WASHINGTON, D.C. — The Federal Trade Commission rescinded its 2021 health-app breach policy on Sept. 9 after a 2024 rule formally extended federal breach-notification requirements to health apps and connected devices, eliminating guidance the agency now considers redundant.
The withdrawal removes the FTC’s “Statement of the Commission on Breaches by Health Apps and Other Connected Devices,” which was adopted in September 2021 to explain how the Health Breach Notification Rule applied to digital health products. The underlying rule and its requirements remain in force.
The FTC amended the Health Breach Notification Rule in 2024 to clarify its application to health apps, connected devices, and similar technologies that handle consumers’ identifiable health information but fall outside the Health Insurance Portability and Accountability Act. Those amendments took effect July 29, 2024.
Covered companies must notify affected consumers and the FTC following qualifying breaches of unsecured identifiable health information and, in some cases, notify the media. For breaches involving 500 or more people, notice to affected individuals and the FTC must occur without unreasonable delay and no later than 60 calendar days after discovery.
The 2021 policy had taken the position that health apps and connected devices capable of drawing health information from multiple sources could fall under the rule. The commission approved that statement 3-2 at the time.
Three years later, the FTC incorporated the scope more directly into the regulation by revising definitions and specifying its application to health apps and similar technologies. The amendments also clarified what constitutes a breach, expanded electronic notification options, and changed requirements governing the information consumers receive after a breach.
In rescinding the earlier statement, the FTC determined that it had been superseded by the rulemaking and provided “minimal benefit.” The commission also stated that guidance generally creates neither substantive rights nor binding obligations.
The withdrawal is also part of the Trump administration’s broader deregulatory initiative. President Donald Trump’s January 2025 executive order directed federal agencies to consider regulations as well as memoranda, guidance documents, policy statements, and other administrative actions when reducing regulatory burdens.
The change does not eliminate the FTC’s breach-notification requirements for covered digital-health businesses. The agency’s current compliance guidance states that the 2024 amendments make clear that makers of covered health apps, connected devices, and similar products must comply with the Health Breach Notification Rule.
Support the local news that supports Chester County. MyChesCo delivers reliable, fact-based reporting and essential community resources—free for everyone. If you value that, click here to become a patron today.