FTC Health Breach Notification Rule for practices

Most practice owners know HIPAA’s breach notification rule. Fewer know there is a second federal health breach rule, enforced by the FTC, that covers health information HIPAA does not. It was amended in 2024 with health apps and online tracking in mind, and it matters to a practice in three situations: when part of your business sits outside HIPAA, when you offer patients an app or online health program, and when you choose vendors that collect health data from consumers.

This guide explains who the rule covers, what counts as a breach, what notice it requires, and the questions to ask before you launch an app, a wellness program or a tracking tool. For apps that send push notifications, see our guide to web push notifications for practice websites and apps. For the store rules that apply to health apps, see our guide to App Store and Google Play rules for health apps.

This is general information, not legal advice. Sources cited were checked on October 28, 2026: 16 CFR Part 318 (the Health Breach Notification Rule, as amended by the final rule published in the Federal Register on May 30, 2024) and the FTC business guidance Complying with FTC’s Health Breach Notification Rule (penalty figure as edited in January 2025). Whether your practice is a HIPAA-covered entity, and whether this rule reaches any part of your business, are legal questions. Have a health care attorney review your situation.

Two breach rules, two kinds of business

The FTC rule applies to vendors of personal health records, PHR related entities and third party service providers. The definitions in 16 CFR 318.2 exclude HIPAA-covered entities and businesses to the extent they act as a HIPAA business associate. The FTC’s guidance says it plainly: the rule does not apply to HIPAA-covered entities, like a hospital, doctor’s office or health insurance company, or to a business acting solely as a HIPAA business associate. Those businesses follow the HHS breach notification rule instead.

So for a typical practice that bills insurance electronically, patient records handled under HIPAA stay under HIPAA. The FTC rule becomes relevant at the edges: a business that is not a covered entity, a separate company that runs an app or program, and the outside vendors those businesses use.

What the rule covers after the 2024 amendments

The 2024 amendments rewrote several definitions. Three matter most to practices.

Personal health record. An electronic record of identifiable health information on an individual that has the technical capacity to draw information from multiple sources and is managed, shared and controlled by or primarily for the individual. The FTC’s guidance gives the example of a health app that collects information from consumers and can also draw information from other sources.
Covered health care provider. The definition now includes any entity furnishing health care services or supplies, and health care services or supplies includes any online service, such as a website, mobile app or internet-connected device, that provides mechanisms to track diseases, conditions, treatment, medications, vital signs, symptoms, fitness, fertility, sexual health, sleep, mental health, diet and more.
PHR identifiable health information. Health information that identifies the individual, or could reasonably be used to, and is created or received by a covered health care provider, health plan, employer or clearinghouse. Information provided by or on behalf of the individual counts.

Read together, these definitions mean that a consumer-facing health app or online program can fall under the rule even when no traditional health care provider is involved.

A breach is not only a hack

Under 318.2, a breach of security is the acquisition of unsecured PHR identifiable health information in a personal health record without the individual’s authorization, and it includes an unauthorized disclosure. The FTC’s guidance says a breach is not limited to cybersecurity intrusions, and that sharing covered information without an individual’s authorization triggers notification obligations.

That is the change that links this rule to marketing. Sending identifiable health information from an app or website to an advertising or analytics company, without the person’s authorization, can itself be a breach under the rule. The rule applies only to unsecured information, meaning information not protected by the encryption or destruction methods HHS specifies, and only to electronic records. Member profiles and posts in a company-run community can raise the same question; our guide to brand-run patient communities covers that case.

Where a practice can run into it

A cash-pay business that is not a HIPAA-covered entity and offers patients an app, portal or online tracker. Whether you are a covered entity depends on facts such as electronic billing, so ask counsel rather than assume.
A separate company you set up to run a consumer wellness, weight loss, fitness or supplement program online, outside the practice.
A patient app you license from a vendor that the vendor offers directly to consumers as well, where the vendor may be covered for its own consumer business.
Marketing tools inside such an app or program that send health details to ad platforms.

Inside a HIPAA-covered practice, the same tracking problem is handled under HIPAA instead; see our guides to tracking pixels on practice websites and AI chatbots on practice websites.

Who must be notified, and when

Under 318.3 to 318.5, after discovering a breach a covered vendor or PHR related entity must notify:

Each affected individual who is a U.S. citizen or resident, without unreasonable delay and no later than 60 calendar days after discovery.
The FTC. For 500 or more individuals, at the same time as the individual notices; for fewer than 500, the rule allows a log submitted to the FTC on an annual schedule.
Prominent media outlets serving a state or jurisdiction, if 500 or more residents of that state or jurisdiction are affected.

A breach counts as discovered on the first day it is known, or reasonably should have been known, to the business. Third party service providers must notify the business they serve, which then notifies individuals. Under 318.6, the notice must describe what happened and when, the types of health information involved, the full name or identity of any third parties that acquired the information (with a narrow exception where naming them would pose a risk), steps people can take to protect themselves, what the business is doing in response, and contact procedures. Written notice can go by electronic mail, which the rule defines as email combined with a text message, in-app message or banner, if the individual has specified electronic mail as their primary method of communication.

For the HIPAA side, our guide to the HIPAA breach notification letter covers the 60 day limit, what the patient letter must include and reporting to HHS.

Penalties

Under 318.7, a violation is treated as a violation of an FTC rule on unfair or deceptive acts or practices and is subject to civil penalties, adjusted for inflation. The FTC’s guidance, as edited in January 2025, lists a civil penalty of up to 53,088 dollars per violation. Penalty amounts are adjusted over time, so check the current figure.

Questions to ask before you launch an app or program

Which rule applies? Is the business running it a HIPAA-covered entity or business associate for this activity, or not? Get a written answer from counsel.
What does it collect, and from where? Does it draw information from more than one source, such as a device, a lab result or a form? That points toward the personal health record definition.
Where does the data go? List every company that receives identifiable data, including ad and analytics tools, and get each disclosure authorized or removed.
Is it secured? Is data encrypted in line with HHS’s specified methods, at rest and in transit?
Who notifies whom? Do vendor contracts name the official who receives breach notices, and does your plan meet the 60-day limit?
Do your words match? Privacy notices and marketing claims about how data is used must be accurate, which the FTC also enforces under Section 5 of the FTC Act.

Our AI front desk page explains how we limit what our own tool collects. For state-level rules on consumer health data, see our guide to Washington’s My Health My Data Act.

Does the FTC Health Breach Notification Rule apply to my medical practice?

Usually not to records handled as a HIPAA-covered entity. The FTC’s guidance says the rule does not apply to HIPAA-covered entities such as a doctor’s office, or to businesses acting solely as HIPAA business associates. It can apply to parts of a business outside HIPAA, such as a consumer health app or online program.

Is sharing app data with an ad platform a breach?

It can be. Under 16 CFR 318.2 a breach includes an unauthorized disclosure, and the FTC’s guidance says sharing covered information without the individual’s authorization triggers notification obligations.

How long do we have to notify people?

Without unreasonable delay and no later than 60 calendar days after the breach is discovered, under 16 CFR 318.4.

When do we have to notify the media?

When the unsecured information of 500 or more residents of a state or jurisdiction is, or is reasonably believed to have been, acquired in the breach, under 16 CFR 318.3 and 318.5.

Does the rule cover paper records?

No. The FTC’s guidance says that if a breach involves only paper records, not electronic ones, the rule does not require notification.

For practices and other HIPAA-covered entities, the state layer is covered in our guide to state data breach laws vs HIPAA.

The FTC Health Breach Notification Rule: when it applies to practices, apps and health programs