The FTC has rescinded a 2021 policy statement addressing data breaches involving health apps, fitness trackers and connected devices.
The agency says the change does not eliminate breach protections because those requirements were incorporated into an updated federal rule in 2024.
Consumers should not assume health apps have the same comprehensive privacy protections that apply to doctors, hospitals and health insurers under HIPAA.
The Federal Trade Commission has withdrawn a policy statement explaining how federal breach-notification requirements apply to health apps and connected devices—but that does not mean app companies are suddenly free to conceal breaches.
The commission rescinded its 2021 Statement on Breaches by Health Apps and Other Connected Devices on September 9. It called the guidance obsolete because the agency amended its legally enforceable Health Breach Notification Rule in 2024.
Those amendments expressly cover many health apps, fitness trackers and other products that collect consumers’ health information.
In practical terms, the policy document is going away, but the underlying notification requirements remain.
What the rule requires
The FTC’s rule generally applies to companies that maintain electronic personal health records but are not regulated by the Health Insurance Portability and Accountability Act, better known as HIPAA.
Covered companies may include makers of fitness, diet, medication, fertility and health-monitoring apps. Connected blood-pressure cuffs, glucose monitors and wearable fitness devices may also fall under the rule.
When a company experiences a breach of unsecured, personally identifiable health information, it generally must notify:
Each affected consumer;
The FTC; and
News organizations in certain cases involving at least 500 people in a state or territory.
Consumer notices must ordinarily be sent without unreasonable delay and no later than 60 days after the breach is discovered.
The rule covers more than conventional computer hacking. An app’s unauthorized disclosure of identifiable health information to an advertising platform or another company may also qualify as a breach.
Does the FTC action weaken consumer protection?
On its own, the withdrawal does not repeal the Health Breach Notification Rule or the 2024 amendments.
The FTC said the earlier policy statement became unnecessary after the rule was updated. The formal regulation now makes clear that health apps and connected devices can be subject to its requirements.
However, the development highlights a continuing source of confusion: Information entered into a commercial health app is not necessarily protected by HIPAA.
HIPAA generally applies to health plans, health care providers and certain companies that handle information on their behalf. An independently downloaded fitness or fertility app may operate outside that system.
The FTC can still act against companies that fail to provide required breach notices or make misleading promises about how they collect, protect or share health data.
Sensitive information may extend beyond medical records
Health apps can collect intimate information, including diagnoses, medication use, menstrual cycles, pregnancies, miscarriages, mental-health symptoms, heart rates and sleeping patterns.
They may also collect email addresses, birth dates, precise locations, mobile-device identifiers and information obtained from connected devices.
Even when a consumer’s name is not attached, several pieces of information can sometimes be combined to identify that person. Health data used for advertising or other unauthorized purposes can expose consumers to embarrassment, discrimination, scams and medical identity theft.
What consumers can do
Before downloading an app, consumers should review its privacy policy and look for a clear explanation of:
What information is collected;
Whether information is sold or shared;
Which companies receive it;
How long the data is retained; and
Whether users can delete their information and accounts.
Consumers should also review app permissions and turn off access to location, contacts, photos or other data that is not necessary for the service. Apps and phone operating systems should be updated regularly to install security fixes.
Anyone receiving a health-data breach notice should change affected passwords and avoid reusing the same password elsewhere. If Social Security numbers, insurance information, or financial accounts were exposed, additional steps may include freezing credit, monitoring insurance statements and checking medical records for unfamiliar treatment or claims.
The FTC’s action may sound like a retreat from health-app oversight, but the agency says the operative breach requirements remain intact. The larger concern for consumers is that those requirements mainly guarantee notification after certain breaches—not complete control over how every health app collects and uses sensitive information.