FTC Rescinds 2021 Policy Statement on Health App Data Breaches

On September 9, 2026, the Federal Trade Commission (the “FTC”) rescinded its 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices. The Statement had clarified the FTC’s interpretation of the Health Breach Notification Rule, including that the Rule could apply to certain health apps and connected devices not covered by HIPAA that collect information from multiple sources, and that a “breach of security” could include not just cybersecurity incidents but also unauthorized disclosures to third parties.

The FTC has now concluded that the Statement is obsolete because its 2024 amendments to the Rule expressly addressed health apps, connected devices, and unauthorized disclosures, and that the rescission is consistent with its policy of avoiding unnecessary subregulatory guidance. 

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts