The FTC Health Breach Notification Rule, 16 CFR Part 318, requires vendors of personal health records and related entities that are not covered by HIPAA to notify affected individuals, the Federal Trade Commission and, in some cases, the media after a breach of security of unsecured health information. Since the amendments effective July 29, 2024, the definition of breach of security states that it includes an unauthorized acquisition that results from a data breach or an unauthorized disclosure. Integral Healthcare Solutions (IHS) drafts the data inventory, incident procedure and notice templates for consumer health apps, wearables and wellness companies; your counsel decides whether the rule applies, and you send every notice.
IHS is a consulting firm, not a law firm, and this page is not legal advice.
Last updated: November 2026
What does the FTC Health Breach Notification Rule require?
We read the annual edition of 16 CFR Part 318 dated January 1, 2026, whose source note shows the last amendment as 89 FR 47054 (May 30, 2024), and the Federal Register final rule, 89 FR 47028; opened November 5, 2026: CFR Part 318 and final rule. We did not check for later amendments. In IHS's words:
| Section | What it asks | What answers it |
|---|---|---|
| 318.1(a) | Applies to foreign and domestic vendors of personal health records, PHR related entities and third party service providers that maintain information of U.S. citizens or residents, irrespective of any jurisdictional tests in the FTC Act. Does not apply to HIPAA-covered entities, or to any other entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity. | Applicability worksheet for counsel |
| 318.3(a) | After discovering a breach of security of unsecured PHR identifiable health information, a vendor (for information in a personal health record it maintains or offers) and a PHR related entity (for information obtained through its product or service) must notify each affected individual who is a citizen or resident of the United States, notify the FTC, and notify prominent media outlets serving a State or jurisdiction if the information of 500 or more residents of that State or jurisdiction is, or is reasonably believed to have been, acquired. | Incident procedure |
| 318.4(a) | Individual, media and service provider notices go out without unreasonable delay and no later than 60 calendar days after discovery, unless 318.4(d) law enforcement delay applies. | Decision calendar |
| 318.4(b), 318.5(c) | Notice to the FTC follows every breach. For 500 or more individuals it goes contemporaneously with the 318.4(a) notice. For fewer than 500 individuals the entity may keep a log and send it annually, no later than 60 calendar days after the end of the calendar year, covering the preceding year. | FTC notice step and breach log |
| 318.5(a) | Written notice at the last known address; electronic mail, which section 318.2 defines as email combined with a text message, within-application messaging or electronic banner, counts only if the individual specified it as the primary method of communication, and it must be clear and conspicuous. If contact information for ten or more individuals is insufficient or out of date after reasonable efforts, substitute notice is required: a 90-day home page posting or major media, with a toll-free number active at least 90 days. | Notice delivery plan |
| 318.6 | Plain language and, to the extent possible, five items: what happened, the types of information involved, steps individuals should take, what the entity is doing, and two or more contact channels. | Notice templates |
| 318.7 | A violation is treated as a violation of a rule under section 18 of the FTC Act regarding unfair or deceptive acts or practices, and so is subject to civil penalties, as adjusted for inflation under 16 CFR 1.98. | Reason to keep the procedure current |
What changed in the 2024 amendments?
Per the FTC's own summary, the final rule effective July 29, 2024 clarified coverage of developers of many health apps, modernized the method of notice, expanded notice content and altered the timing of notice to the FTC.
Does the rule apply to a health app, wearable or wellness company?
It can, and your counsel makes the call. In IHS's reading, the questions for a vendor of personal health records run in this order:
- Are you outside HIPAA? Section 318.1(a) excludes covered entities and business associate activities.
- Do you offer or maintain a personal health record? Section 318.2 defines it as an electronic record of PHR identifiable health information on an individual that has the technical capacity to draw information from multiple sources and is managed, shared and controlled by or primarily for the individual.
- Is the data PHR identifiable health information? It must relate to health, health care or payment for it, identify the individual or give a reasonable basis to believe it can, and be created or received by a covered health care provider, health plan, employer or health care clearinghouse, and include information provided by or on behalf of the individual. A covered health care provider includes any entity furnishing health care services or supplies, which the rule defines as any online service such as a website, mobile application or internet-connected device that provides mechanisms to track health conditions, fitness, sleep, diet and other listed items, or that provides other health-related services or tools.
The FTC's preamble to the final rule gives examples, which are illustrations, not rule text. A purely informational app with no tracking mechanism is not a personal health record. A symptom tracker is not one to the extent that the consumer is its only source of information. The same tracker that also collects geolocation data through an application programming interface is one.
These events are reasons to start a build: launching or buying a consumer health app or wearable outside HIPAA; adding a data source, which in IHS's reading is a reason to ask counsel to re-run the multiple-sources question; or finding health data going to a third party with no authorization record.
What counts as a breach of security, and when does the clock start?
A breach of security is the acquisition of unsecured PHR identifiable health information in a personal health record without the individual's authorization, including an acquisition that results from a data breach or an unauthorized disclosure (section 318.2). Unauthorized acquisition is presumed to include unauthorized access unless the entity has reliable evidence showing that there has not been, or could not reasonably have been, unauthorized acquisition.
Under section 318.3(c), a breach is treated as discovered on the first day it is known or reasonably should have been known to the entity. Knowledge of any employee, officer or agent other than the person committing the breach counts as the entity's knowledge.
How IHS helps
IHS runs five steps: a gap assessment of your incident handling against Part 318; a map of the health data you collect and where it goes; drafting of the missing procedures; a tabletop exercise script; and readiness support.
IHS drafts the data inventory, incident procedure, notice templates keyed to section 318.6, a media-notice decision step, an FTC log process and a service provider notice clause checklist. You supply product facts, incident facts, the sending of notices, and any FTC submission according to its instructions.
The real limit: IHS drafts. Your counsel decides whether the rule applies, and IHS does not send notices, submit to the FTC, or communicate with any regulator for you.
IHS was founded in 2002 and is led by Thomas G. Goddard, JD, PhD, former Chief Operating Officer and General Counsel of URAC.
What to have ready
- What your product does, what health information it collects, and whether you are or act for a HIPAA-covered entity (sections 318.1 and 318.2).
- Every source the product draws information from (section 318.2).
- Where health information is stored, which third party service providers hold it, their contracts and who receives breach notices (section 318.3(b)).
- Any incident response procedure and decision log, including how you would date discovery (sections 318.3(c) and 318.4(c)).
- How you would reach each affected individual, including who chose email (section 318.5(a)).
- How you would count individuals, and residents of each State, against the 500 thresholds (sections 318.3(a), 318.4(b)).
- Past incident records, notice templates and your counsel's contact.
If you want to start, the introductory call is free and is where IHS learns what you already have.
How does it compare with the HIPAA breach rule?
Section 318.1(a) excludes HIPAA-covered entities, and any other entity to the extent that it engages in activities as a business associate of one, from Part 318. Counsel decides which rule reaches which of your activities. See HIPAA breach notification response for the HIPAA duties. This page does not cover state consumer health data laws. See compliance services.
What does an FTC Health Breach Notification Rule program cost?
A violation is subject to civil penalties, as adjusted for inflation under 16 CFR 1.98; we state no penalty figure. IHS does not publish a price for this work and scopes each engagement after a free introductory call.
What this is not
- It is not legal advice and does not decide whether the rule applies to your product.
- It is not notice delivery or an FTC filing; IHS does not send notices or submit to the FTC.
- It is not a guarantee about how any regulator will view your response.
Frequently asked questions
Who must comply with the FTC Health Breach Notification Rule?
Vendors of personal health records, PHR related entities and third party service providers that maintain information of U.S. citizens or residents; HIPAA-covered entities are excluded, as is any other entity to the extent that it engages in activities as a business associate of one (section 318.1(a)). Counsel decides whether a product falls inside.
Does it apply to health apps and wearables?
It can. An app is a vendor of personal health records only if it offers or maintains a personal health record, which needs the technical capacity to draw information from multiple sources (section 318.2). A PHR related entity or third party service provider can also be covered without offering one (section 318.2). The FTC called the question a fact-intensive inquiry, so counsel decides.
How is it different from the HIPAA breach rule?
Part 318 does not apply to HIPAA-covered entities, or to any other entity to the extent that it engages in activities as a business associate of one (section 318.1(a)). Counsel decides which rule reaches which of your activities.
Is sharing health data with an advertiser or analytics vendor a breach of security?
It can be. Section 318.2 says a breach of security includes an unauthorized acquisition of unsecured PHR identifiable health information in a personal health record that occurs as a result of a data breach or an unauthorized disclosure. Whether the individual authorized a particular arrangement is a question for your counsel.
How soon must we notify?
Without unreasonable delay and in no case later than 60 calendar days after discovery of a breach of security, except where a law enforcement official determines that notice would impede a criminal investigation or cause damage to national security (section 318.4(d)).
When must we notify the FTC?
After every breach of security (section 318.5(c)). For 500 or more individuals the notice goes contemporaneously with the notices required by section 318.4(a). For fewer than 500 individuals the entity may keep a log and send it annually, no later than 60 calendar days after the end of the calendar year. Notices follow the FTC website's instructions, which we did not open.
What do we owe if we are a service provider to a health app?
A third party service provider must, after discovering a breach, notify an official designated in a written contract by the vendor or PHR related entity, or a senior official there if none is designated, obtain acknowledgment, and identify each affected customer (section 318.3(b)).
Does the consultant file with the FTC?
No. IHS does not send notices, submit anything to the FTC or communicate with any regulator for you.