Health information does not become protected by HIPAA simply because it is sensitive, medical, or collected by an app. That assumption is understandable, but it can leave consumers with an inaccurate picture of their rights and developers with an incomplete compliance plan. Federal health privacy is divided among different laws and regulators, and one of the most important rules for consumer-facing health technology comes from the Federal Trade Commission.
The Department of Health and Human Services explains that HIPAA generally applies to covered health plans, qualifying health care providers, health care clearinghouses, and their business associates. HHS also states plainly that an entity outside the definitions of covered entity or business associate does not have to comply with the HIPAA Rules. That means a wellness app, fitness service, fertility tracker, or connected device may handle deeply personal information without being governed by HIPAA in the same way as a hospital or health plan. HHS guidance on covered entities and business associates
That gap does not mean there are no federal obligations. The FTC’s Health Breach Notification Rule applies to vendors of personal health records, personal-health-record-related entities, and certain third-party service providers that maintain information concerning U.S. citizens or residents. It expressly excludes HIPAA-covered entities and activities performed as a business associate of one. The rule implements provisions of the American Recovery and Reinvestment Act of 2009. It is an existing federal regulation, not a new bill awaiting a congressional vote.
The FTC finalized amendments in 2024 to clarify how the rule reaches modern consumer health technology. The final rule was published May 30, 2024, and the amendments became effective July 29, 2024. The agency explained that the changes clarify coverage of many health apps, modernize notice methods, expand required notice content, and confirm that a breach can include an unauthorized disclosure—not only a cybersecurity intrusion. Federal Register final rule
The current regulation defines “health care services or supplies” broadly enough to include websites, mobile apps, and internet-connected devices that help people track matters such as diseases, medications, vital signs, symptoms, fitness, fertility, sexual health, sleep, mental health, genetics, or diet. A “personal health record” is an electronic record of identifiable health information that has the technical capacity to draw information from multiple sources and is managed, shared, and controlled by or primarily for the individual. Coverage still requires analysis of the complete definitions; the fact that software mentions health does not automatically resolve every question. Current text of 16 CFR Part 318
The expanded understanding of a breach is especially important for development teams. Under the current rule, a breach includes unauthorized acquisition resulting from either a data breach or an unauthorized disclosure. A malicious outsider breaking into a database is one example, but it is not the only one. Sending identifiable health information to an advertising, analytics, or other technology provider without authorization may raise a different kind of breach question.
That does not mean every third-party network request is automatically a violation. The technical facts and the legal definitions matter: what information was sent, whether it was identifiable health information, where it originated, which entities were involved, what the user authorized, and whether the record could draw from multiple sources. Developers should be able to answer those questions with evidence rather than relying on a generic privacy-policy sentence.
The rule’s notice duties are concrete. Following discovery of a covered breach, vendors and related entities must notify affected individuals and the FTC. If the breach involves 500 or more residents of a state or jurisdiction, prominent media outlets serving that area must also be notified. A third-party service provider must notify the appropriate official at the vendor or related entity and obtain acknowledgment that the notice was received. The rule treats a breach as discovered when it is known or reasonably should have been known, including knowledge attributable to employees, officers, or other agents as specified in the regulation.
Required notifications generally must be sent without unreasonable delay and no later than 60 calendar days after discovery. For breaches involving 500 or more individuals, FTC notice must be provided at the same time as the required individual notice. Smaller incidents may be logged and reported to the FTC annually within the rule’s deadline. The notice to individuals must use plain language and include, where possible, what happened, the dates, the types of information involved, protective steps, the entity’s response, and ways to ask questions. FTC rule summary and official resources
The FTC has shown that unauthorized advertising disclosures are not merely theoretical. In February 2023, the agency announced its first enforcement action under the rule against GoodRx. The FTC alleged that the company disclosed identifiable health information to advertising platforms and others without providing required notifications. The announced proposed order included a $1.5 million civil penalty and restrictions on health-data sharing for advertising. The case preceded the 2024 amendments, but it illustrates the agency’s view that an unauthorized disclosure can trigger breach-notification duties. FTC’s GoodRx enforcement announcement
For developers, the practical response begins with a data-flow inventory. List the health-related fields, user identifiers, device identifiers, URLs, event names, and derived attributes a product handles. Then map every destination: internal databases, crash reporting, customer support, analytics, advertising, cloud storage, and external APIs. Review whether each transfer is expected, necessary, disclosed, and authorized. An SDK that was harmless on a general marketing page may create a different risk when placed inside a medication, fertility, or mental-health workflow.
Incident planning should reflect that broader view. Monitoring should detect unexpected outbound disclosures as well as unauthorized access. Contracts should identify who receives breach notices and how receipt is acknowledged. Logs should support a reliable discovery date, affected-user count, and reconstruction of the information transmitted. Product, security, privacy, and legal teams should know who starts the notification analysis and who preserves the evidence.
For consumers, the lesson is equally direct: do not assume that a health-themed service is covered by HIPAA. Review who operates it, what it collects, where it sends information, and what controls it provides. For developers, the absence of HIPAA coverage is not the end of the analysis. The FTC’s rule exists precisely because consumer health records can sit outside the traditional medical system while remaining intensely personal.
About Joseph Sides
Joseph Sides is a South Florida-based data privacy advocate, consultant, and entrepreneur whose work focuses on consumer rights, digital transparency, website tracking, meaningful privacy choices, and responsible technology. His public DEV introduction describes a bachelor’s degree in criminology, a minor in business, and training in data analytics. These interests connect questions about how technology operates with questions about what people understand and how organizations remain accountable for their decisions.
The educational purpose of these articles is to make privacy developments easier to follow and their practical implications easier to examine. That means connecting the language of laws and regulatory actions with familiar experiences: visiting a website, choosing an app, responding to a consent request, or trying to delete information. For developers, the discussion also considers how interface choices and data practices shape the choices available to consumers. The aim is informed understanding and thoughtful questions, with attention to both individual rights and responsible product decisions.
Educational Information — Not Legal Advice
This article provides general education and commentary, not legal advice. Joseph writes as a privacy advocate and consultant, not as an attorney. Reading this article does not create an attorney-client relationship, and the discussion is not a substitute for advice from a qualified attorney about your particular circumstances.
Laws, interpretations, applicability, exemptions, and deadlines vary by jurisdiction and can change. A requirement that applies to one organization or activity may apply differently to another. Readers should consult current primary sources and a qualified attorney when evaluating obligations, available rights, or a specific course of action. This article does not promise complete coverage, guaranteed outcomes, or personal legal guidance.
AI Disclosure
Prepared with AI assistance.
Top comments (0)