United States. Breach notification. Regulation
HBNRFTC Health Breach Notification Rule (16 C.F.R. Part 318)
Partly verified
Medium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
§1Summary
- Synopsis
Requires vendors of personal health records and related entities not covered by HIPAA to notify individuals, the FTC and sometimes the media after a breach of unsecured identifiable health information. The 2024 update confirms that unauthorised disclosures (e.g. sharing with advertisers) count as breaches.
- Key themes
- Unique features
Treats unauthorised sharing, not just security incidents, as a reportable breach; fills the gap for non-HIPAA health apps.
- SaaS relevance
Health and wellness apps and the SaaS platforms behind them that draw data from multiple sources are 'PHR vendors' or service providers to them.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals without unreasonable delay and within 60 days; FTC at same time if 500+ (else annually); media if 500+ in a state
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- $53,088 per violation
§3Dates
- Key dates
- Adopted
- In force
- 2021 policy statement; amended rule published 2024-05-30, effective 2024-07-29, clarifying coverage of health apps and adding electronic notice.
§4Text and authority
- Text
- Authoritative text ecfr.gov
- Authority
- Federal Trade Commission (FTC)
§5Where it applies
- Domestic law of
- United States
- Also applies in
- Alabama
- Alaska
- Arizona
- Arkansas
- California
- Colorado
- Connecticut
- Delaware
- District of Columbia
- Florida
- Georgia
- Guam
- Hawaii
- Idaho
- Illinois
- Indiana
- Iowa
- Kansas
- Kentucky
- Louisiana
- Maine
- Maryland
- Massachusetts
- Michigan
- Minnesota
- Mississippi
- Missouri
- Montana
- Nebraska
- Nevada
- New Hampshire
- New Jersey
- New Mexico
- New York
- North Carolina
- North Dakota
- Ohio
- Oklahoma
- Oregon
- Pennsylvania
- Puerto Rico
- Rhode Island
- South Carolina
- South Dakota
- Tennessee
- Texas
- US Virgin Islands
- Utah
- Vermont
- Virginia
- Washington
- West Virginia
- Wisconsin
- Wyoming
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.