FTC Withdraws Obsolete 2021 Policy Statement on Health Apps Following Rule Modernization

The U.S. Federal Trade Commission (FTC) has officially rescinded its 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices. Initially issued to address regulatory gaps surrounding consumer digital health tools, the policy clarified that developers of health tracking applications and connected hardware were subject to the FTC's Health Breach Notification Rule (HBNR). Following the formal modernization of the HBNR in 2024, the commission determined that the interim policy statement had become redundant and could cause confusion among covered entities.

Evolution of Health Data Privacy Enforcement

Historically, consumer digital health applications fell into a legal gray area because many non-traditional wellness tools were outside the scope of HIPAA. The FTC utilized its 2021 policy to bridge this gap, asserting that unauthorized disclosures of health information—including tracking pixels sharing sensitive personal records with advertisers—constituted reportable breaches under the HBNR. With the codification of the revised rules in 2024, the updated HBNR explicitly incorporates direct-to-consumer health services, connected wellness trackers, and third-party data analytics pipelines into binding federal law.

Actionable Guidance for Digital Health Vendors

• Review Third-Party Trackers: Audit tracking pixels, software development kits (SDKs), and embedded analytics across digital health platforms to avoid unauthorized dissemination of sensitive customer metrics.
• Align Notification Workflows: Update corporate breach response plans to comply strictly with the updated HBNR timelines, ensuring regulatory reporting obligations are fully met.
• Adopt Privacy-by-Design: Enforce strict data minimization policies and end-to-end encryption for all consumer health telemetry and cloud-stored records.

---

แหล่งที่มา: DataBreaches.net เผยแพร่ครั้งแรก: Thu, 10 Sep 2026 13:40:00 +0000 บทความต้นฉบับ: อ่านต้นฉบับ