables 

syncing with a consumer’s fitness tracker. Similarly, an app that draws information from 

multiple sources is covered, even if the health information comes from only one source. For 

example, if a blood sugar monitoring app draws health information only from one source (e.g., a 

consumer’s inputted blood sugar levels), but also takes non-health information from another 

source (e.g., dates from your phone’s calendar), it is covered under the Rule. 

In addition, the Commission reminds entities offering services covered by the Rule that a 

“breach” is not limited to cybersecurity intrusions or nefarious behavior. Incidents of 

unauthorized access, including sharing of covered information without an individual’s 

authorization, triggers notification obligations under the Rule. 

As many Americans turn to apps and other technologies to track diseases, diagnoses, 

treatment, medications, fitness, fertility, sleep, mental health, diet, and other vital areas, this Rule 

is more important than ever. Firms offering these services should take appropriate care to secure 

and protect consumer data. The Commission intends to bring actions to enforce the Rule 

consistent with this Policy Statement. Violations of the Rule face civil penalties of $43,792 per 

violation per day. 

6 Id. § 318.2(a) (defining “breach of security” as “acquisition of [PHR identifiable health information] without the 

authorization of the individual.”).