The FTC Health Breach Notification Rule for Health and Fitness Apps

The FTC says its Health Breach Notification Rule "applies to most health apps that aren't covered by HIPAA". The rule is 16 CFR part 318, and the FTC explains it in its business guide, Complying with FTC's Health Breach Notification Rule. This page sets out what the rule's text and the FTC's own pages say, as read on October 17, 2026. It is general information, not legal advice.

Who the rule covers#

Section 318.1 says the rule "applies to foreign and domestic vendors of personal health records, PHR related entities, and third party service providers, irrespective of any jurisdictional tests in the Federal Trade Commission (FTC) Act, that maintain information of U.S. citizens or residents." It "does not apply to HIPAA-covered entities, or to any other entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity."

A personal health record is "an electronic record of PHR identifiable health information on an individual that has the technical capacity to draw information from multiple sources and that is managed, shared, and controlled by or primarily for the individual." The FTC's guide gives a diet app where users enter daily weights and an API pulls calorie counts from restaurant menus as a case where "there's a good chance you have a PHR covered by the FTC's Rule."

Why fitness and sleep apps fall inside it#

The information the rule protects must be created or received by, among others, a covered health care provider, which the rule defines to include "any other entity furnishing health care services or supplies." Health care services or supplies means "any online service such as a website, mobile application, or internet-connected device that provides mechanisms to track diseases, health conditions, diagnoses or diagnostic testing, treatment, medications, vital signs, symptoms, bodily functions, fitness, fertility, sexual health, sleep, mental health, genetic information, diet, or that provides other health-related services or tools."

The FTC's Mobile Health Apps Interactive Tool states the consequence: the July 2024 amendments "explain that most health app developers act as 'covered health care providers' when they furnish health care services or supplies – in this case, their app – to consumers."

The FTC's guide answers the fitness-app case directly. Asked about an app where users enter their height, weight and age, which can sync with wearable fitness trackers that only some users connect, the FTC replies: "You are likely a vendor of personal health records." It explains that the app has the technical capacity to draw identifiable health information from both the consumer and the tracker, "even if some consumers choose to not connect the fitness tracker."

What counts as a breach#

The rule defines a breach of security as the "acquisition of such information without the authorization of the individual." It presumes that unauthorized access is acquisition unless the company "has reliable evidence showing that there has not been, or could not reasonably have been, unauthorized acquisition of such information", and it says a breach includes an unauthorized acquisition "that occurs as a result of a data breach or an unauthorized disclosure."

That last clause reaches product decisions, not just security incidents. The FTC's guide says "if you disclose consumers' unsecured, individually identifiable health information without their consent, a breach has occurred." Its example of identifiable health information is a company that shares "your users' medical information along with their mobile identifiers with an ad network for the purpose of targeted marketing without first getting the person's consent." No names were shared in that example, and the FTC says the information "could still readily identify individual consumers".

Two limits narrow the rule:

• Unsecured information only. The rule covers information not protected by a technology or methodology that HHS specifies. The FTC's guide says HHS's definition includes "any information that is not encrypted or destroyed", and that losing a laptop holding only encrypted personal health records would not require notice.
• Electronic records only. "If your business experiences a breach involving only paper health records – not electronic records – the FTC's Rule doesn't require any notification."

Who to notify, and by when#

A breach counts as discovered "as of the first day on which such breach is known or reasonably should have been known", including when it is known to any employee, officer or other agent other than the person who committed it.

The 60 days are a ceiling, not a target. The FTC's guide says that if a company gathers the necessary information within 30 days, "it would be unreasonable to wait until the 60th day" to notify people. A law enforcement official can delay notice that "would impede a criminal investigation or cause damage to national security", and the company carries "the burden of demonstrating that all notifications were made as required under this part". Notice to the FTC goes through its online form, the Notice of Breach of Health Information.

How the notice must look#

Written notice goes to the individual's last known address, and may go by electronic mail if the individual has chosen that as the primary method. The rule defines electronic mail as "email in combination with one or more of the following: text message, within-application messaging, or electronic banner", so email alone does not meet it. If contact details are insufficient or out of date for ten or more people, the rule requires substitute notice: a conspicuous posting on the website's home page for 90 days, or notice in major print or broadcast media, each with a toll-free number that stays active for at least 90 days.

Section 318.6 sets the content, in plain language:

• what happened, including the dates of the breach and of its discovery if known, and the identity of any third parties that acquired the information;
• the types of information involved, a list that names "the individual's use of a health-related mobile application" and a "device identifier (in combination with another data element)";
• steps individuals should take to protect themselves;
• what the company is doing to investigate, mitigate harm and protect against further breaches;
• at least two ways to make contact, chosen from a toll-free telephone number, email address, website, within-application, or postal address.

Penalties, HIPAA and state law#

Section 318.7 treats a violation as a violation of an FTC rule on unfair or deceptive acts or practices, subject to civil penalties as adjusted for inflation. The FTC's guide, edited in January 2025 to reflect inflation-adjusted maximums, says businesses that violate the rule "may be subject to a civil penalty of up to $53,088 per violation." That maximum is adjusted for inflation, so check the FTC's current figure before quoting it.

The FTC says a company that acts solely as a HIPAA business associate is outside the rule, and its duties sit in HHS's Breach Notification Rule. A business associate that also offers personal health record services to the public "may be subject to both the HHS and FTC Breach Notification Rules." The FTC's rule "preempts contradictory state breach notification laws, but not those that impose additional – but non-contradictory – breach notification requirements", and the FTC says one notice can carry both sets of content.

What changed in 2024 and 2026#

eCFR's current text records the rule as amended at 89 FR 47054 on May 30, 2024, and the FTC's guide says the "July 2024 amendments make clear that makers of health apps, connected devices, and similar products must comply with the Rule."

On September 9, 2026, the FTC rescinded its 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices. The FTC said its 2024 update to the rule already covers "health apps and connected devices like fitness trackers, rendering the policy statement unnecessary." The rescission did not amend the rule: eCFR's current text lists no amendment after May 30, 2024.

What this means for a fitness app#

In our reading, these are the engineering consequences:

• Map every flow of health data out of your app. The FTC's tool asks which APIs you use, whether your app syncs with other health or fitness apps, and whether users can upload data from other sources or send it elsewhere, and says whether the rule applies "may depend on the answers to these questions". An analytics or advertising SDK that receives identifiable health data without the user's authorization is a breach question, not only a privacy-policy question.
• Encrypt health data at rest and in transit. Information protected by a technology or methodology HHS specifies is not "unsecured" under the rule. Our secure storage guide covers the mechanics.
• Ask users at sign-up how they want to hear about a breach. The FTC's guide suggests finding out in advance, "perhaps when they sign up for your service", whether people prefer email or first-class mail, and an email plan needs a text, in-app or banner channel alongside it.
• Put the notice duty in vendor contracts. The rule requires vendors and related entities to tell their third party service providers that they are covered, and those providers must notify a designated official and get acknowledgment.
• Keep an incident log from day one. Breaches affecting fewer than 500 people go to the FTC in an annual log, and the burden of showing timely notice sits with you.

Whether you are a vendor, a related entity or a service provider depends on your product and your data flows, so confirm it with counsel. For where HIPAA begins, see does my fitness app need HIPAA; for Washington's state law, see the My Health My Data Act for fitness apps.