Article
What the FTC did
On Sept. 9, the FTC said it had rescinded its 2021 policy statement explaining how the Health Breach Notification Rule applies to health apps and connected devices that collect consumer health information. The agency called the statement unnecessary because its 2024 update to the rule now covers health apps and connected devices such as fitness trackers directly. It also tied the move to a presidential order directing agencies to remove obsolete guidance and policy statements.
In practice, the substance did not go away. The 2021 statement was guidance; the 2024 rule is binding regulation. The FTC’s action removes a duplicate document, not an obligation.
Why hospitals should pay attention
Hospitals’ own breach duties come mainly from HIPAA. But health systems increasingly rely on consumer-facing tools that sit outside that framework, including wellness and fitness apps, remote monitoring products, and digital front-door partners that collect data directly from consumers. When a breach involves one of these tools, the question of which rule applies, and who must notify patients and regulators, can become urgent quickly.
The answer depends on how each relationship is structured. A vendor working on a hospital’s behalf under a business associate agreement is usually covered by HIPAA. A company offering its own app to consumers, even one that connects to a hospital’s records, may instead fall under the FTC rule. Leaders should know where those lines fall before an incident, not after.
What to review now
- Inventory consumer tools. List apps, devices and portals that collect health information from patients, including those offered by partners under your brand.
- Classify each one. Work with counsel to decide whether HIPAA, the FTC rule or both apply.
- Check contracts. Make sure agreements assign breach notice duties, timelines and costs, and require the partner to tell you promptly.
- Align with your incident plan. Add partner app breaches to tabletop exercises so legal, privacy and communications teams know their roles.
- Watch for more changes. The FTC framed this step as part of a broader cleanup of guidance, so other privacy documents may also be revisited.
Archive entry for Sep 10, 2026, added Nov. 11, 2026.