FTC Health Breach Notification Rule
HBNRThe HBNR requires vendors of personal health records and related entities outside HIPAA to notify individuals, the FTC, and sometimes the media after a breach of unsecured identifiable health information. The 2024 amendments (effective July 29, 2024) confirm the rule covers health apps and treat unauthorized disclosures, not just hacks, as breaches.
Jurisdiction
United States
Jurisdiction Type
federal
Country
United States
Effective Date
9/24/2009
Enforcing Authority
Federal Trade Commission
Maximum Fine
Up to $50,120 per violation per day
Fines Under This Regulation
0
Total Fine Amount (USD)
--
Privacy Topics
health_databreach_notificationhealth_apps
Key Articles
| Article | Description |
|---|---|
| §318.1 | Purpose and scope |
| §318.2 | Definitions |
| §318.3 | Breach notification requirement |
| §318.4 | Timeliness |
| §318.5 | Methods of notice |
| §318.6 | Content of notice |