The FTC rule covers vendors of personal health records and related entities not subject to HIPAA. Recent enforcement extended it to unauthorized disclosures through tracking technologies, not only security incidents.
Penalties accrue per violation per day.
Alternative Names:
HBNR|FTC Health Breach Rule
Why it Matters?
Extension to tracking technology disclosures substantially broadened the rule's reach, since sharing health-related information with advertising platforms is treated as a breach requiring notification rather than only a privacy violation, which caught health application developers that never considered themselves covered. Determining whether an application handles personal health records is accordingly a threshold analysis for any health-adjacent product.
Frequently Confused with
Related terms
Frequently asked questions
What did recent enforcement extend?
Who was caught unprepared?
