Privacy Law Library

FTC Health Breach Notification Rule

HBNR

Health · Breach notification

The HBNR requires vendors of personal health records and related entities outside HIPAA to notify individuals, the FTC, and sometimes the media after a breach of unsecured identifiable health information. The 2024 amendments (effective July 29, 2024) confirm the rule covers health apps and treat unauthorized disclosures, not just hacks, as breaches.

Where
Federal
Citation
42 U.S.C. 17937 (ARRA section 13407); 16 CFR Part 318
Status
In force
In force since
2009-09-24
Last amended
2024-07-29
Enforced by
Federal Trade Commission
People can sue
No
Penalties
Violations are treated as FTC rule violations: civil penalties up to $53,088 per violation (16 CFR 1.98, inflation-adjusted amount in force since Jan. 17, 2025).
Applies to
  • Vendors of personal health records and PHR related entities that are not HIPAA covered entities or business associates (including many health apps)
  • Third party service providers to those vendors

What a privacy notice must say

  • Notices must include required content, such as what happened, the data involved, steps individuals should take, and contact procedures.16 CFR 318.6

Breach duties

  • After discovering a breach of security of unsecured PHR identifiable health information, notify each affected U.S. individual and the FTC.16 CFR 318.3(a)(1)-(2)
  • Notify prominent media outlets when 500 or more residents of a state or jurisdiction are affected.16 CFR 318.3(a)(3)
  • Send individual and media notices without unreasonable delay and no later than 60 calendar days after discovery.16 CFR 318.4(a)
  • Notify the FTC at the same time as individuals for breaches affecting 500 or more people; smaller breaches may be logged and reported annually within 60 days after year end.16 CFR 318.4(b)
  • Third party service providers must notify the vendor or PHR related entity after discovering a breach.16 CFR 318.3(b)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: 16 CFR 318.6 content elements were cited from the section heading only

Research reference, not legal advice.