Updated Guidance On The FTC's Health Breach Notification Rule

Last week, the Federal Trade Commission ("FTC") released two guidance documents to aid in compliance with its Health Breach Notification Rule ("the Rule"), which requires "vendors of personal health records" or "PHR related entities" to notify consumers, the FTC, and, sometimes the media, when they discover a breach of security of "unsecured" personal health record identifiable health information. Last year, the FTC released a policy statement, signaling its commitment to enforce the Rule and clarifying (and from the perspective of many, broadening) the types of entities that would come under the Rule's purview. 

This latest set of guidance reinforces that the FTC is increasing its attention on health apps and health data breaches in particular. Violations of the Rule are treated as unfair or deceptive acts or practices under the FTC Act and could lead to civil penalties of up to $46,517 per violation. Health app companies that offer products that may fall within