FTC Health Breach Notification Rule
Amended United States (Federal) · In force Sep 24, 2009 · no upcoming deadlines
Deadlines
| Date | What happens | When |
|---|---|---|
| Feb 22, 2010 | Full compliance with original Rule16.6 years ago | 16.6 years ago |
| Jul 29, 2024 | 2024 amendments effective2.2 years ago | 2.2 years ago |
Summaries for reference, not legal advice. Check the official text.
What it does
Requires vendors of personal health records (including health and wellness apps) and PHR related entities not covered by HIPAA to notify affected individuals, the FTC and, for 500+ residents of a state, prominent media, after a breach of unsecured PHR identifiable health information. The 2024 amendments confirm that unauthorized disclosures (not just hacks) are breaches, clarify coverage of health apps drawing data from multiple sources, allow email notice, and expand notice content.
- Who it applies to
- Vendors of personal health records, PHR related entities, and their third-party service providers that are not HIPAA covered entities or business associates. Notice to individuals within 60 calendar days of discovery; FTC notice for breaches of 500+ individuals contemporaneously with individual notice; smaller breaches logged and reported annually.
- Penalties
- Treated as violations of an FTC trade regulation rule: civil penalties up to $53,088 per violation (FTC Act 5(m)(1)(A) amount as adjusted January 2025, 90 FR 5580; adjusted annually for inflation).
- Enforced by
- Federal Trade Commission
- Official name
- FTC Health Breach Notification Rule (16 CFR Part 318), as amended 2024
- Citation
- 16 CFR Part 318; 74 FR 42962 (2009); amendments 89 FR 47028 (May 30, 2024)
- Topics
- health, privacy, breach-notification
Research notes
Prior FTC enforcement: GoodRx ($1.5 million civil penalty, 2023) and Easy Healthcare ($100,000, 2023), cited in the 2024 rule.
Related
CIRCIAQuestions about FTC Health Breach Notification Rule
- What are the FTC Health Breach Notification Rule compliance deadlines?
- Feb 22, 2010: Full compliance with original Rule. Jul 29, 2024: 2024 amendments effective.
- When does FTC Health Breach Notification Rule take effect?
- FTC Health Breach Notification Rule took effect on Sep 24, 2009.
- Who does FTC Health Breach Notification Rule apply to?
- Vendors of personal health records, PHR related entities, and their third-party service providers that are not HIPAA covered entities or business associates. Notice to individuals within 60 calendar days of discovery; FTC notice for breaches of 500+ individuals contemporaneously with individual notice; smaller breaches logged and reported annually.
- What are the penalties under FTC Health Breach Notification Rule?
- Treated as violations of an FTC trade regulation rule: civil penalties up to $53,088 per violation (FTC Act 5(m)(1)(A) amount as adjusted January 2025, 90 FR 5580; adjusted annually for inflation).