The FTC highlighted several specific aspects of the final rule:

The rule applies to health apps and similar technologies not covered by HIPAA.
The definition of "breach of security" includes both data security breaches and unauthorized disclosures.
The revised definition of "personal health data-related entity" establishes that the rule applies to entities that offer products and services through online services of vendors of personal health records, including mobile apps.
In the definition of "personal health record," the technical capacity to draw information from multiple sources matters.
The final rule expands the use of electronic notice to consumers.
Notices to consumers must include more information and must be "clear and conspicuous" and "reasonably understandable."
Covered entities must move quickly to notify consumers — and the FTC — about breaches involving 500 or more people.
The final rule adds cross-references, citations and more information about penalties for noncompliance.

In February 2023, the FTC resolved several claims under the rule against GoodRX, which it alleged had failed to notify customers and regulators of unauthorized disclosures of consumers' personal health information. GoodRx agreed to pay a $1.5 million civil penalty. Last May, the FTC reached a settlement with the developer of the fertility app Premom over allegations it had deceived users by sharing their sensitive personal information with third parties, disclosed users' sensitive health data to AppsFlyer and Google, and failed to notify consumers of these unauthorized disclosures in violation of the Health Breach Notification Rule.

Instant Insights /

New FTC rule requires digital health apps to notify users of data breaches

More From HR Executive

Related Stories

Recommended For You