Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A health app may have U.S. breach-notification duties under the Federal Trade Commission’s Health Breach Notification Rule (HBNR), even if it is not covered by HIPAA. The HBNR applies to defined vendors of personal health records (PHRs), PHR-related entities, and certain service providers when unsecured PHR identifiable health information is breached. The FTC’s 2024 amendments clarified how the rule can apply to health apps and similar technologies; they took effect July 29, 2024.
Does the FTC Health Breach Notification Rule cover your app?
Start with what the product does and how information moves through it—not just whether the company calls itself a health business. The FTC identifies three potentially covered roles: a vendor of personal health records, a PHR-related entity, and a third-party service provider to a vendor or related entity.
A personal health record is an electronic record of identifiable health information that has the technical capacity to draw information from multiple sources and is managed, shared, and controlled by or primarily for the individual. A possible example is an app that combines information entered by a user with data from a connected fitness tracker. Whether a specific product meets the definition depends on its capabilities and facts.
The FTC says most health apps that are not covered by HIPAA may be subject to the HBNR when the rule’s definitions and conditions apply. The rule is not a blanket requirement for every app that touches health information.
#1 Best Overall
- Chronic Illness Essential Gift: This A4 200-page medical records organizer is a perfect chronic illness gift. It serves as a comprehensive medical journal, ensuring you never miss vital information. Ideal for organizing health details with ease and efficiency.
- Blood Pressure Chart for Seniors: Our medical journal features detailed blood pressure charts for seniors, facilitating easy tracking of vital signs. This health journal for women and men is a crucial tool for managing blood pressure and maintaining health records.
- Comprehensive Medical Planner: The medical planner offers a structured approach to managing chronic illness. This blood pressure log book for daily tracking includes a blood pressure guide chart, making it a reliable chronic illness journal and vital signs log book.
- Medical Notebook for Patients: Designed as a medical notebook for patients, this organizer is perfect for maintaining detailed medical records. It serves as a blood pressure log, chronic illness journal, and health planner, ensuring all essential health data is recorded.
- Versatile Medical Log Book: This medical log book for daily tracking is ideal for organizing health information. As a medical records organizer, it includes a blood pressure log book, vital signs log book, and a planner for chronic illness management.
Screen the product and its data flows
- Does the app, website, connected device, or similar technology hold consumers’ health information?
- Does it provide products or services, or send or receive data to or from such a product?
- Does the company handle health information while providing services to a business that offers such a product?
- Can the record draw identifiable health information from multiple sources, and is it managed, shared, and controlled by or primarily for the individual?
- What is the company’s role in relation to the record: PHR vendor, related entity, or service provider?
The FTC’s Mobile Health App Interactive Tool can help with an initial screen. It is optional and cannot guarantee compliance. The product’s architecture, data flows, role, and HIPAA status still need to be assessed against the rule.
How the HBNR relates to HIPAA
HIPAA and the HBNR are distinct U.S. federal frameworks. FTC guidance says the HBNR does not apply to businesses or organizations covered by HIPAA; HIPAA-covered entities must follow HHS’s Breach Notification Rule. For companies and service providers outside HIPAA coverage, the HBNR may still apply if the rule’s definitions are met.
That makes “Are we a HIPAA covered entity?” an incomplete screening question. A consumer-facing app that is not a HIPAA covered entity or business associate should still assess whether it is a PHR vendor, related entity, or service provider covered by the HBNR. A simple HIPAA-versus-non-HIPAA label does not settle every vendor or service-provider question.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat counts as a breach?
A breach does not necessarily require a hacker to break into a system. The 2024 amendments clarify that a breach of security includes unauthorized acquisition of unsecured PHR identifiable health information resulting from a data-security breach or an unauthorized disclosure. The FTC’s April 30, 2024 business explainer quoted the final rule this way: “A breach of security includes an unauthorized acquisition of unsecured PHR identifiable health information in a personal health record that occurs as a result of a data breach or an unauthorized disclosure.”
Accordingly, a disclosure of health information to an outside advertising or analytics platform may raise HBNR questions, as can an external intrusion. But not every disclosure automatically qualifies as a reportable breach: assess whether the information, record, entity, and event meet the rule’s definitions on the actual facts.
Who must be notified, and by when?
For the deadlines below, discovery occurs when someone in the company knows or reasonably should know of the breach. Individual notice must be provided without unreasonable delay and no later than 60 calendar days after discovery.
| Recipient | Trigger and deadline |
|---|---|
| Affected U.S. individuals | Notify without unreasonable delay and within 60 calendar days after discovery. |
| FTC, 500 or more people affected | Notify at the same time as affected individuals, without unreasonable delay and within 60 calendar days after discovery. |
| FTC, fewer than 500 people affected | Submit notice within 60 calendar days after the end of the calendar year in which the breach occurred. The FTC says smaller breaches can be reported annually. |
| Prominent media serving a state or jurisdiction | Notify if 500 or more residents of that state or jurisdiction are affected, without unreasonable delay and within 60 calendar days after discovery. This is in addition to individual notice. |
| Client of a third-party service provider | The service provider notifies the contract-designated official—or a senior official if none is designated—without unreasonable delay and within 60 calendar days after discovery. It must identify affected customers and obtain acknowledgment. |
The affected-person count determines the FTC reporting schedule; the separate media threshold is based on the number of affected residents in one state or jurisdiction. For the rule text and FTC’s detailed reporting guidance, see the Health Breach Notification Rule and FTC business guidance.
How to make breach notices usable
Notice is not just a delivery task. FTC guidance calls for clear, conspicuous, reasonably understandable language and recommends planning contact methods before an incident. The rule’s required content includes a brief description of what happened; known breach and discovery dates; known acquiring third parties; the types of unsecured health information involved; and other prescribed information. Consult the final rule and guidance for the complete content requirements.
Best Value
- Achieve Your Health Goals: Empower your wellness journey with this easy-to-use food diary, perfect for tracking daily meals and managing your nutrition and calorie intake. Find motivation and clarity in your diet plans, and celebrate each step towards your health goals.
- Detailed Nutritional Tracking: More than just a calorie tracker, you can monitor calories, carbs, fat, protein and much more. This comprehensive tracking fosters control over your diet, ensuring you’re on track with your nutritional needs. Thick paper pages, a cover page, and a opaque plastic privacy cover.
- Simplify Your Diet Planning: Our food diary is designed for efficiency and simplicity. Track your meals effortlessly, which helps you maintain a consistent and effective diet routine. This food log is your partner in pursuing a healthy lifestyle.
- Stay Inspired and Accountable: Cora Kate's food journals for tracking meals are more than just trackers, they're a daily source of inspiration. Stay accountable to your dietary choices and feel encouraged as you progress towards your personal dietary goals.
- Compact and Convenient: Sized at 5.5 x 8.5 inches with 50 pages, our food diet journal is perfectly portable. Carry it easily in your bag or backpack, ensuring you can log your meals and track your diet and water intake anytime, anywhere.
Choose and supplement contact channels
- If email is the default, give consumers a clear and conspicuous opportunity to choose first-class mail instead.
- When sending notice by email, provide a supplementary notice through text message, an in-app message, or a banner on the website or app.
- If reasonable efforts cannot reach at least 10 people because contact details are insufficient or out of date, FTC guidance describes substitute notice options. These include a prominent website posting for 90 days or notice through major local print or broadcast media, along with a toll-free number active for at least 90 days.
Write for people affected by the incident
Use short sentences, bullets, plain-language headings, legible type, and enough spacing to make the notice easy to read. Avoid unnecessary legal or technical terminology, multiple negatives, and vague descriptions. Explain what happened and what types of information were involved in terms people can understand.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What app teams should do before an incident
- Map the product’s data sources and sharing. Document what health information the product holds, where it comes from, whether it can combine information from multiple sources, who controls or manages the record, and which third parties receive data.
- Determine the company’s role. Assess whether the company may be a PHR vendor, PHR-related entity, or third-party service provider, and separately determine whether HIPAA applies.
- Set up escalation and counting. Establish how suspected unauthorized acquisition or disclosure is escalated, how the discovery date is determined, and how affected individuals and residents by jurisdiction will be counted.
- Prepare notification logistics. Keep usable contact information, decide how consumers can choose mail instead of email, and make sure a supplementary email channel and substitute-notice process can be deployed.
- Align service-provider contracts and operations. Ensure teams know which official receives a provider’s notice, how affected customers will be identified, and how acknowledgment will be obtained.
The FTC’s July 2024 business guidance stated that a business failing to comply could face civil penalties of up to $51,744 per violation. That is the FTC’s stated maximum in guidance published in July 2024; civil penalty maximums can change, so confirm the current figure before relying on it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
