FTC rescinds health app breach notification policy
Rule Changes2021 policy statement withdrawn as obsolete; Health Breach Notification Rule still covers health apps
Yesterday: FTC rescinds health app policyNew here? Follow stories to track developments over time. Create a free account to get updates when stories you care about change.
Overview
Updated 56 minutes agoThe Federal Trade Commission rescinded its 2021 policy statement that required health apps and connected devices to notify users when their health data is breached. The agency said the guidance was obsolete, superseded by a 2024 rulemaking that already extended the underlying Health Breach Notification Rule to those products.
The withdrawal advances President Trump's executive order directing agencies to eliminate unnecessary guidance documents. The 2024 rule remains in force, so the practical effect depends on whether health app companies keep notifying users of breaches without the policy statement's explicit language.
Why it matters
The rescission could leave millions of health app users without breach notifications if companies stop complying.
Questions about this story
Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.
No questions yet — be the first to ask.
Key Indicators
Voices
Curated perspectives — historical figures and your fellow readers.
Play
Exploring all sides of a story is often best achieved with Play.
Higher or Lower
A number from this story, against one from elsewhere in the news — guess which is bigger, then keep the chain going. 5 rounds, 3 strikes; a miss costs a strike and resets your streak.
Keyboard: ↓/L lower · ↑/H higher
0 points — sign up to put that on the leaderboard.
Connections
Sixteen names from the news. Find the four hidden groups of four. Four mistakes max.
Sign up to keep a daily streak — a new puzzle lands every day.
Exit debate?
Your progress in this debate will be lost.
- 1 Two AI personas square off on this story.
- 2 You predict who'll win each round — correct picks earn XP.
- 3 One crossfire question is yours to fire. Pick it carefully.
Couldn't generate a topic
Select Your Champions
Choose one persona for each side of the debate
DEBATE TOPIC
Choose personas with different perspectives for a more dynamic debate.
Select debater for this side:
No debate personas available right now.
Select debater for this side:
No debate personas available right now.
Who's Got This Round?
Make your prediction before the referee scores
The referee scores both sides on
Round Results
Set the Crossfire
Pick the question both personas must answer in the final round
Debate Oracle! You called every round!
Sharp Instincts! You know your debaters!
The Coin Flip Strategist! Perfectly balanced!
The Contrarian! Bold predictions!
Inverse Genius! Try betting the opposite next time!
XP Breakdown
Prediction History
People Involved
Organizations Involved
Timeline
September 2021 September 2026
-
FTC rescinds health app policy
Latest StatementUnanimous vote withdraws the 2021 statement as obsolete; the 2024 rule remains in effect.
-
FTC finalizes HBNR rule changes
Rule ChangeRule updated to explicitly cover health apps and connected devices not covered by HIPAA; passed 3-2.
-
Premom app publisher settles
EnforcementFTC fined Easy Healthcare, maker of the Premom fertility app, for disclosing health data without authorization.
-
GoodRx settles first HBNR case
EnforcementThe FTC fined telehealth company GoodRx for sharing user health data, the first enforcement action under the rule.
-
FTC issues health app breach policy
Statement3-2 vote extends Health Breach Notification Rule to apps and connected devices, with fines up to $43,792 per violation per day.
Historical Context
3 moments from history that rhyme with this story — and how they unfolded.
Broadband privacy rules repeal (2017)
Congress voted to repeal Federal Communications Commission rules that would have required internet providers to get opt-in consent before sharing customers' browsing history and app usage data. The rules never took effect.
Internet providers were not required to get opt-in consent, and privacy advocates warned consumers would see more targeted advertising and data sharing.
The repeal became a template for rolling back consumer data protections through the Congressional Review Act after a presidential transition.
Shows how a consumer data privacy protection can be undone when political control shifts, though the FTC rescission is narrower than a congressional repeal.
Congressional Review Act rollbacks (2017)
Using the Congressional Review Act, the Republican Congress rolled back 14 Obama-era regulations, including the broadband privacy rules and a rule limiting coal mining impacts. Each repeal required only a simple majority.
Obama-era rules were voided, and agencies could not issue substantially similar rules without new legislation.
Established the CRA as a standard tool for reversing regulations after a presidential transition.
Illustrates the broader deregulatory mechanism at work in the FTC's rescission, though the FTC used its own authority rather than waiting for Congress.
GoodRx and Easy Healthcare HBNR settlements (2023)
The FTC brought its first enforcement actions under the Health Breach Notification Rule, fining telehealth company GoodRx and fertility app publisher Easy Healthcare for sharing user health data without consent. Both cases relied on the 2021 policy statement's interpretation of the rule.
The settlements put health app companies on notice that the FTC would enforce breach notification requirements and third-party data-sharing prohibitions.
The enforcement push led to the 2024 rulemaking that codified the policy statement's interpretations into the rule itself.
Shows the policy statement was not just guidance on paper — it drove real enforcement actions, which the 2024 rule now sustains on its own.
