FTC's Final Health Breach Notification Rule: Expanded Scope, New Obligations, And Modified Reporting Requirements

The Federal Trade Commission ("FTC") intends to "strengthen and modernize" the Health Breach Notification Rule with revamped and increased scrutiny on entities holding health information, including health apps, websites, and other direct-to-consumer services.

The FTC recently announced a final rule amending its Health Breach Notification Rule ("HBNR") to explicitly extend to health apps, websites, and other direct-to-consumer services holding certain health information. The HBNR requires regulated entities to notify consumers, the FTC, and, in some cases, the media of a "breach" of unsecured personally identifiable health information ("IHI") that is in a personal health record ("PHR"). The original HBNR became effective in 2009 and was enforced for the first time in 2023. With the new final rule, the FTC intends to "strengthen and modernize" the HBNR with revamped and increased scrutiny on entities holding health information. The final rule will take effect on