FTC Amended Health Breach Notification Rule Takes Effect
The FTC's amended Health Breach Notification Rule became effective on July 29, 2024 (final rule published May 30, 2024, 89 FR 47028), expanding the definition of personal health record (PHR) to cover health apps, fitness trackers, and other direct-to-consumer digital health tools not covered by HIPAA. The amendments clarify that unauthorized sharing of health data with third parties (not just traditional security breaches) constitutes a reportable breach. Entities must notify affected individuals and the FTC without unreasonable delay and no later than 60 days after discovering a breach, with FTC notice for breaches affecting 500 or more individuals due at the same time as individual notice, and media notice required in some cases.
Key Analytics
Impact Analysis
Digital health companies, wellness apps, and consumer wearable platforms that fall outside HIPAA's covered entity definition are now explicitly subject to breach notification obligations. The expanded definition of breach to include unauthorized data sharing (not just hacking or theft) significantly broadens the scope of reportable events. Non-HIPAA health data handlers must build breach detection and notification infrastructure comparable to what HIPAA-covered entities maintain.
Recommended Actions
- Determine whether your organization handles personal health records under the expanded FTC definition and assess notification obligations
- Implement breach detection and notification procedures that meet the 60-day FTC reporting timeline for health data incidents
- Review all third-party data sharing arrangements involving health information to identify potential unauthorized disclosures requiring notification
Always verify requirements with official regulatory sources.
Estimated Remediation Effort
Indicative effort to address this development, broken down by your organization's current compliance posture. Select the posture that best matches where you are today.
A partial program exists: some policies and controls are in place, but coverage, evidence, and ownership have gaps.
- ›Applicability analysis under the expanded PHR definition
- ›Notification procedure gaps against the 60-day clock
- ›Third-party disclosure review for reportable sharing
The Cost of Waiting
Readiness work is dramatically cheaper before a deadline than after one. The ranges below come from the same estimate: the difference is only how prepared you are when the work starts.
Roughly 55 to 125 hours avoided by preparing early
Effort ranges are indicative planning estimates, not quotes. Actual effort depends on organizational scope, environment complexity, and evidence maturity. Talk to us for a scoped assessment.